Merge tag 'regmap-3.4' into regmap-stride

regmap: Last minute bug fix for 3.4

This is a last minute bug fix that was only just noticed since the code
path that's being exercised here is one that is fairly rarely used.  The
changelog for the change itself is extremely clear and the code itself
is obvious to inspection so should be pretty safe.

Conflicts:
	drivers/base/regmap/regmap.c (overlap between the fix and stride code)

993 files changed, 9912 insertions, 6699 deletions

diff --git a/Documentation/ABI/stable/sysfs-driver-usb-usbtmc b/Documentation/ABI/stable/sysfs-driver-usb-usbtmc
index 2a7f9a00cb0a..e960cd027e1e 100644
--- a/Documentation/ABI/stable/sysfs-driver-usb-usbtmc
+++ b/Documentation/ABI/stable/sysfs-driver-usb-usbtmc
@@ -1,5 +1,5 @@
-What:           /sys/bus/usb/drivers/usbtmc/devices/*/interface_capabilities
-What:           /sys/bus/usb/drivers/usbtmc/devices/*/device_capabilities
+What:           /sys/bus/usb/drivers/usbtmc/*/interface_capabilities
+What:           /sys/bus/usb/drivers/usbtmc/*/device_capabilities
 Date:           August 2008
 Contact:        Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 Description:
@@ -12,8 +12,8 @@ Description:
                 The files are read only.
 
 
-What:           /sys/bus/usb/drivers/usbtmc/devices/*/usb488_interface_capabilities
-What:           /sys/bus/usb/drivers/usbtmc/devices/*/usb488_device_capabilities
+What:           /sys/bus/usb/drivers/usbtmc/*/usb488_interface_capabilities
+What:           /sys/bus/usb/drivers/usbtmc/*/usb488_device_capabilities
 Date:           August 2008
 Contact:        Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 Description:
@@ -27,7 +27,7 @@ Description:
                 The files are read only.
 
 
-What:           /sys/bus/usb/drivers/usbtmc/devices/*/TermChar
+What:           /sys/bus/usb/drivers/usbtmc/*/TermChar
 Date:           August 2008
 Contact:        Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 Description:
@@ -40,7 +40,7 @@ Description:
                 sent to the device or not.
 
 
-What:           /sys/bus/usb/drivers/usbtmc/devices/*/TermCharEnabled
+What:           /sys/bus/usb/drivers/usbtmc/*/TermCharEnabled
 Date:           August 2008
 Contact:        Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 Description:
@@ -51,7 +51,7 @@ Description:
                 published by the USB-IF.
 
 
-What:           /sys/bus/usb/drivers/usbtmc/devices/*/auto_abort
+What:           /sys/bus/usb/drivers/usbtmc/*/auto_abort
 Date:           August 2008
 Contact:        Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 Description:
diff --git a/Documentation/ABI/testing/sysfs-block-rssd b/Documentation/ABI/testing/sysfs-block-rssd
new file mode 100644
index 000000000000..d535757799fe
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-block-rssd
@@ -0,0 +1,18 @@
+What:           /sys/block/rssd*/registers
+Date:           March 2012
+KernelVersion:  3.3
+Contact:        Asai Thambi S P <asamymuthupa@micron.com>
+Description:    This is a read-only file. Dumps below driver information and
+                hardware registers.
+                    - S ACTive
+                    - Command Issue
+                    - Allocated
+                    - Completed
+                    - PORT IRQ STAT
+                    - HOST IRQ STAT
+
+What:           /sys/block/rssd*/status
+Date:           April 2012
+KernelVersion:  3.4
+Contact:        Asai Thambi S P <asamymuthupa@micron.com>
+Description:   This is a read-only file. Indicates the status of the device.
diff --git a/Documentation/ABI/testing/sysfs-bus-hsi b/Documentation/ABI/testing/sysfs-bus-hsi
new file mode 100644
index 000000000000..1b1b282a99e1
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-bus-hsi
@@ -0,0 +1,19 @@
+What:           /sys/bus/hsi
+Date:           April 2012
+KernelVersion:  3.4
+Contact:        Carlos Chinea <carlos.chinea@nokia.com>
+Description:
+                High Speed Synchronous Serial Interface (HSI) is a
+                serial interface mainly used for connecting application
+                engines (APE) with cellular modem engines (CMT) in cellular
+                handsets.
+                The bus will be populated with devices (hsi_clients) representing
+                the protocols available in the system. Bus drivers implement
+                those protocols.
+
+What:           /sys/bus/hsi/devices/.../modalias
+Date:           April 2012
+KernelVersion:  3.4
+Contact:        Carlos Chinea <carlos.chinea@nokia.com>
+Description:    Stores the same MODALIAS value emitted by uevent
+                Format: hsi:<hsi_client device name>
diff --git a/Documentation/ABI/testing/sysfs-cfq-target-latency b/Documentation/ABI/testing/sysfs-cfq-target-latency
new file mode 100644
index 000000000000..df0f7828c5e3
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-cfq-target-latency
@@ -0,0 +1,8 @@
+What:           /sys/block/<device>/iosched/target_latency
+Date:           March 2012
+contact:        Tao Ma <boyu.mt@taobao.com>
+Description:
+                The /sys/block/<device>/iosched/target_latency only exists
+                when the user sets cfq to /sys/block/<device>/scheduler.
+                It contains an estimated latency time for the cfq. cfq will
+                use it to calculate the time slice used for every task.
diff --git a/Documentation/DocBook/media/v4l/pixfmt-nv12m.xml b/Documentation/DocBook/media/v4l/pixfmt-nv12m.xml
index 3fd3ce5df270..5274c24d11e0 100644
--- a/Documentation/DocBook/media/v4l/pixfmt-nv12m.xml
+++ b/Documentation/DocBook/media/v4l/pixfmt-nv12m.xml
@@ -1,6 +1,6 @@
     <refentry id="V4L2-PIX-FMT-NV12M">
       <refmeta>
-        <refentrytitle>V4L2_PIX_FMT_NV12M ('NV12M')</refentrytitle>
+        <refentrytitle>V4L2_PIX_FMT_NV12M ('NM12')</refentrytitle>
         &manvol;
       </refmeta>
       <refnamediv>
diff --git a/Documentation/DocBook/media/v4l/pixfmt-yuv420m.xml b/Documentation/DocBook/media/v4l/pixfmt-yuv420m.xml
index 9957863daf18..60308f1eefdf 100644
--- a/Documentation/DocBook/media/v4l/pixfmt-yuv420m.xml
+++ b/Documentation/DocBook/media/v4l/pixfmt-yuv420m.xml
@@ -1,6 +1,6 @@
     <refentry id="V4L2-PIX-FMT-YUV420M">
       <refmeta>
-        <refentrytitle>V4L2_PIX_FMT_YUV420M ('YU12M')</refentrytitle>
+        <refentrytitle>V4L2_PIX_FMT_YUV420M ('YM12')</refentrytitle>
         &manvol;
       </refmeta>
       <refnamediv>
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index 4c95c0034a4b..9b1067afb224 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -34,8 +34,7 @@ Current Status: linux-2.6.34-mmotm(development version of 2010/April)
 
 Features:
  - accounting anonymous pages, file caches, swap caches usage and limiting them.
- - private LRU and reclaim routine. (system's global LRU and private LRU
-   work independently from each other)
+ - pages are linked to per-memcg LRU exclusively, and there is no global LRU.
  - optionally, memory+swap usage can be accounted and limited.
  - hierarchical accounting
  - soft limit
@@ -154,7 +153,7 @@ updated. page_cgroup has its own LRU on cgroup.
 2.2.1 Accounting details
 
 All mapped anon pages (RSS) and cache pages (Page Cache) are accounted.
-Some pages which are never reclaimable and will not be on the global LRU
+Some pages which are never reclaimable and will not be on the LRU
 are not accounted. We just account pages under usual VM management.
 
 RSS pages are accounted at page_fault unless they've already been accounted
diff --git a/Documentation/devicetree/bindings/ata/calxeda-sata.txt b/Documentation/devicetree/bindings/ata/ahci-platform.txt
index 79caa5651f53..8bb8a76d42e8 100644
--- a/Documentation/devicetree/bindings/ata/calxeda-sata.txt
+++ b/Documentation/devicetree/bindings/ata/ahci-platform.txt
@@ -1,10 +1,10 @@
-* Calxeda SATA Controller
+* AHCI SATA Controller
 
 SATA nodes are defined to describe on-chip Serial ATA controllers.
 Each SATA controller should have its own node.
 
 Required properties:
-- compatible        : compatible list, contains "calxeda,hb-ahci"
+- compatible        : compatible list, contains "calxeda,hb-ahci" or "snps,spear-ahci"
 - interrupts        : <interrupt mapping for SATA IRQ>
 - reg               : <registers mapping>
 
@@ -14,4 +14,3 @@ Example:
                 reg = <0xffe08000 0x1000>;
                 interrupts = <115>;
         };
-
diff --git a/Documentation/devicetree/bindings/sound/sgtl5000.txt b/Documentation/devicetree/bindings/sound/sgtl5000.txt
index 2c3cd413f042..9cc44449508d 100644
--- a/Documentation/devicetree/bindings/sound/sgtl5000.txt
+++ b/Documentation/devicetree/bindings/sound/sgtl5000.txt
@@ -3,6 +3,8 @@
 Required properties:
 - compatible : "fsl,sgtl5000".
 
+- reg : the I2C address of the device
+
 Example:
 
 codec: sgtl5000@0a {
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 709e08e9a222..03ca210406ed 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -531,3 +531,11 @@ Why:	There appear to be no production users of the get_robust_list syscall,
         of ASLR. It was only ever intended for debugging, so it should be
         removed.
 Who:    Kees Cook <keescook@chromium.org>
+
+----------------------------
+
+What:   setitimer accepts user NULL pointer (value)
+When:   3.6
+Why:    setitimer is not returning -EFAULT if user pointer is NULL. This
+        violates the spec.
+Who:    Sasikantha Babu <sasikanth.v19@gmail.com>
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index e916e3d36488..0d0492028082 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -114,7 +114,7 @@ members are defined:
 struct file_system_type {
         const char *name;
         int fs_flags;
-        struct dentry (*mount) (struct file_system_type *, int,
+        struct dentry *(*mount) (struct file_system_type *, int,
                        const char *, void *);
         void (*kill_sb) (struct super_block *);
         struct module *owner;
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index bd80ba5847d2..1619a8c80873 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -147,7 +147,7 @@ tcp_adv_win_scale - INTEGER
         (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
         if it is <= 0.
         Possible values are [-31, 31], inclusive.
-        Default: 2
+        Default: 1
 
 tcp_allowed_congestion_control - STRING
         Show/set the congestion control choices available to non-privileged
@@ -410,7 +410,7 @@ tcp_rmem - vector of 3 INTEGERs: min, default, max
         net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
         automatic tuning of that socket's receive buffer size, in which
         case this value is ignored.
-        Default: between 87380B and 4MB, depending on RAM size.
+        Default: between 87380B and 6MB, depending on RAM size.
 
 tcp_sack - BOOLEAN
         Enable select acknowledgments (SACKS).
diff --git a/Documentation/power/freezing-of-tasks.txt b/Documentation/power/freezing-of-tasks.txt
index ec715cd78fbb..6ec291ea1c78 100644
--- a/Documentation/power/freezing-of-tasks.txt
+++ b/Documentation/power/freezing-of-tasks.txt
@@ -9,7 +9,7 @@ architectures).
 
 II. How does it work?
 
-There are four per-task flags used for that, PF_NOFREEZE, PF_FROZEN, TIF_FREEZE
+There are three per-task flags used for that, PF_NOFREEZE, PF_FROZEN
 and PF_FREEZER_SKIP (the last one is auxiliary).  The tasks that have
 PF_NOFREEZE unset (all user space processes and some kernel threads) are
 regarded as 'freezable' and treated in a special way before the system enters a
@@ -17,30 +17,31 @@ suspend state as well as before a hibernation image is created (in what follows
 we only consider hibernation, but the description also applies to suspend).
 
 Namely, as the first step of the hibernation procedure the function
-freeze_processes() (defined in kernel/power/process.c) is called.  It executes
-try_to_freeze_tasks() that sets TIF_FREEZE for all of the freezable tasks and
-either wakes them up, if they are kernel threads, or sends fake signals to them,
-if they are user space processes.  A task that has TIF_FREEZE set, should react
-to it by calling the function called __refrigerator() (defined in
-kernel/freezer.c), which sets the task's PF_FROZEN flag, changes its state
-to TASK_UNINTERRUPTIBLE and makes it loop until PF_FROZEN is cleared for it.
-Then, we say that the task is 'frozen' and therefore the set of functions
-handling this mechanism is referred to as 'the freezer' (these functions are
-defined in kernel/power/process.c, kernel/freezer.c & include/linux/freezer.h).
-User space processes are generally frozen before kernel threads.
+freeze_processes() (defined in kernel/power/process.c) is called.  A system-wide
+variable system_freezing_cnt (as opposed to a per-task flag) is used to indicate
+whether the system is to undergo a freezing operation. And freeze_processes()
+sets this variable.  After this, it executes try_to_freeze_tasks() that sends a
+fake signal to all user space processes, and wakes up all the kernel threads.
+All freezable tasks must react to that by calling try_to_freeze(), which
+results in a call to __refrigerator() (defined in kernel/freezer.c), which sets
+the task's PF_FROZEN flag, changes its state to TASK_UNINTERRUPTIBLE and makes
+it loop until PF_FROZEN is cleared for it. Then, we say that the task is
+'frozen' and therefore the set of functions handling this mechanism is referred
+to as 'the freezer' (these functions are defined in kernel/power/process.c,
+kernel/freezer.c & include/linux/freezer.h). User space processes are generally
+frozen before kernel threads.
 
 __refrigerator() must not be called directly.  Instead, use the
 try_to_freeze() function (defined in include/linux/freezer.h), that checks
-the task's TIF_FREEZE flag and makes the task enter __refrigerator() if the
-flag is set.
+if the task is to be frozen and makes the task enter __refrigerator().
 
 For user space processes try_to_freeze() is called automatically from the
 signal-handling code, but the freezable kernel threads need to call it
 explicitly in suitable places or use the wait_event_freezable() or
 wait_event_freezable_timeout() macros (defined in include/linux/freezer.h)
-that combine interruptible sleep with checking if TIF_FREEZE is set and calling
-try_to_freeze().  The main loop of a freezable kernel thread may look like the
-following one:
+that combine interruptible sleep with checking if the task is to be frozen and
+calling try_to_freeze().  The main loop of a freezable kernel thread may look
+like the following one:
 
         set_freezable();
         do {
@@ -53,7 +54,7 @@ following one:
 (from drivers/usb/core/hub.c::hub_thread()).
 
 If a freezable kernel thread fails to call try_to_freeze() after the freezer has
-set TIF_FREEZE for it, the freezing of tasks will fail and the entire
+initiated a freezing operation, the freezing of tasks will fail and the entire
 hibernation operation will be cancelled.  For this reason, freezable kernel
 threads must call try_to_freeze() somewhere or use one of the
 wait_event_freezable() and wait_event_freezable_timeout() macros.
diff --git a/Documentation/security/keys.txt b/Documentation/security/keys.txt
index 787717091421..d389acd31e19 100644
--- a/Documentation/security/keys.txt
+++ b/Documentation/security/keys.txt
@@ -123,7 +123,7 @@ KEY SERVICE OVERVIEW
 
 The key service provides a number of features besides keys:
 
- (*) The key service defines two special key types:
+ (*) The key service defines three special key types:
 
      (+) "keyring"
 
@@ -137,6 +137,18 @@ The key service provides a number of features besides keys:
          blobs of data. These can be created, updated and read by userspace,
          and aren't intended for use by kernel services.
 
+     (+) "logon"
+
+         Like a "user" key, a "logon" key has a payload that is an arbitrary
+         blob of data. It is intended as a place to store secrets which are
+         accessible to the kernel but not to userspace programs.
+
+         The description can be arbitrary, but must be prefixed with a non-zero
+         length string that describes the key "subclass". The subclass is
+         separated from the rest of the description by a ':'. "logon" keys can
+         be created and updated from userspace, but the payload is only
+         readable from kernel space.
+
  (*) Each process subscribes to three keyrings: a thread-specific keyring, a
      process-specific keyring, and a session-specific keyring.
 
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index d97d992ced14..03f7897c6414 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -43,7 +43,9 @@ ALC680
 
 ALC882/883/885/888/889
 ======================
-  N/A
+  acer-aspire-4930g     Acer Aspire 4930G/5930G/6530G/6930G/7730G
+  acer-aspire-8930g     Acer Aspire 8330G/6935G
+  acer-aspire           Acer Aspire others
 
 ALC861/660
 ==========
diff --git a/Documentation/usb/URB.txt b/Documentation/usb/URB.txt
index 8ffce746d496..00d2c644068e 100644
--- a/Documentation/usb/URB.txt
+++ b/Documentation/usb/URB.txt
@@ -168,6 +168,28 @@ that if the completion handler or anyone else tries to resubmit it
 they will get a -EPERM error.  Thus you can be sure that when
 usb_kill_urb() returns, the URB is totally idle.
 
+There is a lifetime issue to consider.  An URB may complete at any
+time, and the completion handler may free the URB.  If this happens
+while usb_unlink_urb or usb_kill_urb is running, it will cause a
+memory-access violation.  The driver is responsible for avoiding this,
+which often means some sort of lock will be needed to prevent the URB
+from being deallocated while it is still in use.
+
+On the other hand, since usb_unlink_urb may end up calling the
+completion handler, the handler must not take any lock that is held
+when usb_unlink_urb is invoked.  The general solution to this problem
+is to increment the URB's reference count while holding the lock, then
+drop the lock and call usb_unlink_urb or usb_kill_urb, and then
+decrement the URB's reference count.  You increment the reference
+count by calling
+
+        struct urb *usb_get_urb(struct urb *urb)
+
+(ignore the return value; it is the same as the argument) and
+decrement the reference count by calling usb_free_urb.  Of course,
+none of this is necessary if there's no danger of the URB being freed
+by the completion handler.
+
 
 1.7. What about the completion handler?
 
diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt
index 5335fa8b06eb..c42bb9cd3b43 100644
--- a/Documentation/usb/usbmon.txt
+++ b/Documentation/usb/usbmon.txt
@@ -183,10 +183,10 @@ An input control transfer to get a port status.
 d5ea89a0 3575914555 S Ci:1:001:0 s a3 00 0000 0003 0004 4 <
 d5ea89a0 3575914560 C Ci:1:001:0 0 4 = 01050000
 
-An output bulk transfer to send a SCSI command 0x5E in a 31-byte Bulk wrapper
-to a storage device at address 5:
+An output bulk transfer to send a SCSI command 0x28 (READ_10) in a 31-byte
+Bulk wrapper to a storage device at address 5:
 
-dd65f0e8 4128379752 S Bo:1:005:2 -115 31 = 55534243 5e000000 00000000 00000600 00000000 00000000 00000000 000000
+dd65f0e8 4128379752 S Bo:1:005:2 -115 31 = 55534243 ad000000 00800000 80010a28 20000000 20000040 00000000 000000
 dd65f0e8 4128379808 C Bo:1:005:2 0 31 >
 
 * Raw binary format and API
diff --git a/MAINTAINERS b/MAINTAINERS
index 2dcfca850639..707163365a93 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1521,8 +1521,8 @@ M:	Gustavo Padovan <gustavo@padovan.org>
 M:      Johan Hedberg <johan.hedberg@gmail.com>
 L:      linux-bluetooth@vger.kernel.org
 W:      http://www.bluez.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jh/bluetooth.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
 S:      Maintained
 F:      drivers/bluetooth/
 
@@ -1532,8 +1532,8 @@ M:	Gustavo Padovan <gustavo@padovan.org>
 M:      Johan Hedberg <johan.hedberg@gmail.com>
 L:      linux-bluetooth@vger.kernel.org
 W:      http://www.bluez.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jh/bluetooth.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
 S:      Maintained
 F:      net/bluetooth/
 F:      include/net/bluetooth/
@@ -1968,10 +1968,7 @@ S:	Maintained
 F:      drivers/net/ethernet/ti/cpmac.c
 
 CPU FREQUENCY DRIVERS
-M:      Dave Jones <davej@redhat.com>
 L:      cpufreq@vger.kernel.org
-W:      http://www.codemonkey.org.uk/projects/cpufreq/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq.git
 S:      Maintained
 F:      drivers/cpufreq/
 F:      include/linux/cpufreq.h
@@ -2321,9 +2318,9 @@ S:	Supported
 F:      drivers/acpi/dock.c
 
 DOCUMENTATION
-M:      Randy Dunlap <rdunlap@xenotime.net>
+M:      Rob Landley <rob@landley.net>
 L:      linux-doc@vger.kernel.org
-T:      quilt http://xenotime.net/kernel-doc-patches/current/
+T:      TBD
 S:      Maintained
 F:      Documentation/
 
@@ -3592,6 +3589,7 @@ S:	Supported
 F:      drivers/net/wireless/iwlegacy/
 
 INTEL WIRELESS WIFI LINK (iwlwifi)
+M:      Johannes Berg <johannes.berg@intel.com>
 M:      Wey-Yi Guy <wey-yi.w.guy@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
@@ -4533,8 +4531,7 @@ S:	Supported
 F:      drivers/net/ethernet/myricom/myri10ge/
 
 NATSEMI ETHERNET DRIVER (DP8381x)
-M:      Tim Hockin <thockin@hockin.org>
-S:      Maintained
+S:      Orphan
 F:      drivers/net/ethernet/natsemi/natsemi.c
 
 NATIVE INSTRUMENTS USB SOUND INTERFACE DRIVER
@@ -4803,6 +4800,7 @@ F:	arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
 F:      arch/arm/mach-omap2/clockdomain44xx.c
 
 OMAP AUDIO SUPPORT
+M:      Peter Ujfalusi <peter.ujfalusi@ti.com>
 M:      Jarkko Nikula <jarkko.nikula@bitmer.com>
 L:      alsa-devel@alsa-project.org (subscribers-only)
 L:      linux-omap@vger.kernel.org
@@ -5117,6 +5115,11 @@ F:	drivers/i2c/busses/i2c-pca-*
 F:      include/linux/i2c-algo-pca.h
 F:      include/linux/i2c-pca-platform.h
 
+PCDP - PRIMARY CONSOLE AND DEBUG PORT
+M:      Khalid Aziz <khalid.aziz@hp.com>
+S:      Maintained
+F:      drivers/firmware/pcdp.*
+
 PCI ERROR RECOVERY
 M:     Linas Vepstas <linasvepstas@gmail.com>
 L:      linux-pci@vger.kernel.org
@@ -5886,11 +5889,11 @@ F:	Documentation/scsi/st.txt
 F:      drivers/scsi/st*
 
 SCTP PROTOCOL
-M:      Vlad Yasevich <vladislav.yasevich@hp.com>
+M:      Vlad Yasevich <vyasevich@gmail.com>
 M:      Sridhar Samudrala <sri@us.ibm.com>
 L:      linux-sctp@vger.kernel.org
 W:      http://lksctp.sourceforge.net
-S:      Supported
+S:      Maintained
 F:      Documentation/networking/sctp.txt
 F:      include/linux/sctp.h
 F:      include/net/sctp/
@@ -6466,6 +6469,7 @@ S:	Odd Fixes
 F:      drivers/staging/olpc_dcon/
 
 STAGING - OZMO DEVICES USB OVER WIFI DRIVER
+M:      Rupesh Gujare <rgujare@ozmodevices.com>
 M:      Chris Kelly <ckelly@ozmodevices.com>
 S:      Maintained
 F:      drivers/staging/ozwpan/
@@ -7461,8 +7465,7 @@ F:	include/linux/wm97xx.h
 
 WOLFSON MICROELECTRONICS DRIVERS
 M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
-M:      Ian Lartey <ian@opensource.wolfsonmicro.com>
-M:      Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
+L:      patches@opensource.wolfsonmicro.com
 T:      git git://opensource.wolfsonmicro.com/linux-2.6-asoc
 T:      git git://opensource.wolfsonmicro.com/linux-2.6-audioplus
 W:      http://opensource.wolfsonmicro.com/content/linux-drivers-wolfson-devices
@@ -7573,8 +7576,8 @@ F:	Documentation/filesystems/xfs.txt
 F:      fs/xfs/
 
 XILINX AXI ETHERNET DRIVER
-M:      Ariane Keller <ariane.keller@tik.ee.ethz.ch>
-M:      Daniel Borkmann <daniel.borkmann@tik.ee.ethz.ch>
+M:      Anirudha Sarangi <anirudh@xilinx.com>
+M:      John Linn <John.Linn@xilinx.com>
 S:      Maintained
 F:      drivers/net/ethernet/xilinx/xilinx_axienet*
 
diff --git a/Makefile b/Makefile
index 0df3d003a079..9e384ae6c403 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc6
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 56a4df952fb0..22e58a99f38b 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -477,7 +477,7 @@ config ALPHA_BROKEN_IRQ_MASK
 
 config VGA_HOSE
         bool
-        depends on ALPHA_GENERIC || ALPHA_TITAN || ALPHA_MARVEL || ALPHA_TSUNAMI
+        depends on VGA_CONSOLE && (ALPHA_GENERIC || ALPHA_TITAN || ALPHA_MARVEL || ALPHA_TSUNAMI)
         default y
         help
           Support VGA on an arbitrary hose; needed for several platforms
diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
index f62251e82ffa..3bb7ffeae3bc 100644
--- a/arch/alpha/include/asm/atomic.h
+++ b/arch/alpha/include/asm/atomic.h
@@ -3,6 +3,7 @@
 
 #include <linux/types.h>
 #include <asm/barrier.h>
+#include <asm/cmpxchg.h>
 
 /*
  * Atomic operations that C can't guarantee us.  Useful for
@@ -168,73 +169,6 @@ static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
         return result;
 }
 
-/*
- * Atomic exchange routines.
- */
-
-#define __ASM__MB
-#define ____xchg(type, args...)         __xchg ## type ## _local(args)
-#define ____cmpxchg(type, args...)      __cmpxchg ## type ## _local(args)
-#include <asm/xchg.h>
-
-#define xchg_local(ptr,x)                                               \
-  ({                                                                    \
-     __typeof__(*(ptr)) _x_ = (x);                                      \
-     (__typeof__(*(ptr))) __xchg_local((ptr), (unsigned long)_x_,       \
-                                       sizeof(*(ptr)));                 \
-  })
-
-#define cmpxchg_local(ptr, o, n)                                        \
-  ({                                                                    \
-     __typeof__(*(ptr)) _o_ = (o);                                      \
-     __typeof__(*(ptr)) _n_ = (n);                                      \
-     (__typeof__(*(ptr))) __cmpxchg_local((ptr), (unsigned long)_o_,    \
-                                          (unsigned long)_n_,           \
-                                          sizeof(*(ptr)));              \
-  })
-
-#define cmpxchg64_local(ptr, o, n)                                      \
-  ({                                                                    \
-        BUILD_BUG_ON(sizeof(*(ptr)) != 8);                              \
-        cmpxchg_local((ptr), (o), (n));                                 \
-  })
-
-#ifdef CONFIG_SMP
-#undef __ASM__MB
-#define __ASM__MB       "\tmb\n"
-#endif
-#undef ____xchg
-#undef ____cmpxchg
-#define ____xchg(type, args...)         __xchg ##type(args)
-#define ____cmpxchg(type, args...)      __cmpxchg ##type(args)
-#include <asm/xchg.h>
-
-#define xchg(ptr,x)                                                     \
-  ({                                                                    \
-     __typeof__(*(ptr)) _x_ = (x);                                      \
-     (__typeof__(*(ptr))) __xchg((ptr), (unsigned long)_x_,             \
-                                 sizeof(*(ptr)));                       \
-  })
-
-#define cmpxchg(ptr, o, n)                                              \
-  ({                                                                    \
-     __typeof__(*(ptr)) _o_ = (o);                                      \
-     __typeof__(*(ptr)) _n_ = (n);                                      \
-     (__typeof__(*(ptr))) __cmpxchg((ptr), (unsigned long)_o_,          \
-                                    (unsigned long)_n_, sizeof(*(ptr)));\
-  })
-
-#define cmpxchg64(ptr, o, n)                                            \
-  ({                                                                    \
-        BUILD_BUG_ON(sizeof(*(ptr)) != 8);                              \
-        cmpxchg((ptr), (o), (n));                                       \
-  })
-
-#undef __ASM__MB
-#undef ____cmpxchg
-
-#define __HAVE_ARCH_CMPXCHG 1
-
 #define atomic64_cmpxchg(v, old, new) (cmpxchg(&((v)->counter), old, new))
 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
 
diff --git a/arch/alpha/include/asm/cmpxchg.h b/arch/alpha/include/asm/cmpxchg.h
new file mode 100644
index 000000000000..429e8cd0d78e
--- /dev/null
+++ b/arch/alpha/include/asm/cmpxchg.h
@@ -0,0 +1,71 @@
+#ifndef _ALPHA_CMPXCHG_H
+#define _ALPHA_CMPXCHG_H
+
+/*
+ * Atomic exchange routines.
+ */
+
+#define __ASM__MB
+#define ____xchg(type, args...)         __xchg ## type ## _local(args)
+#define ____cmpxchg(type, args...)      __cmpxchg ## type ## _local(args)
+#include <asm/xchg.h>
+
+#define xchg_local(ptr, x)                                              \
+({                                                                      \
+        __typeof__(*(ptr)) _x_ = (x);                                   \
+        (__typeof__(*(ptr))) __xchg_local((ptr), (unsigned long)_x_,    \
+                                       sizeof(*(ptr)));                 \
+})
+
+#define cmpxchg_local(ptr, o, n)                                        \
+({                                                                      \
+        __typeof__(*(ptr)) _o_ = (o);                                   \
+        __typeof__(*(ptr)) _n_ = (n);                                   \
+        (__typeof__(*(ptr))) __cmpxchg_local((ptr), (unsigned long)_o_, \
+                                          (unsigned long)_n_,           \
+                                          sizeof(*(ptr)));              \
+})
+
+#define cmpxchg64_local(ptr, o, n)                                      \
+({                                                                      \
+        BUILD_BUG_ON(sizeof(*(ptr)) != 8);                              \
+        cmpxchg_local((ptr), (o), (n));                                 \
+})
+
+#ifdef CONFIG_SMP
+#undef __ASM__MB
+#define __ASM__MB       "\tmb\n"
+#endif
+#undef ____xchg
+#undef ____cmpxchg
+#define ____xchg(type, args...)         __xchg ##type(args)
+#define ____cmpxchg(type, args...)      __cmpxchg ##type(args)
+#include <asm/xchg.h>
+
+#define xchg(ptr, x)                                                    \
+({                                                                      \
+        __typeof__(*(ptr)) _x_ = (x);                                   \
+        (__typeof__(*(ptr))) __xchg((ptr), (unsigned long)_x_,          \
+                                 sizeof(*(ptr)));                       \
+})
+
+#define cmpxchg(ptr, o, n)                                              \
+({                                                                      \
+        __typeof__(*(ptr)) _o_ = (o);                                   \
+        __typeof__(*(ptr)) _n_ = (n);                                   \
+        (__typeof__(*(ptr))) __cmpxchg((ptr), (unsigned long)_o_,       \
+                                    (unsigned long)_n_, sizeof(*(ptr)));\
+})
+
+#define cmpxchg64(ptr, o, n)                                            \
+({                                                                      \
+        BUILD_BUG_ON(sizeof(*(ptr)) != 8);                              \
+        cmpxchg((ptr), (o), (n));                                       \
+})
+
+#undef __ASM__MB
+#undef ____cmpxchg
+
+#define __HAVE_ARCH_CMPXCHG 1
+
+#endif /* _ALPHA_CMPXCHG_H */
diff --git a/arch/alpha/include/asm/rtc.h b/arch/alpha/include/asm/rtc.h
index 1f7fba671ae6..d70408d36677 100644
--- a/arch/alpha/include/asm/rtc.h
+++ b/arch/alpha/include/asm/rtc.h
@@ -1,14 +1,10 @@
 #ifndef _ALPHA_RTC_H
 #define _ALPHA_RTC_H
 
-#if defined(CONFIG_ALPHA_GENERIC)
+#if defined(CONFIG_ALPHA_MARVEL) && defined(CONFIG_SMP) \
+ || defined(CONFIG_ALPHA_GENERIC)
 # define get_rtc_time           alpha_mv.rtc_get_time
 # define set_rtc_time           alpha_mv.rtc_set_time
-#else
-# if defined(CONFIG_ALPHA_MARVEL) && defined(CONFIG_SMP)
-#  define get_rtc_time          marvel_get_rtc_time
-#  define set_rtc_time          marvel_set_rtc_time
-# endif
 #endif
 
 #include <asm-generic/rtc.h>
diff --git a/arch/alpha/include/asm/xchg.h b/arch/alpha/include/asm/xchg.h
index 1d1b436fbff2..0ca9724597c1 100644
--- a/arch/alpha/include/asm/xchg.h
+++ b/arch/alpha/include/asm/xchg.h
@@ -1,10 +1,10 @@
-#ifndef _ALPHA_ATOMIC_H
+#ifndef _ALPHA_CMPXCHG_H
 #error Do not include xchg.h directly!
 #else
 /*
  * xchg/xchg_local and cmpxchg/cmpxchg_local share the same code
  * except that local version do not have the expensive memory barrier.
- * So this file is included twice from asm/system.h.
+ * So this file is included twice from asm/cmpxchg.h.
  */
 
 /*
diff --git a/arch/alpha/kernel/core_tsunami.c b/arch/alpha/kernel/core_tsunami.c
index 5e7c28f92f19..61893d7bdda5 100644
--- a/arch/alpha/kernel/core_tsunami.c
+++ b/arch/alpha/kernel/core_tsunami.c
@@ -11,6 +11,7 @@
 #include <asm/core_tsunami.h>
 #undef __EXTERN_INLINE
 
+#include <linux/module.h>
 #include <linux/types.h>
 #include <linux/pci.h>
 #include <linux/sched.h>
diff --git a/arch/alpha/kernel/sys_marvel.c b/arch/alpha/kernel/sys_marvel.c
index 14a4b6a7cf59..407accc80877 100644
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -317,7 +317,7 @@ marvel_init_irq(void)
 }
 
 static int 
-marvel_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+marvel_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
 {
         struct pci_controller *hose = dev->sysdata;
         struct io7_port *io7_port = hose->sysdata;
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index cf006d40342c..36586dba6fa6 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1186,6 +1186,15 @@ if !MMU
 source "arch/arm/Kconfig-nommu"
 endif
 
+config ARM_ERRATA_326103
+        bool "ARM errata: FSR write bit incorrect on a SWP to read-only memory"
+        depends on CPU_V6
+        help
+          Executing a SWP instruction to read-only memory does not set bit 11
+          of the FSR on the ARM 1136 prior to r1p0. This causes the kernel to
+          treat the access as a read, preventing a COW from occurring and
+          causing the faulting task to livelock.
+
 config ARM_ERRATA_411920
         bool "ARM errata: Invalidation of the Instruction Cache operation can fail"
         depends on CPU_V6 || CPU_V6K
diff --git a/arch/arm/boot/compressed/atags_to_fdt.c b/arch/arm/boot/compressed/atags_to_fdt.c
index 6ce11c481178..797f04bedb47 100644
--- a/arch/arm/boot/compressed/atags_to_fdt.c
+++ b/arch/arm/boot/compressed/atags_to_fdt.c
@@ -77,6 +77,8 @@ int atags_to_fdt(void *atag_list, void *fdt, int total_space)
                 } else if (atag->hdr.tag == ATAG_MEM) {
                         if (memcount >= sizeof(mem_reg_property)/4)
                                 continue;
+                        if (!atag->u.mem.size)
+                                continue;
                         mem_reg_property[memcount++] = cpu_to_fdt32(atag->u.mem.start);
                         mem_reg_property[memcount++] = cpu_to_fdt32(atag->u.mem.size);
                 } else if (atag->hdr.tag == ATAG_INITRD2) {
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 5f6045f1766c..dc7e8ce8e6be 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -273,7 +273,7 @@ restart:	adr	r0, LC0
                 add     r0, r0, #0x100
                 mov     r1, r6
                 sub     r2, sp, r6
-                blne    atags_to_fdt
+                bleq    atags_to_fdt
 
                 ldmfd   sp!, {r0-r3, ip, lr}
                 sub     sp, sp, #0x10000
diff --git a/arch/arm/boot/dts/at91sam9g20.dtsi b/arch/arm/boot/dts/at91sam9g20.dtsi
index 799ad1889b51..773ef484037a 100644
--- a/arch/arm/boot/dts/at91sam9g20.dtsi
+++ b/arch/arm/boot/dts/at91sam9g20.dtsi
@@ -55,7 +55,6 @@
                                 #interrupt-cells = <2>;
                                 compatible = "atmel,at91rm9200-aic";
                                 interrupt-controller;
-                                interrupt-parent;
                                 reg = <0xfffff000 0x200>;
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
index 9e6eb6ecea0e..c8042147eaa2 100644
--- a/arch/arm/boot/dts/at91sam9g45.dtsi
+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
@@ -56,7 +56,6 @@
                                 #interrupt-cells = <2>;
                                 compatible = "atmel,at91rm9200-aic";
                                 interrupt-controller;
-                                interrupt-parent;
                                 reg = <0xfffff000 0x200>;
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 70ab3a4e026f..dd4ed748469a 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -54,7 +54,6 @@
                                 #interrupt-cells = <2>;
                                 compatible = "atmel,at91rm9200-aic";
                                 interrupt-controller;
-                                interrupt-parent;
                                 reg = <0xfffff000 0x200>;
                         };
 
diff --git a/arch/arm/boot/dts/db8500.dtsi b/arch/arm/boot/dts/db8500.dtsi
index d73dce645667..14bc30705099 100644
--- a/arch/arm/boot/dts/db8500.dtsi
+++ b/arch/arm/boot/dts/db8500.dtsi
@@ -24,7 +24,6 @@
                         #interrupt-cells = <3>;
                         #address-cells = <1>;
                         interrupt-controller;
-                        interrupt-parent;
                         reg = <0xa0411000 0x1000>,
                               <0xa0410100 0x100>;
                 };
diff --git a/arch/arm/boot/dts/highbank.dts b/arch/arm/boot/dts/highbank.dts
index 37c0ff9c8b90..83e72294aefb 100644
--- a/arch/arm/boot/dts/highbank.dts
+++ b/arch/arm/boot/dts/highbank.dts
@@ -89,7 +89,6 @@
                         #size-cells = <0>;
                         #address-cells = <1>;
                         interrupt-controller;
-                        interrupt-parent;
                         reg = <0xfff11000 0x1000>,
                               <0xfff10100 0x100>;
                 };
diff --git a/arch/arm/boot/dts/msm8660-surf.dts b/arch/arm/boot/dts/msm8660-surf.dts
index 15ded0deaa79..45bc4bb04e57 100644
--- a/arch/arm/boot/dts/msm8660-surf.dts
+++ b/arch/arm/boot/dts/msm8660-surf.dts
@@ -10,7 +10,7 @@
         intc: interrupt-controller@02080000 {
                 compatible = "qcom,msm-8660-qgic";
                 interrupt-controller;
-                #interrupt-cells = <1>;
+                #interrupt-cells = <3>;
                 reg = < 0x02080000 0x1000 >,
                       < 0x02081000 0x1000 >;
         };
@@ -19,6 +19,6 @@
                 compatible = "qcom,msm-hsuart", "qcom,msm-uart";
                 reg = <0x19c40000 0x1000>,
                       <0x19c00000 0x1000>;
-                interrupts = <195>;
+                interrupts = <0 195 0x0>;
         };
 };
diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts
index 0b32925f2147..e2fe3195c0d1 100644
--- a/arch/arm/boot/dts/versatile-ab.dts
+++ b/arch/arm/boot/dts/versatile-ab.dts
@@ -173,7 +173,7 @@
                         mmc@5000 {
                                 compatible = "arm,primecell";
                                 reg = < 0x5000 0x1000>;
-                                interrupts = <22>;
+                                interrupts = <22 34>;
                         };
                         kmi@6000 {
                                 compatible = "arm,pl050", "arm,primecell";
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index 166461073b78..7e8175269064 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -41,7 +41,7 @@
                         mmc@b000 {
                                 compatible = "arm,primecell";
                                 reg = <0xb000 0x1000>;
-                                interrupts = <23>;
+                                interrupts = <23 34>;
                         };
                 };
         };
diff --git a/arch/arm/common/vic.c b/arch/arm/common/vic.c
index 7a66311f3066..7e288f96cedf 100644
--- a/arch/arm/common/vic.c
+++ b/arch/arm/common/vic.c
@@ -427,19 +427,18 @@ int __init vic_of_init(struct device_node *node, struct device_node *parent)
 
 /*
  * Handle each interrupt in a single VIC.  Returns non-zero if we've
- * handled at least one interrupt.  This does a single read of the
- * status register and handles all interrupts in order from LSB first.
+ * handled at least one interrupt.  This reads the status register
+ * before handling each interrupt, which is necessary given that
+ * handle_IRQ may briefly re-enable interrupts for soft IRQ handling.
  */
 static int handle_one_vic(struct vic_device *vic, struct pt_regs *regs)
 {
         u32 stat, irq;
         int handled = 0;
 
-        stat = readl_relaxed(vic->base + VIC_IRQ_STATUS);
-        while (stat) {
+        while ((stat = readl_relaxed(vic->base + VIC_IRQ_STATUS))) {
                 irq = ffs(stat) - 1;
                 handle_IRQ(irq_find_mapping(vic->domain, irq), regs);
-                stat &= ~(1 << irq);
                 handled = 1;
         }
 
diff --git a/arch/arm/configs/imx_v4_v5_defconfig b/arch/arm/configs/imx_v4_v5_defconfig
index b5ac644e12af..6b31cb60daab 100644
--- a/arch/arm/configs/imx_v4_v5_defconfig
+++ b/arch/arm/configs/imx_v4_v5_defconfig
@@ -112,6 +112,7 @@ CONFIG_WATCHDOG=y
 CONFIG_IMX2_WDT=y
 CONFIG_MFD_MC13XXX=y
 CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_MC13783=y
 CONFIG_REGULATOR_MC13892=y
 CONFIG_FB=y
diff --git a/arch/arm/configs/mini2440_defconfig b/arch/arm/configs/mini2440_defconfig
index 42da9183acc8..082175c54e7c 100644
--- a/arch/arm/configs/mini2440_defconfig
+++ b/arch/arm/configs/mini2440_defconfig
@@ -14,6 +14,8 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_ARCH_S3C24XX=y
+# CONFIG_CPU_S3C2410 is not set
+CONFIG_CPU_S3C2440=y
 CONFIG_S3C_ADC=y
 CONFIG_S3C24XX_PWM=y
 CONFIG_MACH_MINI2440=y
diff --git a/arch/arm/configs/u8500_defconfig b/arch/arm/configs/u8500_defconfig
index 889d73ac1ae1..7e84f453e8a6 100644
--- a/arch/arm/configs/u8500_defconfig
+++ b/arch/arm/configs/u8500_defconfig
@@ -8,8 +8,6 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_LBDAF is not set
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_ARCH_U8500=y
-CONFIG_UX500_SOC_DB5500=y
-CONFIG_UX500_SOC_DB8500=y
 CONFIG_MACH_HREFV60=y
 CONFIG_MACH_SNOWBALL=y
 CONFIG_MACH_U5500=y
@@ -39,7 +37,6 @@ CONFIG_CAIF=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=65536
-CONFIG_MISC_DEVICES=y
 CONFIG_AB8500_PWM=y
 CONFIG_SENSORS_BH1780=y
 CONFIG_NETDEVICES=y
@@ -65,16 +62,18 @@ CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_HW_RANDOM=y
 CONFIG_HW_RANDOM_NOMADIK=y
-CONFIG_I2C=y
-CONFIG_I2C_NOMADIK=y
 CONFIG_SPI=y
 CONFIG_SPI_PL022=y
 CONFIG_GPIO_STMPE=y
 CONFIG_GPIO_TC3589X=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_AB8500_BM=y
+CONFIG_AB8500_BATTERY_THERM_ON_BATCTRL=y
 CONFIG_MFD_STMPE=y
 CONFIG_MFD_TC3589X=y
 CONFIG_AB5500_CORE=y
 CONFIG_AB8500_CORE=y
+CONFIG_REGULATOR=y
 CONFIG_REGULATOR_AB8500=y
 # CONFIG_HID_SUPPORT is not set
 CONFIG_USB_GADGET=y
diff --git a/arch/arm/include/asm/jump_label.h b/arch/arm/include/asm/jump_label.h
index 5c5ca2ea62b0..bfc198c75913 100644
--- a/arch/arm/include/asm/jump_label.h
+++ b/arch/arm/include/asm/jump_label.h
@@ -14,7 +14,7 @@
 #define JUMP_LABEL_NOP  "nop"
 #endif
 
-static __always_inline bool arch_static_branch(struct jump_label_key *key)
+static __always_inline bool arch_static_branch(struct static_key *key)
 {
         asm goto("1:\n\t"
                  JUMP_LABEL_NOP "\n\t"
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index d4c24d412a8d..0f04d84582e1 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -118,6 +118,13 @@ extern void iwmmxt_task_switch(struct thread_info *);
 extern void vfp_sync_hwstate(struct thread_info *);
 extern void vfp_flush_hwstate(struct thread_info *);
 
+struct user_vfp;
+struct user_vfp_exc;
+
+extern int vfp_preserve_user_clear_hwstate(struct user_vfp __user *,
+                                           struct user_vfp_exc __user *);
+extern int vfp_restore_user_hwstate(struct user_vfp __user *,
+                                    struct user_vfp_exc __user *);
 #endif
 
 /*
diff --git a/arch/arm/include/asm/tls.h b/arch/arm/include/asm/tls.h
index 60843eb0f61c..73409e6c0251 100644
--- a/arch/arm/include/asm/tls.h
+++ b/arch/arm/include/asm/tls.h
@@ -7,6 +7,8 @@
 
         .macro set_tls_v6k, tp, tmp1, tmp2
         mcr     p15, 0, \tp, c13, c0, 3         @ set TLS register
+        mov     \tmp1, #0
+        mcr     p15, 0, \tmp1, c13, c0, 2       @ clear user r/w TLS register
         .endm
 
         .macro set_tls_v6, tp, tmp1, tmp2
@@ -15,6 +17,8 @@
         mov     \tmp2, #0xffff0fff
         tst     \tmp1, #HWCAP_TLS               @ hardware TLS available?
         mcrne   p15, 0, \tp, c13, c0, 3         @ yes, set TLS register
+        movne   \tmp1, #0
+        mcrne   p15, 0, \tmp1, c13, c0, 2       @ clear user r/w TLS register
         streq   \tp, [\tmp2, #-15]              @ set TLS value at 0xffff0ff0
         .endm
 
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 71ccdbfed662..8349d4e97e2b 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -155,10 +155,10 @@ static bool migrate_one_irq(struct irq_desc *desc)
         }
 
         c = irq_data_get_irq_chip(d);
-        if (c->irq_set_affinity)
-                c->irq_set_affinity(d, affinity, true);
-        else
+        if (!c->irq_set_affinity)
                 pr_debug("IRQ%u: unable to set affinity\n", d->irq);
+        else if (c->irq_set_affinity(d, affinity, true) == IRQ_SET_MASK_OK && ret)
+                cpumask_copy(d->affinity, affinity);
 
         return ret;
 }
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index b91411371ae1..ebfac782593f 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -523,7 +523,21 @@ int __init arm_add_memory(phys_addr_t start, unsigned long size)
          */
         size -= start & ~PAGE_MASK;
         bank->start = PAGE_ALIGN(start);
-        bank->size  = size & PAGE_MASK;
+
+#ifndef CONFIG_LPAE
+        if (bank->start + size < bank->start) {
+                printk(KERN_CRIT "Truncating memory at 0x%08llx to fit in "
+                        "32-bit physical address space\n", (long long)start);
+                /*
+                 * To ensure bank->start + bank->size is representable in
+                 * 32 bits, we use ULONG_MAX as the upper limit rather than 4GB.
+                 * This means we lose a page after masking.
+                 */
+                size = ULONG_MAX - bank->start;
+        }
+#endif
+
+        bank->size = size & PAGE_MASK;
 
         /*
          * Check whether this memory region has non-zero size or
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 7cb532fc8aa4..d68d1b694680 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -180,44 +180,23 @@ static int restore_iwmmxt_context(struct iwmmxt_sigframe *frame)
 
 static int preserve_vfp_context(struct vfp_sigframe __user *frame)
 {
-        struct thread_info *thread = current_thread_info();
-        struct vfp_hard_struct *h = &thread->vfpstate.hard;
         const unsigned long magic = VFP_MAGIC;
         const unsigned long size = VFP_STORAGE_SIZE;
         int err = 0;
 
-        vfp_sync_hwstate(thread);
         __put_user_error(magic, &frame->magic, err);
         __put_user_error(size, &frame->size, err);
 
-        /*
-         * Copy the floating point registers. There can be unused
-         * registers see asm/hwcap.h for details.
-         */
-        err |= __copy_to_user(&frame->ufp.fpregs, &h->fpregs,
-                              sizeof(h->fpregs));
-        /*
-         * Copy the status and control register.
-         */
-        __put_user_error(h->fpscr, &frame->ufp.fpscr, err);
-
-        /*
-         * Copy the exception registers.
-         */
-        __put_user_error(h->fpexc, &frame->ufp_exc.fpexc, err);
-        __put_user_error(h->fpinst, &frame->ufp_exc.fpinst, err);
-        __put_user_error(h->fpinst2, &frame->ufp_exc.fpinst2, err);
+        if (err)
+                return -EFAULT;
 
-        return err ? -EFAULT : 0;
+        return vfp_preserve_user_clear_hwstate(&frame->ufp, &frame->ufp_exc);
 }
 
 static int restore_vfp_context(struct vfp_sigframe __user *frame)
 {
-        struct thread_info *thread = current_thread_info();
-        struct vfp_hard_struct *h = &thread->vfpstate.hard;
         unsigned long magic;
         unsigned long size;
-        unsigned long fpexc;
         int err = 0;
 
         __get_user_error(magic, &frame->magic, err);
@@ -228,33 +207,7 @@ static int restore_vfp_context(struct vfp_sigframe __user *frame)
         if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
                 return -EINVAL;
 
-        vfp_flush_hwstate(thread);
-
-        /*
-         * Copy the floating point registers. There can be unused
-         * registers see asm/hwcap.h for details.
-         */
-        err |= __copy_from_user(&h->fpregs, &frame->ufp.fpregs,
-                                sizeof(h->fpregs));
-        /*
-         * Copy the status and control register.
-         */
-        __get_user_error(h->fpscr, &frame->ufp.fpscr, err);
-
-        /*
-         * Sanitise and restore the exception registers.
-         */
-        __get_user_error(fpexc, &frame->ufp_exc.fpexc, err);
-        /* Ensure the VFP is enabled. */
-        fpexc |= FPEXC_EN;
-        /* Ensure FPINST2 is invalid and the exception flag is cleared. */
-        fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
-        h->fpexc = fpexc;
-
-        __get_user_error(h->fpinst, &frame->ufp_exc.fpinst, err);
-        __get_user_error(h->fpinst2, &frame->ufp_exc.fpinst2, err);
-
-        return err ? -EFAULT : 0;
+        return vfp_restore_user_hwstate(&frame->ufp, &frame->ufp_exc);
 }
 
 #endif
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index addbbe8028c2..f6a4d32b0421 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -510,10 +510,6 @@ static void ipi_cpu_stop(unsigned int cpu)
         local_fiq_disable();
         local_irq_disable();
 
-#ifdef CONFIG_HOTPLUG_CPU
-        platform_cpu_kill(cpu);
-#endif
-
         while (1)
                 cpu_relax();
 }
@@ -576,17 +572,25 @@ void smp_send_reschedule(int cpu)
         smp_cross_call(cpumask_of(cpu), IPI_RESCHEDULE);
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
+static void smp_kill_cpus(cpumask_t *mask)
+{
+        unsigned int cpu;
+        for_each_cpu(cpu, mask)
+                platform_cpu_kill(cpu);
+}
+#else
+static void smp_kill_cpus(cpumask_t *mask) { }
+#endif
+
 void smp_send_stop(void)
 {
         unsigned long timeout;
+        struct cpumask mask;
 
-        if (num_online_cpus() > 1) {
-                struct cpumask mask;
-                cpumask_copy(&mask, cpu_online_mask);
-                cpumask_clear_cpu(smp_processor_id(), &mask);
-
-                smp_cross_call(&mask, IPI_CPU_STOP);
-        }
+        cpumask_copy(&mask, cpu_online_mask);
+        cpumask_clear_cpu(smp_processor_id(), &mask);
+        smp_cross_call(&mask, IPI_CPU_STOP);
 
         /* Wait up to one second for other CPUs to stop */
         timeout = USEC_PER_SEC;
@@ -595,6 +599,8 @@ void smp_send_stop(void)
 
         if (num_online_cpus() > 1)
                 pr_warning("SMP: failed to stop secondary CPUs\n");
+
+        smp_kill_cpus(&mask);
 }
 
 /*
diff --git a/arch/arm/mach-at91/at91rm9200_devices.c b/arch/arm/mach-at91/at91rm9200_devices.c
index 99ce5c955e39..05774e5b1cba 100644
--- a/arch/arm/mach-at91/at91rm9200_devices.c
+++ b/arch/arm/mach-at91/at91rm9200_devices.c
@@ -1173,7 +1173,6 @@ void __init at91_add_device_serial(void)
                 printk(KERN_INFO "AT91: No default serial console defined.\n");
 }
 #else
-void __init __deprecated at91_init_serial(struct at91_uart_config *config) {}
 void __init at91_register_uart(unsigned id, unsigned portnr, unsigned pins) {}
 void __init at91_set_serial_console(unsigned portnr) {}
 void __init at91_add_device_serial(void) {}
diff --git a/arch/arm/mach-at91/at91rm9200_time.c b/arch/arm/mach-at91/at91rm9200_time.c
index dd7f782b0b91..104ca40d8d18 100644
--- a/arch/arm/mach-at91/at91rm9200_time.c
+++ b/arch/arm/mach-at91/at91rm9200_time.c
@@ -23,6 +23,7 @@
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/clockchips.h>
+#include <linux/export.h>
 
 #include <asm/mach/time.h>
 
@@ -176,6 +177,7 @@ static struct clock_event_device clkevt = {
 };
 
 void __iomem *at91_st_base;
+EXPORT_SYMBOL_GPL(at91_st_base);
 
 void __init at91rm9200_ioremap_st(u32 addr)
 {
diff --git a/arch/arm/mach-at91/board-rm9200ek.c b/arch/arm/mach-at91/board-rm9200ek.c
index 11cbaa8946fe..b2e4fe21f346 100644
--- a/arch/arm/mach-at91/board-rm9200ek.c
+++ b/arch/arm/mach-at91/board-rm9200ek.c
@@ -117,7 +117,7 @@ static struct i2c_board_info __initdata ek_i2c_devices[] = {
 };
 
 #define EK_FLASH_BASE   AT91_CHIPSELECT_0
-#define EK_FLASH_SIZE   SZ_2M
+#define EK_FLASH_SIZE   SZ_8M
 
 static struct physmap_flash_data ek_flash_data = {
         .width          = 2,
diff --git a/arch/arm/mach-at91/board-sam9261ek.c b/arch/arm/mach-at91/board-sam9261ek.c
index c3f994462864..065fed342424 100644
--- a/arch/arm/mach-at91/board-sam9261ek.c
+++ b/arch/arm/mach-at91/board-sam9261ek.c
@@ -85,8 +85,6 @@ static struct resource dm9000_resource[] = {
                 .flags  = IORESOURCE_MEM
         },
         [2] = {
-                .start  = AT91_PIN_PC11,
-                .end    = AT91_PIN_PC11,
                 .flags  = IORESOURCE_IRQ
                         | IORESOURCE_IRQ_LOWEDGE | IORESOURCE_IRQ_HIGHEDGE,
         }
@@ -130,6 +128,8 @@ static struct sam9_smc_config __initdata dm9000_smc_config = {
 
 static void __init ek_add_device_dm9000(void)
 {
+        struct resource *r = &dm9000_resource[2];
+
         /* Configure chip-select 2 (DM9000) */
         sam9_smc_configure(0, 2, &dm9000_smc_config);
 
@@ -139,6 +139,7 @@ static void __init ek_add_device_dm9000(void)
         /* Configure Interrupt pin as input, no pull-up */
         at91_set_gpio_input(AT91_PIN_PC11, 0);
 
+        r->start = r->end = gpio_to_irq(AT91_PIN_PC11);
         platform_device_register(&dm9000_device);
 }
 #else
diff --git a/arch/arm/mach-at91/clock.c b/arch/arm/mach-at91/clock.c
index a0f4d7424cdc..6b692824c988 100644
--- a/arch/arm/mach-at91/clock.c
+++ b/arch/arm/mach-at91/clock.c
@@ -35,6 +35,7 @@
 #include "generic.h"
 
 void __iomem *at91_pmc_base;
+EXPORT_SYMBOL_GPL(at91_pmc_base);
 
 /*
  * There's a lot more which can be done with clocks, including cpufreq
diff --git a/arch/arm/mach-at91/include/mach/at91_pmc.h b/arch/arm/mach-at91/include/mach/at91_pmc.h
index 36604782a78f..ea2c57a86ca6 100644
--- a/arch/arm/mach-at91/include/mach/at91_pmc.h
+++ b/arch/arm/mach-at91/include/mach/at91_pmc.h
@@ -25,7 +25,7 @@ extern void __iomem *at91_pmc_base;
 #define at91_pmc_write(field, value) \
         __raw_writel(value, at91_pmc_base + field)
 #else
-.extern at91_aic_base
+.extern at91_pmc_base
 #endif
 
 #define AT91_PMC_SCER           0x00                    /* System Clock Enable Register */
diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
index 97cc04dc8073..f44a2e7272e3 100644
--- a/arch/arm/mach-at91/setup.c
+++ b/arch/arm/mach-at91/setup.c
@@ -54,6 +54,7 @@ void __init at91_init_interrupts(unsigned int *priority)
 }
 
 void __iomem *at91_ramc_base[2];
+EXPORT_SYMBOL_GPL(at91_ramc_base);
 
 void __init at91_ioremap_ramc(int id, u32 addr, u32 size)
 {
@@ -292,6 +293,7 @@ void __init at91_ioremap_rstc(u32 base_addr)
 }
 
 void __iomem *at91_matrix_base;
+EXPORT_SYMBOL_GPL(at91_matrix_base);
 
 void __init at91_ioremap_matrix(u32 base_addr)
 {
diff --git a/arch/arm/mach-bcmring/core.c b/arch/arm/mach-bcmring/core.c
index 22e4e0a28ad1..adbfb1994582 100644
--- a/arch/arm/mach-bcmring/core.c
+++ b/arch/arm/mach-bcmring/core.c
@@ -52,8 +52,8 @@
 #include <mach/csp/chipcHw_inline.h>
 #include <mach/csp/tmrHw_reg.h>
 
-static AMBA_APB_DEVICE(uartA, "uarta", MM_ADDR_IO_UARTA, { IRQ_UARTA }, NULL);
-static AMBA_APB_DEVICE(uartB, "uartb", MM_ADDR_IO_UARTB, { IRQ_UARTB }, NULL);
+static AMBA_APB_DEVICE(uartA, "uartA", 0, MM_ADDR_IO_UARTA, {IRQ_UARTA}, NULL);
+static AMBA_APB_DEVICE(uartB, "uartB", 0, MM_ADDR_IO_UARTB, {IRQ_UARTB}, NULL);
 
 static struct clk pll1_clk = {
         .name = "PLL1",
diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig
index 0491ceef1cda..e81c35f936b5 100644
--- a/arch/arm/mach-exynos/Kconfig
+++ b/arch/arm/mach-exynos/Kconfig
@@ -368,6 +368,7 @@ comment "Flattened Device Tree based board for EXYNOS SoCs"
 
 config MACH_EXYNOS4_DT
         bool "Samsung Exynos4 Machine using device tree"
+        depends on ARCH_EXYNOS4
         select CPU_EXYNOS4210
         select USE_OF
         select ARM_AMBA
@@ -380,6 +381,7 @@ config MACH_EXYNOS4_DT
 
 config MACH_EXYNOS5_DT
         bool "SAMSUNG EXYNOS5 Machine using device tree"
+        depends on ARCH_EXYNOS5
         select SOC_EXYNOS5250
         select USE_OF
         select ARM_AMBA
diff --git a/arch/arm/mach-exynos/clock-exynos4.c b/arch/arm/mach-exynos/clock-exynos4.c
index df54c2a92225..6efd1e5919fd 100644
--- a/arch/arm/mach-exynos/clock-exynos4.c
+++ b/arch/arm/mach-exynos/clock-exynos4.c
@@ -497,25 +497,25 @@ static struct clk exynos4_init_clocks_off[] = {
                 .ctrlbit        = (1 << 3),
         }, {
                 .name           = "hsmmc",
-                .devname        = "s3c-sdhci.0",
+                .devname        = "exynos4-sdhci.0",
                 .parent         = &exynos4_clk_aclk_133.clk,
                 .enable         = exynos4_clk_ip_fsys_ctrl,
                 .ctrlbit        = (1 << 5),
         }, {
                 .name           = "hsmmc",
-                .devname        = "s3c-sdhci.1",
+                .devname        = "exynos4-sdhci.1",
                 .parent         = &exynos4_clk_aclk_133.clk,
                 .enable         = exynos4_clk_ip_fsys_ctrl,
                 .ctrlbit        = (1 << 6),
         }, {
                 .name           = "hsmmc",
-                .devname        = "s3c-sdhci.2",
+                .devname        = "exynos4-sdhci.2",
                 .parent         = &exynos4_clk_aclk_133.clk,
                 .enable         = exynos4_clk_ip_fsys_ctrl,
                 .ctrlbit        = (1 << 7),
         }, {
                 .name           = "hsmmc",
-                .devname        = "s3c-sdhci.3",
+                .devname        = "exynos4-sdhci.3",
                 .parent         = &exynos4_clk_aclk_133.clk,
                 .enable         = exynos4_clk_ip_fsys_ctrl,
                 .ctrlbit        = (1 << 8),
@@ -1202,7 +1202,7 @@ static struct clksrc_clk exynos4_clk_sclk_uart3 = {
 static struct clksrc_clk exynos4_clk_sclk_mmc0 = {
         .clk    = {
                 .name           = "sclk_mmc",
-                .devname        = "s3c-sdhci.0",
+                .devname        = "exynos4-sdhci.0",
                 .parent         = &exynos4_clk_dout_mmc0.clk,
                 .enable         = exynos4_clksrc_mask_fsys_ctrl,
                 .ctrlbit        = (1 << 0),
@@ -1213,7 +1213,7 @@ static struct clksrc_clk exynos4_clk_sclk_mmc0 = {
 static struct clksrc_clk exynos4_clk_sclk_mmc1 = {
         .clk    = {
                 .name           = "sclk_mmc",
-                .devname        = "s3c-sdhci.1",
+                .devname        = "exynos4-sdhci.1",
                 .parent         = &exynos4_clk_dout_mmc1.clk,
                 .enable         = exynos4_clksrc_mask_fsys_ctrl,
                 .ctrlbit        = (1 << 4),
@@ -1224,7 +1224,7 @@ static struct clksrc_clk exynos4_clk_sclk_mmc1 = {
 static struct clksrc_clk exynos4_clk_sclk_mmc2 = {
         .clk    = {
                 .name           = "sclk_mmc",
-                .devname        = "s3c-sdhci.2",
+                .devname        = "exynos4-sdhci.2",
                 .parent         = &exynos4_clk_dout_mmc2.clk,
                 .enable         = exynos4_clksrc_mask_fsys_ctrl,
                 .ctrlbit        = (1 << 8),
@@ -1235,7 +1235,7 @@ static struct clksrc_clk exynos4_clk_sclk_mmc2 = {
 static struct clksrc_clk exynos4_clk_sclk_mmc3 = {
         .clk    = {
                 .name           = "sclk_mmc",
-                .devname        = "s3c-sdhci.3",
+                .devname        = "exynos4-sdhci.3",
                 .parent         = &exynos4_clk_dout_mmc3.clk,
                 .enable         = exynos4_clksrc_mask_fsys_ctrl,
                 .ctrlbit        = (1 << 12),
@@ -1340,10 +1340,10 @@ static struct clk_lookup exynos4_clk_lookup[] = {
         CLKDEV_INIT("exynos4210-uart.1", "clk_uart_baud0", &exynos4_clk_sclk_uart1.clk),
         CLKDEV_INIT("exynos4210-uart.2", "clk_uart_baud0", &exynos4_clk_sclk_uart2.clk),
         CLKDEV_INIT("exynos4210-uart.3", "clk_uart_baud0", &exynos4_clk_sclk_uart3.clk),
-        CLKDEV_INIT("s3c-sdhci.0", "mmc_busclk.2", &exynos4_clk_sclk_mmc0.clk),
-        CLKDEV_INIT("s3c-sdhci.1", "mmc_busclk.2", &exynos4_clk_sclk_mmc1.clk),
-        CLKDEV_INIT("s3c-sdhci.2", "mmc_busclk.2", &exynos4_clk_sclk_mmc2.clk),
-        CLKDEV_INIT("s3c-sdhci.3", "mmc_busclk.2", &exynos4_clk_sclk_mmc3.clk),
+        CLKDEV_INIT("exynos4-sdhci.0", "mmc_busclk.2", &exynos4_clk_sclk_mmc0.clk),
+        CLKDEV_INIT("exynos4-sdhci.1", "mmc_busclk.2", &exynos4_clk_sclk_mmc1.clk),
+        CLKDEV_INIT("exynos4-sdhci.2", "mmc_busclk.2", &exynos4_clk_sclk_mmc2.clk),
+        CLKDEV_INIT("exynos4-sdhci.3", "mmc_busclk.2", &exynos4_clk_sclk_mmc3.clk),
         CLKDEV_INIT("exynos4-fb.0", "lcd", &exynos4_clk_fimd0),
         CLKDEV_INIT("dma-pl330.0", "apb_pclk", &exynos4_clk_pdma0),
         CLKDEV_INIT("dma-pl330.1", "apb_pclk", &exynos4_clk_pdma1),
diff --git a/arch/arm/mach-exynos/clock-exynos5.c b/arch/arm/mach-exynos/clock-exynos5.c
index d013982d0f8e..5cd7a8b8868c 100644
--- a/arch/arm/mach-exynos/clock-exynos5.c
+++ b/arch/arm/mach-exynos/clock-exynos5.c
@@ -455,25 +455,25 @@ static struct clk exynos5_init_clocks_off[] = {
                 .ctrlbit        = (1 << 20),
         }, {
                 .name           = "hsmmc",
-                .devname        = "s3c-sdhci.0",
+                .devname        = "exynos4-sdhci.0",
                 .parent         = &exynos5_clk_aclk_200.clk,
                 .enable         = exynos5_clk_ip_fsys_ctrl,
                 .ctrlbit        = (1 << 12),
         }, {
                 .name           = "hsmmc",
-                .devname        = "s3c-sdhci.1",
+                .devname        = "exynos4-sdhci.1",
                 .parent         = &exynos5_clk_aclk_200.clk,
                 .enable         = exynos5_clk_ip_fsys_ctrl,
                 .ctrlbit        = (1 << 13),
         }, {
                 .name           = "hsmmc",
-                .devname        = "s3c-sdhci.2",
+                .devname        = "exynos4-sdhci.2",
                 .parent         = &exynos5_clk_aclk_200.clk,
                 .enable         = exynos5_clk_ip_fsys_ctrl,
                 .ctrlbit        = (1 << 14),
         }, {
                 .name           = "hsmmc",
-                .devname        = "s3c-sdhci.3",
+                .devname        = "exynos4-sdhci.3",
                 .parent         = &exynos5_clk_aclk_200.clk,
                 .enable         = exynos5_clk_ip_fsys_ctrl,
                 .ctrlbit        = (1 << 15),
@@ -813,7 +813,7 @@ static struct clksrc_clk exynos5_clk_sclk_uart3 = {
 static struct clksrc_clk exynos5_clk_sclk_mmc0 = {
         .clk    = {
                 .name           = "sclk_mmc",
-                .devname        = "s3c-sdhci.0",
+                .devname        = "exynos4-sdhci.0",
                 .parent         = &exynos5_clk_dout_mmc0.clk,
                 .enable         = exynos5_clksrc_mask_fsys_ctrl,
                 .ctrlbit        = (1 << 0),
@@ -824,7 +824,7 @@ static struct clksrc_clk exynos5_clk_sclk_mmc0 = {
 static struct clksrc_clk exynos5_clk_sclk_mmc1 = {
         .clk    = {
                 .name           = "sclk_mmc",
-                .devname        = "s3c-sdhci.1",
+                .devname        = "exynos4-sdhci.1",
                 .parent         = &exynos5_clk_dout_mmc1.clk,
                 .enable         = exynos5_clksrc_mask_fsys_ctrl,
                 .ctrlbit        = (1 << 4),
@@ -835,7 +835,7 @@ static struct clksrc_clk exynos5_clk_sclk_mmc1 = {
 static struct clksrc_clk exynos5_clk_sclk_mmc2 = {
         .clk    = {
                 .name           = "sclk_mmc",
-                .devname        = "s3c-sdhci.2",
+                .devname        = "exynos4-sdhci.2",
                 .parent         = &exynos5_clk_dout_mmc2.clk,
                 .enable         = exynos5_clksrc_mask_fsys_ctrl,
                 .ctrlbit        = (1 << 8),
@@ -846,7 +846,7 @@ static struct clksrc_clk exynos5_clk_sclk_mmc2 = {
 static struct clksrc_clk exynos5_clk_sclk_mmc3 = {
         .clk    = {
                 .name           = "sclk_mmc",
-                .devname        = "s3c-sdhci.3",
+                .devname        = "exynos4-sdhci.3",
                 .parent         = &exynos5_clk_dout_mmc3.clk,
                 .enable         = exynos5_clksrc_mask_fsys_ctrl,
                 .ctrlbit        = (1 << 12),
@@ -990,10 +990,10 @@ static struct clk_lookup exynos5_clk_lookup[] = {
         CLKDEV_INIT("exynos4210-uart.1", "clk_uart_baud0", &exynos5_clk_sclk_uart1.clk),
         CLKDEV_INIT("exynos4210-uart.2", "clk_uart_baud0", &exynos5_clk_sclk_uart2.clk),
         CLKDEV_INIT("exynos4210-uart.3", "clk_uart_baud0", &exynos5_clk_sclk_uart3.clk),
-        CLKDEV_INIT("s3c-sdhci.0", "mmc_busclk.2", &exynos5_clk_sclk_mmc0.clk),
-        CLKDEV_INIT("s3c-sdhci.1", "mmc_busclk.2", &exynos5_clk_sclk_mmc1.clk),
-        CLKDEV_INIT("s3c-sdhci.2", "mmc_busclk.2", &exynos5_clk_sclk_mmc2.clk),
-        CLKDEV_INIT("s3c-sdhci.3", "mmc_busclk.2", &exynos5_clk_sclk_mmc3.clk),
+        CLKDEV_INIT("exynos4-sdhci.0", "mmc_busclk.2", &exynos5_clk_sclk_mmc0.clk),
+        CLKDEV_INIT("exynos4-sdhci.1", "mmc_busclk.2", &exynos5_clk_sclk_mmc1.clk),
+        CLKDEV_INIT("exynos4-sdhci.2", "mmc_busclk.2", &exynos5_clk_sclk_mmc2.clk),
+        CLKDEV_INIT("exynos4-sdhci.3", "mmc_busclk.2", &exynos5_clk_sclk_mmc3.clk),
         CLKDEV_INIT("dma-pl330.0", "apb_pclk", &exynos5_clk_pdma0),
         CLKDEV_INIT("dma-pl330.1", "apb_pclk", &exynos5_clk_pdma1),
         CLKDEV_INIT("dma-pl330.2", "apb_pclk", &exynos5_clk_mdma1),
diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c
index 8614aab47cc0..5ccd6e80a607 100644
--- a/arch/arm/mach-exynos/common.c
+++ b/arch/arm/mach-exynos/common.c
@@ -326,6 +326,11 @@ static void __init exynos4_map_io(void)
         s3c_fimc_setname(2, "exynos4-fimc");
         s3c_fimc_setname(3, "exynos4-fimc");
 
+        s3c_sdhci_setname(0, "exynos4-sdhci");
+        s3c_sdhci_setname(1, "exynos4-sdhci");
+        s3c_sdhci_setname(2, "exynos4-sdhci");
+        s3c_sdhci_setname(3, "exynos4-sdhci");
+
         /* The I2C bus controllers are directly compatible with s3c2440 */
         s3c_i2c0_setname("s3c2440-i2c");
         s3c_i2c1_setname("s3c2440-i2c");
@@ -344,6 +349,11 @@ static void __init exynos5_map_io(void)
         s3c_device_i2c0.resource[1].start = EXYNOS5_IRQ_IIC;
         s3c_device_i2c0.resource[1].end   = EXYNOS5_IRQ_IIC;
 
+        s3c_sdhci_setname(0, "exynos4-sdhci");
+        s3c_sdhci_setname(1, "exynos4-sdhci");
+        s3c_sdhci_setname(2, "exynos4-sdhci");
+        s3c_sdhci_setname(3, "exynos4-sdhci");
+
         /* The I2C bus controllers are directly compatible with s3c2440 */
         s3c_i2c0_setname("s3c2440-i2c");
         s3c_i2c1_setname("s3c2440-i2c");
@@ -537,7 +547,9 @@ void __init exynos5_init_irq(void)
 {
         int irq;
 
-        gic_init(0, IRQ_PPI(0), S5P_VA_GIC_DIST, S5P_VA_GIC_CPU);
+#ifdef CONFIG_OF
+        of_irq_init(exynos4_dt_irq_match);
+#endif
 
         for (irq = 0; irq < EXYNOS5_MAX_COMBINER_NR; irq++) {
                 combiner_init(irq, (void __iomem *)S5P_VA_COMBINER(irq),
diff --git a/arch/arm/mach-exynos/dev-dwmci.c b/arch/arm/mach-exynos/dev-dwmci.c
index b025db4bf602..79035018fb74 100644
--- a/arch/arm/mach-exynos/dev-dwmci.c
+++ b/arch/arm/mach-exynos/dev-dwmci.c
@@ -16,6 +16,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
+#include <linux/ioport.h>
 #include <linux/mmc/dw_mmc.h>
 
 #include <plat/devs.h>
@@ -33,16 +34,8 @@ static int exynos4_dwmci_init(u32 slot_id, irq_handler_t handler, void *data)
 }
 
 static struct resource exynos4_dwmci_resource[] = {
-        [0] = {
-                .start  = EXYNOS4_PA_DWMCI,
-                .end    = EXYNOS4_PA_DWMCI + SZ_4K - 1,
-                .flags  = IORESOURCE_MEM,
-        },
-        [1] = {
-                .start  = IRQ_DWMCI,
-                .end    = IRQ_DWMCI,
-                .flags  = IORESOURCE_IRQ,
-        }
+        [0] = DEFINE_RES_MEM(EXYNOS4_PA_DWMCI, SZ_4K),
+        [1] = DEFINE_RES_IRQ(EXYNOS4_IRQ_DWMCI),
 };
 
 static struct dw_mci_board exynos4_dwci_pdata = {
diff --git a/arch/arm/mach-exynos/include/mach/irqs.h b/arch/arm/mach-exynos/include/mach/irqs.h
index 9bee8535d9e0..591e78521a9f 100644
--- a/arch/arm/mach-exynos/include/mach/irqs.h
+++ b/arch/arm/mach-exynos/include/mach/irqs.h
@@ -212,6 +212,8 @@
 #define IRQ_MFC                         EXYNOS4_IRQ_MFC
 #define IRQ_SDO                         EXYNOS4_IRQ_SDO
 
+#define IRQ_I2S0                        EXYNOS4_IRQ_I2S0
+
 #define IRQ_ADC                         EXYNOS4_IRQ_ADC0
 #define IRQ_TC                          EXYNOS4_IRQ_PEN0
 
diff --git a/arch/arm/mach-exynos/include/mach/map.h b/arch/arm/mach-exynos/include/mach/map.h
index 024d38ff1718..6e6d11ff352a 100644
--- a/arch/arm/mach-exynos/include/mach/map.h
+++ b/arch/arm/mach-exynos/include/mach/map.h
@@ -89,6 +89,10 @@
 #define EXYNOS4_PA_MDMA1                0x12840000
 #define EXYNOS4_PA_PDMA0                0x12680000
 #define EXYNOS4_PA_PDMA1                0x12690000
+#define EXYNOS5_PA_MDMA0                0x10800000
+#define EXYNOS5_PA_MDMA1                0x11C10000
+#define EXYNOS5_PA_PDMA0                0x121A0000
+#define EXYNOS5_PA_PDMA1                0x121B0000
 
 #define EXYNOS4_PA_SYSMMU_MDMA          0x10A40000
 #define EXYNOS4_PA_SYSMMU_SSS           0x10A50000
diff --git a/arch/arm/mach-exynos/include/mach/regs-clock.h b/arch/arm/mach-exynos/include/mach/regs-clock.h
index e141c1fd68d8..d9578a58ae7f 100644
--- a/arch/arm/mach-exynos/include/mach/regs-clock.h
+++ b/arch/arm/mach-exynos/include/mach/regs-clock.h
@@ -255,9 +255,15 @@
 
 /* For EXYNOS5250 */
 
+#define EXYNOS5_APLL_LOCK                       EXYNOS_CLKREG(0x00000)
 #define EXYNOS5_APLL_CON0                       EXYNOS_CLKREG(0x00100)
 #define EXYNOS5_CLKSRC_CPU                      EXYNOS_CLKREG(0x00200)
+#define EXYNOS5_CLKMUX_STATCPU                  EXYNOS_CLKREG(0x00400)
 #define EXYNOS5_CLKDIV_CPU0                     EXYNOS_CLKREG(0x00500)
+#define EXYNOS5_CLKDIV_CPU1                     EXYNOS_CLKREG(0x00504)
+#define EXYNOS5_CLKDIV_STATCPU0                 EXYNOS_CLKREG(0x00600)
+#define EXYNOS5_CLKDIV_STATCPU1                 EXYNOS_CLKREG(0x00604)
+
 #define EXYNOS5_MPLL_CON0                       EXYNOS_CLKREG(0x04100)
 #define EXYNOS5_CLKSRC_CORE1                    EXYNOS_CLKREG(0x04204)
 
diff --git a/arch/arm/mach-exynos/mach-exynos5-dt.c b/arch/arm/mach-exynos/mach-exynos5-dt.c
index 0d26f50081ad..4711c8920e37 100644
--- a/arch/arm/mach-exynos/mach-exynos5-dt.c
+++ b/arch/arm/mach-exynos/mach-exynos5-dt.c
@@ -45,7 +45,7 @@ static const struct of_dev_auxdata exynos5250_auxdata_lookup[] __initconst = {
                                 "exynos4210-uart.3", NULL),
         OF_DEV_AUXDATA("arm,pl330", EXYNOS5_PA_PDMA0, "dma-pl330.0", NULL),
         OF_DEV_AUXDATA("arm,pl330", EXYNOS5_PA_PDMA1, "dma-pl330.1", NULL),
-        OF_DEV_AUXDATA("arm,pl330", EXYNOS5_PA_PDMA1, "dma-pl330.2", NULL),
+        OF_DEV_AUXDATA("arm,pl330", EXYNOS5_PA_MDMA1, "dma-pl330.2", NULL),
         {},
 };
 
diff --git a/arch/arm/mach-exynos/mach-nuri.c b/arch/arm/mach-exynos/mach-nuri.c
index b3982c867c9c..ed90aef404c3 100644
--- a/arch/arm/mach-exynos/mach-nuri.c
+++ b/arch/arm/mach-exynos/mach-nuri.c
@@ -112,6 +112,7 @@ static struct s3c_sdhci_platdata nuri_hsmmc0_data __initdata = {
         .host_caps              = (MMC_CAP_8_BIT_DATA | MMC_CAP_4_BIT_DATA |
                                 MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
                                 MMC_CAP_ERASE),
+        .host_caps2             = MMC_CAP2_BROKEN_VOLTAGE,
         .cd_type                = S3C_SDHCI_CD_PERMANENT,
         .clk_type               = S3C_SDHCI_CLK_DIV_EXTERNAL,
 };
@@ -307,49 +308,7 @@ static struct i2c_board_info i2c1_devs[] __initdata = {
 };
 
 /* TSP */
-static u8 mxt_init_vals[] = {
-        /* MXT_GEN_COMMAND(6) */
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        /* MXT_GEN_POWER(7) */
-        0x20, 0xff, 0x32,
-        /* MXT_GEN_ACQUIRE(8) */
-        0x0a, 0x00, 0x05, 0x00, 0x00, 0x00, 0x09, 0x23,
-        /* MXT_TOUCH_MULTI(9) */
-        0x00, 0x00, 0x00, 0x13, 0x0b, 0x00, 0x00, 0x00, 0x02, 0x00,
-        0x00, 0x01, 0x01, 0x0e, 0x0a, 0x0a, 0x0a, 0x0a, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00,
-        /* MXT_TOUCH_KEYARRAY(15) */
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
-        0x00,
-        /* MXT_SPT_GPIOPWM(19) */
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        /* MXT_PROCI_GRIPFACE(20) */
-        0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x28, 0x04,
-        0x0f, 0x0a,
-        /* MXT_PROCG_NOISE(22) */
-        0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x23, 0x00,
-        0x00, 0x05, 0x0f, 0x19, 0x23, 0x2d, 0x03,
-        /* MXT_TOUCH_PROXIMITY(23) */
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00,
-        /* MXT_PROCI_ONETOUCH(24) */
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        /* MXT_SPT_SELFTEST(25) */
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00,
-        /* MXT_PROCI_TWOTOUCH(27) */
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        /* MXT_SPT_CTECONFIG(28) */
-        0x00, 0x00, 0x02, 0x08, 0x10, 0x00,
-};
-
 static struct mxt_platform_data mxt_platform_data = {
-        .config                 = mxt_init_vals,
-        .config_length          = ARRAY_SIZE(mxt_init_vals),
-
         .x_line                 = 18,
         .y_line                 = 11,
         .x_size                 = 1024,
@@ -571,7 +530,7 @@ static struct regulator_init_data __initdata max8997_ldo7_data = {
 
 static struct regulator_init_data __initdata max8997_ldo8_data = {
         .constraints    = {
-                .name           = "VUSB/VDAC_3.3V_C210",
+                .name           = "VUSB+VDAC_3.3V_C210",
                 .min_uV         = 3300000,
                 .max_uV         = 3300000,
                 .valid_ops_mask = REGULATOR_CHANGE_STATUS,
@@ -1347,6 +1306,7 @@ static struct platform_device *nuri_devices[] __initdata = {
 
 static void __init nuri_map_io(void)
 {
+        clk_xusbxti.rate = 24000000;
         exynos_init_io(NULL, 0);
         s3c24xx_init_clocks(24000000);
         s3c24xx_init_uarts(nuri_uartcfgs, ARRAY_SIZE(nuri_uartcfgs));
@@ -1379,7 +1339,6 @@ static void __init nuri_machine_init(void)
         nuri_camera_init();
 
         nuri_ehci_init();
-        clk_xusbxti.rate = 24000000;
 
         /* Last */
         platform_add_devices(nuri_devices, ARRAY_SIZE(nuri_devices));
diff --git a/arch/arm/mach-exynos/mach-universal_c210.c b/arch/arm/mach-exynos/mach-universal_c210.c
index 6bb9dbdd73fd..cb2b027f09a6 100644
--- a/arch/arm/mach-exynos/mach-universal_c210.c
+++ b/arch/arm/mach-exynos/mach-universal_c210.c
@@ -29,6 +29,7 @@
 #include <asm/mach-types.h>
 
 #include <plat/regs-serial.h>
+#include <plat/clock.h>
 #include <plat/cpu.h>
 #include <plat/devs.h>
 #include <plat/iic.h>
@@ -746,6 +747,7 @@ static struct s3c_sdhci_platdata universal_hsmmc0_data __initdata = {
         .max_width              = 8,
         .host_caps              = (MMC_CAP_8_BIT_DATA | MMC_CAP_4_BIT_DATA |
                                 MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED),
+        .host_caps2             = MMC_CAP2_BROKEN_VOLTAGE,
         .cd_type                = S3C_SDHCI_CD_PERMANENT,
         .clk_type               = S3C_SDHCI_CLK_DIV_EXTERNAL,
 };
@@ -1057,6 +1059,7 @@ static struct platform_device *universal_devices[] __initdata = {
 
 static void __init universal_map_io(void)
 {
+        clk_xusbxti.rate = 24000000;
         exynos_init_io(NULL, 0);
         s3c24xx_init_clocks(24000000);
         s3c24xx_init_uarts(universal_uartcfgs, ARRAY_SIZE(universal_uartcfgs));
diff --git a/arch/arm/mach-imx/imx27-dt.c b/arch/arm/mach-imx/imx27-dt.c
index 861ceb8232d6..ed38d03c61f2 100644
--- a/arch/arm/mach-imx/imx27-dt.c
+++ b/arch/arm/mach-imx/imx27-dt.c
@@ -35,7 +35,7 @@ static const struct of_dev_auxdata imx27_auxdata_lookup[] __initconst = {
 static int __init imx27_avic_add_irq_domain(struct device_node *np,
                                 struct device_node *interrupt_parent)
 {
-        irq_domain_add_simple(np, 0);
+        irq_domain_add_legacy(np, 64, 0, 0, &irq_domain_simple_ops, NULL);
         return 0;
 }
 
@@ -44,7 +44,9 @@ static int __init imx27_gpio_add_irq_domain(struct device_node *np,
 {
         static int gpio_irq_base = MXC_GPIO_IRQ_START + ARCH_NR_GPIOS;
 
-        irq_domain_add_simple(np, gpio_irq_base);
+        gpio_irq_base -= 32;
+        irq_domain_add_legacy(np, 32, gpio_irq_base, 0, &irq_domain_simple_ops,
+                                NULL);
 
         return 0;
 }
diff --git a/arch/arm/mach-imx/mm-imx5.c b/arch/arm/mach-imx/mm-imx5.c
index 05250aed61fb..e10f3914fcfe 100644
--- a/arch/arm/mach-imx/mm-imx5.c
+++ b/arch/arm/mach-imx/mm-imx5.c
@@ -35,7 +35,7 @@ static void imx5_idle(void)
         }
         clk_enable(gpc_dvfs_clk);
         mx5_cpu_lp_set(WAIT_UNCLOCKED_POWER_OFF);
-        if (tzic_enable_wake() != 0)
+        if (!tzic_enable_wake())
                 cpu_do_idle();
         clk_disable(gpc_dvfs_clk);
 }
diff --git a/arch/arm/mach-msm/board-halibut.c b/arch/arm/mach-msm/board-halibut.c
index 3698a370d636..26aac363a064 100644
--- a/arch/arm/mach-msm/board-halibut.c
+++ b/arch/arm/mach-msm/board-halibut.c
@@ -86,9 +86,6 @@ static void __init halibut_init(void)
 static void __init halibut_fixup(struct tag *tags, char **cmdline,
                                  struct meminfo *mi)
 {
-        mi->nr_banks=1;
-        mi->bank[0].start = PHYS_OFFSET;
-        mi->bank[0].size = (101*1024*1024);
 }
 
 static void __init halibut_map_io(void)
diff --git a/arch/arm/mach-msm/board-msm8x60.c b/arch/arm/mach-msm/board-msm8x60.c
index 962e71169750..fb3496a52ef4 100644
--- a/arch/arm/mach-msm/board-msm8x60.c
+++ b/arch/arm/mach-msm/board-msm8x60.c
@@ -17,6 +17,7 @@
 #include <linux/irqdomain.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/of_irq.h>
 #include <linux/of_platform.h>
 #include <linux/memblock.h>
 
@@ -49,10 +50,22 @@ static void __init msm8x60_map_io(void)
         msm_map_msm8x60_io();
 }
 
+#ifdef CONFIG_OF
+static struct of_device_id msm_dt_gic_match[] __initdata = {
+        { .compatible = "qcom,msm-8660-qgic", .data = gic_of_init },
+        {}
+};
+#endif
+
 static void __init msm8x60_init_irq(void)
 {
-        gic_init(0, GIC_PPI_START, MSM_QGIC_DIST_BASE,
-                 (void *)MSM_QGIC_CPU_BASE);
+        if (!of_have_populated_dt())
+                gic_init(0, GIC_PPI_START, MSM_QGIC_DIST_BASE,
+                         (void *)MSM_QGIC_CPU_BASE);
+#ifdef CONFIG_OF
+        else
+                of_irq_init(msm_dt_gic_match);
+#endif
 
         /* Edge trigger PPIs except AVS_SVICINT and AVS_SVICINTSWDONE */
         writel(0xFFFFD7FF, MSM_QGIC_DIST_BASE + GIC_DIST_CONFIG + 4);
@@ -73,16 +86,8 @@ static struct of_dev_auxdata msm_auxdata_lookup[] __initdata = {
         {}
 };
 
-static struct of_device_id msm_dt_gic_match[] __initdata = {
-        { .compatible = "qcom,msm-8660-qgic", },
-        {}
-};
-
 static void __init msm8x60_dt_init(void)
 {
-        irq_domain_generate_simple(msm_dt_gic_match, MSM8X60_QGIC_DIST_PHYS,
-                                GIC_SPI_START);
-
         if (of_machine_is_compatible("qcom,msm8660-surf")) {
                 printk(KERN_INFO "Init surf UART registers\n");
                 msm8x60_init_uart12dm();
diff --git a/arch/arm/mach-msm/board-trout-panel.c b/arch/arm/mach-msm/board-trout-panel.c
index 25105c1027fe..89bf6b426699 100644
--- a/arch/arm/mach-msm/board-trout-panel.c
+++ b/arch/arm/mach-msm/board-trout-panel.c
@@ -12,6 +12,7 @@
 
 #include <asm/io.h>
 #include <asm/mach-types.h>
+#include <asm/system_info.h>
 
 #include <mach/msm_fb.h>
 #include <mach/vreg.h>
diff --git a/arch/arm/mach-msm/board-trout.c b/arch/arm/mach-msm/board-trout.c
index 5414f76ec0a9..d4060a37e23d 100644
--- a/arch/arm/mach-msm/board-trout.c
+++ b/arch/arm/mach-msm/board-trout.c
@@ -19,6 +19,7 @@
 #include <linux/platform_device.h>
 #include <linux/clkdev.h>
 
+#include <asm/system_info.h>
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-msm/proc_comm.c b/arch/arm/mach-msm/proc_comm.c
index 67e701c7f183..9980dc736e7b 100644
--- a/arch/arm/mach-msm/proc_comm.c
+++ b/arch/arm/mach-msm/proc_comm.c
@@ -121,7 +121,7 @@ int msm_proc_comm(unsigned cmd, unsigned *data1, unsigned *data2)
  * and unknown state. This function should be called early to
  * wait on the ARM9.
  */
-void __init proc_comm_boot_wait(void)
+void __devinit proc_comm_boot_wait(void)
 {
         void __iomem *base = MSM_SHARED_RAM_BASE;
  
diff --git a/arch/arm/mach-omap1/mux.c b/arch/arm/mach-omap1/mux.c
index 087dba0df47e..e9cc52d4cb28 100644
--- a/arch/arm/mach-omap1/mux.c
+++ b/arch/arm/mach-omap1/mux.c
@@ -27,6 +27,7 @@
 #include <linux/io.h>
 #include <linux/spinlock.h>
 
+#include <mach/hardware.h>
 
 #include <plat/mux.h>
 
diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c
index 6e90665a7c47..fb202af01d0d 100644
--- a/arch/arm/mach-omap1/timer.c
+++ b/arch/arm/mach-omap1/timer.c
@@ -47,9 +47,9 @@ static int omap1_dm_timer_set_src(struct platform_device *pdev,
         int n = (pdev->id - 1) << 1;
         u32 l;
 
-        l = __raw_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
+        l = omap_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
         l |= source << n;
-        __raw_writel(l, MOD_CONF_CTRL_1);
+        omap_writel(l, MOD_CONF_CTRL_1);
 
         return 0;
 }
diff --git a/arch/arm/mach-omap2/board-4430sdp.c b/arch/arm/mach-omap2/board-4430sdp.c
index a39fc4bbd2b8..130ab00c09a2 100644
--- a/arch/arm/mach-omap2/board-4430sdp.c
+++ b/arch/arm/mach-omap2/board-4430sdp.c
@@ -20,6 +20,7 @@
 #include <linux/usb/otg.h>
 #include <linux/spi/spi.h>
 #include <linux/i2c/twl.h>
+#include <linux/mfd/twl6040.h>
 #include <linux/gpio_keys.h>
 #include <linux/regulator/machine.h>
 #include <linux/regulator/fixed.h>
@@ -560,7 +561,7 @@ static struct regulator_init_data sdp4430_vusim = {
         },
 };
 
-static struct twl4030_codec_data twl6040_codec = {
+static struct twl6040_codec_data twl6040_codec = {
         /* single-step ramp for headset and handsfree */
         .hs_left_step   = 0x0f,
         .hs_right_step  = 0x0f,
@@ -568,7 +569,7 @@ static struct twl4030_codec_data twl6040_codec = {
         .hf_right_step  = 0x1d,
 };
 
-static struct twl4030_vibra_data twl6040_vibra = {
+static struct twl6040_vibra_data twl6040_vibra = {
         .vibldrv_res = 8,
         .vibrdrv_res = 3,
         .viblmotor_res = 10,
@@ -577,16 +578,14 @@ static struct twl4030_vibra_data twl6040_vibra = {
         .vddvibr_uV = 0,        /* fixed volt supply - VBAT */
 };
 
-static struct twl4030_audio_data twl6040_audio = {
+static struct twl6040_platform_data twl6040_data = {
         .codec          = &twl6040_codec,
         .vibra          = &twl6040_vibra,
         .audpwron_gpio  = 127,
-        .naudint_irq    = OMAP44XX_IRQ_SYS_2N,
         .irq_base       = TWL6040_CODEC_IRQ_BASE,
 };
 
 static struct twl4030_platform_data sdp4430_twldata = {
-        .audio          = &twl6040_audio,
         /* Regulators */
         .vusim          = &sdp4430_vusim,
         .vaux1          = &sdp4430_vaux1,
@@ -617,7 +616,8 @@ static int __init omap4_i2c_init(void)
                         TWL_COMMON_REGULATOR_VCXIO |
                         TWL_COMMON_REGULATOR_VUSB |
                         TWL_COMMON_REGULATOR_CLK32KG);
-        omap4_pmic_init("twl6030", &sdp4430_twldata);
+        omap4_pmic_init("twl6030", &sdp4430_twldata,
+                        &twl6040_data, OMAP44XX_IRQ_SYS_2N);
         omap_register_i2c_bus(2, 400, NULL, 0);
         omap_register_i2c_bus(3, 400, sdp4430_i2c_3_boardinfo,
                                 ARRAY_SIZE(sdp4430_i2c_3_boardinfo));
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 74e1687b5170..098d183a0086 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -137,7 +137,7 @@ static struct twl4030_platform_data sdp4430_twldata = {
 
 static void __init omap4_i2c_init(void)
 {
-        omap4_pmic_init("twl6030", &sdp4430_twldata);
+        omap4_pmic_init("twl6030", &sdp4430_twldata, NULL, 0);
 }
 
 static void __init omap4_init(void)
diff --git a/arch/arm/mach-omap2/board-omap4panda.c b/arch/arm/mach-omap2/board-omap4panda.c
index d8c0e89f0126..1b782ba53433 100644
--- a/arch/arm/mach-omap2/board-omap4panda.c
+++ b/arch/arm/mach-omap2/board-omap4panda.c
@@ -25,6 +25,7 @@
 #include <linux/gpio.h>
 #include <linux/usb/otg.h>
 #include <linux/i2c/twl.h>
+#include <linux/mfd/twl6040.h>
 #include <linux/regulator/machine.h>
 #include <linux/regulator/fixed.h>
 #include <linux/wl12xx.h>
@@ -284,7 +285,7 @@ static int __init omap4_twl6030_hsmmc_init(struct omap2_hsmmc_info *controllers)
         return 0;
 }
 
-static struct twl4030_codec_data twl6040_codec = {
+static struct twl6040_codec_data twl6040_codec = {
         /* single-step ramp for headset and handsfree */
         .hs_left_step   = 0x0f,
         .hs_right_step  = 0x0f,
@@ -292,17 +293,14 @@ static struct twl4030_codec_data twl6040_codec = {
         .hf_right_step  = 0x1d,
 };
 
-static struct twl4030_audio_data twl6040_audio = {
+static struct twl6040_platform_data twl6040_data = {
         .codec          = &twl6040_codec,
         .audpwron_gpio  = 127,
-        .naudint_irq    = OMAP44XX_IRQ_SYS_2N,
         .irq_base       = TWL6040_CODEC_IRQ_BASE,
 };
 
 /* Panda board uses the common PMIC configuration */
-static struct twl4030_platform_data omap4_panda_twldata = {
-        .audio          = &twl6040_audio,
-};
+static struct twl4030_platform_data omap4_panda_twldata;
 
 /*
  * Display monitor features are burnt in their EEPROM as EDID data. The EEPROM
@@ -326,7 +324,8 @@ static int __init omap4_panda_i2c_init(void)
                         TWL_COMMON_REGULATOR_VCXIO |
                         TWL_COMMON_REGULATOR_VUSB |
                         TWL_COMMON_REGULATOR_CLK32KG);
-        omap4_pmic_init("twl6030", &omap4_panda_twldata);
+        omap4_pmic_init("twl6030", &omap4_panda_twldata,
+                        &twl6040_data, OMAP44XX_IRQ_SYS_2N);
         omap_register_i2c_bus(2, 400, NULL, 0);
         /*
          * Bus 3 is attached to the DVI port where devices like the pico DLP
diff --git a/arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c b/arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c
index 7072e0d651b1..3d9d746b221a 100644
--- a/arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c
+++ b/arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c
@@ -165,83 +165,3 @@ int omap2_select_table_rate(struct clk *clk, unsigned long rate)
 
         return 0;
 }
-
-#ifdef CONFIG_CPU_FREQ
-/*
- * Walk PRCM rate table and fillout cpufreq freq_table
- * XXX This should be replaced by an OPP layer in the near future
- */
-static struct cpufreq_frequency_table *freq_table;
-
-void omap2_clk_init_cpufreq_table(struct cpufreq_frequency_table **table)
-{
-        const struct prcm_config *prcm;
-        int i = 0;
-        int tbl_sz = 0;
-
-        if (!cpu_is_omap24xx())
-                return;
-
-        for (prcm = rate_table; prcm->mpu_speed; prcm++) {
-                if (!(prcm->flags & cpu_mask))
-                        continue;
-                if (prcm->xtal_speed != sclk->rate)
-                        continue;
-
-                /* don't put bypass rates in table */
-                if (prcm->dpll_speed == prcm->xtal_speed)
-                        continue;
-
-                tbl_sz++;
-        }
-
-        /*
-         * XXX Ensure that we're doing what CPUFreq expects for this error
-         * case and the following one
-         */
-        if (tbl_sz == 0) {
-                pr_warning("%s: no matching entries in rate_table\n",
-                           __func__);
-                return;
-        }
-
-        /* Include the CPUFREQ_TABLE_END terminator entry */
-        tbl_sz++;
-
-        freq_table = kzalloc(sizeof(struct cpufreq_frequency_table) * tbl_sz,
-                             GFP_ATOMIC);
-        if (!freq_table) {
-                pr_err("%s: could not kzalloc frequency table\n", __func__);
-                return;
-        }
-
-        for (prcm = rate_table; prcm->mpu_speed; prcm++) {
-                if (!(prcm->flags & cpu_mask))
-                        continue;
-                if (prcm->xtal_speed != sclk->rate)
-                        continue;
-
-                /* don't put bypass rates in table */
-                if (prcm->dpll_speed == prcm->xtal_speed)
-                        continue;
-
-                freq_table[i].index = i;
-                freq_table[i].frequency = prcm->mpu_speed / 1000;
-                i++;
-        }
-
-        freq_table[i].index = i;
-        freq_table[i].frequency = CPUFREQ_TABLE_END;
-
-        *table = &freq_table[0];
-}
-
-void omap2_clk_exit_cpufreq_table(struct cpufreq_frequency_table **table)
-{
-        if (!cpu_is_omap24xx())
-                return;
-
-        kfree(freq_table);
-}
-
-#endif
diff --git a/arch/arm/mach-omap2/clock.c b/arch/arm/mach-omap2/clock.c
index f57ed5baeccf..d9f4931513f9 100644
--- a/arch/arm/mach-omap2/clock.c
+++ b/arch/arm/mach-omap2/clock.c
@@ -536,10 +536,5 @@ struct clk_functions omap2_clk_functions = {
         .clk_set_rate           = omap2_clk_set_rate,
         .clk_set_parent         = omap2_clk_set_parent,
         .clk_disable_unused     = omap2_clk_disable_unused,
-#ifdef CONFIG_CPU_FREQ
-        /* These will be removed when the OPP code is integrated */
-        .clk_init_cpufreq_table = omap2_clk_init_cpufreq_table,
-        .clk_exit_cpufreq_table = omap2_clk_exit_cpufreq_table,
-#endif
 };
 
diff --git a/arch/arm/mach-omap2/clock.h b/arch/arm/mach-omap2/clock.h
index b8c2a686481c..a1bb23a23351 100644
--- a/arch/arm/mach-omap2/clock.h
+++ b/arch/arm/mach-omap2/clock.h
@@ -146,14 +146,6 @@ extern const struct clksel_rate gpt_sys_rates[];
 extern const struct clksel_rate gfx_l3_rates[];
 extern const struct clksel_rate dsp_ick_rates[];
 
-#if defined(CONFIG_ARCH_OMAP2) && defined(CONFIG_CPU_FREQ)
-extern void omap2_clk_init_cpufreq_table(struct cpufreq_frequency_table **table);
-extern void omap2_clk_exit_cpufreq_table(struct cpufreq_frequency_table **table);
-#else
-#define omap2_clk_init_cpufreq_table    0
-#define omap2_clk_exit_cpufreq_table    0
-#endif
-
 extern const struct clkops clkops_omap2_iclk_dflt_wait;
 extern const struct clkops clkops_omap2_iclk_dflt;
 extern const struct clkops clkops_omap2_iclk_idle_only;
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 2c27fdb61e66..7144ae651d3d 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1422,6 +1422,9 @@ static int _ocp_softreset(struct omap_hwmod *oh)
                 goto dis_opt_clks;
         _write_sysconfig(v, oh);
 
+        if (oh->class->sysc->srst_udelay)
+                udelay(oh->class->sysc->srst_udelay);
+
         if (oh->class->sysc->sysc_flags & SYSS_HAS_RESET_STATUS)
                 omap_test_timeout((omap_hwmod_read(oh,
                                                     oh->class->sysc->syss_offs)
@@ -1903,10 +1906,20 @@ void omap_hwmod_write(u32 v, struct omap_hwmod *oh, u16 reg_offs)
  */
 int omap_hwmod_softreset(struct omap_hwmod *oh)
 {
-        if (!oh)
+        u32 v;
+        int ret;
+
+        if (!oh || !(oh->_sysc_cache))
                 return -EINVAL;
 
-        return _ocp_softreset(oh);
+        v = oh->_sysc_cache;
+        ret = _set_softreset(oh, &v);
+        if (ret)
+                goto error;
+        _write_sysconfig(v, oh);
+
+error:
+        return ret;
 }
 
 /**
diff --git a/arch/arm/mach-omap2/omap_hwmod_2420_data.c b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
index a5409ce3f323..a6bde34e443a 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2420_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
@@ -1000,7 +1000,6 @@ static struct omap_hwmod_ocp_if omap2420_l4_core__dss_venc = {
                         .flags  = OMAP_FIREWALL_L4,
                 }
         },
-        .flags          = OCPIF_SWSUP_IDLE,
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
diff --git a/arch/arm/mach-omap2/omap_hwmod_2430_data.c b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
index c4f56cb60d7d..04a3885f4475 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2430_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
@@ -1049,7 +1049,6 @@ static struct omap_hwmod_ocp_if omap2430_l4_core__dss_venc = {
         .slave          = &omap2430_dss_venc_hwmod,
         .clk            = "dss_ick",
         .addr           = omap2_dss_venc_addrs,
-        .flags          = OCPIF_SWSUP_IDLE,
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index 34b9766d1d23..db86ce90c69f 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -1676,7 +1676,6 @@ static struct omap_hwmod_ocp_if omap3xxx_l4_core__dss_venc = {
                         .flags  = OMAP_FIREWALL_L4,
                 }
         },
-        .flags          = OCPIF_SWSUP_IDLE,
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index cc9bd106a854..6abc75753e42 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -2594,6 +2594,15 @@ static struct omap_hwmod omap44xx_ipu_hwmod = {
 static struct omap_hwmod_class_sysconfig omap44xx_iss_sysc = {
         .rev_offs       = 0x0000,
         .sysc_offs      = 0x0010,
+        /*
+         * ISS needs 100 OCP clk cycles delay after a softreset before
+         * accessing sysconfig again.
+         * The lowest frequency at the moment for L3 bus is 100 MHz, so
+         * 1usec delay is needed. Add an x2 margin to be safe (2 usecs).
+         *
+         * TODO: Indicate errata when available.
+         */
+        .srst_udelay    = 2,
         .sysc_flags     = (SYSC_HAS_MIDLEMODE | SYSC_HAS_RESET_STATUS |
                            SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET),
         .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index 0cdd359a128e..9fc2f44188cb 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -108,8 +108,14 @@ static void omap_uart_set_noidle(struct platform_device *pdev)
 static void omap_uart_set_smartidle(struct platform_device *pdev)
 {
         struct omap_device *od = to_omap_device(pdev);
+        u8 idlemode;
 
-        omap_hwmod_set_slave_idlemode(od->hwmods[0], HWMOD_IDLEMODE_SMART);
+        if (od->hwmods[0]->class->sysc->idlemodes & SIDLE_SMART_WKUP)
+                idlemode = HWMOD_IDLEMODE_SMART_WKUP;
+        else
+                idlemode = HWMOD_IDLEMODE_SMART;
+
+        omap_hwmod_set_slave_idlemode(od->hwmods[0], idlemode);
 }
 
 #else
@@ -120,124 +126,8 @@ static void omap_uart_set_smartidle(struct platform_device *pdev) {}
 #endif /* CONFIG_PM */
 
 #ifdef CONFIG_OMAP_MUX
-static struct omap_device_pad default_uart1_pads[] __initdata = {
-        {
-                .name   = "uart1_cts.uart1_cts",
-                .enable = OMAP_PIN_INPUT_PULLUP | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart1_rts.uart1_rts",
-                .enable = OMAP_PIN_OUTPUT | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart1_tx.uart1_tx",
-                .enable = OMAP_PIN_OUTPUT | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart1_rx.uart1_rx",
-                .flags  = OMAP_DEVICE_PAD_REMUX | OMAP_DEVICE_PAD_WAKEUP,
-                .enable = OMAP_PIN_INPUT_PULLUP | OMAP_MUX_MODE0,
-                .idle   = OMAP_PIN_INPUT_PULLUP | OMAP_MUX_MODE0,
-        },
-};
-
-static struct omap_device_pad default_uart2_pads[] __initdata = {
-        {
-                .name   = "uart2_cts.uart2_cts",
-                .enable = OMAP_PIN_INPUT_PULLUP | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart2_rts.uart2_rts",
-                .enable = OMAP_PIN_OUTPUT | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart2_tx.uart2_tx",
-                .enable = OMAP_PIN_OUTPUT | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart2_rx.uart2_rx",
-                .flags  = OMAP_DEVICE_PAD_REMUX | OMAP_DEVICE_PAD_WAKEUP,
-                .enable = OMAP_PIN_INPUT_PULLUP | OMAP_MUX_MODE0,
-                .idle   = OMAP_PIN_INPUT_PULLUP | OMAP_MUX_MODE0,
-        },
-};
-
-static struct omap_device_pad default_uart3_pads[] __initdata = {
-        {
-                .name   = "uart3_cts_rctx.uart3_cts_rctx",
-                .enable = OMAP_PIN_INPUT_PULLUP | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart3_rts_sd.uart3_rts_sd",
-                .enable = OMAP_PIN_OUTPUT | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart3_tx_irtx.uart3_tx_irtx",
-                .enable = OMAP_PIN_OUTPUT | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart3_rx_irrx.uart3_rx_irrx",
-                .flags  = OMAP_DEVICE_PAD_REMUX | OMAP_DEVICE_PAD_WAKEUP,
-                .enable = OMAP_PIN_INPUT | OMAP_MUX_MODE0,
-                .idle   = OMAP_PIN_INPUT | OMAP_MUX_MODE0,
-        },
-};
-
-static struct omap_device_pad default_omap36xx_uart4_pads[] __initdata = {
-        {
-                .name   = "gpmc_wait2.uart4_tx",
-                .enable = OMAP_PIN_OUTPUT | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "gpmc_wait3.uart4_rx",
-                .flags  = OMAP_DEVICE_PAD_REMUX | OMAP_DEVICE_PAD_WAKEUP,
-                .enable = OMAP_PIN_INPUT | OMAP_MUX_MODE2,
-                .idle   = OMAP_PIN_INPUT | OMAP_MUX_MODE2,
-        },
-};
-
-static struct omap_device_pad default_omap4_uart4_pads[] __initdata = {
-        {
-                .name   = "uart4_tx.uart4_tx",
-                .enable = OMAP_PIN_OUTPUT | OMAP_MUX_MODE0,
-        },
-        {
-                .name   = "uart4_rx.uart4_rx",
-                .flags  = OMAP_DEVICE_PAD_REMUX | OMAP_DEVICE_PAD_WAKEUP,
-                .enable = OMAP_PIN_INPUT | OMAP_MUX_MODE0,
-                .idle   = OMAP_PIN_INPUT | OMAP_MUX_MODE0,
-        },
-};
-
 static void omap_serial_fill_default_pads(struct omap_board_data *bdata)
 {
-        switch (bdata->id) {
-        case 0:
-                bdata->pads = default_uart1_pads;
-                bdata->pads_cnt = ARRAY_SIZE(default_uart1_pads);
-                break;
-        case 1:
-                bdata->pads = default_uart2_pads;
-                bdata->pads_cnt = ARRAY_SIZE(default_uart2_pads);
-                break;
-        case 2:
-                bdata->pads = default_uart3_pads;
-                bdata->pads_cnt = ARRAY_SIZE(default_uart3_pads);
-                break;
-        case 3:
-                if (cpu_is_omap44xx()) {
-                        bdata->pads = default_omap4_uart4_pads;
-                        bdata->pads_cnt =
-                                ARRAY_SIZE(default_omap4_uart4_pads);
-                } else if (cpu_is_omap3630()) {
-                        bdata->pads = default_omap36xx_uart4_pads;
-                        bdata->pads_cnt =
-                                ARRAY_SIZE(default_omap36xx_uart4_pads);
-                }
-                break;
-        default:
-                break;
-        }
 }
 #else
 static void omap_serial_fill_default_pads(struct omap_board_data *bdata) {}
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 4b57757bf9d1..7a7b89304c48 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -37,6 +37,16 @@ static struct i2c_board_info __initdata pmic_i2c_board_info = {
         .flags          = I2C_CLIENT_WAKE,
 };
 
+static struct i2c_board_info __initdata omap4_i2c1_board_info[] = {
+        {
+                .addr           = 0x48,
+                .flags          = I2C_CLIENT_WAKE,
+        },
+        {
+                I2C_BOARD_INFO("twl6040", 0x4b),
+        },
+};
+
 void __init omap_pmic_init(int bus, u32 clkrate,
                            const char *pmic_type, int pmic_irq,
                            struct twl4030_platform_data *pmic_data)
@@ -49,14 +59,31 @@ void __init omap_pmic_init(int bus, u32 clkrate,
         omap_register_i2c_bus(bus, clkrate, &pmic_i2c_board_info, 1);
 }
 
+void __init omap4_pmic_init(const char *pmic_type,
+                    struct twl4030_platform_data *pmic_data,
+                    struct twl6040_platform_data *twl6040_data, int twl6040_irq)
+{
+        /* PMIC part*/
+        strncpy(omap4_i2c1_board_info[0].type, pmic_type,
+                sizeof(omap4_i2c1_board_info[0].type));
+        omap4_i2c1_board_info[0].irq = OMAP44XX_IRQ_SYS_1N;
+        omap4_i2c1_board_info[0].platform_data = pmic_data;
+
+        /* TWL6040 audio IC part */
+        omap4_i2c1_board_info[1].irq = twl6040_irq;
+        omap4_i2c1_board_info[1].platform_data = twl6040_data;
+
+        omap_register_i2c_bus(1, 400, omap4_i2c1_board_info, 2);
+
+}
+
 void __init omap_pmic_late_init(void)
 {
         /* Init the OMAP TWL parameters (if PMIC has been registerd) */
-        if (!pmic_i2c_board_info.irq)
-                return;
-
-        omap3_twl_init();
-        omap4_twl_init();
+        if (pmic_i2c_board_info.irq)
+                omap3_twl_init();
+        if (omap4_i2c1_board_info[0].irq)
+                omap4_twl_init();
 }
 
 #if defined(CONFIG_ARCH_OMAP3)
diff --git a/arch/arm/mach-omap2/twl-common.h b/arch/arm/mach-omap2/twl-common.h
index 275dde8cb27a..09627483a57f 100644
--- a/arch/arm/mach-omap2/twl-common.h
+++ b/arch/arm/mach-omap2/twl-common.h
@@ -29,6 +29,7 @@
 
 
 struct twl4030_platform_data;
+struct twl6040_platform_data;
 
 void omap_pmic_init(int bus, u32 clkrate, const char *pmic_type, int pmic_irq,
                     struct twl4030_platform_data *pmic_data);
@@ -46,12 +47,9 @@ static inline void omap3_pmic_init(const char *pmic_type,
         omap_pmic_init(1, 2600, pmic_type, INT_34XX_SYS_NIRQ, pmic_data);
 }
 
-static inline void omap4_pmic_init(const char *pmic_type,
-                                   struct twl4030_platform_data *pmic_data)
-{
-        /* Phoenix Audio IC needs I2C1 to start with 400 KHz or less */
-        omap_pmic_init(1, 400, pmic_type, OMAP44XX_IRQ_SYS_1N, pmic_data);
-}
+void omap4_pmic_init(const char *pmic_type,
+                    struct twl4030_platform_data *pmic_data,
+                    struct twl6040_platform_data *audio_data, int twl6040_irq);
 
 void omap3_pmic_get_config(struct twl4030_platform_data *pmic_data,
                            u32 pdata_flags, u32 regulators_flags);
diff --git a/arch/arm/mach-pxa/include/mach/mfp-pxa2xx.h b/arch/arm/mach-pxa/include/mach/mfp-pxa2xx.h
index c54cef25895c..cbf51ae81855 100644
--- a/arch/arm/mach-pxa/include/mach/mfp-pxa2xx.h
+++ b/arch/arm/mach-pxa/include/mach/mfp-pxa2xx.h
@@ -17,6 +17,7 @@
  *
  * bit     23 - Input/Output (PXA2xx specific)
  * bit     24 - Wakeup Enable(PXA2xx specific)
+ * bit     25 - Keep Output  (PXA2xx specific)
  */
 
 #define MFP_DIR_IN              (0x0 << 23)
@@ -25,6 +26,12 @@
 #define MFP_DIR(x)              (((x) >> 23) & 0x1)
 
 #define MFP_LPM_CAN_WAKEUP      (0x1 << 24)
+
+/*
+ * MFP_LPM_KEEP_OUTPUT must be specified for pins that need to
+ * retain their last output level (low or high).
+ * Note: MFP_LPM_KEEP_OUTPUT has no effect on pins configured for input.
+ */
 #define MFP_LPM_KEEP_OUTPUT     (0x1 << 25)
 
 #define WAKEUP_ON_EDGE_RISE     (MFP_LPM_CAN_WAKEUP | MFP_LPM_EDGE_RISE)
diff --git a/arch/arm/mach-pxa/mfp-pxa2xx.c b/arch/arm/mach-pxa/mfp-pxa2xx.c
index b0a842887780..ef0426a159d4 100644
--- a/arch/arm/mach-pxa/mfp-pxa2xx.c
+++ b/arch/arm/mach-pxa/mfp-pxa2xx.c
@@ -33,6 +33,8 @@
 #define BANK_OFF(n)     (((n) < 3) ? (n) << 2 : 0x100 + (((n) - 3) << 2))
 #define GPLR(x)         __REG2(0x40E00000, BANK_OFF((x) >> 5))
 #define GPDR(x)         __REG2(0x40E00000, BANK_OFF((x) >> 5) + 0x0c)
+#define GPSR(x)         __REG2(0x40E00000, BANK_OFF((x) >> 5) + 0x18)
+#define GPCR(x)         __REG2(0x40E00000, BANK_OFF((x) >> 5) + 0x24)
 
 #define PWER_WE35       (1 << 24)
 
@@ -348,6 +350,7 @@ static inline void pxa27x_mfp_init(void) {}
 #ifdef CONFIG_PM
 static unsigned long saved_gafr[2][4];
 static unsigned long saved_gpdr[4];
+static unsigned long saved_gplr[4];
 static unsigned long saved_pgsr[4];
 
 static int pxa2xx_mfp_suspend(void)
@@ -366,14 +369,26 @@ static int pxa2xx_mfp_suspend(void)
         }
 
         for (i = 0; i <= gpio_to_bank(pxa_last_gpio); i++) {
-
                 saved_gafr[0][i] = GAFR_L(i);
                 saved_gafr[1][i] = GAFR_U(i);
                 saved_gpdr[i] = GPDR(i * 32);
+                saved_gplr[i] = GPLR(i * 32);
                 saved_pgsr[i] = PGSR(i);
 
-                GPDR(i * 32) = gpdr_lpm[i];
+                GPSR(i * 32) = PGSR(i);
+                GPCR(i * 32) = ~PGSR(i);
+        }
+
+        /* set GPDR bits taking into account MFP_LPM_KEEP_OUTPUT */
+        for (i = 0; i < pxa_last_gpio; i++) {
+                if ((gpdr_lpm[gpio_to_bank(i)] & GPIO_bit(i)) ||
+                    ((gpio_desc[i].config & MFP_LPM_KEEP_OUTPUT) &&
+                     (saved_gpdr[gpio_to_bank(i)] & GPIO_bit(i))))
+                        GPDR(i) |= GPIO_bit(i);
+                else
+                        GPDR(i) &= ~GPIO_bit(i);
         }
+
         return 0;
 }
 
@@ -384,6 +399,8 @@ static void pxa2xx_mfp_resume(void)
         for (i = 0; i <= gpio_to_bank(pxa_last_gpio); i++) {
                 GAFR_L(i) = saved_gafr[0][i];
                 GAFR_U(i) = saved_gafr[1][i];
+                GPSR(i * 32) = saved_gplr[i];
+                GPCR(i * 32) = ~saved_gplr[i];
                 GPDR(i * 32) = saved_gpdr[i];
                 PGSR(i) = saved_pgsr[i];
         }
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index 6bce78edce7a..4726c246dcdc 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -421,8 +421,11 @@ void __init pxa27x_set_i2c_power_info(struct i2c_pxa_platform_data *info)
         pxa_register_device(&pxa27x_device_i2c_power, info);
 }
 
+static struct pxa_gpio_platform_data pxa27x_gpio_info __initdata = {
+        .gpio_set_wake = gpio_set_wake,
+};
+
 static struct platform_device *devices[] __initdata = {
-        &pxa_device_gpio,
         &pxa27x_device_udc,
         &pxa_device_pmu,
         &pxa_device_i2s,
@@ -458,6 +461,7 @@ static int __init pxa27x_init(void)
                 register_syscore_ops(&pxa2xx_mfp_syscore_ops);
                 register_syscore_ops(&pxa2xx_clock_syscore_ops);
 
+                pxa_register_device(&pxa_device_gpio, &pxa27x_gpio_info);
                 ret = platform_add_devices(devices, ARRAY_SIZE(devices));
         }
 
diff --git a/arch/arm/mach-s3c24xx/Kconfig b/arch/arm/mach-s3c24xx/Kconfig
index 0f3a327ebcaa..b34287ab5afd 100644
--- a/arch/arm/mach-s3c24xx/Kconfig
+++ b/arch/arm/mach-s3c24xx/Kconfig
@@ -111,10 +111,6 @@ config S3C24XX_SETUP_TS
         help
           Compile in platform device definition for Samsung TouchScreen.
 
-# cpu-specific sections
-
-if CPU_S3C2410
-
 config S3C2410_DMA
         bool
         depends on S3C24XX_DMA && (CPU_S3C2410 || CPU_S3C2442)
@@ -127,6 +123,10 @@ config S3C2410_PM
         help
           Power Management code common to S3C2410 and better
 
+# cpu-specific sections
+
+if CPU_S3C2410
+
 config S3C24XX_SIMTEC_NOR
         bool
         help
diff --git a/arch/arm/mach-s5pv210/dma.c b/arch/arm/mach-s5pv210/dma.c
index 86ce62f66190..b8337e248b09 100644
--- a/arch/arm/mach-s5pv210/dma.c
+++ b/arch/arm/mach-s5pv210/dma.c
@@ -33,8 +33,6 @@
 #include <mach/irqs.h>
 #include <mach/dma.h>
 
-static u64 dma_dmamask = DMA_BIT_MASK(32);
-
 static u8 pdma0_peri[] = {
         DMACH_UART0_RX,
         DMACH_UART0_TX,
diff --git a/arch/arm/mach-s5pv210/mach-aquila.c b/arch/arm/mach-s5pv210/mach-aquila.c
index a9ea64e0da0d..48d018f2332b 100644
--- a/arch/arm/mach-s5pv210/mach-aquila.c
+++ b/arch/arm/mach-s5pv210/mach-aquila.c
@@ -484,8 +484,8 @@ static struct wm8994_pdata wm8994_platform_data = {
         .gpio_defaults[8] = 0x0100,
         .gpio_defaults[9] = 0x0100,
         .gpio_defaults[10] = 0x0100,
-        .ldo[0] = { S5PV210_MP03(6), NULL, &wm8994_ldo1_data }, /* XM0FRNB_2 */
-        .ldo[1] = { 0, NULL, &wm8994_ldo2_data },
+        .ldo[0] = { S5PV210_MP03(6), &wm8994_ldo1_data },       /* XM0FRNB_2 */
+        .ldo[1] = { 0, &wm8994_ldo2_data },
 };
 
 /* GPIO I2C PMIC */
diff --git a/arch/arm/mach-s5pv210/mach-goni.c b/arch/arm/mach-s5pv210/mach-goni.c
index 2cf5ed75f390..32395664e879 100644
--- a/arch/arm/mach-s5pv210/mach-goni.c
+++ b/arch/arm/mach-s5pv210/mach-goni.c
@@ -25,6 +25,7 @@
 #include <linux/gpio_keys.h>
 #include <linux/input.h>
 #include <linux/gpio.h>
+#include <linux/mmc/host.h>
 #include <linux/interrupt.h>
 
 #include <asm/hardware/vic.h>
@@ -674,8 +675,8 @@ static struct wm8994_pdata wm8994_platform_data = {
         .gpio_defaults[8] = 0x0100,
         .gpio_defaults[9] = 0x0100,
         .gpio_defaults[10] = 0x0100,
-        .ldo[0] = { S5PV210_MP03(6), NULL, &wm8994_ldo1_data }, /* XM0FRNB_2 */
-        .ldo[1] = { 0, NULL, &wm8994_ldo2_data },
+        .ldo[0] = { S5PV210_MP03(6), &wm8994_ldo1_data },       /* XM0FRNB_2 */
+        .ldo[1] = { 0, &wm8994_ldo2_data },
 };
 
 /* GPIO I2C PMIC */
@@ -765,6 +766,7 @@ static void __init goni_pmic_init(void)
 /* MoviNAND */
 static struct s3c_sdhci_platdata goni_hsmmc0_data __initdata = {
         .max_width              = 4,
+        .host_caps2             = MMC_CAP2_BROKEN_VOLTAGE,
         .cd_type                = S3C_SDHCI_CD_PERMANENT,
 };
 
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index 7c524b4e415d..16be4c56abe3 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -306,7 +306,7 @@ void sa11x0_register_irda(struct irda_platform_data *irda)
 }
 
 static struct resource sa1100_rtc_resources[] = {
-        DEFINE_RES_MEM(0x90010000, 0x9001003f),
+        DEFINE_RES_MEM(0x90010000, 0x40),
         DEFINE_RES_IRQ_NAMED(IRQ_RTC1Hz, "rtc 1Hz"),
         DEFINE_RES_IRQ_NAMED(IRQ_RTCAlrm, "rtc alarm"),
 };
diff --git a/arch/arm/mach-u300/core.c b/arch/arm/mach-u300/core.c
index 1621ad07d284..33339745d432 100644
--- a/arch/arm/mach-u300/core.c
+++ b/arch/arm/mach-u300/core.c
@@ -1667,8 +1667,10 @@ void __init u300_init_irq(void)
 
         for (i = 0; i < U300_VIC_IRQS_END; i++)
                 set_bit(i, (unsigned long *) &mask[0]);
-        vic_init((void __iomem *) U300_INTCON0_VBASE, 0, mask[0], mask[0]);
-        vic_init((void __iomem *) U300_INTCON1_VBASE, 32, mask[1], mask[1]);
+        vic_init((void __iomem *) U300_INTCON0_VBASE, IRQ_U300_INTCON0_START,
+                 mask[0], mask[0]);
+        vic_init((void __iomem *) U300_INTCON1_VBASE, IRQ_U300_INTCON1_START,
+                 mask[1], mask[1]);
 }
 
 
diff --git a/arch/arm/mach-u300/i2c.c b/arch/arm/mach-u300/i2c.c
index a38f80238ea9..cb04bd6ab3e7 100644
--- a/arch/arm/mach-u300/i2c.c
+++ b/arch/arm/mach-u300/i2c.c
@@ -146,9 +146,6 @@ static struct ab3100_platform_data ab3100_plf_data = {
                                 .min_uV = 1800000,
                                 .max_uV = 1800000,
                                 .valid_modes_mask = REGULATOR_MODE_NORMAL,
-                                .valid_ops_mask =
-                                REGULATOR_CHANGE_VOLTAGE |
-                                REGULATOR_CHANGE_STATUS,
                                 .always_on = 1,
                                 .boot_on = 1,
                         },
@@ -160,9 +157,6 @@ static struct ab3100_platform_data ab3100_plf_data = {
                                 .min_uV = 2500000,
                                 .max_uV = 2500000,
                                 .valid_modes_mask = REGULATOR_MODE_NORMAL,
-                                .valid_ops_mask =
-                                REGULATOR_CHANGE_VOLTAGE |
-                                REGULATOR_CHANGE_STATUS,
                                 .always_on = 1,
                                 .boot_on = 1,
                         },
@@ -230,8 +224,7 @@ static struct ab3100_platform_data ab3100_plf_data = {
                                 .max_uV = 1800000,
                                 .valid_modes_mask = REGULATOR_MODE_NORMAL,
                                 .valid_ops_mask =
-                                REGULATOR_CHANGE_VOLTAGE |
-                                REGULATOR_CHANGE_STATUS,
+                                REGULATOR_CHANGE_VOLTAGE,
                                 .always_on = 1,
                                 .boot_on = 1,
                         },
diff --git a/arch/arm/mach-u300/include/mach/irqs.h b/arch/arm/mach-u300/include/mach/irqs.h
index ee78a26707eb..ec09c1e07b1a 100644
--- a/arch/arm/mach-u300/include/mach/irqs.h
+++ b/arch/arm/mach-u300/include/mach/irqs.h
@@ -12,101 +12,101 @@
 #ifndef __MACH_IRQS_H
 #define __MACH_IRQS_H
 
-#define IRQ_U300_INTCON0_START          0
-#define IRQ_U300_INTCON1_START          32
+#define IRQ_U300_INTCON0_START          1
+#define IRQ_U300_INTCON1_START          33
 /* These are on INTCON0 - 30 lines */
-#define IRQ_U300_IRQ0_EXT               0
-#define IRQ_U300_IRQ1_EXT               1
-#define IRQ_U300_DMA                    2
-#define IRQ_U300_VIDEO_ENC_0            3
-#define IRQ_U300_VIDEO_ENC_1            4
-#define IRQ_U300_AAIF_RX                5
-#define IRQ_U300_AAIF_TX                6
-#define IRQ_U300_AAIF_VGPIO             7
-#define IRQ_U300_AAIF_WAKEUP            8
-#define IRQ_U300_PCM_I2S0_FRAME         9
-#define IRQ_U300_PCM_I2S0_FIFO          10
-#define IRQ_U300_PCM_I2S1_FRAME         11
-#define IRQ_U300_PCM_I2S1_FIFO          12
-#define IRQ_U300_XGAM_GAMCON            13
-#define IRQ_U300_XGAM_CDI               14
-#define IRQ_U300_XGAM_CDICON            15
+#define IRQ_U300_IRQ0_EXT               1
+#define IRQ_U300_IRQ1_EXT               2
+#define IRQ_U300_DMA                    3
+#define IRQ_U300_VIDEO_ENC_0            4
+#define IRQ_U300_VIDEO_ENC_1            5
+#define IRQ_U300_AAIF_RX                6
+#define IRQ_U300_AAIF_TX                7
+#define IRQ_U300_AAIF_VGPIO             8
+#define IRQ_U300_AAIF_WAKEUP            9
+#define IRQ_U300_PCM_I2S0_FRAME         10
+#define IRQ_U300_PCM_I2S0_FIFO          11
+#define IRQ_U300_PCM_I2S1_FRAME         12
+#define IRQ_U300_PCM_I2S1_FIFO          13
+#define IRQ_U300_XGAM_GAMCON            14
+#define IRQ_U300_XGAM_CDI               15
+#define IRQ_U300_XGAM_CDICON            16
 #if defined(CONFIG_MACH_U300_BS2X) || defined(CONFIG_MACH_U300_BS330)
 /* MMIACC not used on the DB3210 or DB3350 chips */
-#define IRQ_U300_XGAM_MMIACC            16
+#define IRQ_U300_XGAM_MMIACC            17
 #endif
-#define IRQ_U300_XGAM_PDI               17
-#define IRQ_U300_XGAM_PDICON            18
-#define IRQ_U300_XGAM_GAMEACC           19
-#define IRQ_U300_XGAM_MCIDCT            20
-#define IRQ_U300_APEX                   21
-#define IRQ_U300_UART0                  22
-#define IRQ_U300_SPI                    23
-#define IRQ_U300_TIMER_APP_OS           24
-#define IRQ_U300_TIMER_APP_DD           25
-#define IRQ_U300_TIMER_APP_GP1          26
-#define IRQ_U300_TIMER_APP_GP2          27
-#define IRQ_U300_TIMER_OS               28
-#define IRQ_U300_TIMER_MS               29
-#define IRQ_U300_KEYPAD_KEYBF           30
-#define IRQ_U300_KEYPAD_KEYBR           31
+#define IRQ_U300_XGAM_PDI               18
+#define IRQ_U300_XGAM_PDICON            19
+#define IRQ_U300_XGAM_GAMEACC           20
+#define IRQ_U300_XGAM_MCIDCT            21
+#define IRQ_U300_APEX                   22
+#define IRQ_U300_UART0                  23
+#define IRQ_U300_SPI                    24
+#define IRQ_U300_TIMER_APP_OS           25
+#define IRQ_U300_TIMER_APP_DD           26
+#define IRQ_U300_TIMER_APP_GP1          27
+#define IRQ_U300_TIMER_APP_GP2          28
+#define IRQ_U300_TIMER_OS               29
+#define IRQ_U300_TIMER_MS               30
+#define IRQ_U300_KEYPAD_KEYBF           31
+#define IRQ_U300_KEYPAD_KEYBR           32
 /* These are on INTCON1 - 32 lines */
-#define IRQ_U300_GPIO_PORT0             32
-#define IRQ_U300_GPIO_PORT1             33
-#define IRQ_U300_GPIO_PORT2             34
+#define IRQ_U300_GPIO_PORT0             33
+#define IRQ_U300_GPIO_PORT1             34
+#define IRQ_U300_GPIO_PORT2             35
 
 #if defined(CONFIG_MACH_U300_BS2X) || defined(CONFIG_MACH_U300_BS330) || \
     defined(CONFIG_MACH_U300_BS335)
 /* These are for DB3150, DB3200 and DB3350 */
-#define IRQ_U300_WDOG                   35
-#define IRQ_U300_EVHIST                 36
-#define IRQ_U300_MSPRO                  37
-#define IRQ_U300_MMCSD_MCIINTR0         38
-#define IRQ_U300_MMCSD_MCIINTR1         39
-#define IRQ_U300_I2C0                   40
-#define IRQ_U300_I2C1                   41
-#define IRQ_U300_RTC                    42
-#define IRQ_U300_NFIF                   43
-#define IRQ_U300_NFIF2                  44
+#define IRQ_U300_WDOG                   36
+#define IRQ_U300_EVHIST                 37
+#define IRQ_U300_MSPRO                  38
+#define IRQ_U300_MMCSD_MCIINTR0         39
+#define IRQ_U300_MMCSD_MCIINTR1         40
+#define IRQ_U300_I2C0                   41
+#define IRQ_U300_I2C1                   42
+#define IRQ_U300_RTC                    43
+#define IRQ_U300_NFIF                   44
+#define IRQ_U300_NFIF2                  45
 #endif
 
 /* DB3150 and DB3200 have only 45 IRQs */
 #if defined(CONFIG_MACH_U300_BS2X) || defined(CONFIG_MACH_U300_BS330)
-#define U300_VIC_IRQS_END               45
+#define U300_VIC_IRQS_END               46
 #endif
 
 /* The DB3350-specific interrupt lines */
 #ifdef CONFIG_MACH_U300_BS335
-#define IRQ_U300_ISP_F0                 45
-#define IRQ_U300_ISP_F1                 46
-#define IRQ_U300_ISP_F2                 47
-#define IRQ_U300_ISP_F3                 48
-#define IRQ_U300_ISP_F4                 49
-#define IRQ_U300_GPIO_PORT3             50
-#define IRQ_U300_SYSCON_PLL_LOCK        51
-#define IRQ_U300_UART1                  52
-#define IRQ_U300_GPIO_PORT4             53
-#define IRQ_U300_GPIO_PORT5             54
-#define IRQ_U300_GPIO_PORT6             55
-#define U300_VIC_IRQS_END               56
+#define IRQ_U300_ISP_F0                 46
+#define IRQ_U300_ISP_F1                 47
+#define IRQ_U300_ISP_F2                 48
+#define IRQ_U300_ISP_F3                 49
+#define IRQ_U300_ISP_F4                 50
+#define IRQ_U300_GPIO_PORT3             51
+#define IRQ_U300_SYSCON_PLL_LOCK        52
+#define IRQ_U300_UART1                  53
+#define IRQ_U300_GPIO_PORT4             54
+#define IRQ_U300_GPIO_PORT5             55
+#define IRQ_U300_GPIO_PORT6             56
+#define U300_VIC_IRQS_END               57
 #endif
 
 /* The DB3210-specific interrupt lines */
 #ifdef CONFIG_MACH_U300_BS365
-#define IRQ_U300_GPIO_PORT3             35
-#define IRQ_U300_GPIO_PORT4             36
-#define IRQ_U300_WDOG                   37
-#define IRQ_U300_EVHIST                 38
-#define IRQ_U300_MSPRO                  39
-#define IRQ_U300_MMCSD_MCIINTR0         40
-#define IRQ_U300_MMCSD_MCIINTR1         41
-#define IRQ_U300_I2C0                   42
-#define IRQ_U300_I2C1                   43
-#define IRQ_U300_RTC                    44
-#define IRQ_U300_NFIF                   45
-#define IRQ_U300_NFIF2                  46
-#define IRQ_U300_SYSCON_PLL_LOCK        47
-#define U300_VIC_IRQS_END               48
+#define IRQ_U300_GPIO_PORT3             36
+#define IRQ_U300_GPIO_PORT4             37
+#define IRQ_U300_WDOG                   38
+#define IRQ_U300_EVHIST                 39
+#define IRQ_U300_MSPRO                  40
+#define IRQ_U300_MMCSD_MCIINTR0         41
+#define IRQ_U300_MMCSD_MCIINTR1         42
+#define IRQ_U300_I2C0                   43
+#define IRQ_U300_I2C1                   44
+#define IRQ_U300_RTC                    45
+#define IRQ_U300_NFIF                   46
+#define IRQ_U300_NFIF2                  47
+#define IRQ_U300_SYSCON_PLL_LOCK        48
+#define U300_VIC_IRQS_END               49
 #endif
 
 /* Maximum 8*7 GPIO lines */
@@ -117,6 +117,6 @@
 #define IRQ_U300_GPIO_END               (U300_VIC_IRQS_END)
 #endif
 
-#define NR_IRQS                         (IRQ_U300_GPIO_END)
+#define NR_IRQS                         (IRQ_U300_GPIO_END - IRQ_U300_INTCON0_START)
 
 #endif
diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
index 880d02ec89d4..ef7099eea0f2 100644
--- a/arch/arm/mach-ux500/Kconfig
+++ b/arch/arm/mach-ux500/Kconfig
@@ -17,6 +17,7 @@ config UX500_SOC_DB5500
 config UX500_SOC_DB8500
         bool
         select MFD_DB8500_PRCMU
+        select REGULATOR
         select REGULATOR_DB8500_PRCMU
         select CPU_FREQ_TABLE if CPU_FREQ
 
diff --git a/arch/arm/mach-ux500/mbox-db5500.c b/arch/arm/mach-ux500/mbox-db5500.c
index 2b2d51caf9d8..0127490218cd 100644
--- a/arch/arm/mach-ux500/mbox-db5500.c
+++ b/arch/arm/mach-ux500/mbox-db5500.c
@@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct device *dev,
         return sprintf(buf, "0x%X\n", mbox_value);
 }
 
-static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
+static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
 
 static int mbox_show(struct seq_file *s, void *data)
 {
diff --git a/arch/arm/mach-ux500/platsmp.c b/arch/arm/mach-ux500/platsmp.c
index d2058ef8345f..eff5842f6232 100644
--- a/arch/arm/mach-ux500/platsmp.c
+++ b/arch/arm/mach-ux500/platsmp.c
@@ -99,7 +99,7 @@ int __cpuinit boot_secondary(unsigned int cpu, struct task_struct *idle)
          */
         write_pen_release(cpu_logical_map(cpu));
 
-        gic_raise_softirq(cpumask_of(cpu), 1);
+        smp_send_reschedule(cpu);
 
         timeout = jiffies + (1 * HZ);
         while (time_before(jiffies, timeout)) {
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 7edef9121632..7c8a7d8467bf 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -723,7 +723,7 @@ config CPU_HIGH_VECTOR
         bool "Select the High exception vector"
         help
           Say Y here to select high exception vector(0xFFFF0000~).
-          The exception vector can be vary depending on the platform
+          The exception vector can vary depending on the platform
           design in nommu mode. If your platform needs to select
           high exception vector, say Y.
           Otherwise or if you are unsure, say N, and the low exception
diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
index ff1f7cc11f87..80741992a9fc 100644
--- a/arch/arm/mm/abort-ev6.S
+++ b/arch/arm/mm/abort-ev6.S
@@ -26,18 +26,23 @@ ENTRY(v6_early_abort)
         mrc     p15, 0, r1, c5, c0, 0           @ get FSR
         mrc     p15, 0, r0, c6, c0, 0           @ get FAR
 /*
- * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR (erratum 326103).
- * The test below covers all the write situations, including Java bytecodes
+ * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR.
  */
-        bic     r1, r1, #1 << 11                @ clear bit 11 of FSR
+#ifdef CONFIG_ARM_ERRATA_326103
+        ldr     ip, =0x4107b36
+        mrc     p15, 0, r3, c0, c0, 0           @ get processor id
+        teq     ip, r3, lsr #4                  @ r0 ARM1136?
+        bne     do_DataAbort
         tst     r5, #PSR_J_BIT                  @ Java?
+        tsteq   r5, #PSR_T_BIT                  @ Thumb?
         bne     do_DataAbort
-        do_thumb_abort fsr=r1, pc=r4, psr=r5, tmp=r3
-        ldreq   r3, [r4]                        @ read aborted ARM instruction
+        bic     r1, r1, #1 << 11                @ clear bit 11 of FSR
+        ldr     r3, [r4]                        @ read aborted ARM instruction
 #ifdef CONFIG_CPU_ENDIAN_BE8
-        reveq   r3, r3
+        rev     r3, r3
 #endif
         do_ldrd_abort tmp=ip, insn=r3
         tst     r3, #1 << 20                    @ L = 0 -> write
         orreq   r1, r1, #1 << 11                @ yes.
+#endif
         b       do_DataAbort
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index a53fd2aaa2f4..2a8e380501e8 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -32,6 +32,7 @@ static void __iomem *l2x0_base;
 static DEFINE_RAW_SPINLOCK(l2x0_lock);
 static u32 l2x0_way_mask;       /* Bitmask of active ways */
 static u32 l2x0_size;
+static unsigned long sync_reg_offset = L2X0_CACHE_SYNC;
 
 struct l2x0_regs l2x0_saved_regs;
 
@@ -61,12 +62,7 @@ static inline void cache_sync(void)
 {
         void __iomem *base = l2x0_base;
 
-#ifdef CONFIG_PL310_ERRATA_753970
-        /* write to an unmmapped register */
-        writel_relaxed(0, base + L2X0_DUMMY_REG);
-#else
-        writel_relaxed(0, base + L2X0_CACHE_SYNC);
-#endif
+        writel_relaxed(0, base + sync_reg_offset);
         cache_wait(base + L2X0_CACHE_SYNC, 1);
 }
 
@@ -85,10 +81,13 @@ static inline void l2x0_inv_line(unsigned long addr)
 }
 
 #if defined(CONFIG_PL310_ERRATA_588369) || defined(CONFIG_PL310_ERRATA_727915)
+static inline void debug_writel(unsigned long val)
+{
+        if (outer_cache.set_debug)
+                outer_cache.set_debug(val);
+}
 
-#define debug_writel(val)       outer_cache.set_debug(val)
-
-static void l2x0_set_debug(unsigned long val)
+static void pl310_set_debug(unsigned long val)
 {
         writel_relaxed(val, l2x0_base + L2X0_DEBUG_CTRL);
 }
@@ -98,7 +97,7 @@ static inline void debug_writel(unsigned long val)
 {
 }
 
-#define l2x0_set_debug  NULL
+#define pl310_set_debug NULL
 #endif
 
 #ifdef CONFIG_PL310_ERRATA_588369
@@ -331,6 +330,11 @@ void __init l2x0_init(void __iomem *base, u32 aux_val, u32 aux_mask)
                 else
                         ways = 8;
                 type = "L310";
+#ifdef CONFIG_PL310_ERRATA_753970
+                /* Unmapped register. */
+                sync_reg_offset = L2X0_DUMMY_REG;
+#endif
+                outer_cache.set_debug = pl310_set_debug;
                 break;
         case L2X0_CACHE_ID_PART_L210:
                 ways = (aux >> 13) & 0xf;
@@ -379,7 +383,6 @@ void __init l2x0_init(void __iomem *base, u32 aux_val, u32 aux_mask)
         outer_cache.flush_all = l2x0_flush_all;
         outer_cache.inv_all = l2x0_inv_all;
         outer_cache.disable = l2x0_disable;
-        outer_cache.set_debug = l2x0_set_debug;
 
         printk(KERN_INFO "%s cache controller enabled\n", type);
         printk(KERN_INFO "l2x0: %d ways, CACHE_ID 0x%08x, AUX_CTRL 0x%08x, Cache size: %d B\n",
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 9055b5a84ec5..f07467533365 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -320,7 +320,7 @@ retry:
          */
 
         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
-        if (flags & FAULT_FLAG_ALLOW_RETRY) {
+        if (!(fault & VM_FAULT_ERROR) && flags & FAULT_FLAG_ALLOW_RETRY) {
                 if (fault & VM_FAULT_MAJOR) {
                         tsk->maj_flt++;
                         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 595079fa9d1d..8f5813bbffb5 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -293,11 +293,11 @@ EXPORT_SYMBOL(pfn_valid);
 #endif
 
 #ifndef CONFIG_SPARSEMEM
-static void arm_memory_present(void)
+static void __init arm_memory_present(void)
 {
 }
 #else
-static void arm_memory_present(void)
+static void __init arm_memory_present(void)
 {
         struct memblock_region *reg;
 
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index b86f8933ff91..2c7cf2f9c837 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -618,8 +618,8 @@ static void __init alloc_init_section(pud_t *pud, unsigned long addr,
         }
 }
 
-static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
-        unsigned long phys, const struct mem_type *type)
+static void __init alloc_init_pud(pgd_t *pgd, unsigned long addr,
+        unsigned long end, unsigned long phys, const struct mem_type *type)
 {
         pud_t *pud = pud_offset(pgd, addr);
         unsigned long next;
diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
index 6486d2f253cd..d51225f90ae2 100644
--- a/arch/arm/mm/nommu.c
+++ b/arch/arm/mm/nommu.c
@@ -13,6 +13,7 @@
 #include <asm/sections.h>
 #include <asm/page.h>
 #include <asm/setup.h>
+#include <asm/traps.h>
 #include <asm/mach/arch.h>
 
 #include "mm.h"
@@ -39,6 +40,7 @@ void __init sanity_check_meminfo(void)
  */
 void __init paging_init(struct machine_desc *mdesc)
 {
+        early_trap_init((void *)CONFIG_VECTORS_BASE);
         bootmem_init();
 }
 
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index f1c8486f7501..c2e2b66f72b5 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -255,6 +255,18 @@ __v7_setup:
         mcr     p15, 0, r5, c10, c2, 0          @ write PRRR
         mcr     p15, 0, r6, c10, c2, 1          @ write NMRR
 #endif
+#ifndef CONFIG_ARM_THUMBEE
+        mrc     p15, 0, r0, c0, c1, 0           @ read ID_PFR0 for ThumbEE
+        and     r0, r0, #(0xf << 12)            @ ThumbEE enabled field
+        teq     r0, #(1 << 12)                  @ check if ThumbEE is present
+        bne     1f
+        mov     r5, #0
+        mcr     p14, 6, r5, c1, c0, 0           @ Initialize TEEHBR to 0
+        mrc     p14, 6, r0, c0, c0, 0           @ load TEECR
+        orr     r0, r0, #1                      @ set the 1st bit in order to
+        mcr     p14, 6, r0, c0, c0, 0           @ stop userspace TEEHBR access
+1:
+#endif
         adr     r5, v7_crval
         ldmia   r5, {r5, r6}
 #ifdef CONFIG_CPU_ENDIAN_BE8
diff --git a/arch/arm/plat-omap/clock.c b/arch/arm/plat-omap/clock.c
index 8506cbb7fea4..62ec5c452792 100644
--- a/arch/arm/plat-omap/clock.c
+++ b/arch/arm/plat-omap/clock.c
@@ -398,32 +398,6 @@ struct clk dummy_ck = {
         .ops    = &clkops_null,
 };
 
-#ifdef CONFIG_CPU_FREQ
-void clk_init_cpufreq_table(struct cpufreq_frequency_table **table)
-{
-        unsigned long flags;
-
-        if (!arch_clock || !arch_clock->clk_init_cpufreq_table)
-                return;
-
-        spin_lock_irqsave(&clockfw_lock, flags);
-        arch_clock->clk_init_cpufreq_table(table);
-        spin_unlock_irqrestore(&clockfw_lock, flags);
-}
-
-void clk_exit_cpufreq_table(struct cpufreq_frequency_table **table)
-{
-        unsigned long flags;
-
-        if (!arch_clock || !arch_clock->clk_exit_cpufreq_table)
-                return;
-
-        spin_lock_irqsave(&clockfw_lock, flags);
-        arch_clock->clk_exit_cpufreq_table(table);
-        spin_unlock_irqrestore(&clockfw_lock, flags);
-}
-#endif
-
 /*
  *
  */
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index ecdb3da0dea9..c58d896cd5c3 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -916,6 +916,13 @@ void omap_start_dma(int lch)
                         l |= OMAP_DMA_CCR_BUFFERING_DISABLE;
         l |= OMAP_DMA_CCR_EN;
 
+        /*
+         * As dma_write() uses IO accessors which are weakly ordered, there
+         * is no guarantee that data in coherent DMA memory will be visible
+         * to the DMA device.  Add a memory barrier here to ensure that any
+         * such data is visible prior to enabling DMA.
+         */
+        mb();
         p->dma_write(l, CCR, lch);
 
         dma_chan[lch].flags |= OMAP_DMA_ACTIVE;
@@ -965,6 +972,13 @@ void omap_stop_dma(int lch)
                 p->dma_write(l, CCR, lch);
         }
 
+        /*
+         * Ensure that data transferred by DMA is visible to any access
+         * after DMA has been disabled.  This is important for coherent
+         * DMA regions.
+         */
+        mb();
+
         if (!omap_dma_in_1510_mode() && dma_chan[lch].next_lch != -1) {
                 int next_lch, cur_lch = lch;
                 char dma_chan_link_map[dma_lch_count];
diff --git a/arch/arm/plat-omap/include/plat/clock.h b/arch/arm/plat-omap/include/plat/clock.h
index 240a7b9fd946..d0ef57c1d71b 100644
--- a/arch/arm/plat-omap/include/plat/clock.h
+++ b/arch/arm/plat-omap/include/plat/clock.h
@@ -272,8 +272,6 @@ struct clk {
 #endif
 };
 
-struct cpufreq_frequency_table;
-
 struct clk_functions {
         int             (*clk_enable)(struct clk *clk);
         void            (*clk_disable)(struct clk *clk);
@@ -283,10 +281,6 @@ struct clk_functions {
         void            (*clk_allow_idle)(struct clk *clk);
         void            (*clk_deny_idle)(struct clk *clk);
         void            (*clk_disable_unused)(struct clk *clk);
-#ifdef CONFIG_CPU_FREQ
-        void            (*clk_init_cpufreq_table)(struct cpufreq_frequency_table **);
-        void            (*clk_exit_cpufreq_table)(struct cpufreq_frequency_table **);
-#endif
 };
 
 extern int mpurate;
@@ -301,10 +295,6 @@ extern void recalculate_root_clocks(void);
 extern unsigned long followparent_recalc(struct clk *clk);
 extern void clk_enable_init_clocks(void);
 unsigned long omap_fixed_divisor_recalc(struct clk *clk);
-#ifdef CONFIG_CPU_FREQ
-extern void clk_init_cpufreq_table(struct cpufreq_frequency_table **table);
-extern void clk_exit_cpufreq_table(struct cpufreq_frequency_table **table);
-#endif
 extern struct clk *omap_clk_get_by_name(const char *name);
 extern int omap_clk_enable_autoidle_all(void);
 extern int omap_clk_disable_autoidle_all(void);
diff --git a/arch/arm/plat-omap/include/plat/omap_hwmod.h b/arch/arm/plat-omap/include/plat/omap_hwmod.h
index 8070145ccb98..3f26db4ee8e6 100644
--- a/arch/arm/plat-omap/include/plat/omap_hwmod.h
+++ b/arch/arm/plat-omap/include/plat/omap_hwmod.h
@@ -305,6 +305,7 @@ struct omap_hwmod_sysc_fields {
  * @rev_offs: IP block revision register offset (from module base addr)
  * @sysc_offs: OCP_SYSCONFIG register offset (from module base addr)
  * @syss_offs: OCP_SYSSTATUS register offset (from module base addr)
+ * @srst_udelay: Delay needed after doing a softreset in usecs
  * @idlemodes: One or more of {SIDLE,MSTANDBY}_{OFF,FORCE,SMART}
  * @sysc_flags: SYS{C,S}_HAS* flags indicating SYSCONFIG bits supported
  * @clockact: the default value of the module CLOCKACTIVITY bits
@@ -330,9 +331,10 @@ struct omap_hwmod_class_sysconfig {
         u16 sysc_offs;
         u16 syss_offs;
         u16 sysc_flags;
+        struct omap_hwmod_sysc_fields *sysc_fields;
+        u8 srst_udelay;
         u8 idlemodes;
         u8 clockact;
-        struct omap_hwmod_sysc_fields *sysc_fields;
 };
 
 /**
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index eec98afa0f83..f9a8c5341ee9 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -348,7 +348,6 @@ u32 omap3_configure_core_dpll(u32 m2, u32 unlock_dll, u32 f, u32 inc,
                         sdrc_actim_ctrl_b_1, sdrc_mr_1);
 }
 
-#ifdef CONFIG_PM
 void omap3_sram_restore_context(void)
 {
         omap_sram_ceil = omap_sram_base + omap_sram_size;
@@ -358,17 +357,18 @@ void omap3_sram_restore_context(void)
                                omap3_sram_configure_core_dpll_sz);
         omap_push_sram_idle();
 }
-#endif /* CONFIG_PM */
-
-#endif /* CONFIG_ARCH_OMAP3 */
 
 static inline int omap34xx_sram_init(void)
 {
-#if defined(CONFIG_ARCH_OMAP3) && defined(CONFIG_PM)
         omap3_sram_restore_context();
-#endif
         return 0;
 }
+#else
+static inline int omap34xx_sram_init(void)
+{
+        return 0;
+}
+#endif /* CONFIG_ARCH_OMAP3 */
 
 static inline int am33xx_sram_init(void)
 {
diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig
index 71553f410016..a0ffc77da809 100644
--- a/arch/arm/plat-samsung/Kconfig
+++ b/arch/arm/plat-samsung/Kconfig
@@ -302,6 +302,7 @@ comment "Power management"
 config SAMSUNG_PM_DEBUG
         bool "S3C2410 PM Suspend debug"
         depends on PM
+        select DEBUG_LL
         help
           Say Y here if you want verbose debugging from the PM Suspend and
           Resume code. See <file:Documentation/arm/Samsung-S3C24XX/Suspend.txt>
diff --git a/arch/arm/plat-samsung/include/plat/sdhci.h b/arch/arm/plat-samsung/include/plat/sdhci.h
index 317e246ffc56..e834c5ef437c 100644
--- a/arch/arm/plat-samsung/include/plat/sdhci.h
+++ b/arch/arm/plat-samsung/include/plat/sdhci.h
@@ -18,6 +18,8 @@
 #ifndef __PLAT_S3C_SDHCI_H
 #define __PLAT_S3C_SDHCI_H __FILE__
 
+#include <plat/devs.h>
+
 struct platform_device;
 struct mmc_host;
 struct mmc_card;
@@ -356,4 +358,30 @@ static inline void exynos4_default_sdhci3(void) { }
 
 #endif /* CONFIG_EXYNOS4_SETUP_SDHCI */
 
+static inline void s3c_sdhci_setname(int id, char *name)
+{
+        switch (id) {
+#ifdef CONFIG_S3C_DEV_HSMMC
+        case 0:
+                s3c_device_hsmmc0.name = name;
+                break;
+#endif
+#ifdef CONFIG_S3C_DEV_HSMMC1
+        case 1:
+                s3c_device_hsmmc1.name = name;
+                break;
+#endif
+#ifdef CONFIG_S3C_DEV_HSMMC2
+        case 2:
+                s3c_device_hsmmc2.name = name;
+                break;
+#endif
+#ifdef CONFIG_S3C_DEV_HSMMC3
+        case 3:
+                s3c_device_hsmmc3.name = name;
+                break;
+#endif
+        }
+}
+
 #endif /* __PLAT_S3C_SDHCI_H */
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 858748eaa144..bc683b8219b5 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -17,6 +17,8 @@
 #include <linux/sched.h>
 #include <linux/smp.h>
 #include <linux/init.h>
+#include <linux/uaccess.h>
+#include <linux/user.h>
 
 #include <asm/cp15.h>
 #include <asm/cputype.h>
@@ -529,6 +531,103 @@ void vfp_flush_hwstate(struct thread_info *thread)
 }
 
 /*
+ * Save the current VFP state into the provided structures and prepare
+ * for entry into a new function (signal handler).
+ */
+int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,
+                                    struct user_vfp_exc __user *ufp_exc)
+{
+        struct thread_info *thread = current_thread_info();
+        struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
+        int err = 0;
+
+        /* Ensure that the saved hwstate is up-to-date. */
+        vfp_sync_hwstate(thread);
+
+        /*
+         * Copy the floating point registers. There can be unused
+         * registers see asm/hwcap.h for details.
+         */
+        err |= __copy_to_user(&ufp->fpregs, &hwstate->fpregs,
+                              sizeof(hwstate->fpregs));
+        /*
+         * Copy the status and control register.
+         */
+        __put_user_error(hwstate->fpscr, &ufp->fpscr, err);
+
+        /*
+         * Copy the exception registers.
+         */
+        __put_user_error(hwstate->fpexc, &ufp_exc->fpexc, err);
+        __put_user_error(hwstate->fpinst, &ufp_exc->fpinst, err);
+        __put_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err);
+
+        if (err)
+                return -EFAULT;
+
+        /* Ensure that VFP is disabled. */
+        vfp_flush_hwstate(thread);
+
+        /*
+         * As per the PCS, clear the length and stride bits for function
+         * entry.
+         */
+        hwstate->fpscr &= ~(FPSCR_LENGTH_MASK | FPSCR_STRIDE_MASK);
+
+        /*
+         * Disable VFP in the hwstate so that we can detect if it gets
+         * used.
+         */
+        hwstate->fpexc &= ~FPEXC_EN;
+        return 0;
+}
+
+/* Sanitise and restore the current VFP state from the provided structures. */
+int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
+                             struct user_vfp_exc __user *ufp_exc)
+{
+        struct thread_info *thread = current_thread_info();
+        struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
+        unsigned long fpexc;
+        int err = 0;
+
+        /*
+         * If VFP has been used, then disable it to avoid corrupting
+         * the new thread state.
+         */
+        if (hwstate->fpexc & FPEXC_EN)
+                vfp_flush_hwstate(thread);
+
+        /*
+         * Copy the floating point registers. There can be unused
+         * registers see asm/hwcap.h for details.
+         */
+        err |= __copy_from_user(&hwstate->fpregs, &ufp->fpregs,
+                                sizeof(hwstate->fpregs));
+        /*
+         * Copy the status and control register.
+         */
+        __get_user_error(hwstate->fpscr, &ufp->fpscr, err);
+
+        /*
+         * Sanitise and restore the exception registers.
+         */
+        __get_user_error(fpexc, &ufp_exc->fpexc, err);
+
+        /* Ensure the VFP is enabled. */
+        fpexc |= FPEXC_EN;
+
+        /* Ensure FPINST2 is invalid and the exception flag is cleared. */
+        fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
+        hwstate->fpexc = fpexc;
+
+        __get_user_error(hwstate->fpinst, &ufp_exc->fpinst, err);
+        __get_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err);
+
+        return err ? -EFAULT : 0;
+}
+
+/*
  * VFP hardware can lose all context when a CPU goes offline.
  * As we will be running in SMP mode with CPU hotplug, we will save the
  * hardware state at every thread switch.  We clear our held state when
diff --git a/arch/blackfin/mach-bf538/boards/ezkit.c b/arch/blackfin/mach-bf538/boards/ezkit.c
index 1633a6f306c0..85038f54354d 100644
--- a/arch/blackfin/mach-bf538/boards/ezkit.c
+++ b/arch/blackfin/mach-bf538/boards/ezkit.c
@@ -38,7 +38,7 @@ static struct platform_device rtc_device = {
         .name = "rtc-bfin",
         .id   = -1,
 };
-#endif
+#endif  /* CONFIG_RTC_DRV_BFIN */
 
 #if defined(CONFIG_SERIAL_BFIN) || defined(CONFIG_SERIAL_BFIN_MODULE)
 #ifdef CONFIG_SERIAL_BFIN_UART0
@@ -100,7 +100,7 @@ static struct platform_device bfin_uart0_device = {
                 .platform_data = &bfin_uart0_peripherals, /* Passed to driver */
         },
 };
-#endif
+#endif  /* CONFIG_SERIAL_BFIN_UART0 */
 #ifdef CONFIG_SERIAL_BFIN_UART1
 static struct resource bfin_uart1_resources[] = {
         {
@@ -148,7 +148,7 @@ static struct platform_device bfin_uart1_device = {
                 .platform_data = &bfin_uart1_peripherals, /* Passed to driver */
         },
 };
-#endif
+#endif  /* CONFIG_SERIAL_BFIN_UART1 */
 #ifdef CONFIG_SERIAL_BFIN_UART2
 static struct resource bfin_uart2_resources[] = {
         {
@@ -196,8 +196,8 @@ static struct platform_device bfin_uart2_device = {
                 .platform_data = &bfin_uart2_peripherals, /* Passed to driver */
         },
 };
-#endif
-#endif
+#endif  /* CONFIG_SERIAL_BFIN_UART2 */
+#endif  /* CONFIG_SERIAL_BFIN */
 
 #if defined(CONFIG_BFIN_SIR) || defined(CONFIG_BFIN_SIR_MODULE)
 #ifdef CONFIG_BFIN_SIR0
@@ -224,7 +224,7 @@ static struct platform_device bfin_sir0_device = {
         .num_resources = ARRAY_SIZE(bfin_sir0_resources),
         .resource = bfin_sir0_resources,
 };
-#endif
+#endif  /* CONFIG_BFIN_SIR0 */
 #ifdef CONFIG_BFIN_SIR1
 static struct resource bfin_sir1_resources[] = {
         {
@@ -249,7 +249,7 @@ static struct platform_device bfin_sir1_device = {
         .num_resources = ARRAY_SIZE(bfin_sir1_resources),
         .resource = bfin_sir1_resources,
 };
-#endif
+#endif  /* CONFIG_BFIN_SIR1 */
 #ifdef CONFIG_BFIN_SIR2
 static struct resource bfin_sir2_resources[] = {
         {
@@ -274,8 +274,8 @@ static struct platform_device bfin_sir2_device = {
         .num_resources = ARRAY_SIZE(bfin_sir2_resources),
         .resource = bfin_sir2_resources,
 };
-#endif
-#endif
+#endif  /* CONFIG_BFIN_SIR2 */
+#endif  /* CONFIG_BFIN_SIR */
 
 #if defined(CONFIG_SERIAL_BFIN_SPORT) || defined(CONFIG_SERIAL_BFIN_SPORT_MODULE)
 #ifdef CONFIG_SERIAL_BFIN_SPORT0_UART
@@ -311,7 +311,7 @@ static struct platform_device bfin_sport0_uart_device = {
                 .platform_data = &bfin_sport0_peripherals, /* Passed to driver */
         },
 };
-#endif
+#endif  /* CONFIG_SERIAL_BFIN_SPORT0_UART */
 #ifdef CONFIG_SERIAL_BFIN_SPORT1_UART
 static struct resource bfin_sport1_uart_resources[] = {
         {
@@ -345,7 +345,7 @@ static struct platform_device bfin_sport1_uart_device = {
                 .platform_data = &bfin_sport1_peripherals, /* Passed to driver */
         },
 };
-#endif
+#endif  /* CONFIG_SERIAL_BFIN_SPORT1_UART */
 #ifdef CONFIG_SERIAL_BFIN_SPORT2_UART
 static struct resource bfin_sport2_uart_resources[] = {
         {
@@ -379,7 +379,7 @@ static struct platform_device bfin_sport2_uart_device = {
                 .platform_data = &bfin_sport2_peripherals, /* Passed to driver */
         },
 };
-#endif
+#endif  /* CONFIG_SERIAL_BFIN_SPORT2_UART */
 #ifdef CONFIG_SERIAL_BFIN_SPORT3_UART
 static struct resource bfin_sport3_uart_resources[] = {
         {
@@ -413,8 +413,8 @@ static struct platform_device bfin_sport3_uart_device = {
                 .platform_data = &bfin_sport3_peripherals, /* Passed to driver */
         },
 };
-#endif
-#endif
+#endif  /* CONFIG_SERIAL_BFIN_SPORT3_UART */
+#endif  /* CONFIG_SERIAL_BFIN_SPORT */
 
 #if defined(CONFIG_CAN_BFIN) || defined(CONFIG_CAN_BFIN_MODULE)
 static unsigned short bfin_can_peripherals[] = {
@@ -452,7 +452,7 @@ static struct platform_device bfin_can_device = {
                 .platform_data = &bfin_can_peripherals, /* Passed to driver */
         },
 };
-#endif
+#endif  /* CONFIG_CAN_BFIN */
 
 /*
  *  USB-LAN EzExtender board
@@ -488,7 +488,7 @@ static struct platform_device smc91x_device = {
                 .platform_data  = &smc91x_info,
         },
 };
-#endif
+#endif  /* CONFIG_SMC91X */
 
 #if defined(CONFIG_SPI_BFIN5XX) || defined(CONFIG_SPI_BFIN5XX_MODULE)
 /* all SPI peripherals info goes here */
@@ -518,7 +518,8 @@ static struct flash_platform_data bfin_spi_flash_data = {
 static struct bfin5xx_spi_chip spi_flash_chip_info = {
         .enable_dma = 0,         /* use dma transfer with this chip*/
 };
-#endif
+#endif  /* CONFIG_MTD_M25P80 */
+#endif  /* CONFIG_SPI_BFIN5XX */
 
 #if defined(CONFIG_TOUCHSCREEN_AD7879) || defined(CONFIG_TOUCHSCREEN_AD7879_MODULE)
 #include <linux/spi/ad7879.h>
@@ -535,7 +536,7 @@ static const struct ad7879_platform_data bfin_ad7879_ts_info = {
         .gpio_export            = 1,    /* Export GPIO to gpiolib */
         .gpio_base              = -1,   /* Dynamic allocation */
 };
-#endif
+#endif  /* CONFIG_TOUCHSCREEN_AD7879 */
 
 #if defined(CONFIG_FB_BFIN_LQ035Q1) || defined(CONFIG_FB_BFIN_LQ035Q1_MODULE)
 #include <asm/bfin-lq035q1.h>
@@ -564,7 +565,7 @@ static struct platform_device bfin_lq035q1_device = {
                 .platform_data = &bfin_lq035q1_data,
         },
 };
-#endif
+#endif  /* CONFIG_FB_BFIN_LQ035Q1 */
 
 static struct spi_board_info bf538_spi_board_info[] __initdata = {
 #if defined(CONFIG_MTD_M25P80) \
@@ -579,7 +580,7 @@ static struct spi_board_info bf538_spi_board_info[] __initdata = {
                 .controller_data = &spi_flash_chip_info,
                 .mode = SPI_MODE_3,
         },
-#endif
+#endif  /* CONFIG_MTD_M25P80 */
 #if defined(CONFIG_TOUCHSCREEN_AD7879_SPI) || defined(CONFIG_TOUCHSCREEN_AD7879_SPI_MODULE)
         {
                 .modalias = "ad7879",
@@ -590,7 +591,7 @@ static struct spi_board_info bf538_spi_board_info[] __initdata = {
                 .chip_select = 1,
                 .mode = SPI_CPHA | SPI_CPOL,
         },
-#endif
+#endif  /* CONFIG_TOUCHSCREEN_AD7879_SPI */
 #if defined(CONFIG_FB_BFIN_LQ035Q1) || defined(CONFIG_FB_BFIN_LQ035Q1_MODULE)
         {
                 .modalias = "bfin-lq035q1-spi",
@@ -599,7 +600,7 @@ static struct spi_board_info bf538_spi_board_info[] __initdata = {
                 .chip_select = 2,
                 .mode = SPI_CPHA | SPI_CPOL,
         },
-#endif
+#endif  /* CONFIG_FB_BFIN_LQ035Q1 */
 #if defined(CONFIG_SPI_SPIDEV) || defined(CONFIG_SPI_SPIDEV_MODULE)
         {
                 .modalias = "spidev",
@@ -607,7 +608,7 @@ static struct spi_board_info bf538_spi_board_info[] __initdata = {
                 .bus_num = 0,
                 .chip_select = 1,
         },
-#endif
+#endif  /* CONFIG_SPI_SPIDEV */
 };
 
 /* SPI (0) */
@@ -716,8 +717,6 @@ static struct platform_device bf538_spi_master2 = {
                 },
 };
 
-#endif  /* spi master and devices */
-
 #if defined(CONFIG_I2C_BLACKFIN_TWI) || defined(CONFIG_I2C_BLACKFIN_TWI_MODULE)
 static struct resource bfin_twi0_resource[] = {
         [0] = {
@@ -759,8 +758,8 @@ static struct platform_device i2c_bfin_twi1_device = {
         .num_resources = ARRAY_SIZE(bfin_twi1_resource),
         .resource = bfin_twi1_resource,
 };
-#endif
-#endif
+#endif  /* CONFIG_BF542 */
+#endif  /* CONFIG_I2C_BLACKFIN_TWI */
 
 #if defined(CONFIG_KEYBOARD_GPIO) || defined(CONFIG_KEYBOARD_GPIO_MODULE)
 #include <linux/gpio_keys.h>
diff --git a/arch/c6x/include/asm/irq.h b/arch/c6x/include/asm/irq.h
index f13b78d5e1ca..ab4577f93d96 100644
--- a/arch/c6x/include/asm/irq.h
+++ b/arch/c6x/include/asm/irq.h
@@ -42,10 +42,6 @@
 /* This number is used when no interrupt has been assigned */
 #define NO_IRQ          0
 
-struct irq_data;
-extern irq_hw_number_t irqd_to_hwirq(struct irq_data *d);
-extern irq_hw_number_t virq_to_hw(unsigned int virq);
-
 extern void __init init_pic_c64xplus(void);
 
 extern void init_IRQ(void);
diff --git a/arch/c6x/kernel/irq.c b/arch/c6x/kernel/irq.c
index 65b8ddf54b44..c90fb5e82ad7 100644
--- a/arch/c6x/kernel/irq.c
+++ b/arch/c6x/kernel/irq.c
@@ -130,16 +130,3 @@ int arch_show_interrupts(struct seq_file *p, int prec)
         seq_printf(p, "%*s: %10lu\n", prec, "Err", irq_err_count);
         return 0;
 }
-
-irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
-{
-        return d->hwirq;
-}
-EXPORT_SYMBOL_GPL(irqd_to_hwirq);
-
-irq_hw_number_t virq_to_hw(unsigned int virq)
-{
-        struct irq_data *irq_data = irq_get_irq_data(virq);
-        return WARN_ON(!irq_data) ? 0 : irq_data->hwirq;
-}
-EXPORT_SYMBOL_GPL(virq_to_hw);
diff --git a/arch/hexagon/kernel/dma.c b/arch/hexagon/kernel/dma.c
index 37302218ca4a..0f2367cc5493 100644
--- a/arch/hexagon/kernel/dma.c
+++ b/arch/hexagon/kernel/dma.c
@@ -22,6 +22,7 @@
 #include <linux/bootmem.h>
 #include <linux/genalloc.h>
 #include <asm/dma-mapping.h>
+#include <linux/module.h>
 
 struct dma_map_ops *dma_ops;
 EXPORT_SYMBOL(dma_ops);
diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c
index 18c4f0b0f4ba..ff02821bfb7e 100644
--- a/arch/hexagon/kernel/process.c
+++ b/arch/hexagon/kernel/process.c
@@ -1,7 +1,7 @@
 /*
  * Process creation support for Hexagon
  *
- * Copyright (c) 2010-2011, Code Aurora Forum. All rights reserved.
+ * Copyright (c) 2010-2012, Code Aurora Forum. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -88,7 +88,7 @@ void (*idle_sleep)(void) = default_idle;
 void cpu_idle(void)
 {
         while (1) {
-                tick_nohz_stop_sched_tick(1);
+                tick_nohz_idle_enter();
                 local_irq_disable();
                 while (!need_resched()) {
                         idle_sleep();
@@ -97,7 +97,7 @@ void cpu_idle(void)
                         local_irq_disable();
                 }
                 local_irq_enable();
-                tick_nohz_restart_sched_tick();
+                tick_nohz_idle_exit();
                 schedule();
         }
 }
diff --git a/arch/hexagon/kernel/ptrace.c b/arch/hexagon/kernel/ptrace.c
index 32342de1a79c..96c3b2c4dbad 100644
--- a/arch/hexagon/kernel/ptrace.c
+++ b/arch/hexagon/kernel/ptrace.c
@@ -28,6 +28,7 @@
 #include <linux/ptrace.h>
 #include <linux/regset.h>
 #include <linux/user.h>
+#include <linux/elf.h>
 
 #include <asm/user.h>
 
diff --git a/arch/hexagon/kernel/smp.c b/arch/hexagon/kernel/smp.c
index 9b44a9e2d05a..1298141874a3 100644
--- a/arch/hexagon/kernel/smp.c
+++ b/arch/hexagon/kernel/smp.c
@@ -1,7 +1,7 @@
 /*
  * SMP support for Hexagon
  *
- * Copyright (c) 2010-2011, Code Aurora Forum. All rights reserved.
+ * Copyright (c) 2010-2012, Code Aurora Forum. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -28,6 +28,7 @@
 #include <linux/sched.h>
 #include <linux/smp.h>
 #include <linux/spinlock.h>
+#include <linux/cpu.h>
 
 #include <asm/time.h>    /*  timer_interrupt  */
 #include <asm/hexagon_vm.h>
@@ -177,7 +178,12 @@ void __cpuinit start_secondary(void)
 
         printk(KERN_INFO "%s cpu %d\n", __func__, current_thread_info()->cpu);
 
+        notify_cpu_starting(cpu);
+
+        ipi_call_lock();
         set_cpu_online(cpu, true);
+        ipi_call_unlock();
+
         local_irq_enable();
 
         cpu_idle();
diff --git a/arch/hexagon/kernel/time.c b/arch/hexagon/kernel/time.c
index 6bee15c9c113..5d9b33b67935 100644
--- a/arch/hexagon/kernel/time.c
+++ b/arch/hexagon/kernel/time.c
@@ -28,6 +28,7 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
+#include <linux/module.h>
 
 #include <asm/timer-regs.h>
 #include <asm/hexagon_vm.h>
diff --git a/arch/hexagon/kernel/vdso.c b/arch/hexagon/kernel/vdso.c
index f212a453b527..5d39f42f7085 100644
--- a/arch/hexagon/kernel/vdso.c
+++ b/arch/hexagon/kernel/vdso.c
@@ -21,6 +21,7 @@
 #include <linux/err.h>
 #include <linux/mm.h>
 #include <linux/vmalloc.h>
+#include <linux/binfmts.h>
 
 #include <asm/vdso.h>
 
diff --git a/arch/ia64/include/asm/cmpxchg.h b/arch/ia64/include/asm/cmpxchg.h
index 4c96187e2049..4f37dbbb8640 100644
--- a/arch/ia64/include/asm/cmpxchg.h
+++ b/arch/ia64/include/asm/cmpxchg.h
@@ -1 +1,147 @@
-#include <asm/intrinsics.h>
+#ifndef _ASM_IA64_CMPXCHG_H
+#define _ASM_IA64_CMPXCHG_H
+
+/*
+ * Compare/Exchange, forked from asm/intrinsics.h
+ * which was:
+ *
+ *      Copyright (C) 2002-2003 Hewlett-Packard Co
+ *      David Mosberger-Tang <davidm@hpl.hp.com>
+ */
+
+#ifndef __ASSEMBLY__
+
+#include <linux/types.h>
+/* include compiler specific intrinsics */
+#include <asm/ia64regs.h>
+#ifdef __INTEL_COMPILER
+# include <asm/intel_intrin.h>
+#else
+# include <asm/gcc_intrin.h>
+#endif
+
+/*
+ * This function doesn't exist, so you'll get a linker error if
+ * something tries to do an invalid xchg().
+ */
+extern void ia64_xchg_called_with_bad_pointer(void);
+
+#define __xchg(x, ptr, size)                                            \
+({                                                                      \
+        unsigned long __xchg_result;                                    \
+                                                                        \
+        switch (size) {                                                 \
+        case 1:                                                         \
+                __xchg_result = ia64_xchg1((__u8 *)ptr, x);             \
+                break;                                                  \
+                                                                        \
+        case 2:                                                         \
+                __xchg_result = ia64_xchg2((__u16 *)ptr, x);            \
+                break;                                                  \
+                                                                        \
+        case 4:                                                         \
+                __xchg_result = ia64_xchg4((__u32 *)ptr, x);            \
+                break;                                                  \
+                                                                        \
+        case 8:                                                         \
+                __xchg_result = ia64_xchg8((__u64 *)ptr, x);            \
+                break;                                                  \
+        default:                                                        \
+                ia64_xchg_called_with_bad_pointer();                    \
+        }                                                               \
+        __xchg_result;                                                  \
+})
+
+#define xchg(ptr, x)                                                    \
+((__typeof__(*(ptr))) __xchg((unsigned long) (x), (ptr), sizeof(*(ptr))))
+
+/*
+ * Atomic compare and exchange.  Compare OLD with MEM, if identical,
+ * store NEW in MEM.  Return the initial value in MEM.  Success is
+ * indicated by comparing RETURN with OLD.
+ */
+
+#define __HAVE_ARCH_CMPXCHG 1
+
+/*
+ * This function doesn't exist, so you'll get a linker error
+ * if something tries to do an invalid cmpxchg().
+ */
+extern long ia64_cmpxchg_called_with_bad_pointer(void);
+
+#define ia64_cmpxchg(sem, ptr, old, new, size)                          \
+({                                                                      \
+        __u64 _o_, _r_;                                                 \
+                                                                        \
+        switch (size) {                                                 \
+        case 1:                                                         \
+                _o_ = (__u8) (long) (old);                              \
+                break;                                                  \
+        case 2:                                                         \
+                _o_ = (__u16) (long) (old);                             \
+                break;                                                  \
+        case 4:                                                         \
+                _o_ = (__u32) (long) (old);                             \
+                break;                                                  \
+        case 8:                                                         \
+                _o_ = (__u64) (long) (old);                             \
+                break;                                                  \
+        default:                                                        \
+                break;                                                  \
+        }                                                               \
+        switch (size) {                                                 \
+        case 1:                                                         \
+                _r_ = ia64_cmpxchg1_##sem((__u8 *) ptr, new, _o_);      \
+                break;                                                  \
+                                                                        \
+        case 2:                                                         \
+                _r_ = ia64_cmpxchg2_##sem((__u16 *) ptr, new, _o_);     \
+                break;                                                  \
+                                                                        \
+        case 4:                                                         \
+                _r_ = ia64_cmpxchg4_##sem((__u32 *) ptr, new, _o_);     \
+                break;                                                  \
+                                                                        \
+        case 8:                                                         \
+                _r_ = ia64_cmpxchg8_##sem((__u64 *) ptr, new, _o_);     \
+                break;                                                  \
+                                                                        \
+        default:                                                        \
+                _r_ = ia64_cmpxchg_called_with_bad_pointer();           \
+                break;                                                  \
+        }                                                               \
+        (__typeof__(old)) _r_;                                          \
+})
+
+#define cmpxchg_acq(ptr, o, n)  \
+        ia64_cmpxchg(acq, (ptr), (o), (n), sizeof(*(ptr)))
+#define cmpxchg_rel(ptr, o, n)  \
+        ia64_cmpxchg(rel, (ptr), (o), (n), sizeof(*(ptr)))
+
+/* for compatibility with other platforms: */
+#define cmpxchg(ptr, o, n)      cmpxchg_acq((ptr), (o), (n))
+#define cmpxchg64(ptr, o, n)    cmpxchg_acq((ptr), (o), (n))
+
+#define cmpxchg_local           cmpxchg
+#define cmpxchg64_local         cmpxchg64
+
+#ifdef CONFIG_IA64_DEBUG_CMPXCHG
+# define CMPXCHG_BUGCHECK_DECL  int _cmpxchg_bugcheck_count = 128;
+# define CMPXCHG_BUGCHECK(v)                                            \
+do {                                                                    \
+        if (_cmpxchg_bugcheck_count-- <= 0) {                           \
+                void *ip;                                               \
+                extern int printk(const char *fmt, ...);                \
+                ip = (void *) ia64_getreg(_IA64_REG_IP);                \
+                printk("CMPXCHG_BUGCHECK: stuck at %p on word %p\n", ip, (v));\
+                break;                                                  \
+        }                                                               \
+} while (0)
+#else /* !CONFIG_IA64_DEBUG_CMPXCHG */
+# define CMPXCHG_BUGCHECK_DECL
+# define CMPXCHG_BUGCHECK(v)
+#endif /* !CONFIG_IA64_DEBUG_CMPXCHG */
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* _ASM_IA64_CMPXCHG_H */
diff --git a/arch/ia64/include/asm/futex.h b/arch/ia64/include/asm/futex.h
index 0ab82cc2dc8f..d2bf1fd5e44f 100644
--- a/arch/ia64/include/asm/futex.h
+++ b/arch/ia64/include/asm/futex.h
@@ -106,15 +106,16 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                 return -EFAULT;
 
         {
-                register unsigned long r8 __asm ("r8") = 0;
+                register unsigned long r8 __asm ("r8");
                 unsigned long prev;
                 __asm__ __volatile__(
                         "       mf;;                                    \n"
-                        "       mov ar.ccv=%3;;                         \n"
-                        "[1:]   cmpxchg4.acq %0=[%1],%2,ar.ccv          \n"
+                        "       mov %0=r0                               \n"
+                        "       mov ar.ccv=%4;;                         \n"
+                        "[1:]   cmpxchg4.acq %1=[%2],%3,ar.ccv          \n"
                         "       .xdata4 \"__ex_table\", 1b-., 2f-.      \n"
                         "[2:]"
-                        : "=r" (prev)
+                        : "=r" (r8), "=r" (prev)
                         : "r" (uaddr), "r" (newval),
                           "rO" ((long) (unsigned) oldval)
                         : "memory");
diff --git a/arch/ia64/include/asm/intrinsics.h b/arch/ia64/include/asm/intrinsics.h
index e4076b511829..d129e367e764 100644
--- a/arch/ia64/include/asm/intrinsics.h
+++ b/arch/ia64/include/asm/intrinsics.h
@@ -18,6 +18,7 @@
 #else
 # include <asm/gcc_intrin.h>
 #endif
+#include <asm/cmpxchg.h>
 
 #define ia64_native_get_psr_i() (ia64_native_getreg(_IA64_REG_PSR) & IA64_PSR_I)
 
@@ -81,119 +82,6 @@ extern unsigned long __bad_increment_for_ia64_fetch_and_add (void);
 
 #define ia64_fetch_and_add(i,v) (ia64_fetchadd(i, v, rel) + (i)) /* return new value */
 
-/*
- * This function doesn't exist, so you'll get a linker error if
- * something tries to do an invalid xchg().
- */
-extern void ia64_xchg_called_with_bad_pointer (void);
-
-#define __xchg(x,ptr,size)                                              \
-({                                                                      \
-        unsigned long __xchg_result;                                    \
-                                                                        \
-        switch (size) {                                                 \
-              case 1:                                                   \
-                __xchg_result = ia64_xchg1((__u8 *)ptr, x);             \
-                break;                                                  \
-                                                                        \
-              case 2:                                                   \
-                __xchg_result = ia64_xchg2((__u16 *)ptr, x);            \
-                break;                                                  \
-                                                                        \
-              case 4:                                                   \
-                __xchg_result = ia64_xchg4((__u32 *)ptr, x);            \
-                break;                                                  \
-                                                                        \
-              case 8:                                                   \
-                __xchg_result = ia64_xchg8((__u64 *)ptr, x);            \
-                break;                                                  \
-              default:                                                  \
-                ia64_xchg_called_with_bad_pointer();                    \
-        }                                                               \
-        __xchg_result;                                                  \
-})
-
-#define xchg(ptr,x)                                                          \
-  ((__typeof__(*(ptr))) __xchg ((unsigned long) (x), (ptr), sizeof(*(ptr))))
-
-/*
- * Atomic compare and exchange.  Compare OLD with MEM, if identical,
- * store NEW in MEM.  Return the initial value in MEM.  Success is
- * indicated by comparing RETURN with OLD.
- */
-
-#define __HAVE_ARCH_CMPXCHG 1
-
-/*
- * This function doesn't exist, so you'll get a linker error
- * if something tries to do an invalid cmpxchg().
- */
-extern long ia64_cmpxchg_called_with_bad_pointer (void);
-
-#define ia64_cmpxchg(sem,ptr,old,new,size)                                              \
-({                                                                                      \
-        __u64 _o_, _r_;                                                                 \
-                                                                                        \
-        switch (size) {                                                                 \
-              case 1: _o_ = (__u8 ) (long) (old); break;                                \
-              case 2: _o_ = (__u16) (long) (old); break;                                \
-              case 4: _o_ = (__u32) (long) (old); break;                                \
-              case 8: _o_ = (__u64) (long) (old); break;                                \
-              default: break;                                                           \
-        }                                                                               \
-        switch (size) {                                                                 \
-              case 1:                                                                   \
-                _r_ = ia64_cmpxchg1_##sem((__u8 *) ptr, new, _o_);                      \
-                break;                                                                  \
-                                                                                        \
-              case 2:                                                                   \
-               _r_ = ia64_cmpxchg2_##sem((__u16 *) ptr, new, _o_);                      \
-                break;                                                                  \
-                                                                                        \
-              case 4:                                                                   \
-                _r_ = ia64_cmpxchg4_##sem((__u32 *) ptr, new, _o_);                     \
-                break;                                                                  \
-                                                                                        \
-              case 8:                                                                   \
-                _r_ = ia64_cmpxchg8_##sem((__u64 *) ptr, new, _o_);                     \
-                break;                                                                  \
-                                                                                        \
-              default:                                                                  \
-                _r_ = ia64_cmpxchg_called_with_bad_pointer();                           \
-                break;                                                                  \
-        }                                                                               \
-        (__typeof__(old)) _r_;                                                          \
-})
-
-#define cmpxchg_acq(ptr, o, n)  \
-        ia64_cmpxchg(acq, (ptr), (o), (n), sizeof(*(ptr)))
-#define cmpxchg_rel(ptr, o, n)  \
-        ia64_cmpxchg(rel, (ptr), (o), (n), sizeof(*(ptr)))
-
-/* for compatibility with other platforms: */
-#define cmpxchg(ptr, o, n)      cmpxchg_acq((ptr), (o), (n))
-#define cmpxchg64(ptr, o, n)    cmpxchg_acq((ptr), (o), (n))
-
-#define cmpxchg_local           cmpxchg
-#define cmpxchg64_local         cmpxchg64
-
-#ifdef CONFIG_IA64_DEBUG_CMPXCHG
-# define CMPXCHG_BUGCHECK_DECL  int _cmpxchg_bugcheck_count = 128;
-# define CMPXCHG_BUGCHECK(v)                                                    \
-  do {                                                                          \
-        if (_cmpxchg_bugcheck_count-- <= 0) {                                   \
-                void *ip;                                                       \
-                extern int printk(const char *fmt, ...);                        \
-                ip = (void *) ia64_getreg(_IA64_REG_IP);                        \
-                printk("CMPXCHG_BUGCHECK: stuck at %p on word %p\n", ip, (v));  \
-                break;                                                          \
-        }                                                                       \
-  } while (0)
-#else /* !CONFIG_IA64_DEBUG_CMPXCHG */
-# define CMPXCHG_BUGCHECK_DECL
-# define CMPXCHG_BUGCHECK(v)
-#endif /* !CONFIG_IA64_DEBUG_CMPXCHG */
-
 #endif
 
 #ifdef __KERNEL__
diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
index 9d0fd7d5bb82..f00ba025375d 100644
--- a/arch/ia64/kernel/perfmon.c
+++ b/arch/ia64/kernel/perfmon.c
@@ -604,12 +604,6 @@ pfm_unprotect_ctx_ctxsw(pfm_context_t *x, unsigned long f)
         spin_unlock(&(x)->ctx_lock);
 }
 
-static inline unsigned int
-pfm_do_munmap(struct mm_struct *mm, unsigned long addr, size_t len, int acct)
-{
-        return do_munmap(mm, addr, len);
-}
-
 static inline unsigned long 
 pfm_get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags, unsigned long exec)
 {
@@ -1458,8 +1452,9 @@ pfm_unreserve_session(pfm_context_t *ctx, int is_syswide, unsigned int cpu)
  * a PROTECT_CTX() section.
  */
 static int
-pfm_remove_smpl_mapping(struct task_struct *task, void *vaddr, unsigned long size)
+pfm_remove_smpl_mapping(void *vaddr, unsigned long size)
 {
+        struct task_struct *task = current;
         int r;
 
         /* sanity checks */
@@ -1473,13 +1468,8 @@ pfm_remove_smpl_mapping(struct task_struct *task, void *vaddr, unsigned long siz
         /*
          * does the actual unmapping
          */
-        down_write(&task->mm->mmap_sem);
+        r = vm_munmap((unsigned long)vaddr, size);
 
-        DPRINT(("down_write done smpl_vaddr=%p size=%lu\n", vaddr, size));
-
-        r = pfm_do_munmap(task->mm, (unsigned long)vaddr, size, 0);
-
-        up_write(&task->mm->mmap_sem);
         if (r !=0) {
                 printk(KERN_ERR "perfmon: [%d] unable to unmap sampling buffer @%p size=%lu\n", task_pid_nr(task), vaddr, size);
         }
@@ -1945,7 +1935,7 @@ pfm_flush(struct file *filp, fl_owner_t id)
          * because some VM function reenables interrupts.
          *
          */
-        if (smpl_buf_vaddr) pfm_remove_smpl_mapping(current, smpl_buf_vaddr, smpl_buf_size);
+        if (smpl_buf_vaddr) pfm_remove_smpl_mapping(smpl_buf_vaddr, smpl_buf_size);
 
         return 0;
 }
diff --git a/arch/m68k/configs/m5275evb_defconfig b/arch/m68k/configs/m5275evb_defconfig
index 33c32aeca12b..a1230e82bb1e 100644
--- a/arch/m68k/configs/m5275evb_defconfig
+++ b/arch/m68k/configs/m5275evb_defconfig
@@ -49,7 +49,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_NETDEVICES=y
 CONFIG_NET_ETHERNET=y
 CONFIG_FEC=y
-CONFIG_FEC2=y
 # CONFIG_NETDEV_1000 is not set
 # CONFIG_NETDEV_10000 is not set
 CONFIG_PPP=y
diff --git a/arch/m68k/platform/527x/config.c b/arch/m68k/platform/527x/config.c
index 7ed848c3b848..f91a53294c35 100644
--- a/arch/m68k/platform/527x/config.c
+++ b/arch/m68k/platform/527x/config.c
@@ -74,9 +74,7 @@ static void __init m527x_fec_init(void)
         writew(par | 0xf00, MCF_IPSBAR + 0x100082);
         v = readb(MCF_IPSBAR + 0x100078);
         writeb(v | 0xc0, MCF_IPSBAR + 0x100078);
-#endif
 
-#ifdef CONFIG_FEC2
         /* Set multi-function pins to ethernet mode for fec1 */
         par = readw(MCF_IPSBAR + 0x100082);
         writew(par | 0xa0, MCF_IPSBAR + 0x100082);
diff --git a/arch/m68k/platform/68EZ328/Makefile b/arch/m68k/platform/68EZ328/Makefile
index ee97735a242c..b44d799b1115 100644
--- a/arch/m68k/platform/68EZ328/Makefile
+++ b/arch/m68k/platform/68EZ328/Makefile
@@ -3,9 +3,3 @@
 #
 
 obj-y := config.o
-
-extra-y := bootlogo.rh
-
-$(obj)/bootlogo.rh: $(src)/bootlogo.h
-        perl $(src)/../68328/bootlogo.pl < $(src)/bootlogo.h \
-                > $(obj)/bootlogo.rh
diff --git a/arch/m68k/platform/68VZ328/Makefile b/arch/m68k/platform/68VZ328/Makefile
index 447ffa0fd7c7..a49d75e65489 100644
--- a/arch/m68k/platform/68VZ328/Makefile
+++ b/arch/m68k/platform/68VZ328/Makefile
@@ -3,14 +3,9 @@
 #
 
 obj-y           := config.o
-logo-$(UCDIMM)  := bootlogo.rh
-logo-$(DRAGEN2) := screen.h
-extra-y         := $(logo-y)
-
-$(obj)/bootlogo.rh: $(src)/../68EZ328/bootlogo.h
-        perl $(src)/bootlogo.pl < $(src)/../68328/bootlogo.h > $(obj)/bootlogo.rh
+extra-$(DRAGEN2):= screen.h
 
 $(obj)/screen.h: $(src)/screen.xbm $(src)/xbm2lcd.pl
         perl $(src)/xbm2lcd.pl < $(src)/screen.xbm > $(obj)/screen.h
 
-clean-files := $(obj)/screen.h $(obj)/bootlogo.rh
+clean-files := $(obj)/screen.h
diff --git a/arch/m68k/platform/68EZ328/bootlogo.h b/arch/m68k/platform/68VZ328/bootlogo.h
index e842bdae5839..b38e2b255142 100644
--- a/arch/m68k/platform/68EZ328/bootlogo.h
+++ b/arch/m68k/platform/68VZ328/bootlogo.h
@@ -1,6 +1,6 @@
 #define splash_width 640
 #define splash_height 480
-static unsigned char splash_bits[] = {
+unsigned char __attribute__ ((aligned(16))) bootlogo_bits[] = {
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
diff --git a/arch/m68k/platform/coldfire/device.c b/arch/m68k/platform/coldfire/device.c
index fa50c48292ff..7af97362b95c 100644
--- a/arch/m68k/platform/coldfire/device.c
+++ b/arch/m68k/platform/coldfire/device.c
@@ -114,7 +114,7 @@ static struct resource mcf_fec1_resources[] = {
 
 static struct platform_device mcf_fec1 = {
         .name                   = "fec",
-        .id                     = 0,
+        .id                     = 1,
         .num_resources          = ARRAY_SIZE(mcf_fec1_resources),
         .resource               = mcf_fec1_resources,
 };
diff --git a/arch/mips/ath79/dev-wmac.c b/arch/mips/ath79/dev-wmac.c
index e21507052066..9c717bf98ffe 100644
--- a/arch/mips/ath79/dev-wmac.c
+++ b/arch/mips/ath79/dev-wmac.c
@@ -58,8 +58,8 @@ static void __init ar913x_wmac_setup(void)
 
 static int ar933x_wmac_reset(void)
 {
-        ath79_device_reset_clear(AR933X_RESET_WMAC);
         ath79_device_reset_set(AR933X_RESET_WMAC);
+        ath79_device_reset_clear(AR933X_RESET_WMAC);
 
         return 0;
 }
diff --git a/arch/mips/include/asm/mach-jz4740/irq.h b/arch/mips/include/asm/mach-jz4740/irq.h
index a865c983c70a..5ad1a9c113c6 100644
--- a/arch/mips/include/asm/mach-jz4740/irq.h
+++ b/arch/mips/include/asm/mach-jz4740/irq.h
@@ -45,7 +45,7 @@
 #define JZ4740_IRQ_LCD          JZ4740_IRQ(30)
 
 /* 2nd-level interrupts */
-#define JZ4740_IRQ_DMA(x)       (JZ4740_IRQ(32) + (X))
+#define JZ4740_IRQ_DMA(x)       (JZ4740_IRQ(32) + (x))
 
 #define JZ4740_IRQ_INTC_GPIO(x) (JZ4740_IRQ_GPIO0 - (x))
 #define JZ4740_IRQ_GPIO(x)      (JZ4740_IRQ(48) + (x))
diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index 73c0d45798de..9b02cfba7449 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -37,12 +37,6 @@ extern void tlbmiss_handler_setup_pgd(unsigned long pgd);
                 write_c0_xcontext((unsigned long) smp_processor_id() << 51); \
         } while (0)
 
-
-static inline unsigned long get_current_pgd(void)
-{
-        return PHYS_TO_XKSEG_CACHED((read_c0_context() >> 11) & ~0xfffUL);
-}
-
 #else /* CONFIG_MIPS_PGD_C0_CONTEXT: using  pgd_current*/
 
 /*
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 185ca00c4c84..d5a338a1739c 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -257,11 +257,8 @@ asmlinkage int sys_sigsuspend(nabi_no_regargs struct pt_regs regs)
                 return -EFAULT;
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -286,11 +283,8 @@ asmlinkage int sys_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
                 return -EFAULT;
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -362,10 +356,7 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&blocked, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = blocked;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&blocked);
 
         sig = restore_sigcontext(&regs, &frame->sf_sc);
         if (sig < 0)
@@ -401,10 +392,7 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
 
         sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
         if (sig < 0)
@@ -580,12 +568,7 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
         if (ret)
                 return ret;
 
-        spin_lock_irq(&current->sighand->siglock);
-        sigorsets(&current->blocked, &current->blocked, &ka->sa.sa_mask);
-        if (!(ka->sa.sa_flags & SA_NODEFER))
-                sigaddset(&current->blocked, sig);
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        block_sigmask(ka, sig);
 
         return ret;
 }
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 06b5da392e24..ac3b8d89aae5 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -290,11 +290,8 @@ asmlinkage int sys32_sigsuspend(nabi_no_regargs struct pt_regs regs)
                 return -EFAULT;
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -318,11 +315,8 @@ asmlinkage int sys32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
                 return -EFAULT;
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -488,10 +482,7 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&blocked, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = blocked;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&blocked);
 
         sig = restore_sigcontext32(&regs, &frame->sf_sc);
         if (sig < 0)
@@ -529,10 +520,7 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
 
         sig = restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext);
         if (sig < 0)
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index ae29e894ab8d..86eb4b04631c 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -93,11 +93,8 @@ asmlinkage int sysn32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigset_from_compat(&newset, &uset);
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -121,10 +118,7 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
 
         sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
         if (sig < 0)
diff --git a/arch/parisc/kernel/pdc_cons.c b/arch/parisc/kernel/pdc_cons.c
index 4f004596a6e7..0b3393381a81 100644
--- a/arch/parisc/kernel/pdc_cons.c
+++ b/arch/parisc/kernel/pdc_cons.c
@@ -104,7 +104,7 @@ static int pdc_console_tty_open(struct tty_struct *tty, struct file *filp)
 
 static void pdc_console_tty_close(struct tty_struct *tty, struct file *filp)
 {
-        if (!tty->count) {
+        if (tty->count == 1) {
                 del_timer_sync(&pdc_console_timer);
                 tty_port_tty_set(&tty_port, NULL);
         }
diff --git a/arch/powerpc/boot/dts/fsl/pq3-mpic-message-B.dtsi b/arch/powerpc/boot/dts/fsl/pq3-mpic-message-B.dtsi
new file mode 100644
index 000000000000..1cf0b77b1efe
--- /dev/null
+++ b/arch/powerpc/boot/dts/fsl/pq3-mpic-message-B.dtsi
@@ -0,0 +1,43 @@
+/*
+ * PQ3 MPIC Message (Group B) device tree stub [ controller @ offset 0x42400 ]
+ *
+ * Copyright 2012 Freescale Semiconductor Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of Freescale Semiconductor nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+message@42400 {
+        compatible = "fsl,mpic-v3.1-msgr";
+        reg = <0x42400 0x200>;
+        interrupts = <
+                0xb4 2 0 0
+                0xb5 2 0 0
+                0xb6 2 0 0
+                0xb7 2 0 0>;
+};
diff --git a/arch/powerpc/boot/dts/fsl/pq3-mpic.dtsi b/arch/powerpc/boot/dts/fsl/pq3-mpic.dtsi
index fdedf7b1fe0f..71c30eb10056 100644
--- a/arch/powerpc/boot/dts/fsl/pq3-mpic.dtsi
+++ b/arch/powerpc/boot/dts/fsl/pq3-mpic.dtsi
@@ -53,6 +53,16 @@ timer@41100 {
                       3 0 3 0>;
 };
 
+message@41400 {
+        compatible = "fsl,mpic-v3.1-msgr";
+        reg = <0x41400 0x200>;
+        interrupts = <
+                0xb0 2 0 0
+                0xb1 2 0 0
+                0xb2 2 0 0
+                0xb3 2 0 0>;
+};
+
 msi@41600 {
         compatible = "fsl,mpic-msi";
         reg = <0x41600 0x80>;
diff --git a/arch/powerpc/include/asm/irq.h b/arch/powerpc/include/asm/irq.h
index cf417e510736..0e40843a1c6e 100644
--- a/arch/powerpc/include/asm/irq.h
+++ b/arch/powerpc/include/asm/irq.h
@@ -18,10 +18,6 @@
 #include <linux/atomic.h>
 
 
-/* Define a way to iterate across irqs. */
-#define for_each_irq(i) \
-        for ((i) = 0; (i) < NR_IRQS; ++(i))
-
 extern atomic_t ppc_n_lost_interrupts;
 
 /* This number is used when no interrupt has been assigned */
@@ -33,8 +29,6 @@ extern atomic_t ppc_n_lost_interrupts;
 /* Same thing, used by the generic IRQ code */
 #define NR_IRQS_LEGACY          NUM_ISA_INTERRUPTS
 
-struct irq_data;
-extern irq_hw_number_t irqd_to_hwirq(struct irq_data *d);
 extern irq_hw_number_t virq_to_hw(unsigned int virq);
 
 /**
diff --git a/arch/powerpc/include/asm/mpic.h b/arch/powerpc/include/asm/mpic.h
index c65b9294376e..c9f698a994be 100644
--- a/arch/powerpc/include/asm/mpic.h
+++ b/arch/powerpc/include/asm/mpic.h
@@ -275,9 +275,6 @@ struct mpic
         unsigned int            isu_mask;
         /* Number of sources */
         unsigned int            num_sources;
-        /* default senses array */
-        unsigned char           *senses;
-        unsigned int            senses_count;
 
         /* vector numbers used for internal sources (ipi/timers) */
         unsigned int            ipi_vecs[4];
@@ -415,21 +412,6 @@ extern struct mpic *mpic_alloc(struct device_node *node,
 extern void mpic_assign_isu(struct mpic *mpic, unsigned int isu_num,
                             phys_addr_t phys_addr);
 
-/* Set default sense codes
- *
- * @mpic:       controller
- * @senses:     array of sense codes
- * @count:      size of above array
- *
- * Optionally provide an array (indexed on hardware interrupt numbers
- * for this MPIC) of default sense codes for the chip. Those are linux
- * sense codes IRQ_TYPE_*
- *
- * The driver gets ownership of the pointer, don't dispose of it or
- * anything like that. __init only.
- */
-extern void mpic_set_default_senses(struct mpic *mpic, u8 *senses, int count);
-
 
 /* Initialize the controller. After this has been called, none of the above
  * should be called again for this mpic
diff --git a/arch/powerpc/include/asm/mpic_msgr.h b/arch/powerpc/include/asm/mpic_msgr.h
index 3ec37dc9003e..326d33ca55cd 100644
--- a/arch/powerpc/include/asm/mpic_msgr.h
+++ b/arch/powerpc/include/asm/mpic_msgr.h
@@ -13,6 +13,7 @@
 
 #include <linux/types.h>
 #include <linux/spinlock.h>
+#include <asm/smp.h>
 
 struct mpic_msgr {
         u32 __iomem *base;
diff --git a/arch/powerpc/include/asm/reg_booke.h b/arch/powerpc/include/asm/reg_booke.h
index b86faa9107da..8a97aa7289d3 100644
--- a/arch/powerpc/include/asm/reg_booke.h
+++ b/arch/powerpc/include/asm/reg_booke.h
@@ -15,11 +15,6 @@
 #ifndef __ASM_POWERPC_REG_BOOKE_H__
 #define __ASM_POWERPC_REG_BOOKE_H__
 
-#ifdef CONFIG_BOOKE_WDT
-extern u32 booke_wdt_enabled;
-extern u32 booke_wdt_period;
-#endif /* CONFIG_BOOKE_WDT */
-
 /* Machine State Register (MSR) Fields */
 #define MSR_GS          (1<<28) /* Guest state */
 #define MSR_UCLE        (1<<26) /* User-mode cache lock enable */
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index 3e57a00b8cba..ba3aeb4bc06a 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -206,40 +206,43 @@ reenable_mmu:				/* re-enable mmu so we can */
         andi.   r10,r10,MSR_EE          /* Did EE change? */
         beq     1f
 
-        /* Save handler and return address into the 2 unused words
-         * of the STACK_FRAME_OVERHEAD (sneak sneak sneak). Everything
-         * else can be recovered from the pt_regs except r3 which for
-         * normal interrupts has been set to pt_regs and for syscalls
-         * is an argument, so we temporarily use ORIG_GPR3 to save it
-         */
-        stw     r9,8(r1)
-        stw     r11,12(r1)
-        stw     r3,ORIG_GPR3(r1)
         /*
          * The trace_hardirqs_off will use CALLER_ADDR0 and CALLER_ADDR1.
          * If from user mode there is only one stack frame on the stack, and
          * accessing CALLER_ADDR1 will cause oops. So we need create a dummy
          * stack frame to make trace_hardirqs_off happy.
+         *
+         * This is handy because we also need to save a bunch of GPRs,
+         * r3 can be different from GPR3(r1) at this point, r9 and r11
+         * contains the old MSR and handler address respectively,
+         * r4 & r5 can contain page fault arguments that need to be passed
+         * along as well. r12, CCR, CTR, XER etc... are left clobbered as
+         * they aren't useful past this point (aren't syscall arguments),
+         * the rest is restored from the exception frame.
          */
+        stwu    r1,-32(r1)
+        stw     r9,8(r1)
+        stw     r11,12(r1)
+        stw     r3,16(r1)
+        stw     r4,20(r1)
+        stw     r5,24(r1)
         andi.   r12,r12,MSR_PR
-        beq     11f
-        stwu    r1,-16(r1)
+        b       11f
         bl      trace_hardirqs_off
-        addi    r1,r1,16
         b       12f
-
 11:
         bl      trace_hardirqs_off
 12:
+        lwz     r5,24(r1)
+        lwz     r4,20(r1)
+        lwz     r3,16(r1)
+        lwz     r11,12(r1)
+        lwz     r9,8(r1)
+        addi    r1,r1,32
         lwz     r0,GPR0(r1)
-        lwz     r3,ORIG_GPR3(r1)
-        lwz     r4,GPR4(r1)
-        lwz     r5,GPR5(r1)
         lwz     r6,GPR6(r1)
         lwz     r7,GPR7(r1)
         lwz     r8,GPR8(r1)
-        lwz     r9,8(r1)
-        lwz     r11,12(r1)
 1:      mtctr   r11
         mtlr    r9
         bctr                            /* jump to handler */
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 243dbabfe74d..43eb74fcedde 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -330,14 +330,10 @@ void migrate_irqs(void)
 
         alloc_cpumask_var(&mask, GFP_KERNEL);
 
-        for_each_irq(irq) {
+        for_each_irq_desc(irq, desc) {
                 struct irq_data *data;
                 struct irq_chip *chip;
 
-                desc = irq_to_desc(irq);
-                if (!desc)
-                        continue;
-
                 data = irq_desc_get_irq_data(desc);
                 if (irqd_is_per_cpu(data))
                         continue;
@@ -560,12 +556,6 @@ void do_softirq(void)
         local_irq_restore(flags);
 }
 
-irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
-{
-        return d->hwirq;
-}
-EXPORT_SYMBOL_GPL(irqd_to_hwirq);
-
 irq_hw_number_t virq_to_hw(unsigned int virq)
 {
         struct irq_data *irq_data = irq_get_irq_data(virq);
diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
index c957b1202bdc..5df777794403 100644
--- a/arch/powerpc/kernel/machine_kexec.c
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -23,14 +23,11 @@
 
 void machine_kexec_mask_interrupts(void) {
         unsigned int i;
+        struct irq_desc *desc;
 
-        for_each_irq(i) {
-                struct irq_desc *desc = irq_to_desc(i);
+        for_each_irq_desc(i, desc) {
                 struct irq_chip *chip;
 
-                if (!desc)
-                        continue;
-
                 chip = irq_desc_get_chip(desc);
                 if (!chip)
                         continue;
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index f88698c0f332..4937c9690090 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1235,7 +1235,7 @@ void __ppc64_runlatch_on(void)
         ctrl |= CTRL_RUNLATCH;
         mtspr(SPRN_CTRLT, ctrl);
 
-        ti->local_flags |= TLF_RUNLATCH;
+        ti->local_flags |= _TLF_RUNLATCH;
 }
 
 /* Called with hard IRQs off */
@@ -1244,7 +1244,7 @@ void __ppc64_runlatch_off(void)
         struct thread_info *ti = current_thread_info();
         unsigned long ctrl;
 
-        ti->local_flags &= ~TLF_RUNLATCH;
+        ti->local_flags &= ~_TLF_RUNLATCH;
 
         ctrl = mfspr(SPRN_CTRLF);
         ctrl &= ~CTRL_RUNLATCH;
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index 9825f29d1faf..ec8a53fa9e8f 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -150,6 +150,9 @@ notrace void __init machine_init(u64 dt_ptr)
 }
 
 #ifdef CONFIG_BOOKE_WDT
+extern u32 booke_wdt_enabled;
+extern u32 booke_wdt_period;
+
 /* Checks wdt=x and wdt_period=xx command-line option */
 notrace int __init early_parse_wdt(char *p)
 {
diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
index af1ab5e9a691..5c3cf2d04e41 100644
--- a/arch/powerpc/net/bpf_jit.h
+++ b/arch/powerpc/net/bpf_jit.h
@@ -48,7 +48,13 @@
 /*
  * Assembly helpers from arch/powerpc/net/bpf_jit.S:
  */
-extern u8 sk_load_word[], sk_load_half[], sk_load_byte[], sk_load_byte_msh[];
+#define DECLARE_LOAD_FUNC(func) \
+        extern u8 func[], func##_negative_offset[], func##_positive_offset[]
+
+DECLARE_LOAD_FUNC(sk_load_word);
+DECLARE_LOAD_FUNC(sk_load_half);
+DECLARE_LOAD_FUNC(sk_load_byte);
+DECLARE_LOAD_FUNC(sk_load_byte_msh);
 
 #define FUNCTION_DESCR_SIZE     24
 
diff --git a/arch/powerpc/net/bpf_jit_64.S b/arch/powerpc/net/bpf_jit_64.S
index ff4506e85cce..55ba3855a97f 100644
--- a/arch/powerpc/net/bpf_jit_64.S
+++ b/arch/powerpc/net/bpf_jit_64.S
@@ -31,14 +31,13 @@
  * then branch directly to slow_path_XXX if required.  (In fact, could
  * load a spare GPR with the address of slow_path_generic and pass size
  * as an argument, making the call site a mtlr, li and bllr.)
- *
- * Technically, the "is addr < 0" check is unnecessary & slowing down
- * the ABS path, as it's statically checked on generation.
  */
         .globl  sk_load_word
 sk_load_word:
         cmpdi   r_addr, 0
-        blt     bpf_error
+        blt     bpf_slow_path_word_neg
+        .globl  sk_load_word_positive_offset
+sk_load_word_positive_offset:
         /* Are we accessing past headlen? */
         subi    r_scratch1, r_HL, 4
         cmpd    r_scratch1, r_addr
@@ -51,7 +50,9 @@ sk_load_word:
         .globl  sk_load_half
 sk_load_half:
         cmpdi   r_addr, 0
-        blt     bpf_error
+        blt     bpf_slow_path_half_neg
+        .globl  sk_load_half_positive_offset
+sk_load_half_positive_offset:
         subi    r_scratch1, r_HL, 2
         cmpd    r_scratch1, r_addr
         blt     bpf_slow_path_half
@@ -61,7 +62,9 @@ sk_load_half:
         .globl  sk_load_byte
 sk_load_byte:
         cmpdi   r_addr, 0
-        blt     bpf_error
+        blt     bpf_slow_path_byte_neg
+        .globl  sk_load_byte_positive_offset
+sk_load_byte_positive_offset:
         cmpd    r_HL, r_addr
         ble     bpf_slow_path_byte
         lbzx    r_A, r_D, r_addr
@@ -69,22 +72,20 @@ sk_load_byte:
 
 /*
  * BPF_S_LDX_B_MSH: ldxb  4*([offset]&0xf)
- * r_addr is the offset value, already known positive
+ * r_addr is the offset value
  */
         .globl sk_load_byte_msh
 sk_load_byte_msh:
+        cmpdi   r_addr, 0
+        blt     bpf_slow_path_byte_msh_neg
+        .globl sk_load_byte_msh_positive_offset
+sk_load_byte_msh_positive_offset:
         cmpd    r_HL, r_addr
         ble     bpf_slow_path_byte_msh
         lbzx    r_X, r_D, r_addr
         rlwinm  r_X, r_X, 2, 32-4-2, 31-2
         blr
 
-bpf_error:
-        /* Entered with cr0 = lt */
-        li      r3, 0
-        /* Generated code will 'blt epilogue', returning 0. */
-        blr
-
 /* Call out to skb_copy_bits:
  * We'll need to back up our volatile regs first; we have
  * local variable space at r1+(BPF_PPC_STACK_BASIC).
@@ -136,3 +137,84 @@ bpf_slow_path_byte_msh:
         lbz     r_X, BPF_PPC_STACK_BASIC+(2*8)(r1)
         rlwinm  r_X, r_X, 2, 32-4-2, 31-2
         blr
+
+/* Call out to bpf_internal_load_pointer_neg_helper:
+ * We'll need to back up our volatile regs first; we have
+ * local variable space at r1+(BPF_PPC_STACK_BASIC).
+ * Allocate a new stack frame here to remain ABI-compliant in
+ * stashing LR.
+ */
+#define sk_negative_common(SIZE)                                \
+        mflr    r0;                                             \
+        std     r0, 16(r1);                                     \
+        /* R3 goes in parameter space of caller's frame */      \
+        std     r_skb, (BPF_PPC_STACKFRAME+48)(r1);             \
+        std     r_A, (BPF_PPC_STACK_BASIC+(0*8))(r1);           \
+        std     r_X, (BPF_PPC_STACK_BASIC+(1*8))(r1);           \
+        stdu    r1, -BPF_PPC_SLOWPATH_FRAME(r1);                \
+        /* R3 = r_skb, as passed */                             \
+        mr      r4, r_addr;                                     \
+        li      r5, SIZE;                                       \
+        bl      bpf_internal_load_pointer_neg_helper;           \
+        /* R3 != 0 on success */                                \
+        addi    r1, r1, BPF_PPC_SLOWPATH_FRAME;                 \
+        ld      r0, 16(r1);                                     \
+        ld      r_A, (BPF_PPC_STACK_BASIC+(0*8))(r1);           \
+        ld      r_X, (BPF_PPC_STACK_BASIC+(1*8))(r1);           \
+        mtlr    r0;                                             \
+        cmpldi  r3, 0;                                          \
+        beq     bpf_error_slow; /* cr0 = EQ */                  \
+        mr      r_addr, r3;                                     \
+        ld      r_skb, (BPF_PPC_STACKFRAME+48)(r1);             \
+        /* Great success! */
+
+bpf_slow_path_word_neg:
+        lis     r_scratch1,-32  /* SKF_LL_OFF */
+        cmpd    r_addr, r_scratch1      /* addr < SKF_* */
+        blt     bpf_error       /* cr0 = LT */
+        .globl  sk_load_word_negative_offset
+sk_load_word_negative_offset:
+        sk_negative_common(4)
+        lwz     r_A, 0(r_addr)
+        blr
+
+bpf_slow_path_half_neg:
+        lis     r_scratch1,-32  /* SKF_LL_OFF */
+        cmpd    r_addr, r_scratch1      /* addr < SKF_* */
+        blt     bpf_error       /* cr0 = LT */
+        .globl  sk_load_half_negative_offset
+sk_load_half_negative_offset:
+        sk_negative_common(2)
+        lhz     r_A, 0(r_addr)
+        blr
+
+bpf_slow_path_byte_neg:
+        lis     r_scratch1,-32  /* SKF_LL_OFF */
+        cmpd    r_addr, r_scratch1      /* addr < SKF_* */
+        blt     bpf_error       /* cr0 = LT */
+        .globl  sk_load_byte_negative_offset
+sk_load_byte_negative_offset:
+        sk_negative_common(1)
+        lbz     r_A, 0(r_addr)
+        blr
+
+bpf_slow_path_byte_msh_neg:
+        lis     r_scratch1,-32  /* SKF_LL_OFF */
+        cmpd    r_addr, r_scratch1      /* addr < SKF_* */
+        blt     bpf_error       /* cr0 = LT */
+        .globl  sk_load_byte_msh_negative_offset
+sk_load_byte_msh_negative_offset:
+        sk_negative_common(1)
+        lbz     r_X, 0(r_addr)
+        rlwinm  r_X, r_X, 2, 32-4-2, 31-2
+        blr
+
+bpf_error_slow:
+        /* fabricate a cr0 = lt */
+        li      r_scratch1, -1
+        cmpdi   r_scratch1, 0
+bpf_error:
+        /* Entered with cr0 = lt */
+        li      r3, 0
+        /* Generated code will 'blt epilogue', returning 0. */
+        blr
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 73619d3aeb6c..2dc8b1484845 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -127,6 +127,9 @@ static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
         PPC_BLR();
 }
 
+#define CHOOSE_LOAD_FUNC(K, func) \
+        ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative_offset : func) : func##_positive_offset)
+
 /* Assemble the body code between the prologue & epilogue. */
 static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
                               struct codegen_context *ctx,
@@ -391,21 +394,16 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
 
                         /*** Absolute loads from packet header/data ***/
                 case BPF_S_LD_W_ABS:
-                        func = sk_load_word;
+                        func = CHOOSE_LOAD_FUNC(K, sk_load_word);
                         goto common_load;
                 case BPF_S_LD_H_ABS:
-                        func = sk_load_half;
+                        func = CHOOSE_LOAD_FUNC(K, sk_load_half);
                         goto common_load;
                 case BPF_S_LD_B_ABS:
-                        func = sk_load_byte;
+                        func = CHOOSE_LOAD_FUNC(K, sk_load_byte);
                 common_load:
-                        /*
-                         * Load from [K].  Reference with the (negative)
-                         * SKF_NET_OFF/SKF_LL_OFF offsets is unsupported.
-                         */
+                        /* Load from [K]. */
                         ctx->seen |= SEEN_DATAREF;
-                        if ((int)K < 0)
-                                return -ENOTSUPP;
                         PPC_LI64(r_scratch1, func);
                         PPC_MTLR(r_scratch1);
                         PPC_LI32(r_addr, K);
@@ -429,7 +427,7 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
                 common_load_ind:
                         /*
                          * Load from [X + K].  Negative offsets are tested for
-                         * in the helper functions, and result in a 'ret 0'.
+                         * in the helper functions.
                          */
                         ctx->seen |= SEEN_DATAREF | SEEN_XREG;
                         PPC_LI64(r_scratch1, func);
@@ -443,13 +441,7 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
                         break;
 
                 case BPF_S_LDX_B_MSH:
-                        /*
-                         * x86 version drops packet (RET 0) when K<0, whereas
-                         * interpreter does allow K<0 (__load_pointer, special
-                         * ancillary data).  common_load returns ENOTSUPP if K<0,
-                         * so we fall back to interpreter & filter works.
-                         */
-                        func = sk_load_byte_msh;
+                        func = CHOOSE_LOAD_FUNC(K, sk_load_byte_msh);
                         goto common_load;
                         break;
 
diff --git a/arch/powerpc/platforms/85xx/common.c b/arch/powerpc/platforms/85xx/common.c
index 9fef5302adc1..67dac22b4363 100644
--- a/arch/powerpc/platforms/85xx/common.c
+++ b/arch/powerpc/platforms/85xx/common.c
@@ -21,6 +21,12 @@ static struct of_device_id __initdata mpc85xx_common_ids[] = {
         { .compatible = "fsl,qe", },
         { .compatible = "fsl,cpm2", },
         { .compatible = "fsl,srio", },
+        /* So that the DMA channel nodes can be probed individually: */
+        { .compatible = "fsl,eloplus-dma", },
+        /* For the PMC driver */
+        { .compatible = "fsl,mpc8548-guts", },
+        /* Probably unnecessary? */
+        { .compatible = "gpio-leds", },
         {},
 };
 
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_mds.c b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
index 9a6f04406e0d..d208ebccb91c 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_mds.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
@@ -399,12 +399,6 @@ static int __init board_fixups(void)
 machine_arch_initcall(mpc8568_mds, board_fixups);
 machine_arch_initcall(mpc8569_mds, board_fixups);
 
-static struct of_device_id mpc85xx_ids[] = {
-        { .compatible = "fsl,mpc8548-guts", },
-        { .compatible = "gpio-leds", },
-        {},
-};
-
 static int __init mpc85xx_publish_devices(void)
 {
         if (machine_is(mpc8568_mds))
@@ -412,10 +406,7 @@ static int __init mpc85xx_publish_devices(void)
         if (machine_is(mpc8569_mds))
                 simple_gpiochip_init("fsl,mpc8569mds-bcsr-gpio");
 
-        mpc85xx_common_publish_devices();
-        of_platform_bus_probe(NULL, mpc85xx_ids, NULL);
-
-        return 0;
+        return mpc85xx_common_publish_devices();
 }
 
 machine_device_initcall(mpc8568_mds, mpc85xx_publish_devices);
diff --git a/arch/powerpc/platforms/85xx/p1022_ds.c b/arch/powerpc/platforms/85xx/p1022_ds.c
index e74b7cde9aee..f700c81a1321 100644
--- a/arch/powerpc/platforms/85xx/p1022_ds.c
+++ b/arch/powerpc/platforms/85xx/p1022_ds.c
@@ -460,18 +460,7 @@ static void __init p1022_ds_setup_arch(void)
         pr_info("Freescale P1022 DS reference board\n");
 }
 
-static struct of_device_id __initdata p1022_ds_ids[] = {
-        /* So that the DMA channel nodes can be probed individually: */
-        { .compatible = "fsl,eloplus-dma", },
-        {},
-};
-
-static int __init p1022_ds_publish_devices(void)
-{
-        mpc85xx_common_publish_devices();
-        return of_platform_bus_probe(NULL, p1022_ds_ids, NULL);
-}
-machine_device_initcall(p1022_ds, p1022_ds_publish_devices);
+machine_device_initcall(p1022_ds, mpc85xx_common_publish_devices);
 
 machine_arch_initcall(p1022_ds, swiotlb_setup_bus_notifier);
 
diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platforms/cell/axon_msi.c
index db360fc4cf0e..85825b5401e5 100644
--- a/arch/powerpc/platforms/cell/axon_msi.c
+++ b/arch/powerpc/platforms/cell/axon_msi.c
@@ -114,7 +114,7 @@ static void axon_msi_cascade(unsigned int irq, struct irq_desc *desc)
                 pr_devel("axon_msi: woff %x roff %x msi %x\n",
                           write_offset, msic->read_offset, msi);
 
-                if (msi < NR_IRQS && irq_get_chip_data(msi) == msic) {
+                if (msi < nr_irqs && irq_get_chip_data(msi) == msic) {
                         generic_handle_irq(msi);
                         msic->fifo_virt[idx] = cpu_to_le32(0xffffffff);
                 } else {
@@ -276,9 +276,6 @@ static int axon_msi_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
         if (rc)
                 return rc;
 
-        /* We rely on being able to stash a virq in a u16 */
-        BUILD_BUG_ON(NR_IRQS > 65536);
-
         list_for_each_entry(entry, &dev->msi_list, list) {
                 virq = irq_create_direct_mapping(msic->irq_domain);
                 if (virq == NO_IRQ) {
@@ -392,7 +389,8 @@ static int axon_msi_probe(struct platform_device *device)
         }
         memset(msic->fifo_virt, 0xff, MSIC_FIFO_SIZE_BYTES);
 
-        msic->irq_domain = irq_domain_add_nomap(dn, &msic_host_ops, msic);
+        /* We rely on being able to stash a virq in a u16, so limit irqs to < 65536 */
+        msic->irq_domain = irq_domain_add_nomap(dn, 65536, &msic_host_ops, msic);
         if (!msic->irq_domain) {
                 printk(KERN_ERR "axon_msi: couldn't allocate irq_domain for %s\n",
                        dn->full_name);
diff --git a/arch/powerpc/platforms/cell/beat_interrupt.c b/arch/powerpc/platforms/cell/beat_interrupt.c
index e5c3a2c6090d..8c6dc42ecf65 100644
--- a/arch/powerpc/platforms/cell/beat_interrupt.c
+++ b/arch/powerpc/platforms/cell/beat_interrupt.c
@@ -239,7 +239,7 @@ void __init beatic_init_IRQ(void)
         ppc_md.get_irq = beatic_get_irq;
 
         /* Allocate an irq host */
-        beatic_host = irq_domain_add_nomap(NULL, &beatic_pic_host_ops, NULL);
+        beatic_host = irq_domain_add_nomap(NULL, 0, &beatic_pic_host_ops, NULL);
         BUG_ON(beatic_host == NULL);
         irq_set_default_host(beatic_host);
 }
@@ -248,6 +248,6 @@ void beatic_deinit_IRQ(void)
 {
         int     i;
 
-        for (i = 1; i < NR_IRQS; i++)
+        for (i = 1; i < nr_irqs; i++)
                 beat_destruct_irq_plug(i);
 }
diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c
index 996c5ff7824b..03685a329d7d 100644
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -366,11 +366,20 @@ static void kw_i2c_timeout(unsigned long data)
         unsigned long flags;
 
         spin_lock_irqsave(&host->lock, flags);
+
+        /*
+         * If the timer is pending, that means we raced with the
+         * irq, in which case we just return
+         */
+        if (timer_pending(&host->timeout_timer))
+                goto skip;
+
         kw_i2c_handle_interrupt(host, kw_read_reg(reg_isr));
         if (host->state != state_idle) {
                 host->timeout_timer.expires = jiffies + KW_POLL_TIMEOUT;
                 add_timer(&host->timeout_timer);
         }
+ skip:
         spin_unlock_irqrestore(&host->lock, flags);
 }
 
diff --git a/arch/powerpc/platforms/powermac/pic.c b/arch/powerpc/platforms/powermac/pic.c
index 66ad93de1d55..c4e630576ff2 100644
--- a/arch/powerpc/platforms/powermac/pic.c
+++ b/arch/powerpc/platforms/powermac/pic.c
@@ -57,9 +57,9 @@ static int max_real_irqs;
 
 static DEFINE_RAW_SPINLOCK(pmac_pic_lock);
 
-#define NR_MASK_WORDS   ((NR_IRQS + 31) / 32)
-static unsigned long ppc_lost_interrupts[NR_MASK_WORDS];
-static unsigned long ppc_cached_irq_mask[NR_MASK_WORDS];
+/* The max irq number this driver deals with is 128; see max_irqs */
+static DECLARE_BITMAP(ppc_lost_interrupts, 128);
+static DECLARE_BITMAP(ppc_cached_irq_mask, 128);
 static int pmac_irq_cascade = -1;
 static struct irq_domain *pmac_pic_host;
 
diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
index a81e5a88fbdf..b4ddaa3fbb29 100644
--- a/arch/powerpc/platforms/powermac/smp.c
+++ b/arch/powerpc/platforms/powermac/smp.c
@@ -192,7 +192,7 @@ static int psurge_secondary_ipi_init(void)
 {
         int rc = -ENOMEM;
 
-        psurge_host = irq_domain_add_nomap(NULL, &psurge_host_ops, NULL);
+        psurge_host = irq_domain_add_nomap(NULL, 0, &psurge_host_ops, NULL);
 
         if (psurge_host)
                 psurge_secondary_virq = irq_create_direct_mapping(psurge_host);
diff --git a/arch/powerpc/platforms/ps3/interrupt.c b/arch/powerpc/platforms/ps3/interrupt.c
index 2a4ff86cc21f..5f3b23220b8e 100644
--- a/arch/powerpc/platforms/ps3/interrupt.c
+++ b/arch/powerpc/platforms/ps3/interrupt.c
@@ -753,9 +753,8 @@ void __init ps3_init_IRQ(void)
         unsigned cpu;
         struct irq_domain *host;
 
-        host = irq_domain_add_nomap(NULL, &ps3_host_ops, NULL);
+        host = irq_domain_add_nomap(NULL, PS3_PLUG_MAX + 1, &ps3_host_ops, NULL);
         irq_set_default_host(host);
-        irq_set_virq_count(PS3_PLUG_MAX + 1);
 
         for_each_possible_cpu(cpu) {
                 struct ps3_private *pd = &per_cpu(ps3_private, cpu);
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index aadbe4f6d537..178a5f300bc9 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -30,9 +30,9 @@ config PPC_SPLPAR
           two or more partitions.
 
 config EEH
-        bool "PCI Extended Error Handling (EEH)" if EXPERT
+        bool
         depends on PPC_PSERIES && PCI
-        default y if !EXPERT
+        default y
 
 config PSERIES_MSI
        bool
diff --git a/arch/powerpc/platforms/pseries/eeh.c b/arch/powerpc/platforms/pseries/eeh.c
index 309d38ef7322..a75e37dc41aa 100644
--- a/arch/powerpc/platforms/pseries/eeh.c
+++ b/arch/powerpc/platforms/pseries/eeh.c
@@ -1076,7 +1076,7 @@ static void eeh_add_device_late(struct pci_dev *dev)
         pr_debug("EEH: Adding device %s\n", pci_name(dev));
 
         dn = pci_device_to_OF_node(dev);
-        edev = pci_dev_to_eeh_dev(dev);
+        edev = of_node_to_eeh_dev(dn);
         if (edev->pdev == dev) {
                 pr_debug("EEH: Already referenced !\n");
                 return;
diff --git a/arch/powerpc/sysdev/cpm2_pic.c b/arch/powerpc/sysdev/cpm2_pic.c
index d3be961e2ae7..10386b676d87 100644
--- a/arch/powerpc/sysdev/cpm2_pic.c
+++ b/arch/powerpc/sysdev/cpm2_pic.c
@@ -51,8 +51,7 @@
 static intctl_cpm2_t __iomem *cpm2_intctl;
 
 static struct irq_domain *cpm2_pic_host;
-#define NR_MASK_WORDS   ((NR_IRQS + 31) / 32)
-static unsigned long ppc_cached_irq_mask[NR_MASK_WORDS];
+static unsigned long ppc_cached_irq_mask[2]; /* 2 32-bit registers */
 
 static const u_char irq_to_siureg[] = {
         1, 1, 1, 1, 1, 1, 1, 1,
diff --git a/arch/powerpc/sysdev/mpc8xx_pic.c b/arch/powerpc/sysdev/mpc8xx_pic.c
index d5f5416be310..b724622c3a0b 100644
--- a/arch/powerpc/sysdev/mpc8xx_pic.c
+++ b/arch/powerpc/sysdev/mpc8xx_pic.c
@@ -18,69 +18,45 @@
 extern int cpm_get_irq(struct pt_regs *regs);
 
 static struct irq_domain *mpc8xx_pic_host;
-#define NR_MASK_WORDS   ((NR_IRQS + 31) / 32)
-static unsigned long ppc_cached_irq_mask[NR_MASK_WORDS];
+static unsigned long mpc8xx_cached_irq_mask;
 static sysconf8xx_t __iomem *siu_reg;
 
-int cpm_get_irq(struct pt_regs *regs);
+static inline unsigned long mpc8xx_irqd_to_bit(struct irq_data *d)
+{
+        return 0x80000000 >> irqd_to_hwirq(d);
+}
 
 static void mpc8xx_unmask_irq(struct irq_data *d)
 {
-        int     bit, word;
-        unsigned int irq_nr = (unsigned int)irqd_to_hwirq(d);
-
-        bit = irq_nr & 0x1f;
-        word = irq_nr >> 5;
-
-        ppc_cached_irq_mask[word] |= (1 << (31-bit));
-        out_be32(&siu_reg->sc_simask, ppc_cached_irq_mask[word]);
+        mpc8xx_cached_irq_mask |= mpc8xx_irqd_to_bit(d);
+        out_be32(&siu_reg->sc_simask, mpc8xx_cached_irq_mask);
 }
 
 static void mpc8xx_mask_irq(struct irq_data *d)
 {
-        int     bit, word;
-        unsigned int irq_nr = (unsigned int)irqd_to_hwirq(d);
-
-        bit = irq_nr & 0x1f;
-        word = irq_nr >> 5;
-
-        ppc_cached_irq_mask[word] &= ~(1 << (31-bit));
-        out_be32(&siu_reg->sc_simask, ppc_cached_irq_mask[word]);
+        mpc8xx_cached_irq_mask &= ~mpc8xx_irqd_to_bit(d);
+        out_be32(&siu_reg->sc_simask, mpc8xx_cached_irq_mask);
 }
 
 static void mpc8xx_ack(struct irq_data *d)
 {
-        int     bit;
-        unsigned int irq_nr = (unsigned int)irqd_to_hwirq(d);
-
-        bit = irq_nr & 0x1f;
-        out_be32(&siu_reg->sc_sipend, 1 << (31-bit));
+        out_be32(&siu_reg->sc_sipend, mpc8xx_irqd_to_bit(d));
 }
 
 static void mpc8xx_end_irq(struct irq_data *d)
 {
-        int bit, word;
-        unsigned int irq_nr = (unsigned int)irqd_to_hwirq(d);
-
-        bit = irq_nr & 0x1f;
-        word = irq_nr >> 5;
-
-        ppc_cached_irq_mask[word] |= (1 << (31-bit));
-        out_be32(&siu_reg->sc_simask, ppc_cached_irq_mask[word]);
+        mpc8xx_cached_irq_mask |= mpc8xx_irqd_to_bit(d);
+        out_be32(&siu_reg->sc_simask, mpc8xx_cached_irq_mask);
 }
 
 static int mpc8xx_set_irq_type(struct irq_data *d, unsigned int flow_type)
 {
-        if (flow_type & IRQ_TYPE_EDGE_FALLING) {
-                irq_hw_number_t hw = (unsigned int)irqd_to_hwirq(d);
+        /* only external IRQ senses are programmable */
+        if ((flow_type & IRQ_TYPE_EDGE_FALLING) && !(irqd_to_hwirq(d) & 1)) {
                 unsigned int siel = in_be32(&siu_reg->sc_siel);
-
-                /* only external IRQ senses are programmable */
-                if ((hw & 1) == 0) {
-                        siel |= (0x80000000 >> hw);
-                        out_be32(&siu_reg->sc_siel, siel);
-                        __irq_set_handler_locked(d->irq, handle_edge_irq);
-                }
+                siel |= mpc8xx_irqd_to_bit(d);
+                out_be32(&siu_reg->sc_siel, siel);
+                __irq_set_handler_locked(d->irq, handle_edge_irq);
         }
         return 0;
 }
@@ -132,6 +108,9 @@ static int mpc8xx_pic_host_xlate(struct irq_domain *h, struct device_node *ct,
                 IRQ_TYPE_EDGE_FALLING,
         };
 
+        if (intspec[0] > 0x1f)
+                return 0;
+
         *out_hwirq = intspec[0];
         if (intsize > 1 && intspec[1] < 4)
                 *out_flags = map_pic_senses[intspec[1]];
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 9ac71ebd2c40..395af1347749 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -604,18 +604,14 @@ static struct mpic *mpic_find(unsigned int irq)
 }
 
 /* Determine if the linux irq is an IPI */
-static unsigned int mpic_is_ipi(struct mpic *mpic, unsigned int irq)
+static unsigned int mpic_is_ipi(struct mpic *mpic, unsigned int src)
 {
-        unsigned int src = virq_to_hw(irq);
-
         return (src >= mpic->ipi_vecs[0] && src <= mpic->ipi_vecs[3]);
 }
 
 /* Determine if the linux irq is a timer */
-static unsigned int mpic_is_tm(struct mpic *mpic, unsigned int irq)
+static unsigned int mpic_is_tm(struct mpic *mpic, unsigned int src)
 {
-        unsigned int src = virq_to_hw(irq);
-
         return (src >= mpic->timer_vecs[0] && src <= mpic->timer_vecs[7]);
 }
 
@@ -876,21 +872,45 @@ int mpic_set_irq_type(struct irq_data *d, unsigned int flow_type)
         if (src >= mpic->num_sources)
                 return -EINVAL;
 
+        vold = mpic_irq_read(src, MPIC_INFO(IRQ_VECTOR_PRI));
+
+        /* We don't support "none" type */
         if (flow_type == IRQ_TYPE_NONE)
-                if (mpic->senses && src < mpic->senses_count)
-                        flow_type = mpic->senses[src];
-        if (flow_type == IRQ_TYPE_NONE)
-                flow_type = IRQ_TYPE_LEVEL_LOW;
+                flow_type = IRQ_TYPE_DEFAULT;
+
+        /* Default: read HW settings */
+        if (flow_type == IRQ_TYPE_DEFAULT) {
+                switch(vold & (MPIC_INFO(VECPRI_POLARITY_MASK) |
+                               MPIC_INFO(VECPRI_SENSE_MASK))) {
+                        case MPIC_INFO(VECPRI_SENSE_EDGE) |
+                             MPIC_INFO(VECPRI_POLARITY_POSITIVE):
+                                flow_type = IRQ_TYPE_EDGE_RISING;
+                                break;
+                        case MPIC_INFO(VECPRI_SENSE_EDGE) |
+                             MPIC_INFO(VECPRI_POLARITY_NEGATIVE):
+                                flow_type = IRQ_TYPE_EDGE_FALLING;
+                                break;
+                        case MPIC_INFO(VECPRI_SENSE_LEVEL) |
+                             MPIC_INFO(VECPRI_POLARITY_POSITIVE):
+                                flow_type = IRQ_TYPE_LEVEL_HIGH;
+                                break;
+                        case MPIC_INFO(VECPRI_SENSE_LEVEL) |
+                             MPIC_INFO(VECPRI_POLARITY_NEGATIVE):
+                                flow_type = IRQ_TYPE_LEVEL_LOW;
+                                break;
+                }
+        }
 
+        /* Apply to irq desc */
         irqd_set_trigger_type(d, flow_type);
 
+        /* Apply to HW */
         if (mpic_is_ht_interrupt(mpic, src))
                 vecpri = MPIC_VECPRI_POLARITY_POSITIVE |
                         MPIC_VECPRI_SENSE_EDGE;
         else
                 vecpri = mpic_type_to_vecpri(mpic, flow_type);
 
-        vold = mpic_irq_read(src, MPIC_INFO(IRQ_VECTOR_PRI));
         vnew = vold & ~(MPIC_INFO(VECPRI_POLARITY_MASK) |
                         MPIC_INFO(VECPRI_SENSE_MASK));
         vnew |= vecpri;
@@ -1026,7 +1046,7 @@ static int mpic_host_map(struct irq_domain *h, unsigned int virq,
         irq_set_chip_and_handler(virq, chip, handle_fasteoi_irq);
 
         /* Set default irq type */
-        irq_set_irq_type(virq, IRQ_TYPE_NONE);
+        irq_set_irq_type(virq, IRQ_TYPE_DEFAULT);
 
         /* If the MPIC was reset, then all vectors have already been
          * initialized.  Otherwise, a per source lazy initialization
@@ -1417,12 +1437,6 @@ void __init mpic_assign_isu(struct mpic *mpic, unsigned int isu_num,
                 mpic->num_sources = isu_first + mpic->isu_size;
 }
 
-void __init mpic_set_default_senses(struct mpic *mpic, u8 *senses, int count)
-{
-        mpic->senses = senses;
-        mpic->senses_count = count;
-}
-
 void __init mpic_init(struct mpic *mpic)
 {
         int i, cpu;
@@ -1555,12 +1569,12 @@ void mpic_irq_set_priority(unsigned int irq, unsigned int pri)
                 return;
 
         raw_spin_lock_irqsave(&mpic_lock, flags);
-        if (mpic_is_ipi(mpic, irq)) {
+        if (mpic_is_ipi(mpic, src)) {
                 reg = mpic_ipi_read(src - mpic->ipi_vecs[0]) &
                         ~MPIC_VECPRI_PRIORITY_MASK;
                 mpic_ipi_write(src - mpic->ipi_vecs[0],
                                reg | (pri << MPIC_VECPRI_PRIORITY_SHIFT));
-        } else if (mpic_is_tm(mpic, irq)) {
+        } else if (mpic_is_tm(mpic, src)) {
                 reg = mpic_tm_read(src - mpic->timer_vecs[0]) &
                         ~MPIC_VECPRI_PRIORITY_MASK;
                 mpic_tm_write(src - mpic->timer_vecs[0],
diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c
index 6e7fa386e76a..483d8fa72e8b 100644
--- a/arch/powerpc/sysdev/mpic_msgr.c
+++ b/arch/powerpc/sysdev/mpic_msgr.c
@@ -27,6 +27,7 @@
 
 static struct mpic_msgr **mpic_msgrs;
 static unsigned int mpic_msgr_count;
+static DEFINE_RAW_SPINLOCK(msgrs_lock);
 
 static inline void _mpic_msgr_mer_write(struct mpic_msgr *msgr, u32 value)
 {
@@ -56,12 +57,11 @@ struct mpic_msgr *mpic_msgr_get(unsigned int reg_num)
         if (reg_num >= mpic_msgr_count)
                 return ERR_PTR(-ENODEV);
 
-        raw_spin_lock_irqsave(&msgr->lock, flags);
-        if (mpic_msgrs[reg_num]->in_use == MSGR_FREE) {
-                msgr = mpic_msgrs[reg_num];
+        raw_spin_lock_irqsave(&msgrs_lock, flags);
+        msgr = mpic_msgrs[reg_num];
+        if (msgr->in_use == MSGR_FREE)
                 msgr->in_use = MSGR_INUSE;
-        }
-        raw_spin_unlock_irqrestore(&msgr->lock, flags);
+        raw_spin_unlock_irqrestore(&msgrs_lock, flags);
 
         return msgr;
 }
@@ -228,7 +228,7 @@ static __devinit int mpic_msgr_probe(struct platform_device *dev)
 
                 reg_number = block_number * MPIC_MSGR_REGISTERS_PER_BLOCK + i;
                 msgr->base = msgr_block_addr + i * MPIC_MSGR_STRIDE;
-                msgr->mer = msgr->base + MPIC_MSGR_MER_OFFSET;
+                msgr->mer = (u32 *)((u8 *)msgr->base + MPIC_MSGR_MER_OFFSET);
                 msgr->in_use = MSGR_FREE;
                 msgr->num = i;
                 raw_spin_lock_init(&msgr->lock);
diff --git a/arch/powerpc/sysdev/scom.c b/arch/powerpc/sysdev/scom.c
index 49a3ece1c6b3..702256a1ca11 100644
--- a/arch/powerpc/sysdev/scom.c
+++ b/arch/powerpc/sysdev/scom.c
@@ -22,6 +22,7 @@
 #include <linux/debugfs.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <asm/debug.h>
 #include <asm/prom.h>
 #include <asm/scom.h>
 
diff --git a/arch/powerpc/sysdev/xics/xics-common.c b/arch/powerpc/sysdev/xics/xics-common.c
index ea5e204e3450..cd1d18db92c6 100644
--- a/arch/powerpc/sysdev/xics/xics-common.c
+++ b/arch/powerpc/sysdev/xics/xics-common.c
@@ -188,6 +188,7 @@ void xics_migrate_irqs_away(void)
 {
         int cpu = smp_processor_id(), hw_cpu = hard_smp_processor_id();
         unsigned int irq, virq;
+        struct irq_desc *desc;
 
         /* If we used to be the default server, move to the new "boot_cpuid" */
         if (hw_cpu == xics_default_server)
@@ -202,8 +203,7 @@ void xics_migrate_irqs_away(void)
         /* Allow IPIs again... */
         icp_ops->set_priority(DEFAULT_PRIORITY);
 
-        for_each_irq(virq) {
-                struct irq_desc *desc;
+        for_each_irq_desc(virq, desc) {
                 struct irq_chip *chip;
                 long server;
                 unsigned long flags;
@@ -212,9 +212,8 @@ void xics_migrate_irqs_away(void)
                 /* We can't set affinity on ISA interrupts */
                 if (virq < NUM_ISA_INTERRUPTS)
                         continue;
-                desc = irq_to_desc(virq);
                 /* We only need to migrate enabled IRQS */
-                if (!desc || !desc->action)
+                if (!desc->action)
                         continue;
                 if (desc->irq_data.domain != xics_host)
                         continue;
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 2b7c0fbe578e..9015060919a0 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -90,7 +90,6 @@ config S390
         select HAVE_KERNEL_XZ
         select HAVE_ARCH_MUTEX_CPU_RELAX
         select HAVE_ARCH_JUMP_LABEL if !MARCH_G5
-        select HAVE_RCU_TABLE_FREE if SMP
         select ARCH_SAVE_PAGE_KEYS if HIBERNATION
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 6cf8e26b3137..1957a9dd256d 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,8 +1,12 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
+CONFIG_FHANDLE=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_AUDIT=y
-CONFIG_RCU_TRACE=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CGROUPS=y
@@ -14,16 +18,22 @@ CONFIG_CGROUP_MEM_RES_CTLR_SWAP=y
 CONFIG_CGROUP_SCHED=y
 CONFIG_RT_GROUP_SCHED=y
 CONFIG_BLK_CGROUP=y
+CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_RD_BZIP2=y
+CONFIG_RD_LZMA=y
+CONFIG_RD_XZ=y
+CONFIG_RD_LZO=y
+CONFIG_EXPERT=y
 # CONFIG_COMPAT_BRK is not set
-CONFIG_SLAB=y
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=y
 CONFIG_KPROBES=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_IBM_PARTITION=y
 CONFIG_DEFAULT_DEADLINE=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -34,18 +44,15 @@ CONFIG_KSM=y
 CONFIG_BINFMT_MISC=m
 CONFIG_CMM=m
 CONFIG_HZ_100=y
-CONFIG_KEXEC=y
-CONFIG_PM=y
+CONFIG_CRASH_DUMP=y
 CONFIG_HIBERNATION=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_NET_KEY=y
-CONFIG_AFIUCV=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 # CONFIG_INET_LRO is not set
 CONFIG_IPV6=y
-CONFIG_NET_SCTPPROBE=m
 CONFIG_L2TP=m
 CONFIG_L2TP_DEBUGFS=m
 CONFIG_VLAN_8021Q=y
@@ -84,15 +91,14 @@ CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_SCAN_ASYNC=y
 CONFIG_ZFCP=y
-CONFIG_ZFCP_DIF=y
 CONFIG_NETDEVICES=y
-CONFIG_DUMMY=m
 CONFIG_BONDING=m
+CONFIG_DUMMY=m
 CONFIG_EQUALIZER=m
 CONFIG_TUN=m
-CONFIG_NET_ETHERNET=y
 CONFIG_VIRTIO_NET=y
 CONFIG_RAW_DRIVER=m
+CONFIG_VIRTIO_BALLOON=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
@@ -103,27 +109,21 @@ CONFIG_PROC_KCORE=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_IBM_PARTITION=y
-CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
-CONFIG_DEBUG_KERNEL=y
 CONFIG_TIMER_STATS=y
 CONFIG_PROVE_LOCKING=y
 CONFIG_PROVE_RCU=y
 CONFIG_LOCK_STAT=y
 CONFIG_DEBUG_LOCKDEP=y
-CONFIG_DEBUG_SPINLOCK_SLEEP=y
 CONFIG_DEBUG_LIST=y
 CONFIG_DEBUG_NOTIFIERS=y
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
+CONFIG_RCU_TRACE=y
 CONFIG_KPROBES_SANITY_TEST=y
 CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
 CONFIG_CPU_NOTIFIER_ERROR_INJECT=m
 CONFIG_LATENCYTOP=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_DEBUG_PAGEALLOC=y
-# CONFIG_FTRACE is not set
+CONFIG_BLK_DEV_IO_TRACE=y
 # CONFIG_STRICT_DEVMEM is not set
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
@@ -173,4 +173,3 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRC7=m
-CONFIG_VIRTIO_BALLOON=y
diff --git a/arch/s390/include/asm/facility.h b/arch/s390/include/asm/facility.h
index 1e5b27edc0c9..2ee66a65f2d4 100644
--- a/arch/s390/include/asm/facility.h
+++ b/arch/s390/include/asm/facility.h
@@ -38,12 +38,11 @@ static inline void stfle(u64 *stfle_fac_list, int size)
         unsigned long nr;
 
         preempt_disable();
-        S390_lowcore.stfl_fac_list = 0;
         asm volatile(
                 "       .insn s,0xb2b10000,0(0)\n" /* stfl */
                 "0:\n"
                 EX_TABLE(0b, 0b)
-                : "=m" (S390_lowcore.stfl_fac_list));
+                : "+m" (S390_lowcore.stfl_fac_list));
         nr = 4; /* bytes stored by stfl */
         memcpy(stfle_fac_list, &S390_lowcore.stfl_fac_list, 4);
         if (S390_lowcore.stfl_fac_list & 0x01000000) {
diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
index 8eef9b5b3cf4..78e3041919de 100644
--- a/arch/s390/include/asm/pgalloc.h
+++ b/arch/s390/include/asm/pgalloc.h
@@ -22,10 +22,7 @@ void crst_table_free(struct mm_struct *, unsigned long *);
 
 unsigned long *page_table_alloc(struct mm_struct *, unsigned long);
 void page_table_free(struct mm_struct *, unsigned long *);
-#ifdef CONFIG_HAVE_RCU_TABLE_FREE
 void page_table_free_rcu(struct mmu_gather *, unsigned long *);
-void __tlb_remove_table(void *_table);
-#endif
 
 static inline void clear_table(unsigned long *s, unsigned long val, size_t n)
 {
diff --git a/arch/s390/include/asm/swab.h b/arch/s390/include/asm/swab.h
index 6bdee21c077e..a3e4ebb32090 100644
--- a/arch/s390/include/asm/swab.h
+++ b/arch/s390/include/asm/swab.h
@@ -77,7 +77,7 @@ static inline __u16 __arch_swab16p(const __u16 *x)
         
         asm volatile(
 #ifndef __s390x__
-                "       icm     %0,2,%O+1(%R1)\n"
+                "       icm     %0,2,%O1+1(%R1)\n"
                 "       ic      %0,%1\n"
                 : "=&d" (result) : "Q" (*x) : "cc");
 #else /* __s390x__ */
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index c687a2c83462..775a5eea8f9e 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -30,14 +30,10 @@
 
 struct mmu_gather {
         struct mm_struct *mm;
-#ifdef CONFIG_HAVE_RCU_TABLE_FREE
         struct mmu_table_batch *batch;
-#endif
         unsigned int fullmm;
-        unsigned int need_flush;
 };
 
-#ifdef CONFIG_HAVE_RCU_TABLE_FREE
 struct mmu_table_batch {
         struct rcu_head         rcu;
         unsigned int            nr;
@@ -49,7 +45,6 @@ struct mmu_table_batch {
 
 extern void tlb_table_flush(struct mmu_gather *tlb);
 extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
-#endif
 
 static inline void tlb_gather_mmu(struct mmu_gather *tlb,
                                   struct mm_struct *mm,
@@ -57,29 +52,20 @@ static inline void tlb_gather_mmu(struct mmu_gather *tlb,
 {
         tlb->mm = mm;
         tlb->fullmm = full_mm_flush;
-        tlb->need_flush = 0;
-#ifdef CONFIG_HAVE_RCU_TABLE_FREE
         tlb->batch = NULL;
-#endif
         if (tlb->fullmm)
                 __tlb_flush_mm(mm);
 }
 
 static inline void tlb_flush_mmu(struct mmu_gather *tlb)
 {
-        if (!tlb->need_flush)
-                return;
-        tlb->need_flush = 0;
-        __tlb_flush_mm(tlb->mm);
-#ifdef CONFIG_HAVE_RCU_TABLE_FREE
         tlb_table_flush(tlb);
-#endif
 }
 
 static inline void tlb_finish_mmu(struct mmu_gather *tlb,
                                   unsigned long start, unsigned long end)
 {
-        tlb_flush_mmu(tlb);
+        tlb_table_flush(tlb);
 }
 
 /*
@@ -105,10 +91,8 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
 static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
                                 unsigned long address)
 {
-#ifdef CONFIG_HAVE_RCU_TABLE_FREE
         if (!tlb->fullmm)
                 return page_table_free_rcu(tlb, (unsigned long *) pte);
-#endif
         page_table_free(tlb->mm, (unsigned long *) pte);
 }
 
@@ -125,10 +109,8 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
 #ifdef __s390x__
         if (tlb->mm->context.asce_limit <= (1UL << 31))
                 return;
-#ifdef CONFIG_HAVE_RCU_TABLE_FREE
         if (!tlb->fullmm)
                 return tlb_remove_table(tlb, pmd);
-#endif
         crst_table_free(tlb->mm, (unsigned long *) pmd);
 #endif
 }
@@ -146,10 +128,8 @@ static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
 #ifdef __s390x__
         if (tlb->mm->context.asce_limit <= (1UL << 42))
                 return;
-#ifdef CONFIG_HAVE_RCU_TABLE_FREE
         if (!tlb->fullmm)
                 return tlb_remove_table(tlb, pud);
-#endif
         crst_table_free(tlb->mm, (unsigned long *) pud);
 #endif
 }
diff --git a/arch/s390/kernel/head.S b/arch/s390/kernel/head.S
index c27a0727f930..adccd908ebc7 100644
--- a/arch/s390/kernel/head.S
+++ b/arch/s390/kernel/head.S
@@ -474,9 +474,9 @@ ENTRY(startup_kdump)
         stck    __LC_LAST_UPDATE_CLOCK
         spt     5f-.LPG0(%r13)
         mvc     __LC_LAST_UPDATE_TIMER(8),5f-.LPG0(%r13)
+        xc      __LC_STFL_FAC_LIST(8),__LC_STFL_FAC_LIST
 #ifndef CONFIG_MARCH_G5
         # check capabilities against MARCH_{G5,Z900,Z990,Z9_109,Z10}
-        xc      __LC_STFL_FAC_LIST(8),__LC_STFL_FAC_LIST
         .insn   s,0xb2b10000,__LC_STFL_FAC_LIST # store facility list
         tm      __LC_STFL_FAC_LIST,0x01 # stfle available ?
         jz      0f
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index 1c2cdd59ccd0..8a22c27219dd 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -118,9 +118,10 @@ asmlinkage void do_softirq(void)
                                          "a" (__do_softirq)
                                      : "0", "1", "2", "3", "4", "5", "14",
                                        "cc", "memory" );
-                } else
+                } else {
                         /* We are already on the async stack. */
                         __do_softirq();
+                }
         }
 
         local_irq_restore(flags);
@@ -192,11 +193,12 @@ int unregister_external_interrupt(u16 code, ext_int_handler_t handler)
         int index = ext_hash(code);
 
         spin_lock_irqsave(&ext_int_hash_lock, flags);
-        list_for_each_entry_rcu(p, &ext_int_hash[index], entry)
+        list_for_each_entry_rcu(p, &ext_int_hash[index], entry) {
                 if (p->code == code && p->handler == handler) {
                         list_del_rcu(&p->entry);
                         kfree_rcu(p, rcu);
                 }
+        }
         spin_unlock_irqrestore(&ext_int_hash_lock, flags);
         return 0;
 }
@@ -211,9 +213,10 @@ void __irq_entry do_extint(struct pt_regs *regs, struct ext_code ext_code,
 
         old_regs = set_irq_regs(regs);
         irq_enter();
-        if (S390_lowcore.int_clock >= S390_lowcore.clock_comparator)
+        if (S390_lowcore.int_clock >= S390_lowcore.clock_comparator) {
                 /* Serve timer interrupts first. */
                 clock_comparator_work();
+        }
         kstat_cpu(smp_processor_id()).irqs[EXTERNAL_INTERRUPT]++;
         if (ext_code.code != 0x1004)
                 __get_cpu_var(s390_idle).nohz_delay = 1;
diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index 46405086479c..cb019f429e88 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -178,7 +178,7 @@ static void cpumf_pmu_enable(struct pmu *pmu)
         err = lcctl(cpuhw->state);
         if (err) {
                 pr_err("Enabling the performance measuring unit "
-                       "failed with rc=%lx\n", err);
+                       "failed with rc=%x\n", err);
                 return;
         }
 
@@ -203,7 +203,7 @@ static void cpumf_pmu_disable(struct pmu *pmu)
         err = lcctl(inactive);
         if (err) {
                 pr_err("Disabling the performance measuring unit "
-                       "failed with rc=%lx\n", err);
+                       "failed with rc=%x\n", err);
                 return;
         }
 
diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
index 7bb15fcca75e..e1335dc2b1b7 100644
--- a/arch/s390/mm/maccess.c
+++ b/arch/s390/mm/maccess.c
@@ -61,21 +61,14 @@ long probe_kernel_write(void *dst, const void *src, size_t size)
         return copied < 0 ? -EFAULT : 0;
 }
 
-/*
- * Copy memory in real mode (kernel to kernel)
- */
-int memcpy_real(void *dest, void *src, size_t count)
+static int __memcpy_real(void *dest, void *src, size_t count)
 {
         register unsigned long _dest asm("2") = (unsigned long) dest;
         register unsigned long _len1 asm("3") = (unsigned long) count;
         register unsigned long _src  asm("4") = (unsigned long) src;
         register unsigned long _len2 asm("5") = (unsigned long) count;
-        unsigned long flags;
         int rc = -EFAULT;
 
-        if (!count)
-                return 0;
-        flags = __arch_local_irq_stnsm(0xf8UL);
         asm volatile (
                 "0:     mvcle   %1,%2,0x0\n"
                 "1:     jo      0b\n"
@@ -86,7 +79,23 @@ int memcpy_real(void *dest, void *src, size_t count)
                   "+d" (_len2), "=m" (*((long *) dest))
                 : "m" (*((long *) src))
                 : "cc", "memory");
-        arch_local_irq_restore(flags);
+        return rc;
+}
+
+/*
+ * Copy memory in real mode (kernel to kernel)
+ */
+int memcpy_real(void *dest, void *src, size_t count)
+{
+        unsigned long flags;
+        int rc;
+
+        if (!count)
+                return 0;
+        local_irq_save(flags);
+        __arch_local_irq_stnsm(0xfbUL);
+        rc = __memcpy_real(dest, src, count);
+        local_irq_restore(flags);
         return rc;
 }
 
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 373adf69b01c..6e765bf00670 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -678,8 +678,6 @@ void page_table_free(struct mm_struct *mm, unsigned long *table)
         }
 }
 
-#ifdef CONFIG_HAVE_RCU_TABLE_FREE
-
 static void __page_table_free_rcu(void *table, unsigned bit)
 {
         struct page *page;
@@ -733,7 +731,66 @@ void __tlb_remove_table(void *_table)
                 free_pages((unsigned long) table, ALLOC_ORDER);
 }
 
-#endif
+static void tlb_remove_table_smp_sync(void *arg)
+{
+        /* Simply deliver the interrupt */
+}
+
+static void tlb_remove_table_one(void *table)
+{
+        /*
+         * This isn't an RCU grace period and hence the page-tables cannot be
+         * assumed to be actually RCU-freed.
+         *
+         * It is however sufficient for software page-table walkers that rely
+         * on IRQ disabling. See the comment near struct mmu_table_batch.
+         */
+        smp_call_function(tlb_remove_table_smp_sync, NULL, 1);
+        __tlb_remove_table(table);
+}
+
+static void tlb_remove_table_rcu(struct rcu_head *head)
+{
+        struct mmu_table_batch *batch;
+        int i;
+
+        batch = container_of(head, struct mmu_table_batch, rcu);
+
+        for (i = 0; i < batch->nr; i++)
+                __tlb_remove_table(batch->tables[i]);
+
+        free_page((unsigned long)batch);
+}
+
+void tlb_table_flush(struct mmu_gather *tlb)
+{
+        struct mmu_table_batch **batch = &tlb->batch;
+
+        if (*batch) {
+                __tlb_flush_mm(tlb->mm);
+                call_rcu_sched(&(*batch)->rcu, tlb_remove_table_rcu);
+                *batch = NULL;
+        }
+}
+
+void tlb_remove_table(struct mmu_gather *tlb, void *table)
+{
+        struct mmu_table_batch **batch = &tlb->batch;
+
+        if (*batch == NULL) {
+                *batch = (struct mmu_table_batch *)
+                        __get_free_page(GFP_NOWAIT | __GFP_NOWARN);
+                if (*batch == NULL) {
+                        __tlb_flush_mm(tlb->mm);
+                        tlb_remove_table_one(table);
+                        return;
+                }
+                (*batch)->nr = 0;
+        }
+        (*batch)->tables[(*batch)->nr++] = table;
+        if ((*batch)->nr == MAX_TABLE_BATCH)
+                tlb_table_flush(tlb);
+}
 
 /*
  * switch on pgstes for its userspace process (for kvm)
diff --git a/arch/sh/include/asm/atomic.h b/arch/sh/include/asm/atomic.h
index 37f2f4a55231..f4c1c20bcdf6 100644
--- a/arch/sh/include/asm/atomic.h
+++ b/arch/sh/include/asm/atomic.h
@@ -11,7 +11,7 @@
 #include <linux/types.h>
 #include <asm/cmpxchg.h>
 
-#define ATOMIC_INIT(i)  ( (atomic_t) { (i) } )
+#define ATOMIC_INIT(i)  { (i) }
 
 #define atomic_read(v)          (*(volatile int *)&(v)->counter)
 #define atomic_set(v,i)         ((v)->counter = (i))
diff --git a/arch/sh/mm/fault_32.c b/arch/sh/mm/fault_32.c
index 324eef93c900..e99b104d967a 100644
--- a/arch/sh/mm/fault_32.c
+++ b/arch/sh/mm/fault_32.c
@@ -86,7 +86,7 @@ static noinline int vmalloc_fault(unsigned long address)
         pte_t *pte_k;
 
         /* Make sure we are in vmalloc/module/P3 area: */
-        if (!(address >= VMALLOC_START && address < P3_ADDR_MAX))
+        if (!(address >= P3SEG && address < P3_ADDR_MAX))
                 return -1;
 
         /*
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index fea13c7b1aee..b93c2c9ccb1d 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -1264,4 +1264,4 @@ static int __init ds_init(void)
         return vio_register_driver(&ds_driver);
 }
 
-subsys_initcall(ds_init);
+fs_initcall(ds_init);
diff --git a/arch/sparc/kernel/leon_pci.c b/arch/sparc/kernel/leon_pci.c
index aba6b958b2a5..19f56058742b 100644
--- a/arch/sparc/kernel/leon_pci.c
+++ b/arch/sparc/kernel/leon_pci.c
@@ -45,7 +45,6 @@ void leon_pci_init(struct platform_device *ofdev, struct leon_pci_info *info)
 
 void __devinit pcibios_fixup_bus(struct pci_bus *pbus)
 {
-        struct leon_pci_info *info = pbus->sysdata;
         struct pci_dev *dev;
         int i, has_io, has_mem;
         u16 cmd;
@@ -111,18 +110,6 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
         return pci_enable_resources(dev, mask);
 }
 
-struct device_node *pci_device_to_OF_node(struct pci_dev *pdev)
-{
-        /*
-         * Currently the OpenBoot nodes are not connected with the PCI device,
-         * this is because the LEON PROM does not create PCI nodes. Eventually
-         * this will change and the same approach as pcic.c can be used to
-         * match PROM nodes with pci devices.
-         */
-        return NULL;
-}
-EXPORT_SYMBOL(pci_device_to_OF_node);
-
 void __devinit pcibios_update_irq(struct pci_dev *dev, int irq)
 {
 #ifdef CONFIG_PCI_DEBUG
diff --git a/arch/sparc/kernel/leon_smp.c b/arch/sparc/kernel/leon_smp.c
index 1210fde18740..160cac9c4036 100644
--- a/arch/sparc/kernel/leon_smp.c
+++ b/arch/sparc/kernel/leon_smp.c
@@ -23,6 +23,7 @@
 #include <linux/pm.h>
 #include <linux/delay.h>
 #include <linux/gfp.h>
+#include <linux/cpu.h>
 
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
@@ -78,6 +79,8 @@ void __cpuinit leon_callin(void)
         local_flush_tlb_all();
         leon_configure_cache_smp();
 
+        notify_cpu_starting(cpuid);
+
         /* Get our local ticker going. */
         smp_setup_percpu_timer();
 
diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
index 77f1b95e0806..9171fc238def 100644
--- a/arch/sparc/kernel/rtrap_64.S
+++ b/arch/sparc/kernel/rtrap_64.S
@@ -20,11 +20,6 @@
 
                 .text
                 .align                  32
-__handle_softirq:
-                call                    do_softirq
-                 nop
-                ba,a,pt                 %xcc, __handle_softirq_continue
-                 nop
 __handle_preemption:
                 call                    schedule
                  wrpr                   %g0, RTRAP_PSTATE, %pstate
@@ -89,9 +84,7 @@ rtrap:
                 cmp                     %l1, 0
 
                 /* mm/ultra.S:xcall_report_regs KNOWS about this load. */
-                bne,pn                  %icc, __handle_softirq
                  ldx                    [%sp + PTREGS_OFF + PT_V9_TSTATE], %l1
-__handle_softirq_continue:
 rtrap_xcall:
                 sethi                   %hi(0xf << 20), %l4
                 and                     %l1, %l4, %l4
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index 232df9949530..3ee51f189a55 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -566,15 +566,10 @@ out:
 
 SYSCALL_DEFINE2(64_munmap, unsigned long, addr, size_t, len)
 {
-        long ret;
-
         if (invalid_64bit_range(addr, len))
                 return -EINVAL;
 
-        down_write(&current->mm->mmap_sem);
-        ret = do_munmap(current->mm, addr, len);
-        up_write(&current->mm->mmap_sem);
-        return ret;
+        return vm_munmap(addr, len);
 }
 
 extern unsigned long do_mremap(unsigned long addr,
diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
index 7705c6731e28..df3155a17991 100644
--- a/arch/sparc/mm/fault_32.c
+++ b/arch/sparc/mm/fault_32.c
@@ -225,6 +225,8 @@ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
         unsigned long g2;
         int from_user = !(regs->psr & PSR_PS);
         int fault, code;
+        unsigned int flags = (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+                              (write ? FAULT_FLAG_WRITE : 0));
 
         if(text_fault)
                 address = regs->pc;
@@ -251,6 +253,7 @@ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
 
         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
 
+retry:
         down_read(&mm->mmap_sem);
 
         /*
@@ -289,7 +292,11 @@ good_area:
          * make sure we exit gracefully rather than endlessly redo
          * the fault.
          */
-        fault = handle_mm_fault(mm, vma, address, write ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
+
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
@@ -297,13 +304,29 @@ good_area:
                         goto do_sigbus;
                 BUG();
         }
-        if (fault & VM_FAULT_MAJOR) {
-                current->maj_flt++;
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
-        } else {
-                current->min_flt++;
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
+
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
+                if (fault & VM_FAULT_MAJOR) {
+                        current->maj_flt++;
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ,
+                                      1, regs, address);
+                } else {
+                        current->min_flt++;
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN,
+                                      1, regs, address);
+                }
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+
+                        /* No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+
+                        goto retry;
+                }
         }
+
         up_read(&mm->mmap_sem);
         return;
 
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
index 504c0622f729..1fe0429b6314 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -279,6 +279,7 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
         unsigned int insn = 0;
         int si_code, fault_code, fault;
         unsigned long address, mm_rss;
+        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
 
         fault_code = get_thread_fault_code();
 
@@ -333,6 +334,8 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
                         insn = get_fault_insn(regs, insn);
                         goto handle_kernel_fault;
                 }
+
+retry:
                 down_read(&mm->mmap_sem);
         }
 
@@ -423,7 +426,12 @@ good_area:
                         goto bad_area;
         }
 
-        fault = handle_mm_fault(mm, vma, address, (fault_code & FAULT_CODE_WRITE) ? FAULT_FLAG_WRITE : 0);
+        flags |= ((fault_code & FAULT_CODE_WRITE) ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
+
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
@@ -431,12 +439,27 @@ good_area:
                         goto do_sigbus;
                 BUG();
         }
-        if (fault & VM_FAULT_MAJOR) {
-                current->maj_flt++;
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
-        } else {
-                current->min_flt++;
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
+
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
+                if (fault & VM_FAULT_MAJOR) {
+                        current->maj_flt++;
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ,
+                                      1, regs, address);
+                } else {
+                        current->min_flt++;
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN,
+                                      1, regs, address);
+                }
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+
+                        /* No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+
+                        goto retry;
+                }
         }
         up_read(&mm->mmap_sem);
 
diff --git a/arch/tile/include/asm/pci.h b/arch/tile/include/asm/pci.h
index 5d5a635530bd..32e6cbe8dff3 100644
--- a/arch/tile/include/asm/pci.h
+++ b/arch/tile/include/asm/pci.h
@@ -47,8 +47,8 @@ struct pci_controller {
  */
 #define PCI_DMA_BUS_IS_PHYS     1
 
-int __devinit tile_pci_init(void);
-int __devinit pcibios_init(void);
+int __init tile_pci_init(void);
+int __init pcibios_init(void);
 
 static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr) {}
 
diff --git a/arch/tile/kernel/pci.c b/arch/tile/kernel/pci.c
index a1bb59eecc18..b56d12bf5900 100644
--- a/arch/tile/kernel/pci.c
+++ b/arch/tile/kernel/pci.c
@@ -141,7 +141,7 @@ static int __devinit tile_init_irqs(int controller_id,
  *
  * Returns the number of controllers discovered.
  */
-int __devinit tile_pci_init(void)
+int __init tile_pci_init(void)
 {
         int i;
 
@@ -287,7 +287,7 @@ static void __devinit fixup_read_and_payload_sizes(void)
  * The controllers have been set up by the time we get here, by a call to
  * tile_pci_init.
  */
-int __devinit pcibios_init(void)
+int __init pcibios_init(void)
 {
         int i;
 
diff --git a/arch/tile/kernel/proc.c b/arch/tile/kernel/proc.c
index 7a9327046404..446a7f52cc11 100644
--- a/arch/tile/kernel/proc.c
+++ b/arch/tile/kernel/proc.c
@@ -146,7 +146,6 @@ static ctl_table unaligned_table[] = {
         },
         {}
 };
-#endif
 
 static struct ctl_path tile_path[] = {
         { .procname = "tile" },
@@ -155,10 +154,9 @@ static struct ctl_path tile_path[] = {
 
 static int __init proc_sys_tile_init(void)
 {
-#ifndef __tilegx__  /* FIXME: GX: no support for unaligned access yet */
         register_sysctl_paths(tile_path, unaligned_table);
-#endif
         return 0;
 }
 
 arch_initcall(proc_sys_tile_init);
+#endif
diff --git a/arch/tile/kernel/single_step.c b/arch/tile/kernel/single_step.c
index 9efbc1391b3c..89529c9f0605 100644
--- a/arch/tile/kernel/single_step.c
+++ b/arch/tile/kernel/single_step.c
@@ -346,12 +346,10 @@ void single_step_once(struct pt_regs *regs)
                 }
 
                 /* allocate a cache line of writable, executable memory */
-                down_write(&current->mm->mmap_sem);
-                buffer = (void __user *) do_mmap(NULL, 0, 64,
+                buffer = (void __user *) vm_mmap(NULL, 0, 64,
                                           PROT_EXEC | PROT_READ | PROT_WRITE,
                                           MAP_PRIVATE | MAP_ANONYMOUS,
                                           0);
-                up_write(&current->mm->mmap_sem);
 
                 if (IS_ERR((void __force *)buffer)) {
                         kfree(state);
diff --git a/arch/tile/kernel/smpboot.c b/arch/tile/kernel/smpboot.c
index b949edcec200..172aef7d3159 100644
--- a/arch/tile/kernel/smpboot.c
+++ b/arch/tile/kernel/smpboot.c
@@ -196,6 +196,8 @@ void __cpuinit online_secondary(void)
         /* This must be done before setting cpu_online_mask */
         wmb();
 
+        notify_cpu_starting(smp_processor_id());
+
         /*
          * We need to hold call_lock, so there is no inconsistency
          * between the time smp_call_function() determines number of
diff --git a/arch/um/drivers/cow.h b/arch/um/drivers/cow.h
index dc36b222100b..6673508f3426 100644
--- a/arch/um/drivers/cow.h
+++ b/arch/um/drivers/cow.h
@@ -3,41 +3,6 @@
 
 #include <asm/types.h>
 
-#if defined(__KERNEL__)
-
-# include <asm/byteorder.h>
-
-# if defined(__BIG_ENDIAN)
-#       define ntohll(x) (x)
-#       define htonll(x) (x)
-# elif defined(__LITTLE_ENDIAN)
-#       define ntohll(x)  be64_to_cpu(x)
-#       define htonll(x)  cpu_to_be64(x)
-# else
-#       error "Could not determine byte order"
-# endif
-
-#else
-/* For the definition of ntohl, htonl and __BYTE_ORDER */
-#include <endian.h>
-#include <netinet/in.h>
-#if defined(__BYTE_ORDER)
-
-#  if __BYTE_ORDER == __BIG_ENDIAN
-#       define ntohll(x) (x)
-#       define htonll(x) (x)
-#  elif __BYTE_ORDER == __LITTLE_ENDIAN
-#       define ntohll(x)  bswap_64(x)
-#       define htonll(x)  bswap_64(x)
-#  else
-#       error "Could not determine byte order: __BYTE_ORDER uncorrectly defined"
-#  endif
-
-#else  /* ! defined(__BYTE_ORDER) */
-#       error "Could not determine byte order: __BYTE_ORDER not defined"
-#endif
-#endif /* ! defined(__KERNEL__) */
-
 extern int init_cow_file(int fd, char *cow_file, char *backing_file,
                          int sectorsize, int alignment, int *bitmap_offset_out,
                          unsigned long *bitmap_len_out, int *data_offset_out);
diff --git a/arch/um/drivers/cow_user.c b/arch/um/drivers/cow_user.c
index 9cbb426c0b91..0ee9cc6cc4c7 100644
--- a/arch/um/drivers/cow_user.c
+++ b/arch/um/drivers/cow_user.c
@@ -8,11 +8,10 @@
  * that.
  */
 #include <unistd.h>
-#include <byteswap.h>
 #include <errno.h>
 #include <string.h>
 #include <arpa/inet.h>
-#include <asm/types.h>
+#include <endian.h>
 #include "cow.h"
 #include "cow_sys.h"
 
@@ -214,8 +213,8 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
                            "header\n");
                 goto out;
         }
-        header->magic = htonl(COW_MAGIC);
-        header->version = htonl(COW_VERSION);
+        header->magic = htobe32(COW_MAGIC);
+        header->version = htobe32(COW_VERSION);
 
         err = -EINVAL;
         if (strlen(backing_file) > sizeof(header->backing_file) - 1) {
@@ -246,10 +245,10 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
                 goto out_free;
         }
 
-        header->mtime = htonl(modtime);
-        header->size = htonll(*size);
-        header->sectorsize = htonl(sectorsize);
-        header->alignment = htonl(alignment);
+        header->mtime = htobe32(modtime);
+        header->size = htobe64(*size);
+        header->sectorsize = htobe32(sectorsize);
+        header->alignment = htobe32(alignment);
         header->cow_format = COW_BITMAP;
 
         err = cow_write_file(fd, header, sizeof(*header));
@@ -301,8 +300,8 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
         magic = header->v1.magic;
         if (magic == COW_MAGIC)
                 version = header->v1.version;
-        else if (magic == ntohl(COW_MAGIC))
-                version = ntohl(header->v1.version);
+        else if (magic == be32toh(COW_MAGIC))
+                version = be32toh(header->v1.version);
         /* No error printed because the non-COW case comes through here */
         else goto out;
 
@@ -327,9 +326,9 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                                    "header\n");
                         goto out;
                 }
-                *mtime_out = ntohl(header->v2.mtime);
-                *size_out = ntohll(header->v2.size);
-                *sectorsize_out = ntohl(header->v2.sectorsize);
+                *mtime_out = be32toh(header->v2.mtime);
+                *size_out = be64toh(header->v2.size);
+                *sectorsize_out = be32toh(header->v2.sectorsize);
                 *bitmap_offset_out = sizeof(header->v2);
                 *align_out = *sectorsize_out;
                 file = header->v2.backing_file;
@@ -341,10 +340,10 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                                    "header\n");
                         goto out;
                 }
-                *mtime_out = ntohl(header->v3.mtime);
-                *size_out = ntohll(header->v3.size);
-                *sectorsize_out = ntohl(header->v3.sectorsize);
-                *align_out = ntohl(header->v3.alignment);
+                *mtime_out = be32toh(header->v3.mtime);
+                *size_out = be64toh(header->v3.size);
+                *sectorsize_out = be32toh(header->v3.sectorsize);
+                *align_out = be32toh(header->v3.alignment);
                 if (*align_out == 0) {
                         cow_printf("read_cow_header - invalid COW header, "
                                    "align == 0\n");
@@ -366,16 +365,16 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                  * this was used until Dec2005 - 64bits are needed to represent
                  * 2038+. I.e. we can safely do this truncating cast.
                  *
-                 * Additionally, we must use ntohl() instead of ntohll(), since
+                 * Additionally, we must use be32toh() instead of be64toh(), since
                  * the program used to use the former (tested - I got mtime
                  * mismatch "0 vs whatever").
                  *
                  * Ever heard about bug-to-bug-compatibility ? ;-) */
-                *mtime_out = (time32_t) ntohl(header->v3_b.mtime);
+                *mtime_out = (time32_t) be32toh(header->v3_b.mtime);
 
-                *size_out = ntohll(header->v3_b.size);
-                *sectorsize_out = ntohl(header->v3_b.sectorsize);
-                *align_out = ntohl(header->v3_b.alignment);
+                *size_out = be64toh(header->v3_b.size);
+                *sectorsize_out = be32toh(header->v3_b.sectorsize);
+                *align_out = be32toh(header->v3_b.alignment);
                 if (*align_out == 0) {
                         cow_printf("read_cow_header - invalid COW header, "
                                    "align == 0\n");
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index e672bd6d43e3..43b39d61b538 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -22,6 +22,7 @@
 #include <linux/workqueue.h>
 #include <linux/mutex.h>
 #include <asm/uaccess.h>
+#include <asm/switch_to.h>
 
 #include "init.h"
 #include "irq_kern.h"
diff --git a/arch/um/include/asm/Kbuild b/arch/um/include/asm/Kbuild
index 8419f5cf2ac7..fff24352255d 100644
--- a/arch/um/include/asm/Kbuild
+++ b/arch/um/include/asm/Kbuild
@@ -1,3 +1,4 @@
 generic-y += bug.h cputime.h device.h emergency-restart.h futex.h hardirq.h
 generic-y += hw_irq.h irq_regs.h kdebug.h percpu.h sections.h topology.h xor.h
-generic-y += ftrace.h pci.h io.h param.h delay.h mutex.h current.h
+generic-y += ftrace.h pci.h io.h param.h delay.h mutex.h current.h exec.h
+generic-y += switch_to.h
diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
index 492bc4c1b62b..65a1c3d690ea 100644
--- a/arch/um/kernel/Makefile
+++ b/arch/um/kernel/Makefile
@@ -3,9 +3,10 @@
 # Licensed under the GPL
 #
 
-CPPFLAGS_vmlinux.lds := -DSTART=$(LDS_START) \
-                        -DELF_ARCH=$(LDS_ELF_ARCH)        \
-                        -DELF_FORMAT=$(LDS_ELF_FORMAT)
+CPPFLAGS_vmlinux.lds := -DSTART=$(LDS_START)            \
+                        -DELF_ARCH=$(LDS_ELF_ARCH)      \
+                        -DELF_FORMAT=$(LDS_ELF_FORMAT)  \
+                        $(LDS_EXTRA)
 extra-y := vmlinux.lds
 clean-files :=
 
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index f386d04a84a5..2b73dedb44ca 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -88,11 +88,8 @@ static inline void set_current(struct task_struct *task)
 
 extern void arch_switch_to(struct task_struct *to);
 
-void *_switch_to(void *prev, void *next, void *last)
+void *__switch_to(struct task_struct *from, struct task_struct *to)
 {
-        struct task_struct *from = prev;
-        struct task_struct *to = next;
-
         to->thread.prev_sched = from;
         set_current(to);
 
@@ -111,7 +108,6 @@ void *_switch_to(void *prev, void *next, void *last)
         } while (current->thread.saved_task);
 
         return current->thread.prev_sched;
-
 }
 
 void interrupt_end(void)
diff --git a/arch/um/kernel/skas/mmu.c b/arch/um/kernel/skas/mmu.c
index 4947b319f53a..0a49ef0c2bf4 100644
--- a/arch/um/kernel/skas/mmu.c
+++ b/arch/um/kernel/skas/mmu.c
@@ -103,7 +103,6 @@ int init_new_context(struct task_struct *task, struct mm_struct *mm)
 
 void uml_setup_stubs(struct mm_struct *mm)
 {
-        struct page **pages;
         int err, ret;
 
         if (!skas_needs_stub)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 1d14cc6b79ad..c9866b0b77d8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -81,7 +81,7 @@ config X86
         select CLKEVT_I8253
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select GENERIC_IOMAP
-        select DCACHE_WORD_ACCESS if !DEBUG_PAGEALLOC
+        select DCACHE_WORD_ACCESS
 
 config INSTRUCTION_DECODER
         def_bool (KPROBES || PERF_EVENTS)
diff --git a/arch/x86/Makefile.um b/arch/x86/Makefile.um
index 4be406abeefd..36b62bc52638 100644
--- a/arch/x86/Makefile.um
+++ b/arch/x86/Makefile.um
@@ -14,6 +14,9 @@ LINK-y			+= $(call cc-option,-m32)
 
 export LDFLAGS
 
+LDS_EXTRA               := -Ui386
+export LDS_EXTRA
+
 # First of all, tune CFLAGS for the specific CPU. This actually sets cflags-y.
 include $(srctree)/arch/x86/Makefile_32.cpu
 
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index a0559930a180..c85e3ac99bba 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -33,6 +33,9 @@
         __HEAD
 ENTRY(startup_32)
 #ifdef CONFIG_EFI_STUB
+        jmp     preferred_addr
+
+        .balign 0x10
         /*
          * We don't need the return address, so set up the stack so
          * efi_main() can find its arugments.
@@ -41,12 +44,17 @@ ENTRY(startup_32)
 
         call    efi_main
         cmpl    $0, %eax
-        je      preferred_addr
         movl    %eax, %esi
-        call    1f
+        jne     2f
 1:
+        /* EFI init failed, so hang. */
+        hlt
+        jmp     1b
+2:
+        call    3f
+3:
         popl    %eax
-        subl    $1b, %eax
+        subl    $3b, %eax
         subl    BP_pref_address(%esi), %eax
         add     BP_code32_start(%esi), %eax
         leal    preferred_addr(%eax), %eax
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index 558d76ce23bc..87e03a13d8e3 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -200,18 +200,28 @@ ENTRY(startup_64)
          * entire text+data+bss and hopefully all of memory.
          */
 #ifdef CONFIG_EFI_STUB
-        pushq   %rsi
+        /*
+         * The entry point for the PE/COFF executable is 0x210, so only
+         * legacy boot loaders will execute this jmp.
+         */
+        jmp     preferred_addr
+
+        .org 0x210
         mov     %rcx, %rdi
         mov     %rdx, %rsi
         call    efi_main
-        popq    %rsi
-        cmpq    $0,%rax
-        je      preferred_addr
         movq    %rax,%rsi
-        call    1f
+        cmpq    $0,%rax
+        jne     2f
 1:
+        /* EFI init failed, so hang. */
+        hlt
+        jmp     1b
+2:
+        call    3f
+3:
         popq    %rax
-        subq    $1b, %rax
+        subq    $3b, %rax
         subq    BP_pref_address(%rsi), %rax
         add     BP_code32_start(%esi), %eax
         leaq    preferred_addr(%rax), %rax
diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
index d3c0b0277666..fb7117a4ade1 100644
--- a/arch/x86/boot/compressed/relocs.c
+++ b/arch/x86/boot/compressed/relocs.c
@@ -403,13 +403,11 @@ static void print_absolute_symbols(void)
         for (i = 0; i < ehdr.e_shnum; i++) {
                 struct section *sec = &secs[i];
                 char *sym_strtab;
-                Elf32_Sym *sh_symtab;
                 int j;
 
                 if (sec->shdr.sh_type != SHT_SYMTAB) {
                         continue;
                 }
-                sh_symtab = sec->symtab;
                 sym_strtab = sec->link->strtab;
                 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Sym); j++) {
                         Elf32_Sym *sym;
diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index ed549767a231..24443a332083 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -205,8 +205,13 @@ int main(int argc, char ** argv)
         put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
 
 #ifdef CONFIG_X86_32
-        /* Address of entry point */
-        put_unaligned_le32(i, &buf[pe_header + 0x28]);
+        /*
+         * Address of entry point.
+         *
+         * The EFI stub entry point is +16 bytes from the start of
+         * the .text section.
+         */
+        put_unaligned_le32(i + 16, &buf[pe_header + 0x28]);
 
         /* .text size */
         put_unaligned_le32(file_sz, &buf[pe_header + 0xb0]);
@@ -217,9 +222,11 @@ int main(int argc, char ** argv)
         /*
          * Address of entry point. startup_32 is at the beginning and
          * the 64-bit entry point (startup_64) is always 512 bytes
-         * after.
+         * after. The EFI stub entry point is 16 bytes after that, as
+         * the first instruction allows legacy loaders to jump over
+         * the EFI stub initialisation
          */
-        put_unaligned_le32(i + 512, &buf[pe_header + 0x28]);
+        put_unaligned_le32(i + 528, &buf[pe_header + 0x28]);
 
         /* .text size */
         put_unaligned_le32(file_sz, &buf[pe_header + 0xc0]);
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index d511d951a052..07b3a68d2d29 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -119,9 +119,7 @@ static void set_brk(unsigned long start, unsigned long end)
         end = PAGE_ALIGN(end);
         if (end <= start)
                 return;
-        down_write(&current->mm->mmap_sem);
-        do_brk(start, end - start);
-        up_write(&current->mm->mmap_sem);
+        vm_brk(start, end - start);
 }
 
 #ifdef CORE_DUMP
@@ -296,8 +294,7 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 
         /* OK, This is the point of no return */
         set_personality(PER_LINUX);
-        set_thread_flag(TIF_IA32);
-        current->mm->context.ia32_compat = 1;
+        set_personality_ia32(false);
 
         setup_new_exec(bprm);
 
@@ -332,9 +329,7 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                 pos = 32;
                 map_size = ex.a_text+ex.a_data;
 
-                down_write(&current->mm->mmap_sem);
-                error = do_brk(text_addr & PAGE_MASK, map_size);
-                up_write(&current->mm->mmap_sem);
+                error = vm_brk(text_addr & PAGE_MASK, map_size);
 
                 if (error != (text_addr & PAGE_MASK)) {
                         send_sig(SIGKILL, current, 0);
@@ -373,9 +368,7 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                 if (!bprm->file->f_op->mmap || (fd_offset & ~PAGE_MASK) != 0) {
                         loff_t pos = fd_offset;
 
-                        down_write(&current->mm->mmap_sem);
-                        do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
-                        up_write(&current->mm->mmap_sem);
+                        vm_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
                         bprm->file->f_op->read(bprm->file,
                                         (char __user *)N_TXTADDR(ex),
                                         ex.a_text+ex.a_data, &pos);
@@ -385,26 +378,22 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                         goto beyond_if;
                 }
 
-                down_write(&current->mm->mmap_sem);
-                error = do_mmap(bprm->file, N_TXTADDR(ex), ex.a_text,
+                error = vm_mmap(bprm->file, N_TXTADDR(ex), ex.a_text,
                                 PROT_READ | PROT_EXEC,
                                 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE |
                                 MAP_EXECUTABLE | MAP_32BIT,
                                 fd_offset);
-                up_write(&current->mm->mmap_sem);
 
                 if (error != N_TXTADDR(ex)) {
                         send_sig(SIGKILL, current, 0);
                         return error;
                 }
 
-                down_write(&current->mm->mmap_sem);
-                error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
+                error = vm_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
                                 PROT_READ | PROT_WRITE | PROT_EXEC,
                                 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE |
                                 MAP_EXECUTABLE | MAP_32BIT,
                                 fd_offset + ex.a_text);
-                up_write(&current->mm->mmap_sem);
                 if (error != N_DATADDR(ex)) {
                         send_sig(SIGKILL, current, 0);
                         return error;
@@ -476,9 +465,7 @@ static int load_aout_library(struct file *file)
                         error_time = jiffies;
                 }
 #endif
-                down_write(&current->mm->mmap_sem);
-                do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
-                up_write(&current->mm->mmap_sem);
+                vm_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
 
                 file->f_op->read(file, (char __user *)start_addr,
                         ex.a_text + ex.a_data, &pos);
@@ -490,12 +477,10 @@ static int load_aout_library(struct file *file)
                 goto out;
         }
         /* Now use mmap to map the library into memory. */
-        down_write(&current->mm->mmap_sem);
-        error = do_mmap(file, start_addr, ex.a_text + ex.a_data,
+        error = vm_mmap(file, start_addr, ex.a_text + ex.a_data,
                         PROT_READ | PROT_WRITE | PROT_EXEC,
                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_32BIT,
                         N_TXTOFF(ex));
-        up_write(&current->mm->mmap_sem);
         retval = error;
         if (error != start_addr)
                 goto out;
@@ -503,9 +488,7 @@ static int load_aout_library(struct file *file)
         len = PAGE_ALIGN(ex.a_text + ex.a_data);
         bss = ex.a_text + ex.a_data + ex.a_bss;
         if (bss > len) {
-                down_write(&current->mm->mmap_sem);
-                error = do_brk(start_addr + len, bss - len);
-                up_write(&current->mm->mmap_sem);
+                error = vm_brk(start_addr + len, bss - len);
                 retval = error;
                 if (error != start_addr + len)
                         goto out;
diff --git a/arch/x86/include/asm/cmpxchg.h b/arch/x86/include/asm/cmpxchg.h
index b3b733262909..99480e55973d 100644
--- a/arch/x86/include/asm/cmpxchg.h
+++ b/arch/x86/include/asm/cmpxchg.h
@@ -43,7 +43,7 @@ extern void __add_wrong_size(void)
                 switch (sizeof(*(ptr))) {                               \
                 case __X86_CASE_B:                                      \
                         asm volatile (lock #op "b %b0, %1\n"            \
-                                      : "+r" (__ret), "+m" (*(ptr))     \
+                                      : "+q" (__ret), "+m" (*(ptr))     \
                                       : : "memory", "cc");              \
                         break;                                          \
                 case __X86_CASE_W:                                      \
@@ -173,7 +173,7 @@ extern void __add_wrong_size(void)
                 switch (sizeof(*(ptr))) {                               \
                 case __X86_CASE_B:                                      \
                         asm volatile (lock "addb %b1, %0\n"             \
-                                      : "+m" (*(ptr)) : "ri" (inc)      \
+                                      : "+m" (*(ptr)) : "qi" (inc)      \
                                       : "memory", "cc");                \
                         break;                                          \
                 case __X86_CASE_W:                                      \
diff --git a/arch/x86/include/asm/posix_types.h b/arch/x86/include/asm/posix_types.h
index 3427b7798dbc..7ef7c3020e5c 100644
--- a/arch/x86/include/asm/posix_types.h
+++ b/arch/x86/include/asm/posix_types.h
@@ -7,9 +7,9 @@
 #else
 # ifdef __i386__
 #  include "posix_types_32.h"
-# elif defined(__LP64__)
-#  include "posix_types_64.h"
-# else
+# elif defined(__ILP32__)
 #  include "posix_types_x32.h"
+# else
+#  include "posix_types_64.h"
 # endif
 #endif
diff --git a/arch/x86/include/asm/sigcontext.h b/arch/x86/include/asm/sigcontext.h
index 4a085383af27..5ca71c065eef 100644
--- a/arch/x86/include/asm/sigcontext.h
+++ b/arch/x86/include/asm/sigcontext.h
@@ -257,7 +257,7 @@ struct sigcontext {
         __u64 oldmask;
         __u64 cr2;
         struct _fpstate __user *fpstate;        /* zero when no FPU context */
-#ifndef __LP64__
+#ifdef __ILP32__
         __u32 __fpstate_pad;
 #endif
         __u64 reserved1[8];
diff --git a/arch/x86/include/asm/siginfo.h b/arch/x86/include/asm/siginfo.h
index fc1aa5535646..34c47b3341c0 100644
--- a/arch/x86/include/asm/siginfo.h
+++ b/arch/x86/include/asm/siginfo.h
@@ -2,7 +2,13 @@
 #define _ASM_X86_SIGINFO_H
 
 #ifdef __x86_64__
-# define __ARCH_SI_PREAMBLE_SIZE        (4 * sizeof(int))
+# ifdef __ILP32__ /* x32 */
+typedef long long __kernel_si_clock_t __attribute__((aligned(4)));
+#  define __ARCH_SI_CLOCK_T             __kernel_si_clock_t
+#  define __ARCH_SI_ATTRIBUTES          __attribute__((aligned(8)))
+# else /* x86-64 */
+#  define __ARCH_SI_PREAMBLE_SIZE       (4 * sizeof(int))
+# endif
 #endif
 
 #include <asm-generic/siginfo.h>
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 8be5f54d9360..e0544597cfe7 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -557,6 +557,8 @@ struct __large_struct { unsigned long buf[100]; };
 
 extern unsigned long
 copy_from_user_nmi(void *to, const void __user *from, unsigned long n);
+extern __must_check long
+strncpy_from_user(char *dst, const char __user *src, long count);
 
 /*
  * movsl can be slow when source and dest are not both 8-byte aligned
diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
index 566e803cc602..8084bc73b18c 100644
--- a/arch/x86/include/asm/uaccess_32.h
+++ b/arch/x86/include/asm/uaccess_32.h
@@ -213,11 +213,6 @@ static inline unsigned long __must_check copy_from_user(void *to,
         return n;
 }
 
-long __must_check strncpy_from_user(char *dst, const char __user *src,
-                                    long count);
-long __must_check __strncpy_from_user(char *dst,
-                                      const char __user *src, long count);
-
 /**
  * strlen_user: - Get the size of a string in user space.
  * @str: The string to measure.
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 1c66d30971ad..fcd4b6f3ef02 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -208,10 +208,6 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
         }
 }
 
-__must_check long
-strncpy_from_user(char *dst, const char __user *src, long count);
-__must_check long
-__strncpy_from_user(char *dst, const char __user *src, long count);
 __must_check long strnlen_user(const char __user *str, long n);
 __must_check long __strnlen_user(const char __user *str, long n);
 __must_check long strlen_user(const char __user *str);
diff --git a/arch/x86/include/asm/unistd.h b/arch/x86/include/asm/unistd.h
index 37cdc9d99bb1..4437001d8e3d 100644
--- a/arch/x86/include/asm/unistd.h
+++ b/arch/x86/include/asm/unistd.h
@@ -63,10 +63,10 @@
 #else
 # ifdef __i386__
 #  include <asm/unistd_32.h>
-# elif defined(__LP64__)
-#  include <asm/unistd_64.h>
-# else
+# elif defined(__ILP32__)
 #  include <asm/unistd_x32.h>
+# else
+#  include <asm/unistd_64.h>
 # endif
 #endif
 
diff --git a/arch/x86/include/asm/word-at-a-time.h b/arch/x86/include/asm/word-at-a-time.h
index 6fe6767b7124..e58f03b206c3 100644
--- a/arch/x86/include/asm/word-at-a-time.h
+++ b/arch/x86/include/asm/word-at-a-time.h
@@ -43,4 +43,37 @@ static inline unsigned long has_zero(unsigned long a)
         return ((a - REPEAT_BYTE(0x01)) & ~a) & REPEAT_BYTE(0x80);
 }
 
+/*
+ * Load an unaligned word from kernel space.
+ *
+ * In the (very unlikely) case of the word being a page-crosser
+ * and the next page not being mapped, take the exception and
+ * return zeroes in the non-existing part.
+ */
+static inline unsigned long load_unaligned_zeropad(const void *addr)
+{
+        unsigned long ret, dummy;
+
+        asm(
+                "1:\tmov %2,%0\n"
+                "2:\n"
+                ".section .fixup,\"ax\"\n"
+                "3:\t"
+                "lea %2,%1\n\t"
+                "and %3,%1\n\t"
+                "mov (%1),%0\n\t"
+                "leal %2,%%ecx\n\t"
+                "andl %4,%%ecx\n\t"
+                "shll $3,%%ecx\n\t"
+                "shr %%cl,%0\n\t"
+                "jmp 2b\n"
+                ".previous\n"
+                _ASM_EXTABLE(1b, 3b)
+                :"=&r" (ret),"=&c" (dummy)
+                :"m" (*(unsigned long *)addr),
+                 "i" (-sizeof(unsigned long)),
+                 "i" (sizeof(unsigned long)-1));
+        return ret;
+}
+
 #endif /* _ASM_WORD_AT_A_TIME_H */
diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
index baaca8defec8..764b66a4cf89 100644
--- a/arch/x86/include/asm/x86_init.h
+++ b/arch/x86/include/asm/x86_init.h
@@ -195,6 +195,5 @@ extern struct x86_msi_ops x86_msi;
 
 extern void x86_init_noop(void);
 extern void x86_init_uint_noop(unsigned int unused);
-extern void x86_default_fixup_cpu_id(struct cpuinfo_x86 *c, int node);
 
 #endif
diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
index 103b6ab368d3..146a49c763a4 100644
--- a/arch/x86/kernel/acpi/sleep.c
+++ b/arch/x86/kernel/acpi/sleep.c
@@ -24,6 +24,10 @@ unsigned long acpi_realmode_flags;
 static char temp_stack[4096];
 #endif
 
+asmlinkage void acpi_enter_s3(void)
+{
+        acpi_enter_sleep_state(3, wake_sleep_flags);
+}
 /**
  * acpi_suspend_lowlevel - save kernel state
  *
diff --git a/arch/x86/kernel/acpi/sleep.h b/arch/x86/kernel/acpi/sleep.h
index 416d4be13fef..d68677a2a010 100644
--- a/arch/x86/kernel/acpi/sleep.h
+++ b/arch/x86/kernel/acpi/sleep.h
@@ -3,12 +3,16 @@
  */
 
 #include <asm/trampoline.h>
+#include <linux/linkage.h>
 
 extern unsigned long saved_video_mode;
 extern long saved_magic;
 
 extern int wakeup_pmode_return;
 
+extern u8 wake_sleep_flags;
+extern asmlinkage void acpi_enter_s3(void);
+
 extern unsigned long acpi_copy_wakeup_routine(unsigned long);
 extern void wakeup_long64(void);
 
diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
index 13ab720573e3..72610839f03b 100644
--- a/arch/x86/kernel/acpi/wakeup_32.S
+++ b/arch/x86/kernel/acpi/wakeup_32.S
@@ -74,9 +74,7 @@ restore_registers:
 ENTRY(do_suspend_lowlevel)
         call    save_processor_state
         call    save_registers
-        pushl   $3
-        call    acpi_enter_sleep_state
-        addl    $4, %esp
+        call    acpi_enter_s3
 
 #       In case of S3 failure, we'll emerge here.  Jump
 #       to ret_point to recover
diff --git a/arch/x86/kernel/acpi/wakeup_64.S b/arch/x86/kernel/acpi/wakeup_64.S
index 8ea5164cbd04..014d1d28c397 100644
--- a/arch/x86/kernel/acpi/wakeup_64.S
+++ b/arch/x86/kernel/acpi/wakeup_64.S
@@ -71,9 +71,7 @@ ENTRY(do_suspend_lowlevel)
         movq    %rsi, saved_rsi
 
         addq    $8, %rsp
-        movl    $3, %edi
-        xorl    %eax, %eax
-        call    acpi_enter_sleep_state
+        call    acpi_enter_s3
         /* in case something went wrong, restore the machine status and go on */
         jmp     resume_point
 
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 11544d8f1e97..edc24480469f 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1637,9 +1637,11 @@ static int __init apic_verify(void)
         mp_lapic_addr = APIC_DEFAULT_PHYS_BASE;
 
         /* The BIOS may have set up the APIC at some other address */
-        rdmsr(MSR_IA32_APICBASE, l, h);
-        if (l & MSR_IA32_APICBASE_ENABLE)
-                mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
+        if (boot_cpu_data.x86 >= 6) {
+                rdmsr(MSR_IA32_APICBASE, l, h);
+                if (l & MSR_IA32_APICBASE_ENABLE)
+                        mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
+        }
 
         pr_info("Found and enabled local APIC!\n");
         return 0;
@@ -1657,13 +1659,15 @@ int __init apic_force_enable(unsigned long addr)
          * MSR. This can only be done in software for Intel P6 or later
          * and AMD K7 (Model > 1) or later.
          */
-        rdmsr(MSR_IA32_APICBASE, l, h);
-        if (!(l & MSR_IA32_APICBASE_ENABLE)) {
-                pr_info("Local APIC disabled by BIOS -- reenabling.\n");
-                l &= ~MSR_IA32_APICBASE_BASE;
-                l |= MSR_IA32_APICBASE_ENABLE | addr;
-                wrmsr(MSR_IA32_APICBASE, l, h);
-                enabled_via_apicbase = 1;
+        if (boot_cpu_data.x86 >= 6) {
+                rdmsr(MSR_IA32_APICBASE, l, h);
+                if (!(l & MSR_IA32_APICBASE_ENABLE)) {
+                        pr_info("Local APIC disabled by BIOS -- reenabling.\n");
+                        l &= ~MSR_IA32_APICBASE_BASE;
+                        l |= MSR_IA32_APICBASE_ENABLE | addr;
+                        wrmsr(MSR_IA32_APICBASE, l, h);
+                        enabled_via_apicbase = 1;
+                }
         }
         return apic_verify();
 }
@@ -2209,10 +2213,12 @@ static void lapic_resume(void)
                  * FIXME! This will be wrong if we ever support suspend on
                  * SMP! We'll need to do this as part of the CPU restore!
                  */
-                rdmsr(MSR_IA32_APICBASE, l, h);
-                l &= ~MSR_IA32_APICBASE_BASE;
-                l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
-                wrmsr(MSR_IA32_APICBASE, l, h);
+                if (boot_cpu_data.x86 >= 6) {
+                        rdmsr(MSR_IA32_APICBASE, l, h);
+                        l &= ~MSR_IA32_APICBASE_BASE;
+                        l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
+                        wrmsr(MSR_IA32_APICBASE, l, h);
+                }
         }
 
         maxlvt = lapic_get_maxlvt();
diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c
index 899803e03214..23e75422e013 100644
--- a/arch/x86/kernel/apic/apic_numachip.c
+++ b/arch/x86/kernel/apic/apic_numachip.c
@@ -207,8 +207,11 @@ static void __init map_csrs(void)
 
 static void fixup_cpu_id(struct cpuinfo_x86 *c, int node)
 {
-        c->phys_proc_id = node;
-        per_cpu(cpu_llc_id, smp_processor_id()) = node;
+
+        if (c->phys_proc_id != node) {
+                c->phys_proc_id = node;
+                per_cpu(cpu_llc_id, smp_processor_id()) = node;
+        }
 }
 
 static int __init numachip_system_init(void)
diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
index 8a778db45e3a..991e315f4227 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -24,6 +24,12 @@ static int x2apic_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
 {
         if (x2apic_phys)
                 return x2apic_enabled();
+        else if ((acpi_gbl_FADT.header.revision >= FADT2_REVISION_ID) &&
+                (acpi_gbl_FADT.flags & ACPI_FADT_APIC_PHYSICAL) &&
+                x2apic_enabled()) {
+                printk(KERN_DEBUG "System requires x2apic physical mode\n");
+                return 1;
+        }
         else
                 return 0;
 }
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 0a44b90602b0..146bb6218eec 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -26,7 +26,8 @@
  *      contact AMD for precise details and a CPU swap.
  *
  *      See     http://www.multimania.com/poulot/k6bug.html
- *              http://www.amd.com/K6/k6docs/revgd.html
+ *      and     section 2.6.2 of "AMD-K6 Processor Revision Guide - Model 6"
+ *              (Publication # 21266  Issue Date: August 1998)
  *
  *      The following test is erm.. interesting. AMD neglected to up
  *      the chip setting when fixing the bug but they also tweaked some
@@ -94,7 +95,6 @@ static void __cpuinit init_amd_k6(struct cpuinfo_x86 *c)
                                 "system stability may be impaired when more than 32 MB are used.\n");
                 else
                         printk(KERN_CONT "probably OK (after B9730xxxx).\n");
-                printk(KERN_INFO "Please see http://membres.lycos.fr/poulot/k6bug.html\n");
         }
 
         /* K6 with old style WHCR */
@@ -353,10 +353,11 @@ static void __cpuinit srat_detect_node(struct cpuinfo_x86 *c)
                 node = per_cpu(cpu_llc_id, cpu);
 
         /*
-         * If core numbers are inconsistent, it's likely a multi-fabric platform,
-         * so invoke platform-specific handler
+         * On multi-fabric platform (e.g. Numascale NumaChip) a
+         * platform-specific handler needs to be called to fixup some
+         * IDs of the CPU.
          */
-        if (c->phys_proc_id != node)
+        if (x86_cpuinit.fixup_cpu_id)
                 x86_cpuinit.fixup_cpu_id(c, node);
 
         if (!node_online(node)) {
@@ -579,6 +580,24 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
                 }
         }
 
+        /* re-enable TopologyExtensions if switched off by BIOS */
+        if ((c->x86 == 0x15) &&
+            (c->x86_model >= 0x10) && (c->x86_model <= 0x1f) &&
+            !cpu_has(c, X86_FEATURE_TOPOEXT)) {
+                u64 val;
+
+                if (!rdmsrl_amd_safe(0xc0011005, &val)) {
+                        val |= 1ULL << 54;
+                        wrmsrl_amd_safe(0xc0011005, val);
+                        rdmsrl(0xc0011005, val);
+                        if (val & (1ULL << 54)) {
+                                set_cpu_cap(c, X86_FEATURE_TOPOEXT);
+                                printk(KERN_INFO FW_INFO "CPU: Re-enabling "
+                                  "disabled Topology Extensions Support\n");
+                        }
+                }
+        }
+
         cpu_detect_cache_sizes(c);
 
         /* Multi core CPU? */
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 67e258362a3d..cf79302198a6 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1163,15 +1163,6 @@ static void dbg_restore_debug_regs(void)
 #endif /* ! CONFIG_KGDB */
 
 /*
- * Prints an error where the NUMA and configured core-number mismatch and the
- * platform didn't override this to fix it up
- */
-void __cpuinit x86_default_fixup_cpu_id(struct cpuinfo_x86 *c, int node)
-{
-        pr_err("NUMA core number %d differs from configured core number %d\n", node, c->phys_proc_id);
-}
-
-/*
  * cpu_init() initializes state that is per-CPU. Some data is already
  * initialized (naturally) in the bootstrap process, such as the GDT
  * and IDT. We reload them nevertheless, this function acts as a
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index 73d08ed98a64..b8f3653dddbc 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -433,14 +433,14 @@ int amd_set_l3_disable_slot(struct amd_northbridge *nb, int cpu, unsigned slot,
         /*  check if @slot is already used or the index is already disabled */
         ret = amd_get_l3_disable_slot(nb, slot);
         if (ret >= 0)
-                return -EINVAL;
+                return -EEXIST;
 
         if (index > nb->l3_cache.indices)
                 return -EINVAL;
 
         /* check whether the other slot has disabled the same index already */
         if (index == amd_get_l3_disable_slot(nb, !slot))
-                return -EINVAL;
+                return -EEXIST;
 
         amd_l3_disable_index(nb, cpu, slot, index);
 
@@ -468,8 +468,8 @@ static ssize_t store_cache_disable(struct _cpuid4_info *this_leaf,
         err = amd_set_l3_disable_slot(this_leaf->base.nb, cpu, slot, val);
         if (err) {
                 if (err == -EEXIST)
-                        printk(KERN_WARNING "L3 disable slot %d in use!\n",
-                                            slot);
+                        pr_warning("L3 slot %d in use/index already disabled!\n",
+                                   slot);
                 return err;
         }
         return count;
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index 7734bcbb5a3a..2d6e6498c176 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -235,6 +235,7 @@ int init_fpu(struct task_struct *tsk)
         if (tsk_used_math(tsk)) {
                 if (HAVE_HWFP && tsk == current)
                         unlazy_fpu(tsk);
+                tsk->thread.fpu.last_cpu = ~0;
                 return 0;
         }
 
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 73465aab28f8..8a2ce8fd41c0 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -82,11 +82,6 @@ static int collect_cpu_info_amd(int cpu, struct cpu_signature *csig)
 {
         struct cpuinfo_x86 *c = &cpu_data(cpu);
 
-        if (c->x86_vendor != X86_VENDOR_AMD || c->x86 < 0x10) {
-                pr_warning("CPU%d: family %d not supported\n", cpu, c->x86);
-                return -1;
-        }
-
         csig->rev = c->microcode;
         pr_info("CPU%d: patch_level=0x%08x\n", cpu, csig->rev);
 
@@ -380,6 +375,13 @@ static struct microcode_ops microcode_amd_ops = {
 
 struct microcode_ops * __init init_amd_microcode(void)
 {
+        struct cpuinfo_x86 *c = &cpu_data(0);
+
+        if (c->x86_vendor != X86_VENDOR_AMD || c->x86 < 0x10) {
+                pr_warning("AMD CPU family 0x%x not supported\n", c->x86);
+                return NULL;
+        }
+
         patch = (void *)get_zeroed_page(GFP_KERNEL);
         if (!patch)
                 return NULL;
diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
index 87a0f8688301..c9bda6d6035c 100644
--- a/arch/x86/kernel/microcode_core.c
+++ b/arch/x86/kernel/microcode_core.c
@@ -419,10 +419,8 @@ static int mc_device_add(struct device *dev, struct subsys_interface *sif)
         if (err)
                 return err;
 
-        if (microcode_init_cpu(cpu) == UCODE_ERROR) {
-                sysfs_remove_group(&dev->kobj, &mc_attr_group);
+        if (microcode_init_cpu(cpu) == UCODE_ERROR)
                 return -EINVAL;
-        }
 
         return err;
 }
@@ -528,11 +526,11 @@ static int __init microcode_init(void)
                 microcode_ops = init_intel_microcode();
         else if (c->x86_vendor == X86_VENDOR_AMD)
                 microcode_ops = init_amd_microcode();
-
-        if (!microcode_ops) {
+        else
                 pr_err("no support for this CPU vendor\n");
+
+        if (!microcode_ops)
                 return -ENODEV;
-        }
 
         microcode_pdev = platform_device_register_simple("microcode", -1,
                                                          NULL, 0);
diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
index f386dc49f988..7515cf0e1805 100644
--- a/arch/x86/kernel/vsyscall_64.c
+++ b/arch/x86/kernel/vsyscall_64.c
@@ -216,9 +216,9 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
         current_thread_info()->sig_on_uaccess_error = 1;
 
         /*
-         * 0 is a valid user pointer (in the access_ok sense) on 32-bit and
+         * NULL is a valid user pointer (in the access_ok sense) on 32-bit and
          * 64-bit, so we don't need to special-case it here.  For all the
-         * vsyscalls, 0 means "don't write anything" not "write it at
+         * vsyscalls, NULL means "don't write anything" not "write it at
          * address 0".
          */
         ret = -EFAULT;
@@ -247,7 +247,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
 
                 ret = sys_getcpu((unsigned __user *)regs->di,
                                  (unsigned __user *)regs->si,
-                                 0);
+                                 NULL);
                 break;
         }
 
diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c
index e9f265fd79ae..9cf71d0b2d37 100644
--- a/arch/x86/kernel/x86_init.c
+++ b/arch/x86/kernel/x86_init.c
@@ -93,7 +93,6 @@ struct x86_init_ops x86_init __initdata = {
 struct x86_cpuinit_ops x86_cpuinit __cpuinitdata = {
         .early_percpu_clock_init        = x86_init_noop,
         .setup_percpu_clockev           = setup_secondary_APIC_clock,
-        .fixup_cpu_id                   = x86_default_fixup_cpu_id,
 };
 
 static void default_nmi_init(void) { };
diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
index 173df38dbda5..2e88438ffd83 100644
--- a/arch/x86/kvm/pmu.c
+++ b/arch/x86/kvm/pmu.c
@@ -459,17 +459,17 @@ void kvm_pmu_cpuid_update(struct kvm_vcpu *vcpu)
         pmu->available_event_types = ~entry->ebx & ((1ull << bitmap_len) - 1);
 
         if (pmu->version == 1) {
-                pmu->global_ctrl = (1 << pmu->nr_arch_gp_counters) - 1;
-                return;
+                pmu->nr_arch_fixed_counters = 0;
+        } else {
+                pmu->nr_arch_fixed_counters = min((int)(entry->edx & 0x1f),
+                                X86_PMC_MAX_FIXED);
+                pmu->counter_bitmask[KVM_PMC_FIXED] =
+                        ((u64)1 << ((entry->edx >> 5) & 0xff)) - 1;
         }
 
-        pmu->nr_arch_fixed_counters = min((int)(entry->edx & 0x1f),
-                        X86_PMC_MAX_FIXED);
-        pmu->counter_bitmask[KVM_PMC_FIXED] =
-                ((u64)1 << ((entry->edx >> 5) & 0xff)) - 1;
-        pmu->global_ctrl_mask = ~(((1 << pmu->nr_arch_gp_counters) - 1)
-                        | (((1ull << pmu->nr_arch_fixed_counters) - 1)
-                                << X86_PMC_IDX_FIXED));
+        pmu->global_ctrl = ((1 << pmu->nr_arch_gp_counters) - 1) |
+                (((1ull << pmu->nr_arch_fixed_counters) - 1) << X86_PMC_IDX_FIXED);
+        pmu->global_ctrl_mask = ~pmu->global_ctrl;
 }
 
 void kvm_pmu_init(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index ad85adfef843..4ff0ab9bc3c8 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2210,9 +2210,12 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
                 msr = find_msr_entry(vmx, msr_index);
                 if (msr) {
                         msr->data = data;
-                        if (msr - vmx->guest_msrs < vmx->save_nmsrs)
+                        if (msr - vmx->guest_msrs < vmx->save_nmsrs) {
+                                preempt_disable();
                                 kvm_set_shared_msr(msr->index, msr->data,
                                                    msr->mask);
+                                preempt_enable();
+                        }
                         break;
                 }
                 ret = kvm_set_msr_common(vcpu, msr_index, data);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 4044ce0bf7c1..91a5e989abcf 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6336,13 +6336,11 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
                 if (npages && !old.rmap) {
                         unsigned long userspace_addr;
 
-                        down_write(&current->mm->mmap_sem);
-                        userspace_addr = do_mmap(NULL, 0,
+                        userspace_addr = vm_mmap(NULL, 0,
                                                  npages * PAGE_SIZE,
                                                  PROT_READ | PROT_WRITE,
                                                  map_flags,
                                                  0);
-                        up_write(&current->mm->mmap_sem);
 
                         if (IS_ERR((void *)userspace_addr))
                                 return PTR_ERR((void *)userspace_addr);
@@ -6366,10 +6364,8 @@ void kvm_arch_commit_memory_region(struct kvm *kvm,
         if (!user_alloc && !old.user_alloc && old.rmap && !npages) {
                 int ret;
 
-                down_write(&current->mm->mmap_sem);
-                ret = do_munmap(current->mm, old.userspace_addr,
+                ret = vm_munmap(old.userspace_addr,
                                 old.npages * PAGE_SIZE);
-                up_write(&current->mm->mmap_sem);
                 if (ret < 0)
                         printk(KERN_WARNING
                                "kvm_vm_ioctl_set_memory_region: "
diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
index 25feb1ae71c5..b1e6c4b2e8eb 100644
--- a/arch/x86/lib/insn.c
+++ b/arch/x86/lib/insn.c
@@ -379,8 +379,8 @@ err_out:
         return;
 }
 
-/* Decode moffset16/32/64 */
-static void __get_moffset(struct insn *insn)
+/* Decode moffset16/32/64. Return 0 if failed */
+static int __get_moffset(struct insn *insn)
 {
         switch (insn->addr_bytes) {
         case 2:
@@ -397,15 +397,19 @@ static void __get_moffset(struct insn *insn)
                 insn->moffset2.value = get_next(int, insn);
                 insn->moffset2.nbytes = 4;
                 break;
+        default:        /* opnd_bytes must be modified manually */
+                goto err_out;
         }
         insn->moffset1.got = insn->moffset2.got = 1;
 
+        return 1;
+
 err_out:
-        return;
+        return 0;
 }
 
-/* Decode imm v32(Iz) */
-static void __get_immv32(struct insn *insn)
+/* Decode imm v32(Iz). Return 0 if failed */
+static int __get_immv32(struct insn *insn)
 {
         switch (insn->opnd_bytes) {
         case 2:
@@ -417,14 +421,18 @@ static void __get_immv32(struct insn *insn)
                 insn->immediate.value = get_next(int, insn);
                 insn->immediate.nbytes = 4;
                 break;
+        default:        /* opnd_bytes must be modified manually */
+                goto err_out;
         }
 
+        return 1;
+
 err_out:
-        return;
+        return 0;
 }
 
-/* Decode imm v64(Iv/Ov) */
-static void __get_immv(struct insn *insn)
+/* Decode imm v64(Iv/Ov), Return 0 if failed */
+static int __get_immv(struct insn *insn)
 {
         switch (insn->opnd_bytes) {
         case 2:
@@ -441,15 +449,18 @@ static void __get_immv(struct insn *insn)
                 insn->immediate2.value = get_next(int, insn);
                 insn->immediate2.nbytes = 4;
                 break;
+        default:        /* opnd_bytes must be modified manually */
+                goto err_out;
         }
         insn->immediate1.got = insn->immediate2.got = 1;
 
+        return 1;
 err_out:
-        return;
+        return 0;
 }
 
 /* Decode ptr16:16/32(Ap) */
-static void __get_immptr(struct insn *insn)
+static int __get_immptr(struct insn *insn)
 {
         switch (insn->opnd_bytes) {
         case 2:
@@ -462,14 +473,17 @@ static void __get_immptr(struct insn *insn)
                 break;
         case 8:
                 /* ptr16:64 is not exist (no segment) */
-                return;
+                return 0;
+        default:        /* opnd_bytes must be modified manually */
+                goto err_out;
         }
         insn->immediate2.value = get_next(unsigned short, insn);
         insn->immediate2.nbytes = 2;
         insn->immediate1.got = insn->immediate2.got = 1;
 
+        return 1;
 err_out:
-        return;
+        return 0;
 }
 
 /**
@@ -489,7 +503,8 @@ void insn_get_immediate(struct insn *insn)
                 insn_get_displacement(insn);
 
         if (inat_has_moffset(insn->attr)) {
-                __get_moffset(insn);
+                if (!__get_moffset(insn))
+                        goto err_out;
                 goto done;
         }
 
@@ -517,16 +532,20 @@ void insn_get_immediate(struct insn *insn)
                 insn->immediate2.nbytes = 4;
                 break;
         case INAT_IMM_PTR:
-                __get_immptr(insn);
+                if (!__get_immptr(insn))
+                        goto err_out;
                 break;
         case INAT_IMM_VWORD32:
-                __get_immv32(insn);
+                if (!__get_immv32(insn))
+                        goto err_out;
                 break;
         case INAT_IMM_VWORD:
-                __get_immv(insn);
+                if (!__get_immv(insn))
+                        goto err_out;
                 break;
         default:
-                break;
+                /* Here, insn must have an immediate, but failed */
+                goto err_out;
         }
         if (inat_has_second_immediate(insn->attr)) {
                 insn->immediate2.value = get_next(char, insn);
diff --git a/arch/x86/lib/usercopy.c b/arch/x86/lib/usercopy.c
index 97be9cb54483..d6ae30bbd7bb 100644
--- a/arch/x86/lib/usercopy.c
+++ b/arch/x86/lib/usercopy.c
@@ -7,6 +7,8 @@
 #include <linux/highmem.h>
 #include <linux/module.h>
 
+#include <asm/word-at-a-time.h>
+
 /*
  * best effort, GUP based copy_from_user() that is NMI-safe
  */
@@ -41,3 +43,104 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
         return len;
 }
 EXPORT_SYMBOL_GPL(copy_from_user_nmi);
+
+static inline unsigned long count_bytes(unsigned long mask)
+{
+        mask = (mask - 1) & ~mask;
+        mask >>= 7;
+        return count_masked_bytes(mask);
+}
+
+/*
+ * Do a strncpy, return length of string without final '\0'.
+ * 'count' is the user-supplied count (return 'count' if we
+ * hit it), 'max' is the address space maximum (and we return
+ * -EFAULT if we hit it).
+ */
+static inline long do_strncpy_from_user(char *dst, const char __user *src, long count, unsigned long max)
+{
+        long res = 0;
+
+        /*
+         * Truncate 'max' to the user-specified limit, so that
+         * we only have one limit we need to check in the loop
+         */
+        if (max > count)
+                max = count;
+
+        while (max >= sizeof(unsigned long)) {
+                unsigned long c;
+
+                /* Fall back to byte-at-a-time if we get a page fault */
+                if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
+                        break;
+                /* This can write a few bytes past the NUL character, but that's ok */
+                *(unsigned long *)(dst+res) = c;
+                c = has_zero(c);
+                if (c)
+                        return res + count_bytes(c);
+                res += sizeof(unsigned long);
+                max -= sizeof(unsigned long);
+        }
+
+        while (max) {
+                char c;
+
+                if (unlikely(__get_user(c,src+res)))
+                        return -EFAULT;
+                dst[res] = c;
+                if (!c)
+                        return res;
+                res++;
+                max--;
+        }
+
+        /*
+         * Uhhuh. We hit 'max'. But was that the user-specified maximum
+         * too? If so, that's ok - we got as much as the user asked for.
+         */
+        if (res >= count)
+                return res;
+
+        /*
+         * Nope: we hit the address space limit, and we still had more
+         * characters the caller would have wanted. That's an EFAULT.
+         */
+        return -EFAULT;
+}
+
+/**
+ * strncpy_from_user: - Copy a NUL terminated string from userspace.
+ * @dst:   Destination address, in kernel space.  This buffer must be at
+ *         least @count bytes long.
+ * @src:   Source address, in user space.
+ * @count: Maximum number of bytes to copy, including the trailing NUL.
+ *
+ * Copies a NUL-terminated string from userspace to kernel space.
+ *
+ * On success, returns the length of the string (not including the trailing
+ * NUL).
+ *
+ * If access to userspace fails, returns -EFAULT (some data may have been
+ * copied).
+ *
+ * If @count is smaller than the length of the string, copies @count bytes
+ * and returns @count.
+ */
+long
+strncpy_from_user(char *dst, const char __user *src, long count)
+{
+        unsigned long max_addr, src_addr;
+
+        if (unlikely(count <= 0))
+                return 0;
+
+        max_addr = current_thread_info()->addr_limit.seg;
+        src_addr = (unsigned long)src;
+        if (likely(src_addr < max_addr)) {
+                unsigned long max = max_addr - src_addr;
+                return do_strncpy_from_user(dst, src, count, max);
+        }
+        return -EFAULT;
+}
+EXPORT_SYMBOL(strncpy_from_user);
diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
index d9b094ca7aaa..ef2a6a5d78e3 100644
--- a/arch/x86/lib/usercopy_32.c
+++ b/arch/x86/lib/usercopy_32.c
@@ -33,93 +33,6 @@ static inline int __movsl_is_ok(unsigned long a1, unsigned long a2, unsigned lon
         __movsl_is_ok((unsigned long)(a1), (unsigned long)(a2), (n))
 
 /*
- * Copy a null terminated string from userspace.
- */
-
-#define __do_strncpy_from_user(dst, src, count, res)                       \
-do {                                                                       \
-        int __d0, __d1, __d2;                                              \
-        might_fault();                                                     \
-        __asm__ __volatile__(                                              \
-                "       testl %1,%1\n"                                     \
-                "       jz 2f\n"                                           \
-                "0:     lodsb\n"                                           \
-                "       stosb\n"                                           \
-                "       testb %%al,%%al\n"                                 \
-                "       jz 1f\n"                                           \
-                "       decl %1\n"                                         \
-                "       jnz 0b\n"                                          \
-                "1:     subl %1,%0\n"                                      \
-                "2:\n"                                                     \
-                ".section .fixup,\"ax\"\n"                                 \
-                "3:     movl %5,%0\n"                                      \
-                "       jmp 2b\n"                                          \
-                ".previous\n"                                              \
-                _ASM_EXTABLE(0b,3b)                                        \
-                : "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),    \
-                  "=&D" (__d2)                                             \
-                : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
-                : "memory");                                               \
-} while (0)
-
-/**
- * __strncpy_from_user: - Copy a NUL terminated string from userspace, with less checking.
- * @dst:   Destination address, in kernel space.  This buffer must be at
- *         least @count bytes long.
- * @src:   Source address, in user space.
- * @count: Maximum number of bytes to copy, including the trailing NUL.
- *
- * Copies a NUL-terminated string from userspace to kernel space.
- * Caller must check the specified block with access_ok() before calling
- * this function.
- *
- * On success, returns the length of the string (not including the trailing
- * NUL).
- *
- * If access to userspace fails, returns -EFAULT (some data may have been
- * copied).
- *
- * If @count is smaller than the length of the string, copies @count bytes
- * and returns @count.
- */
-long
-__strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res;
-        __do_strncpy_from_user(dst, src, count, res);
-        return res;
-}
-EXPORT_SYMBOL(__strncpy_from_user);
-
-/**
- * strncpy_from_user: - Copy a NUL terminated string from userspace.
- * @dst:   Destination address, in kernel space.  This buffer must be at
- *         least @count bytes long.
- * @src:   Source address, in user space.
- * @count: Maximum number of bytes to copy, including the trailing NUL.
- *
- * Copies a NUL-terminated string from userspace to kernel space.
- *
- * On success, returns the length of the string (not including the trailing
- * NUL).
- *
- * If access to userspace fails, returns -EFAULT (some data may have been
- * copied).
- *
- * If @count is smaller than the length of the string, copies @count bytes
- * and returns @count.
- */
-long
-strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res = -EFAULT;
-        if (access_ok(VERIFY_READ, src, 1))
-                __do_strncpy_from_user(dst, src, count, res);
-        return res;
-}
-EXPORT_SYMBOL(strncpy_from_user);
-
-/*
  * Zero Userspace
  */
 
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
index b7c2849ffb66..0d0326f388c0 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -9,55 +9,6 @@
 #include <asm/uaccess.h>
 
 /*
- * Copy a null terminated string from userspace.
- */
-
-#define __do_strncpy_from_user(dst,src,count,res)                          \
-do {                                                                       \
-        long __d0, __d1, __d2;                                             \
-        might_fault();                                                     \
-        __asm__ __volatile__(                                              \
-                "       testq %1,%1\n"                                     \
-                "       jz 2f\n"                                           \
-                "0:     lodsb\n"                                           \
-                "       stosb\n"                                           \
-                "       testb %%al,%%al\n"                                 \
-                "       jz 1f\n"                                           \
-                "       decq %1\n"                                         \
-                "       jnz 0b\n"                                          \
-                "1:     subq %1,%0\n"                                      \
-                "2:\n"                                                     \
-                ".section .fixup,\"ax\"\n"                                 \
-                "3:     movq %5,%0\n"                                      \
-                "       jmp 2b\n"                                          \
-                ".previous\n"                                              \
-                _ASM_EXTABLE(0b,3b)                                        \
-                : "=&r"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),    \
-                  "=&D" (__d2)                                             \
-                : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
-                : "memory");                                               \
-} while (0)
-
-long
-__strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res;
-        __do_strncpy_from_user(dst, src, count, res);
-        return res;
-}
-EXPORT_SYMBOL(__strncpy_from_user);
-
-long
-strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res = -EFAULT;
-        if (access_ok(VERIFY_READ, src, 1))
-                return __strncpy_from_user(dst, src, count);
-        return res;
-}
-EXPORT_SYMBOL(strncpy_from_user);
-
-/*
  * Zero Userspace
  */
 
diff --git a/arch/x86/platform/geode/net5501.c b/arch/x86/platform/geode/net5501.c
index 66d377e334f7..646e3b5b4bb6 100644
--- a/arch/x86/platform/geode/net5501.c
+++ b/arch/x86/platform/geode/net5501.c
@@ -63,7 +63,7 @@ static struct gpio_led net5501_leds[] = {
                 .name = "net5501:1",
                 .gpio = 6,
                 .default_trigger = "default-on",
-                .active_low = 1,
+                .active_low = 0,
         },
 };
 
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index e0a37233c0af..e31bcd8f2eee 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -805,7 +805,7 @@ void intel_scu_devices_create(void)
                 } else
                         i2c_register_board_info(i2c_bus[i], i2c_devs[i], 1);
         }
-        intel_scu_notifier_post(SCU_AVAILABLE, 0L);
+        intel_scu_notifier_post(SCU_AVAILABLE, NULL);
 }
 EXPORT_SYMBOL_GPL(intel_scu_devices_create);
 
@@ -814,7 +814,7 @@ void intel_scu_devices_destroy(void)
 {
         int i;
 
-        intel_scu_notifier_post(SCU_DOWN, 0L);
+        intel_scu_notifier_post(SCU_DOWN, NULL);
 
         for (i = 0; i < ipc_next_dev; i++)
                 platform_device_del(ipc_devs[i]);
diff --git a/arch/x86/um/asm/barrier.h b/arch/x86/um/asm/barrier.h
new file mode 100644
index 000000000000..7d01b8c56c00
--- /dev/null
+++ b/arch/x86/um/asm/barrier.h
@@ -0,0 +1,75 @@
+#ifndef _ASM_UM_BARRIER_H_
+#define _ASM_UM_BARRIER_H_
+
+#include <asm/asm.h>
+#include <asm/segment.h>
+#include <asm/cpufeature.h>
+#include <asm/cmpxchg.h>
+#include <asm/nops.h>
+
+#include <linux/kernel.h>
+#include <linux/irqflags.h>
+
+/*
+ * Force strict CPU ordering.
+ * And yes, this is required on UP too when we're talking
+ * to devices.
+ */
+#ifdef CONFIG_X86_32
+
+#define mb()    alternative("lock; addl $0,0(%%esp)", "mfence", X86_FEATURE_XMM2)
+#define rmb()   alternative("lock; addl $0,0(%%esp)", "lfence", X86_FEATURE_XMM2)
+#define wmb()   alternative("lock; addl $0,0(%%esp)", "sfence", X86_FEATURE_XMM)
+
+#else /* CONFIG_X86_32 */
+
+#define mb()    asm volatile("mfence" : : : "memory")
+#define rmb()   asm volatile("lfence" : : : "memory")
+#define wmb()   asm volatile("sfence" : : : "memory")
+
+#endif /* CONFIG_X86_32 */
+
+#define read_barrier_depends()  do { } while (0)
+
+#ifdef CONFIG_SMP
+
+#define smp_mb()        mb()
+#ifdef CONFIG_X86_PPRO_FENCE
+#define smp_rmb()       rmb()
+#else /* CONFIG_X86_PPRO_FENCE */
+#define smp_rmb()       barrier()
+#endif /* CONFIG_X86_PPRO_FENCE */
+
+#ifdef CONFIG_X86_OOSTORE
+#define smp_wmb()       wmb()
+#else /* CONFIG_X86_OOSTORE */
+#define smp_wmb()       barrier()
+#endif /* CONFIG_X86_OOSTORE */
+
+#define smp_read_barrier_depends()      read_barrier_depends()
+#define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
+
+#else /* CONFIG_SMP */
+
+#define smp_mb()        barrier()
+#define smp_rmb()       barrier()
+#define smp_wmb()       barrier()
+#define smp_read_barrier_depends()      do { } while (0)
+#define set_mb(var, value) do { var = value; barrier(); } while (0)
+
+#endif /* CONFIG_SMP */
+
+/*
+ * Stop RDTSC speculation. This is needed when you need to use RDTSC
+ * (or get_cycles or vread that possibly accesses the TSC) in a defined
+ * code region.
+ *
+ * (Could use an alternative three way for this if there was one.)
+ */
+static inline void rdtsc_barrier(void)
+{
+        alternative(ASM_NOP3, "mfence", X86_FEATURE_MFENCE_RDTSC);
+        alternative(ASM_NOP3, "lfence", X86_FEATURE_LFENCE_RDTSC);
+}
+
+#endif
diff --git a/arch/x86/um/asm/system.h b/arch/x86/um/asm/system.h
deleted file mode 100644
index a459fd9b7598..000000000000
--- a/arch/x86/um/asm/system.h
+++ /dev/null
@@ -1,135 +0,0 @@
-#ifndef _ASM_X86_SYSTEM_H_
-#define _ASM_X86_SYSTEM_H_
-
-#include <asm/asm.h>
-#include <asm/segment.h>
-#include <asm/cpufeature.h>
-#include <asm/cmpxchg.h>
-#include <asm/nops.h>
-
-#include <linux/kernel.h>
-#include <linux/irqflags.h>
-
-/* entries in ARCH_DLINFO: */
-#ifdef CONFIG_IA32_EMULATION
-# define AT_VECTOR_SIZE_ARCH 2
-#else
-# define AT_VECTOR_SIZE_ARCH 1
-#endif
-
-extern unsigned long arch_align_stack(unsigned long sp);
-
-void default_idle(void);
-
-/*
- * Force strict CPU ordering.
- * And yes, this is required on UP too when we're talking
- * to devices.
- */
-#ifdef CONFIG_X86_32
-/*
- * Some non-Intel clones support out of order store. wmb() ceases to be a
- * nop for these.
- */
-#define mb() alternative("lock; addl $0,0(%%esp)", "mfence", X86_FEATURE_XMM2)
-#define rmb() alternative("lock; addl $0,0(%%esp)", "lfence", X86_FEATURE_XMM2)
-#define wmb() alternative("lock; addl $0,0(%%esp)", "sfence", X86_FEATURE_XMM)
-#else
-#define mb()    asm volatile("mfence":::"memory")
-#define rmb()   asm volatile("lfence":::"memory")
-#define wmb()   asm volatile("sfence" ::: "memory")
-#endif
-
-/**
- * read_barrier_depends - Flush all pending reads that subsequents reads
- * depend on.
- *
- * No data-dependent reads from memory-like regions are ever reordered
- * over this barrier.  All reads preceding this primitive are guaranteed
- * to access memory (but not necessarily other CPUs' caches) before any
- * reads following this primitive that depend on the data return by
- * any of the preceding reads.  This primitive is much lighter weight than
- * rmb() on most CPUs, and is never heavier weight than is
- * rmb().
- *
- * These ordering constraints are respected by both the local CPU
- * and the compiler.
- *
- * Ordering is not guaranteed by anything other than these primitives,
- * not even by data dependencies.  See the documentation for
- * memory_barrier() for examples and URLs to more information.
- *
- * For example, the following code would force ordering (the initial
- * value of "a" is zero, "b" is one, and "p" is "&a"):
- *
- * <programlisting>
- *      CPU 0                           CPU 1
- *
- *      b = 2;
- *      memory_barrier();
- *      p = &b;                         q = p;
- *                                      read_barrier_depends();
- *                                      d = *q;
- * </programlisting>
- *
- * because the read of "*q" depends on the read of "p" and these
- * two reads are separated by a read_barrier_depends().  However,
- * the following code, with the same initial values for "a" and "b":
- *
- * <programlisting>
- *      CPU 0                           CPU 1
- *
- *      a = 2;
- *      memory_barrier();
- *      b = 3;                          y = b;
- *                                      read_barrier_depends();
- *                                      x = a;
- * </programlisting>
- *
- * does not enforce ordering, since there is no data dependency between
- * the read of "a" and the read of "b".  Therefore, on some CPUs, such
- * as Alpha, "y" could be set to 3 and "x" to 0.  Use rmb()
- * in cases like this where there are no data dependencies.
- **/
-
-#define read_barrier_depends()  do { } while (0)
-
-#ifdef CONFIG_SMP
-#define smp_mb()        mb()
-#ifdef CONFIG_X86_PPRO_FENCE
-# define smp_rmb()      rmb()
-#else
-# define smp_rmb()      barrier()
-#endif
-#ifdef CONFIG_X86_OOSTORE
-# define smp_wmb()      wmb()
-#else
-# define smp_wmb()      barrier()
-#endif
-#define smp_read_barrier_depends()      read_barrier_depends()
-#define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
-#else
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()      do { } while (0)
-#define set_mb(var, value) do { var = value; barrier(); } while (0)
-#endif
-
-/*
- * Stop RDTSC speculation. This is needed when you need to use RDTSC
- * (or get_cycles or vread that possibly accesses the TSC) in a defined
- * code region.
- *
- * (Could use an alternative three way for this if there was one.)
- */
-static inline void rdtsc_barrier(void)
-{
-        alternative(ASM_NOP3, "mfence", X86_FEATURE_MFENCE_RDTSC);
-        alternative(ASM_NOP3, "lfence", X86_FEATURE_LFENCE_RDTSC);
-}
-
-extern void *_switch_to(void *prev, void *next, void *last);
-#define switch_to(prev, next, last) prev = _switch_to(prev, next, last)
-
-#endif
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 4f51bebac02c..a8f8844b8d32 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -261,7 +261,8 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
 
 static bool __init xen_check_mwait(void)
 {
-#ifdef CONFIG_ACPI
+#if defined(CONFIG_ACPI) && !defined(CONFIG_ACPI_PROCESSOR_AGGREGATOR) && \
+        !defined(CONFIG_ACPI_PROCESSOR_AGGREGATOR_MODULE)
         struct xen_platform_op op = {
                 .cmd                    = XENPF_set_processor_pminfo,
                 .u.set_pminfo.id        = -1,
@@ -349,7 +350,6 @@ static void __init xen_init_cpuid_mask(void)
         /* Xen will set CR4.OSXSAVE if supported and not disabled by force */
         if ((cx & xsave_mask) != xsave_mask)
                 cpuid_leaf1_ecx_mask &= ~xsave_mask; /* disable XSAVE & OSXSAVE */
-
         if (xen_check_mwait())
                 cpuid_leaf1_ecx_set_mask = (1 << (X86_FEATURE_MWAIT % 32));
 }
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 5fac6919b957..0503c0c493a9 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -178,6 +178,7 @@ static void __init xen_fill_possible_map(void)
 static void __init xen_filter_cpu_maps(void)
 {
         int i, rc;
+        unsigned int subtract = 0;
 
         if (!xen_initial_domain())
                 return;
@@ -192,8 +193,22 @@ static void __init xen_filter_cpu_maps(void)
                 } else {
                         set_cpu_possible(i, false);
                         set_cpu_present(i, false);
+                        subtract++;
                 }
         }
+#ifdef CONFIG_HOTPLUG_CPU
+        /* This is akin to using 'nr_cpus' on the Linux command line.
+         * Which is OK as when we use 'dom0_max_vcpus=X' we can only
+         * have up to X, while nr_cpu_ids is greater than X. This
+         * normally is not a problem, except when CPU hotplugging
+         * is involved and then there might be more than X CPUs
+         * in the guest - which will not work as there is no
+         * hypercall to expand the max number of VCPUs an already
+         * running guest has. So cap it up to X. */
+        if (subtract)
+                nr_cpu_ids = nr_cpu_ids - subtract;
+#endif
+
 }
 
 static void __init xen_smp_prepare_boot_cpu(void)
diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
index 79d7362ad6d1..3e45aa000718 100644
--- a/arch/x86/xen/xen-asm.S
+++ b/arch/x86/xen/xen-asm.S
@@ -96,7 +96,7 @@ ENTRY(xen_restore_fl_direct)
 
         /* check for unmasked and pending */
         cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
-        jz 1f
+        jnz 1f
 2:      call check_events
 1:
 ENDPATCH(xen_restore_fl_direct)
diff --git a/arch/xtensa/include/asm/hardirq.h b/arch/xtensa/include/asm/hardirq.h
index 26664cef8f11..91695a135498 100644
--- a/arch/xtensa/include/asm/hardirq.h
+++ b/arch/xtensa/include/asm/hardirq.h
@@ -11,9 +11,6 @@
 #ifndef _XTENSA_HARDIRQ_H
 #define _XTENSA_HARDIRQ_H
 
-void ack_bad_irq(unsigned int irq);
-#define ack_bad_irq ack_bad_irq
-
 #include <asm-generic/hardirq.h>
 
 #endif  /* _XTENSA_HARDIRQ_H */
diff --git a/arch/xtensa/include/asm/io.h b/arch/xtensa/include/asm/io.h
index d04cd3a625fa..4beb43c087d3 100644
--- a/arch/xtensa/include/asm/io.h
+++ b/arch/xtensa/include/asm/io.h
@@ -14,6 +14,7 @@
 #ifdef __KERNEL__
 #include <asm/byteorder.h>
 #include <asm/page.h>
+#include <linux/bug.h>
 #include <linux/kernel.h>
 
 #include <linux/types.h>
diff --git a/arch/xtensa/kernel/signal.c b/arch/xtensa/kernel/signal.c
index b69b000349fc..d78869a00b11 100644
--- a/arch/xtensa/kernel/signal.c
+++ b/arch/xtensa/kernel/signal.c
@@ -496,6 +496,7 @@ int do_signal(struct pt_regs *regs, sigset_t *oldset)
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
 
         if (signr > 0) {
+                int ret;
 
                 /* Are we from a system call? */
 
diff --git a/block/blk-core.c b/block/blk-core.c
index 3a78b00edd71..1f61b74867e4 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -483,7 +483,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
         if (!q)
                 return NULL;
 
-        q->id = ida_simple_get(&blk_queue_ida, 0, 0, GFP_KERNEL);
+        q->id = ida_simple_get(&blk_queue_ida, 0, 0, gfp_mask);
         if (q->id < 0)
                 goto fail_q;
 
@@ -1277,7 +1277,8 @@ static bool attempt_plug_merge(struct request_queue *q, struct bio *bio,
         list_for_each_entry_reverse(rq, &plug->list, queuelist) {
                 int el_ret;
 
-                (*request_count)++;
+                if (rq->q == q)
+                        (*request_count)++;
 
                 if (rq->q != q || !blk_rq_merge_ok(rq, bio))
                         continue;
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 5eed6a76721d..f2ddb94626bd 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1218,7 +1218,7 @@ void blk_throtl_drain(struct request_queue *q)
         struct bio_list bl;
         struct bio *bio;
 
-        WARN_ON_ONCE(!queue_is_locked(q));
+        queue_lockdep_assert_held(q);
 
         bio_list_init(&bl);
 
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 457295253566..3c38536bd52c 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -295,6 +295,7 @@ struct cfq_data {
         unsigned int cfq_slice_idle;
         unsigned int cfq_group_idle;
         unsigned int cfq_latency;
+        unsigned int cfq_target_latency;
 
         /*
          * Fallback dummy cfqq for extreme OOM conditions
@@ -604,7 +605,7 @@ cfq_group_slice(struct cfq_data *cfqd, struct cfq_group *cfqg)
 {
         struct cfq_rb_root *st = &cfqd->grp_service_tree;
 
-        return cfq_target_latency * cfqg->weight / st->total_weight;
+        return cfqd->cfq_target_latency * cfqg->weight / st->total_weight;
 }
 
 static inline unsigned
@@ -2271,7 +2272,8 @@ new_workload:
                  * to have higher weight. A more accurate thing would be to
                  * calculate system wide asnc/sync ratio.
                  */
-                tmp = cfq_target_latency * cfqg_busy_async_queues(cfqd, cfqg);
+                tmp = cfqd->cfq_target_latency *
+                        cfqg_busy_async_queues(cfqd, cfqg);
                 tmp = tmp/cfqd->busy_queues;
                 slice = min_t(unsigned, slice, tmp);
 
@@ -3737,6 +3739,7 @@ static void *cfq_init_queue(struct request_queue *q)
         cfqd->cfq_back_penalty = cfq_back_penalty;
         cfqd->cfq_slice[0] = cfq_slice_async;
         cfqd->cfq_slice[1] = cfq_slice_sync;
+        cfqd->cfq_target_latency = cfq_target_latency;
         cfqd->cfq_slice_async_rq = cfq_slice_async_rq;
         cfqd->cfq_slice_idle = cfq_slice_idle;
         cfqd->cfq_group_idle = cfq_group_idle;
@@ -3788,6 +3791,7 @@ SHOW_FUNCTION(cfq_slice_sync_show, cfqd->cfq_slice[1], 1);
 SHOW_FUNCTION(cfq_slice_async_show, cfqd->cfq_slice[0], 1);
 SHOW_FUNCTION(cfq_slice_async_rq_show, cfqd->cfq_slice_async_rq, 0);
 SHOW_FUNCTION(cfq_low_latency_show, cfqd->cfq_latency, 0);
+SHOW_FUNCTION(cfq_target_latency_show, cfqd->cfq_target_latency, 1);
 #undef SHOW_FUNCTION
 
 #define STORE_FUNCTION(__FUNC, __PTR, MIN, MAX, __CONV)                 \
@@ -3821,6 +3825,7 @@ STORE_FUNCTION(cfq_slice_async_store, &cfqd->cfq_slice[0], 1, UINT_MAX, 1);
 STORE_FUNCTION(cfq_slice_async_rq_store, &cfqd->cfq_slice_async_rq, 1,
                 UINT_MAX, 0);
 STORE_FUNCTION(cfq_low_latency_store, &cfqd->cfq_latency, 0, 1, 0);
+STORE_FUNCTION(cfq_target_latency_store, &cfqd->cfq_target_latency, 1, UINT_MAX, 1);
 #undef STORE_FUNCTION
 
 #define CFQ_ATTR(name) \
@@ -3838,6 +3843,7 @@ static struct elv_fs_entry cfq_attrs[] = {
         CFQ_ATTR(slice_idle),
         CFQ_ATTR(group_idle),
         CFQ_ATTR(low_latency),
+        CFQ_ATTR(target_latency),
         __ATTR_NULL
 };
 
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 21ff9d015432..8e84225c096b 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -627,7 +627,7 @@ config CRYPTO_BLOWFISH_COMMON
 
 config CRYPTO_BLOWFISH_X86_64
         tristate "Blowfish cipher algorithm (x86_64)"
-        depends on (X86 || UML_X86) && 64BIT
+        depends on X86 && 64BIT
         select CRYPTO_ALGAPI
         select CRYPTO_BLOWFISH_COMMON
         help
@@ -657,7 +657,7 @@ config CRYPTO_CAMELLIA
 
 config CRYPTO_CAMELLIA_X86_64
         tristate "Camellia cipher algorithm (x86_64)"
-        depends on (X86 || UML_X86) && 64BIT
+        depends on X86 && 64BIT
         depends on CRYPTO
         select CRYPTO_ALGAPI
         select CRYPTO_LRW
@@ -893,7 +893,7 @@ config CRYPTO_TWOFISH_X86_64
 
 config CRYPTO_TWOFISH_X86_64_3WAY
         tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
-        depends on (X86 || UML_X86) && 64BIT
+        depends on X86 && 64BIT
         select CRYPTO_ALGAPI
         select CRYPTO_TWOFISH_COMMON
         select CRYPTO_TWOFISH_X86_64
diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
index 107f6f7be5e1..dd30f40af9f5 100644
--- a/crypto/sha512_generic.c
+++ b/crypto/sha512_generic.c
@@ -174,7 +174,7 @@ sha512_update(struct shash_desc *desc, const u8 *data, unsigned int len)
         index = sctx->count[0] & 0x7f;
 
         /* Update number of bytes */
-        if (!(sctx->count[0] += len))
+        if ((sctx->count[0] += len) < len)
                 sctx->count[1]++;
 
         part_len = 128 - index;
diff --git a/drivers/acpi/acpica/hwxface.c b/drivers/acpi/acpica/hwxface.c
index ab513a972c95..a716fede4f25 100644
--- a/drivers/acpi/acpica/hwxface.c
+++ b/drivers/acpi/acpica/hwxface.c
@@ -74,7 +74,8 @@ acpi_status acpi_reset(void)
 
         /* Check if the reset register is supported */
 
-        if (!reset_reg->address) {
+        if (!(acpi_gbl_FADT.flags & ACPI_FADT_RESET_REGISTER) ||
+            !reset_reg->address) {
                 return_ACPI_STATUS(AE_NOT_EXIST);
         }
 
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index ba14fb93c929..c3881b2eb8b2 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -607,8 +607,7 @@ acpi_os_install_interrupt_handler(u32 gsi, acpi_osd_handler handler,
 
         acpi_irq_handler = handler;
         acpi_irq_context = context;
-        if (request_threaded_irq(irq, NULL, acpi_irq, IRQF_SHARED, "acpi",
-                                 acpi_irq)) {
+        if (request_irq(irq, acpi_irq, IRQF_SHARED, "acpi", acpi_irq)) {
                 printk(KERN_ERR PREFIX "SCI (IRQ%d) allocation failed\n", irq);
                 acpi_irq_handler = NULL;
                 return AE_NOT_ACQUIRED;
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 7049a7d27c4f..330bb4d75852 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -631,7 +631,7 @@ int acpi_power_get_inferred_state(struct acpi_device *device, int *state)
          * We know a device's inferred power state when all the resources
          * required for a given D-state are 'on'.
          */
-        for (i = ACPI_STATE_D0; i < ACPI_STATE_D3; i++) {
+        for (i = ACPI_STATE_D0; i < ACPI_STATE_D3_HOT; i++) {
                 list = &device->power.states[i].resources;
                 if (list->count < 1)
                         continue;
diff --git a/drivers/acpi/reboot.c b/drivers/acpi/reboot.c
index c1d612435939..a6c77e8b37bd 100644
--- a/drivers/acpi/reboot.c
+++ b/drivers/acpi/reboot.c
@@ -23,7 +23,8 @@ void acpi_reboot(void)
         /* Is the reset register supported? The spec says we should be
          * checking the bit width and bit offset, but Windows ignores
          * these fields */
-        /* Ignore also acpi_gbl_FADT.flags.ACPI_FADT_RESET_REGISTER */
+        if (!(acpi_gbl_FADT.flags & ACPI_FADT_RESET_REGISTER))
+                return;
 
         reset_value = acpi_gbl_FADT.reset_value;
 
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 767e2dcb9616..7417267e88fa 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -869,7 +869,7 @@ static int acpi_bus_get_power_flags(struct acpi_device *device)
         /*
          * Enumerate supported power management states
          */
-        for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3; i++) {
+        for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) {
                 struct acpi_device_power_state *ps = &device->power.states[i];
                 char object_name[5] = { '_', 'P', 'R', '0' + i, '\0' };
 
@@ -884,21 +884,18 @@ static int acpi_bus_get_power_flags(struct acpi_device *device)
                                 acpi_bus_add_power_resource(ps->resources.handles[j]);
                 }
 
-                /* The exist of _PR3 indicates D3Cold support */
-                if (i == ACPI_STATE_D3) {
-                        status = acpi_get_handle(device->handle, object_name, &handle);
-                        if (ACPI_SUCCESS(status))
-                                device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1;
-                }
-
                 /* Evaluate "_PSx" to see if we can do explicit sets */
                 object_name[2] = 'S';
                 status = acpi_get_handle(device->handle, object_name, &handle);
                 if (ACPI_SUCCESS(status))
                         ps->flags.explicit_set = 1;
 
-                /* State is valid if we have some power control */
-                if (ps->resources.count || ps->flags.explicit_set)
+                /*
+                 * State is valid if there are means to put the device into it.
+                 * D3hot is only valid if _PR3 present.
+                 */
+                if (ps->resources.count ||
+                    (ps->flags.explicit_set && i < ACPI_STATE_D3_HOT))
                         ps->flags.valid = 1;
 
                 ps->power = -1; /* Unknown - driver assigned */
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 1d661b5c3287..eb6fd233764b 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -28,23 +28,33 @@
 #include "internal.h"
 #include "sleep.h"
 
+u8 wake_sleep_flags = ACPI_NO_OPTIONAL_METHODS;
 static unsigned int gts, bfs;
-module_param(gts, uint, 0644);
-module_param(bfs, uint, 0644);
-MODULE_PARM_DESC(gts, "Enable evaluation of _GTS on suspend.");
-MODULE_PARM_DESC(bfs, "Enable evaluation of _BFS on resume".);
-
-static u8 wake_sleep_flags(void)
+static int set_param_wake_flag(const char *val, struct kernel_param *kp)
 {
-        u8 flags = ACPI_NO_OPTIONAL_METHODS;
+        int ret = param_set_int(val, kp);
 
-        if (gts)
-                flags |= ACPI_EXECUTE_GTS;
-        if (bfs)
-                flags |= ACPI_EXECUTE_BFS;
+        if (ret)
+                return ret;
 
-        return flags;
+        if (kp->arg == (const char *)&gts) {
+                if (gts)
+                        wake_sleep_flags |= ACPI_EXECUTE_GTS;
+                else
+                        wake_sleep_flags &= ~ACPI_EXECUTE_GTS;
+        }
+        if (kp->arg == (const char *)&bfs) {
+                if (bfs)
+                        wake_sleep_flags |= ACPI_EXECUTE_BFS;
+                else
+                        wake_sleep_flags &= ~ACPI_EXECUTE_BFS;
+        }
+        return ret;
 }
+module_param_call(gts, set_param_wake_flag, param_get_int, &gts, 0644);
+module_param_call(bfs, set_param_wake_flag, param_get_int, &bfs, 0644);
+MODULE_PARM_DESC(gts, "Enable evaluation of _GTS on suspend.");
+MODULE_PARM_DESC(bfs, "Enable evaluation of _BFS on resume".);
 
 static u8 sleep_states[ACPI_S_STATE_COUNT];
 
@@ -263,7 +273,6 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
 {
         acpi_status status = AE_OK;
         u32 acpi_state = acpi_target_sleep_state;
-        u8 flags = wake_sleep_flags();
         int error;
 
         ACPI_FLUSH_CPU_CACHE();
@@ -271,7 +280,7 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
         switch (acpi_state) {
         case ACPI_STATE_S1:
                 barrier();
-                status = acpi_enter_sleep_state(acpi_state, flags);
+                status = acpi_enter_sleep_state(acpi_state, wake_sleep_flags);
                 break;
 
         case ACPI_STATE_S3:
@@ -286,7 +295,7 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
         acpi_write_bit_register(ACPI_BITREG_SCI_ENABLE, 1);
 
         /* Reprogram control registers and execute _BFS */
-        acpi_leave_sleep_state_prep(acpi_state, flags);
+        acpi_leave_sleep_state_prep(acpi_state, wake_sleep_flags);
 
         /* ACPI 3.0 specs (P62) says that it's the responsibility
          * of the OSPM to clear the status bit [ implying that the
@@ -550,30 +559,27 @@ static int acpi_hibernation_begin(void)
 
 static int acpi_hibernation_enter(void)
 {
-        u8 flags = wake_sleep_flags();
         acpi_status status = AE_OK;
 
         ACPI_FLUSH_CPU_CACHE();
 
         /* This shouldn't return.  If it returns, we have a problem */
-        status = acpi_enter_sleep_state(ACPI_STATE_S4, flags);
+        status = acpi_enter_sleep_state(ACPI_STATE_S4, wake_sleep_flags);
         /* Reprogram control registers and execute _BFS */
-        acpi_leave_sleep_state_prep(ACPI_STATE_S4, flags);
+        acpi_leave_sleep_state_prep(ACPI_STATE_S4, wake_sleep_flags);
 
         return ACPI_SUCCESS(status) ? 0 : -EFAULT;
 }
 
 static void acpi_hibernation_leave(void)
 {
-        u8 flags = wake_sleep_flags();
-
         /*
          * If ACPI is not enabled by the BIOS and the boot kernel, we need to
          * enable it here.
          */
         acpi_enable();
         /* Reprogram control registers and execute _BFS */
-        acpi_leave_sleep_state_prep(ACPI_STATE_S4, flags);
+        acpi_leave_sleep_state_prep(ACPI_STATE_S4, wake_sleep_flags);
         /* Check the hardware signature */
         if (facs && s4_hardware_signature != facs->hardware_signature) {
                 printk(KERN_EMERG "ACPI: Hardware changed while hibernated, "
@@ -828,12 +834,10 @@ static void acpi_power_off_prepare(void)
 
 static void acpi_power_off(void)
 {
-        u8 flags = wake_sleep_flags();
-
         /* acpi_sleep_prepare(ACPI_STATE_S5) should have already been called */
         printk(KERN_DEBUG "%s called\n", __func__);
         local_irq_disable();
-        acpi_enter_sleep_state(ACPI_STATE_S5, flags);
+        acpi_enter_sleep_state(ACPI_STATE_S5, wake_sleep_flags);
 }
 
 /*
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 01c2cf4efcdd..cc273226dbd0 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -247,8 +247,7 @@ static int amba_pm_restore(struct device *dev)
 /*
  * Hooks to provide runtime PM of the pclk (bus clock).  It is safe to
  * enable/disable the bus clock at runtime PM suspend/resume as this
- * does not result in loss of context.  However, disabling vcore power
- * would do, so we leave that to the driver.
+ * does not result in loss of context.
  */
 static int amba_pm_runtime_suspend(struct device *dev)
 {
@@ -354,39 +353,6 @@ static void amba_put_disable_pclk(struct amba_device *pcdev)
         clk_put(pclk);
 }
 
-static int amba_get_enable_vcore(struct amba_device *pcdev)
-{
-        struct regulator *vcore = regulator_get(&pcdev->dev, "vcore");
-        int ret;
-
-        pcdev->vcore = vcore;
-
-        if (IS_ERR(vcore)) {
-                /* It is OK not to supply a vcore regulator */
-                if (PTR_ERR(vcore) == -ENODEV)
-                        return 0;
-                return PTR_ERR(vcore);
-        }
-
-        ret = regulator_enable(vcore);
-        if (ret) {
-                regulator_put(vcore);
-                pcdev->vcore = ERR_PTR(-ENODEV);
-        }
-
-        return ret;
-}
-
-static void amba_put_disable_vcore(struct amba_device *pcdev)
-{
-        struct regulator *vcore = pcdev->vcore;
-
-        if (!IS_ERR(vcore)) {
-                regulator_disable(vcore);
-                regulator_put(vcore);
-        }
-}
-
 /*
  * These are the device model conversion veneers; they convert the
  * device model structures to our more specific structures.
@@ -399,10 +365,6 @@ static int amba_probe(struct device *dev)
         int ret;
 
         do {
-                ret = amba_get_enable_vcore(pcdev);
-                if (ret)
-                        break;
-
                 ret = amba_get_enable_pclk(pcdev);
                 if (ret)
                         break;
@@ -420,7 +382,6 @@ static int amba_probe(struct device *dev)
                 pm_runtime_put_noidle(dev);
 
                 amba_put_disable_pclk(pcdev);
-                amba_put_disable_vcore(pcdev);
         } while (0);
 
         return ret;
@@ -442,7 +403,6 @@ static int amba_remove(struct device *dev)
         pm_runtime_put_noidle(dev);
 
         amba_put_disable_pclk(pcdev);
-        amba_put_disable_vcore(pcdev);
 
         return ret;
 }
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 79a1e9dd56d9..ebaf67e4b2bc 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -394,6 +394,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },                  /* 88se9128 */
         { PCI_DEVICE(0x1b4b, 0x9125),
           .driver_data = board_ahci_yes_fbs },                  /* 88se9125 */
+        { PCI_DEVICE(0x1b4b, 0x917a),
+          .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
         { PCI_DEVICE(0x1b4b, 0x91a3),
           .driver_data = board_ahci_yes_fbs },
 
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index 0c86c77764bc..9e419e1c2006 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -280,6 +280,7 @@ static struct dev_pm_ops ahci_pm_ops = {
 
 static const struct of_device_id ahci_of_match[] = {
         { .compatible = "calxeda,hb-ahci", },
+        { .compatible = "snps,spear-ahci", },
         {},
 };
 MODULE_DEVICE_TABLE(of, ahci_of_match);
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 68013f96729f..7857e8fd0a3e 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -329,6 +329,8 @@ static const struct pci_device_id piix_pci_tbl[] = {
         { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
         /* SATA Controller IDE (Lynx Point) */
         { 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (DH89xxCC) */
+        { 0x8086, 0x2326, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
         { }     /* terminate list */
 };
 
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index e0bda9ff89cd..23763a1ec570 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -95,7 +95,7 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev);
 static void ata_dev_xfermask(struct ata_device *dev);
 static unsigned long ata_dev_blacklisted(const struct ata_device *dev);
 
-unsigned int ata_print_id = 1;
+atomic_t ata_print_id = ATOMIC_INIT(0);
 
 struct ata_force_param {
         const char      *name;
@@ -6029,7 +6029,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
 
         /* give ports names and add SCSI hosts */
         for (i = 0; i < host->n_ports; i++)
-                host->ports[i]->print_id = ata_print_id++;
+                host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
 
 
         /* Create associated sysfs transport objects  */
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index c61316e9d2f7..d1fbd59ead16 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -3501,7 +3501,8 @@ static int ata_count_probe_trials_cb(struct ata_ering_entry *ent, void *void_arg
         u64 now = get_jiffies_64();
         int *trials = void_arg;
 
-        if (ent->timestamp < now - min(now, interval))
+        if ((ent->eflags & ATA_EFLAG_OLD_ER) ||
+            (ent->timestamp < now - min(now, interval)))
                 return -1;
 
         (*trials)++;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 1ee00c8b5b04..22226350cd0c 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3399,7 +3399,8 @@ int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)
                  */
                 shost->max_host_blocked = 1;
 
-                rc = scsi_add_host(ap->scsi_host, &ap->tdev);
+                rc = scsi_add_host_with_dma(ap->scsi_host,
+                                                &ap->tdev, ap->host->dev);
                 if (rc)
                         goto err_add;
         }
@@ -3838,18 +3839,25 @@ void ata_sas_port_stop(struct ata_port *ap)
 }
 EXPORT_SYMBOL_GPL(ata_sas_port_stop);
 
-int ata_sas_async_port_init(struct ata_port *ap)
+/**
+ * ata_sas_async_probe - simply schedule probing and return
+ * @ap: Port to probe
+ *
+ * For batch scheduling of probe for sas attached ata devices, assumes
+ * the port has already been through ata_sas_port_init()
+ */
+void ata_sas_async_probe(struct ata_port *ap)
 {
-        int rc = ap->ops->port_start(ap);
-
-        if (!rc) {
-                ap->print_id = ata_print_id++;
-                __ata_port_probe(ap);
-        }
+        __ata_port_probe(ap);
+}
+EXPORT_SYMBOL_GPL(ata_sas_async_probe);
 
-        return rc;
+int ata_sas_sync_probe(struct ata_port *ap)
+{
+        return ata_port_probe(ap);
 }
-EXPORT_SYMBOL_GPL(ata_sas_async_port_init);
+EXPORT_SYMBOL_GPL(ata_sas_sync_probe);
+
 
 /**
  *      ata_sas_port_init - Initialize a SATA device
@@ -3866,12 +3874,10 @@ int ata_sas_port_init(struct ata_port *ap)
 {
         int rc = ap->ops->port_start(ap);
 
-        if (!rc) {
-                ap->print_id = ata_print_id++;
-                rc = ata_port_probe(ap);
-        }
-
-        return rc;
+        if (rc)
+                return rc;
+        ap->print_id = atomic_inc_return(&ata_print_id);
+        return 0;
 }
 EXPORT_SYMBOL_GPL(ata_sas_port_init);
 
diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
index 74aaee30e264..c34190485377 100644
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -294,6 +294,7 @@ int ata_tport_add(struct device *parent,
         device_enable_async_suspend(dev);
         pm_runtime_set_active(dev);
         pm_runtime_enable(dev);
+        pm_runtime_forbid(dev);
 
         transport_add_device(dev);
         transport_configure_device(dev);
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index 2e26fcaf635b..9d0fd0b71852 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -53,7 +53,7 @@ enum {
         ATA_DNXFER_QUIET        = (1 << 31),
 };
 
-extern unsigned int ata_print_id;
+extern atomic_t ata_print_id;
 extern int atapi_passthru16;
 extern int libata_fua;
 extern int libata_noacpi;
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index fc2db2a89a6b..3239517f4d90 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -943,9 +943,9 @@ static int arasan_cf_resume(struct device *dev)
 
         return 0;
 }
+#endif
 
 static SIMPLE_DEV_PM_OPS(arasan_cf_pm_ops, arasan_cf_suspend, arasan_cf_resume);
-#endif
 
 static struct platform_driver arasan_cf_driver = {
         .probe          = arasan_cf_probe,
@@ -953,9 +953,7 @@ static struct platform_driver arasan_cf_driver = {
         .driver         = {
                 .name   = DRIVER_NAME,
                 .owner  = THIS_MODULE,
-#ifdef CONFIG_PM
                 .pm     = &arasan_cf_pm_ops,
-#endif
         },
 };
 
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 38950ea8398a..7336d4a7ab31 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4025,7 +4025,8 @@ static int mv_platform_probe(struct platform_device *pdev)
         struct ata_host *host;
         struct mv_host_priv *hpriv;
         struct resource *res;
-        int n_ports, rc;
+        int n_ports = 0;
+        int rc;
 
         ata_print_version_once(&pdev->dev, DRV_VERSION);
 
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index fcd69ff695d5..357294905793 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -898,10 +898,12 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
                         map->format.parse_val(val + i);
         } else {
                 for (i = 0; i < val_count; i++) {
+                        unsigned int ival;
                         ret = regmap_read(map, reg + (i * map->reg_stride),
-                                          val + (i * val_bytes));
+                                          &ival);
                         if (ret != 0)
                                 return ret;
+                        memcpy(val + (i * val_bytes), &ival, val_bytes);
                 }
         }
 
diff --git a/drivers/base/soc.c b/drivers/base/soc.c
index 05f150382da8..ba29b2e73d48 100644
--- a/drivers/base/soc.c
+++ b/drivers/base/soc.c
@@ -15,7 +15,7 @@
 #include <linux/sys_soc.h>
 #include <linux/err.h>
 
-static DEFINE_IDR(soc_ida);
+static DEFINE_IDA(soc_ida);
 static DEFINE_SPINLOCK(soc_lock);
 
 static ssize_t soc_info_get(struct device *dev,
@@ -168,8 +168,6 @@ void soc_device_unregister(struct soc_device *soc_dev)
 
 static int __init soc_bus_register(void)
 {
-        spin_lock_init(&soc_lock);
-
         return bus_register(&soc_bus_type);
 }
 core_initcall(soc_bus_register);
diff --git a/drivers/bcma/Kconfig b/drivers/bcma/Kconfig
index c1172dafdffa..fb7c80fb721e 100644
--- a/drivers/bcma/Kconfig
+++ b/drivers/bcma/Kconfig
@@ -29,7 +29,7 @@ config BCMA_HOST_PCI
 
 config BCMA_DRIVER_PCI_HOSTMODE
         bool "Driver for PCI core working in hostmode"
-        depends on BCMA && MIPS
+        depends on BCMA && MIPS && BCMA_HOST_PCI
         help
           PCI core hostmode operation (external PCI bus).
 
diff --git a/drivers/bcma/driver_pci_host.c b/drivers/bcma/driver_pci_host.c
index 4e20bcfa7ec5..d2097a11c3c7 100644
--- a/drivers/bcma/driver_pci_host.c
+++ b/drivers/bcma/driver_pci_host.c
@@ -10,6 +10,7 @@
  */
 
 #include "bcma_private.h"
+#include <linux/pci.h>
 #include <linux/export.h>
 #include <linux/bcma/bcma.h>
 #include <asm/paccess.h>
diff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c
index cdcf75c0954f..3e2a6002aae6 100644
--- a/drivers/bcma/sprom.c
+++ b/drivers/bcma/sprom.c
@@ -404,16 +404,19 @@ int bcma_sprom_get(struct bcma_bus *bus)
                 return -EOPNOTSUPP;
 
         if (!bcma_sprom_ext_available(bus)) {
+                bool sprom_onchip;
+
                 /*
                  * External SPROM takes precedence so check
                  * on-chip OTP only when no external SPROM
                  * is present.
                  */
-                if (bcma_sprom_onchip_available(bus)) {
+                sprom_onchip = bcma_sprom_onchip_available(bus);
+                if (sprom_onchip) {
                         /* determine offset */
                         offset = bcma_sprom_onchip_offset(bus);
                 }
-                if (!offset) {
+                if (!offset || !sprom_onchip) {
                         /*
                          * Maybe there is no SPROM on the device?
                          * Now we ask the arch code if there is some sprom
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index e820b68d2f6c..acda773b3720 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -866,6 +866,7 @@ cciss_scsi_detect(ctlr_info_t *h)
         sh->can_queue = cciss_tape_cmds;
         sh->sg_tablesize = h->maxsgentries;
         sh->max_cmd_len = MAX_COMMAND_SIZE;
+        sh->max_sectors = h->cciss_max_sectors;
 
         ((struct cciss_scsi_adapter_data_t *) 
                 h->scsi_ctlr)->scsi_host = sh;
@@ -1410,7 +1411,7 @@ static void cciss_scatter_gather(ctlr_info_t *h, CommandList_struct *c,
         /* track how many SG entries we are using */
         if (request_nsgs > h->maxSG)
                 h->maxSG = request_nsgs;
-        c->Header.SGTotal = (__u8) request_nsgs + chained;
+        c->Header.SGTotal = (u16) request_nsgs + chained;
         if (request_nsgs > h->max_cmd_sgentries)
                 c->Header.SGList = h->max_cmd_sgentries;
         else
diff --git a/drivers/block/mtip32xx/Kconfig b/drivers/block/mtip32xx/Kconfig
index b5dd14e072f2..0ba837fc62a8 100644
--- a/drivers/block/mtip32xx/Kconfig
+++ b/drivers/block/mtip32xx/Kconfig
@@ -4,6 +4,6 @@
 
 config BLK_DEV_PCIESSD_MTIP32XX
         tristate "Block Device Driver for Micron PCIe SSDs"
-        depends on HOTPLUG_PCI_PCIE
+        depends on PCI
         help
           This enables the block driver for Micron PCIe SSDs.
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 8eb81c96608f..00f9fc992090 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -36,6 +36,7 @@
 #include <linux/idr.h>
 #include <linux/kthread.h>
 #include <../drivers/ata/ahci.h>
+#include <linux/export.h>
 #include "mtip32xx.h"
 
 #define HW_CMD_SLOT_SZ          (MTIP_MAX_COMMAND_SLOTS * 32)
@@ -44,6 +45,7 @@
 #define HW_PORT_PRIV_DMA_SZ \
                 (HW_CMD_SLOT_SZ + HW_CMD_TBL_AR_SZ + AHCI_RX_FIS_SZ)
 
+#define HOST_CAP_NZDMA          (1 << 19)
 #define HOST_HSORG              0xFC
 #define HSORG_DISABLE_SLOTGRP_INTR (1<<24)
 #define HSORG_DISABLE_SLOTGRP_PXIS (1<<16)
@@ -139,6 +141,12 @@ static void mtip_command_cleanup(struct driver_data *dd)
         int group = 0, commandslot = 0, commandindex = 0;
         struct mtip_cmd *command;
         struct mtip_port *port = dd->port;
+        static int in_progress;
+
+        if (in_progress)
+                return;
+
+        in_progress = 1;
 
         for (group = 0; group < 4; group++) {
                 for (commandslot = 0; commandslot < 32; commandslot++) {
@@ -165,7 +173,8 @@ static void mtip_command_cleanup(struct driver_data *dd)
 
         up(&port->cmd_slot);
 
-        atomic_set(&dd->drv_cleanup_done, true);
+        set_bit(MTIP_DDF_CLEANUP_BIT, &dd->dd_flag);
+        in_progress = 0;
 }
 
 /*
@@ -262,6 +271,9 @@ static int hba_reset_nosleep(struct driver_data *dd)
                  && time_before(jiffies, timeout))
                 mdelay(1);
 
+        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag))
+                return -1;
+
         if (readl(dd->mmio + HOST_CTL) & HOST_RESET)
                 return -1;
 
@@ -294,6 +306,10 @@ static inline void mtip_issue_ncq_command(struct mtip_port *port, int tag)
                         port->cmd_issue[MTIP_TAG_INDEX(tag)]);
 
         spin_unlock_irqrestore(&port->cmd_issue_lock, flags);
+
+        /* Set the command's timeout value.*/
+        port->commands[tag].comp_time = jiffies + msecs_to_jiffies(
+                                        MTIP_NCQ_COMMAND_TIMEOUT_MS);
 }
 
 /*
@@ -420,7 +436,12 @@ static void mtip_init_port(struct mtip_port *port)
                 writel(0xFFFFFFFF, port->completed[i]);
 
         /* Clear any pending interrupts for this port */
-        writel(readl(port->mmio + PORT_IRQ_STAT), port->mmio + PORT_IRQ_STAT);
+        writel(readl(port->dd->mmio + PORT_IRQ_STAT),
+                                        port->dd->mmio + PORT_IRQ_STAT);
+
+        /* Clear any pending interrupts on the HBA. */
+        writel(readl(port->dd->mmio + HOST_IRQ_STAT),
+                                        port->dd->mmio + HOST_IRQ_STAT);
 
         /* Enable port interrupts */
         writel(DEF_PORT_IRQ, port->mmio + PORT_IRQ_MASK);
@@ -447,6 +468,9 @@ static void mtip_restart_port(struct mtip_port *port)
                  && time_before(jiffies, timeout))
                 ;
 
+        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &port->dd->dd_flag))
+                return;
+
         /*
          * Chip quirk: escalate to hba reset if
          * PxCMD.CR not clear after 500 ms
@@ -475,6 +499,9 @@ static void mtip_restart_port(struct mtip_port *port)
         while (time_before(jiffies, timeout))
                 ;
 
+        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &port->dd->dd_flag))
+                return;
+
         /* Clear PxSCTL.DET */
         writel(readl(port->mmio + PORT_SCR_CTL) & ~1,
                          port->mmio + PORT_SCR_CTL);
@@ -486,15 +513,35 @@ static void mtip_restart_port(struct mtip_port *port)
                          && time_before(jiffies, timeout))
                 ;
 
+        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &port->dd->dd_flag))
+                return;
+
         if ((readl(port->mmio + PORT_SCR_STAT) & 0x01) == 0)
                 dev_warn(&port->dd->pdev->dev,
                         "COM reset failed\n");
 
-        /* Clear SError, the PxSERR.DIAG.x should be set so clear it */
-        writel(readl(port->mmio + PORT_SCR_ERR), port->mmio + PORT_SCR_ERR);
+        mtip_init_port(port);
+        mtip_start_port(port);
 
-        /* Enable the DMA engine */
-        mtip_enable_engine(port, 1);
+}
+
+/*
+ * Helper function for tag logging
+ */
+static void print_tags(struct driver_data *dd,
+                        char *msg,
+                        unsigned long *tagbits,
+                        int cnt)
+{
+        unsigned char tagmap[128];
+        int group, tagmap_len = 0;
+
+        memset(tagmap, 0, sizeof(tagmap));
+        for (group = SLOTBITS_IN_LONGS; group > 0; group--)
+                tagmap_len = sprintf(tagmap + tagmap_len, "%016lX ",
+                                                tagbits[group-1]);
+        dev_warn(&dd->pdev->dev,
+                        "%d command(s) %s: tagmap [%s]", cnt, msg, tagmap);
 }
 
 /*
@@ -514,15 +561,18 @@ static void mtip_timeout_function(unsigned long int data)
         int tag, cmdto_cnt = 0;
         unsigned int bit, group;
         unsigned int num_command_slots = port->dd->slot_groups * 32;
+        unsigned long to, tagaccum[SLOTBITS_IN_LONGS];
 
         if (unlikely(!port))
                 return;
 
-        if (atomic_read(&port->dd->resumeflag) == true) {
+        if (test_bit(MTIP_DDF_RESUME_BIT, &port->dd->dd_flag)) {
                 mod_timer(&port->cmd_timer,
                         jiffies + msecs_to_jiffies(30000));
                 return;
         }
+        /* clear the tag accumulator */
+        memset(tagaccum, 0, SLOTBITS_IN_LONGS * sizeof(long));
 
         for (tag = 0; tag < num_command_slots; tag++) {
                 /*
@@ -540,12 +590,10 @@ static void mtip_timeout_function(unsigned long int data)
                         command = &port->commands[tag];
                         fis = (struct host_to_dev_fis *) command->command;
 
-                        dev_warn(&port->dd->pdev->dev,
-                                "Timeout for command tag %d\n", tag);
-
+                        set_bit(tag, tagaccum);
                         cmdto_cnt++;
                         if (cmdto_cnt == 1)
-                                set_bit(MTIP_FLAG_EH_ACTIVE_BIT, &port->flags);
+                                set_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
 
                         /*
                          * Clear the completed bit. This should prevent
@@ -578,15 +626,29 @@ static void mtip_timeout_function(unsigned long int data)
                 }
         }
 
-        if (cmdto_cnt) {
-                dev_warn(&port->dd->pdev->dev,
-                        "%d commands timed out: restarting port",
-                        cmdto_cnt);
+        if (cmdto_cnt && !test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
+                print_tags(port->dd, "timed out", tagaccum, cmdto_cnt);
+
                 mtip_restart_port(port);
-                clear_bit(MTIP_FLAG_EH_ACTIVE_BIT, &port->flags);
+                clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
                 wake_up_interruptible(&port->svc_wait);
         }
 
+        if (port->ic_pause_timer) {
+                to  = port->ic_pause_timer + msecs_to_jiffies(1000);
+                if (time_after(jiffies, to)) {
+                        if (!test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
+                                port->ic_pause_timer = 0;
+                                clear_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
+                                clear_bit(MTIP_PF_DM_ACTIVE_BIT, &port->flags);
+                                clear_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags);
+                                wake_up_interruptible(&port->svc_wait);
+                        }
+
+
+                }
+        }
+
         /* Restart the timer */
         mod_timer(&port->cmd_timer,
                 jiffies + msecs_to_jiffies(MTIP_TIMEOUT_CHECK_PERIOD));
@@ -681,23 +743,18 @@ static void mtip_completion(struct mtip_port *port,
         complete(waiting);
 }
 
-/*
- * Helper function for tag logging
- */
-static void print_tags(struct driver_data *dd,
-                        char *msg,
-                        unsigned long *tagbits)
+static void mtip_null_completion(struct mtip_port *port,
+                            int tag,
+                            void *data,
+                            int status)
 {
-        unsigned int tag, count = 0;
-
-        for (tag = 0; tag < (dd->slot_groups) * 32; tag++) {
-                if (test_bit(tag, tagbits))
-                        count++;
-        }
-        if (count)
-                dev_info(&dd->pdev->dev, "%s [%i tags]\n", msg, count);
+        return;
 }
 
+static int mtip_read_log_page(struct mtip_port *port, u8 page, u16 *buffer,
+                                dma_addr_t buffer_dma, unsigned int sectors);
+static int mtip_get_smart_attr(struct mtip_port *port, unsigned int id,
+                                                struct smart_attr *attrib);
 /*
  * Handle an error.
  *
@@ -708,12 +765,16 @@ static void print_tags(struct driver_data *dd,
  */
 static void mtip_handle_tfe(struct driver_data *dd)
 {
-        int group, tag, bit, reissue;
+        int group, tag, bit, reissue, rv;
         struct mtip_port *port;
-        struct mtip_cmd  *command;
+        struct mtip_cmd  *cmd;
         u32 completed;
         struct host_to_dev_fis *fis;
         unsigned long tagaccum[SLOTBITS_IN_LONGS];
+        unsigned int cmd_cnt = 0;
+        unsigned char *buf;
+        char *fail_reason = NULL;
+        int fail_all_ncq_write = 0, fail_all_ncq_cmds = 0;
 
         dev_warn(&dd->pdev->dev, "Taskfile error\n");
 
@@ -722,8 +783,11 @@ static void mtip_handle_tfe(struct driver_data *dd)
         /* Stop the timer to prevent command timeouts. */
         del_timer(&port->cmd_timer);
 
+        /* clear the tag accumulator */
+        memset(tagaccum, 0, SLOTBITS_IN_LONGS * sizeof(long));
+
         /* Set eh_active */
-        set_bit(MTIP_FLAG_EH_ACTIVE_BIT, &port->flags);
+        set_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
 
         /* Loop through all the groups */
         for (group = 0; group < dd->slot_groups; group++) {
@@ -732,9 +796,6 @@ static void mtip_handle_tfe(struct driver_data *dd)
                 /* clear completed status register in the hardware.*/
                 writel(completed, port->completed[group]);
 
-                /* clear the tag accumulator */
-                memset(tagaccum, 0, SLOTBITS_IN_LONGS * sizeof(long));
-
                 /* Process successfully completed commands */
                 for (bit = 0; bit < 32 && completed; bit++) {
                         if (!(completed & (1<<bit)))
@@ -745,13 +806,14 @@ static void mtip_handle_tfe(struct driver_data *dd)
                         if (tag == MTIP_TAG_INTERNAL)
                                 continue;
 
-                        command = &port->commands[tag];
-                        if (likely(command->comp_func)) {
+                        cmd = &port->commands[tag];
+                        if (likely(cmd->comp_func)) {
                                 set_bit(tag, tagaccum);
-                                atomic_set(&port->commands[tag].active, 0);
-                                command->comp_func(port,
+                                cmd_cnt++;
+                                atomic_set(&cmd->active, 0);
+                                cmd->comp_func(port,
                                          tag,
-                                         command->comp_data,
+                                         cmd->comp_data,
                                          0);
                         } else {
                                 dev_err(&port->dd->pdev->dev,
@@ -765,12 +827,45 @@ static void mtip_handle_tfe(struct driver_data *dd)
                         }
                 }
         }
-        print_tags(dd, "TFE tags completed:", tagaccum);
+
+        print_tags(dd, "completed (TFE)", tagaccum, cmd_cnt);
 
         /* Restart the port */
         mdelay(20);
         mtip_restart_port(port);
 
+        /* Trying to determine the cause of the error */
+        rv = mtip_read_log_page(dd->port, ATA_LOG_SATA_NCQ,
+                                dd->port->log_buf,
+                                dd->port->log_buf_dma, 1);
+        if (rv) {
+                dev_warn(&dd->pdev->dev,
+                        "Error in READ LOG EXT (10h) command\n");
+                /* non-critical error, don't fail the load */
+        } else {
+                buf = (unsigned char *)dd->port->log_buf;
+                if (buf[259] & 0x1) {
+                        dev_info(&dd->pdev->dev,
+                                "Write protect bit is set.\n");
+                        set_bit(MTIP_DDF_WRITE_PROTECT_BIT, &dd->dd_flag);
+                        fail_all_ncq_write = 1;
+                        fail_reason = "write protect";
+                }
+                if (buf[288] == 0xF7) {
+                        dev_info(&dd->pdev->dev,
+                                "Exceeded Tmax, drive in thermal shutdown.\n");
+                        set_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag);
+                        fail_all_ncq_cmds = 1;
+                        fail_reason = "thermal shutdown";
+                }
+                if (buf[288] == 0xBF) {
+                        dev_info(&dd->pdev->dev,
+                                "Drive indicates rebuild has failed.\n");
+                        fail_all_ncq_cmds = 1;
+                        fail_reason = "rebuild failed";
+                }
+        }
+
         /* clear the tag accumulator */
         memset(tagaccum, 0, SLOTBITS_IN_LONGS * sizeof(long));
 
@@ -779,32 +874,47 @@ static void mtip_handle_tfe(struct driver_data *dd)
                 for (bit = 0; bit < 32; bit++) {
                         reissue = 1;
                         tag = (group << 5) + bit;
+                        cmd = &port->commands[tag];
 
                         /* If the active bit is set re-issue the command */
-                        if (atomic_read(&port->commands[tag].active) == 0)
+                        if (atomic_read(&cmd->active) == 0)
                                 continue;
 
-                        fis = (struct host_to_dev_fis *)
-                                port->commands[tag].command;
+                        fis = (struct host_to_dev_fis *)cmd->command;
 
                         /* Should re-issue? */
                         if (tag == MTIP_TAG_INTERNAL ||
                             fis->command == ATA_CMD_SET_FEATURES)
                                 reissue = 0;
+                        else {
+                                if (fail_all_ncq_cmds ||
+                                        (fail_all_ncq_write &&
+                                        fis->command == ATA_CMD_FPDMA_WRITE)) {
+                                        dev_warn(&dd->pdev->dev,
+                                        "  Fail: %s w/tag %d [%s].\n",
+                                        fis->command == ATA_CMD_FPDMA_WRITE ?
+                                                "write" : "read",
+                                        tag,
+                                        fail_reason != NULL ?
+                                                fail_reason : "unknown");
+                                        atomic_set(&cmd->active, 0);
+                                        if (cmd->comp_func) {
+                                                cmd->comp_func(port, tag,
+                                                        cmd->comp_data,
+                                                        -ENODATA);
+                                        }
+                                        continue;
+                                }
+                        }
 
                         /*
                          * First check if this command has
                          *  exceeded its retries.
                          */
-                        if (reissue &&
-                            (port->commands[tag].retries-- > 0)) {
+                        if (reissue && (cmd->retries-- > 0)) {
 
                                 set_bit(tag, tagaccum);
 
-                                /* Update the timeout value. */
-                                port->commands[tag].comp_time =
-                                        jiffies + msecs_to_jiffies(
-                                        MTIP_NCQ_COMMAND_TIMEOUT_MS);
                                 /* Re-issue the command. */
                                 mtip_issue_ncq_command(port, tag);
 
@@ -814,13 +924,13 @@ static void mtip_handle_tfe(struct driver_data *dd)
                         /* Retire a command that will not be reissued */
                         dev_warn(&port->dd->pdev->dev,
                                 "retiring tag %d\n", tag);
-                        atomic_set(&port->commands[tag].active, 0);
+                        atomic_set(&cmd->active, 0);
 
-                        if (port->commands[tag].comp_func)
-                                port->commands[tag].comp_func(
+                        if (cmd->comp_func)
+                                cmd->comp_func(
                                         port,
                                         tag,
-                                        port->commands[tag].comp_data,
+                                        cmd->comp_data,
                                         PORT_IRQ_TF_ERR);
                         else
                                 dev_warn(&port->dd->pdev->dev,
@@ -828,10 +938,10 @@ static void mtip_handle_tfe(struct driver_data *dd)
                                         tag);
                 }
         }
-        print_tags(dd, "TFE tags reissued:", tagaccum);
+        print_tags(dd, "reissued (TFE)", tagaccum, cmd_cnt);
 
         /* clear eh_active */
-        clear_bit(MTIP_FLAG_EH_ACTIVE_BIT, &port->flags);
+        clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
         wake_up_interruptible(&port->svc_wait);
 
         mod_timer(&port->cmd_timer,
@@ -899,7 +1009,7 @@ static inline void mtip_process_legacy(struct driver_data *dd, u32 port_stat)
         struct mtip_port *port = dd->port;
         struct mtip_cmd *cmd = &port->commands[MTIP_TAG_INTERNAL];
 
-        if (test_bit(MTIP_FLAG_IC_ACTIVE_BIT, &port->flags) &&
+        if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags) &&
             (cmd != NULL) && !(readl(port->cmd_issue[MTIP_TAG_INTERNAL])
                 & (1 << MTIP_TAG_INTERNAL))) {
                 if (cmd->comp_func) {
@@ -911,8 +1021,6 @@ static inline void mtip_process_legacy(struct driver_data *dd, u32 port_stat)
                 }
         }
 
-        dev_warn(&dd->pdev->dev, "IRQ status 0x%x ignored.\n", port_stat);
-
         return;
 }
 
@@ -968,6 +1076,9 @@ static inline irqreturn_t mtip_handle_irq(struct driver_data *data)
                                 /* don't proceed further */
                                 return IRQ_HANDLED;
                         }
+                        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
+                                                        &dd->dd_flag))
+                                return rv;
 
                         mtip_process_errors(dd, port_stat & PORT_IRQ_ERR);
                 }
@@ -1015,6 +1126,39 @@ static void mtip_issue_non_ncq_command(struct mtip_port *port, int tag)
                 port->cmd_issue[MTIP_TAG_INDEX(tag)]);
 }
 
+static bool mtip_pause_ncq(struct mtip_port *port,
+                                struct host_to_dev_fis *fis)
+{
+        struct host_to_dev_fis *reply;
+        unsigned long task_file_data;
+
+        reply = port->rxfis + RX_FIS_D2H_REG;
+        task_file_data = readl(port->mmio+PORT_TFDATA);
+
+        if ((task_file_data & 1) || (fis->command == ATA_CMD_SEC_ERASE_UNIT))
+                return false;
+
+        if (fis->command == ATA_CMD_SEC_ERASE_PREP) {
+                set_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
+                port->ic_pause_timer = jiffies;
+                return true;
+        } else if ((fis->command == ATA_CMD_DOWNLOAD_MICRO) &&
+                                        (fis->features == 0x03)) {
+                set_bit(MTIP_PF_DM_ACTIVE_BIT, &port->flags);
+                port->ic_pause_timer = jiffies;
+                return true;
+        } else if ((fis->command == ATA_CMD_SEC_ERASE_UNIT) ||
+                ((fis->command == 0xFC) &&
+                        (fis->features == 0x27 || fis->features == 0x72 ||
+                         fis->features == 0x62 || fis->features == 0x26))) {
+                /* Com reset after secure erase or lowlevel format */
+                mtip_restart_port(port);
+                return false;
+        }
+
+        return false;
+}
+
 /*
  * Wait for port to quiesce
  *
@@ -1033,11 +1177,13 @@ static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout)
 
         to = jiffies + msecs_to_jiffies(timeout);
         do {
-                if (test_bit(MTIP_FLAG_SVC_THD_ACTIVE_BIT, &port->flags) &&
-                        test_bit(MTIP_FLAG_ISSUE_CMDS_BIT, &port->flags)) {
+                if (test_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags) &&
+                        test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags)) {
                         msleep(20);
                         continue; /* svc thd is actively issuing commands */
                 }
+                if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &port->dd->dd_flag))
+                        return -EFAULT;
                 /*
                  * Ignore s_active bit 0 of array element 0.
                  * This bit will always be set
@@ -1074,7 +1220,7 @@ static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout)
  *      -EAGAIN  Time out waiting for command to complete.
  */
 static int mtip_exec_internal_command(struct mtip_port *port,
-                                        void *fis,
+                                        struct host_to_dev_fis *fis,
                                         int fis_len,
                                         dma_addr_t buffer,
                                         int buf_len,
@@ -1084,8 +1230,9 @@ static int mtip_exec_internal_command(struct mtip_port *port,
 {
         struct mtip_cmd_sg *command_sg;
         DECLARE_COMPLETION_ONSTACK(wait);
-        int rv = 0;
+        int rv = 0, ready2go = 1;
         struct mtip_cmd *int_cmd = &port->commands[MTIP_TAG_INTERNAL];
+        unsigned long to;
 
         /* Make sure the buffer is 8 byte aligned. This is asic specific. */
         if (buffer & 0x00000007) {
@@ -1094,23 +1241,38 @@ static int mtip_exec_internal_command(struct mtip_port *port,
                 return -EFAULT;
         }
 
-        /* Only one internal command should be running at a time */
-        if (test_and_set_bit(MTIP_TAG_INTERNAL, port->allocated)) {
+        to = jiffies + msecs_to_jiffies(timeout);
+        do {
+                ready2go = !test_and_set_bit(MTIP_TAG_INTERNAL,
+                                                port->allocated);
+                if (ready2go)
+                        break;
+                mdelay(100);
+        } while (time_before(jiffies, to));
+        if (!ready2go) {
                 dev_warn(&port->dd->pdev->dev,
-                        "Internal command already active\n");
+                        "Internal cmd active. new cmd [%02X]\n", fis->command);
                 return -EBUSY;
         }
-        set_bit(MTIP_FLAG_IC_ACTIVE_BIT, &port->flags);
+        set_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags);
+        port->ic_pause_timer = 0;
+
+        if (fis->command == ATA_CMD_SEC_ERASE_UNIT)
+                clear_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
+        else if (fis->command == ATA_CMD_DOWNLOAD_MICRO)
+                clear_bit(MTIP_PF_DM_ACTIVE_BIT, &port->flags);
 
         if (atomic == GFP_KERNEL) {
-                /* wait for io to complete if non atomic */
-                if (mtip_quiesce_io(port, 5000) < 0) {
-                        dev_warn(&port->dd->pdev->dev,
-                                "Failed to quiesce IO\n");
-                        release_slot(port, MTIP_TAG_INTERNAL);
-                        clear_bit(MTIP_FLAG_IC_ACTIVE_BIT, &port->flags);
-                        wake_up_interruptible(&port->svc_wait);
-                        return -EBUSY;
+                if (fis->command != ATA_CMD_STANDBYNOW1) {
+                        /* wait for io to complete if non atomic */
+                        if (mtip_quiesce_io(port, 5000) < 0) {
+                                dev_warn(&port->dd->pdev->dev,
+                                        "Failed to quiesce IO\n");
+                                release_slot(port, MTIP_TAG_INTERNAL);
+                                clear_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags);
+                                wake_up_interruptible(&port->svc_wait);
+                                return -EBUSY;
+                        }
                 }
 
                 /* Set the completion function and data for the command. */
@@ -1120,7 +1282,7 @@ static int mtip_exec_internal_command(struct mtip_port *port,
         } else {
                 /* Clear completion - we're going to poll */
                 int_cmd->comp_data = NULL;
-                int_cmd->comp_func = NULL;
+                int_cmd->comp_func = mtip_null_completion;
         }
 
         /* Copy the command to the command table */
@@ -1159,6 +1321,12 @@ static int mtip_exec_internal_command(struct mtip_port *port,
                                 "Internal command did not complete [%d] "
                                 "within timeout of  %lu ms\n",
                                 atomic, timeout);
+                        if (mtip_check_surprise_removal(port->dd->pdev) ||
+                                test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
+                                                &port->dd->dd_flag)) {
+                                rv = -ENXIO;
+                                goto exec_ic_exit;
+                        }
                         rv = -EAGAIN;
                 }
 
@@ -1166,31 +1334,59 @@ static int mtip_exec_internal_command(struct mtip_port *port,
                         & (1 << MTIP_TAG_INTERNAL)) {
                         dev_warn(&port->dd->pdev->dev,
                                 "Retiring internal command but CI is 1.\n");
+                        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
+                                                &port->dd->dd_flag)) {
+                                hba_reset_nosleep(port->dd);
+                                rv = -ENXIO;
+                        } else {
+                                mtip_restart_port(port);
+                                rv = -EAGAIN;
+                        }
+                        goto exec_ic_exit;
                 }
 
         } else {
                 /* Spin for <timeout> checking if command still outstanding */
                 timeout = jiffies + msecs_to_jiffies(timeout);
-
-                while ((readl(
-                        port->cmd_issue[MTIP_TAG_INTERNAL])
-                        & (1 << MTIP_TAG_INTERNAL))
-                        && time_before(jiffies, timeout))
-                        ;
+                while ((readl(port->cmd_issue[MTIP_TAG_INTERNAL])
+                                & (1 << MTIP_TAG_INTERNAL))
+                                && time_before(jiffies, timeout)) {
+                        if (mtip_check_surprise_removal(port->dd->pdev)) {
+                                rv = -ENXIO;
+                                goto exec_ic_exit;
+                        }
+                        if ((fis->command != ATA_CMD_STANDBYNOW1) &&
+                                test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
+                                                &port->dd->dd_flag)) {
+                                rv = -ENXIO;
+                                goto exec_ic_exit;
+                        }
+                }
 
                 if (readl(port->cmd_issue[MTIP_TAG_INTERNAL])
                         & (1 << MTIP_TAG_INTERNAL)) {
                         dev_err(&port->dd->pdev->dev,
-                                "Internal command did not complete [%d]\n",
-                                atomic);
+                                "Internal command did not complete [atomic]\n");
                         rv = -EAGAIN;
+                        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
+                                                &port->dd->dd_flag)) {
+                                hba_reset_nosleep(port->dd);
+                                rv = -ENXIO;
+                        } else {
+                                mtip_restart_port(port);
+                                rv = -EAGAIN;
+                        }
                 }
         }
-
+exec_ic_exit:
         /* Clear the allocated and active bits for the internal command. */
         atomic_set(&int_cmd->active, 0);
         release_slot(port, MTIP_TAG_INTERNAL);
-        clear_bit(MTIP_FLAG_IC_ACTIVE_BIT, &port->flags);
+        if (rv >= 0 && mtip_pause_ncq(port, fis)) {
+                /* NCQ paused */
+                return rv;
+        }
+        clear_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags);
         wake_up_interruptible(&port->svc_wait);
 
         return rv;
@@ -1240,6 +1436,9 @@ static int mtip_get_identify(struct mtip_port *port, void __user *user_buffer)
         int rv = 0;
         struct host_to_dev_fis fis;
 
+        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &port->dd->dd_flag))
+                return -EFAULT;
+
         /* Build the FIS. */
         memset(&fis, 0, sizeof(struct host_to_dev_fis));
         fis.type        = 0x27;
@@ -1313,6 +1512,7 @@ static int mtip_standby_immediate(struct mtip_port *port)
 {
         int rv;
         struct host_to_dev_fis  fis;
+        unsigned long start;
 
         /* Build the FIS. */
         memset(&fis, 0, sizeof(struct host_to_dev_fis));
@@ -1320,15 +1520,150 @@ static int mtip_standby_immediate(struct mtip_port *port)
         fis.opts        = 1 << 7;
         fis.command     = ATA_CMD_STANDBYNOW1;
 
-        /* Execute the command.  Use a 15-second timeout for large drives. */
+        start = jiffies;
         rv = mtip_exec_internal_command(port,
                                         &fis,
                                         5,
                                         0,
                                         0,
                                         0,
-                                        GFP_KERNEL,
+                                        GFP_ATOMIC,
                                         15000);
+        dbg_printk(MTIP_DRV_NAME "Time taken to complete standby cmd: %d ms\n",
+                        jiffies_to_msecs(jiffies - start));
+        if (rv)
+                dev_warn(&port->dd->pdev->dev,
+                        "STANDBY IMMEDIATE command failed.\n");
+
+        return rv;
+}
+
+/*
+ * Issue a READ LOG EXT command to the device.
+ *
+ * @port        pointer to the port structure.
+ * @page        page number to fetch
+ * @buffer      pointer to buffer
+ * @buffer_dma  dma address corresponding to @buffer
+ * @sectors     page length to fetch, in sectors
+ *
+ * return value
+ *      @rv     return value from mtip_exec_internal_command()
+ */
+static int mtip_read_log_page(struct mtip_port *port, u8 page, u16 *buffer,
+                                dma_addr_t buffer_dma, unsigned int sectors)
+{
+        struct host_to_dev_fis fis;
+
+        memset(&fis, 0, sizeof(struct host_to_dev_fis));
+        fis.type        = 0x27;
+        fis.opts        = 1 << 7;
+        fis.command     = ATA_CMD_READ_LOG_EXT;
+        fis.sect_count  = sectors & 0xFF;
+        fis.sect_cnt_ex = (sectors >> 8) & 0xFF;
+        fis.lba_low     = page;
+        fis.lba_mid     = 0;
+        fis.device      = ATA_DEVICE_OBS;
+
+        memset(buffer, 0, sectors * ATA_SECT_SIZE);
+
+        return mtip_exec_internal_command(port,
+                                        &fis,
+                                        5,
+                                        buffer_dma,
+                                        sectors * ATA_SECT_SIZE,
+                                        0,
+                                        GFP_ATOMIC,
+                                        MTIP_INTERNAL_COMMAND_TIMEOUT_MS);
+}
+
+/*
+ * Issue a SMART READ DATA command to the device.
+ *
+ * @port        pointer to the port structure.
+ * @buffer      pointer to buffer
+ * @buffer_dma  dma address corresponding to @buffer
+ *
+ * return value
+ *      @rv     return value from mtip_exec_internal_command()
+ */
+static int mtip_get_smart_data(struct mtip_port *port, u8 *buffer,
+                                        dma_addr_t buffer_dma)
+{
+        struct host_to_dev_fis fis;
+
+        memset(&fis, 0, sizeof(struct host_to_dev_fis));
+        fis.type        = 0x27;
+        fis.opts        = 1 << 7;
+        fis.command     = ATA_CMD_SMART;
+        fis.features    = 0xD0;
+        fis.sect_count  = 1;
+        fis.lba_mid     = 0x4F;
+        fis.lba_hi      = 0xC2;
+        fis.device      = ATA_DEVICE_OBS;
+
+        return mtip_exec_internal_command(port,
+                                        &fis,
+                                        5,
+                                        buffer_dma,
+                                        ATA_SECT_SIZE,
+                                        0,
+                                        GFP_ATOMIC,
+                                        15000);
+}
+
+/*
+ * Get the value of a smart attribute
+ *
+ * @port        pointer to the port structure
+ * @id          attribute number
+ * @attrib      pointer to return attrib information corresponding to @id
+ *
+ * return value
+ *      -EINVAL NULL buffer passed or unsupported attribute @id.
+ *      -EPERM  Identify data not valid, SMART not supported or not enabled
+ */
+static int mtip_get_smart_attr(struct mtip_port *port, unsigned int id,
+                                                struct smart_attr *attrib)
+{
+        int rv, i;
+        struct smart_attr *pattr;
+
+        if (!attrib)
+                return -EINVAL;
+
+        if (!port->identify_valid) {
+                dev_warn(&port->dd->pdev->dev, "IDENTIFY DATA not valid\n");
+                return -EPERM;
+        }
+        if (!(port->identify[82] & 0x1)) {
+                dev_warn(&port->dd->pdev->dev, "SMART not supported\n");
+                return -EPERM;
+        }
+        if (!(port->identify[85] & 0x1)) {
+                dev_warn(&port->dd->pdev->dev, "SMART not enabled\n");
+                return -EPERM;
+        }
+
+        memset(port->smart_buf, 0, ATA_SECT_SIZE);
+        rv = mtip_get_smart_data(port, port->smart_buf, port->smart_buf_dma);
+        if (rv) {
+                dev_warn(&port->dd->pdev->dev, "Failed to ge SMART data\n");
+                return rv;
+        }
+
+        pattr = (struct smart_attr *)(port->smart_buf + 2);
+        for (i = 0; i < 29; i++, pattr++)
+                if (pattr->attr_id == id) {
+                        memcpy(attrib, pattr, sizeof(struct smart_attr));
+                        break;
+                }
+
+        if (i == 29) {
+                dev_warn(&port->dd->pdev->dev,
+                        "Query for invalid SMART attribute ID\n");
+                rv = -EINVAL;
+        }
 
         return rv;
 }
@@ -1504,10 +1839,7 @@ static int exec_drive_task(struct mtip_port *port, u8 *command)
         fis.cyl_hi      = command[5];
         fis.device      = command[6] & ~0x10; /* Clear the dev bit*/
 
-
-        dbg_printk(MTIP_DRV_NAME "%s: User Command: cmd %x, feat %x, "
-                "nsect %x, sect %x, lcyl %x, "
-                "hcyl %x, sel %x\n",
+        dbg_printk(MTIP_DRV_NAME " %s: User Command: cmd %x, feat %x, nsect %x, sect %x, lcyl %x, hcyl %x, sel %x\n",
                 __func__,
                 command[0],
                 command[1],
@@ -1534,8 +1866,7 @@ static int exec_drive_task(struct mtip_port *port, u8 *command)
         command[4] = reply->cyl_low;
         command[5] = reply->cyl_hi;
 
-        dbg_printk(MTIP_DRV_NAME "%s: Completion Status: stat %x, "
-                "err %x , cyl_lo %x cyl_hi %x\n",
+        dbg_printk(MTIP_DRV_NAME " %s: Completion Status: stat %x, err %x , cyl_lo %x cyl_hi %x\n",
                 __func__,
                 command[0],
                 command[1],
@@ -1578,7 +1909,7 @@ static int exec_drive_command(struct mtip_port *port, u8 *command,
         }
 
         dbg_printk(MTIP_DRV_NAME
-                "%s: User Command: cmd %x, sect %x, "
+                " %s: User Command: cmd %x, sect %x, "
                 "feat %x, sectcnt %x\n",
                 __func__,
                 command[0],
@@ -1607,7 +1938,7 @@ static int exec_drive_command(struct mtip_port *port, u8 *command,
         command[2] = command[3];
 
         dbg_printk(MTIP_DRV_NAME
-                "%s: Completion Status: stat %x, "
+                " %s: Completion Status: stat %x, "
                 "err %x, cmd %x\n",
                 __func__,
                 command[0],
@@ -1810,9 +2141,10 @@ static int exec_drive_taskfile(struct driver_data *dd,
         }
 
         dbg_printk(MTIP_DRV_NAME
-                "taskfile: cmd %x, feat %x, nsect %x,"
+                " %s: cmd %x, feat %x, nsect %x,"
                 " sect/lbal %x, lcyl/lbam %x, hcyl/lbah %x,"
                 " head/dev %x\n",
+                __func__,
                 fis.command,
                 fis.features,
                 fis.sect_count,
@@ -1823,8 +2155,8 @@ static int exec_drive_taskfile(struct driver_data *dd,
 
         switch (fis.command) {
         case ATA_CMD_DOWNLOAD_MICRO:
-                /* Change timeout for Download Microcode to 60 seconds.*/
-                timeout = 60000;
+                /* Change timeout for Download Microcode to 2 minutes */
+                timeout = 120000;
                 break;
         case ATA_CMD_SEC_ERASE_UNIT:
                 /* Change timeout for Security Erase Unit to 4 minutes.*/
@@ -1840,8 +2172,8 @@ static int exec_drive_taskfile(struct driver_data *dd,
                 timeout = 10000;
                 break;
         case ATA_CMD_SMART:
-                /* Change timeout for vendor unique command to 10 secs */
-                timeout = 10000;
+                /* Change timeout for vendor unique command to 15 secs */
+                timeout = 15000;
                 break;
         default:
                 timeout = MTIP_IOCTL_COMMAND_TIMEOUT_MS;
@@ -1903,18 +2235,8 @@ static int exec_drive_taskfile(struct driver_data *dd,
                 req_task->hob_ports[1] = reply->features_ex;
                 req_task->hob_ports[2] = reply->sect_cnt_ex;
         }
-
-        /* Com rest after secure erase or lowlevel format */
-        if (((fis.command == ATA_CMD_SEC_ERASE_UNIT) ||
-                ((fis.command == 0xFC) &&
-                        (fis.features == 0x27 || fis.features == 0x72 ||
-                         fis.features == 0x62 || fis.features == 0x26))) &&
-                         !(reply->command & 1)) {
-                mtip_restart_port(dd->port);
-        }
-
         dbg_printk(MTIP_DRV_NAME
-                "%s: Completion: stat %x,"
+                " %s: Completion: stat %x,"
                 "err %x, sect_cnt %x, lbalo %x,"
                 "lbamid %x, lbahi %x, dev %x\n",
                 __func__,
@@ -2080,14 +2402,10 @@ static void mtip_hw_submit_io(struct driver_data *dd, sector_t start,
         struct host_to_dev_fis  *fis;
         struct mtip_port *port = dd->port;
         struct mtip_cmd *command = &port->commands[tag];
+        int dma_dir = (dir == READ) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
 
         /* Map the scatter list for DMA access */
-        if (dir == READ)
-                nents = dma_map_sg(&dd->pdev->dev, command->sg,
-                                        nents, DMA_FROM_DEVICE);
-        else
-                nents = dma_map_sg(&dd->pdev->dev, command->sg,
-                                        nents, DMA_TO_DEVICE);
+        nents = dma_map_sg(&dd->pdev->dev, command->sg, nents, dma_dir);
 
         command->scatter_ents = nents;
 
@@ -2127,7 +2445,7 @@ static void mtip_hw_submit_io(struct driver_data *dd, sector_t start,
          */
         command->comp_data = dd;
         command->comp_func = mtip_async_complete;
-        command->direction = (dir == READ ? DMA_FROM_DEVICE : DMA_TO_DEVICE);
+        command->direction = dma_dir;
 
         /*
          * Set the completion function and data for the command passed
@@ -2140,19 +2458,16 @@ static void mtip_hw_submit_io(struct driver_data *dd, sector_t start,
          * To prevent this command from being issued
          * if an internal command is in progress or error handling is active.
          */
-        if (unlikely(test_bit(MTIP_FLAG_IC_ACTIVE_BIT, &port->flags) ||
-                        test_bit(MTIP_FLAG_EH_ACTIVE_BIT, &port->flags))) {
+        if (port->flags & MTIP_PF_PAUSE_IO) {
                 set_bit(tag, port->cmds_to_issue);
-                set_bit(MTIP_FLAG_ISSUE_CMDS_BIT, &port->flags);
+                set_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags);
                 return;
         }
 
         /* Issue the command to the hardware */
         mtip_issue_ncq_command(port, tag);
 
-        /* Set the command's timeout value.*/
-        port->commands[tag].comp_time = jiffies + msecs_to_jiffies(
-                                        MTIP_NCQ_COMMAND_TIMEOUT_MS);
+        return;
 }
 
 /*
@@ -2191,6 +2506,10 @@ static struct scatterlist *mtip_hw_get_scatterlist(struct driver_data *dd,
         down(&dd->port->cmd_slot);
         *tag = get_slot(dd->port);
 
+        if (unlikely(test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag))) {
+                up(&dd->port->cmd_slot);
+                return NULL;
+        }
         if (unlikely(*tag < 0))
                 return NULL;
 
@@ -2207,7 +2526,7 @@ static struct scatterlist *mtip_hw_get_scatterlist(struct driver_data *dd,
  * return value
  *      The size, in bytes, of the data copied into buf.
  */
-static ssize_t hw_show_registers(struct device *dev,
+static ssize_t mtip_hw_show_registers(struct device *dev,
                                 struct device_attribute *attr,
                                 char *buf)
 {
@@ -2216,7 +2535,7 @@ static ssize_t hw_show_registers(struct device *dev,
         int size = 0;
         int n;
 
-        size += sprintf(&buf[size], "%s:\ns_active:\n", __func__);
+        size += sprintf(&buf[size], "S ACTive:\n");
 
         for (n = 0; n < dd->slot_groups; n++)
                 size += sprintf(&buf[size], "0x%08x\n",
@@ -2240,20 +2559,39 @@ static ssize_t hw_show_registers(struct device *dev,
                                  group_allocated);
         }
 
-        size += sprintf(&buf[size], "completed:\n");
+        size += sprintf(&buf[size], "Completed:\n");
 
         for (n = 0; n < dd->slot_groups; n++)
                 size += sprintf(&buf[size], "0x%08x\n",
                                 readl(dd->port->completed[n]));
 
-        size += sprintf(&buf[size], "PORT_IRQ_STAT 0x%08x\n",
+        size += sprintf(&buf[size], "PORT IRQ STAT : 0x%08x\n",
                                 readl(dd->port->mmio + PORT_IRQ_STAT));
-        size += sprintf(&buf[size], "HOST_IRQ_STAT 0x%08x\n",
+        size += sprintf(&buf[size], "HOST IRQ STAT : 0x%08x\n",
                                 readl(dd->mmio + HOST_IRQ_STAT));
 
         return size;
 }
-static DEVICE_ATTR(registers, S_IRUGO, hw_show_registers, NULL);
+
+static ssize_t mtip_hw_show_status(struct device *dev,
+                                struct device_attribute *attr,
+                                char *buf)
+{
+        struct driver_data *dd = dev_to_disk(dev)->private_data;
+        int size = 0;
+
+        if (test_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag))
+                size += sprintf(buf, "%s", "thermal_shutdown\n");
+        else if (test_bit(MTIP_DDF_WRITE_PROTECT_BIT, &dd->dd_flag))
+                size += sprintf(buf, "%s", "write_protect\n");
+        else
+                size += sprintf(buf, "%s", "online\n");
+
+        return size;
+}
+
+static DEVICE_ATTR(registers, S_IRUGO, mtip_hw_show_registers, NULL);
+static DEVICE_ATTR(status, S_IRUGO, mtip_hw_show_status, NULL);
 
 /*
  * Create the sysfs related attributes.
@@ -2272,7 +2610,10 @@ static int mtip_hw_sysfs_init(struct driver_data *dd, struct kobject *kobj)
 
         if (sysfs_create_file(kobj, &dev_attr_registers.attr))
                 dev_warn(&dd->pdev->dev,
-                        "Error creating registers sysfs entry\n");
+                        "Error creating 'registers' sysfs entry\n");
+        if (sysfs_create_file(kobj, &dev_attr_status.attr))
+                dev_warn(&dd->pdev->dev,
+                        "Error creating 'status' sysfs entry\n");
         return 0;
 }
 
@@ -2292,6 +2633,7 @@ static int mtip_hw_sysfs_exit(struct driver_data *dd, struct kobject *kobj)
                 return -EINVAL;
 
         sysfs_remove_file(kobj, &dev_attr_registers.attr);
+        sysfs_remove_file(kobj, &dev_attr_status.attr);
 
         return 0;
 }
@@ -2384,10 +2726,12 @@ static int mtip_ftl_rebuild_poll(struct driver_data *dd)
                 "FTL rebuild in progress. Polling for completion.\n");
 
         start = jiffies;
-        dd->ftlrebuildflag = 1;
         timeout = jiffies + msecs_to_jiffies(MTIP_FTL_REBUILD_TIMEOUT_MS);
 
         do {
+                if (unlikely(test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
+                                &dd->dd_flag)))
+                        return -EFAULT;
                 if (mtip_check_surprise_removal(dd->pdev))
                         return -EFAULT;
 
@@ -2408,22 +2752,17 @@ static int mtip_ftl_rebuild_poll(struct driver_data *dd)
                         dev_warn(&dd->pdev->dev,
                                 "FTL rebuild complete (%d secs).\n",
                         jiffies_to_msecs(jiffies - start) / 1000);
-                        dd->ftlrebuildflag = 0;
                         mtip_block_initialize(dd);
-                        break;
+                        return 0;
                 }
                 ssleep(10);
         } while (time_before(jiffies, timeout));
 
         /* Check for timeout */
-        if (dd->ftlrebuildflag) {
-                dev_err(&dd->pdev->dev,
+        dev_err(&dd->pdev->dev,
                 "Timed out waiting for FTL rebuild to complete (%d secs).\n",
                 jiffies_to_msecs(jiffies - start) / 1000);
-                return -EFAULT;
-        }
-
-        return 0;
+        return -EFAULT;
 }
 
 /*
@@ -2448,14 +2787,17 @@ static int mtip_service_thread(void *data)
                  * is in progress nor error handling is active
                  */
                 wait_event_interruptible(port->svc_wait, (port->flags) &&
-                        !test_bit(MTIP_FLAG_IC_ACTIVE_BIT, &port->flags) &&
-                        !test_bit(MTIP_FLAG_EH_ACTIVE_BIT, &port->flags));
+                        !(port->flags & MTIP_PF_PAUSE_IO));
 
                 if (kthread_should_stop())
                         break;
 
-                set_bit(MTIP_FLAG_SVC_THD_ACTIVE_BIT, &port->flags);
-                if (test_bit(MTIP_FLAG_ISSUE_CMDS_BIT, &port->flags)) {
+                if (unlikely(test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
+                                &dd->dd_flag)))
+                        break;
+
+                set_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags);
+                if (test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags)) {
                         slot = 1;
                         /* used to restrict the loop to one iteration */
                         slot_start = num_cmd_slots;
@@ -2480,21 +2822,19 @@ static int mtip_service_thread(void *data)
                                 /* Issue the command to the hardware */
                                 mtip_issue_ncq_command(port, slot);
 
-                                /* Set the command's timeout value.*/
-                                port->commands[slot].comp_time = jiffies +
-                                msecs_to_jiffies(MTIP_NCQ_COMMAND_TIMEOUT_MS);
-
                                 clear_bit(slot, port->cmds_to_issue);
                         }
 
-                        clear_bit(MTIP_FLAG_ISSUE_CMDS_BIT, &port->flags);
-                } else if (test_bit(MTIP_FLAG_REBUILD_BIT, &port->flags)) {
-                        mtip_ftl_rebuild_poll(dd);
-                        clear_bit(MTIP_FLAG_REBUILD_BIT, &port->flags);
+                        clear_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags);
+                } else if (test_bit(MTIP_PF_REBUILD_BIT, &port->flags)) {
+                        if (!mtip_ftl_rebuild_poll(dd))
+                                set_bit(MTIP_DDF_REBUILD_FAILED_BIT,
+                                                        &dd->dd_flag);
+                        clear_bit(MTIP_PF_REBUILD_BIT, &port->flags);
                 }
-                clear_bit(MTIP_FLAG_SVC_THD_ACTIVE_BIT, &port->flags);
+                clear_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags);
 
-                if (test_bit(MTIP_FLAG_SVC_THD_SHOULD_STOP_BIT, &port->flags))
+                if (test_bit(MTIP_PF_SVC_THD_STOP_BIT, &port->flags))
                         break;
         }
         return 0;
@@ -2513,6 +2853,9 @@ static int mtip_hw_init(struct driver_data *dd)
         int i;
         int rv;
         unsigned int num_command_slots;
+        unsigned long timeout, timetaken;
+        unsigned char *buf;
+        struct smart_attr attr242;
 
         dd->mmio = pcim_iomap_table(dd->pdev)[MTIP_ABAR];
 
@@ -2547,7 +2890,7 @@ static int mtip_hw_init(struct driver_data *dd)
         /* Allocate memory for the command list. */
         dd->port->command_list =
                 dmam_alloc_coherent(&dd->pdev->dev,
-                        HW_PORT_PRIV_DMA_SZ + (ATA_SECT_SIZE * 2),
+                        HW_PORT_PRIV_DMA_SZ + (ATA_SECT_SIZE * 4),
                         &dd->port->command_list_dma,
                         GFP_KERNEL);
         if (!dd->port->command_list) {
@@ -2560,7 +2903,7 @@ static int mtip_hw_init(struct driver_data *dd)
         /* Clear the memory we have allocated. */
         memset(dd->port->command_list,
                 0,
-                HW_PORT_PRIV_DMA_SZ + (ATA_SECT_SIZE * 2));
+                HW_PORT_PRIV_DMA_SZ + (ATA_SECT_SIZE * 4));
 
         /* Setup the addresse of the RX FIS. */
         dd->port->rxfis     = dd->port->command_list + HW_CMD_SLOT_SZ;
@@ -2576,10 +2919,19 @@ static int mtip_hw_init(struct driver_data *dd)
         dd->port->identify_dma = dd->port->command_tbl_dma +
                                         HW_CMD_TBL_AR_SZ;
 
-        /* Setup the address of the sector buffer. */
+        /* Setup the address of the sector buffer - for some non-ncq cmds */
         dd->port->sector_buffer = (void *) dd->port->identify + ATA_SECT_SIZE;
         dd->port->sector_buffer_dma = dd->port->identify_dma + ATA_SECT_SIZE;
 
+        /* Setup the address of the log buf - for read log command */
+        dd->port->log_buf = (void *)dd->port->sector_buffer  + ATA_SECT_SIZE;
+        dd->port->log_buf_dma = dd->port->sector_buffer_dma + ATA_SECT_SIZE;
+
+        /* Setup the address of the smart buf - for smart read data command */
+        dd->port->smart_buf = (void *)dd->port->log_buf  + ATA_SECT_SIZE;
+        dd->port->smart_buf_dma = dd->port->log_buf_dma + ATA_SECT_SIZE;
+
+
         /* Point the command headers at the command tables. */
         for (i = 0; i < num_command_slots; i++) {
                 dd->port->commands[i].command_header =
@@ -2623,14 +2975,43 @@ static int mtip_hw_init(struct driver_data *dd)
                         dd->port->mmio + i*0x80 + PORT_SDBV;
         }
 
-        /* Reset the HBA. */
-        if (mtip_hba_reset(dd) < 0) {
-                dev_err(&dd->pdev->dev,
-                        "Card did not reset within timeout\n");
-                rv = -EIO;
+        timetaken = jiffies;
+        timeout = jiffies + msecs_to_jiffies(30000);
+        while (((readl(dd->port->mmio + PORT_SCR_STAT) & 0x0F) != 0x03) &&
+                 time_before(jiffies, timeout)) {
+                mdelay(100);
+        }
+        if (unlikely(mtip_check_surprise_removal(dd->pdev))) {
+                timetaken = jiffies - timetaken;
+                dev_warn(&dd->pdev->dev,
+                        "Surprise removal detected at %u ms\n",
+                        jiffies_to_msecs(timetaken));
+                rv = -ENODEV;
+                goto out2 ;
+        }
+        if (unlikely(test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag))) {
+                timetaken = jiffies - timetaken;
+                dev_warn(&dd->pdev->dev,
+                        "Removal detected at %u ms\n",
+                        jiffies_to_msecs(timetaken));
+                rv = -EFAULT;
                 goto out2;
         }
 
+        /* Conditionally reset the HBA. */
+        if (!(readl(dd->mmio + HOST_CAP) & HOST_CAP_NZDMA)) {
+                if (mtip_hba_reset(dd) < 0) {
+                        dev_err(&dd->pdev->dev,
+                                "Card did not reset within timeout\n");
+                        rv = -EIO;
+                        goto out2;
+                }
+        } else {
+                /* Clear any pending interrupts on the HBA */
+                writel(readl(dd->mmio + HOST_IRQ_STAT),
+                        dd->mmio + HOST_IRQ_STAT);
+        }
+
         mtip_init_port(dd->port);
         mtip_start_port(dd->port);
 
@@ -2660,6 +3041,12 @@ static int mtip_hw_init(struct driver_data *dd)
         mod_timer(&dd->port->cmd_timer,
                 jiffies + msecs_to_jiffies(MTIP_TIMEOUT_CHECK_PERIOD));
 
+
+        if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag)) {
+                rv = -EFAULT;
+                goto out3;
+        }
+
         if (mtip_get_identify(dd->port, NULL) < 0) {
                 rv = -EFAULT;
                 goto out3;
@@ -2667,10 +3054,47 @@ static int mtip_hw_init(struct driver_data *dd)
 
         if (*(dd->port->identify + MTIP_FTL_REBUILD_OFFSET) ==
                 MTIP_FTL_REBUILD_MAGIC) {
-                set_bit(MTIP_FLAG_REBUILD_BIT, &dd->port->flags);
+                set_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags);
                 return MTIP_FTL_REBUILD_MAGIC;
         }
         mtip_dump_identify(dd->port);
+
+        /* check write protect, over temp and rebuild statuses */
+        rv = mtip_read_log_page(dd->port, ATA_LOG_SATA_NCQ,
+                                dd->port->log_buf,
+                                dd->port->log_buf_dma, 1);
+        if (rv) {
+                dev_warn(&dd->pdev->dev,
+                        "Error in READ LOG EXT (10h) command\n");
+                /* non-critical error, don't fail the load */
+        } else {
+                buf = (unsigned char *)dd->port->log_buf;
+                if (buf[259] & 0x1) {
+                        dev_info(&dd->pdev->dev,
+                                "Write protect bit is set.\n");
+                        set_bit(MTIP_DDF_WRITE_PROTECT_BIT, &dd->dd_flag);
+                }
+                if (buf[288] == 0xF7) {
+                        dev_info(&dd->pdev->dev,
+                                "Exceeded Tmax, drive in thermal shutdown.\n");
+                        set_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag);
+                }
+                if (buf[288] == 0xBF) {
+                        dev_info(&dd->pdev->dev,
+                                "Drive indicates rebuild has failed.\n");
+                        /* TODO */
+                }
+        }
+
+        /* get write protect progess */
+        memset(&attr242, 0, sizeof(struct smart_attr));
+        if (mtip_get_smart_attr(dd->port, 242, &attr242))
+                dev_warn(&dd->pdev->dev,
+                                "Unable to check write protect progress\n");
+        else
+                dev_info(&dd->pdev->dev,
+                                "Write protect progress: %d%% (%d blocks)\n",
+                                attr242.cur, attr242.data);
         return rv;
 
 out3:
@@ -2688,7 +3112,7 @@ out2:
 
         /* Free the command/command header memory. */
         dmam_free_coherent(&dd->pdev->dev,
-                                HW_PORT_PRIV_DMA_SZ + (ATA_SECT_SIZE * 2),
+                                HW_PORT_PRIV_DMA_SZ + (ATA_SECT_SIZE * 4),
                                 dd->port->command_list,
                                 dd->port->command_list_dma);
 out1:
@@ -2712,9 +3136,12 @@ static int mtip_hw_exit(struct driver_data *dd)
          * Send standby immediate (E0h) to the drive so that it
          * saves its state.
          */
-        if (atomic_read(&dd->drv_cleanup_done) != true) {
+        if (!test_bit(MTIP_DDF_CLEANUP_BIT, &dd->dd_flag)) {
 
-                mtip_standby_immediate(dd->port);
+                if (!test_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags))
+                        if (mtip_standby_immediate(dd->port))
+                                dev_warn(&dd->pdev->dev,
+                                        "STANDBY IMMEDIATE failed\n");
 
                 /* de-initialize the port. */
                 mtip_deinit_port(dd->port);
@@ -2734,7 +3161,7 @@ static int mtip_hw_exit(struct driver_data *dd)
 
         /* Free the command/command header memory. */
         dmam_free_coherent(&dd->pdev->dev,
-                        HW_PORT_PRIV_DMA_SZ + (ATA_SECT_SIZE * 2),
+                        HW_PORT_PRIV_DMA_SZ + (ATA_SECT_SIZE * 4),
                         dd->port->command_list,
                         dd->port->command_list_dma);
         /* Free the memory allocated for the for structure. */
@@ -2892,6 +3319,9 @@ static int mtip_block_ioctl(struct block_device *dev,
         if (!dd)
                 return -ENOTTY;
 
+        if (unlikely(test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag)))
+                return -ENOTTY;
+
         switch (cmd) {
         case BLKFLSBUF:
                 return -ENOTTY;
@@ -2927,6 +3357,9 @@ static int mtip_block_compat_ioctl(struct block_device *dev,
         if (!dd)
                 return -ENOTTY;
 
+        if (unlikely(test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag)))
+                return -ENOTTY;
+
         switch (cmd) {
         case BLKFLSBUF:
                 return -ENOTTY;
@@ -3049,6 +3482,24 @@ static void mtip_make_request(struct request_queue *queue, struct bio *bio)
         int nents = 0;
         int tag = 0;
 
+        if (unlikely(dd->dd_flag & MTIP_DDF_STOP_IO)) {
+                if (unlikely(test_bit(MTIP_DDF_REMOVE_PENDING_BIT,
+                                                        &dd->dd_flag))) {
+                        bio_endio(bio, -ENXIO);
+                        return;
+                }
+                if (unlikely(test_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag))) {
+                        bio_endio(bio, -ENODATA);
+                        return;
+                }
+                if (unlikely(test_bit(MTIP_DDF_WRITE_PROTECT_BIT,
+                                                        &dd->dd_flag) &&
+                                bio_data_dir(bio))) {
+                        bio_endio(bio, -ENODATA);
+                        return;
+                }
+        }
+
         if (unlikely(!bio_has_data(bio))) {
                 blk_queue_flush(queue, 0);
                 bio_endio(bio, 0);
@@ -3061,7 +3512,7 @@ static void mtip_make_request(struct request_queue *queue, struct bio *bio)
 
                 if (unlikely((bio)->bi_vcnt > MTIP_MAX_SG)) {
                         dev_warn(&dd->pdev->dev,
-                                "Maximum number of SGL entries exceeded");
+                                "Maximum number of SGL entries exceeded\n");
                         bio_io_error(bio);
                         mtip_hw_release_scatterlist(dd, tag);
                         return;
@@ -3210,8 +3661,10 @@ skip_create_disk:
                 kobject_put(kobj);
         }
 
-        if (dd->mtip_svc_handler)
+        if (dd->mtip_svc_handler) {
+                set_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag);
                 return rv; /* service thread created for handling rebuild */
+        }
 
 start_service_thread:
         sprintf(thd_name, "mtip_svc_thd_%02d", index);
@@ -3220,12 +3673,15 @@ start_service_thread:
                                                 dd, thd_name);
 
         if (IS_ERR(dd->mtip_svc_handler)) {
-                printk(KERN_ERR "mtip32xx: service thread failed to start\n");
+                dev_err(&dd->pdev->dev, "service thread failed to start\n");
                 dd->mtip_svc_handler = NULL;
                 rv = -EFAULT;
                 goto kthread_run_error;
         }
 
+        if (wait_for_rebuild == MTIP_FTL_REBUILD_MAGIC)
+                rv = wait_for_rebuild;
+
         return rv;
 
 kthread_run_error:
@@ -3266,16 +3722,18 @@ static int mtip_block_remove(struct driver_data *dd)
         struct kobject *kobj;
 
         if (dd->mtip_svc_handler) {
-                set_bit(MTIP_FLAG_SVC_THD_SHOULD_STOP_BIT, &dd->port->flags);
+                set_bit(MTIP_PF_SVC_THD_STOP_BIT, &dd->port->flags);
                 wake_up_interruptible(&dd->port->svc_wait);
                 kthread_stop(dd->mtip_svc_handler);
         }
 
-        /* Clean up the sysfs attributes managed by the protocol layer. */
-        kobj = kobject_get(&disk_to_dev(dd->disk)->kobj);
-        if (kobj) {
-                mtip_hw_sysfs_exit(dd, kobj);
-                kobject_put(kobj);
+        /* Clean up the sysfs attributes, if created */
+        if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag)) {
+                kobj = kobject_get(&disk_to_dev(dd->disk)->kobj);
+                if (kobj) {
+                        mtip_hw_sysfs_exit(dd, kobj);
+                        kobject_put(kobj);
+                }
         }
 
         /*
@@ -3283,6 +3741,11 @@ static int mtip_block_remove(struct driver_data *dd)
          * from /dev
          */
         del_gendisk(dd->disk);
+
+        spin_lock(&rssd_index_lock);
+        ida_remove(&rssd_index_ida, dd->index);
+        spin_unlock(&rssd_index_lock);
+
         blk_cleanup_queue(dd->queue);
         dd->disk  = NULL;
         dd->queue = NULL;
@@ -3312,6 +3775,11 @@ static int mtip_block_shutdown(struct driver_data *dd)
 
         /* Delete our gendisk structure, and cleanup the blk queue. */
         del_gendisk(dd->disk);
+
+        spin_lock(&rssd_index_lock);
+        ida_remove(&rssd_index_ida, dd->index);
+        spin_unlock(&rssd_index_lock);
+
         blk_cleanup_queue(dd->queue);
         dd->disk  = NULL;
         dd->queue = NULL;
@@ -3359,11 +3827,6 @@ static int mtip_pci_probe(struct pci_dev *pdev,
                 return -ENOMEM;
         }
 
-        /* Set the atomic variable as 1 in case of SRSI */
-        atomic_set(&dd->drv_cleanup_done, true);
-
-        atomic_set(&dd->resumeflag, false);
-
         /* Attach the private data to this PCI device.  */
         pci_set_drvdata(pdev, dd);
 
@@ -3420,7 +3883,8 @@ static int mtip_pci_probe(struct pci_dev *pdev,
          * instance number.
          */
         instance++;
-
+        if (rv != MTIP_FTL_REBUILD_MAGIC)
+                set_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag);
         goto done;
 
 block_initialize_err:
@@ -3434,9 +3898,6 @@ iomap_err:
         pci_set_drvdata(pdev, NULL);
         return rv;
 done:
-        /* Set the atomic variable as 0 in case of SRSI */
-        atomic_set(&dd->drv_cleanup_done, true);
-
         return rv;
 }
 
@@ -3452,8 +3913,10 @@ static void mtip_pci_remove(struct pci_dev *pdev)
         struct driver_data *dd = pci_get_drvdata(pdev);
         int counter = 0;
 
+        set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag);
+
         if (mtip_check_surprise_removal(pdev)) {
-                while (atomic_read(&dd->drv_cleanup_done) == false) {
+                while (!test_bit(MTIP_DDF_CLEANUP_BIT, &dd->dd_flag)) {
                         counter++;
                         msleep(20);
                         if (counter == 10) {
@@ -3463,8 +3926,6 @@ static void mtip_pci_remove(struct pci_dev *pdev)
                         }
                 }
         }
-        /* Set the atomic variable as 1 in case of SRSI */
-        atomic_set(&dd->drv_cleanup_done, true);
 
         /* Clean up the block layer. */
         mtip_block_remove(dd);
@@ -3493,7 +3954,7 @@ static int mtip_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
                 return -EFAULT;
         }
 
-        atomic_set(&dd->resumeflag, true);
+        set_bit(MTIP_DDF_RESUME_BIT, &dd->dd_flag);
 
         /* Disable ports & interrupts then send standby immediate */
         rv = mtip_block_suspend(dd);
@@ -3559,7 +4020,7 @@ static int mtip_pci_resume(struct pci_dev *pdev)
                 dev_err(&pdev->dev, "Unable to resume\n");
 
 err:
-        atomic_set(&dd->resumeflag, false);
+        clear_bit(MTIP_DDF_RESUME_BIT, &dd->dd_flag);
 
         return rv;
 }
@@ -3608,18 +4069,25 @@ MODULE_DEVICE_TABLE(pci, mtip_pci_tbl);
  */
 static int __init mtip_init(void)
 {
+        int error;
+
         printk(KERN_INFO MTIP_DRV_NAME " Version " MTIP_DRV_VERSION "\n");
 
         /* Allocate a major block device number to use with this driver. */
-        mtip_major = register_blkdev(0, MTIP_DRV_NAME);
-        if (mtip_major < 0) {
+        error = register_blkdev(0, MTIP_DRV_NAME);
+        if (error <= 0) {
                 printk(KERN_ERR "Unable to register block device (%d)\n",
-                mtip_major);
+                error);
                 return -EBUSY;
         }
+        mtip_major = error;
 
         /* Register our PCI operations. */
-        return pci_register_driver(&mtip_pci_driver);
+        error = pci_register_driver(&mtip_pci_driver);
+        if (error)
+                unregister_blkdev(mtip_major, MTIP_DRV_NAME);
+
+        return error;
 }
 
 /*
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index e0554a8f2233..4ef58336310a 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -34,8 +34,8 @@
 /* offset of Device Control register in PCIe extended capabilites space */
 #define PCIE_CONFIG_EXT_DEVICE_CONTROL_OFFSET   0x48
 
-/* # of times to retry timed out IOs */
-#define MTIP_MAX_RETRIES        5
+/* # of times to retry timed out/failed IOs */
+#define MTIP_MAX_RETRIES        2
 
 /* Various timeout values in ms */
 #define MTIP_NCQ_COMMAND_TIMEOUT_MS       5000
@@ -114,12 +114,41 @@
 #define __force_bit2int (unsigned int __force)
 
 /* below are bit numbers in 'flags' defined in mtip_port */
-#define MTIP_FLAG_IC_ACTIVE_BIT                 0
-#define MTIP_FLAG_EH_ACTIVE_BIT                 1
-#define MTIP_FLAG_SVC_THD_ACTIVE_BIT            2
-#define MTIP_FLAG_ISSUE_CMDS_BIT                4
-#define MTIP_FLAG_REBUILD_BIT                   5
-#define MTIP_FLAG_SVC_THD_SHOULD_STOP_BIT       8
+#define MTIP_PF_IC_ACTIVE_BIT           0 /* pio/ioctl */
+#define MTIP_PF_EH_ACTIVE_BIT           1 /* error handling */
+#define MTIP_PF_SE_ACTIVE_BIT           2 /* secure erase */
+#define MTIP_PF_DM_ACTIVE_BIT           3 /* download microcde */
+#define MTIP_PF_PAUSE_IO        ((1 << MTIP_PF_IC_ACTIVE_BIT) | \
+                                (1 << MTIP_PF_EH_ACTIVE_BIT) | \
+                                (1 << MTIP_PF_SE_ACTIVE_BIT) | \
+                                (1 << MTIP_PF_DM_ACTIVE_BIT))
+
+#define MTIP_PF_SVC_THD_ACTIVE_BIT      4
+#define MTIP_PF_ISSUE_CMDS_BIT          5
+#define MTIP_PF_REBUILD_BIT             6
+#define MTIP_PF_SVC_THD_STOP_BIT        8
+
+/* below are bit numbers in 'dd_flag' defined in driver_data */
+#define MTIP_DDF_REMOVE_PENDING_BIT     1
+#define MTIP_DDF_OVER_TEMP_BIT          2
+#define MTIP_DDF_WRITE_PROTECT_BIT      3
+#define MTIP_DDF_STOP_IO        ((1 << MTIP_DDF_REMOVE_PENDING_BIT) | \
+                                (1 << MTIP_DDF_OVER_TEMP_BIT) | \
+                                (1 << MTIP_DDF_WRITE_PROTECT_BIT))
+
+#define MTIP_DDF_CLEANUP_BIT            5
+#define MTIP_DDF_RESUME_BIT             6
+#define MTIP_DDF_INIT_DONE_BIT          7
+#define MTIP_DDF_REBUILD_FAILED_BIT     8
+
+__packed struct smart_attr{
+        u8 attr_id;
+        u16 flags;
+        u8 cur;
+        u8 worst;
+        u32 data;
+        u8 res[3];
+};
 
 /* Register Frame Information Structure (FIS), host to device. */
 struct host_to_dev_fis {
@@ -345,6 +374,12 @@ struct mtip_port {
          * when the command slot and all associated data structures
          * are no longer needed.
          */
+        u16 *log_buf;
+        dma_addr_t log_buf_dma;
+
+        u8 *smart_buf;
+        dma_addr_t smart_buf_dma;
+
         unsigned long allocated[SLOTBITS_IN_LONGS];
         /*
          * used to queue commands when an internal command is in progress
@@ -368,6 +403,7 @@ struct mtip_port {
          * Timer used to complete commands that have been active for too long.
          */
         struct timer_list cmd_timer;
+        unsigned long ic_pause_timer;
         /*
          * Semaphore used to block threads if there are no
          * command slots available.
@@ -404,13 +440,9 @@ struct driver_data {
 
         unsigned slot_groups; /* number of slot groups the product supports */
 
-        atomic_t drv_cleanup_done; /* Atomic variable for SRSI */
-
         unsigned long index; /* Index to determine the disk name */
 
-        unsigned int ftlrebuildflag; /* FTL rebuild flag */
-
-        atomic_t resumeflag; /* Atomic variable to track suspend/resume */
+        unsigned long dd_flag; /* NOTE: use atomic bit operations on this */
 
         struct task_struct *mtip_svc_handler; /* task_struct of svc thd */
 };
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index c4a60badf252..0d39f2f4294a 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -351,6 +351,7 @@ static void virtblk_config_changed_work(struct work_struct *work)
                   cap_str_10, cap_str_2);
 
         set_capacity(vblk->disk, capacity);
+        revalidate_disk(vblk->disk);
 done:
         mutex_unlock(&vblk->config_lock);
 }
@@ -374,6 +375,34 @@ static int init_vq(struct virtio_blk *vblk)
         return err;
 }
 
+/*
+ * Legacy naming scheme used for virtio devices.  We are stuck with it for
+ * virtio blk but don't ever use it for any new driver.
+ */
+static int virtblk_name_format(char *prefix, int index, char *buf, int buflen)
+{
+        const int base = 'z' - 'a' + 1;
+        char *begin = buf + strlen(prefix);
+        char *end = buf + buflen;
+        char *p;
+        int unit;
+
+        p = end - 1;
+        *p = '\0';
+        unit = base;
+        do {
+                if (p == begin)
+                        return -EINVAL;
+                *--p = 'a' + (index % unit);
+                index = (index / unit) - 1;
+        } while (index >= 0);
+
+        memmove(begin, p, end - p);
+        memcpy(buf, prefix, strlen(prefix));
+
+        return 0;
+}
+
 static int __devinit virtblk_probe(struct virtio_device *vdev)
 {
         struct virtio_blk *vblk;
@@ -442,18 +471,7 @@ static int __devinit virtblk_probe(struct virtio_device *vdev)
 
         q->queuedata = vblk;
 
-        if (index < 26) {
-                sprintf(vblk->disk->disk_name, "vd%c", 'a' + index % 26);
-        } else if (index < (26 + 1) * 26) {
-                sprintf(vblk->disk->disk_name, "vd%c%c",
-                        'a' + index / 26 - 1, 'a' + index % 26);
-        } else {
-                const unsigned int m1 = (index / 26 - 1) / 26 - 1;
-                const unsigned int m2 = (index / 26 - 1) % 26;
-                const unsigned int m3 =  index % 26;
-                sprintf(vblk->disk->disk_name, "vd%c%c%c",
-                        'a' + m1, 'a' + m2, 'a' + m3);
-        }
+        virtblk_name_format("vd", index, vblk->disk->disk_name, DISK_NAME_LEN);
 
         vblk->disk->major = major;
         vblk->disk->first_minor = index_to_minor(index);
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 0088bf60f368..73f196ca713f 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -321,6 +321,7 @@ struct seg_buf {
 static void xen_blkbk_unmap(struct pending_req *req)
 {
         struct gnttab_unmap_grant_ref unmap[BLKIF_MAX_SEGMENTS_PER_REQUEST];
+        struct page *pages[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         unsigned int i, invcount = 0;
         grant_handle_t handle;
         int ret;
@@ -332,25 +333,12 @@ static void xen_blkbk_unmap(struct pending_req *req)
                 gnttab_set_unmap_op(&unmap[invcount], vaddr(req, i),
                                     GNTMAP_host_map, handle);
                 pending_handle(req, i) = BLKBACK_INVALID_HANDLE;
+                pages[invcount] = virt_to_page(vaddr(req, i));
                 invcount++;
         }
 
-        ret = HYPERVISOR_grant_table_op(
-                GNTTABOP_unmap_grant_ref, unmap, invcount);
+        ret = gnttab_unmap_refs(unmap, pages, invcount, false);
         BUG_ON(ret);
-        /*
-         * Note, we use invcount, so nr->pages, so we can't index
-         * using vaddr(req, i).
-         */
-        for (i = 0; i < invcount; i++) {
-                ret = m2p_remove_override(
-                        virt_to_page(unmap[i].host_addr), false);
-                if (ret) {
-                        pr_alert(DRV_PFX "Failed to remove M2P override for %lx\n",
-                                 (unsigned long)unmap[i].host_addr);
-                        continue;
-                }
-        }
 }
 
 static int xen_blkbk_map(struct blkif_request *req,
@@ -378,7 +366,7 @@ static int xen_blkbk_map(struct blkif_request *req,
                                   pending_req->blkif->domid);
         }
 
-        ret = HYPERVISOR_grant_table_op(GNTTABOP_map_grant_ref, map, nseg);
+        ret = gnttab_map_refs(map, NULL, &blkbk->pending_page(pending_req, 0), nseg);
         BUG_ON(ret);
 
         /*
@@ -398,15 +386,6 @@ static int xen_blkbk_map(struct blkif_request *req,
                 if (ret)
                         continue;
 
-                ret = m2p_add_override(PFN_DOWN(map[i].dev_bus_addr),
-                        blkbk->pending_page(pending_req, i), NULL);
-                if (ret) {
-                        pr_alert(DRV_PFX "Failed to install M2P override for %lx (ret: %d)\n",
-                                 (unsigned long)map[i].dev_bus_addr, ret);
-                        /* We could switch over to GNTTABOP_copy */
-                        continue;
-                }
-
                 seg[i].buf  = map[i].dev_bus_addr |
                         (req->u.rw.seg[i].first_sect << 9);
         }
@@ -419,21 +398,18 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
         int err = 0;
         int status = BLKIF_RSP_OKAY;
         struct block_device *bdev = blkif->vbd.bdev;
+        unsigned long secure;
 
         blkif->st_ds_req++;
 
         xen_blkif_get(blkif);
-        if (blkif->blk_backend_type == BLKIF_BACKEND_PHY ||
-            blkif->blk_backend_type == BLKIF_BACKEND_FILE) {
-                unsigned long secure = (blkif->vbd.discard_secure &&
-                        (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
-                        BLKDEV_DISCARD_SECURE : 0;
-                err = blkdev_issue_discard(bdev,
-                                req->u.discard.sector_number,
-                                req->u.discard.nr_sectors,
-                                GFP_KERNEL, secure);
-        } else
-                err = -EOPNOTSUPP;
+        secure = (blkif->vbd.discard_secure &&
+                 (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
+                 BLKDEV_DISCARD_SECURE : 0;
+
+        err = blkdev_issue_discard(bdev, req->u.discard.sector_number,
+                                   req->u.discard.nr_sectors,
+                                   GFP_KERNEL, secure);
 
         if (err == -EOPNOTSUPP) {
                 pr_debug(DRV_PFX "discard op failed, not supported\n");
@@ -830,7 +806,7 @@ static int __init xen_blkif_init(void)
         int i, mmap_pages;
         int rc = 0;
 
-        if (!xen_pv_domain())
+        if (!xen_domain())
                 return -ENODEV;
 
         blkbk = kzalloc(sizeof(struct xen_blkbk), GFP_KERNEL);
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index d0ee7edc9be8..773cf27dc23f 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -146,11 +146,6 @@ enum blkif_protocol {
         BLKIF_PROTOCOL_X86_64 = 3,
 };
 
-enum blkif_backend_type {
-        BLKIF_BACKEND_PHY  = 1,
-        BLKIF_BACKEND_FILE = 2,
-};
-
 struct xen_vbd {
         /* What the domain refers to this vbd as. */
         blkif_vdev_t            handle;
@@ -177,7 +172,6 @@ struct xen_blkif {
         unsigned int            irq;
         /* Comms information. */
         enum blkif_protocol     blk_protocol;
-        enum blkif_backend_type blk_backend_type;
         union blkif_back_rings  blk_rings;
         void                    *blk_ring;
         /* The VBD attached to this interface. */
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 24a2fb57e5d0..4f66171c6683 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -381,72 +381,49 @@ int xen_blkbk_flush_diskcache(struct xenbus_transaction xbt,
         err = xenbus_printf(xbt, dev->nodename, "feature-flush-cache",
                             "%d", state);
         if (err)
-                xenbus_dev_fatal(dev, err, "writing feature-flush-cache");
+                dev_warn(&dev->dev, "writing feature-flush-cache (%d)", err);
 
         return err;
 }
 
-int xen_blkbk_discard(struct xenbus_transaction xbt, struct backend_info *be)
+static void xen_blkbk_discard(struct xenbus_transaction xbt, struct backend_info *be)
 {
         struct xenbus_device *dev = be->dev;
         struct xen_blkif *blkif = be->blkif;
-        char *type;
         int err;
         int state = 0;
+        struct block_device *bdev = be->blkif->vbd.bdev;
+        struct request_queue *q = bdev_get_queue(bdev);
 
-        type = xenbus_read(XBT_NIL, dev->nodename, "type", NULL);
-        if (!IS_ERR(type)) {
-                if (strncmp(type, "file", 4) == 0) {
-                        state = 1;
-                        blkif->blk_backend_type = BLKIF_BACKEND_FILE;
+        if (blk_queue_discard(q)) {
+                err = xenbus_printf(xbt, dev->nodename,
+                        "discard-granularity", "%u",
+                        q->limits.discard_granularity);
+                if (err) {
+                        dev_warn(&dev->dev, "writing discard-granularity (%d)", err);
+                        return;
                 }
-                if (strncmp(type, "phy", 3) == 0) {
-                        struct block_device *bdev = be->blkif->vbd.bdev;
-                        struct request_queue *q = bdev_get_queue(bdev);
-                        if (blk_queue_discard(q)) {
-                                err = xenbus_printf(xbt, dev->nodename,
-                                        "discard-granularity", "%u",
-                                        q->limits.discard_granularity);
-                                if (err) {
-                                        xenbus_dev_fatal(dev, err,
-                                                "writing discard-granularity");
-                                        goto kfree;
-                                }
-                                err = xenbus_printf(xbt, dev->nodename,
-                                        "discard-alignment", "%u",
-                                        q->limits.discard_alignment);
-                                if (err) {
-                                        xenbus_dev_fatal(dev, err,
-                                                "writing discard-alignment");
-                                        goto kfree;
-                                }
-                                state = 1;
-                                blkif->blk_backend_type = BLKIF_BACKEND_PHY;
-                        }
-                        /* Optional. */
-                        err = xenbus_printf(xbt, dev->nodename,
-                                "discard-secure", "%d",
-                                blkif->vbd.discard_secure);
-                        if (err) {
-                                xenbus_dev_fatal(dev, err,
-                                        "writting discard-secure");
-                                goto kfree;
-                        }
+                err = xenbus_printf(xbt, dev->nodename,
+                        "discard-alignment", "%u",
+                        q->limits.discard_alignment);
+                if (err) {
+                        dev_warn(&dev->dev, "writing discard-alignment (%d)", err);
+                        return;
+                }
+                state = 1;
+                /* Optional. */
+                err = xenbus_printf(xbt, dev->nodename,
+                                    "discard-secure", "%d",
+                                    blkif->vbd.discard_secure);
+                if (err) {
+                        dev_warn(&dev->dev, "writing discard-secure (%d)", err);
+                        return;
                 }
-        } else {
-                err = PTR_ERR(type);
-                xenbus_dev_fatal(dev, err, "reading type");
-                goto out;
         }
-
         err = xenbus_printf(xbt, dev->nodename, "feature-discard",
                             "%d", state);
         if (err)
-                xenbus_dev_fatal(dev, err, "writing feature-discard");
-kfree:
-        kfree(type);
-out:
-        return err;
+                dev_warn(&dev->dev, "writing feature-discard (%d)", err);
 }
 int xen_blkbk_barrier(struct xenbus_transaction xbt,
                       struct backend_info *be, int state)
@@ -457,7 +434,7 @@ int xen_blkbk_barrier(struct xenbus_transaction xbt,
         err = xenbus_printf(xbt, dev->nodename, "feature-barrier",
                             "%d", state);
         if (err)
-                xenbus_dev_fatal(dev, err, "writing feature-barrier");
+                dev_warn(&dev->dev, "writing feature-barrier (%d)", err);
 
         return err;
 }
@@ -689,14 +666,12 @@ again:
                 return;
         }
 
-        err = xen_blkbk_flush_diskcache(xbt, be, be->blkif->vbd.flush_support);
-        if (err)
-                goto abort;
+        /* If we can't advertise it is OK. */
+        xen_blkbk_flush_diskcache(xbt, be, be->blkif->vbd.flush_support);
 
-        err = xen_blkbk_discard(xbt, be);
+        xen_blkbk_discard(xbt, be);
 
-        /* If we can't advertise it is OK. */
-        err = xen_blkbk_barrier(xbt, be, be->blkif->vbd.flush_support);
+        xen_blkbk_barrier(xbt, be, be->blkif->vbd.flush_support);
 
         err = xenbus_printf(xbt, dev->nodename, "sectors", "%llu",
                             (unsigned long long)vbd_sz(&be->blkif->vbd));
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 98cbeba8cd53..4e86393a09cf 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -43,6 +43,7 @@
 #include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/scatterlist.h>
+#include <linux/bitmap.h>
 
 #include <xen/xen.h>
 #include <xen/xenbus.h>
@@ -81,6 +82,7 @@ static const struct block_device_operations xlvbd_block_fops;
  */
 struct blkfront_info
 {
+        spinlock_t io_lock;
         struct mutex mutex;
         struct xenbus_device *xbdev;
         struct gendisk *gd;
@@ -105,8 +107,6 @@ struct blkfront_info
         int is_ready;
 };
 
-static DEFINE_SPINLOCK(blkif_io_lock);
-
 static unsigned int nr_minors;
 static unsigned long *minors;
 static DEFINE_SPINLOCK(minor_lock);
@@ -177,8 +177,7 @@ static int xlbd_reserve_minors(unsigned int minor, unsigned int nr)
 
         spin_lock(&minor_lock);
         if (find_next_bit(minors, end, minor) >= end) {
-                for (; minor < end; ++minor)
-                        __set_bit(minor, minors);
+                bitmap_set(minors, minor, nr);
                 rc = 0;
         } else
                 rc = -EBUSY;
@@ -193,8 +192,7 @@ static void xlbd_release_minors(unsigned int minor, unsigned int nr)
 
         BUG_ON(end > nr_minors);
         spin_lock(&minor_lock);
-        for (; minor < end; ++minor)
-                __clear_bit(minor, minors);
+        bitmap_clear(minors,  minor, nr);
         spin_unlock(&minor_lock);
 }
 
@@ -419,7 +417,7 @@ static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size)
         struct request_queue *rq;
         struct blkfront_info *info = gd->private_data;
 
-        rq = blk_init_queue(do_blkif_request, &blkif_io_lock);
+        rq = blk_init_queue(do_blkif_request, &info->io_lock);
         if (rq == NULL)
                 return -1;
 
@@ -636,14 +634,14 @@ static void xlvbd_release_gendisk(struct blkfront_info *info)
         if (info->rq == NULL)
                 return;
 
-        spin_lock_irqsave(&blkif_io_lock, flags);
+        spin_lock_irqsave(&info->io_lock, flags);
 
         /* No more blkif_request(). */
         blk_stop_queue(info->rq);
 
         /* No more gnttab callback work. */
         gnttab_cancel_free_callback(&info->callback);
-        spin_unlock_irqrestore(&blkif_io_lock, flags);
+        spin_unlock_irqrestore(&info->io_lock, flags);
 
         /* Flush gnttab callback work. Must be done with no locks held. */
         flush_work_sync(&info->work);
@@ -675,16 +673,16 @@ static void blkif_restart_queue(struct work_struct *work)
 {
         struct blkfront_info *info = container_of(work, struct blkfront_info, work);
 
-        spin_lock_irq(&blkif_io_lock);
+        spin_lock_irq(&info->io_lock);
         if (info->connected == BLKIF_STATE_CONNECTED)
                 kick_pending_request_queues(info);
-        spin_unlock_irq(&blkif_io_lock);
+        spin_unlock_irq(&info->io_lock);
 }
 
 static void blkif_free(struct blkfront_info *info, int suspend)
 {
         /* Prevent new requests being issued until we fix things up. */
-        spin_lock_irq(&blkif_io_lock);
+        spin_lock_irq(&info->io_lock);
         info->connected = suspend ?
                 BLKIF_STATE_SUSPENDED : BLKIF_STATE_DISCONNECTED;
         /* No more blkif_request(). */
@@ -692,7 +690,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
                 blk_stop_queue(info->rq);
         /* No more gnttab callback work. */
         gnttab_cancel_free_callback(&info->callback);
-        spin_unlock_irq(&blkif_io_lock);
+        spin_unlock_irq(&info->io_lock);
 
         /* Flush gnttab callback work. Must be done with no locks held. */
         flush_work_sync(&info->work);
@@ -728,10 +726,10 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
         struct blkfront_info *info = (struct blkfront_info *)dev_id;
         int error;
 
-        spin_lock_irqsave(&blkif_io_lock, flags);
+        spin_lock_irqsave(&info->io_lock, flags);
 
         if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) {
-                spin_unlock_irqrestore(&blkif_io_lock, flags);
+                spin_unlock_irqrestore(&info->io_lock, flags);
                 return IRQ_HANDLED;
         }
 
@@ -816,7 +814,7 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
 
         kick_pending_request_queues(info);
 
-        spin_unlock_irqrestore(&blkif_io_lock, flags);
+        spin_unlock_irqrestore(&info->io_lock, flags);
 
         return IRQ_HANDLED;
 }
@@ -991,6 +989,7 @@ static int blkfront_probe(struct xenbus_device *dev,
         }
 
         mutex_init(&info->mutex);
+        spin_lock_init(&info->io_lock);
         info->xbdev = dev;
         info->vdevice = vdevice;
         info->connected = BLKIF_STATE_DISCONNECTED;
@@ -1068,7 +1067,7 @@ static int blkif_recover(struct blkfront_info *info)
 
         xenbus_switch_state(info->xbdev, XenbusStateConnected);
 
-        spin_lock_irq(&blkif_io_lock);
+        spin_lock_irq(&info->io_lock);
 
         /* Now safe for us to use the shared ring */
         info->connected = BLKIF_STATE_CONNECTED;
@@ -1079,7 +1078,7 @@ static int blkif_recover(struct blkfront_info *info)
         /* Kick any other new requests queued since we resumed */
         kick_pending_request_queues(info);
 
-        spin_unlock_irq(&blkif_io_lock);
+        spin_unlock_irq(&info->io_lock);
 
         return 0;
 }
@@ -1277,10 +1276,10 @@ static void blkfront_connect(struct blkfront_info *info)
         xenbus_switch_state(info->xbdev, XenbusStateConnected);
 
         /* Kick pending requests. */
-        spin_lock_irq(&blkif_io_lock);
+        spin_lock_irq(&info->io_lock);
         info->connected = BLKIF_STATE_CONNECTED;
         kick_pending_request_queues(info);
-        spin_unlock_irq(&blkif_io_lock);
+        spin_unlock_irq(&info->io_lock);
 
         add_disk(info->gd);
 
@@ -1410,7 +1409,6 @@ static int blkif_release(struct gendisk *disk, fmode_t mode)
         mutex_lock(&blkfront_mutex);
 
         bdev = bdget_disk(disk, 0);
-        bdput(bdev);
 
         if (bdev->bd_openers)
                 goto out;
@@ -1441,6 +1439,7 @@ static int blkif_release(struct gendisk *disk, fmode_t mode)
         }
 
 out:
+        bdput(bdev);
         mutex_unlock(&blkfront_mutex);
         return 0;
 }
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 48442476ec00..57fd867553d7 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -72,7 +72,11 @@ static struct usb_device_id ath3k_table[] = {
 
         /* Atheros AR3012 with sflash firmware*/
         { USB_DEVICE(0x0CF3, 0x3004) },
+        { USB_DEVICE(0x0CF3, 0x311D) },
         { USB_DEVICE(0x13d3, 0x3375) },
+        { USB_DEVICE(0x04CA, 0x3005) },
+        { USB_DEVICE(0x13d3, 0x3362) },
+        { USB_DEVICE(0x0CF3, 0xE004) },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE02C) },
@@ -89,7 +93,11 @@ static struct usb_device_id ath3k_blist_tbl[] = {
 
         /* Atheros AR3012 with sflash firmware*/
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 
         { }     /* Terminating entry */
 };
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 480cad920048..9217121362e1 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -61,7 +61,7 @@ static struct usb_device_id btusb_table[] = {
         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
 
         /* Broadcom SoftSailing reporting vendor specific */
-        { USB_DEVICE(0x05ac, 0x21e1) },
+        { USB_DEVICE(0x0a5c, 0x21e1) },
 
         /* Apple MacBookPro 7,1 */
         { USB_DEVICE(0x05ac, 0x8213) },
@@ -101,11 +101,16 @@ static struct usb_device_id btusb_table[] = {
         { USB_DEVICE(0x0c10, 0x0000) },
 
         /* Broadcom BCM20702A0 */
+        { USB_DEVICE(0x0489, 0xe042) },
         { USB_DEVICE(0x0a5c, 0x21e3) },
         { USB_DEVICE(0x0a5c, 0x21e6) },
+        { USB_DEVICE(0x0a5c, 0x21e8) },
         { USB_DEVICE(0x0a5c, 0x21f3) },
         { USB_DEVICE(0x413c, 0x8197) },
 
+        /* Foxconn - Hon Hai */
+        { USB_DEVICE(0x0489, 0xe033) },
+
         { }     /* Terminating entry */
 };
 
@@ -129,7 +134,11 @@ static struct usb_device_id blacklist_table[] = {
 
         /* Atheros 3012 with sflash firmware */
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index fd5adb408f44..98a8c05d4f23 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -299,11 +299,11 @@ static void hci_uart_tty_close(struct tty_struct *tty)
                         hci_uart_close(hdev);
 
                 if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
-                        hu->proto->close(hu);
                         if (hdev) {
                                 hci_unregister_dev(hdev);
                                 hci_free_dev(hdev);
                         }
+                        hu->proto->close(hu);
                 }
 
                 kfree(hu);
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 3845ab44c330..dfd7876f127c 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -906,8 +906,8 @@ int hpet_alloc(struct hpet_data *hdp)
                 hpetp->hp_which, hdp->hd_phys_address,
                 hpetp->hp_ntimer > 1 ? "s" : "");
         for (i = 0; i < hpetp->hp_ntimer; i++)
-                printk("%s %d", i > 0 ? "," : "", hdp->hd_irq[i]);
-        printk("\n");
+                printk(KERN_CONT "%s %d", i > 0 ? "," : "", hdp->hd_irq[i]);
+        printk(KERN_CONT "\n");
 
         temp = hpetp->hp_tick_freq;
         remainder = do_div(temp, 1000000);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 54ca8b23cde3..4ec04a754733 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1260,10 +1260,15 @@ static int proc_do_uuid(ctl_table *table, int write,
         uuid = table->data;
         if (!uuid) {
                 uuid = tmp_uuid;
-                uuid[8] = 0;
-        }
-        if (uuid[8] == 0)
                 generate_random_uuid(uuid);
+        } else {
+                static DEFINE_SPINLOCK(bootid_spinlock);
+
+                spin_lock(&bootid_spinlock);
+                if (!uuid[8])
+                        generate_random_uuid(uuid);
+                spin_unlock(&bootid_spinlock);
+        }
 
         sprintf(buf, "%pU", uuid);
 
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index 82e882028fcf..6b5cf02c35c8 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -23,7 +23,6 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
-#include <linux/async.h>
 #include <asm/io.h>
 
 /*
@@ -180,15 +179,17 @@ static int verify_pmtmr_rate(void)
 /* Number of reads we try to get two different values */
 #define ACPI_PM_READ_CHECKS 10000
 
-static void __init acpi_pm_clocksource_async(void *unused, async_cookie_t cookie)
+static int __init init_acpi_pm_clocksource(void)
 {
         cycle_t value1, value2;
         unsigned int i, j = 0;
 
+        if (!pmtmr_ioport)
+                return -ENODEV;
 
         /* "verify" this timing source: */
         for (j = 0; j < ACPI_PM_MONOTONICITY_CHECKS; j++) {
-                usleep_range(100 * j, 100 * j + 100);
+                udelay(100 * j);
                 value1 = clocksource_acpi_pm.read(&clocksource_acpi_pm);
                 for (i = 0; i < ACPI_PM_READ_CHECKS; i++) {
                         value2 = clocksource_acpi_pm.read(&clocksource_acpi_pm);
@@ -202,34 +203,25 @@ static void __init acpi_pm_clocksource_async(void *unused, async_cookie_t cookie
                                " 0x%#llx, 0x%#llx - aborting.\n",
                                value1, value2);
                         pmtmr_ioport = 0;
-                        return;
+                        return -EINVAL;
                 }
                 if (i == ACPI_PM_READ_CHECKS) {
                         printk(KERN_INFO "PM-Timer failed consistency check "
                                " (0x%#llx) - aborting.\n", value1);
                         pmtmr_ioport = 0;
-                        return;
+                        return -ENODEV;
                 }
         }
 
         if (verify_pmtmr_rate() != 0){
                 pmtmr_ioport = 0;
-                return;
+                return -ENODEV;
         }
 
-        clocksource_register_hz(&clocksource_acpi_pm,
+        return clocksource_register_hz(&clocksource_acpi_pm,
                                                 PMTMR_TICKS_PER_SEC);
 }
 
-static int __init init_acpi_pm_clocksource(void)
-{
-        if (!pmtmr_ioport)
-                return -ENODEV;
-
-        async_schedule(acpi_pm_clocksource_async, NULL);
-        return 0;
-}
-
 /* We use fs_initcall because we want the PCI fixups to have run
  * but we still need to load before device_initcall
  */
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index ffbb44685915..5961e6415f08 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -4,6 +4,7 @@
 
 config ARM_OMAP2PLUS_CPUFREQ
         bool "TI OMAP2+"
+        depends on ARCH_OMAP2PLUS
         default ARCH_OMAP2PLUS
         select CPU_FREQ_TABLE
 
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 0053d7ebb5ca..8f3f74ce8c7f 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -18,6 +18,7 @@
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/gfp.h>
+#include <linux/module.h>
 
 #include <crypto/ctr.h>
 #include <crypto/des.h>
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index dc641c796526..921039e56f87 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -124,6 +124,9 @@ struct talitos_private {
         void __iomem *reg;
         int irq[2];
 
+        /* SEC global registers lock  */
+        spinlock_t reg_lock ____cacheline_aligned;
+
         /* SEC version geometry (from device tree node) */
         unsigned int num_channels;
         unsigned int chfifo_len;
@@ -412,6 +415,7 @@ static void talitos_done_##name(unsigned long data)			\
 {                                                                       \
         struct device *dev = (struct device *)data;                     \
         struct talitos_private *priv = dev_get_drvdata(dev);            \
+        unsigned long flags;                                            \
                                                                         \
         if (ch_done_mask & 1)                                           \
                 flush_channel(dev, 0, 0, 0);                            \
@@ -427,8 +431,10 @@ static void talitos_done_##name(unsigned long data)			\
 out:                                                                    \
         /* At this point, all completed channels have been processed */ \
         /* Unmask done interrupts for channels completed later on. */   \
+        spin_lock_irqsave(&priv->reg_lock, flags);                      \
         setbits32(priv->reg + TALITOS_IMR, ch_done_mask);               \
         setbits32(priv->reg + TALITOS_IMR_LO, TALITOS_IMR_LO_INIT);     \
+        spin_unlock_irqrestore(&priv->reg_lock, flags);                 \
 }
 DEF_TALITOS_DONE(4ch, TALITOS_ISR_4CHDONE)
 DEF_TALITOS_DONE(ch0_2, TALITOS_ISR_CH_0_2_DONE)
@@ -619,22 +625,28 @@ static irqreturn_t talitos_interrupt_##name(int irq, void *data)	       \
         struct device *dev = data;                                             \
         struct talitos_private *priv = dev_get_drvdata(dev);                   \
         u32 isr, isr_lo;                                                       \
+        unsigned long flags;                                                   \
                                                                                \
+        spin_lock_irqsave(&priv->reg_lock, flags);                             \
         isr = in_be32(priv->reg + TALITOS_ISR);                                \
         isr_lo = in_be32(priv->reg + TALITOS_ISR_LO);                          \
         /* Acknowledge interrupt */                                            \
         out_be32(priv->reg + TALITOS_ICR, isr & (ch_done_mask | ch_err_mask)); \
         out_be32(priv->reg + TALITOS_ICR_LO, isr_lo);                          \
                                                                                \
-        if (unlikely((isr & ~TALITOS_ISR_4CHDONE) & ch_err_mask || isr_lo))    \
-                talitos_error(dev, isr, isr_lo);                               \
-        else                                                                   \
+        if (unlikely(isr & ch_err_mask || isr_lo)) {                           \
+                spin_unlock_irqrestore(&priv->reg_lock, flags);                \
+                talitos_error(dev, isr & ch_err_mask, isr_lo);                 \
+        }                                                                      \
+        else {                                                                 \
                 if (likely(isr & ch_done_mask)) {                              \
                         /* mask further done interrupts. */                    \
                         clrbits32(priv->reg + TALITOS_IMR, ch_done_mask);      \
                         /* done_task will unmask done interrupts at exit */    \
                         tasklet_schedule(&priv->done_task[tlet]);              \
                 }                                                              \
+                spin_unlock_irqrestore(&priv->reg_lock, flags);                \
+        }                                                                      \
                                                                                \
         return (isr & (ch_done_mask | ch_err_mask) || isr_lo) ? IRQ_HANDLED :  \
                                                                 IRQ_NONE;      \
@@ -2719,6 +2731,8 @@ static int talitos_probe(struct platform_device *ofdev)
 
         priv->ofdev = ofdev;
 
+        spin_lock_init(&priv->reg_lock);
+
         err = talitos_probe_irq(ofdev);
         if (err)
                 goto err_out;
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index cf9da362d64f..ef378b5b17e4 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -91,11 +91,10 @@ config DW_DMAC
 
 config AT_HDMAC
         tristate "Atmel AHB DMA support"
-        depends on ARCH_AT91SAM9RL || ARCH_AT91SAM9G45
+        depends on ARCH_AT91
         select DMA_ENGINE
         help
-          Support the Atmel AHB DMA controller.  This can be integrated in
-          chips such as the Atmel AT91SAM9RL.
+          Support the Atmel AHB DMA controller.
 
 config FSL_DMA
         tristate "Freescale Elo and Elo Plus DMA support"
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index c301a8ec31aa..3d704abd7912 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -1429,6 +1429,7 @@ static int pl08x_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
                          * signal
                          */
                         release_phy_channel(plchan);
+                        plchan->phychan_hold = 0;
                 }
                 /* Dequeue jobs and free LLIs */
                 if (plchan->at) {
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 7aa58d204892..445fdf811695 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -221,10 +221,6 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first)
 
         vdbg_dump_regs(atchan);
 
-        /* clear any pending interrupt */
-        while (dma_readl(atdma, EBCISR))
-                cpu_relax();
-
         channel_writel(atchan, SADDR, 0);
         channel_writel(atchan, DADDR, 0);
         channel_writel(atchan, CTRLA, 0);
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 767bcc31b365..2397f6f451b1 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -332,6 +332,20 @@ struct dma_chan *dma_find_channel(enum dma_transaction_type tx_type)
 }
 EXPORT_SYMBOL(dma_find_channel);
 
+/*
+ * net_dma_find_channel - find a channel for net_dma
+ * net_dma has alignment requirements
+ */
+struct dma_chan *net_dma_find_channel(void)
+{
+        struct dma_chan *chan = dma_find_channel(DMA_MEMCPY);
+        if (chan && !is_dma_copy_aligned(chan->device, 1, 1, 1))
+                return NULL;
+
+        return chan;
+}
+EXPORT_SYMBOL(net_dma_find_channel);
+
 /**
  * dma_issue_pending_all - flush all pending operations across all channels
  */
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index a45b5d2a5987..bb787d8e1529 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -571,11 +571,14 @@ static void imxdma_tasklet(unsigned long data)
         if (desc->desc.callback)
                 desc->desc.callback(desc->desc.callback_param);
 
-        dma_cookie_complete(&desc->desc);
-
-        /* If we are dealing with a cyclic descriptor keep it on ld_active */
+        /* If we are dealing with a cyclic descriptor keep it on ld_active
+         * and dont mark the descripor as complete.
+         * Only in non-cyclic cases it would be marked as complete
+         */
         if (imxdma_chan_is_doing_cyclic(imxdmac))
                 goto out;
+        else
+                dma_cookie_complete(&desc->desc);
 
         /* Free 2D slot if it was an interleaved transfer */
         if (imxdmac->enabled_2d) {
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 31493d80e0e9..73b2b65cb1de 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -546,9 +546,9 @@ void ioat_dma_unmap(struct ioat_chan_common *chan, enum dma_ctrl_flags flags,
                            PCI_DMA_TODEVICE, flags, 0);
 }
 
-unsigned long ioat_get_current_completion(struct ioat_chan_common *chan)
+dma_addr_t ioat_get_current_completion(struct ioat_chan_common *chan)
 {
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
         u64 completion;
 
         completion = *chan->completion;
@@ -569,7 +569,7 @@ unsigned long ioat_get_current_completion(struct ioat_chan_common *chan)
 }
 
 bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
-                           unsigned long *phys_complete)
+                           dma_addr_t *phys_complete)
 {
         *phys_complete = ioat_get_current_completion(chan);
         if (*phys_complete == chan->last_completion)
@@ -580,14 +580,14 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
         return true;
 }
 
-static void __cleanup(struct ioat_dma_chan *ioat, unsigned long phys_complete)
+static void __cleanup(struct ioat_dma_chan *ioat, dma_addr_t phys_complete)
 {
         struct ioat_chan_common *chan = &ioat->base;
         struct list_head *_desc, *n;
         struct dma_async_tx_descriptor *tx;
 
-        dev_dbg(to_dev(chan), "%s: phys_complete: %lx\n",
-                 __func__, phys_complete);
+        dev_dbg(to_dev(chan), "%s: phys_complete: %llx\n",
+                 __func__, (unsigned long long) phys_complete);
         list_for_each_safe(_desc, n, &ioat->used_desc) {
                 struct ioat_desc_sw *desc;
 
@@ -652,7 +652,7 @@ static void __cleanup(struct ioat_dma_chan *ioat, unsigned long phys_complete)
 static void ioat1_cleanup(struct ioat_dma_chan *ioat)
 {
         struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
 
         prefetch(chan->completion);
 
@@ -698,7 +698,7 @@ static void ioat1_timer_event(unsigned long data)
                 mod_timer(&chan->timer, jiffies + COMPLETION_TIMEOUT);
                 spin_unlock_bh(&ioat->desc_lock);
         } else if (test_bit(IOAT_COMPLETION_PENDING, &chan->state)) {
-                unsigned long phys_complete;
+                dma_addr_t phys_complete;
 
                 spin_lock_bh(&ioat->desc_lock);
                 /* if we haven't made progress and we have already
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index c7888bccd974..5e8fe01ba69d 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -88,7 +88,7 @@ struct ioatdma_device {
 struct ioat_chan_common {
         struct dma_chan common;
         void __iomem *reg_base;
-        unsigned long last_completion;
+        dma_addr_t last_completion;
         spinlock_t cleanup_lock;
         unsigned long state;
         #define IOAT_COMPLETION_PENDING 0
@@ -310,7 +310,7 @@ int __devinit ioat_dma_self_test(struct ioatdma_device *device);
 void __devexit ioat_dma_remove(struct ioatdma_device *device);
 struct dca_provider * __devinit ioat_dca_init(struct pci_dev *pdev,
                                               void __iomem *iobase);
-unsigned long ioat_get_current_completion(struct ioat_chan_common *chan);
+dma_addr_t ioat_get_current_completion(struct ioat_chan_common *chan);
 void ioat_init_channel(struct ioatdma_device *device,
                        struct ioat_chan_common *chan, int idx);
 enum dma_status ioat_dma_tx_status(struct dma_chan *c, dma_cookie_t cookie,
@@ -318,7 +318,7 @@ enum dma_status ioat_dma_tx_status(struct dma_chan *c, dma_cookie_t cookie,
 void ioat_dma_unmap(struct ioat_chan_common *chan, enum dma_ctrl_flags flags,
                     size_t len, struct ioat_dma_descriptor *hw);
 bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
-                           unsigned long *phys_complete);
+                           dma_addr_t *phys_complete);
 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
 void ioat_kobject_del(struct ioatdma_device *device);
 extern const struct sysfs_ops ioat_sysfs_ops;
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index e8e110ff3d96..86895760b598 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -128,7 +128,7 @@ static void ioat2_start_null_desc(struct ioat2_dma_chan *ioat)
         spin_unlock_bh(&ioat->prep_lock);
 }
 
-static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
+static void __cleanup(struct ioat2_dma_chan *ioat, dma_addr_t phys_complete)
 {
         struct ioat_chan_common *chan = &ioat->base;
         struct dma_async_tx_descriptor *tx;
@@ -179,7 +179,7 @@ static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
 static void ioat2_cleanup(struct ioat2_dma_chan *ioat)
 {
         struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
 
         spin_lock_bh(&chan->cleanup_lock);
         if (ioat_cleanup_preamble(chan, &phys_complete))
@@ -260,7 +260,7 @@ int ioat2_reset_sync(struct ioat_chan_common *chan, unsigned long tmo)
 static void ioat2_restart_channel(struct ioat2_dma_chan *ioat)
 {
         struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
 
         ioat2_quiesce(chan, 0);
         if (ioat_cleanup_preamble(chan, &phys_complete))
@@ -275,7 +275,7 @@ void ioat2_timer_event(unsigned long data)
         struct ioat_chan_common *chan = &ioat->base;
 
         if (test_bit(IOAT_COMPLETION_PENDING, &chan->state)) {
-                unsigned long phys_complete;
+                dma_addr_t phys_complete;
                 u64 status;
 
                 status = ioat_chansts(chan);
@@ -572,9 +572,9 @@ bool reshape_ring(struct ioat2_dma_chan *ioat, int order)
          */
         struct ioat_chan_common *chan = &ioat->base;
         struct dma_chan *c = &chan->common;
-        const u16 curr_size = ioat2_ring_size(ioat);
+        const u32 curr_size = ioat2_ring_size(ioat);
         const u16 active = ioat2_ring_active(ioat);
-        const u16 new_size = 1 << order;
+        const u32 new_size = 1 << order;
         struct ioat_ring_ent **ring;
         u16 i;
 
diff --git a/drivers/dma/ioat/dma_v2.h b/drivers/dma/ioat/dma_v2.h
index a2c413b2b8d8..be2a55b95c23 100644
--- a/drivers/dma/ioat/dma_v2.h
+++ b/drivers/dma/ioat/dma_v2.h
@@ -74,7 +74,7 @@ static inline struct ioat2_dma_chan *to_ioat2_chan(struct dma_chan *c)
         return container_of(chan, struct ioat2_dma_chan, base);
 }
 
-static inline u16 ioat2_ring_size(struct ioat2_dma_chan *ioat)
+static inline u32 ioat2_ring_size(struct ioat2_dma_chan *ioat)
 {
         return 1 << ioat->alloc_order;
 }
@@ -91,7 +91,7 @@ static inline u16 ioat2_ring_pending(struct ioat2_dma_chan *ioat)
         return CIRC_CNT(ioat->head, ioat->issued, ioat2_ring_size(ioat));
 }
 
-static inline u16 ioat2_ring_space(struct ioat2_dma_chan *ioat)
+static inline u32 ioat2_ring_space(struct ioat2_dma_chan *ioat)
 {
         return ioat2_ring_size(ioat) - ioat2_ring_active(ioat);
 }
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 2c4476c0e405..f7f1dc62c15c 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -257,7 +257,7 @@ static bool desc_has_ext(struct ioat_ring_ent *desc)
  * The difference from the dma_v2.c __cleanup() is that this routine
  * handles extended descriptors and dma-unmapping raid operations.
  */
-static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
+static void __cleanup(struct ioat2_dma_chan *ioat, dma_addr_t phys_complete)
 {
         struct ioat_chan_common *chan = &ioat->base;
         struct ioat_ring_ent *desc;
@@ -314,7 +314,7 @@ static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
 static void ioat3_cleanup(struct ioat2_dma_chan *ioat)
 {
         struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
 
         spin_lock_bh(&chan->cleanup_lock);
         if (ioat_cleanup_preamble(chan, &phys_complete))
@@ -333,7 +333,7 @@ static void ioat3_cleanup_event(unsigned long data)
 static void ioat3_restart_channel(struct ioat2_dma_chan *ioat)
 {
         struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
 
         ioat2_quiesce(chan, 0);
         if (ioat_cleanup_preamble(chan, &phys_complete))
@@ -348,7 +348,7 @@ static void ioat3_timer_event(unsigned long data)
         struct ioat_chan_common *chan = &ioat->base;
 
         if (test_bit(IOAT_COMPLETION_PENDING, &chan->state)) {
-                unsigned long phys_complete;
+                dma_addr_t phys_complete;
                 u64 status;
 
                 status = ioat_chansts(chan);
@@ -1149,6 +1149,44 @@ static int ioat3_reset_hw(struct ioat_chan_common *chan)
         return ioat2_reset_sync(chan, msecs_to_jiffies(200));
 }
 
+static bool is_jf_ioat(struct pci_dev *pdev)
+{
+        switch (pdev->device) {
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF0:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF1:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF2:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF3:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF4:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF5:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF6:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF7:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF8:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF9:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool is_snb_ioat(struct pci_dev *pdev)
+{
+        switch (pdev->device) {
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB0:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB1:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB2:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB3:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB4:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB5:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB6:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB7:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB8:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB9:
+                return true;
+        default:
+                return false;
+        }
+}
+
 int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
 {
         struct pci_dev *pdev = device->pdev;
@@ -1169,6 +1207,9 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
         dma->device_alloc_chan_resources = ioat2_alloc_chan_resources;
         dma->device_free_chan_resources = ioat2_free_chan_resources;
 
+        if (is_jf_ioat(pdev) || is_snb_ioat(pdev))
+                dma->copy_align = 6;
+
         dma_cap_set(DMA_INTERRUPT, dma->cap_mask);
         dma->device_prep_dma_interrupt = ioat3_prep_interrupt_lock;
 
diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
index da6c4c2c066a..79e3eba29702 100644
--- a/drivers/dma/iop-adma.c
+++ b/drivers/dma/iop-adma.c
@@ -1252,8 +1252,8 @@ iop_adma_pq_zero_sum_self_test(struct iop_adma_device *device)
         struct page **pq_hw = &pq[IOP_ADMA_NUM_SRC_TEST+2];
         /* address conversion buffers (dma_map / page_address) */
         void *pq_sw[IOP_ADMA_NUM_SRC_TEST+2];
-        dma_addr_t pq_src[IOP_ADMA_NUM_SRC_TEST];
-        dma_addr_t pq_dest[2];
+        dma_addr_t pq_src[IOP_ADMA_NUM_SRC_TEST+2];
+        dma_addr_t *pq_dest = &pq_src[IOP_ADMA_NUM_SRC_TEST];
 
         int i;
         struct dma_async_tx_descriptor *tx;
diff --git a/drivers/dma/mxs-dma.c b/drivers/dma/mxs-dma.c
index c81ef7e10e08..655d4ce6ed0d 100644
--- a/drivers/dma/mxs-dma.c
+++ b/drivers/dma/mxs-dma.c
@@ -201,10 +201,6 @@ static struct mxs_dma_chan *to_mxs_dma_chan(struct dma_chan *chan)
 
 static dma_cookie_t mxs_dma_tx_submit(struct dma_async_tx_descriptor *tx)
 {
-        struct mxs_dma_chan *mxs_chan = to_mxs_dma_chan(tx->chan);
-
-        mxs_dma_enable_chan(mxs_chan);
-
         return dma_cookie_assign(tx);
 }
 
@@ -558,9 +554,9 @@ static enum dma_status mxs_dma_tx_status(struct dma_chan *chan,
 
 static void mxs_dma_issue_pending(struct dma_chan *chan)
 {
-        /*
-         * Nothing to do. We only have a single descriptor.
-         */
+        struct mxs_dma_chan *mxs_chan = to_mxs_dma_chan(chan);
+
+        mxs_dma_enable_chan(mxs_chan);
 }
 
 static int __init mxs_dma_init(struct mxs_dma_engine *mxs_dma)
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 282caf118be8..2ee6e23930ad 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2225,12 +2225,9 @@ static inline void free_desc_list(struct list_head *list)
 {
         struct dma_pl330_dmac *pdmac;
         struct dma_pl330_desc *desc;
-        struct dma_pl330_chan *pch;
+        struct dma_pl330_chan *pch = NULL;
         unsigned long flags;
 
-        if (list_empty(list))
-                return;
-
         /* Finish off the work list */
         list_for_each_entry(desc, list, node) {
                 dma_async_tx_callback callback;
@@ -2247,6 +2244,10 @@ static inline void free_desc_list(struct list_head *list)
                 desc->pchan = NULL;
         }
 
+        /* pch will be unset if list was empty */
+        if (!pch)
+                return;
+
         pdmac = pch->dmac;
 
         spin_lock_irqsave(&pdmac->pool_lock, flags);
@@ -2257,12 +2258,9 @@ static inline void free_desc_list(struct list_head *list)
 static inline void handle_cyclic_desc_list(struct list_head *list)
 {
         struct dma_pl330_desc *desc;
-        struct dma_pl330_chan *pch;
+        struct dma_pl330_chan *pch = NULL;
         unsigned long flags;
 
-        if (list_empty(list))
-                return;
-
         list_for_each_entry(desc, list, node) {
                 dma_async_tx_callback callback;
 
@@ -2274,6 +2272,10 @@ static inline void handle_cyclic_desc_list(struct list_head *list)
                         callback(desc->txd.callback_param);
         }
 
+        /* pch will be unset if list was empty */
+        if (!pch)
+                return;
+
         spin_lock_irqsave(&pch->lock, flags);
         list_splice_tail_init(list, &pch->work_list);
         spin_unlock_irqrestore(&pch->lock, flags);
@@ -2926,8 +2928,11 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
         INIT_LIST_HEAD(&pd->channels);
 
         /* Initialize channel parameters */
-        num_chan = max(pdat ? pdat->nr_valid_peri : (u8)pi->pcfg.num_peri,
-                        (u8)pi->pcfg.num_chan);
+        if (pdat)
+                num_chan = max_t(int, pdat->nr_valid_peri, pi->pcfg.num_chan);
+        else
+                num_chan = max_t(int, pi->pcfg.num_peri, pi->pcfg.num_chan);
+
         pdmac->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
 
         for (i = 0; i < num_chan; i++) {
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index bdd41d4bfa8d..2ed1ac3513f3 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -18,6 +18,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/err.h>
 #include <linux/amba/bus.h>
+#include <linux/regulator/consumer.h>
 
 #include <plat/ste_dma40.h>
 
@@ -69,6 +70,22 @@ enum d40_command {
 };
 
 /*
+ * enum d40_events - The different Event Enables for the event lines.
+ *
+ * @D40_DEACTIVATE_EVENTLINE: De-activate Event line, stopping the logical chan.
+ * @D40_ACTIVATE_EVENTLINE: Activate the Event line, to start a logical chan.
+ * @D40_SUSPEND_REQ_EVENTLINE: Requesting for suspending a event line.
+ * @D40_ROUND_EVENTLINE: Status check for event line.
+ */
+
+enum d40_events {
+        D40_DEACTIVATE_EVENTLINE        = 0,
+        D40_ACTIVATE_EVENTLINE          = 1,
+        D40_SUSPEND_REQ_EVENTLINE       = 2,
+        D40_ROUND_EVENTLINE             = 3
+};
+
+/*
  * These are the registers that has to be saved and later restored
  * when the DMA hw is powered off.
  * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
@@ -870,8 +887,8 @@ static void d40_save_restore_registers(struct d40_base *base, bool save)
 }
 #endif
 
-static int d40_channel_execute_command(struct d40_chan *d40c,
-                                       enum d40_command command)
+static int __d40_execute_command_phy(struct d40_chan *d40c,
+                                     enum d40_command command)
 {
         u32 status;
         int i;
@@ -880,6 +897,12 @@ static int d40_channel_execute_command(struct d40_chan *d40c,
         unsigned long flags;
         u32 wmask;
 
+        if (command == D40_DMA_STOP) {
+                ret = __d40_execute_command_phy(d40c, D40_DMA_SUSPEND_REQ);
+                if (ret)
+                        return ret;
+        }
+
         spin_lock_irqsave(&d40c->base->execmd_lock, flags);
 
         if (d40c->phy_chan->num % 2 == 0)
@@ -973,67 +996,109 @@ static void d40_term_all(struct d40_chan *d40c)
                 }
 
         d40c->pending_tx = 0;
-        d40c->busy = false;
 }
 
-static void __d40_config_set_event(struct d40_chan *d40c, bool enable,
-                                   u32 event, int reg)
+static void __d40_config_set_event(struct d40_chan *d40c,
+                                   enum d40_events event_type, u32 event,
+                                   int reg)
 {
         void __iomem *addr = chan_base(d40c) + reg;
         int tries;
+        u32 status;
+
+        switch (event_type) {
+
+        case D40_DEACTIVATE_EVENTLINE:
 
-        if (!enable) {
                 writel((D40_DEACTIVATE_EVENTLINE << D40_EVENTLINE_POS(event))
                        | ~D40_EVENTLINE_MASK(event), addr);
-                return;
-        }
+                break;
+
+        case D40_SUSPEND_REQ_EVENTLINE:
+                status = (readl(addr) & D40_EVENTLINE_MASK(event)) >>
+                          D40_EVENTLINE_POS(event);
+
+                if (status == D40_DEACTIVATE_EVENTLINE ||
+                    status == D40_SUSPEND_REQ_EVENTLINE)
+                        break;
 
+                writel((D40_SUSPEND_REQ_EVENTLINE << D40_EVENTLINE_POS(event))
+                       | ~D40_EVENTLINE_MASK(event), addr);
+
+                for (tries = 0 ; tries < D40_SUSPEND_MAX_IT; tries++) {
+
+                        status = (readl(addr) & D40_EVENTLINE_MASK(event)) >>
+                                  D40_EVENTLINE_POS(event);
+
+                        cpu_relax();
+                        /*
+                         * Reduce the number of bus accesses while
+                         * waiting for the DMA to suspend.
+                         */
+                        udelay(3);
+
+                        if (status == D40_DEACTIVATE_EVENTLINE)
+                                break;
+                }
+
+                if (tries == D40_SUSPEND_MAX_IT) {
+                        chan_err(d40c,
+                                "unable to stop the event_line chl %d (log: %d)"
+                                "status %x\n", d40c->phy_chan->num,
+                                 d40c->log_num, status);
+                }
+                break;
+
+        case D40_ACTIVATE_EVENTLINE:
         /*
          * The hardware sometimes doesn't register the enable when src and dst
          * event lines are active on the same logical channel.  Retry to ensure
          * it does.  Usually only one retry is sufficient.
          */
-        tries = 100;
-        while (--tries) {
-                writel((D40_ACTIVATE_EVENTLINE << D40_EVENTLINE_POS(event))
-                       | ~D40_EVENTLINE_MASK(event), addr);
+                tries = 100;
+                while (--tries) {
+                        writel((D40_ACTIVATE_EVENTLINE <<
+                                D40_EVENTLINE_POS(event)) |
+                                ~D40_EVENTLINE_MASK(event), addr);
 
-                if (readl(addr) & D40_EVENTLINE_MASK(event))
-                        break;
-        }
+                        if (readl(addr) & D40_EVENTLINE_MASK(event))
+                                break;
+                }
 
-        if (tries != 99)
-                dev_dbg(chan2dev(d40c),
-                        "[%s] workaround enable S%cLNK (%d tries)\n",
-                        __func__, reg == D40_CHAN_REG_SSLNK ? 'S' : 'D',
-                        100 - tries);
+                if (tries != 99)
+                        dev_dbg(chan2dev(d40c),
+                                "[%s] workaround enable S%cLNK (%d tries)\n",
+                                __func__, reg == D40_CHAN_REG_SSLNK ? 'S' : 'D',
+                                100 - tries);
 
-        WARN_ON(!tries);
-}
+                WARN_ON(!tries);
+                break;
 
-static void d40_config_set_event(struct d40_chan *d40c, bool do_enable)
-{
-        unsigned long flags;
+        case D40_ROUND_EVENTLINE:
+                BUG();
+                break;
 
-        spin_lock_irqsave(&d40c->phy_chan->lock, flags);
+        }
+}
 
+static void d40_config_set_event(struct d40_chan *d40c,
+                                 enum d40_events event_type)
+{
         /* Enable event line connected to device (or memcpy) */
         if ((d40c->dma_cfg.dir ==  STEDMA40_PERIPH_TO_MEM) ||
             (d40c->dma_cfg.dir == STEDMA40_PERIPH_TO_PERIPH)) {
                 u32 event = D40_TYPE_TO_EVENT(d40c->dma_cfg.src_dev_type);
 
-                __d40_config_set_event(d40c, do_enable, event,
+                __d40_config_set_event(d40c, event_type, event,
                                        D40_CHAN_REG_SSLNK);
         }
 
         if (d40c->dma_cfg.dir !=  STEDMA40_PERIPH_TO_MEM) {
                 u32 event = D40_TYPE_TO_EVENT(d40c->dma_cfg.dst_dev_type);
 
-                __d40_config_set_event(d40c, do_enable, event,
+                __d40_config_set_event(d40c, event_type, event,
                                        D40_CHAN_REG_SDLNK);
         }
-
-        spin_unlock_irqrestore(&d40c->phy_chan->lock, flags);
 }
 
 static u32 d40_chan_has_events(struct d40_chan *d40c)
@@ -1047,6 +1112,64 @@ static u32 d40_chan_has_events(struct d40_chan *d40c)
         return val;
 }
 
+static int
+__d40_execute_command_log(struct d40_chan *d40c, enum d40_command command)
+{
+        unsigned long flags;
+        int ret = 0;
+        u32 active_status;
+        void __iomem *active_reg;
+
+        if (d40c->phy_chan->num % 2 == 0)
+                active_reg = d40c->base->virtbase + D40_DREG_ACTIVE;
+        else
+                active_reg = d40c->base->virtbase + D40_DREG_ACTIVO;
+
+
+        spin_lock_irqsave(&d40c->phy_chan->lock, flags);
+
+        switch (command) {
+        case D40_DMA_STOP:
+        case D40_DMA_SUSPEND_REQ:
+
+                active_status = (readl(active_reg) &
+                                 D40_CHAN_POS_MASK(d40c->phy_chan->num)) >>
+                                 D40_CHAN_POS(d40c->phy_chan->num);
+
+                if (active_status == D40_DMA_RUN)
+                        d40_config_set_event(d40c, D40_SUSPEND_REQ_EVENTLINE);
+                else
+                        d40_config_set_event(d40c, D40_DEACTIVATE_EVENTLINE);
+
+                if (!d40_chan_has_events(d40c) && (command == D40_DMA_STOP))
+                        ret = __d40_execute_command_phy(d40c, command);
+
+                break;
+
+        case D40_DMA_RUN:
+
+                d40_config_set_event(d40c, D40_ACTIVATE_EVENTLINE);
+                ret = __d40_execute_command_phy(d40c, command);
+                break;
+
+        case D40_DMA_SUSPENDED:
+                BUG();
+                break;
+        }
+
+        spin_unlock_irqrestore(&d40c->phy_chan->lock, flags);
+        return ret;
+}
+
+static int d40_channel_execute_command(struct d40_chan *d40c,
+                                       enum d40_command command)
+{
+        if (chan_is_logical(d40c))
+                return __d40_execute_command_log(d40c, command);
+        else
+                return __d40_execute_command_phy(d40c, command);
+}
+
 static u32 d40_get_prmo(struct d40_chan *d40c)
 {
         static const unsigned int phy_map[] = {
@@ -1149,15 +1272,7 @@ static int d40_pause(struct d40_chan *d40c)
         spin_lock_irqsave(&d40c->lock, flags);
 
         res = d40_channel_execute_command(d40c, D40_DMA_SUSPEND_REQ);
-        if (res == 0) {
-                if (chan_is_logical(d40c)) {
-                        d40_config_set_event(d40c, false);
-                        /* Resume the other logical channels if any */
-                        if (d40_chan_has_events(d40c))
-                                res = d40_channel_execute_command(d40c,
-                                                                  D40_DMA_RUN);
-                }
-        }
+
         pm_runtime_mark_last_busy(d40c->base->dev);
         pm_runtime_put_autosuspend(d40c->base->dev);
         spin_unlock_irqrestore(&d40c->lock, flags);
@@ -1174,45 +1289,17 @@ static int d40_resume(struct d40_chan *d40c)
 
         spin_lock_irqsave(&d40c->lock, flags);
         pm_runtime_get_sync(d40c->base->dev);
-        if (d40c->base->rev == 0)
-                if (chan_is_logical(d40c)) {
-                        res = d40_channel_execute_command(d40c,
-                                                          D40_DMA_SUSPEND_REQ);
-                        goto no_suspend;
-                }
 
         /* If bytes left to transfer or linked tx resume job */
-        if (d40_residue(d40c) || d40_tx_is_linked(d40c)) {
-
-                if (chan_is_logical(d40c))
-                        d40_config_set_event(d40c, true);
-
+        if (d40_residue(d40c) || d40_tx_is_linked(d40c))
                 res = d40_channel_execute_command(d40c, D40_DMA_RUN);
-        }
 
-no_suspend:
         pm_runtime_mark_last_busy(d40c->base->dev);
         pm_runtime_put_autosuspend(d40c->base->dev);
         spin_unlock_irqrestore(&d40c->lock, flags);
         return res;
 }
 
-static int d40_terminate_all(struct d40_chan *chan)
-{
-        unsigned long flags;
-        int ret = 0;
-
-        ret = d40_pause(chan);
-        if (!ret && chan_is_physical(chan))
-                ret = d40_channel_execute_command(chan, D40_DMA_STOP);
-
-        spin_lock_irqsave(&chan->lock, flags);
-        d40_term_all(chan);
-        spin_unlock_irqrestore(&chan->lock, flags);
-
-        return ret;
-}
-
 static dma_cookie_t d40_tx_submit(struct dma_async_tx_descriptor *tx)
 {
         struct d40_chan *d40c = container_of(tx->chan,
@@ -1232,20 +1319,6 @@ static dma_cookie_t d40_tx_submit(struct dma_async_tx_descriptor *tx)
 
 static int d40_start(struct d40_chan *d40c)
 {
-        if (d40c->base->rev == 0) {
-                int err;
-
-                if (chan_is_logical(d40c)) {
-                        err = d40_channel_execute_command(d40c,
-                                                          D40_DMA_SUSPEND_REQ);
-                        if (err)
-                                return err;
-                }
-        }
-
-        if (chan_is_logical(d40c))
-                d40_config_set_event(d40c, true);
-
         return d40_channel_execute_command(d40c, D40_DMA_RUN);
 }
 
@@ -1258,10 +1331,10 @@ static struct d40_desc *d40_queue_start(struct d40_chan *d40c)
         d40d = d40_first_queued(d40c);
 
         if (d40d != NULL) {
-                if (!d40c->busy)
+                if (!d40c->busy) {
                         d40c->busy = true;
-
-                pm_runtime_get_sync(d40c->base->dev);
+                        pm_runtime_get_sync(d40c->base->dev);
+                }
 
                 /* Remove from queue */
                 d40_desc_remove(d40d);
@@ -1388,8 +1461,8 @@ static void dma_tasklet(unsigned long data)
 
         return;
 
- err:
-        /* Rescue manoeuvre if receiving double interrupts */
+err:
+        /* Rescue manouver if receiving double interrupts */
         if (d40c->pending_tx > 0)
                 d40c->pending_tx--;
         spin_unlock_irqrestore(&d40c->lock, flags);
@@ -1770,7 +1843,6 @@ static int d40_config_memcpy(struct d40_chan *d40c)
         return 0;
 }
 
-
 static int d40_free_dma(struct d40_chan *d40c)
 {
 
@@ -1806,43 +1878,18 @@ static int d40_free_dma(struct d40_chan *d40c)
         }
 
         pm_runtime_get_sync(d40c->base->dev);
-        res = d40_channel_execute_command(d40c, D40_DMA_SUSPEND_REQ);
+        res = d40_channel_execute_command(d40c, D40_DMA_STOP);
         if (res) {
-                chan_err(d40c, "suspend failed\n");
+                chan_err(d40c, "stop failed\n");
                 goto out;
         }
 
-        if (chan_is_logical(d40c)) {
-                /* Release logical channel, deactivate the event line */
+        d40_alloc_mask_free(phy, is_src, chan_is_logical(d40c) ? event : 0);
 
-                d40_config_set_event(d40c, false);
+        if (chan_is_logical(d40c))
                 d40c->base->lookup_log_chans[d40c->log_num] = NULL;
-
-                /*
-                 * Check if there are more logical allocation
-                 * on this phy channel.
-                 */
-                if (!d40_alloc_mask_free(phy, is_src, event)) {
-                        /* Resume the other logical channels if any */
-                        if (d40_chan_has_events(d40c)) {
-                                res = d40_channel_execute_command(d40c,
-                                                                  D40_DMA_RUN);
-                                if (res)
-                                        chan_err(d40c,
-                                                "Executing RUN command\n");
-                        }
-                        goto out;
-                }
-        } else {
-                (void) d40_alloc_mask_free(phy, is_src, 0);
-        }
-
-        /* Release physical channel */
-        res = d40_channel_execute_command(d40c, D40_DMA_STOP);
-        if (res) {
-                chan_err(d40c, "Failed to stop channel\n");
-                goto out;
-        }
+        else
+                d40c->base->lookup_phy_chans[phy->num] = NULL;
 
         if (d40c->busy) {
                 pm_runtime_mark_last_busy(d40c->base->dev);
@@ -1852,7 +1899,6 @@ static int d40_free_dma(struct d40_chan *d40c)
         d40c->busy = false;
         d40c->phy_chan = NULL;
         d40c->configured = false;
-        d40c->base->lookup_phy_chans[phy->num] = NULL;
 out:
 
         pm_runtime_mark_last_busy(d40c->base->dev);
@@ -2070,7 +2116,7 @@ d40_prep_sg(struct dma_chan *dchan, struct scatterlist *sg_src,
         if (sg_next(&sg_src[sg_len - 1]) == sg_src)
                 desc->cyclic = true;
 
-        if (direction != DMA_NONE) {
+        if (direction != DMA_TRANS_NONE) {
                 dma_addr_t dev_addr = d40_get_dev_addr(chan, direction);
 
                 if (direction == DMA_DEV_TO_MEM)
@@ -2371,6 +2417,31 @@ static void d40_issue_pending(struct dma_chan *chan)
         spin_unlock_irqrestore(&d40c->lock, flags);
 }
 
+static void d40_terminate_all(struct dma_chan *chan)
+{
+        unsigned long flags;
+        struct d40_chan *d40c = container_of(chan, struct d40_chan, chan);
+        int ret;
+
+        spin_lock_irqsave(&d40c->lock, flags);
+
+        pm_runtime_get_sync(d40c->base->dev);
+        ret = d40_channel_execute_command(d40c, D40_DMA_STOP);
+        if (ret)
+                chan_err(d40c, "Failed to stop channel\n");
+
+        d40_term_all(d40c);
+        pm_runtime_mark_last_busy(d40c->base->dev);
+        pm_runtime_put_autosuspend(d40c->base->dev);
+        if (d40c->busy) {
+                pm_runtime_mark_last_busy(d40c->base->dev);
+                pm_runtime_put_autosuspend(d40c->base->dev);
+        }
+        d40c->busy = false;
+
+        spin_unlock_irqrestore(&d40c->lock, flags);
+}
+
 static int
 dma40_config_to_halfchannel(struct d40_chan *d40c,
                             struct stedma40_half_channel_info *info,
@@ -2551,7 +2622,8 @@ static int d40_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
 
         switch (cmd) {
         case DMA_TERMINATE_ALL:
-                return d40_terminate_all(d40c);
+                d40_terminate_all(chan);
+                return 0;
         case DMA_PAUSE:
                 return d40_pause(d40c);
         case DMA_RESUME:
@@ -2908,6 +2980,12 @@ static struct d40_base * __init d40_hw_detect_init(struct platform_device *pdev)
         dev_info(&pdev->dev, "hardware revision: %d @ 0x%x\n",
                  rev, res->start);
 
+        if (rev < 2) {
+                d40_err(&pdev->dev, "hardware revision: %d is not supported",
+                        rev);
+                goto failure;
+        }
+
         plat_data = pdev->dev.platform_data;
 
         /* Count the number of logical channels in use */
@@ -2998,6 +3076,7 @@ failure:
 
         if (base) {
                 kfree(base->lcla_pool.alloc_map);
+                kfree(base->reg_val_backup_chan);
                 kfree(base->lookup_log_chans);
                 kfree(base->lookup_phy_chans);
                 kfree(base->phy_res);
diff --git a/drivers/dma/ste_dma40_ll.h b/drivers/dma/ste_dma40_ll.h
index 8d3d490968a3..51e8e5396e9b 100644
--- a/drivers/dma/ste_dma40_ll.h
+++ b/drivers/dma/ste_dma40_ll.h
@@ -62,8 +62,6 @@
 #define D40_SREG_ELEM_LOG_LIDX_MASK     (0xFF << D40_SREG_ELEM_LOG_LIDX_POS)
 
 /* Link register */
-#define D40_DEACTIVATE_EVENTLINE        0x0
-#define D40_ACTIVATE_EVENTLINE          0x1
 #define D40_EVENTLINE_POS(i)            (2 * i)
 #define D40_EVENTLINE_MASK(i)           (0x3 << D40_EVENTLINE_POS(i))
 
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index d25599f2a3f8..47408e802ab6 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -191,6 +191,190 @@ utf16_strncmp(const efi_char16_t *a, const efi_char16_t *b, size_t len)
         }
 }
 
+static bool
+validate_device_path(struct efi_variable *var, int match, u8 *buffer,
+                     unsigned long len)
+{
+        struct efi_generic_dev_path *node;
+        int offset = 0;
+
+        node = (struct efi_generic_dev_path *)buffer;
+
+        if (len < sizeof(*node))
+                return false;
+
+        while (offset <= len - sizeof(*node) &&
+               node->length >= sizeof(*node) &&
+                node->length <= len - offset) {
+                offset += node->length;
+
+                if ((node->type == EFI_DEV_END_PATH ||
+                     node->type == EFI_DEV_END_PATH2) &&
+                    node->sub_type == EFI_DEV_END_ENTIRE)
+                        return true;
+
+                node = (struct efi_generic_dev_path *)(buffer + offset);
+        }
+
+        /*
+         * If we're here then either node->length pointed past the end
+         * of the buffer or we reached the end of the buffer without
+         * finding a device path end node.
+         */
+        return false;
+}
+
+static bool
+validate_boot_order(struct efi_variable *var, int match, u8 *buffer,
+                    unsigned long len)
+{
+        /* An array of 16-bit integers */
+        if ((len % 2) != 0)
+                return false;
+
+        return true;
+}
+
+static bool
+validate_load_option(struct efi_variable *var, int match, u8 *buffer,
+                     unsigned long len)
+{
+        u16 filepathlength;
+        int i, desclength = 0, namelen;
+
+        namelen = utf16_strnlen(var->VariableName, sizeof(var->VariableName));
+
+        /* Either "Boot" or "Driver" followed by four digits of hex */
+        for (i = match; i < match+4; i++) {
+                if (var->VariableName[i] > 127 ||
+                    hex_to_bin(var->VariableName[i] & 0xff) < 0)
+                        return true;
+        }
+
+        /* Reject it if there's 4 digits of hex and then further content */
+        if (namelen > match + 4)
+                return false;
+
+        /* A valid entry must be at least 8 bytes */
+        if (len < 8)
+                return false;
+
+        filepathlength = buffer[4] | buffer[5] << 8;
+
+        /*
+         * There's no stored length for the description, so it has to be
+         * found by hand
+         */
+        desclength = utf16_strsize((efi_char16_t *)(buffer + 6), len - 6) + 2;
+
+        /* Each boot entry must have a descriptor */
+        if (!desclength)
+                return false;
+
+        /*
+         * If the sum of the length of the description, the claimed filepath
+         * length and the original header are greater than the length of the
+         * variable, it's malformed
+         */
+        if ((desclength + filepathlength + 6) > len)
+                return false;
+
+        /*
+         * And, finally, check the filepath
+         */
+        return validate_device_path(var, match, buffer + desclength + 6,
+                                    filepathlength);
+}
+
+static bool
+validate_uint16(struct efi_variable *var, int match, u8 *buffer,
+                unsigned long len)
+{
+        /* A single 16-bit integer */
+        if (len != 2)
+                return false;
+
+        return true;
+}
+
+static bool
+validate_ascii_string(struct efi_variable *var, int match, u8 *buffer,
+                      unsigned long len)
+{
+        int i;
+
+        for (i = 0; i < len; i++) {
+                if (buffer[i] > 127)
+                        return false;
+
+                if (buffer[i] == 0)
+                        return true;
+        }
+
+        return false;
+}
+
+struct variable_validate {
+        char *name;
+        bool (*validate)(struct efi_variable *var, int match, u8 *data,
+                         unsigned long len);
+};
+
+static const struct variable_validate variable_validate[] = {
+        { "BootNext", validate_uint16 },
+        { "BootOrder", validate_boot_order },
+        { "DriverOrder", validate_boot_order },
+        { "Boot*", validate_load_option },
+        { "Driver*", validate_load_option },
+        { "ConIn", validate_device_path },
+        { "ConInDev", validate_device_path },
+        { "ConOut", validate_device_path },
+        { "ConOutDev", validate_device_path },
+        { "ErrOut", validate_device_path },
+        { "ErrOutDev", validate_device_path },
+        { "Timeout", validate_uint16 },
+        { "Lang", validate_ascii_string },
+        { "PlatformLang", validate_ascii_string },
+        { "", NULL },
+};
+
+static bool
+validate_var(struct efi_variable *var, u8 *data, unsigned long len)
+{
+        int i;
+        u16 *unicode_name = var->VariableName;
+
+        for (i = 0; variable_validate[i].validate != NULL; i++) {
+                const char *name = variable_validate[i].name;
+                int match;
+
+                for (match = 0; ; match++) {
+                        char c = name[match];
+                        u16 u = unicode_name[match];
+
+                        /* All special variables are plain ascii */
+                        if (u > 127)
+                                return true;
+
+                        /* Wildcard in the matching name means we've matched */
+                        if (c == '*')
+                                return variable_validate[i].validate(var,
+                                                             match, data, len);
+
+                        /* Case sensitive match */
+                        if (c != u)
+                                break;
+
+                        /* Reached the end of the string while matching */
+                        if (!c)
+                                return variable_validate[i].validate(var,
+                                                             match, data, len);
+                }
+        }
+
+        return true;
+}
+
 static efi_status_t
 get_var_data_locked(struct efivars *efivars, struct efi_variable *var)
 {
@@ -324,6 +508,12 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count)
                 return -EINVAL;
         }
 
+        if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 ||
+            validate_var(new_var, new_var->Data, new_var->DataSize) == false) {
+                printk(KERN_ERR "efivars: Malformed variable content\n");
+                return -EINVAL;
+        }
+
         spin_lock(&efivars->lock);
         status = efivars->ops->set_variable(new_var->VariableName,
                                             &new_var->VendorGuid,
@@ -626,6 +816,12 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
+        if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 ||
+            validate_var(new_var, new_var->Data, new_var->DataSize) == false) {
+                printk(KERN_ERR "efivars: Malformed variable content\n");
+                return -EINVAL;
+        }
+
         spin_lock(&efivars->lock);
 
         /*
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index edadbdad31d0..e03653d69357 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -430,7 +430,7 @@ config GPIO_ML_IOH
 
 config GPIO_SODAVILLE
         bool "Intel Sodaville GPIO support"
-        depends on X86 && PCI && OF && BROKEN
+        depends on X86 && PCI && OF
         select GPIO_GENERIC
         select GENERIC_IRQ_CHIP
         help
diff --git a/drivers/gpio/gpio-adp5588.c b/drivers/gpio/gpio-adp5588.c
index 9ad1703d1408..ae5d7f12ce66 100644
--- a/drivers/gpio/gpio-adp5588.c
+++ b/drivers/gpio/gpio-adp5588.c
@@ -252,7 +252,7 @@ static irqreturn_t adp5588_irq_handler(int irq, void *devid)
                 if (ret < 0)
                         memset(dev->irq_stat, 0, ARRAY_SIZE(dev->irq_stat));
 
-                for (bank = 0; bank <= ADP5588_BANK(ADP5588_MAXGPIO);
+                for (bank = 0, bit = 0; bank <= ADP5588_BANK(ADP5588_MAXGPIO);
                         bank++, bit = 0) {
                         pending = dev->irq_stat[bank] & dev->irq_mask[bank];
 
diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
index 5689ce62fd81..fc3ace3fd4cb 100644
--- a/drivers/gpio/gpio-pxa.c
+++ b/drivers/gpio/gpio-pxa.c
@@ -64,6 +64,7 @@ struct pxa_gpio_chip {
         unsigned long   irq_mask;
         unsigned long   irq_edge_rise;
         unsigned long   irq_edge_fall;
+        int (*set_wake)(unsigned int gpio, unsigned int on);
 
 #ifdef CONFIG_PM
         unsigned long   saved_gplr;
@@ -269,7 +270,8 @@ static void pxa_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
                                 (value ? GPSR_OFFSET : GPCR_OFFSET));
 }
 
-static int __devinit pxa_init_gpio_chip(int gpio_end)
+static int __devinit pxa_init_gpio_chip(int gpio_end,
+                                        int (*set_wake)(unsigned int, unsigned int))
 {
         int i, gpio, nbanks = gpio_to_bank(gpio_end) + 1;
         struct pxa_gpio_chip *chips;
@@ -285,6 +287,7 @@ static int __devinit pxa_init_gpio_chip(int gpio_end)
 
                 sprintf(chips[i].label, "gpio-%d", i);
                 chips[i].regbase = gpio_reg_base + BANK_OFF(i);
+                chips[i].set_wake = set_wake;
 
                 c->base  = gpio;
                 c->label = chips[i].label;
@@ -412,6 +415,17 @@ static void pxa_mask_muxed_gpio(struct irq_data *d)
         writel_relaxed(gfer, c->regbase + GFER_OFFSET);
 }
 
+static int pxa_gpio_set_wake(struct irq_data *d, unsigned int on)
+{
+        int gpio = pxa_irq_to_gpio(d->irq);
+        struct pxa_gpio_chip *c = gpio_to_pxachip(gpio);
+
+        if (c->set_wake)
+                return c->set_wake(gpio, on);
+        else
+                return 0;
+}
+
 static void pxa_unmask_muxed_gpio(struct irq_data *d)
 {
         int gpio = pxa_irq_to_gpio(d->irq);
@@ -427,6 +441,7 @@ static struct irq_chip pxa_muxed_gpio_chip = {
         .irq_mask       = pxa_mask_muxed_gpio,
         .irq_unmask     = pxa_unmask_muxed_gpio,
         .irq_set_type   = pxa_gpio_irq_type,
+        .irq_set_wake   = pxa_gpio_set_wake,
 };
 
 static int pxa_gpio_nums(void)
@@ -471,6 +486,7 @@ static int __devinit pxa_gpio_probe(struct platform_device *pdev)
         struct pxa_gpio_chip *c;
         struct resource *res;
         struct clk *clk;
+        struct pxa_gpio_platform_data *info;
         int gpio, irq, ret;
         int irq0 = 0, irq1 = 0, irq_mux, gpio_offset = 0;
 
@@ -516,7 +532,8 @@ static int __devinit pxa_gpio_probe(struct platform_device *pdev)
         }
 
         /* Initialize GPIO chips */
-        pxa_init_gpio_chip(pxa_last_gpio);
+        info = dev_get_platdata(&pdev->dev);
+        pxa_init_gpio_chip(pxa_last_gpio, info ? info->gpio_set_wake : NULL);
 
         /* clear all GPIO edge detects */
         for_each_gpio_chip(gpio, c) {
diff --git a/drivers/gpio/gpio-samsung.c b/drivers/gpio/gpio-samsung.c
index 46277877b7ec..19d6fc0229c3 100644
--- a/drivers/gpio/gpio-samsung.c
+++ b/drivers/gpio/gpio-samsung.c
@@ -2382,8 +2382,8 @@ static struct samsung_gpio_chip exynos4_gpios_3[] = {
 #endif
 };
 
-static struct samsung_gpio_chip exynos5_gpios_1[] = {
 #ifdef CONFIG_ARCH_EXYNOS5
+static struct samsung_gpio_chip exynos5_gpios_1[] = {
         {
                 .chip   = {
                         .base   = EXYNOS5_GPA0(0),
@@ -2541,11 +2541,11 @@ static struct samsung_gpio_chip exynos5_gpios_1[] = {
                         .to_irq = samsung_gpiolib_to_irq,
                 },
         },
-#endif
 };
+#endif
 
-static struct samsung_gpio_chip exynos5_gpios_2[] = {
 #ifdef CONFIG_ARCH_EXYNOS5
+static struct samsung_gpio_chip exynos5_gpios_2[] = {
         {
                 .chip   = {
                         .base   = EXYNOS5_GPE0(0),
@@ -2602,11 +2602,11 @@ static struct samsung_gpio_chip exynos5_gpios_2[] = {
 
                 },
         },
-#endif
 };
+#endif
 
-static struct samsung_gpio_chip exynos5_gpios_3[] = {
 #ifdef CONFIG_ARCH_EXYNOS5
+static struct samsung_gpio_chip exynos5_gpios_3[] = {
         {
                 .chip   = {
                         .base   = EXYNOS5_GPV0(0),
@@ -2638,11 +2638,11 @@ static struct samsung_gpio_chip exynos5_gpios_3[] = {
                         .label  = "GPV4",
                 },
         },
-#endif
 };
+#endif
 
-static struct samsung_gpio_chip exynos5_gpios_4[] = {
 #ifdef CONFIG_ARCH_EXYNOS5
+static struct samsung_gpio_chip exynos5_gpios_4[] = {
         {
                 .chip   = {
                         .base   = EXYNOS5_GPZ(0),
@@ -2650,8 +2650,8 @@ static struct samsung_gpio_chip exynos5_gpios_4[] = {
                         .label  = "GPZ",
                 },
         },
-#endif
 };
+#endif
 
 
 #if defined(CONFIG_ARCH_EXYNOS) && defined(CONFIG_OF)
diff --git a/drivers/gpio/gpio-sodaville.c b/drivers/gpio/gpio-sodaville.c
index 9ba15d31d242..031e5d24837d 100644
--- a/drivers/gpio/gpio-sodaville.c
+++ b/drivers/gpio/gpio-sodaville.c
@@ -41,7 +41,7 @@
 struct sdv_gpio_chip_data {
         int irq_base;
         void __iomem *gpio_pub_base;
-        struct irq_domain id;
+        struct irq_domain *id;
         struct irq_chip_generic *gc;
         struct bgpio_chip bgpio;
 };
@@ -51,10 +51,9 @@ static int sdv_gpio_pub_set_type(struct irq_data *d, unsigned int type)
         struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
         struct sdv_gpio_chip_data *sd = gc->private;
         void __iomem *type_reg;
-        u32 irq_offs = d->irq - sd->irq_base;
         u32 reg;
 
-        if (irq_offs < 8)
+        if (d->hwirq < 8)
                 type_reg = sd->gpio_pub_base + GPIT1R0;
         else
                 type_reg = sd->gpio_pub_base + GPIT1R1;
@@ -63,11 +62,11 @@ static int sdv_gpio_pub_set_type(struct irq_data *d, unsigned int type)
 
         switch (type) {
         case IRQ_TYPE_LEVEL_HIGH:
-                reg &= ~BIT(4 * (irq_offs % 8));
+                reg &= ~BIT(4 * (d->hwirq % 8));
                 break;
 
         case IRQ_TYPE_LEVEL_LOW:
-                reg |= BIT(4 * (irq_offs % 8));
+                reg |= BIT(4 * (d->hwirq % 8));
                 break;
 
         default:
@@ -91,7 +90,7 @@ static irqreturn_t sdv_gpio_pub_irq_handler(int irq, void *data)
                 u32 irq_bit = __fls(irq_stat);
 
                 irq_stat &= ~BIT(irq_bit);
-                generic_handle_irq(sd->irq_base + irq_bit);
+                generic_handle_irq(irq_find_mapping(sd->id, irq_bit));
         }
 
         return IRQ_HANDLED;
@@ -127,7 +126,7 @@ static int sdv_xlate(struct irq_domain *h, struct device_node *node,
 }
 
 static struct irq_domain_ops irq_domain_sdv_ops = {
-        .dt_translate   = sdv_xlate,
+        .xlate = sdv_xlate,
 };
 
 static __devinit int sdv_register_irqsupport(struct sdv_gpio_chip_data *sd,
@@ -149,10 +148,6 @@ static __devinit int sdv_register_irqsupport(struct sdv_gpio_chip_data *sd,
         if (ret)
                 goto out_free_desc;
 
-        sd->id.irq_base = sd->irq_base;
-        sd->id.of_node = of_node_get(pdev->dev.of_node);
-        sd->id.ops = &irq_domain_sdv_ops;
-
         /*
          * This gpio irq controller latches level irqs. Testing shows that if
          * we unmask & ACK the IRQ before the source of the interrupt is gone
@@ -179,7 +174,10 @@ static __devinit int sdv_register_irqsupport(struct sdv_gpio_chip_data *sd,
                         IRQ_GC_INIT_MASK_CACHE, IRQ_NOREQUEST,
                         IRQ_LEVEL | IRQ_NOPROBE);
 
-        irq_domain_add(&sd->id);
+        sd->id = irq_domain_add_legacy(pdev->dev.of_node, SDV_NUM_PUB_GPIOS,
+                                sd->irq_base, 0, &irq_domain_sdv_ops, sd);
+        if (!sd->id)
+                goto out_free_irq;
         return 0;
 out_free_irq:
         free_irq(pdev->irq, sd);
@@ -260,7 +258,6 @@ static void sdv_gpio_remove(struct pci_dev *pdev)
 {
         struct sdv_gpio_chip_data *sd = pci_get_drvdata(pdev);
 
-        irq_domain_del(&sd->id);
         free_irq(pdev->irq, sd);
         irq_free_descs(sd->irq_base, SDV_NUM_PUB_GPIOS);
 
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index 30372f7b2d45..348b367debeb 100644
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -1510,8 +1510,8 @@ int drm_freebufs(struct drm_device *dev, void *data,
  * \param arg pointer to a drm_buf_map structure.
  * \return zero on success or a negative number on failure.
  *
- * Maps the AGP, SG or PCI buffer region with do_mmap(), and copies information
- * about each buffer into user space. For PCI buffers, it calls do_mmap() with
+ * Maps the AGP, SG or PCI buffer region with vm_mmap(), and copies information
+ * about each buffer into user space. For PCI buffers, it calls vm_mmap() with
  * offset equal to 0, which drm_mmap() interpretes as PCI buffers and calls
  * drm_mmap_dma().
  */
@@ -1553,18 +1553,14 @@ int drm_mapbufs(struct drm_device *dev, void *data,
                                 retcode = -EINVAL;
                                 goto done;
                         }
-                        down_write(&current->mm->mmap_sem);
-                        virtual = do_mmap(file_priv->filp, 0, map->size,
+                        virtual = vm_mmap(file_priv->filp, 0, map->size,
                                           PROT_READ | PROT_WRITE,
                                           MAP_SHARED,
                                           token);
-                        up_write(&current->mm->mmap_sem);
                 } else {
-                        down_write(&current->mm->mmap_sem);
-                        virtual = do_mmap(file_priv->filp, 0, dma->byte_count,
+                        virtual = vm_mmap(file_priv->filp, 0, dma->byte_count,
                                           PROT_READ | PROT_WRITE,
                                           MAP_SHARED, 0);
-                        up_write(&current->mm->mmap_sem);
                 }
                 if (virtual > -1024UL) {
                         /* Real error */
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index d3aaeb6ae236..c79870a75c2f 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -3335,10 +3335,12 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
 
         ret = crtc->funcs->page_flip(crtc, fb, e);
         if (ret) {
-                spin_lock_irqsave(&dev->event_lock, flags);
-                file_priv->event_space += sizeof e->event;
-                spin_unlock_irqrestore(&dev->event_lock, flags);
-                kfree(e);
+                if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
+                        spin_lock_irqsave(&dev->event_lock, flags);
+                        file_priv->event_space += sizeof e->event;
+                        spin_unlock_irqrestore(&dev->event_lock, flags);
+                        kfree(e);
+                }
         }
 
 out:
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index cdfbf27b2b3c..123de28f94ef 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -507,12 +507,12 @@ int drm_release(struct inode *inode, struct file *filp)
 
         drm_events_release(file_priv);
 
-        if (dev->driver->driver_features & DRIVER_GEM)
-                drm_gem_release(dev, file_priv);
-
         if (dev->driver->driver_features & DRIVER_MODESET)
                 drm_fb_release(file_priv);
 
+        if (dev->driver->driver_features & DRIVER_GEM)
+                drm_gem_release(dev, file_priv);
+
         mutex_lock(&dev->ctxlist_mutex);
         if (!list_empty(&dev->ctxlist)) {
                 struct drm_ctx_list *pos, *n;
diff --git a/drivers/gpu/drm/drm_usb.c b/drivers/gpu/drm/drm_usb.c
index c8c83dad2ce1..37c9a523dd1c 100644
--- a/drivers/gpu/drm/drm_usb.c
+++ b/drivers/gpu/drm/drm_usb.c
@@ -1,6 +1,6 @@
 #include "drmP.h"
 #include <linux/usb.h>
-#include <linux/export.h>
+#include <linux/module.h>
 
 int drm_get_usb_dev(struct usb_interface *interface,
                     const struct usb_device_id *id,
@@ -114,3 +114,7 @@ void drm_usb_exit(struct drm_driver *driver,
         usb_deregister(udriver);
 }
 EXPORT_SYMBOL(drm_usb_exit);
+
+MODULE_AUTHOR("David Airlie");
+MODULE_DESCRIPTION("USB DRM support");
+MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/gpu/drm/exynos/exynos_drm_buf.c b/drivers/gpu/drm/exynos/exynos_drm_buf.c
index 4a3a5f72ed4a..de8d2090bce3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_buf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_buf.c
@@ -34,14 +34,14 @@
 static int lowlevel_buffer_allocate(struct drm_device *dev,
                 unsigned int flags, struct exynos_drm_gem_buf *buf)
 {
-        dma_addr_t start_addr, end_addr;
+        dma_addr_t start_addr;
         unsigned int npages, page_size, i = 0;
         struct scatterlist *sgl;
         int ret = 0;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (flags & EXYNOS_BO_NONCONTIG) {
+        if (IS_NONCONTIG_BUFFER(flags)) {
                 DRM_DEBUG_KMS("not support allocation type.\n");
                 return -EINVAL;
         }
@@ -52,13 +52,13 @@ static int lowlevel_buffer_allocate(struct drm_device *dev,
         }
 
         if (buf->size >= SZ_1M) {
-                npages = (buf->size >> SECTION_SHIFT) + 1;
+                npages = buf->size >> SECTION_SHIFT;
                 page_size = SECTION_SIZE;
         } else if (buf->size >= SZ_64K) {
-                npages = (buf->size >> 16) + 1;
+                npages = buf->size >> 16;
                 page_size = SZ_64K;
         } else {
-                npages = (buf->size >> PAGE_SHIFT) + 1;
+                npages = buf->size >> PAGE_SHIFT;
                 page_size = PAGE_SIZE;
         }
 
@@ -76,26 +76,13 @@ static int lowlevel_buffer_allocate(struct drm_device *dev,
                 return -ENOMEM;
         }
 
-                buf->kvaddr = dma_alloc_writecombine(dev->dev, buf->size,
-                                &buf->dma_addr, GFP_KERNEL);
-                if (!buf->kvaddr) {
-                        DRM_ERROR("failed to allocate buffer.\n");
-                        ret = -ENOMEM;
-                        goto err1;
-                }
-
-                start_addr = buf->dma_addr;
-                end_addr = buf->dma_addr + buf->size;
-
-                buf->pages = kzalloc(sizeof(struct page) * npages, GFP_KERNEL);
-                if (!buf->pages) {
-                        DRM_ERROR("failed to allocate pages.\n");
-                        ret = -ENOMEM;
-                        goto err2;
-                }
-
-        start_addr = buf->dma_addr;
-        end_addr = buf->dma_addr + buf->size;
+        buf->kvaddr = dma_alloc_writecombine(dev->dev, buf->size,
+                        &buf->dma_addr, GFP_KERNEL);
+        if (!buf->kvaddr) {
+                DRM_ERROR("failed to allocate buffer.\n");
+                ret = -ENOMEM;
+                goto err1;
+        }
 
         buf->pages = kzalloc(sizeof(struct page) * npages, GFP_KERNEL);
         if (!buf->pages) {
@@ -105,23 +92,17 @@ static int lowlevel_buffer_allocate(struct drm_device *dev,
         }
 
         sgl = buf->sgt->sgl;
+        start_addr = buf->dma_addr;
 
         while (i < npages) {
                 buf->pages[i] = phys_to_page(start_addr);
                 sg_set_page(sgl, buf->pages[i], page_size, 0);
                 sg_dma_address(sgl) = start_addr;
                 start_addr += page_size;
-                if (end_addr - start_addr < page_size)
-                        break;
                 sgl = sg_next(sgl);
                 i++;
         }
 
-        buf->pages[i] = phys_to_page(start_addr);
-
-        sgl = sg_next(sgl);
-        sg_set_page(sgl, buf->pages[i+1], end_addr - start_addr, 0);
-
         DRM_DEBUG_KMS("vaddr(0x%lx), dma_addr(0x%lx), size(0x%lx)\n",
                         (unsigned long)buf->kvaddr,
                         (unsigned long)buf->dma_addr,
@@ -150,7 +131,7 @@ static void lowlevel_buffer_deallocate(struct drm_device *dev,
          * non-continuous memory would be released by exynos
          * gem framework.
          */
-        if (flags & EXYNOS_BO_NONCONTIG) {
+        if (IS_NONCONTIG_BUFFER(flags)) {
                 DRM_DEBUG_KMS("not support allocation type.\n");
                 return;
         }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_core.c b/drivers/gpu/drm/exynos/exynos_drm_core.c
index 411832e8e17a..eaf630dc5dba 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_core.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_core.c
@@ -54,16 +54,18 @@ static int exynos_drm_subdrv_probe(struct drm_device *dev,
                  *
                  * P.S. note that this driver is considered for modularization.
                  */
-                ret = subdrv->probe(dev, subdrv->manager.dev);
+                ret = subdrv->probe(dev, subdrv->dev);
                 if (ret)
                         return ret;
         }
 
-        if (subdrv->is_local)
+        if (!subdrv->manager)
                 return 0;
 
+        subdrv->manager->dev = subdrv->dev;
+
         /* create and initialize a encoder for this sub driver. */
-        encoder = exynos_drm_encoder_create(dev, &subdrv->manager,
+        encoder = exynos_drm_encoder_create(dev, subdrv->manager,
                         (1 << MAX_CRTC) - 1);
         if (!encoder) {
                 DRM_ERROR("failed to create encoder\n");
@@ -186,7 +188,7 @@ int exynos_drm_subdrv_open(struct drm_device *dev, struct drm_file *file)
 
         list_for_each_entry(subdrv, &exynos_drm_subdrv_list, list) {
                 if (subdrv->open) {
-                        ret = subdrv->open(dev, subdrv->manager.dev, file);
+                        ret = subdrv->open(dev, subdrv->dev, file);
                         if (ret)
                                 goto err;
                 }
@@ -197,7 +199,7 @@ int exynos_drm_subdrv_open(struct drm_device *dev, struct drm_file *file)
 err:
         list_for_each_entry_reverse(subdrv, &subdrv->list, list) {
                 if (subdrv->close)
-                        subdrv->close(dev, subdrv->manager.dev, file);
+                        subdrv->close(dev, subdrv->dev, file);
         }
         return ret;
 }
@@ -209,7 +211,7 @@ void exynos_drm_subdrv_close(struct drm_device *dev, struct drm_file *file)
 
         list_for_each_entry(subdrv, &exynos_drm_subdrv_list, list) {
                 if (subdrv->close)
-                        subdrv->close(dev, subdrv->manager.dev, file);
+                        subdrv->close(dev, subdrv->dev, file);
         }
 }
 EXPORT_SYMBOL_GPL(exynos_drm_subdrv_close);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index fbd0a232c93d..1d814175cd49 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -225,24 +225,25 @@ struct exynos_drm_private {
  * Exynos drm sub driver structure.
  *
  * @list: sub driver has its own list object to register to exynos drm driver.
+ * @dev: pointer to device object for subdrv device driver.
  * @drm_dev: pointer to drm_device and this pointer would be set
  *      when sub driver calls exynos_drm_subdrv_register().
- * @is_local: appear encoder and connector disrelated device.
+ * @manager: subdrv has its own manager to control a hardware appropriately
+ *      and we can access a hardware drawing on this manager.
  * @probe: this callback would be called by exynos drm driver after
  *      subdrv is registered to it.
  * @remove: this callback is used to release resources created
  *      by probe callback.
  * @open: this would be called with drm device file open.
  * @close: this would be called with drm device file close.
- * @manager: subdrv has its own manager to control a hardware appropriately
- *      and we can access a hardware drawing on this manager.
  * @encoder: encoder object owned by this sub driver.
  * @connector: connector object owned by this sub driver.
  */
 struct exynos_drm_subdrv {
         struct list_head list;
+        struct device *dev;
         struct drm_device *drm_dev;
-        bool is_local;
+        struct exynos_drm_manager *manager;
 
         int (*probe)(struct drm_device *drm_dev, struct device *dev);
         void (*remove)(struct drm_device *dev);
@@ -251,7 +252,6 @@ struct exynos_drm_subdrv {
         void (*close)(struct drm_device *drm_dev, struct device *dev,
                         struct drm_file *file);
 
-        struct exynos_drm_manager manager;
         struct drm_encoder *encoder;
         struct drm_connector *connector;
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index ecb6db229700..29fdbfeb43cb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -172,7 +172,7 @@ static void fimd_dpms(struct device *subdrv_dev, int mode)
 static void fimd_apply(struct device *subdrv_dev)
 {
         struct fimd_context *ctx = get_fimd_context(subdrv_dev);
-        struct exynos_drm_manager *mgr = &ctx->subdrv.manager;
+        struct exynos_drm_manager *mgr = ctx->subdrv.manager;
         struct exynos_drm_manager_ops *mgr_ops = mgr->ops;
         struct exynos_drm_overlay_ops *ovl_ops = mgr->overlay_ops;
         struct fimd_win_data *win_data;
@@ -577,6 +577,13 @@ static struct exynos_drm_overlay_ops fimd_overlay_ops = {
         .disable = fimd_win_disable,
 };
 
+static struct exynos_drm_manager fimd_manager = {
+        .pipe           = -1,
+        .ops            = &fimd_manager_ops,
+        .overlay_ops    = &fimd_overlay_ops,
+        .display_ops    = &fimd_display_ops,
+};
+
 static void fimd_finish_pageflip(struct drm_device *drm_dev, int crtc)
 {
         struct exynos_drm_private *dev_priv = drm_dev->dev_private;
@@ -628,7 +635,7 @@ static irqreturn_t fimd_irq_handler(int irq, void *dev_id)
         struct fimd_context *ctx = (struct fimd_context *)dev_id;
         struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
         struct drm_device *drm_dev = subdrv->drm_dev;
-        struct exynos_drm_manager *manager = &subdrv->manager;
+        struct exynos_drm_manager *manager = subdrv->manager;
         u32 val;
 
         val = readl(ctx->regs + VIDINTCON1);
@@ -744,7 +751,7 @@ static void fimd_clear_win(struct fimd_context *ctx, int win)
 static int fimd_power_on(struct fimd_context *ctx, bool enable)
 {
         struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
-        struct device *dev = subdrv->manager.dev;
+        struct device *dev = subdrv->dev;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
@@ -867,13 +874,10 @@ static int __devinit fimd_probe(struct platform_device *pdev)
 
         subdrv = &ctx->subdrv;
 
+        subdrv->dev = dev;
+        subdrv->manager = &fimd_manager;
         subdrv->probe = fimd_subdrv_probe;
         subdrv->remove = fimd_subdrv_remove;
-        subdrv->manager.pipe = -1;
-        subdrv->manager.ops = &fimd_manager_ops;
-        subdrv->manager.overlay_ops = &fimd_overlay_ops;
-        subdrv->manager.display_ops = &fimd_display_ops;
-        subdrv->manager.dev = dev;
 
         mutex_init(&ctx->lock);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index fa1aa94a3d8e..1dffa8359f88 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -56,9 +56,28 @@ static unsigned int convert_to_vm_err_msg(int msg)
         return out_msg;
 }
 
-static unsigned int mask_gem_flags(unsigned int flags)
+static int check_gem_flags(unsigned int flags)
 {
-        return flags &= EXYNOS_BO_NONCONTIG;
+        if (flags & ~(EXYNOS_BO_MASK)) {
+                DRM_ERROR("invalid flags.\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static unsigned long roundup_gem_size(unsigned long size, unsigned int flags)
+{
+        if (!IS_NONCONTIG_BUFFER(flags)) {
+                if (size >= SZ_1M)
+                        return roundup(size, SECTION_SIZE);
+                else if (size >= SZ_64K)
+                        return roundup(size, SZ_64K);
+                else
+                        goto out;
+        }
+out:
+        return roundup(size, PAGE_SIZE);
 }
 
 static struct page **exynos_gem_get_pages(struct drm_gem_object *obj,
@@ -130,22 +149,12 @@ static int exynos_drm_gem_map_pages(struct drm_gem_object *obj,
         unsigned long pfn;
 
         if (exynos_gem_obj->flags & EXYNOS_BO_NONCONTIG) {
-                unsigned long usize = buf->size;
-
                 if (!buf->pages)
                         return -EINTR;
 
-                while (usize > 0) {
-                        pfn = page_to_pfn(buf->pages[page_offset++]);
-                        vm_insert_mixed(vma, f_vaddr, pfn);
-                        f_vaddr += PAGE_SIZE;
-                        usize -= PAGE_SIZE;
-                }
-
-                return 0;
-        }
-
-        pfn = (buf->dma_addr >> PAGE_SHIFT) + page_offset;
+                pfn = page_to_pfn(buf->pages[page_offset++]);
+        } else
+                pfn = (buf->dma_addr >> PAGE_SHIFT) + page_offset;
 
         return vm_insert_mixed(vma, f_vaddr, pfn);
 }
@@ -319,10 +328,17 @@ struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_device *dev,
         struct exynos_drm_gem_buf *buf;
         int ret;
 
-        size = roundup(size, PAGE_SIZE);
-        DRM_DEBUG_KMS("%s: size = 0x%lx\n", __FILE__, size);
+        if (!size) {
+                DRM_ERROR("invalid size.\n");
+                return ERR_PTR(-EINVAL);
+        }
+
+        size = roundup_gem_size(size, flags);
+        DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        flags = mask_gem_flags(flags);
+        ret = check_gem_flags(flags);
+        if (ret)
+                return ERR_PTR(ret);
 
         buf = exynos_drm_init_buf(dev, size);
         if (!buf)
@@ -331,7 +347,7 @@ struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_device *dev,
         exynos_gem_obj = exynos_drm_gem_init(dev, size);
         if (!exynos_gem_obj) {
                 ret = -ENOMEM;
-                goto err;
+                goto err_fini_buf;
         }
 
         exynos_gem_obj->buffer = buf;
@@ -347,18 +363,19 @@ struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_device *dev,
                 ret = exynos_drm_gem_get_pages(&exynos_gem_obj->base);
                 if (ret < 0) {
                         drm_gem_object_release(&exynos_gem_obj->base);
-                        goto err;
+                        goto err_fini_buf;
                 }
         } else {
                 ret = exynos_drm_alloc_buf(dev, buf, flags);
                 if (ret < 0) {
                         drm_gem_object_release(&exynos_gem_obj->base);
-                        goto err;
+                        goto err_fini_buf;
                 }
         }
 
         return exynos_gem_obj;
-err:
+
+err_fini_buf:
         exynos_drm_fini_buf(dev, buf);
         return ERR_PTR(ret);
 }
@@ -497,6 +514,8 @@ static int exynos_drm_gem_mmap_buffer(struct file *filp,
                 if (!buffer->pages)
                         return -EINVAL;
 
+                vma->vm_flags |= VM_MIXEDMAP;
+
                 do {
                         ret = vm_insert_page(vma, uaddr, buffer->pages[i++]);
                         if (ret) {
@@ -554,10 +573,8 @@ int exynos_drm_gem_mmap_ioctl(struct drm_device *dev, void *data,
         obj->filp->f_op = &exynos_drm_gem_fops;
         obj->filp->private_data = obj;
 
-        down_write(&current->mm->mmap_sem);
-        addr = do_mmap(obj->filp, 0, args->size,
+        addr = vm_mmap(obj->filp, 0, args->size,
                         PROT_READ | PROT_WRITE, MAP_SHARED, 0);
-        up_write(&current->mm->mmap_sem);
 
         drm_gem_object_unreference_unlocked(obj);
 
@@ -685,7 +702,6 @@ int exynos_drm_gem_dumb_destroy(struct drm_file *file_priv,
 int exynos_drm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
         struct drm_gem_object *obj = vma->vm_private_data;
-        struct exynos_drm_gem_obj *exynos_gem_obj = to_exynos_gem_obj(obj);
         struct drm_device *dev = obj->dev;
         unsigned long f_vaddr;
         pgoff_t page_offset;
@@ -697,21 +713,10 @@ int exynos_drm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 
         mutex_lock(&dev->struct_mutex);
 
-        /*
-         * allocate all pages as desired size if user wants to allocate
-         * physically non-continuous memory.
-         */
-        if (exynos_gem_obj->flags & EXYNOS_BO_NONCONTIG) {
-                ret = exynos_drm_gem_get_pages(obj);
-                if (ret < 0)
-                        goto err;
-        }
-
         ret = exynos_drm_gem_map_pages(obj, vma, f_vaddr, page_offset);
         if (ret < 0)
                 DRM_ERROR("failed to map pages.\n");
 
-err:
         mutex_unlock(&dev->struct_mutex);
 
         return convert_to_vm_err_msg(ret);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.h b/drivers/gpu/drm/exynos/exynos_drm_gem.h
index e40fbad8b705..4ed842039505 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.h
@@ -29,6 +29,8 @@
 #define to_exynos_gem_obj(x)    container_of(x,\
                         struct exynos_drm_gem_obj, base)
 
+#define IS_NONCONTIG_BUFFER(f)          (f & EXYNOS_BO_NONCONTIG)
+
 /*
  * exynos drm gem buffer structure.
  *
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index 14eb26b0ba1c..3424463676e0 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -30,9 +30,8 @@
                                         struct drm_hdmi_context, subdrv);
 
 /* these callback points shoud be set by specific drivers. */
-static struct exynos_hdmi_display_ops *hdmi_display_ops;
-static struct exynos_hdmi_manager_ops *hdmi_manager_ops;
-static struct exynos_hdmi_overlay_ops *hdmi_overlay_ops;
+static struct exynos_hdmi_ops *hdmi_ops;
+static struct exynos_mixer_ops *mixer_ops;
 
 struct drm_hdmi_context {
         struct exynos_drm_subdrv        subdrv;
@@ -40,31 +39,20 @@ struct drm_hdmi_context {
         struct exynos_drm_hdmi_context  *mixer_ctx;
 };
 
-void exynos_drm_display_ops_register(struct exynos_hdmi_display_ops
-                                        *display_ops)
+void exynos_hdmi_ops_register(struct exynos_hdmi_ops *ops)
 {
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (display_ops)
-                hdmi_display_ops = display_ops;
+        if (ops)
+                hdmi_ops = ops;
 }
 
-void exynos_drm_manager_ops_register(struct exynos_hdmi_manager_ops
-                                        *manager_ops)
+void exynos_mixer_ops_register(struct exynos_mixer_ops *ops)
 {
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (manager_ops)
-                hdmi_manager_ops = manager_ops;
-}
-
-void exynos_drm_overlay_ops_register(struct exynos_hdmi_overlay_ops
-                                        *overlay_ops)
-{
-        DRM_DEBUG_KMS("%s\n", __FILE__);
-
-        if (overlay_ops)
-                hdmi_overlay_ops = overlay_ops;
+        if (ops)
+                mixer_ops = ops;
 }
 
 static bool drm_hdmi_is_connected(struct device *dev)
@@ -73,8 +61,8 @@ static bool drm_hdmi_is_connected(struct device *dev)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_display_ops && hdmi_display_ops->is_connected)
-                return hdmi_display_ops->is_connected(ctx->hdmi_ctx->ctx);
+        if (hdmi_ops && hdmi_ops->is_connected)
+                return hdmi_ops->is_connected(ctx->hdmi_ctx->ctx);
 
         return false;
 }
@@ -86,9 +74,9 @@ static int drm_hdmi_get_edid(struct device *dev,
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_display_ops && hdmi_display_ops->get_edid)
-                return hdmi_display_ops->get_edid(ctx->hdmi_ctx->ctx,
-                                connector, edid, len);
+        if (hdmi_ops && hdmi_ops->get_edid)
+                return hdmi_ops->get_edid(ctx->hdmi_ctx->ctx, connector, edid,
+                                          len);
 
         return 0;
 }
@@ -99,9 +87,8 @@ static int drm_hdmi_check_timing(struct device *dev, void *timing)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_display_ops && hdmi_display_ops->check_timing)
-                return hdmi_display_ops->check_timing(ctx->hdmi_ctx->ctx,
-                                timing);
+        if (hdmi_ops && hdmi_ops->check_timing)
+                return hdmi_ops->check_timing(ctx->hdmi_ctx->ctx, timing);
 
         return 0;
 }
@@ -112,8 +99,8 @@ static int drm_hdmi_power_on(struct device *dev, int mode)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_display_ops && hdmi_display_ops->power_on)
-                return hdmi_display_ops->power_on(ctx->hdmi_ctx->ctx, mode);
+        if (hdmi_ops && hdmi_ops->power_on)
+                return hdmi_ops->power_on(ctx->hdmi_ctx->ctx, mode);
 
         return 0;
 }
@@ -130,13 +117,13 @@ static int drm_hdmi_enable_vblank(struct device *subdrv_dev)
 {
         struct drm_hdmi_context *ctx = to_context(subdrv_dev);
         struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
-        struct exynos_drm_manager *manager = &subdrv->manager;
+        struct exynos_drm_manager *manager = subdrv->manager;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_overlay_ops && hdmi_overlay_ops->enable_vblank)
-                return hdmi_overlay_ops->enable_vblank(ctx->mixer_ctx->ctx,
-                                                        manager->pipe);
+        if (mixer_ops && mixer_ops->enable_vblank)
+                return mixer_ops->enable_vblank(ctx->mixer_ctx->ctx,
+                                                manager->pipe);
 
         return 0;
 }
@@ -147,8 +134,8 @@ static void drm_hdmi_disable_vblank(struct device *subdrv_dev)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_overlay_ops && hdmi_overlay_ops->disable_vblank)
-                return hdmi_overlay_ops->disable_vblank(ctx->mixer_ctx->ctx);
+        if (mixer_ops && mixer_ops->disable_vblank)
+                return mixer_ops->disable_vblank(ctx->mixer_ctx->ctx);
 }
 
 static void drm_hdmi_mode_fixup(struct device *subdrv_dev,
@@ -160,9 +147,9 @@ static void drm_hdmi_mode_fixup(struct device *subdrv_dev,
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_manager_ops && hdmi_manager_ops->mode_fixup)
-                hdmi_manager_ops->mode_fixup(ctx->hdmi_ctx->ctx, connector,
-                                                mode, adjusted_mode);
+        if (hdmi_ops && hdmi_ops->mode_fixup)
+                hdmi_ops->mode_fixup(ctx->hdmi_ctx->ctx, connector, mode,
+                                     adjusted_mode);
 }
 
 static void drm_hdmi_mode_set(struct device *subdrv_dev, void *mode)
@@ -171,8 +158,8 @@ static void drm_hdmi_mode_set(struct device *subdrv_dev, void *mode)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_manager_ops && hdmi_manager_ops->mode_set)
-                hdmi_manager_ops->mode_set(ctx->hdmi_ctx->ctx, mode);
+        if (hdmi_ops && hdmi_ops->mode_set)
+                hdmi_ops->mode_set(ctx->hdmi_ctx->ctx, mode);
 }
 
 static void drm_hdmi_get_max_resol(struct device *subdrv_dev,
@@ -182,9 +169,8 @@ static void drm_hdmi_get_max_resol(struct device *subdrv_dev,
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_manager_ops && hdmi_manager_ops->get_max_resol)
-                hdmi_manager_ops->get_max_resol(ctx->hdmi_ctx->ctx, width,
-                                                        height);
+        if (hdmi_ops && hdmi_ops->get_max_resol)
+                hdmi_ops->get_max_resol(ctx->hdmi_ctx->ctx, width, height);
 }
 
 static void drm_hdmi_commit(struct device *subdrv_dev)
@@ -193,8 +179,8 @@ static void drm_hdmi_commit(struct device *subdrv_dev)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_manager_ops && hdmi_manager_ops->commit)
-                hdmi_manager_ops->commit(ctx->hdmi_ctx->ctx);
+        if (hdmi_ops && hdmi_ops->commit)
+                hdmi_ops->commit(ctx->hdmi_ctx->ctx);
 }
 
 static void drm_hdmi_dpms(struct device *subdrv_dev, int mode)
@@ -209,8 +195,8 @@ static void drm_hdmi_dpms(struct device *subdrv_dev, int mode)
         case DRM_MODE_DPMS_STANDBY:
         case DRM_MODE_DPMS_SUSPEND:
         case DRM_MODE_DPMS_OFF:
-                if (hdmi_manager_ops && hdmi_manager_ops->disable)
-                        hdmi_manager_ops->disable(ctx->hdmi_ctx->ctx);
+                if (hdmi_ops && hdmi_ops->disable)
+                        hdmi_ops->disable(ctx->hdmi_ctx->ctx);
                 break;
         default:
                 DRM_DEBUG_KMS("unkown dps mode: %d\n", mode);
@@ -235,8 +221,8 @@ static void drm_mixer_mode_set(struct device *subdrv_dev,
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_overlay_ops && hdmi_overlay_ops->win_mode_set)
-                hdmi_overlay_ops->win_mode_set(ctx->mixer_ctx->ctx, overlay);
+        if (mixer_ops && mixer_ops->win_mode_set)
+                mixer_ops->win_mode_set(ctx->mixer_ctx->ctx, overlay);
 }
 
 static void drm_mixer_commit(struct device *subdrv_dev, int zpos)
@@ -245,8 +231,8 @@ static void drm_mixer_commit(struct device *subdrv_dev, int zpos)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_overlay_ops && hdmi_overlay_ops->win_commit)
-                hdmi_overlay_ops->win_commit(ctx->mixer_ctx->ctx, zpos);
+        if (mixer_ops && mixer_ops->win_commit)
+                mixer_ops->win_commit(ctx->mixer_ctx->ctx, zpos);
 }
 
 static void drm_mixer_disable(struct device *subdrv_dev, int zpos)
@@ -255,8 +241,8 @@ static void drm_mixer_disable(struct device *subdrv_dev, int zpos)
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (hdmi_overlay_ops && hdmi_overlay_ops->win_disable)
-                hdmi_overlay_ops->win_disable(ctx->mixer_ctx->ctx, zpos);
+        if (mixer_ops && mixer_ops->win_disable)
+                mixer_ops->win_disable(ctx->mixer_ctx->ctx, zpos);
 }
 
 static struct exynos_drm_overlay_ops drm_hdmi_overlay_ops = {
@@ -265,6 +251,12 @@ static struct exynos_drm_overlay_ops drm_hdmi_overlay_ops = {
         .disable = drm_mixer_disable,
 };
 
+static struct exynos_drm_manager hdmi_manager = {
+        .pipe           = -1,
+        .ops            = &drm_hdmi_manager_ops,
+        .overlay_ops    = &drm_hdmi_overlay_ops,
+        .display_ops    = &drm_hdmi_display_ops,
+};
 
 static int hdmi_subdrv_probe(struct drm_device *drm_dev,
                 struct device *dev)
@@ -332,12 +324,9 @@ static int __devinit exynos_drm_hdmi_probe(struct platform_device *pdev)
 
         subdrv = &ctx->subdrv;
 
+        subdrv->dev = dev;
+        subdrv->manager = &hdmi_manager;
         subdrv->probe = hdmi_subdrv_probe;
-        subdrv->manager.pipe = -1;
-        subdrv->manager.ops = &drm_hdmi_manager_ops;
-        subdrv->manager.overlay_ops = &drm_hdmi_overlay_ops;
-        subdrv->manager.display_ops = &drm_hdmi_display_ops;
-        subdrv->manager.dev = dev;
 
         platform_set_drvdata(pdev, subdrv);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.h b/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
index 44497cfb6c74..f3ae192c8dcf 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
@@ -38,15 +38,15 @@ struct exynos_drm_hdmi_context {
         void                    *ctx;
 };
 
-struct exynos_hdmi_display_ops {
+struct exynos_hdmi_ops {
+        /* display */
         bool (*is_connected)(void *ctx);
         int (*get_edid)(void *ctx, struct drm_connector *connector,
                         u8 *edid, int len);
         int (*check_timing)(void *ctx, void *timing);
         int (*power_on)(void *ctx, int mode);
-};
 
-struct exynos_hdmi_manager_ops {
+        /* manager */
         void (*mode_fixup)(void *ctx, struct drm_connector *connector,
                                 struct drm_display_mode *mode,
                                 struct drm_display_mode *adjusted_mode);
@@ -57,22 +57,17 @@ struct exynos_hdmi_manager_ops {
         void (*disable)(void *ctx);
 };
 
-struct exynos_hdmi_overlay_ops {
+struct exynos_mixer_ops {
+        /* manager */
         int (*enable_vblank)(void *ctx, int pipe);
         void (*disable_vblank)(void *ctx);
+
+        /* overlay */
         void (*win_mode_set)(void *ctx, struct exynos_drm_overlay *overlay);
         void (*win_commit)(void *ctx, int zpos);
         void (*win_disable)(void *ctx, int zpos);
 };
 
-extern struct platform_driver hdmi_driver;
-extern struct platform_driver mixer_driver;
-
-void exynos_drm_display_ops_register(struct exynos_hdmi_display_ops
-                                        *display_ops);
-void exynos_drm_manager_ops_register(struct exynos_hdmi_manager_ops
-                                        *manager_ops);
-void exynos_drm_overlay_ops_register(struct exynos_hdmi_overlay_ops
-                                        *overlay_ops);
-
+void exynos_hdmi_ops_register(struct exynos_hdmi_ops *ops);
+void exynos_mixer_ops_register(struct exynos_mixer_ops *ops);
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index c277a3a445f5..f92fe4c6174a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -24,6 +24,10 @@ struct exynos_plane {
 
 static const uint32_t formats[] = {
         DRM_FORMAT_XRGB8888,
+        DRM_FORMAT_ARGB8888,
+        DRM_FORMAT_NV12,
+        DRM_FORMAT_NV12M,
+        DRM_FORMAT_NV12MT,
 };
 
 static int
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 8e1339f9fe1f..7b9c153dceb6 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -199,7 +199,7 @@ static void vidi_dpms(struct device *subdrv_dev, int mode)
 static void vidi_apply(struct device *subdrv_dev)
 {
         struct vidi_context *ctx = get_vidi_context(subdrv_dev);
-        struct exynos_drm_manager *mgr = &ctx->subdrv.manager;
+        struct exynos_drm_manager *mgr = ctx->subdrv.manager;
         struct exynos_drm_manager_ops *mgr_ops = mgr->ops;
         struct exynos_drm_overlay_ops *ovl_ops = mgr->overlay_ops;
         struct vidi_win_data *win_data;
@@ -374,6 +374,13 @@ static struct exynos_drm_overlay_ops vidi_overlay_ops = {
         .disable = vidi_win_disable,
 };
 
+static struct exynos_drm_manager vidi_manager = {
+        .pipe           = -1,
+        .ops            = &vidi_manager_ops,
+        .overlay_ops    = &vidi_overlay_ops,
+        .display_ops    = &vidi_display_ops,
+};
+
 static void vidi_finish_pageflip(struct drm_device *drm_dev, int crtc)
 {
         struct exynos_drm_private *dev_priv = drm_dev->dev_private;
@@ -425,7 +432,7 @@ static void vidi_fake_vblank_handler(struct work_struct *work)
         struct vidi_context *ctx = container_of(work, struct vidi_context,
                                         work);
         struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
-        struct exynos_drm_manager *manager = &subdrv->manager;
+        struct exynos_drm_manager *manager = subdrv->manager;
 
         if (manager->pipe < 0)
                 return;
@@ -471,7 +478,7 @@ static void vidi_subdrv_remove(struct drm_device *drm_dev)
 static int vidi_power_on(struct vidi_context *ctx, bool enable)
 {
         struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
-        struct device *dev = subdrv->manager.dev;
+        struct device *dev = subdrv->dev;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
@@ -611,13 +618,10 @@ static int __devinit vidi_probe(struct platform_device *pdev)
         ctx->raw_edid = (struct edid *)fake_edid_info;
 
         subdrv = &ctx->subdrv;
+        subdrv->dev = dev;
+        subdrv->manager = &vidi_manager;
         subdrv->probe = vidi_subdrv_probe;
         subdrv->remove = vidi_subdrv_remove;
-        subdrv->manager.pipe = -1;
-        subdrv->manager.ops = &vidi_manager_ops;
-        subdrv->manager.overlay_ops = &vidi_overlay_ops;
-        subdrv->manager.display_ops = &vidi_display_ops;
-        subdrv->manager.dev = dev;
 
         mutex_init(&ctx->lock);
 
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 575a8cbd3533..b00353876458 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -40,7 +40,6 @@
 
 #include "exynos_hdmi.h"
 
-#define HDMI_OVERLAY_NUMBER     3
 #define MAX_WIDTH               1920
 #define MAX_HEIGHT              1080
 #define get_hdmi_context(dev)   platform_get_drvdata(to_platform_device(dev))
@@ -1194,7 +1193,7 @@ static int hdmi_conf_index(struct hdmi_context *hdata,
 
 static bool hdmi_is_connected(void *ctx)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
         u32 val = hdmi_reg_read(hdata, HDMI_HPD_STATUS);
 
         if (val)
@@ -1207,7 +1206,7 @@ static int hdmi_get_edid(void *ctx, struct drm_connector *connector,
                                 u8 *edid, int len)
 {
         struct edid *raw_edid;
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
@@ -1275,7 +1274,7 @@ static int hdmi_v14_check_timing(struct fb_videomode *check_timing)
 
 static int hdmi_check_timing(void *ctx, void *timing)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
         struct fb_videomode *check_timing = timing;
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
@@ -1312,13 +1311,6 @@ static int hdmi_display_power_on(void *ctx, int mode)
         return 0;
 }
 
-static struct exynos_hdmi_display_ops display_ops = {
-        .is_connected   = hdmi_is_connected,
-        .get_edid       = hdmi_get_edid,
-        .check_timing   = hdmi_check_timing,
-        .power_on       = hdmi_display_power_on,
-};
-
 static void hdmi_set_acr(u32 freq, u8 *acr)
 {
         u32 n, cts;
@@ -1914,7 +1906,7 @@ static void hdmi_mode_fixup(void *ctx, struct drm_connector *connector,
                                 struct drm_display_mode *adjusted_mode)
 {
         struct drm_display_mode *m;
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
         int index;
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
@@ -1951,7 +1943,7 @@ static void hdmi_mode_fixup(void *ctx, struct drm_connector *connector,
 
 static void hdmi_mode_set(void *ctx, void *mode)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
         int conf_idx;
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
@@ -1974,7 +1966,7 @@ static void hdmi_get_max_resol(void *ctx, unsigned int *width,
 
 static void hdmi_commit(void *ctx)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
@@ -1985,7 +1977,7 @@ static void hdmi_commit(void *ctx)
 
 static void hdmi_disable(void *ctx)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
@@ -1996,7 +1988,14 @@ static void hdmi_disable(void *ctx)
         }
 }
 
-static struct exynos_hdmi_manager_ops manager_ops = {
+static struct exynos_hdmi_ops hdmi_ops = {
+        /* display */
+        .is_connected   = hdmi_is_connected,
+        .get_edid       = hdmi_get_edid,
+        .check_timing   = hdmi_check_timing,
+        .power_on       = hdmi_display_power_on,
+
+        /* manager */
         .mode_fixup     = hdmi_mode_fixup,
         .mode_set       = hdmi_mode_set,
         .get_max_resol  = hdmi_get_max_resol,
@@ -2020,7 +2019,7 @@ static void hdmi_hotplug_func(struct work_struct *work)
 static irqreturn_t hdmi_irq_handler(int irq, void *arg)
 {
         struct exynos_drm_hdmi_context *ctx = arg;
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx->ctx;
+        struct hdmi_context *hdata = ctx->ctx;
         u32 intc_flag;
 
         intc_flag = hdmi_reg_read(hdata, HDMI_INTC_FLAG);
@@ -2173,7 +2172,7 @@ static int hdmi_runtime_suspend(struct device *dev)
 
         DRM_DEBUG_KMS("%s\n", __func__);
 
-        hdmi_resource_poweroff((struct hdmi_context *)ctx->ctx);
+        hdmi_resource_poweroff(ctx->ctx);
 
         return 0;
 }
@@ -2184,7 +2183,7 @@ static int hdmi_runtime_resume(struct device *dev)
 
         DRM_DEBUG_KMS("%s\n", __func__);
 
-        hdmi_resource_poweron((struct hdmi_context *)ctx->ctx);
+        hdmi_resource_poweron(ctx->ctx);
 
         return 0;
 }
@@ -2322,8 +2321,7 @@ static int __devinit hdmi_probe(struct platform_device *pdev)
         hdata->irq = res->start;
 
         /* register specific callbacks to common hdmi. */
-        exynos_drm_display_ops_register(&display_ops);
-        exynos_drm_manager_ops_register(&manager_ops);
+        exynos_hdmi_ops_register(&hdmi_ops);
 
         hdmi_resource_poweron(hdata);
 
@@ -2351,7 +2349,7 @@ err_data:
 static int __devexit hdmi_remove(struct platform_device *pdev)
 {
         struct exynos_drm_hdmi_context *ctx = platform_get_drvdata(pdev);
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx->ctx;
+        struct hdmi_context *hdata = ctx->ctx;
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 4d5f41e19527..e15438c01129 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -37,7 +37,8 @@
 #include "exynos_drm_drv.h"
 #include "exynos_drm_hdmi.h"
 
-#define HDMI_OVERLAY_NUMBER     3
+#define MIXER_WIN_NR            3
+#define MIXER_DEFAULT_WIN       0
 
 #define get_mixer_context(dev)  platform_get_drvdata(to_platform_device(dev))
 
@@ -75,16 +76,12 @@ struct mixer_resources {
 };
 
 struct mixer_context {
-        struct fb_videomode     *default_timing;
-        unsigned int            default_win;
-        unsigned int            default_bpp;
         unsigned int            irq;
         int                     pipe;
         bool                    interlace;
-        bool                    vp_enabled;
 
         struct mixer_resources  mixer_res;
-        struct hdmi_win_data    win_data[HDMI_OVERLAY_NUMBER];
+        struct hdmi_win_data    win_data[MIXER_WIN_NR];
 };
 
 static const u8 filter_y_horiz_tap8[] = {
@@ -643,9 +640,9 @@ static void mixer_win_mode_set(void *ctx,
 
         win = overlay->zpos;
         if (win == DEFAULT_ZPOS)
-                win = mixer_ctx->default_win;
+                win = MIXER_DEFAULT_WIN;
 
-        if (win < 0 || win > HDMI_OVERLAY_NUMBER) {
+        if (win < 0 || win > MIXER_WIN_NR) {
                 DRM_ERROR("overlay plane[%d] is wrong\n", win);
                 return;
         }
@@ -683,9 +680,9 @@ static void mixer_win_commit(void *ctx, int zpos)
         DRM_DEBUG_KMS("[%d] %s, win: %d\n", __LINE__, __func__, win);
 
         if (win == DEFAULT_ZPOS)
-                win = mixer_ctx->default_win;
+                win = MIXER_DEFAULT_WIN;
 
-        if (win < 0 || win > HDMI_OVERLAY_NUMBER) {
+        if (win < 0 || win > MIXER_WIN_NR) {
                 DRM_ERROR("overlay plane[%d] is wrong\n", win);
                 return;
         }
@@ -706,9 +703,9 @@ static void mixer_win_disable(void *ctx, int zpos)
         DRM_DEBUG_KMS("[%d] %s, win: %d\n", __LINE__, __func__, win);
 
         if (win == DEFAULT_ZPOS)
-                win = mixer_ctx->default_win;
+                win = MIXER_DEFAULT_WIN;
 
-        if (win < 0 || win > HDMI_OVERLAY_NUMBER) {
+        if (win < 0 || win > MIXER_WIN_NR) {
                 DRM_ERROR("overlay plane[%d] is wrong\n", win);
                 return;
         }
@@ -722,9 +719,12 @@ static void mixer_win_disable(void *ctx, int zpos)
         spin_unlock_irqrestore(&res->reg_slock, flags);
 }
 
-static struct exynos_hdmi_overlay_ops overlay_ops = {
+static struct exynos_mixer_ops mixer_ops = {
+        /* manager */
         .enable_vblank          = mixer_enable_vblank,
         .disable_vblank         = mixer_disable_vblank,
+
+        /* overlay */
         .win_mode_set           = mixer_win_mode_set,
         .win_commit             = mixer_win_commit,
         .win_disable            = mixer_win_disable,
@@ -771,8 +771,7 @@ static void mixer_finish_pageflip(struct drm_device *drm_dev, int crtc)
 static irqreturn_t mixer_irq_handler(int irq, void *arg)
 {
         struct exynos_drm_hdmi_context *drm_hdmi_ctx = arg;
-        struct mixer_context *ctx =
-                        (struct mixer_context *)drm_hdmi_ctx->ctx;
+        struct mixer_context *ctx = drm_hdmi_ctx->ctx;
         struct mixer_resources *res = &ctx->mixer_res;
         u32 val, val_base;
 
@@ -902,7 +901,7 @@ static int mixer_runtime_resume(struct device *dev)
 
         DRM_DEBUG_KMS("resume - start\n");
 
-        mixer_resource_poweron((struct mixer_context *)ctx->ctx);
+        mixer_resource_poweron(ctx->ctx);
 
         return 0;
 }
@@ -913,7 +912,7 @@ static int mixer_runtime_suspend(struct device *dev)
 
         DRM_DEBUG_KMS("suspend - start\n");
 
-        mixer_resource_poweroff((struct mixer_context *)ctx->ctx);
+        mixer_resource_poweroff(ctx->ctx);
 
         return 0;
 }
@@ -926,8 +925,7 @@ static const struct dev_pm_ops mixer_pm_ops = {
 static int __devinit mixer_resources_init(struct exynos_drm_hdmi_context *ctx,
                                  struct platform_device *pdev)
 {
-        struct mixer_context *mixer_ctx =
-                        (struct mixer_context *)ctx->ctx;
+        struct mixer_context *mixer_ctx = ctx->ctx;
         struct device *dev = &pdev->dev;
         struct mixer_resources *mixer_res = &mixer_ctx->mixer_res;
         struct resource *res;
@@ -1076,7 +1074,7 @@ static int __devinit mixer_probe(struct platform_device *pdev)
                 goto fail;
 
         /* register specific callback point to common hdmi. */
-        exynos_drm_overlay_ops_register(&overlay_ops);
+        exynos_mixer_ops_register(&mixer_ops);
 
         mixer_resource_poweron(ctx);
 
@@ -1093,7 +1091,7 @@ static int mixer_remove(struct platform_device *pdev)
         struct device *dev = &pdev->dev;
         struct exynos_drm_hdmi_context *drm_hdmi_ctx =
                                         platform_get_drvdata(pdev);
-        struct mixer_context *ctx = (struct mixer_context *)drm_hdmi_ctx->ctx;
+        struct mixer_context *ctx = drm_hdmi_ctx->ctx;
 
         dev_info(dev, "remove successful\n");
 
diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_output.h b/drivers/gpu/drm/gma500/mdfld_dsi_output.h
index 21071cef92a4..36eb0744841c 100644
--- a/drivers/gpu/drm/gma500/mdfld_dsi_output.h
+++ b/drivers/gpu/drm/gma500/mdfld_dsi_output.h
@@ -29,7 +29,6 @@
 #define __MDFLD_DSI_OUTPUT_H__
 
 #include <linux/backlight.h>
-#include <linux/version.h>
 #include <drm/drmP.h>
 #include <drm/drm.h>
 #include <drm/drm_crtc.h>
diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 2c8a60c3b98e..f920fb5e42b6 100644
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -129,6 +129,7 @@ static int i810_map_buffer(struct drm_buf *buf, struct drm_file *file_priv)
         if (buf_priv->currently_mapped == I810_BUF_MAPPED)
                 return -EINVAL;
 
+        /* This is all entirely broken */
         down_write(&current->mm->mmap_sem);
         old_fops = file_priv->filp->f_op;
         file_priv->filp->f_op = &i810_buffer_fops;
@@ -157,11 +158,8 @@ static int i810_unmap_buffer(struct drm_buf *buf)
         if (buf_priv->currently_mapped != I810_BUF_MAPPED)
                 return -EINVAL;
 
-        down_write(&current->mm->mmap_sem);
-        retcode = do_munmap(current->mm,
-                            (unsigned long)buf_priv->virtual,
+        retcode = vm_munmap((unsigned long)buf_priv->virtual,
                             (size_t) buf->total);
-        up_write(&current->mm->mmap_sem);
 
         buf_priv->currently_mapped = I810_BUF_UNMAPPED;
         buf_priv->virtual = NULL;
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index b505b70dba05..e6162a1681f0 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1224,6 +1224,9 @@ static int i915_emon_status(struct seq_file *m, void *unused)
         unsigned long temp, chipset, gfx;
         int ret;
 
+        if (!IS_GEN5(dev))
+                return -ENODEV;
+
         ret = mutex_lock_interruptible(&dev->struct_mutex);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 785f67f963ef..ba60f3c8f911 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1701,6 +1701,9 @@ void i915_update_gfx_val(struct drm_i915_private *dev_priv)
         unsigned long diffms;
         u32 count;
 
+        if (dev_priv->info->gen != 5)
+                return;
+
         getrawmonotonic(&now);
         diff1 = timespec_sub(now, dev_priv->last_time2);
 
@@ -2121,12 +2124,14 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         setup_timer(&dev_priv->hangcheck_timer, i915_hangcheck_elapsed,
                     (unsigned long) dev);
 
-        spin_lock(&mchdev_lock);
-        i915_mch_dev = dev_priv;
-        dev_priv->mchdev_lock = &mchdev_lock;
-        spin_unlock(&mchdev_lock);
+        if (IS_GEN5(dev)) {
+                spin_lock(&mchdev_lock);
+                i915_mch_dev = dev_priv;
+                dev_priv->mchdev_lock = &mchdev_lock;
+                spin_unlock(&mchdev_lock);
 
-        ips_ping_for_i915_load();
+                ips_ping_for_i915_load();
+        }
 
         return 0;
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index dfa55e7478fb..ae8a64f9f845 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -64,7 +64,7 @@ MODULE_PARM_DESC(semaphores,
                 "Use semaphores for inter-ring sync (default: -1 (use per-chip defaults))");
 
 int i915_enable_rc6 __read_mostly = -1;
-module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
+module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0400);
 MODULE_PARM_DESC(i915_enable_rc6,
                 "Enable power-saving render C-state 6. "
                 "Different stages can be selected via bitmask values "
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 4c65c639f772..0d1e4b7b4b99 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1087,11 +1087,9 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
         if (obj == NULL)
                 return -ENOENT;
 
-        down_write(&current->mm->mmap_sem);
-        addr = do_mmap(obj->filp, 0, args->size,
+        addr = vm_mmap(obj->filp, 0, args->size,
                        PROT_READ | PROT_WRITE, MAP_SHARED,
                        args->offset);
-        up_write(&current->mm->mmap_sem);
         drm_gem_object_unreference_unlocked(obj);
         if (IS_ERR((void *)addr))
                 return addr;
@@ -1493,6 +1491,7 @@ i915_gem_object_move_off_active(struct drm_i915_gem_object *obj)
 {
         list_del_init(&obj->ring_list);
         obj->last_rendering_seqno = 0;
+        obj->last_fenced_seqno = 0;
 }
 
 static void
@@ -1521,6 +1520,7 @@ i915_gem_object_move_to_inactive(struct drm_i915_gem_object *obj)
         BUG_ON(!list_empty(&obj->gpu_write_list));
         BUG_ON(!obj->active);
         obj->ring = NULL;
+        obj->last_fenced_ring = NULL;
 
         i915_gem_object_move_off_active(obj);
         obj->fenced_gpu_access = false;
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index f51a696486cb..de431942ded4 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1133,6 +1133,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                         return -EINVAL;
                 }
 
+                if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) {
+                        DRM_DEBUG("execbuf with %u cliprects\n",
+                                  args->num_cliprects);
+                        return -EINVAL;
+                }
                 cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
                                     GFP_KERNEL);
                 if (cliprects == NULL) {
@@ -1404,7 +1409,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
         struct drm_i915_gem_exec_object2 *exec2_list = NULL;
         int ret;
 
-        if (args->buffer_count < 1) {
+        if (args->buffer_count < 1 ||
+            args->buffer_count > UINT_MAX / sizeof(*exec2_list)) {
                 DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count);
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 2abf4eb94039..9d24d65f0c3e 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -568,6 +568,7 @@
 #define   CM0_MASK_SHIFT          16
 #define   CM0_IZ_OPT_DISABLE      (1<<6)
 #define   CM0_ZR_OPT_DISABLE      (1<<5)
+#define   CM0_STC_EVICT_DISABLE_LRA_SNB (1<<5)
 #define   CM0_DEPTH_EVICT_DISABLE (1<<4)
 #define   CM0_COLOR_EVICT_DISABLE (1<<3)
 #define   CM0_DEPTH_WRITE_DISABLE (1<<1)
@@ -3728,6 +3729,9 @@
 #define  GT_FIFO_FREE_ENTRIES                   0x120008
 #define    GT_FIFO_NUM_RESERVED_ENTRIES         20
 
+#define GEN6_UCGCTL1                            0x9400
+# define GEN6_BLBUNIT_CLOCK_GATE_DISABLE                (1 << 5)
+
 #define GEN6_UCGCTL2                            0x9404
 # define GEN6_RCZUNIT_CLOCK_GATE_DISABLE                (1 << 13)
 # define GEN6_RCPBUNIT_CLOCK_GATE_DISABLE               (1 << 12)
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 4d3d736a4f56..90b9793fd5da 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -430,8 +430,8 @@ intel_crt_detect(struct drm_connector *connector, bool force)
 {
         struct drm_device *dev = connector->dev;
         struct intel_crt *crt = intel_attached_crt(connector);
-        struct drm_crtc *crtc;
         enum drm_connector_status status;
+        struct intel_load_detect_pipe tmp;
 
         if (I915_HAS_HOTPLUG(dev)) {
                 if (intel_crt_detect_hotplug(connector)) {
@@ -450,23 +450,16 @@ intel_crt_detect(struct drm_connector *connector, bool force)
                 return connector->status;
 
         /* for pre-945g platforms use load detect */
-        crtc = crt->base.base.crtc;
-        if (crtc && crtc->enabled) {
-                status = intel_crt_load_detect(crt);
-        } else {
-                struct intel_load_detect_pipe tmp;
-
-                if (intel_get_load_detect_pipe(&crt->base, connector, NULL,
-                                               &tmp)) {
-                        if (intel_crt_detect_ddc(connector))
-                                status = connector_status_connected;
-                        else
-                                status = intel_crt_load_detect(crt);
-                        intel_release_load_detect_pipe(&crt->base, connector,
-                                                       &tmp);
-                } else
-                        status = connector_status_unknown;
-        }
+        if (intel_get_load_detect_pipe(&crt->base, connector, NULL,
+                                       &tmp)) {
+                if (intel_crt_detect_ddc(connector))
+                        status = connector_status_connected;
+                else
+                        status = intel_crt_load_detect(crt);
+                intel_release_load_detect_pipe(&crt->base, connector,
+                                               &tmp);
+        } else
+                status = connector_status_unknown;
 
         return status;
 }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 91b35fd1db8c..1b1cf3b3ff51 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2245,6 +2245,33 @@ intel_pipe_set_base_atomic(struct drm_crtc *crtc, struct drm_framebuffer *fb,
 }
 
 static int
+intel_finish_fb(struct drm_framebuffer *old_fb)
+{
+        struct drm_i915_gem_object *obj = to_intel_framebuffer(old_fb)->obj;
+        struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
+        bool was_interruptible = dev_priv->mm.interruptible;
+        int ret;
+
+        wait_event(dev_priv->pending_flip_queue,
+                   atomic_read(&dev_priv->mm.wedged) ||
+                   atomic_read(&obj->pending_flip) == 0);
+
+        /* Big Hammer, we also need to ensure that any pending
+         * MI_WAIT_FOR_EVENT inside a user batch buffer on the
+         * current scanout is retired before unpinning the old
+         * framebuffer.
+         *
+         * This should only fail upon a hung GPU, in which case we
+         * can safely continue.
+         */
+        dev_priv->mm.interruptible = false;
+        ret = i915_gem_object_finish_gpu(obj);
+        dev_priv->mm.interruptible = was_interruptible;
+
+        return ret;
+}
+
+static int
 intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
                     struct drm_framebuffer *old_fb)
 {
@@ -2282,25 +2309,8 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
                 return ret;
         }
 
-        if (old_fb) {
-                struct drm_i915_private *dev_priv = dev->dev_private;
-                struct drm_i915_gem_object *obj = to_intel_framebuffer(old_fb)->obj;
-
-                wait_event(dev_priv->pending_flip_queue,
-                           atomic_read(&dev_priv->mm.wedged) ||
-                           atomic_read(&obj->pending_flip) == 0);
-
-                /* Big Hammer, we also need to ensure that any pending
-                 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
-                 * current scanout is retired before unpinning the old
-                 * framebuffer.
-                 *
-                 * This should only fail upon a hung GPU, in which case we
-                 * can safely continue.
-                 */
-                ret = i915_gem_object_finish_gpu(obj);
-                (void) ret;
-        }
+        if (old_fb)
+                intel_finish_fb(old_fb);
 
         ret = intel_pipe_set_base_atomic(crtc, crtc->fb, x, y,
                                          LEAVE_ATOMIC_MODE_SET);
@@ -3371,6 +3381,23 @@ static void intel_crtc_disable(struct drm_crtc *crtc)
         struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
         struct drm_device *dev = crtc->dev;
 
+        /* Flush any pending WAITs before we disable the pipe. Note that
+         * we need to drop the struct_mutex in order to acquire it again
+         * during the lowlevel dpms routines around a couple of the
+         * operations. It does not look trivial nor desirable to move
+         * that locking higher. So instead we leave a window for the
+         * submission of further commands on the fb before we can actually
+         * disable it. This race with userspace exists anyway, and we can
+         * only rely on the pipe being disabled by userspace after it
+         * receives the hotplug notification and has flushed any pending
+         * batches.
+         */
+        if (crtc->fb) {
+                mutex_lock(&dev->struct_mutex);
+                intel_finish_fb(crtc->fb);
+                mutex_unlock(&dev->struct_mutex);
+        }
+
         crtc_funcs->dpms(crtc, DRM_MODE_DPMS_OFF);
         assert_plane_disabled(dev->dev_private, to_intel_crtc(crtc)->plane);
         assert_pipe_disabled(dev->dev_private, to_intel_crtc(crtc)->pipe);
@@ -3451,8 +3478,11 @@ static bool intel_crtc_mode_fixup(struct drm_crtc *crtc,
                         return false;
         }
 
-        /* All interlaced capable intel hw wants timings in frames. */
-        drm_mode_set_crtcinfo(adjusted_mode, 0);
+        /* All interlaced capable intel hw wants timings in frames. Note though
+         * that intel_lvds_mode_fixup does some funny tricks with the crtc
+         * timings, so we need to be careful not to clobber these.*/
+        if (!(adjusted_mode->private_flags & INTEL_MODE_CRTC_TIMINGS_SET))
+                drm_mode_set_crtcinfo(adjusted_mode, 0);
 
         return true;
 }
@@ -7042,9 +7072,6 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
         struct drm_device *dev = crtc->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        int pipe = intel_crtc->pipe;
-        int dpll_reg = DPLL(pipe);
-        int dpll = I915_READ(dpll_reg);
 
         if (HAS_PCH_SPLIT(dev))
                 return;
@@ -7057,10 +7084,15 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
          * the manual case.
          */
         if (!HAS_PIPE_CXSR(dev) && intel_crtc->lowfreq_avail) {
+                int pipe = intel_crtc->pipe;
+                int dpll_reg = DPLL(pipe);
+                u32 dpll;
+
                 DRM_DEBUG_DRIVER("downclocking LVDS\n");
 
                 assert_panel_unlocked(dev_priv, pipe);
 
+                dpll = I915_READ(dpll_reg);
                 dpll |= DISPLAY_RATE_SELECT_FPA1;
                 I915_WRITE(dpll_reg, dpll);
                 intel_wait_for_vblank(dev, pipe);
@@ -7068,7 +7100,6 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
                 if (!(dpll & DISPLAY_RATE_SELECT_FPA1))
                         DRM_DEBUG_DRIVER("failed to downclock LVDS!\n");
         }
-
 }
 
 /**
@@ -7438,7 +7469,13 @@ static int intel_gen6_queue_flip(struct drm_device *dev,
         OUT_RING(fb->pitches[0] | obj->tiling_mode);
         OUT_RING(obj->gtt_offset);
 
-        pf = I915_READ(PF_CTL(intel_crtc->pipe)) & PF_ENABLE;
+        /* Contrary to the suggestions in the documentation,
+         * "Enable Panel Fitter" does not seem to be required when page
+         * flipping with a non-native mode, and worse causes a normal
+         * modeset to fail.
+         * pf = I915_READ(PF_CTL(intel_crtc->pipe)) & PF_ENABLE;
+         */
+        pf = 0;
         pipesrc = I915_READ(PIPESRC(intel_crtc->pipe)) & 0x0fff0fff;
         OUT_RING(pf | pipesrc);
         ADVANCE_LP_RING();
@@ -8529,6 +8566,10 @@ static void gen6_init_clock_gating(struct drm_device *dev)
         I915_WRITE(WM2_LP_ILK, 0);
         I915_WRITE(WM1_LP_ILK, 0);
 
+        I915_WRITE(GEN6_UCGCTL1,
+                   I915_READ(GEN6_UCGCTL1) |
+                   GEN6_BLBUNIT_CLOCK_GATE_DISABLE);
+
         /* According to the BSpec vol1g, bit 12 (RCPBUNIT) clock
          * gating disable must be set.  Failure to set it results in
          * flickering pixels due to Z write ordering failures after
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 110552ff302c..4b637919f74f 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -219,14 +219,38 @@ intel_dp_max_data_rate(int max_link_clock, int max_lanes)
         return (max_link_clock * max_lanes * 8) / 10;
 }
 
+static bool
+intel_dp_adjust_dithering(struct intel_dp *intel_dp,
+                          struct drm_display_mode *mode,
+                          struct drm_display_mode *adjusted_mode)
+{
+        int max_link_clock = intel_dp_link_clock(intel_dp_max_link_bw(intel_dp));
+        int max_lanes = intel_dp_max_lane_count(intel_dp);
+        int max_rate, mode_rate;
+
+        mode_rate = intel_dp_link_required(mode->clock, 24);
+        max_rate = intel_dp_max_data_rate(max_link_clock, max_lanes);
+
+        if (mode_rate > max_rate) {
+                mode_rate = intel_dp_link_required(mode->clock, 18);
+                if (mode_rate > max_rate)
+                        return false;
+
+                if (adjusted_mode)
+                        adjusted_mode->private_flags
+                                |= INTEL_MODE_DP_FORCE_6BPC;
+
+                return true;
+        }
+
+        return true;
+}
+
 static int
 intel_dp_mode_valid(struct drm_connector *connector,
                     struct drm_display_mode *mode)
 {
         struct intel_dp *intel_dp = intel_attached_dp(connector);
-        int max_link_clock = intel_dp_link_clock(intel_dp_max_link_bw(intel_dp));
-        int max_lanes = intel_dp_max_lane_count(intel_dp);
-        int max_rate, mode_rate;
 
         if (is_edp(intel_dp) && intel_dp->panel_fixed_mode) {
                 if (mode->hdisplay > intel_dp->panel_fixed_mode->hdisplay)
@@ -236,16 +260,8 @@ intel_dp_mode_valid(struct drm_connector *connector,
                         return MODE_PANEL;
         }
 
-        mode_rate = intel_dp_link_required(mode->clock, 24);
-        max_rate = intel_dp_max_data_rate(max_link_clock, max_lanes);
-
-        if (mode_rate > max_rate) {
-                        mode_rate = intel_dp_link_required(mode->clock, 18);
-                        if (mode_rate > max_rate)
-                                return MODE_CLOCK_HIGH;
-                        else
-                                mode->private_flags |= INTEL_MODE_DP_FORCE_6BPC;
-        }
+        if (!intel_dp_adjust_dithering(intel_dp, mode, NULL))
+                return MODE_CLOCK_HIGH;
 
         if (mode->clock < 10000)
                 return MODE_CLOCK_LOW;
@@ -672,7 +688,7 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
         int lane_count, clock;
         int max_lane_count = intel_dp_max_lane_count(intel_dp);
         int max_clock = intel_dp_max_link_bw(intel_dp) == DP_LINK_BW_2_7 ? 1 : 0;
-        int bpp = mode->private_flags & INTEL_MODE_DP_FORCE_6BPC ? 18 : 24;
+        int bpp;
         static int bws[2] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7 };
 
         if (is_edp(intel_dp) && intel_dp->panel_fixed_mode) {
@@ -686,6 +702,11 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
                 mode->clock = intel_dp->panel_fixed_mode->clock;
         }
 
+        if (!intel_dp_adjust_dithering(intel_dp, mode, adjusted_mode))
+                return false;
+
+        bpp = adjusted_mode->private_flags & INTEL_MODE_DP_FORCE_6BPC ? 18 : 24;
+
         for (lane_count = 1; lane_count <= max_lane_count; lane_count <<= 1) {
                 for (clock = 0; clock <= max_clock; clock++) {
                         int link_avail = intel_dp_max_data_rate(intel_dp_link_clock(bws[clock]), lane_count);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 5a14149b3794..715afa153025 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -105,6 +105,10 @@
 #define INTEL_MODE_PIXEL_MULTIPLIER_SHIFT (0x0)
 #define INTEL_MODE_PIXEL_MULTIPLIER_MASK (0xf << INTEL_MODE_PIXEL_MULTIPLIER_SHIFT)
 #define INTEL_MODE_DP_FORCE_6BPC (0x10)
+/* This flag must be set by the encoder's mode_fixup if it changes the crtc
+ * timings in the mode to prevent the crtc fixup from overwriting them.
+ * Currently only lvds needs that. */
+#define INTEL_MODE_CRTC_TIMINGS_SET (0x20)
 
 static inline void
 intel_mode_set_pixel_multiplier(struct drm_display_mode *mode,
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 19ecd78b8a2c..6e9ee33fd412 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -279,6 +279,8 @@ void intel_fb_restore_mode(struct drm_device *dev)
         struct drm_mode_config *config = &dev->mode_config;
         struct drm_plane *plane;
 
+        mutex_lock(&dev->mode_config.mutex);
+
         ret = drm_fb_helper_restore_fbdev_mode(&dev_priv->fbdev->helper);
         if (ret)
                 DRM_DEBUG("failed to restore crtc mode\n");
@@ -286,4 +288,6 @@ void intel_fb_restore_mode(struct drm_device *dev)
         /* Be sure to shut off any planes that may be active */
         list_for_each_entry(plane, &config->plane_list, head)
                 plane->funcs->disable_plane(plane);
+
+        mutex_unlock(&dev->mode_config.mutex);
 }
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index cae3e5f17a49..2d7f47b56b6a 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -136,7 +136,7 @@ static void i9xx_write_infoframe(struct drm_encoder *encoder,
 
         val &= ~VIDEO_DIP_SELECT_MASK;
 
-        I915_WRITE(VIDEO_DIP_CTL, val | port | flags);
+        I915_WRITE(VIDEO_DIP_CTL, VIDEO_DIP_ENABLE | val | port | flags);
 
         for (i = 0; i < len; i += 4) {
                 I915_WRITE(VIDEO_DIP_DATA, *data);
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index 601c86e664af..8fdc95700218 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -390,7 +390,7 @@ int intel_setup_gmbus(struct drm_device *dev)
                 bus->has_gpio = intel_gpio_setup(bus, i);
 
                 /* XXX force bit banging until GMBUS is fully debugged */
-                if (bus->has_gpio && IS_GEN2(dev))
+                if (bus->has_gpio)
                         bus->force_bit = true;
         }
 
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 95db2e988227..9c71183629c2 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -187,6 +187,8 @@ centre_horizontally(struct drm_display_mode *mode,
 
         mode->crtc_hsync_start = mode->crtc_hblank_start + sync_pos;
         mode->crtc_hsync_end = mode->crtc_hsync_start + sync_width;
+
+        mode->private_flags |= INTEL_MODE_CRTC_TIMINGS_SET;
 }
 
 static void
@@ -208,6 +210,8 @@ centre_vertically(struct drm_display_mode *mode,
 
         mode->crtc_vsync_start = mode->crtc_vblank_start + sync_pos;
         mode->crtc_vsync_end = mode->crtc_vsync_start + sync_width;
+
+        mode->private_flags |= INTEL_MODE_CRTC_TIMINGS_SET;
 }
 
 static inline u32 panel_fitter_scaling(u32 source, u32 target)
@@ -283,6 +287,8 @@ static bool intel_lvds_mode_fixup(struct drm_encoder *encoder,
         for_each_pipe(pipe)
                 I915_WRITE(BCLRPAT(pipe), 0);
 
+        drm_mode_set_crtcinfo(adjusted_mode, 0);
+
         switch (intel_lvds->fitting_mode) {
         case DRM_MODE_SCALE_CENTER:
                 /*
@@ -744,7 +750,7 @@ static const struct dmi_system_id intel_no_lvds[] = {
                 .ident = "Hewlett-Packard t5745",
                 .matches = {
                         DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
-                        DMI_MATCH(DMI_BOARD_NAME, "hp t5745"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "hp t5745"),
                 },
         },
         {
@@ -752,7 +758,7 @@ static const struct dmi_system_id intel_no_lvds[] = {
                 .ident = "Hewlett-Packard st5747",
                 .matches = {
                         DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
-                        DMI_MATCH(DMI_BOARD_NAME, "hp st5747"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "hp st5747"),
                 },
         },
         {
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 230a141dbea3..48177ec4720e 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -47,8 +47,6 @@ intel_fixed_panel_mode(struct drm_display_mode *fixed_mode,
         adjusted_mode->vtotal = fixed_mode->vtotal;
 
         adjusted_mode->clock = fixed_mode->clock;
-
-        drm_mode_set_crtcinfo(adjusted_mode, 0);
 }
 
 /* adjusted_mode has been preset to be the panel's fixed mode */
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index e25581a9f60f..80fce51e2f43 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -401,6 +401,14 @@ static int init_render_ring(struct intel_ring_buffer *ring)
         if (INTEL_INFO(dev)->gen >= 6) {
                 I915_WRITE(INSTPM,
                            INSTPM_FORCE_ORDERING << 16 | INSTPM_FORCE_ORDERING);
+
+                /* From the Sandybridge PRM, volume 1 part 3, page 24:
+                 * "If this bit is set, STCunit will have LRA as replacement
+                 *  policy. [...] This bit must be reset.  LRA replacement
+                 *  policy is not supported."
+                 */
+                I915_WRITE(CACHE_MODE_0,
+                           CM0_STC_EVICT_DISABLE_LRA_SNB << CM0_MASK_SHIFT);
         }
 
         return ret;
@@ -1038,7 +1046,7 @@ int intel_init_ring_buffer(struct drm_device *dev,
          * of the buffer.
          */
         ring->effective_size = ring->size;
-        if (IS_I830(ring->dev))
+        if (IS_I830(ring->dev) || IS_845G(ring->dev))
                 ring->effective_size -= 128;
 
         return 0;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index e36b171c1e7d..232d77d07d8b 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -731,6 +731,7 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
         uint16_t width, height;
         uint16_t h_blank_len, h_sync_len, v_blank_len, v_sync_len;
         uint16_t h_sync_offset, v_sync_offset;
+        int mode_clock;
 
         width = mode->crtc_hdisplay;
         height = mode->crtc_vdisplay;
@@ -745,7 +746,11 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
         h_sync_offset = mode->crtc_hsync_start - mode->crtc_hblank_start;
         v_sync_offset = mode->crtc_vsync_start - mode->crtc_vblank_start;
 
-        dtd->part1.clock = mode->clock / 10;
+        mode_clock = mode->clock;
+        mode_clock /= intel_mode_get_pixel_multiplier(mode) ?: 1;
+        mode_clock /= 10;
+        dtd->part1.clock = mode_clock;
+
         dtd->part1.h_active = width & 0xff;
         dtd->part1.h_blank = h_blank_len & 0xff;
         dtd->part1.h_high = (((width >> 8) & 0xf) << 4) |
@@ -996,7 +1001,7 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
         struct intel_sdvo *intel_sdvo = to_intel_sdvo(encoder);
         u32 sdvox;
         struct intel_sdvo_in_out_map in_out;
-        struct intel_sdvo_dtd input_dtd;
+        struct intel_sdvo_dtd input_dtd, output_dtd;
         int pixel_multiplier = intel_mode_get_pixel_multiplier(adjusted_mode);
         int rate;
 
@@ -1021,20 +1026,13 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
                                           intel_sdvo->attached_output))
                 return;
 
-        /* We have tried to get input timing in mode_fixup, and filled into
-         * adjusted_mode.
-         */
-        if (intel_sdvo->is_tv || intel_sdvo->is_lvds) {
-                input_dtd = intel_sdvo->input_dtd;
-        } else {
-                /* Set the output timing to the screen */
-                if (!intel_sdvo_set_target_output(intel_sdvo,
-                                                  intel_sdvo->attached_output))
-                        return;
-
-                intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode);
-                (void) intel_sdvo_set_output_timing(intel_sdvo, &input_dtd);
-        }
+        /* lvds has a special fixed output timing. */
+        if (intel_sdvo->is_lvds)
+                intel_sdvo_get_dtd_from_mode(&output_dtd,
+                                             intel_sdvo->sdvo_lvds_fixed_mode);
+        else
+                intel_sdvo_get_dtd_from_mode(&output_dtd, mode);
+        (void) intel_sdvo_set_output_timing(intel_sdvo, &output_dtd);
 
         /* Set the input timing to the screen. Assume always input 0. */
         if (!intel_sdvo_set_target_input(intel_sdvo))
@@ -1052,6 +1050,10 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
             !intel_sdvo_set_tv_format(intel_sdvo))
                 return;
 
+        /* We have tried to get input timing in mode_fixup, and filled into
+         * adjusted_mode.
+         */
+        intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode);
         (void) intel_sdvo_set_input_timing(intel_sdvo, &input_dtd);
 
         switch (pixel_multiplier) {
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index a464771a7240..e90dfb625c42 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -95,7 +95,6 @@ ivb_update_plane(struct drm_plane *plane, struct drm_framebuffer *fb,
         /* must disable */
         sprctl |= SPRITE_TRICKLE_FEED_DISABLE;
         sprctl |= SPRITE_ENABLE;
-        sprctl |= SPRITE_DEST_KEY;
 
         /* Sizes are 0 based */
         src_w--;
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 7814a760c164..284bd25d5d21 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -270,7 +270,7 @@ static bool nouveau_dsm_detect(void)
         struct acpi_buffer buffer = {sizeof(acpi_method_name), acpi_method_name};
         struct pci_dev *pdev = NULL;
         int has_dsm = 0;
-        int has_optimus;
+        int has_optimus = 0;
         int vga_count = 0;
         bool guid_valid;
         int retval;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 80963d05b54a..0be4a815e706 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -6156,10 +6156,14 @@ dcb_fake_connectors(struct nvbios *bios)
 
         /* heuristic: if we ever get a non-zero connector field, assume
          * that all the indices are valid and we don't need fake them.
+         *
+         * and, as usual, a blacklist of boards with bad bios data..
          */
-        for (i = 0; i < dcbt->entries; i++) {
-                if (dcbt->entry[i].connector)
-                        return;
+        if (!nv_match_device(bios->dev, 0x0392, 0x107d, 0x20a2)) {
+                for (i = 0; i < dcbt->entries; i++) {
+                        if (dcbt->entry[i].connector)
+                                return;
+                }
         }
 
         /* no useful connector info available, we need to make it up
diff --git a/drivers/gpu/drm/nouveau/nouveau_hdmi.c b/drivers/gpu/drm/nouveau/nouveau_hdmi.c
index 59ea1c14eca0..c3de36384522 100644
--- a/drivers/gpu/drm/nouveau/nouveau_hdmi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_hdmi.c
@@ -32,7 +32,9 @@ static bool
 hdmi_sor(struct drm_encoder *encoder)
 {
         struct drm_nouveau_private *dev_priv = encoder->dev->dev_private;
-        if (dev_priv->chipset < 0xa3)
+        if (dev_priv->chipset <  0xa3 ||
+            dev_priv->chipset == 0xaa ||
+            dev_priv->chipset == 0xac)
                 return false;
         return true;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_pm.c b/drivers/gpu/drm/nouveau/nouveau_pm.c
index 34d591b7d4ef..da3e7c3abab7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_pm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_pm.c
@@ -235,6 +235,7 @@ nouveau_pm_profile_set(struct drm_device *dev, const char *profile)
                 return -EPERM;
 
         strncpy(string, profile, sizeof(string));
+        string[sizeof(string) - 1] = 0;
         if ((ptr = strchr(string, '\n')))
                 *ptr = '\0';
 
diff --git a/drivers/gpu/drm/nouveau/nv10_gpio.c b/drivers/gpu/drm/nouveau/nv10_gpio.c
index 550ad3fcf0af..9d79180069df 100644
--- a/drivers/gpu/drm/nouveau/nv10_gpio.c
+++ b/drivers/gpu/drm/nouveau/nv10_gpio.c
@@ -65,7 +65,7 @@ nv10_gpio_drive(struct drm_device *dev, int line, int dir, int out)
         if (line < 10) {
                 line = (line - 2) * 4;
                 reg  = NV_PCRTC_GPIO_EXT;
-                mask = 0x00000003 << ((line - 2) * 4);
+                mask = 0x00000003;
                 data = (dir << 1) | out;
         } else
         if (line < 14) {
diff --git a/drivers/gpu/drm/nouveau/nv50_sor.c b/drivers/gpu/drm/nouveau/nv50_sor.c
index a7844ab6a50c..274640212475 100644
--- a/drivers/gpu/drm/nouveau/nv50_sor.c
+++ b/drivers/gpu/drm/nouveau/nv50_sor.c
@@ -42,7 +42,7 @@ nv50_sor_dp_lane_map(struct drm_device *dev, struct dcb_entry *dcb, u8 lane)
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         static const u8 nvaf[] = { 24, 16, 8, 0 }; /* thanks, apple.. */
         static const u8 nv50[] = { 16, 8, 0, 24 };
-        if (dev_priv->card_type == 0xaf)
+        if (dev_priv->chipset == 0xaf)
                 return nvaf[lane];
         return nv50[lane];
 }
diff --git a/drivers/gpu/drm/nouveau/nvc0_fb.c b/drivers/gpu/drm/nouveau/nvc0_fb.c
index 5bf55038fd92..f704e942372e 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fb.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fb.c
@@ -54,6 +54,11 @@ nvc0_mfb_isr(struct drm_device *dev)
                         nvc0_mfb_subp_isr(dev, unit, subp);
                 units &= ~(1 << unit);
         }
+
+        /* we do something horribly wrong and upset PMFB a lot, so mask off
+         * interrupts from it after the first one until it's fixed
+         */
+        nv_mask(dev, 0x000640, 0x02000000, 0x00000000);
 }
 
 static void
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index b5ff1f7b6f7e..af1054f8202a 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -575,6 +575,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
 
                 if (rdev->family < CHIP_RV770)
                         pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+                /* use frac fb div on APUs */
+                if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
+                        pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
         } else {
                 pll->flags |= RADEON_PLL_LEGACY;
 
@@ -955,8 +958,8 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
                 break;
         }
 
-        if (radeon_encoder->active_device &
-            (ATOM_DEVICE_LCD_SUPPORT | ATOM_DEVICE_DFP_SUPPORT)) {
+        if ((radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT | ATOM_DEVICE_DFP_SUPPORT)) ||
+            (radeon_encoder_get_dp_bridge_encoder_id(encoder) != ENCODER_OBJECT_ID_NONE)) {
                 struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
                 struct drm_connector *connector =
                         radeon_get_connector_for_encoder(encoder);
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index e607c4d7dd98..2d39f9977e00 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -230,6 +230,10 @@ atombios_dvo_setup(struct drm_encoder *encoder, int action)
         if (!atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev))
                 return;
 
+        /* some R4xx chips have the wrong frev */
+        if (rdev->family <= CHIP_RV410)
+                frev = 1;
+
         switch (frev) {
         case 1:
                 switch (crev) {
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 81801c176aa5..fe33d35dae8c 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2553,7 +2553,7 @@ static void r100_pll_errata_after_data(struct radeon_device *rdev)
          * or the chip could hang on a subsequent access
          */
         if (rdev->pll_errata & CHIP_ERRATA_PLL_DELAY) {
-                udelay(5000);
+                mdelay(5);
         }
 
         /* This function is required to workaround a hardware bug in some (all?)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 391bd2636a80..c8187c4b6ae8 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1135,7 +1135,7 @@ static void r600_vram_gtt_location(struct radeon_device *rdev, struct radeon_mc
         }
         if (rdev->flags & RADEON_IS_AGP) {
                 size_bf = mc->gtt_start;
-                size_af = 0xFFFFFFFF - mc->gtt_end + 1;
+                size_af = 0xFFFFFFFF - mc->gtt_end;
                 if (size_bf > size_af) {
                         if (mc->mc_vram_size > size_bf) {
                                 dev_warn(rdev->dev, "limiting VRAM\n");
@@ -1149,7 +1149,7 @@ static void r600_vram_gtt_location(struct radeon_device *rdev, struct radeon_mc
                                 mc->real_vram_size = size_af;
                                 mc->mc_vram_size = size_af;
                         }
-                        mc->vram_start = mc->gtt_end;
+                        mc->vram_start = mc->gtt_end + 1;
                 }
                 mc->vram_end = mc->vram_start + mc->mc_vram_size - 1;
                 dev_info(rdev->dev, "VRAM: %lluM 0x%08llX - 0x%08llX (%lluM used)\n",
@@ -2839,7 +2839,7 @@ void r600_rlc_stop(struct radeon_device *rdev)
                 /* r7xx asics need to soft reset RLC before halting */
                 WREG32(SRBM_SOFT_RESET, SOFT_RESET_RLC);
                 RREG32(SRBM_SOFT_RESET);
-                udelay(15000);
+                mdelay(15);
                 WREG32(SRBM_SOFT_RESET, 0);
                 RREG32(SRBM_SOFT_RESET);
         }
diff --git a/drivers/gpu/drm/radeon/r600_cp.c b/drivers/gpu/drm/radeon/r600_cp.c
index 84c546250955..75ed17c96115 100644
--- a/drivers/gpu/drm/radeon/r600_cp.c
+++ b/drivers/gpu/drm/radeon/r600_cp.c
@@ -407,7 +407,7 @@ static void r600_cp_load_microcode(drm_radeon_private_t *dev_priv)
 
         RADEON_WRITE(R600_GRBM_SOFT_RESET, R600_SOFT_RESET_CP);
         RADEON_READ(R600_GRBM_SOFT_RESET);
-        DRM_UDELAY(15000);
+        mdelay(15);
         RADEON_WRITE(R600_GRBM_SOFT_RESET, 0);
 
         fw_data = (const __be32 *)dev_priv->me_fw->data;
@@ -500,7 +500,7 @@ static void r700_cp_load_microcode(drm_radeon_private_t *dev_priv)
 
         RADEON_WRITE(R600_GRBM_SOFT_RESET, R600_SOFT_RESET_CP);
         RADEON_READ(R600_GRBM_SOFT_RESET);
-        DRM_UDELAY(15000);
+        mdelay(15);
         RADEON_WRITE(R600_GRBM_SOFT_RESET, 0);
 
         fw_data = (const __be32 *)dev_priv->pfp_fw->data;
@@ -1797,7 +1797,7 @@ static void r600_cp_init_ring_buffer(struct drm_device *dev,
 
         RADEON_WRITE(R600_GRBM_SOFT_RESET, R600_SOFT_RESET_CP);
         RADEON_READ(R600_GRBM_SOFT_RESET);
-        DRM_UDELAY(15000);
+        mdelay(15);
         RADEON_WRITE(R600_GRBM_SOFT_RESET, 0);
 
 
diff --git a/drivers/gpu/drm/radeon/radeon_clocks.c b/drivers/gpu/drm/radeon/radeon_clocks.c
index 6ae0c75f016a..9c6b29a41927 100644
--- a/drivers/gpu/drm/radeon/radeon_clocks.c
+++ b/drivers/gpu/drm/radeon/radeon_clocks.c
@@ -633,7 +633,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                 tmp &= ~(R300_SCLK_FORCE_VAP);
                                 tmp |= RADEON_SCLK_FORCE_CP;
                                 WREG32_PLL(RADEON_SCLK_CNTL, tmp);
-                                udelay(15000);
+                                mdelay(15);
 
                                 tmp = RREG32_PLL(R300_SCLK_CNTL2);
                                 tmp &= ~(R300_SCLK_FORCE_TCL |
@@ -651,12 +651,12 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                         tmp |= (RADEON_ENGIN_DYNCLK_MODE |
                                 (0x01 << RADEON_ACTIVE_HILO_LAT_SHIFT));
                         WREG32_PLL(RADEON_CLK_PWRMGT_CNTL, tmp);
-                        udelay(15000);
+                        mdelay(15);
 
                         tmp = RREG32_PLL(RADEON_CLK_PIN_CNTL);
                         tmp |= RADEON_SCLK_DYN_START_CNTL;
                         WREG32_PLL(RADEON_CLK_PIN_CNTL, tmp);
-                        udelay(15000);
+                        mdelay(15);
 
                         /* When DRI is enabled, setting DYN_STOP_LAT to zero can cause some R200
                            to lockup randomly, leave them as set by BIOS.
@@ -696,7 +696,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                         tmp |= RADEON_SCLK_MORE_FORCEON;
                                 }
                                 WREG32_PLL(RADEON_SCLK_MORE_CNTL, tmp);
-                                udelay(15000);
+                                mdelay(15);
                         }
 
                         /* RV200::A11 A12, RV250::A11 A12 */
@@ -709,7 +709,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                 tmp |= RADEON_TCL_BYPASS_DISABLE;
                                 WREG32_PLL(RADEON_PLL_PWRMGT_CNTL, tmp);
                         }
-                        udelay(15000);
+                        mdelay(15);
 
                         /*enable dynamic mode for display clocks (PIXCLK and PIX2CLK) */
                         tmp = RREG32_PLL(RADEON_PIXCLKS_CNTL);
@@ -722,14 +722,14 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                 RADEON_PIXCLK_TMDS_ALWAYS_ONb);
 
                         WREG32_PLL(RADEON_PIXCLKS_CNTL, tmp);
-                        udelay(15000);
+                        mdelay(15);
 
                         tmp = RREG32_PLL(RADEON_VCLK_ECP_CNTL);
                         tmp |= (RADEON_PIXCLK_ALWAYS_ONb |
                                 RADEON_PIXCLK_DAC_ALWAYS_ONb);
 
                         WREG32_PLL(RADEON_VCLK_ECP_CNTL, tmp);
-                        udelay(15000);
+                        mdelay(15);
                 }
         } else {
                 /* Turn everything OFF (ForceON to everything) */
@@ -861,7 +861,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                         }
                         WREG32_PLL(RADEON_SCLK_CNTL, tmp);
 
-                        udelay(16000);
+                        mdelay(16);
 
                         if ((rdev->family == CHIP_R300) ||
                             (rdev->family == CHIP_R350)) {
@@ -870,7 +870,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                         R300_SCLK_FORCE_GA |
                                         R300_SCLK_FORCE_CBA);
                                 WREG32_PLL(R300_SCLK_CNTL2, tmp);
-                                udelay(16000);
+                                mdelay(16);
                         }
 
                         if (rdev->flags & RADEON_IS_IGP) {
@@ -878,7 +878,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                 tmp &= ~(RADEON_FORCEON_MCLKA |
                                          RADEON_FORCEON_YCLKA);
                                 WREG32_PLL(RADEON_MCLK_CNTL, tmp);
-                                udelay(16000);
+                                mdelay(16);
                         }
 
                         if ((rdev->family == CHIP_RV200) ||
@@ -887,7 +887,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                 tmp = RREG32_PLL(RADEON_SCLK_MORE_CNTL);
                                 tmp |= RADEON_SCLK_MORE_FORCEON;
                                 WREG32_PLL(RADEON_SCLK_MORE_CNTL, tmp);
-                                udelay(16000);
+                                mdelay(16);
                         }
 
                         tmp = RREG32_PLL(RADEON_PIXCLKS_CNTL);
@@ -900,7 +900,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                  RADEON_PIXCLK_TMDS_ALWAYS_ONb);
 
                         WREG32_PLL(RADEON_PIXCLKS_CNTL, tmp);
-                        udelay(16000);
+                        mdelay(16);
 
                         tmp = RREG32_PLL(RADEON_VCLK_ECP_CNTL);
                         tmp &= ~(RADEON_PIXCLK_ALWAYS_ONb |
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 81fc100be7e1..2cad9fde92fc 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2845,7 +2845,7 @@ bool radeon_combios_external_tmds_setup(struct drm_encoder *encoder)
                                         case 4:
                                                 val = RBIOS16(index);
                                                 index += 2;
-                                                udelay(val * 1000);
+                                                mdelay(val);
                                                 break;
                                         case 6:
                                                 slave_addr = id & 0xff;
@@ -3044,7 +3044,7 @@ static void combios_parse_pll_table(struct drm_device *dev, uint16_t offset)
                                         udelay(150);
                                         break;
                                 case 2:
-                                        udelay(1000);
+                                        mdelay(1);
                                         break;
                                 case 3:
                                         while (tmp--) {
@@ -3075,13 +3075,13 @@ static void combios_parse_pll_table(struct drm_device *dev, uint16_t offset)
                                                 /*mclk_cntl |= 0x00001111;*//* ??? */
                                                 WREG32_PLL(RADEON_MCLK_CNTL,
                                                            mclk_cntl);
-                                                udelay(10000);
+                                                mdelay(10);
 #endif
                                                 WREG32_PLL
                                                     (RADEON_CLK_PWRMGT_CNTL,
                                                      tmp &
                                                      ~RADEON_CG_NO1_DEBUG_0);
-                                                udelay(10000);
+                                                mdelay(10);
                                         }
                                         break;
                                 default:
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index bd05156edbdb..3c2e7a000a2a 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -970,7 +970,7 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
 
                         encoder = obj_to_encoder(obj);
 
-                        if (encoder->encoder_type != DRM_MODE_ENCODER_DAC ||
+                        if (encoder->encoder_type != DRM_MODE_ENCODER_DAC &&
                             encoder->encoder_type != DRM_MODE_ENCODER_TVDAC)
                                 continue;
 
@@ -1000,6 +1000,7 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
          * cases the DVI port is actually a virtual KVM port connected to the service
          * processor.
          */
+out:
         if ((!rdev->is_atom_bios) &&
             (ret == connector_status_disconnected) &&
             rdev->mode_info.bios_hardcoded_edid_size) {
@@ -1007,7 +1008,6 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
                 ret = connector_status_connected;
         }
 
-out:
         /* updated in get modes as well since we need to know if it's analog or digital */
         radeon_connector_update_scratch_regs(connector, ret);
         return ret;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index ea7df16e2f84..5992502a3448 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -241,8 +241,8 @@ int radeon_wb_init(struct radeon_device *rdev)
                                 rdev->wb.use_event = true;
                 }
         }
-        /* always use writeback/events on NI */
-        if (ASIC_IS_DCE5(rdev)) {
+        /* always use writeback/events on NI, APUs */
+        if (rdev->family >= CHIP_PALM) {
                 rdev->wb.enabled = true;
                 rdev->wb.use_event = true;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 8086c96e0b06..0a1d4bd65edc 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -533,7 +533,7 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
                 radeon_legacy_init_crtc(dev, radeon_crtc);
 }
 
-static const char *encoder_names[36] = {
+static const char *encoder_names[37] = {
         "NONE",
         "INTERNAL_LVDS",
         "INTERNAL_TMDS1",
@@ -570,6 +570,7 @@ static const char *encoder_names[36] = {
         "INTERNAL_UNIPHY2",
         "NUTMEG",
         "TRAVIS",
+        "INTERNAL_VCE"
 };
 
 static const char *connector_names[15] = {
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index 85bcfc8923a7..3edec1c198e3 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -900,6 +900,10 @@ struct radeon_i2c_chan *radeon_i2c_create(struct drm_device *dev,
         struct radeon_i2c_chan *i2c;
         int ret;
 
+        /* don't add the mm_i2c bus unless hw_i2c is enabled */
+        if (rec->mm_i2c && (radeon_hw_i2c == 0))
+                return NULL;
+
         i2c = kzalloc(sizeof(struct radeon_i2c_chan), GFP_KERNEL);
         if (i2c == NULL)
                 return NULL;
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index 66d5fe1c8174..65060b77c805 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -147,6 +147,12 @@ static bool radeon_msi_ok(struct radeon_device *rdev)
             (rdev->pdev->subsystem_device == 0x01fd))
                 return true;
 
+        /* RV515 seems to have MSI issues where it loses
+         * MSI rearms occasionally. This leads to lockups and freezes.
+         * disable it by default.
+         */
+        if (rdev->family == CHIP_RV515)
+                return false;
         if (rdev->flags & RADEON_IS_IGP) {
                 /* APUs work fine with MSIs */
                 if (rdev->family >= CHIP_PALM)
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 2f46e0c8df53..42db254f6bb0 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -88,7 +88,7 @@ static void radeon_legacy_lvds_update(struct drm_encoder *encoder, int mode)
                 lvds_pll_cntl = RREG32(RADEON_LVDS_PLL_CNTL);
                 lvds_pll_cntl |= RADEON_LVDS_PLL_EN;
                 WREG32(RADEON_LVDS_PLL_CNTL, lvds_pll_cntl);
-                udelay(1000);
+                mdelay(1);
 
                 lvds_pll_cntl = RREG32(RADEON_LVDS_PLL_CNTL);
                 lvds_pll_cntl &= ~RADEON_LVDS_PLL_RESET;
@@ -101,7 +101,7 @@ static void radeon_legacy_lvds_update(struct drm_encoder *encoder, int mode)
                                   (backlight_level << RADEON_LVDS_BL_MOD_LEVEL_SHIFT));
                 if (is_mac)
                         lvds_gen_cntl |= RADEON_LVDS_BL_MOD_EN;
-                udelay(panel_pwr_delay * 1000);
+                mdelay(panel_pwr_delay);
                 WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
                 break;
         case DRM_MODE_DPMS_STANDBY:
@@ -118,10 +118,10 @@ static void radeon_legacy_lvds_update(struct drm_encoder *encoder, int mode)
                         WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
                         lvds_gen_cntl &= ~(RADEON_LVDS_ON | RADEON_LVDS_BLON | RADEON_LVDS_EN | RADEON_LVDS_DIGON);
                 }
-                udelay(panel_pwr_delay * 1000);
+                mdelay(panel_pwr_delay);
                 WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
                 WREG32_PLL(RADEON_PIXCLKS_CNTL, pixclks_cntl);
-                udelay(panel_pwr_delay * 1000);
+                mdelay(panel_pwr_delay);
                 break;
         }
 
@@ -656,7 +656,7 @@ static enum drm_connector_status radeon_legacy_primary_dac_detect(struct drm_enc
 
         WREG32(RADEON_DAC_MACRO_CNTL, tmp);
 
-        udelay(2000);
+        mdelay(2);
 
         if (RREG32(RADEON_DAC_CNTL) & RADEON_DAC_CMP_OUTPUT)
                 found = connector_status_connected;
@@ -1499,7 +1499,7 @@ static enum drm_connector_status radeon_legacy_tv_dac_detect(struct drm_encoder
         tmp = dac_cntl2 | RADEON_DAC2_DAC2_CLK_SEL | RADEON_DAC2_CMP_EN;
         WREG32(RADEON_DAC_CNTL2, tmp);
 
-        udelay(10000);
+        mdelay(10);
 
         if (ASIC_IS_R300(rdev)) {
                 if (RREG32(RADEON_DAC_CNTL2) & RADEON_DAC2_CMP_OUT_B)
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index c62ae4be3845..cdab1aeaed6e 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -969,7 +969,7 @@ void r700_vram_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc)
         }
         if (rdev->flags & RADEON_IS_AGP) {
                 size_bf = mc->gtt_start;
-                size_af = 0xFFFFFFFF - mc->gtt_end + 1;
+                size_af = 0xFFFFFFFF - mc->gtt_end;
                 if (size_bf > size_af) {
                         if (mc->mc_vram_size > size_bf) {
                                 dev_warn(rdev->dev, "limiting VRAM\n");
@@ -983,7 +983,7 @@ void r700_vram_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc)
                                 mc->real_vram_size = size_af;
                                 mc->mc_vram_size = size_af;
                         }
-                        mc->vram_start = mc->gtt_end;
+                        mc->vram_start = mc->gtt_end + 1;
                 }
                 mc->vram_end = mc->vram_start + mc->mc_vram_size - 1;
                 dev_info(rdev->dev, "VRAM: %lluM 0x%08llX - 0x%08llX (%lluM used)\n",
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index ac7a199ffece..27bda986fc2b 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2999,8 +2999,8 @@ int si_rlc_init(struct radeon_device *rdev)
         }
         r = radeon_bo_pin(rdev->rlc.save_restore_obj, RADEON_GEM_DOMAIN_VRAM,
                           &rdev->rlc.save_restore_gpu_addr);
+        radeon_bo_unreserve(rdev->rlc.save_restore_obj);
         if (r) {
-                radeon_bo_unreserve(rdev->rlc.save_restore_obj);
                 dev_warn(rdev->dev, "(%d) pin RLC sr bo failed\n", r);
                 si_rlc_fini(rdev);
                 return r;
@@ -3023,9 +3023,8 @@ int si_rlc_init(struct radeon_device *rdev)
         }
         r = radeon_bo_pin(rdev->rlc.clear_state_obj, RADEON_GEM_DOMAIN_VRAM,
                           &rdev->rlc.clear_state_gpu_addr);
+        radeon_bo_unreserve(rdev->rlc.clear_state_obj);
         if (r) {
-
-                radeon_bo_unreserve(rdev->rlc.clear_state_obj);
                 dev_warn(rdev->dev, "(%d) pin RLC c bo failed\n", r);
                 si_rlc_fini(rdev);
                 return r;
diff --git a/drivers/gpu/drm/savage/savage_state.c b/drivers/gpu/drm/savage/savage_state.c
index 031aaaf79ac2..b6d8608375cd 100644
--- a/drivers/gpu/drm/savage/savage_state.c
+++ b/drivers/gpu/drm/savage/savage_state.c
@@ -988,7 +988,7 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
          * for locking on FreeBSD.
          */
         if (cmdbuf->size) {
-                kcmd_addr = kmalloc(cmdbuf->size * 8, GFP_KERNEL);
+                kcmd_addr = kmalloc_array(cmdbuf->size, 8, GFP_KERNEL);
                 if (kcmd_addr == NULL)
                         return -ENOMEM;
 
@@ -1015,8 +1015,8 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
                 cmdbuf->vb_addr = kvb_addr;
         }
         if (cmdbuf->nbox) {
-                kbox_addr = kmalloc(cmdbuf->nbox * sizeof(struct drm_clip_rect),
-                                    GFP_KERNEL);
+                kbox_addr = kmalloc_array(cmdbuf->nbox, sizeof(struct drm_clip_rect),
+                                          GFP_KERNEL);
                 if (kbox_addr == NULL) {
                         ret = -ENOMEM;
                         goto done;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index a3d033252995..ffddcba32af6 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -34,7 +34,7 @@ config HID
 config HID_BATTERY_STRENGTH
         bool
         depends on HID && POWER_SUPPLY && HID = POWER_SUPPLY
-        default y
+        default n
 
 config HIDRAW
         bool "/dev/hidraw raw HID device support"
diff --git a/drivers/hid/hid-tivo.c b/drivers/hid/hid-tivo.c
index de47039c708c..9f85f827607f 100644
--- a/drivers/hid/hid-tivo.c
+++ b/drivers/hid/hid-tivo.c
@@ -62,7 +62,7 @@ static int tivo_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 
 static const struct hid_device_id tivo_devices[] = {
         /* TiVo Slide Bluetooth remote, pairs with a Broadcom dongle */
-        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
         { }
 };
diff --git a/drivers/hsi/clients/hsi_char.c b/drivers/hsi/clients/hsi_char.c
index 88a050df2389..3ad91f6447d8 100644
--- a/drivers/hsi/clients/hsi_char.c
+++ b/drivers/hsi/clients/hsi_char.c
@@ -123,7 +123,7 @@ struct hsc_client_data {
 static unsigned int hsc_major;
 /* Maximum buffer size that hsi_char will accept from userspace */
 static unsigned int max_data_size = 0x1000;
-module_param(max_data_size, uint, S_IRUSR | S_IWUSR);
+module_param(max_data_size, uint, 0);
 MODULE_PARM_DESC(max_data_size, "max read/write data size [4,8..65536] (^2)");
 
 static void hsc_add_tail(struct hsc_channel *channel, struct hsi_msg *msg,
diff --git a/drivers/hsi/hsi.c b/drivers/hsi/hsi.c
index 4e2d79b79334..2d58f939d27f 100644
--- a/drivers/hsi/hsi.c
+++ b/drivers/hsi/hsi.c
@@ -21,26 +21,13 @@
  */
 #include <linux/hsi/hsi.h>
 #include <linux/compiler.h>
-#include <linux/rwsem.h>
 #include <linux/list.h>
-#include <linux/spinlock.h>
 #include <linux/kobject.h>
 #include <linux/slab.h>
 #include <linux/string.h>
+#include <linux/notifier.h>
 #include "hsi_core.h"
 
-static struct device_type hsi_ctrl = {
-        .name   = "hsi_controller",
-};
-
-static struct device_type hsi_cl = {
-        .name   = "hsi_client",
-};
-
-static struct device_type hsi_port = {
-        .name   = "hsi_port",
-};
-
 static ssize_t modalias_show(struct device *dev,
                         struct device_attribute *a __maybe_unused, char *buf)
 {
@@ -54,8 +41,7 @@ static struct device_attribute hsi_bus_dev_attrs[] = {
 
 static int hsi_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
 {
-        if (dev->type == &hsi_cl)
-                add_uevent_var(env, "MODALIAS=hsi:%s", dev_name(dev));
+        add_uevent_var(env, "MODALIAS=hsi:%s", dev_name(dev));
 
         return 0;
 }
@@ -80,12 +66,10 @@ static void hsi_client_release(struct device *dev)
 static void hsi_new_client(struct hsi_port *port, struct hsi_board_info *info)
 {
         struct hsi_client *cl;
-        unsigned long flags;
 
         cl = kzalloc(sizeof(*cl), GFP_KERNEL);
         if (!cl)
                 return;
-        cl->device.type = &hsi_cl;
         cl->tx_cfg = info->tx_cfg;
         cl->rx_cfg = info->rx_cfg;
         cl->device.bus = &hsi_bus_type;
@@ -93,14 +77,11 @@ static void hsi_new_client(struct hsi_port *port, struct hsi_board_info *info)
         cl->device.release = hsi_client_release;
         dev_set_name(&cl->device, info->name);
         cl->device.platform_data = info->platform_data;
-        spin_lock_irqsave(&port->clock, flags);
-        list_add_tail(&cl->link, &port->clients);
-        spin_unlock_irqrestore(&port->clock, flags);
         if (info->archdata)
                 cl->device.archdata = *info->archdata;
         if (device_register(&cl->device) < 0) {
                 pr_err("hsi: failed to register client: %s\n", info->name);
-                kfree(cl);
+                put_device(&cl->device);
         }
 }
 
@@ -120,13 +101,6 @@ static void hsi_scan_board_info(struct hsi_controller *hsi)
 
 static int hsi_remove_client(struct device *dev, void *data __maybe_unused)
 {
-        struct hsi_client *cl = to_hsi_client(dev);
-        struct hsi_port *port = to_hsi_port(dev->parent);
-        unsigned long flags;
-
-        spin_lock_irqsave(&port->clock, flags);
-        list_del(&cl->link);
-        spin_unlock_irqrestore(&port->clock, flags);
         device_unregister(dev);
 
         return 0;
@@ -140,12 +114,17 @@ static int hsi_remove_port(struct device *dev, void *data __maybe_unused)
         return 0;
 }
 
-static void hsi_controller_release(struct device *dev __maybe_unused)
+static void hsi_controller_release(struct device *dev)
 {
+        struct hsi_controller *hsi = to_hsi_controller(dev);
+
+        kfree(hsi->port);
+        kfree(hsi);
 }
 
-static void hsi_port_release(struct device *dev __maybe_unused)
+static void hsi_port_release(struct device *dev)
 {
+        kfree(to_hsi_port(dev));
 }
 
 /**
@@ -170,20 +149,12 @@ int hsi_register_controller(struct hsi_controller *hsi)
         unsigned int i;
         int err;
 
-        hsi->device.type = &hsi_ctrl;
-        hsi->device.bus = &hsi_bus_type;
-        hsi->device.release = hsi_controller_release;
-        err = device_register(&hsi->device);
+        err = device_add(&hsi->device);
         if (err < 0)
                 return err;
         for (i = 0; i < hsi->num_ports; i++) {
-                hsi->port[i].device.parent = &hsi->device;
-                hsi->port[i].device.bus = &hsi_bus_type;
-                hsi->port[i].device.release = hsi_port_release;
-                hsi->port[i].device.type = &hsi_port;
-                INIT_LIST_HEAD(&hsi->port[i].clients);
-                spin_lock_init(&hsi->port[i].clock);
-                err = device_register(&hsi->port[i].device);
+                hsi->port[i]->device.parent = &hsi->device;
+                err = device_add(&hsi->port[i]->device);
                 if (err < 0)
                         goto out;
         }
@@ -192,7 +163,9 @@ int hsi_register_controller(struct hsi_controller *hsi)
 
         return 0;
 out:
-        hsi_unregister_controller(hsi);
+        while (i-- > 0)
+                device_del(&hsi->port[i]->device);
+        device_del(&hsi->device);
 
         return err;
 }
@@ -223,6 +196,29 @@ static inline int hsi_dummy_cl(struct hsi_client *cl __maybe_unused)
 }
 
 /**
+ * hsi_put_controller - Free an HSI controller
+ *
+ * @hsi: Pointer to the HSI controller to freed
+ *
+ * HSI controller drivers should only use this function if they need
+ * to free their allocated hsi_controller structures before a successful
+ * call to hsi_register_controller. Other use is not allowed.
+ */
+void hsi_put_controller(struct hsi_controller *hsi)
+{
+        unsigned int i;
+
+        if (!hsi)
+                return;
+
+        for (i = 0; i < hsi->num_ports; i++)
+                if (hsi->port && hsi->port[i])
+                        put_device(&hsi->port[i]->device);
+        put_device(&hsi->device);
+}
+EXPORT_SYMBOL_GPL(hsi_put_controller);
+
+/**
  * hsi_alloc_controller - Allocate an HSI controller and its ports
  * @n_ports: Number of ports on the HSI controller
  * @flags: Kernel allocation flags
@@ -232,55 +228,52 @@ static inline int hsi_dummy_cl(struct hsi_client *cl __maybe_unused)
 struct hsi_controller *hsi_alloc_controller(unsigned int n_ports, gfp_t flags)
 {
         struct hsi_controller   *hsi;
-        struct hsi_port         *port;
+        struct hsi_port         **port;
         unsigned int            i;
 
         if (!n_ports)
                 return NULL;
 
-        port = kzalloc(sizeof(*port)*n_ports, flags);
-        if (!port)
-                return NULL;
         hsi = kzalloc(sizeof(*hsi), flags);
         if (!hsi)
-                goto out;
-        for (i = 0; i < n_ports; i++) {
-                dev_set_name(&port[i].device, "port%d", i);
-                port[i].num = i;
-                port[i].async = hsi_dummy_msg;
-                port[i].setup = hsi_dummy_cl;
-                port[i].flush = hsi_dummy_cl;
-                port[i].start_tx = hsi_dummy_cl;
-                port[i].stop_tx = hsi_dummy_cl;
-                port[i].release = hsi_dummy_cl;
-                mutex_init(&port[i].lock);
+                return NULL;
+        port = kzalloc(sizeof(*port)*n_ports, flags);
+        if (!port) {
+                kfree(hsi);
+                return NULL;
         }
         hsi->num_ports = n_ports;
         hsi->port = port;
+        hsi->device.release = hsi_controller_release;
+        device_initialize(&hsi->device);
+
+        for (i = 0; i < n_ports; i++) {
+                port[i] = kzalloc(sizeof(**port), flags);
+                if (port[i] == NULL)
+                        goto out;
+                port[i]->num = i;
+                port[i]->async = hsi_dummy_msg;
+                port[i]->setup = hsi_dummy_cl;
+                port[i]->flush = hsi_dummy_cl;
+                port[i]->start_tx = hsi_dummy_cl;
+                port[i]->stop_tx = hsi_dummy_cl;
+                port[i]->release = hsi_dummy_cl;
+                mutex_init(&port[i]->lock);
+                ATOMIC_INIT_NOTIFIER_HEAD(&port[i]->n_head);
+                dev_set_name(&port[i]->device, "port%d", i);
+                hsi->port[i]->device.release = hsi_port_release;
+                device_initialize(&hsi->port[i]->device);
+        }
 
         return hsi;
 out:
-        kfree(port);
+        hsi_put_controller(hsi);
 
         return NULL;
 }
 EXPORT_SYMBOL_GPL(hsi_alloc_controller);
 
 /**
- * hsi_free_controller - Free an HSI controller
- * @hsi: Pointer to HSI controller
- */
-void hsi_free_controller(struct hsi_controller *hsi)
-{
-        if (!hsi)
-                return;
-
-        kfree(hsi->port);
-        kfree(hsi);
-}
-EXPORT_SYMBOL_GPL(hsi_free_controller);
-
-/**
  * hsi_free_msg - Free an HSI message
  * @msg: Pointer to the HSI message
  *
@@ -414,37 +407,67 @@ void hsi_release_port(struct hsi_client *cl)
 }
 EXPORT_SYMBOL_GPL(hsi_release_port);
 
-static int hsi_start_rx(struct hsi_client *cl, void *data __maybe_unused)
+static int hsi_event_notifier_call(struct notifier_block *nb,
+                                unsigned long event, void *data __maybe_unused)
 {
-        if (cl->hsi_start_rx)
-                (*cl->hsi_start_rx)(cl);
+        struct hsi_client *cl = container_of(nb, struct hsi_client, nb);
+
+        (*cl->ehandler)(cl, event);
 
         return 0;
 }
 
-static int hsi_stop_rx(struct hsi_client *cl, void *data __maybe_unused)
+/**
+ * hsi_register_port_event - Register a client to receive port events
+ * @cl: HSI client that wants to receive port events
+ * @cb: Event handler callback
+ *
+ * Clients should register a callback to be able to receive
+ * events from the ports. Registration should happen after
+ * claiming the port.
+ * The handler can be called in interrupt context.
+ *
+ * Returns -errno on error, or 0 on success.
+ */
+int hsi_register_port_event(struct hsi_client *cl,
+                        void (*handler)(struct hsi_client *, unsigned long))
 {
-        if (cl->hsi_stop_rx)
-                (*cl->hsi_stop_rx)(cl);
+        struct hsi_port *port = hsi_get_port(cl);
 
-        return 0;
+        if (!handler || cl->ehandler)
+                return -EINVAL;
+        if (!hsi_port_claimed(cl))
+                return -EACCES;
+        cl->ehandler = handler;
+        cl->nb.notifier_call = hsi_event_notifier_call;
+
+        return atomic_notifier_chain_register(&port->n_head, &cl->nb);
 }
+EXPORT_SYMBOL_GPL(hsi_register_port_event);
 
-static int hsi_port_for_each_client(struct hsi_port *port, void *data,
-                                int (*fn)(struct hsi_client *cl, void *data))
+/**
+ * hsi_unregister_port_event - Stop receiving port events for a client
+ * @cl: HSI client that wants to stop receiving port events
+ *
+ * Clients should call this function before releasing their associated
+ * port.
+ *
+ * Returns -errno on error, or 0 on success.
+ */
+int hsi_unregister_port_event(struct hsi_client *cl)
 {
-        struct hsi_client *cl;
+        struct hsi_port *port = hsi_get_port(cl);
+        int err;
 
-        spin_lock(&port->clock);
-        list_for_each_entry(cl, &port->clients, link) {
-                spin_unlock(&port->clock);
-                (*fn)(cl, data);
-                spin_lock(&port->clock);
-        }
-        spin_unlock(&port->clock);
+        WARN_ON(!hsi_port_claimed(cl));
 
-        return 0;
+        err = atomic_notifier_chain_unregister(&port->n_head, &cl->nb);
+        if (!err)
+                cl->ehandler = NULL;
+
+        return err;
 }
+EXPORT_SYMBOL_GPL(hsi_unregister_port_event);
 
 /**
  * hsi_event -Notifies clients about port events
@@ -458,22 +481,12 @@ static int hsi_port_for_each_client(struct hsi_port *port, void *data,
  * Events:
  * HSI_EVENT_START_RX - Incoming wake line high
  * HSI_EVENT_STOP_RX - Incoming wake line down
+ *
+ * Returns -errno on error, or 0 on success.
  */
-void hsi_event(struct hsi_port *port, unsigned int event)
+int hsi_event(struct hsi_port *port, unsigned long event)
 {
-        int (*fn)(struct hsi_client *cl, void *data);
-
-        switch (event) {
-        case HSI_EVENT_START_RX:
-                fn = hsi_start_rx;
-                break;
-        case HSI_EVENT_STOP_RX:
-                fn = hsi_stop_rx;
-                break;
-        default:
-                return;
-        }
-        hsi_port_for_each_client(port, NULL, fn);
+        return atomic_notifier_call_chain(&port->n_head, event, NULL);
 }
 EXPORT_SYMBOL_GPL(hsi_event);
 
diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
index 145f13580ff0..9140236a0182 100644
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -391,6 +391,7 @@ static ssize_t show_str(struct device *dev,
                 break;
         default:
                 BUG();
+                val = "";
         }
 
         return sprintf(buf, "%s\n", val);
diff --git a/drivers/hwmon/ad7314.c b/drivers/hwmon/ad7314.c
index ce43642ef03e..f85ce70d9677 100644
--- a/drivers/hwmon/ad7314.c
+++ b/drivers/hwmon/ad7314.c
@@ -47,7 +47,7 @@ struct ad7314_data {
         u16 rx ____cacheline_aligned;
 };
 
-static int ad7314_spi_read(struct ad7314_data *chip, s16 *data)
+static int ad7314_spi_read(struct ad7314_data *chip)
 {
         int ret;
 
@@ -57,9 +57,7 @@ static int ad7314_spi_read(struct ad7314_data *chip, s16 *data)
                 return ret;
         }
 
-        *data = be16_to_cpu(chip->rx);
-
-        return ret;
+        return be16_to_cpu(chip->rx);
 }
 
 static ssize_t ad7314_show_temperature(struct device *dev,
@@ -70,12 +68,12 @@ static ssize_t ad7314_show_temperature(struct device *dev,
         s16 data;
         int ret;
 
-        ret = ad7314_spi_read(chip, &data);
+        ret = ad7314_spi_read(chip);
         if (ret < 0)
                 return ret;
         switch (spi_get_device_id(chip->spi_dev)->driver_data) {
         case ad7314:
-                data = (data & AD7314_TEMP_MASK) >> AD7314_TEMP_OFFSET;
+                data = (ret & AD7314_TEMP_MASK) >> AD7314_TEMP_OFFSET;
                 data = (data << 6) >> 6;
 
                 return sprintf(buf, "%d\n", 250 * data);
@@ -86,7 +84,7 @@ static ssize_t ad7314_show_temperature(struct device *dev,
                  * with a sign bit - which is a 14 bit 2's complement
                  * register.  1lsb - 31.25 milli degrees centigrade
                  */
-                data &= ADT7301_TEMP_MASK;
+                data = ret & ADT7301_TEMP_MASK;
                 data = (data << 2) >> 2;
 
                 return sprintf(buf, "%d\n",
diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c
index 7765e4f74ec5..1958f03efd7a 100644
--- a/drivers/hwmon/ads1015.c
+++ b/drivers/hwmon/ads1015.c
@@ -59,14 +59,11 @@ struct ads1015_data {
         struct ads1015_channel_data channel_data[ADS1015_CHANNELS];
 };
 
-static int ads1015_read_value(struct i2c_client *client, unsigned int channel,
-                              int *value)
+static int ads1015_read_adc(struct i2c_client *client, unsigned int channel)
 {
         u16 config;
-        s16 conversion;
         struct ads1015_data *data = i2c_get_clientdata(client);
         unsigned int pga = data->channel_data[channel].pga;
-        int fullscale;
         unsigned int data_rate = data->channel_data[channel].data_rate;
         unsigned int conversion_time_ms;
         int res;
@@ -78,7 +75,6 @@ static int ads1015_read_value(struct i2c_client *client, unsigned int channel,
         if (res < 0)
                 goto err_unlock;
         config = res;
-        fullscale = fullscale_table[pga];
         conversion_time_ms = DIV_ROUND_UP(1000, data_rate_table[data_rate]);
 
         /* setup and start single conversion */
@@ -105,33 +101,36 @@ static int ads1015_read_value(struct i2c_client *client, unsigned int channel,
         }
 
         res = i2c_smbus_read_word_swapped(client, ADS1015_CONVERSION);
-        if (res < 0)
-                goto err_unlock;
-        conversion = res;
-
-        mutex_unlock(&data->update_lock);
-
-        *value = DIV_ROUND_CLOSEST(conversion * fullscale, 0x7ff0);
-
-        return 0;
 
 err_unlock:
         mutex_unlock(&data->update_lock);
         return res;
 }
 
+static int ads1015_reg_to_mv(struct i2c_client *client, unsigned int channel,
+                             s16 reg)
+{
+        struct ads1015_data *data = i2c_get_clientdata(client);
+        unsigned int pga = data->channel_data[channel].pga;
+        int fullscale = fullscale_table[pga];
+
+        return DIV_ROUND_CLOSEST(reg * fullscale, 0x7ff0);
+}
+
 /* sysfs callback function */
 static ssize_t show_in(struct device *dev, struct device_attribute *da,
         char *buf)
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
         struct i2c_client *client = to_i2c_client(dev);
-        int in;
         int res;
+        int index = attr->index;
 
-        res = ads1015_read_value(client, attr->index, &in);
+        res = ads1015_read_adc(client, index);
+        if (res < 0)
+                return res;
 
-        return (res < 0) ? res : sprintf(buf, "%d\n", in);
+        return sprintf(buf, "%d\n", ads1015_reg_to_mv(client, index, res));
 }
 
 static const struct sensor_device_attribute ads1015_in[] = {
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 0d3141fbbc20..b9d512331ed4 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -52,7 +52,7 @@ module_param_named(tjmax, force_tjmax, int, 0444);
 MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
 
 #define BASE_SYSFS_ATTR_NO      2       /* Sysfs Base attr no for coretemp */
-#define NUM_REAL_CORES          16      /* Number of Real cores per cpu */
+#define NUM_REAL_CORES          32      /* Number of Real cores per cpu */
 #define CORETEMP_NAME_LENGTH    17      /* String Length of attrs */
 #define MAX_CORE_ATTRS          4       /* Maximum no of basic attrs */
 #define TOTAL_ATTRS             (MAX_CORE_ATTRS + 1)
@@ -709,6 +709,10 @@ static void __cpuinit put_core_offline(unsigned int cpu)
 
         indx = TO_ATTR_NO(cpu);
 
+        /* The core id is too big, just return */
+        if (indx > MAX_CORE_DATA - 1)
+                return;
+
         if (pdata->core_data[indx] && pdata->core_data[indx]->cpu == cpu)
                 coretemp_remove_core(pdata, &pdev->dev, indx);
 
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index b7494af1e4a9..e8e18cab1fb8 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -122,6 +122,41 @@ static bool __devinit fam15h_power_is_internal_node0(struct pci_dev *f4)
         return true;
 }
 
+/*
+ * Newer BKDG versions have an updated recommendation on how to properly
+ * initialize the running average range (was: 0xE, now: 0x9). This avoids
+ * counter saturations resulting in bogus power readings.
+ * We correct this value ourselves to cope with older BIOSes.
+ */
+static DEFINE_PCI_DEVICE_TABLE(affected_device) = {
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
+        { 0 }
+};
+
+static void __devinit tweak_runavg_range(struct pci_dev *pdev)
+{
+        u32 val;
+
+        /*
+         * let this quirk apply only to the current version of the
+         * northbridge, since future versions may change the behavior
+         */
+        if (!pci_match_id(affected_device, pdev))
+                return;
+
+        pci_bus_read_config_dword(pdev->bus,
+                PCI_DEVFN(PCI_SLOT(pdev->devfn), 5),
+                REG_TDP_RUNNING_AVERAGE, &val);
+        if ((val & 0xf) != 0xe)
+                return;
+
+        val &= ~0xf;
+        val |=  0x9;
+        pci_bus_write_config_dword(pdev->bus,
+                PCI_DEVFN(PCI_SLOT(pdev->devfn), 5),
+                REG_TDP_RUNNING_AVERAGE, val);
+}
+
 static void __devinit fam15h_power_init_data(struct pci_dev *f4,
                                              struct fam15h_power_data *data)
 {
@@ -155,6 +190,13 @@ static int __devinit fam15h_power_probe(struct pci_dev *pdev,
         struct device *dev;
         int err;
 
+        /*
+         * though we ignore every other northbridge, we still have to
+         * do the tweaking on _each_ node in MCM processors as the counters
+         * are working hand-in-hand
+         */
+        tweak_runavg_range(pdev);
+
         if (!fam15h_power_is_internal_node0(pdev)) {
                 err = -ENODEV;
                 goto exit;
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index be51037363c8..29b319db573e 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -710,13 +710,13 @@ static u16 pmbus_data2reg(struct pmbus_data *data,
  * If a negative value is stored in any of the referenced registers, this value
  * reflects an error code which will be returned.
  */
-static int pmbus_get_boolean(struct pmbus_data *data, int index, int *val)
+static int pmbus_get_boolean(struct pmbus_data *data, int index)
 {
         u8 s1 = (index >> 24) & 0xff;
         u8 s2 = (index >> 16) & 0xff;
         u8 reg = (index >> 8) & 0xff;
         u8 mask = index & 0xff;
-        int status;
+        int ret, status;
         u8 regval;
 
         status = data->status[reg];
@@ -725,7 +725,7 @@ static int pmbus_get_boolean(struct pmbus_data *data, int index, int *val)
 
         regval = status & mask;
         if (!s1 && !s2)
-                *val = !!regval;
+                ret = !!regval;
         else {
                 long v1, v2;
                 struct pmbus_sensor *sensor1, *sensor2;
@@ -739,9 +739,9 @@ static int pmbus_get_boolean(struct pmbus_data *data, int index, int *val)
 
                 v1 = pmbus_reg2data(data, sensor1);
                 v2 = pmbus_reg2data(data, sensor2);
-                *val = !!(regval && v1 >= v2);
+                ret = !!(regval && v1 >= v2);
         }
-        return 0;
+        return ret;
 }
 
 static ssize_t pmbus_show_boolean(struct device *dev,
@@ -750,11 +750,10 @@ static ssize_t pmbus_show_boolean(struct device *dev,
         struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
         struct pmbus_data *data = pmbus_update_device(dev);
         int val;
-        int err;
 
-        err = pmbus_get_boolean(data, attr->index, &val);
-        if (err)
-                return err;
+        val = pmbus_get_boolean(data, attr->index);
+        if (val < 0)
+                return val;
         return snprintf(buf, PAGE_SIZE, "%d\n", val);
 }
 
diff --git a/drivers/hwmon/smsc47b397.c b/drivers/hwmon/smsc47b397.c
index d3b778da3f86..c5f6be478bad 100644
--- a/drivers/hwmon/smsc47b397.c
+++ b/drivers/hwmon/smsc47b397.c
@@ -343,10 +343,11 @@ exit:
         return err;
 }
 
-static int __init smsc47b397_find(unsigned short *addr)
+static int __init smsc47b397_find(void)
 {
         u8 id, rev;
         char *name;
+        unsigned short addr;
 
         superio_enter();
         id = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID);
@@ -370,14 +371,14 @@ static int __init smsc47b397_find(unsigned short *addr)
         rev = superio_inb(SUPERIO_REG_DEVREV);
 
         superio_select(SUPERIO_REG_LD8);
-        *addr = (superio_inb(SUPERIO_REG_BASE_MSB) << 8)
+        addr = (superio_inb(SUPERIO_REG_BASE_MSB) << 8)
                  |  superio_inb(SUPERIO_REG_BASE_LSB);
 
         pr_info("found SMSC %s (base address 0x%04x, revision %u)\n",
-                name, *addr, rev);
+                name, addr, rev);
 
         superio_exit();
-        return 0;
+        return addr;
 }
 
 static int __init smsc47b397_init(void)
@@ -385,9 +386,10 @@ static int __init smsc47b397_init(void)
         unsigned short address;
         int ret;
 
-        ret = smsc47b397_find(&address);
-        if (ret)
+        ret = smsc47b397_find();
+        if (ret < 0)
                 return ret;
+        address = ret;
 
         ret = platform_driver_register(&smsc47b397_driver);
         if (ret)
diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
index c590c1469793..b5aa38dd7ab9 100644
--- a/drivers/hwmon/smsc47m1.c
+++ b/drivers/hwmon/smsc47m1.c
@@ -491,10 +491,10 @@ static const struct attribute_group smsc47m1_group = {
         .attrs = smsc47m1_attributes,
 };
 
-static int __init smsc47m1_find(unsigned short *addr,
-                                struct smsc47m1_sio_data *sio_data)
+static int __init smsc47m1_find(struct smsc47m1_sio_data *sio_data)
 {
         u8 val;
+        unsigned short addr;
 
         superio_enter();
         val = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID);
@@ -546,9 +546,9 @@ static int __init smsc47m1_find(unsigned short *addr,
         }
 
         superio_select();
-        *addr = (superio_inb(SUPERIO_REG_BASE) << 8)
+        addr = (superio_inb(SUPERIO_REG_BASE) << 8)
               |  superio_inb(SUPERIO_REG_BASE + 1);
-        if (*addr == 0) {
+        if (addr == 0) {
                 pr_info("Device address not set, will not use\n");
                 superio_exit();
                 return -ENODEV;
@@ -565,7 +565,7 @@ static int __init smsc47m1_find(unsigned short *addr,
         }
 
         superio_exit();
-        return 0;
+        return addr;
 }
 
 /* Restore device to its initial state */
@@ -938,13 +938,15 @@ static int __init sm_smsc47m1_init(void)
         unsigned short address;
         struct smsc47m1_sio_data sio_data;
 
-        if (smsc47m1_find(&address, &sio_data))
-                return -ENODEV;
+        err = smsc47m1_find(&sio_data);
+        if (err < 0)
+                return err;
+        address = err;
 
         /* Sets global pdev as a side effect */
         err = smsc47m1_device_add(address, &sio_data);
         if (err)
-                goto exit;
+                return err;
 
         err = platform_driver_probe(&smsc47m1_driver, smsc47m1_probe);
         if (err)
@@ -955,7 +957,6 @@ static int __init sm_smsc47m1_init(void)
 exit_device:
         platform_device_unregister(pdev);
         smsc47m1_restore(&sio_data);
-exit:
         return err;
 }
 
diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c
index 37f42113af31..00e8f213f56e 100644
--- a/drivers/i2c/busses/i2c-designware-pcidrv.c
+++ b/drivers/i2c/busses/i2c-designware-pcidrv.c
@@ -182,7 +182,6 @@ static int i2c_dw_pci_resume(struct device *dev)
         pci_restore_state(pdev);
 
         i2c_dw_init(i2c);
-        i2c_dw_enable(i2c);
         return 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index f086131cb1c7..c811289b61e2 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -324,7 +324,7 @@ static s32 pch_i2c_wait_for_xfer_complete(struct i2c_algo_pch_data *adap)
 {
         long ret;
         ret = wait_event_timeout(pch_event,
-                        (adap->pch_event_flag != 0), msecs_to_jiffies(50));
+                        (adap->pch_event_flag != 0), msecs_to_jiffies(1000));
 
         if (ret == 0) {
                 pch_err(adap, "timeout: %x\n", adap->pch_event_flag);
@@ -1063,6 +1063,6 @@ module_exit(pch_pci_exit);
 
 MODULE_DESCRIPTION("Intel EG20T PCH/LAPIS Semico ML7213/ML7223/ML7831 IOH I2C");
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Tomoya MORINAGA. <tomoya-linux@dsn.lapis-semi.com>");
+MODULE_AUTHOR("Tomoya MORINAGA. <tomoya.rohm@gmail.com>");
 module_param(pch_i2c_speed, int, (S_IRUSR | S_IWUSR));
 module_param(pch_clk, int, (S_IRUSR | S_IWUSR));
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 3d471d56bf15..76b8af44f634 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -227,6 +227,7 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
                 return -EINVAL;
 
         init_completion(&i2c->cmd_complete);
+        i2c->cmd_err = 0;
 
         flags = stop ? MXS_I2C_CTRL0_POST_SEND_STOP : 0;
 
@@ -252,6 +253,9 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
 
         if (i2c->cmd_err == -ENXIO)
                 mxs_i2c_reset(i2c);
+        else
+                writel(MXS_I2C_QUEUECTRL_QUEUE_RUN,
+                                i2c->regs + MXS_I2C_QUEUECTRL_CLR);
 
         dev_dbg(i2c->dev, "Done with err=%d\n", i2c->cmd_err);
 
@@ -299,8 +303,6 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
                     MXS_I2C_CTRL1_SLAVE_STOP_IRQ | MXS_I2C_CTRL1_SLAVE_IRQ))
                 /* MXS_I2C_CTRL1_OVERSIZE_XFER_TERM_IRQ is only for slaves */
                 i2c->cmd_err = -EIO;
-        else
-                i2c->cmd_err = 0;
 
         is_last_cmd = (readl(i2c->regs + MXS_I2C_QUEUESTAT) &
                 MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK) == 0;
@@ -384,8 +386,6 @@ static int __devexit mxs_i2c_remove(struct platform_device *pdev)
         if (ret)
                 return -EBUSY;
 
-        writel(MXS_I2C_QUEUECTRL_QUEUE_RUN,
-                        i2c->regs + MXS_I2C_QUEUECTRL_CLR);
         writel(MXS_I2C_CTRL0_SFTRST, i2c->regs + MXS_I2C_CTRL0_SET);
 
         platform_set_drvdata(pdev, NULL);
diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
index 04be9f82e14b..eb8ad538c79f 100644
--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@@ -546,8 +546,7 @@ static int i2c_pnx_controller_suspend(struct platform_device *pdev,
 {
         struct i2c_pnx_algo_data *alg_data = platform_get_drvdata(pdev);
 
-        /* FIXME: shouldn't this be clk_disable? */
-        clk_enable(alg_data->clk);
+        clk_disable(alg_data->clk);
 
         return 0;
 }
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index e978635e60f0..55e5ea62ccee 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -516,6 +516,14 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,
         if (likely(i2c_dev->msg_err == I2C_ERR_NONE))
                 return 0;
 
+        /*
+         * NACK interrupt is generated before the I2C controller generates the
+         * STOP condition on the bus. So wait for 2 clock periods before resetting
+         * the controller so that STOP condition has been delivered properly.
+         */
+        if (i2c_dev->msg_err == I2C_ERR_NO_ACK)
+                udelay(DIV_ROUND_UP(2 * 1000000, i2c_dev->bus_clk_rate));
+
         tegra_i2c_init(i2c_dev);
         if (i2c_dev->msg_err == I2C_ERR_NO_ACK) {
                 if (msg->flags & I2C_M_IGNORE_NAK)
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 426bb7617ec6..b0d0bc8a6fb6 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1854,6 +1854,8 @@ static bool generate_unmatched_resp(struct ib_mad_private *recv,
                 response->mad.mad.mad_hdr.method = IB_MGMT_METHOD_GET_RESP;
                 response->mad.mad.mad_hdr.status =
                         cpu_to_be16(IB_MGMT_MAD_STATUS_UNSUPPORTED_METHOD_ATTRIB);
+                if (recv->mad.mad.mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
+                        response->mad.mad.mad_hdr.status |= IB_SMP_DIRECTION;
 
                 return true;
         } else {
@@ -1869,6 +1871,7 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
         struct ib_mad_list_head *mad_list;
         struct ib_mad_agent_private *mad_agent;
         int port_num;
+        int ret = IB_MAD_RESULT_SUCCESS;
 
         mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
         qp_info = mad_list->mad_queue->qp_info;
@@ -1952,8 +1955,6 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
 local:
         /* Give driver "right of first refusal" on incoming MAD */
         if (port_priv->device->process_mad) {
-                int ret;
-
                 ret = port_priv->device->process_mad(port_priv->device, 0,
                                                      port_priv->port_num,
                                                      wc, &recv->grh,
@@ -1981,7 +1982,8 @@ local:
                  * or via recv_handler in ib_mad_complete_recv()
                  */
                 recv = NULL;
-        } else if (generate_unmatched_resp(recv, response)) {
+        } else if ((ret & IB_MAD_RESULT_SUCCESS) &&
+                   generate_unmatched_resp(recv, response)) {
                 agent_send_response(&response->mad.mad, &recv->grh, wc,
                                     port_priv->device, port_num, qp_info->qp->qp_num);
         }
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 83b720ef6c34..246fdc151652 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -179,7 +179,7 @@ static ssize_t rate_show(struct ib_port *p, struct port_attribute *unused,
 {
         struct ib_port_attr attr;
         char *speed = "";
-        int rate = -1;          /* in deci-Gb/sec */
+        int rate;               /* in deci-Gb/sec */
         ssize_t ret;
 
         ret = ib_query_port(p->ibdev, p->port_num, &attr);
@@ -187,9 +187,6 @@ static ssize_t rate_show(struct ib_port *p, struct port_attribute *unused,
                 return ret;
 
         switch (attr.active_speed) {
-        case IB_SPEED_SDR:
-                rate = 25;
-                break;
         case IB_SPEED_DDR:
                 speed = " DDR";
                 rate = 50;
@@ -210,6 +207,10 @@ static ssize_t rate_show(struct ib_port *p, struct port_attribute *unused,
                 speed = " EDR";
                 rate = 250;
                 break;
+        case IB_SPEED_SDR:
+        default:                /* default to SDR for invalid rates */
+                rate = 25;
+                break;
         }
 
         rate *= ib_width_enum_to_int(attr.active_width);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 75d305629300..b948b6dd5d55 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -247,12 +247,17 @@ static int ib_link_query_port(struct ib_device *ibdev, u8 port,
                 err = mlx4_MAD_IFC(to_mdev(ibdev), 1, 1, port,
                                    NULL, NULL, in_mad, out_mad);
                 if (err)
-                        return err;
+                        goto out;
 
                 /* Checking LinkSpeedActive for FDR-10 */
                 if (out_mad->data[15] & 0x1)
                         props->active_speed = IB_SPEED_FDR10;
         }
+
+        /* Avoid wrong speed value returned by FW if the IB link is down. */
+        if (props->state == IB_PORT_DOWN)
+                 props->active_speed = IB_SPEED_SDR;
+
 out:
         kfree(in_mad);
         kfree(out_mad);
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 69e2ad06e515..daf21b899999 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -3232,6 +3232,7 @@ static void srpt_add_one(struct ib_device *device)
         srq_attr.attr.max_wr = sdev->srq_size;
         srq_attr.attr.max_sge = 1;
         srq_attr.attr.srq_limit = 0;
+        srq_attr.srq_type = IB_SRQT_BASIC;
 
         sdev->srq = ib_create_srq(sdev->pd, &srq_attr);
         if (IS_ERR(sdev->srq))
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index 2d787796bf50..7faf4a7fcaa9 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -380,8 +380,7 @@ config INPUT_TWL4030_VIBRA
 
 config INPUT_TWL6040_VIBRA
         tristate "Support for TWL6040 Vibrator"
-        depends on TWL4030_CORE
-        select TWL6040_CORE
+        depends on TWL6040_CORE
         select INPUT_FF_MEMLESS
         help
           This option enables support for TWL6040 Vibrator Driver.
diff --git a/drivers/input/misc/da9052_onkey.c b/drivers/input/misc/da9052_onkey.c
index 34aebb8cd080..3c843cd725fa 100644
--- a/drivers/input/misc/da9052_onkey.c
+++ b/drivers/input/misc/da9052_onkey.c
@@ -95,7 +95,8 @@ static int __devinit da9052_onkey_probe(struct platform_device *pdev)
         input_dev = input_allocate_device();
         if (!onkey || !input_dev) {
                 dev_err(&pdev->dev, "Failed to allocate memory\n");
-                return -ENOMEM;
+                error = -ENOMEM;
+                goto err_free_mem;
         }
 
         onkey->input = input_dev;
diff --git a/drivers/input/misc/twl6040-vibra.c b/drivers/input/misc/twl6040-vibra.c
index 45874fed523a..14e94f56cb7d 100644
--- a/drivers/input/misc/twl6040-vibra.c
+++ b/drivers/input/misc/twl6040-vibra.c
@@ -28,7 +28,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/workqueue.h>
-#include <linux/i2c/twl.h>
+#include <linux/input.h>
 #include <linux/mfd/twl6040.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
@@ -257,7 +257,7 @@ static SIMPLE_DEV_PM_OPS(twl6040_vibra_pm_ops, twl6040_vibra_suspend, NULL);
 
 static int __devinit twl6040_vibra_probe(struct platform_device *pdev)
 {
-        struct twl4030_vibra_data *pdata = pdev->dev.platform_data;
+        struct twl6040_vibra_data *pdata = pdev->dev.platform_data;
         struct vibra_info *info;
         int ret;
 
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index d2c0db159b18..479011004a11 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -486,7 +486,6 @@ static void elantech_input_sync_v4(struct psmouse *psmouse)
         unsigned char *packet = psmouse->packet;
 
         input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
-        input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
         input_mt_report_pointer_emulation(dev, true);
         input_sync(dev);
 }
@@ -967,6 +966,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
         if (elantech_set_range(psmouse, &x_min, &y_min, &x_max, &y_max, &width))
                 return -1;
 
+        __set_bit(INPUT_PROP_POINTER, dev->propbit);
         __set_bit(EV_KEY, dev->evbit);
         __set_bit(EV_ABS, dev->evbit);
         __clear_bit(EV_REL, dev->evbit);
@@ -1017,7 +1017,9 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                          */
                         psmouse_warn(psmouse, "couldn't query resolution data.\n");
                 }
-
+                /* v4 is clickpad, with only one button. */
+                __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
+                __clear_bit(BTN_RIGHT, dev->keybit);
                 __set_bit(BTN_TOOL_QUADTAP, dev->keybit);
                 /* For X to recognize me as touchpad. */
                 input_set_abs_params(dev, ABS_X, x_min, x_max, 0, 0);
@@ -1245,6 +1247,8 @@ static void elantech_disconnect(struct psmouse *psmouse)
  */
 static int elantech_reconnect(struct psmouse *psmouse)
 {
+        psmouse_reset(psmouse);
+
         if (elantech_detect(psmouse, 0))
                 return -1;
 
@@ -1324,6 +1328,8 @@ int elantech_init(struct psmouse *psmouse)
         if (!etd)
                 return -ENOMEM;
 
+        psmouse_reset(psmouse);
+
         etd->parity[0] = 1;
         for (i = 1; i < 256; i++)
                 etd->parity[i] = etd->parity[i & (i - 1)] ^ 1;
diff --git a/drivers/input/mouse/gpio_mouse.c b/drivers/input/mouse/gpio_mouse.c
index a9ad8e1402be..39fe9b737cae 100644
--- a/drivers/input/mouse/gpio_mouse.c
+++ b/drivers/input/mouse/gpio_mouse.c
@@ -12,9 +12,9 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/input-polldev.h>
+#include <linux/gpio.h>
 #include <linux/gpio_mouse.h>
 
-#include <asm/gpio.h>
 
 /*
  * Timer function which is run every scan_ms ms when the device is opened.
diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index a977bfaa6821..661a0ca3b3d6 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -741,6 +741,14 @@ static psmouse_ret_t fsp_process_byte(struct psmouse *psmouse)
                         }
                 } else {
                         /* SFAC packet */
+                        if ((packet[0] & (FSP_PB0_LBTN|FSP_PB0_PHY_BTN)) ==
+                                FSP_PB0_LBTN) {
+                                /* On-pad click in SFAC mode should be handled
+                                 * by userspace.  On-pad clicks in MFMC mode
+                                 * are real clickpad clicks, and not ignored.
+                                 */
+                                packet[0] &= ~FSP_PB0_LBTN;
+                        }
 
                         /* no multi-finger information */
                         ad->last_mt_fgr = 0;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 8081a0a5d602..a4b14a41cbf4 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -274,7 +274,8 @@ static int synaptics_set_advanced_gesture_mode(struct psmouse *psmouse)
         static unsigned char param = 0xc8;
         struct synaptics_data *priv = psmouse->private;
 
-        if (!SYN_CAP_ADV_GESTURE(priv->ext_cap_0c))
+        if (!(SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
+              SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)))
                 return 0;
 
         if (psmouse_sliced_command(psmouse, SYN_QUE_MODEL))
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 22b218018137..f3102494237d 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -304,7 +304,7 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
                 return 0;
 
         if (trackpoint_read(&psmouse->ps2dev, TP_EXT_BTN, &button_info)) {
-                printk(KERN_WARNING "trackpoint.c: failed to get extended button data\n");
+                psmouse_warn(psmouse, "failed to get extended button data\n");
                 button_info = 0;
         }
 
@@ -326,16 +326,18 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
 
         error = sysfs_create_group(&ps2dev->serio->dev.kobj, &trackpoint_attr_group);
         if (error) {
-                printk(KERN_ERR
-                        "trackpoint.c: failed to create sysfs attributes, error: %d\n",
-                        error);
+                psmouse_err(psmouse,
+                            "failed to create sysfs attributes, error: %d\n",
+                            error);
                 kfree(psmouse->private);
                 psmouse->private = NULL;
                 return -1;
         }
 
-        printk(KERN_INFO "IBM TrackPoint firmware: 0x%02x, buttons: %d/%d\n",
-                firmware_id, (button_info & 0xf0) >> 4, button_info & 0x0f);
+        psmouse_info(psmouse,
+                     "IBM TrackPoint firmware: 0x%02x, buttons: %d/%d\n",
+                     firmware_id,
+                     (button_info & 0xf0) >> 4, button_info & 0x0f);
 
         return 0;
 }
diff --git a/drivers/input/touchscreen/tps6507x-ts.c b/drivers/input/touchscreen/tps6507x-ts.c
index 6c6f6d8ea9b4..f7eda3d00fad 100644
--- a/drivers/input/touchscreen/tps6507x-ts.c
+++ b/drivers/input/touchscreen/tps6507x-ts.c
@@ -1,6 +1,4 @@
 /*
- * drivers/input/touchscreen/tps6507x_ts.c
- *
  * Touchscreen driver for the tps6507x chip.
  *
  * Copyright (c) 2009 RidgeRun (todd.fischer@ridgerun.com)
@@ -376,4 +374,4 @@ module_platform_driver(tps6507x_ts_driver);
 MODULE_AUTHOR("Todd Fischer <todd.fischer@ridgerun.com>");
 MODULE_DESCRIPTION("TPS6507x - TouchScreen driver");
 MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:tps6507x-tsc");
+MODULE_ALIAS("platform:tps6507x-ts");
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index b3d6ac17272d..a6d9fd2858f7 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -176,7 +176,7 @@ static void if_close(struct tty_struct *tty, struct file *filp)
         struct cardstate *cs = tty->driver_data;
 
         if (!cs) { /* happens if we didn't find cs in open */
-                printk(KERN_DEBUG "%s: no cardstate\n", __func__);
+                gig_dbg(DEBUG_IF, "%s: no cardstate", __func__);
                 return;
         }
 
diff --git a/drivers/leds/leds-atmel-pwm.c b/drivers/leds/leds-atmel-pwm.c
index 800243b6037e..64ad702a2ecc 100644
--- a/drivers/leds/leds-atmel-pwm.c
+++ b/drivers/leds/leds-atmel-pwm.c
@@ -35,7 +35,7 @@ static void pwmled_brightness(struct led_classdev *cdev, enum led_brightness b)
  * NOTE:  we reuse the platform_data structure of GPIO leds,
  * but repurpose its "gpio" number as a PWM channel number.
  */
-static int __init pwmled_probe(struct platform_device *pdev)
+static int __devinit pwmled_probe(struct platform_device *pdev)
 {
         const struct gpio_led_platform_data     *pdata;
         struct pwmled                           *leds;
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 3d0dfa7a89a2..17e2b472e16d 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -539,9 +539,6 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
         bitmap->events_cleared = bitmap->mddev->events;
         sb->events_cleared = cpu_to_le64(bitmap->mddev->events);
 
-        bitmap->flags |= BITMAP_HOSTENDIAN;
-        sb->version = cpu_to_le32(BITMAP_MAJOR_HOSTENDIAN);
-
         kunmap_atomic(sb);
 
         return 0;
@@ -1730,8 +1727,7 @@ int bitmap_create(struct mddev *mddev)
         bitmap->chunkshift = (ffz(~mddev->bitmap_info.chunksize)
                               - BITMAP_BLOCK_SHIFT);
 
-        /* now that chunksize and chunkshift are set, we can use these macros */
-        chunks = (blocks + bitmap->chunkshift - 1) >>
+        chunks = (blocks + (1 << bitmap->chunkshift) - 1) >>
                         bitmap->chunkshift;
         pages = (chunks + PAGE_COUNTER_RATIO - 1) / PAGE_COUNTER_RATIO;
 
@@ -1788,7 +1784,9 @@ int bitmap_load(struct mddev *mddev)
                  * re-add of a missing device */
                 start = mddev->recovery_cp;
 
+        mutex_lock(&mddev->bitmap_info.mutex);
         err = bitmap_init_from_disk(bitmap, start);
+        mutex_unlock(&mddev->bitmap_info.mutex);
 
         if (err)
                 goto out;
diff --git a/drivers/md/bitmap.h b/drivers/md/bitmap.h
index 55ca5aec84e4..b44b0aba2d47 100644
--- a/drivers/md/bitmap.h
+++ b/drivers/md/bitmap.h
@@ -101,9 +101,6 @@ typedef __u16 bitmap_counter_t;
 
 #define BITMAP_BLOCK_SHIFT 9
 
-/* how many blocks per chunk? (this is variable) */
-#define CHUNK_BLOCK_RATIO(bitmap) ((bitmap)->mddev->bitmap_info.chunksize >> BITMAP_BLOCK_SHIFT)
-
 #endif
 
 /*
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index b0ba52459ed7..68965e663248 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -859,7 +859,7 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
         int ret;
         unsigned redundancy = 0;
         struct raid_dev *dev;
-        struct md_rdev *rdev, *freshest;
+        struct md_rdev *rdev, *tmp, *freshest;
         struct mddev *mddev = &rs->md;
 
         switch (rs->raid_type->level) {
@@ -877,7 +877,7 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
         }
 
         freshest = NULL;
-        rdev_for_each(rdev, mddev) {
+        rdev_for_each_safe(rdev, tmp, mddev) {
                 if (!rdev->meta_bdev)
                         continue;
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index b572e1e386ce..477eb2e180c0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7560,14 +7560,14 @@ void md_check_recovery(struct mddev *mddev)
                  * any transients in the value of "sync_action".
                  */
                 set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
-                clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                 /* Clear some bits that don't mean anything, but
                  * might be left set
                  */
                 clear_bit(MD_RECOVERY_INTR, &mddev->recovery);
                 clear_bit(MD_RECOVERY_DONE, &mddev->recovery);
 
-                if (test_bit(MD_RECOVERY_FROZEN, &mddev->recovery))
+                if (!test_and_clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery) ||
+                    test_bit(MD_RECOVERY_FROZEN, &mddev->recovery))
                         goto unlock;
                 /* no recovery is running.
                  * remove any failed drives, then
@@ -8140,7 +8140,8 @@ static int md_notify_reboot(struct notifier_block *this,
 
         for_each_mddev(mddev, tmp) {
                 if (mddev_trylock(mddev)) {
-                        __md_stop_writes(mddev);
+                        if (mddev->pers)
+                                __md_stop_writes(mddev);
                         mddev->safemode = 2;
                         mddev_unlock(mddev);
                 }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d35e4c991e38..15dd59b84e94 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1712,6 +1712,7 @@ static int process_checks(struct r1bio *r1_bio)
         struct r1conf *conf = mddev->private;
         int primary;
         int i;
+        int vcnt;
 
         for (primary = 0; primary < conf->raid_disks * 2; primary++)
                 if (r1_bio->bios[primary]->bi_end_io == end_sync_read &&
@@ -1721,9 +1722,9 @@ static int process_checks(struct r1bio *r1_bio)
                         break;
                 }
         r1_bio->read_disk = primary;
+        vcnt = (r1_bio->sectors + PAGE_SIZE / 512 - 1) >> (PAGE_SHIFT - 9);
         for (i = 0; i < conf->raid_disks * 2; i++) {
                 int j;
-                int vcnt = r1_bio->sectors >> (PAGE_SHIFT- 9);
                 struct bio *pbio = r1_bio->bios[primary];
                 struct bio *sbio = r1_bio->bios[i];
                 int size;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index fff782189e48..c8dbb84d5357 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1788,6 +1788,7 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
         struct r10conf *conf = mddev->private;
         int i, first;
         struct bio *tbio, *fbio;
+        int vcnt;
 
         atomic_set(&r10_bio->remaining, 1);
 
@@ -1802,10 +1803,10 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
         first = i;
         fbio = r10_bio->devs[i].bio;
 
+        vcnt = (r10_bio->sectors + (PAGE_SIZE >> 9) - 1) >> (PAGE_SHIFT - 9);
         /* now find blocks with errors */
         for (i=0 ; i < conf->copies ; i++) {
                 int  j, d;
-                int vcnt = r10_bio->sectors >> (PAGE_SHIFT-9);
 
                 tbio = r10_bio->devs[i].bio;
 
@@ -1871,7 +1872,6 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
          */
         for (i = 0; i < conf->copies; i++) {
                 int j, d;
-                int vcnt = r10_bio->sectors >> (PAGE_SHIFT-9);
 
                 tbio = r10_bio->devs[i].repl_bio;
                 if (!tbio || !tbio->bi_end_io)
diff --git a/drivers/media/common/tuners/xc5000.c b/drivers/media/common/tuners/xc5000.c
index 7f98984e4fad..eab2ea424200 100644
--- a/drivers/media/common/tuners/xc5000.c
+++ b/drivers/media/common/tuners/xc5000.c
@@ -54,6 +54,7 @@ struct xc5000_priv {
         struct list_head hybrid_tuner_instance_list;
 
         u32 if_khz;
+        u32 xtal_khz;
         u32 freq_hz;
         u32 bandwidth;
         u8  video_standard;
@@ -214,9 +215,9 @@ static const struct xc5000_fw_cfg xc5000a_1_6_114 = {
         .size = 12401,
 };
 
-static const struct xc5000_fw_cfg xc5000c_41_024_5_31875 = {
-        .name = "dvb-fe-xc5000c-41.024.5-31875.fw",
-        .size = 16503,
+static const struct xc5000_fw_cfg xc5000c_41_024_5 = {
+        .name = "dvb-fe-xc5000c-41.024.5.fw",
+        .size = 16497,
 };
 
 static inline const struct xc5000_fw_cfg *xc5000_assign_firmware(int chip_id)
@@ -226,7 +227,7 @@ static inline const struct xc5000_fw_cfg *xc5000_assign_firmware(int chip_id)
         case XC5000A:
                 return &xc5000a_1_6_114;
         case XC5000C:
-                return &xc5000c_41_024_5_31875;
+                return &xc5000c_41_024_5;
         }
 }
 
@@ -572,6 +573,31 @@ static int xc_tune_channel(struct xc5000_priv *priv, u32 freq_hz, int mode)
         return found;
 }
 
+static int xc_set_xtal(struct dvb_frontend *fe)
+{
+        struct xc5000_priv *priv = fe->tuner_priv;
+        int ret = XC_RESULT_SUCCESS;
+
+        switch (priv->chip_id) {
+        default:
+        case XC5000A:
+                /* 32.000 MHz xtal is default */
+                break;
+        case XC5000C:
+                switch (priv->xtal_khz) {
+                default:
+                case 32000:
+                        /* 32.000 MHz xtal is default */
+                        break;
+                case 31875:
+                        /* 31.875 MHz xtal configuration */
+                        ret = xc_write_reg(priv, 0x000f, 0x8081);
+                        break;
+                }
+                break;
+        }
+        return ret;
+}
 
 static int xc5000_fwupload(struct dvb_frontend *fe)
 {
@@ -603,6 +629,8 @@ static int xc5000_fwupload(struct dvb_frontend *fe)
         } else {
                 printk(KERN_INFO "xc5000: firmware uploading...\n");
                 ret = xc_load_i2c_sequence(fe,  fw->data);
+                if (XC_RESULT_SUCCESS == ret)
+                        ret = xc_set_xtal(fe);
                 printk(KERN_INFO "xc5000: firmware upload complete...\n");
         }
 
@@ -1164,6 +1192,9 @@ struct dvb_frontend *xc5000_attach(struct dvb_frontend *fe,
                 priv->if_khz = cfg->if_khz;
         }
 
+        if (priv->xtal_khz == 0)
+                priv->xtal_khz = cfg->xtal_khz;
+
         if (priv->radio_input == 0)
                 priv->radio_input = cfg->radio_input;
 
diff --git a/drivers/media/common/tuners/xc5000.h b/drivers/media/common/tuners/xc5000.h
index 3396f8e02b40..39a73bf01406 100644
--- a/drivers/media/common/tuners/xc5000.h
+++ b/drivers/media/common/tuners/xc5000.h
@@ -34,6 +34,7 @@ struct xc5000_config {
         u8   i2c_address;
         u32  if_khz;
         u8   radio_input;
+        u32  xtal_khz;
 
         int chip_id;
 };
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 4555baa383b2..0f64d7182657 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -143,10 +143,12 @@ struct dvb_frontend_private {
 static void dvb_frontend_wakeup(struct dvb_frontend *fe);
 static int dtv_get_frontend(struct dvb_frontend *fe,
                             struct dvb_frontend_parameters *p_out);
+static int dtv_property_legacy_params_sync(struct dvb_frontend *fe,
+                                           struct dvb_frontend_parameters *p);
 
 static bool has_get_frontend(struct dvb_frontend *fe)
 {
-        return fe->ops.get_frontend;
+        return fe->ops.get_frontend != NULL;
 }
 
 /*
@@ -697,6 +699,7 @@ restart:
                                         fepriv->algo_status |= DVBFE_ALGO_SEARCH_AGAIN;
                                         fepriv->delay = HZ / 2;
                                 }
+                                dtv_property_legacy_params_sync(fe, &fepriv->parameters_out);
                                 fe->ops.read_status(fe, &s);
                                 if (s != fepriv->status) {
                                         dvb_frontend_add_event(fe, s); /* update event list */
@@ -1443,6 +1446,28 @@ static int set_delivery_system(struct dvb_frontend *fe, u32 desired_system)
                                 __func__);
                         return -EINVAL;
                 }
+                /*
+                 * Get a delivery system that is compatible with DVBv3
+                 * NOTE: in order for this to work with softwares like Kaffeine that
+                 *      uses a DVBv5 call for DVB-S2 and a DVBv3 call to go back to
+                 *      DVB-S, drivers that support both should put the SYS_DVBS entry
+                 *      before the SYS_DVBS2, otherwise it won't switch back to DVB-S.
+                 *      The real fix is that userspace applications should not use DVBv3
+                 *      and not trust on calling FE_SET_FRONTEND to switch the delivery
+                 *      system.
+                 */
+                ncaps = 0;
+                while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {
+                        if (fe->ops.delsys[ncaps] == desired_system) {
+                                delsys = desired_system;
+                                break;
+                        }
+                        ncaps++;
+                }
+                if (delsys == SYS_UNDEFINED) {
+                        dprintk("%s() Couldn't find a delivery system that matches %d\n",
+                                __func__, desired_system);
+                }
         } else {
                 /*
                  * This is a DVBv5 call. So, it likely knows the supported
@@ -1491,9 +1516,10 @@ static int set_delivery_system(struct dvb_frontend *fe, u32 desired_system)
                                 __func__);
                         return -EINVAL;
                 }
-                c->delivery_system = delsys;
         }
 
+        c->delivery_system = delsys;
+
         /*
          * The DVBv3 or DVBv5 call is requesting a different system. So,
          * emulation is needed.
@@ -1833,6 +1859,13 @@ static int dtv_set_frontend(struct dvb_frontend *fe)
                 return -EINVAL;
 
         /*
+         * Initialize output parameters to match the values given by
+         * the user. FE_SET_FRONTEND triggers an initial frontend event
+         * with status = 0, which copies output parameters to userspace.
+         */
+        dtv_property_legacy_params_sync(fe, &fepriv->parameters_out);
+
+        /*
          * Be sure that the bandwidth will be filled for all
          * non-satellite systems, as tuners need to know what
          * low pass/Nyquist half filter should be applied, in
diff --git a/drivers/media/dvb/dvb-usb/it913x.c b/drivers/media/dvb/dvb-usb/it913x.c
index 3b7b102f20ae..482d249ca7f3 100644
--- a/drivers/media/dvb/dvb-usb/it913x.c
+++ b/drivers/media/dvb/dvb-usb/it913x.c
@@ -238,12 +238,27 @@ static int it913x_read_reg(struct usb_device *udev, u32 reg)
 
 static u32 it913x_query(struct usb_device *udev, u8 pro)
 {
-        int ret;
+        int ret, i;
         u8 data[4];
-        ret = it913x_io(udev, READ_LONG, pro, CMD_DEMOD_READ,
-                0x1222, 0, &data[0], 3);
+        u8 ver;
+
+        for (i = 0; i < 5; i++) {
+                ret = it913x_io(udev, READ_LONG, pro, CMD_DEMOD_READ,
+                        0x1222, 0, &data[0], 3);
+                ver = data[0];
+                if (ver > 0 && ver < 3)
+                        break;
+                msleep(100);
+        }
 
-        it913x_config.chip_ver = data[0];
+        if (ver < 1 || ver > 2) {
+                info("Failed to identify chip version applying 1");
+                it913x_config.chip_ver = 0x1;
+                it913x_config.chip_type = 0x9135;
+                return 0;
+        }
+
+        it913x_config.chip_ver = ver;
         it913x_config.chip_type = (u16)(data[2] << 8) + data[1];
 
         info("Chip Version=%02x Chip Type=%04x", it913x_config.chip_ver,
@@ -660,30 +675,41 @@ static int it913x_download_firmware(struct usb_device *udev,
                         if ((packet_size > min_pkt) || (i == fw->size)) {
                                 fw_data = (u8 *)(fw->data + pos);
                                 pos += packet_size;
-                                if (packet_size > 0)
-                                        ret |= it913x_io(udev, WRITE_DATA,
+                                if (packet_size > 0) {
+                                        ret = it913x_io(udev, WRITE_DATA,
                                                 DEV_0, CMD_SCATTER_WRITE, 0,
                                                 0, fw_data, packet_size);
+                                        if (ret < 0)
+                                                break;
+                                }
                                 udelay(1000);
                         }
                 }
                 i++;
         }
 
-        ret |= it913x_io(udev, WRITE_CMD, DEV_0, CMD_BOOT, 0, 0, NULL, 0);
-
-        msleep(100);
-
         if (ret < 0)
-                info("FRM Firmware Download Failed (%04x)" , ret);
+                info("FRM Firmware Download Failed (%d)" , ret);
         else
                 info("FRM Firmware Download Completed - Resetting Device");
 
-        ret |= it913x_return_status(udev);
+        msleep(30);
+
+        ret = it913x_io(udev, WRITE_CMD, DEV_0, CMD_BOOT, 0, 0, NULL, 0);
+        if (ret < 0)
+                info("FRM Device not responding to reboot");
+
+        ret = it913x_return_status(udev);
+        if (ret == 0) {
+                info("FRM Failed to reboot device");
+                return -ENODEV;
+        }
 
         msleep(30);
 
-        ret |= it913x_wr_reg(udev, DEV_0,  I2C_CLK, I2C_CLK_400);
+        ret = it913x_wr_reg(udev, DEV_0,  I2C_CLK, I2C_CLK_400);
+
+        msleep(30);
 
         /* Tuner function */
         if (it913x_config.dual_mode)
@@ -901,5 +927,5 @@ module_usb_driver(it913x_driver);
 
 MODULE_AUTHOR("Malcolm Priestley <tvboxspy@gmail.com>");
 MODULE_DESCRIPTION("it913x USB 2 Driver");
-MODULE_VERSION("1.27");
+MODULE_VERSION("1.28");
 MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/frontends/drxk_hard.c b/drivers/media/dvb/frontends/drxk_hard.c
index 36d11756492f..a414b1f2b6a5 100644
--- a/drivers/media/dvb/frontends/drxk_hard.c
+++ b/drivers/media/dvb/frontends/drxk_hard.c
@@ -1520,8 +1520,10 @@ static int scu_command(struct drxk_state *state,
         dprintk(1, "\n");
 
         if ((cmd == 0) || ((parameterLen > 0) && (parameter == NULL)) ||
-            ((resultLen > 0) && (result == NULL)))
-                goto error;
+            ((resultLen > 0) && (result == NULL))) {
+                printk(KERN_ERR "drxk: Error %d on %s\n", status, __func__);
+                return status;
+        }
 
         mutex_lock(&state->mutex);
 
diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
index b09c5fae489b..af526586fa26 100644
--- a/drivers/media/rc/winbond-cir.c
+++ b/drivers/media/rc/winbond-cir.c
@@ -1046,6 +1046,7 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
                 goto exit_unregister_led;
         }
 
+        data->dev->driver_type = RC_DRIVER_IR_RAW;
         data->dev->driver_name = WBCIR_NAME;
         data->dev->input_name = WBCIR_NAME;
         data->dev->input_phys = "wbcir/cir0";
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index f2479c5c0eb2..ce1e7ba940f6 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -492,7 +492,7 @@ config VIDEO_VS6624
 
 config VIDEO_MT9M032
         tristate "MT9M032 camera sensor support"
-        depends on I2C && VIDEO_V4L2
+        depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
         select VIDEO_APTINA_PLL
         ---help---
           This driver supports MT9M032 camera sensors from Aptina, monochrome
diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
index 5452beef8e11..989e556913ed 100644
--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -1763,13 +1763,13 @@ static int ivtv_decoder_ioctls(struct file *filp, unsigned int cmd, void *arg)
                 IVTV_DEBUG_IOCTL("AUDIO_CHANNEL_SELECT\n");
                 if (iarg > AUDIO_STEREO_SWAPPED)
                         return -EINVAL;
-                return v4l2_ctrl_s_ctrl(itv->ctrl_audio_playback, iarg);
+                return v4l2_ctrl_s_ctrl(itv->ctrl_audio_playback, iarg + 1);
 
         case AUDIO_BILINGUAL_CHANNEL_SELECT:
                 IVTV_DEBUG_IOCTL("AUDIO_BILINGUAL_CHANNEL_SELECT\n");
                 if (iarg > AUDIO_STEREO_SWAPPED)
                         return -EINVAL;
-                return v4l2_ctrl_s_ctrl(itv->ctrl_audio_multilingual_playback, iarg);
+                return v4l2_ctrl_s_ctrl(itv->ctrl_audio_multilingual_playback, iarg + 1);
 
         default:
                 return -EINVAL;
diff --git a/drivers/media/video/mt9m032.c b/drivers/media/video/mt9m032.c
index 7636672c3548..645973c5feb0 100644
--- a/drivers/media/video/mt9m032.c
+++ b/drivers/media/video/mt9m032.c
@@ -392,10 +392,11 @@ static int mt9m032_set_pad_format(struct v4l2_subdev *subdev,
         }
 
         /* Scaling is not supported, the format is thus fixed. */
-        ret = mt9m032_get_pad_format(subdev, fh, fmt);
+        fmt->format = *__mt9m032_get_pad_format(sensor, fh, fmt->which);
+        ret = 0;
 
 done:
-        mutex_lock(&sensor->lock);
+        mutex_unlock(&sensor->lock);
         return ret;
 }
 
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index 4a44f9a1bae0..b76b0ac0958f 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -468,22 +468,30 @@ uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
         spin_unlock_irqrestore(&stream->clock.lock, flags);
 }
 
-static int uvc_video_clock_init(struct uvc_streaming *stream)
+static void uvc_video_clock_reset(struct uvc_streaming *stream)
 {
         struct uvc_clock *clock = &stream->clock;
 
-        spin_lock_init(&clock->lock);
         clock->head = 0;
         clock->count = 0;
-        clock->size = 32;
         clock->last_sof = -1;
         clock->sof_offset = -1;
+}
+
+static int uvc_video_clock_init(struct uvc_streaming *stream)
+{
+        struct uvc_clock *clock = &stream->clock;
+
+        spin_lock_init(&clock->lock);
+        clock->size = 32;
 
         clock->samples = kmalloc(clock->size * sizeof(*clock->samples),
                                  GFP_KERNEL);
         if (clock->samples == NULL)
                 return -ENOMEM;
 
+        uvc_video_clock_reset(stream);
+
         return 0;
 }
 
@@ -1424,8 +1432,6 @@ static void uvc_uninit_video(struct uvc_streaming *stream, int free_buffers)
 
         if (free_buffers)
                 uvc_free_urb_buffers(stream);
-
-        uvc_video_clock_cleanup(stream);
 }
 
 /*
@@ -1555,10 +1561,6 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
 
         uvc_video_stats_start(stream);
 
-        ret = uvc_video_clock_init(stream);
-        if (ret < 0)
-                return ret;
-
         if (intf->num_altsetting > 1) {
                 struct usb_host_endpoint *best_ep = NULL;
                 unsigned int best_psize = 3 * 1024;
@@ -1683,6 +1685,8 @@ int uvc_video_resume(struct uvc_streaming *stream, int reset)
 
         stream->frozen = 0;
 
+        uvc_video_clock_reset(stream);
+
         ret = uvc_commit_video(stream, &stream->ctrl);
         if (ret < 0) {
                 uvc_queue_enable(&stream->queue, 0);
@@ -1819,25 +1823,35 @@ int uvc_video_enable(struct uvc_streaming *stream, int enable)
                 uvc_uninit_video(stream, 1);
                 usb_set_interface(stream->dev->udev, stream->intfnum, 0);
                 uvc_queue_enable(&stream->queue, 0);
+                uvc_video_clock_cleanup(stream);
                 return 0;
         }
 
-        ret = uvc_queue_enable(&stream->queue, 1);
+        ret = uvc_video_clock_init(stream);
         if (ret < 0)
                 return ret;
 
+        ret = uvc_queue_enable(&stream->queue, 1);
+        if (ret < 0)
+                goto error_queue;
+
         /* Commit the streaming parameters. */
         ret = uvc_commit_video(stream, &stream->ctrl);
-        if (ret < 0) {
-                uvc_queue_enable(&stream->queue, 0);
-                return ret;
-        }
+        if (ret < 0)
+                goto error_commit;
 
         ret = uvc_init_video(stream, GFP_KERNEL);
-        if (ret < 0) {
-                usb_set_interface(stream->dev->udev, stream->intfnum, 0);
-                uvc_queue_enable(&stream->queue, 0);
-        }
+        if (ret < 0)
+                goto error_video;
+
+        return 0;
+
+error_video:
+        usb_set_interface(stream->dev->udev, stream->intfnum, 0);
+error_commit:
+        uvc_queue_enable(&stream->queue, 0);
+error_queue:
+        uvc_video_clock_cleanup(stream);
 
         return ret;
 }
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 29f463cc09cb..11e44386fa9b 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -268,10 +268,17 @@ config TWL6030_PWM
           This is used to control charging LED brightness.
 
 config TWL6040_CORE
-        bool
-        depends on TWL4030_CORE && GENERIC_HARDIRQS
+        bool "Support for TWL6040 audio codec"
+        depends on I2C=y && GENERIC_HARDIRQS
         select MFD_CORE
+        select REGMAP_I2C
         default n
+        help
+          Say yes here if you want support for Texas Instruments TWL6040 audio
+          codec.
+          This driver provides common support for accessing the device,
+          additional drivers must be enabled in order to use the
+          functionality of the device (audio, vibra).
 
 config MFD_STMPE
         bool "Support STMicroelectronics STMPE"
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index 1895cf9fab8c..1582c3d95257 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -527,7 +527,9 @@ static void asic3_gpio_set(struct gpio_chip *chip,
 
 static int asic3_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
 {
-        return (offset < ASIC3_NUM_GPIOS) ? IRQ_BOARD_START + offset : -ENXIO;
+        struct asic3 *asic = container_of(chip, struct asic3, gpio);
+
+        return (offset < ASIC3_NUM_GPIOS) ? asic->irq_base + offset : -ENXIO;
 }
 
 static __init int asic3_gpio_probe(struct platform_device *pdev,
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index ebc1e8658226..5be32489714f 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2788,6 +2788,7 @@ static struct regulator_init_data db8500_regulators[DB8500_NUM_REGULATORS] = {
                 .constraints = {
                         .name = "db8500-vape",
                         .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+                        .always_on = true,
                 },
                 .consumer_supplies = db8500_vape_consumers,
                 .num_consumer_supplies = ARRAY_SIZE(db8500_vape_consumers),
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index 95a2e546a489..7e96bb229724 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -25,7 +25,7 @@
 #include <linux/clk.h>
 #include <linux/dma-mapping.h>
 #include <linux/spinlock.h>
-#include <linux/gpio.h>
+#include <plat/cpu.h>
 #include <plat/usb.h>
 #include <linux/pm_runtime.h>
 
@@ -502,19 +502,6 @@ static void omap_usbhs_init(struct device *dev)
         pm_runtime_get_sync(dev);
         spin_lock_irqsave(&omap->lock, flags);
 
-        if (pdata->ehci_data->phy_reset) {
-                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[0]))
-                        gpio_request_one(pdata->ehci_data->reset_gpio_port[0],
-                                         GPIOF_OUT_INIT_LOW, "USB1 PHY reset");
-
-                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1]))
-                        gpio_request_one(pdata->ehci_data->reset_gpio_port[1],
-                                         GPIOF_OUT_INIT_LOW, "USB2 PHY reset");
-
-                /* Hold the PHY in RESET for enough time till DIR is high */
-                udelay(10);
-        }
-
         omap->usbhs_rev = usbhs_read(omap->uhh_base, OMAP_UHH_REVISION);
         dev_dbg(dev, "OMAP UHH_REVISION 0x%x\n", omap->usbhs_rev);
 
@@ -593,39 +580,10 @@ static void omap_usbhs_init(struct device *dev)
                         usbhs_omap_tll_init(dev, OMAP_TLL_CHANNEL_COUNT);
         }
 
-        if (pdata->ehci_data->phy_reset) {
-                /* Hold the PHY in RESET for enough time till
-                 * PHY is settled and ready
-                 */
-                udelay(10);
-
-                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[0]))
-                        gpio_set_value
-                                (pdata->ehci_data->reset_gpio_port[0], 1);
-
-                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1]))
-                        gpio_set_value
-                                (pdata->ehci_data->reset_gpio_port[1], 1);
-        }
-
         spin_unlock_irqrestore(&omap->lock, flags);
         pm_runtime_put_sync(dev);
 }
 
-static void omap_usbhs_deinit(struct device *dev)
-{
-        struct usbhs_hcd_omap           *omap = dev_get_drvdata(dev);
-        struct usbhs_omap_platform_data *pdata = &omap->platdata;
-
-        if (pdata->ehci_data->phy_reset) {
-                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[0]))
-                        gpio_free(pdata->ehci_data->reset_gpio_port[0]);
-
-                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1]))
-                        gpio_free(pdata->ehci_data->reset_gpio_port[1]);
-        }
-}
-
 
 /**
  * usbhs_omap_probe - initialize TI-based HCDs
@@ -860,7 +818,6 @@ static int __devexit usbhs_omap_remove(struct platform_device *pdev)
 {
         struct usbhs_hcd_omap *omap = platform_get_drvdata(pdev);
 
-        omap_usbhs_deinit(&pdev->dev);
         iounmap(omap->tll_base);
         iounmap(omap->uhh_base);
         clk_put(omap->init_60m_fclk);
diff --git a/drivers/mfd/rc5t583.c b/drivers/mfd/rc5t583.c
index 99ef944c621d..44afae0a69ce 100644
--- a/drivers/mfd/rc5t583.c
+++ b/drivers/mfd/rc5t583.c
@@ -80,44 +80,6 @@ static struct mfd_cell rc5t583_subdevs[] = {
         {.name = "rc5t583-key",      }
 };
 
-int rc5t583_write(struct device *dev, uint8_t reg, uint8_t val)
-{
-        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
-        return regmap_write(rc5t583->regmap, reg, val);
-}
-
-int rc5t583_read(struct device *dev, uint8_t reg, uint8_t *val)
-{
-        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
-        unsigned int ival;
-        int ret;
-        ret = regmap_read(rc5t583->regmap, reg, &ival);
-        if (!ret)
-                *val = (uint8_t)ival;
-        return ret;
-}
-
-int rc5t583_set_bits(struct device *dev, unsigned int reg,
-                        unsigned int bit_mask)
-{
-        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
-        return regmap_update_bits(rc5t583->regmap, reg, bit_mask, bit_mask);
-}
-
-int rc5t583_clear_bits(struct device *dev, unsigned int reg,
-                        unsigned int bit_mask)
-{
-        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
-        return regmap_update_bits(rc5t583->regmap, reg, bit_mask, 0);
-}
-
-int rc5t583_update(struct device *dev, unsigned int reg,
-                unsigned int val, unsigned int mask)
-{
-        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
-        return regmap_update_bits(rc5t583->regmap, reg, mask, val);
-}
-
 static int __rc5t583_set_ext_pwrreq1_control(struct device *dev,
         int id, int ext_pwr, int slots)
 {
@@ -197,6 +159,7 @@ int rc5t583_ext_power_req_config(struct device *dev, int ds_id,
                         ds_id, ext_pwr_req);
         return 0;
 }
+EXPORT_SYMBOL(rc5t583_ext_power_req_config);
 
 static int rc5t583_clear_ext_power_req(struct rc5t583 *rc5t583,
         struct rc5t583_platform_data *pdata)
diff --git a/drivers/mfd/twl6040-core.c b/drivers/mfd/twl6040-core.c
index b2d8e512d3cb..2d6bedadca09 100644
--- a/drivers/mfd/twl6040-core.c
+++ b/drivers/mfd/twl6040-core.c
@@ -30,7 +30,9 @@
 #include <linux/platform_device.h>
 #include <linux/gpio.h>
 #include <linux/delay.h>
-#include <linux/i2c/twl.h>
+#include <linux/i2c.h>
+#include <linux/regmap.h>
+#include <linux/err.h>
 #include <linux/mfd/core.h>
 #include <linux/mfd/twl6040.h>
 
@@ -39,7 +41,7 @@
 int twl6040_reg_read(struct twl6040 *twl6040, unsigned int reg)
 {
         int ret;
-        u8 val = 0;
+        unsigned int val;
 
         mutex_lock(&twl6040->io_mutex);
         /* Vibra control registers from cache */
@@ -47,7 +49,7 @@ int twl6040_reg_read(struct twl6040 *twl6040, unsigned int reg)
                      reg == TWL6040_REG_VIBCTLR)) {
                 val = twl6040->vibra_ctrl_cache[VIBRACTRL_MEMBER(reg)];
         } else {
-                ret = twl_i2c_read_u8(TWL_MODULE_AUDIO_VOICE, &val, reg);
+                ret = regmap_read(twl6040->regmap, reg, &val);
                 if (ret < 0) {
                         mutex_unlock(&twl6040->io_mutex);
                         return ret;
@@ -64,7 +66,7 @@ int twl6040_reg_write(struct twl6040 *twl6040, unsigned int reg, u8 val)
         int ret;
 
         mutex_lock(&twl6040->io_mutex);
-        ret = twl_i2c_write_u8(TWL_MODULE_AUDIO_VOICE, val, reg);
+        ret = regmap_write(twl6040->regmap, reg, val);
         /* Cache the vibra control registers */
         if (reg == TWL6040_REG_VIBCTLL || reg == TWL6040_REG_VIBCTLR)
                 twl6040->vibra_ctrl_cache[VIBRACTRL_MEMBER(reg)] = val;
@@ -77,16 +79,9 @@ EXPORT_SYMBOL(twl6040_reg_write);
 int twl6040_set_bits(struct twl6040 *twl6040, unsigned int reg, u8 mask)
 {
         int ret;
-        u8 val;
 
         mutex_lock(&twl6040->io_mutex);
-        ret = twl_i2c_read_u8(TWL_MODULE_AUDIO_VOICE, &val, reg);
-        if (ret)
-                goto out;
-
-        val |= mask;
-        ret = twl_i2c_write_u8(TWL_MODULE_AUDIO_VOICE, val, reg);
-out:
+        ret = regmap_update_bits(twl6040->regmap, reg, mask, mask);
         mutex_unlock(&twl6040->io_mutex);
         return ret;
 }
@@ -95,16 +90,9 @@ EXPORT_SYMBOL(twl6040_set_bits);
 int twl6040_clear_bits(struct twl6040 *twl6040, unsigned int reg, u8 mask)
 {
         int ret;
-        u8 val;
 
         mutex_lock(&twl6040->io_mutex);
-        ret = twl_i2c_read_u8(TWL_MODULE_AUDIO_VOICE, &val, reg);
-        if (ret)
-                goto out;
-
-        val &= ~mask;
-        ret = twl_i2c_write_u8(TWL_MODULE_AUDIO_VOICE, val, reg);
-out:
+        ret = regmap_update_bits(twl6040->regmap, reg, mask, 0);
         mutex_unlock(&twl6040->io_mutex);
         return ret;
 }
@@ -494,32 +482,58 @@ static struct resource twl6040_codec_rsrc[] = {
         },
 };
 
-static int __devinit twl6040_probe(struct platform_device *pdev)
+static bool twl6040_readable_reg(struct device *dev, unsigned int reg)
 {
-        struct twl4030_audio_data *pdata = pdev->dev.platform_data;
+        /* Register 0 is not readable */
+        if (!reg)
+                return false;
+        return true;
+}
+
+static struct regmap_config twl6040_regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 8,
+        .max_register = TWL6040_REG_STATUS, /* 0x2e */
+
+        .readable_reg = twl6040_readable_reg,
+};
+
+static int __devinit twl6040_probe(struct i2c_client *client,
+                                     const struct i2c_device_id *id)
+{
+        struct twl6040_platform_data *pdata = client->dev.platform_data;
         struct twl6040 *twl6040;
         struct mfd_cell *cell = NULL;
         int ret, children = 0;
 
         if (!pdata) {
-                dev_err(&pdev->dev, "Platform data is missing\n");
+                dev_err(&client->dev, "Platform data is missing\n");
                 return -EINVAL;
         }
 
         /* In order to operate correctly we need valid interrupt config */
-        if (!pdata->naudint_irq || !pdata->irq_base) {
-                dev_err(&pdev->dev, "Invalid IRQ configuration\n");
+        if (!client->irq || !pdata->irq_base) {
+                dev_err(&client->dev, "Invalid IRQ configuration\n");
                 return -EINVAL;
         }
 
-        twl6040 = kzalloc(sizeof(struct twl6040), GFP_KERNEL);
-        if (!twl6040)
-                return -ENOMEM;
+        twl6040 = devm_kzalloc(&client->dev, sizeof(struct twl6040),
+                               GFP_KERNEL);
+        if (!twl6040) {
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        twl6040->regmap = regmap_init_i2c(client, &twl6040_regmap_config);
+        if (IS_ERR(twl6040->regmap)) {
+                ret = PTR_ERR(twl6040->regmap);
+                goto err;
+        }
 
-        platform_set_drvdata(pdev, twl6040);
+        i2c_set_clientdata(client, twl6040);
 
-        twl6040->dev = &pdev->dev;
-        twl6040->irq = pdata->naudint_irq;
+        twl6040->dev = &client->dev;
+        twl6040->irq = client->irq;
         twl6040->irq_base = pdata->irq_base;
 
         mutex_init(&twl6040->mutex);
@@ -588,12 +602,12 @@ static int __devinit twl6040_probe(struct platform_device *pdev)
         }
 
         if (children) {
-                ret = mfd_add_devices(&pdev->dev, pdev->id, twl6040->cells,
+                ret = mfd_add_devices(&client->dev, -1, twl6040->cells,
                                       children, NULL, 0);
                 if (ret)
                         goto mfd_err;
         } else {
-                dev_err(&pdev->dev, "No platform data found for children\n");
+                dev_err(&client->dev, "No platform data found for children\n");
                 ret = -ENODEV;
                 goto mfd_err;
         }
@@ -608,14 +622,15 @@ gpio2_err:
         if (gpio_is_valid(twl6040->audpwron))
                 gpio_free(twl6040->audpwron);
 gpio1_err:
-        platform_set_drvdata(pdev, NULL);
-        kfree(twl6040);
+        i2c_set_clientdata(client, NULL);
+        regmap_exit(twl6040->regmap);
+err:
         return ret;
 }
 
-static int __devexit twl6040_remove(struct platform_device *pdev)
+static int __devexit twl6040_remove(struct i2c_client *client)
 {
-        struct twl6040 *twl6040 = platform_get_drvdata(pdev);
+        struct twl6040 *twl6040 = i2c_get_clientdata(client);
 
         if (twl6040->power_count)
                 twl6040_power(twl6040, 0);
@@ -626,23 +641,30 @@ static int __devexit twl6040_remove(struct platform_device *pdev)
         free_irq(twl6040->irq_base + TWL6040_IRQ_READY, twl6040);
         twl6040_irq_exit(twl6040);
 
-        mfd_remove_devices(&pdev->dev);
-        platform_set_drvdata(pdev, NULL);
-        kfree(twl6040);
+        mfd_remove_devices(&client->dev);
+        i2c_set_clientdata(client, NULL);
+        regmap_exit(twl6040->regmap);
 
         return 0;
 }
 
-static struct platform_driver twl6040_driver = {
+static const struct i2c_device_id twl6040_i2c_id[] = {
+        { "twl6040", 0, },
+        { },
+};
+MODULE_DEVICE_TABLE(i2c, twl6040_i2c_id);
+
+static struct i2c_driver twl6040_driver = {
+        .driver = {
+                .name = "twl6040",
+                .owner = THIS_MODULE,
+        },
         .probe          = twl6040_probe,
         .remove         = __devexit_p(twl6040_remove),
-        .driver         = {
-                .owner  = THIS_MODULE,
-                .name   = "twl6040",
-        },
+        .id_table       = twl6040_i2c_id,
 };
 
-module_platform_driver(twl6040_driver);
+module_i2c_driver(twl6040_driver);
 
 MODULE_DESCRIPTION("TWL6040 MFD");
 MODULE_AUTHOR("Misael Lopez Cruz <misael.lopez@ti.com>");
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index b1809650b7aa..dabec556ebb8 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -873,7 +873,7 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
 {
         struct mmc_blk_data *md = mq->data;
         struct mmc_card *card = md->queue.card;
-        unsigned int from, nr, arg;
+        unsigned int from, nr, arg, trim_arg, erase_arg;
         int err = 0, type = MMC_BLK_SECDISCARD;
 
         if (!(mmc_can_secure_erase_trim(card) || mmc_can_sanitize(card))) {
@@ -881,20 +881,26 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
                 goto out;
         }
 
+        from = blk_rq_pos(req);
+        nr = blk_rq_sectors(req);
+
         /* The sanitize operation is supported at v4.5 only */
         if (mmc_can_sanitize(card)) {
-                err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
-                                EXT_CSD_SANITIZE_START, 1, 0);
-                goto out;
+                erase_arg = MMC_ERASE_ARG;
+                trim_arg = MMC_TRIM_ARG;
+        } else {
+                erase_arg = MMC_SECURE_ERASE_ARG;
+                trim_arg = MMC_SECURE_TRIM1_ARG;
         }
 
-        from = blk_rq_pos(req);
-        nr = blk_rq_sectors(req);
-
-        if (mmc_can_trim(card) && !mmc_erase_group_aligned(card, from, nr))
-                arg = MMC_SECURE_TRIM1_ARG;
-        else
-                arg = MMC_SECURE_ERASE_ARG;
+        if (mmc_erase_group_aligned(card, from, nr))
+                arg = erase_arg;
+        else if (mmc_can_trim(card))
+                arg = trim_arg;
+        else {
+                err = -EINVAL;
+                goto out;
+        }
 retry:
         if (card->quirks & MMC_QUIRK_INAND_CMD38) {
                 err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
@@ -904,25 +910,41 @@ retry:
                                  INAND_CMD38_ARG_SECERASE,
                                  0);
                 if (err)
-                        goto out;
+                        goto out_retry;
         }
+
         err = mmc_erase(card, from, nr, arg);
-        if (!err && arg == MMC_SECURE_TRIM1_ARG) {
+        if (err == -EIO)
+                goto out_retry;
+        if (err)
+                goto out;
+
+        if (arg == MMC_SECURE_TRIM1_ARG) {
                 if (card->quirks & MMC_QUIRK_INAND_CMD38) {
                         err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
                                          INAND_CMD38_ARG_EXT_CSD,
                                          INAND_CMD38_ARG_SECTRIM2,
                                          0);
                         if (err)
-                                goto out;
+                                goto out_retry;
                 }
+
                 err = mmc_erase(card, from, nr, MMC_SECURE_TRIM2_ARG);
+                if (err == -EIO)
+                        goto out_retry;
+                if (err)
+                        goto out;
         }
-out:
-        if (err == -EIO && !mmc_blk_reset(md, card->host, type))
+
+        if (mmc_can_sanitize(card))
+                err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+                                 EXT_CSD_SANITIZE_START, 1, 0);
+out_retry:
+        if (err && !mmc_blk_reset(md, card->host, type))
                 goto retry;
         if (!err)
                 mmc_blk_reset_success(md, type);
+out:
         spin_lock_irq(&md->lock);
         __blk_end_request(req, err, blk_rq_bytes(req));
         spin_unlock_irq(&md->lock);
@@ -1802,7 +1824,7 @@ static void mmc_blk_remove(struct mmc_card *card)
 }
 
 #ifdef CONFIG_PM
-static int mmc_blk_suspend(struct mmc_card *card, pm_message_t state)
+static int mmc_blk_suspend(struct mmc_card *card)
 {
         struct mmc_blk_data *part_md;
         struct mmc_blk_data *md = mmc_get_drvdata(card);
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index 2517547b4366..996f8e36e23d 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -139,7 +139,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
 
         queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
         q->limits.max_discard_sectors = max_discard;
-        if (card->erased_byte == 0)
+        if (card->erased_byte == 0 && !mmc_can_discard(card))
                 q->limits.discard_zeroes_data = 1;
         q->limits.discard_granularity = card->pref_erase << 9;
         /* granularity must not be greater than max. discard */
diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
index 3f606068d552..c60cee92a2b2 100644
--- a/drivers/mmc/core/bus.c
+++ b/drivers/mmc/core/bus.c
@@ -122,14 +122,14 @@ static int mmc_bus_remove(struct device *dev)
         return 0;
 }
 
-static int mmc_bus_suspend(struct device *dev, pm_message_t state)
+static int mmc_bus_suspend(struct device *dev)
 {
         struct mmc_driver *drv = to_mmc_driver(dev->driver);
         struct mmc_card *card = mmc_dev_to_card(dev);
         int ret = 0;
 
         if (dev->driver && drv->suspend)
-                ret = drv->suspend(card, state);
+                ret = drv->suspend(card);
         return ret;
 }
 
@@ -165,20 +165,14 @@ static int mmc_runtime_idle(struct device *dev)
         return pm_runtime_suspend(dev);
 }
 
+#endif /* !CONFIG_PM_RUNTIME */
+
 static const struct dev_pm_ops mmc_bus_pm_ops = {
-        .runtime_suspend        = mmc_runtime_suspend,
-        .runtime_resume         = mmc_runtime_resume,
-        .runtime_idle           = mmc_runtime_idle,
+        SET_RUNTIME_PM_OPS(mmc_runtime_suspend, mmc_runtime_resume,
+                        mmc_runtime_idle)
+        SET_SYSTEM_SLEEP_PM_OPS(mmc_bus_suspend, mmc_bus_resume)
 };
 
-#define MMC_PM_OPS_PTR  (&mmc_bus_pm_ops)
-
-#else /* !CONFIG_PM_RUNTIME */
-
-#define MMC_PM_OPS_PTR  NULL
-
-#endif /* !CONFIG_PM_RUNTIME */
-
 static struct bus_type mmc_bus_type = {
         .name           = "mmc",
         .dev_attrs      = mmc_dev_attrs,
@@ -186,9 +180,7 @@ static struct bus_type mmc_bus_type = {
         .uevent         = mmc_bus_uevent,
         .probe          = mmc_bus_probe,
         .remove         = mmc_bus_remove,
-        .suspend        = mmc_bus_suspend,
-        .resume         = mmc_bus_resume,
-        .pm             = MMC_PM_OPS_PTR,
+        .pm             = &mmc_bus_pm_ops,
 };
 
 int mmc_register_bus(void)
diff --git a/drivers/mmc/core/cd-gpio.c b/drivers/mmc/core/cd-gpio.c
index 29de31e260dd..2c14be73254c 100644
--- a/drivers/mmc/core/cd-gpio.c
+++ b/drivers/mmc/core/cd-gpio.c
@@ -12,6 +12,7 @@
 #include <linux/gpio.h>
 #include <linux/interrupt.h>
 #include <linux/jiffies.h>
+#include <linux/mmc/cd-gpio.h>
 #include <linux/mmc/host.h>
 #include <linux/module.h>
 #include <linux/slab.h>
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 7474c47b9c08..ba821fe70bca 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1409,7 +1409,10 @@ static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card,
 {
         unsigned int erase_timeout;
 
-        if (card->ext_csd.erase_group_def & 1) {
+        if (arg == MMC_DISCARD_ARG ||
+            (arg == MMC_TRIM_ARG && card->ext_csd.rev >= 6)) {
+                erase_timeout = card->ext_csd.trim_timeout;
+        } else if (card->ext_csd.erase_group_def & 1) {
                 /* High Capacity Erase Group Size uses HC timeouts */
                 if (arg == MMC_TRIM_ARG)
                         erase_timeout = card->ext_csd.trim_timeout;
@@ -1681,8 +1684,6 @@ int mmc_can_trim(struct mmc_card *card)
 {
         if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_GB_CL_EN)
                 return 1;
-        if (mmc_can_discard(card))
-                return 1;
         return 0;
 }
 EXPORT_SYMBOL(mmc_can_trim);
@@ -1701,6 +1702,8 @@ EXPORT_SYMBOL(mmc_can_discard);
 
 int mmc_can_sanitize(struct mmc_card *card)
 {
+        if (!mmc_can_trim(card) && !mmc_can_erase(card))
+                return 0;
         if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_SANITIZE)
                 return 1;
         return 0;
@@ -2235,6 +2238,7 @@ int mmc_cache_ctrl(struct mmc_host *host, u8 enable)
                         mmc_card_is_removable(host))
                 return err;
 
+        mmc_claim_host(host);
         if (card && mmc_card_mmc(card) &&
                         (card->ext_csd.cache_size > 0)) {
                 enable = !!enable;
@@ -2252,6 +2256,7 @@ int mmc_cache_ctrl(struct mmc_host *host, u8 enable)
                                 card->ext_csd.cache_ctrl = enable;
                 }
         }
+        mmc_release_host(host);
 
         return err;
 }
@@ -2269,49 +2274,32 @@ int mmc_suspend_host(struct mmc_host *host)
 
         cancel_delayed_work(&host->detect);
         mmc_flush_scheduled_work();
-        if (mmc_try_claim_host(host)) {
-                err = mmc_cache_ctrl(host, 0);
-                mmc_release_host(host);
-        } else {
-                err = -EBUSY;
-        }
 
+        err = mmc_cache_ctrl(host, 0);
         if (err)
                 goto out;
 
         mmc_bus_get(host);
         if (host->bus_ops && !host->bus_dead) {
 
-                /*
-                 * A long response time is not acceptable for device drivers
-                 * when doing suspend. Prevent mmc_claim_host in the suspend
-                 * sequence, to potentially wait "forever" by trying to
-                 * pre-claim the host.
-                 */
-                if (mmc_try_claim_host(host)) {
-                        if (host->bus_ops->suspend) {
-                                err = host->bus_ops->suspend(host);
-                        }
-                        mmc_release_host(host);
+                if (host->bus_ops->suspend)
+                        err = host->bus_ops->suspend(host);
 
-                        if (err == -ENOSYS || !host->bus_ops->resume) {
-                                /*
-                                 * We simply "remove" the card in this case.
-                                 * It will be redetected on resume.  (Calling
-                                 * bus_ops->remove() with a claimed host can
-                                 * deadlock.)
-                                 */
-                                if (host->bus_ops->remove)
-                                        host->bus_ops->remove(host);
-                                mmc_claim_host(host);
-                                mmc_detach_bus(host);
-                                mmc_power_off(host);
-                                mmc_release_host(host);
-                                host->pm_flags = 0;
-                                err = 0;
-                        }
-                } else {
-                        err = -EBUSY;
+                if (err == -ENOSYS || !host->bus_ops->resume) {
+                        /*
+                         * We simply "remove" the card in this case.
+                         * It will be redetected on resume.  (Calling
+                         * bus_ops->remove() with a claimed host can
+                         * deadlock.)
+                         */
+                        if (host->bus_ops->remove)
+                                host->bus_ops->remove(host);
+                        mmc_claim_host(host);
+                        mmc_detach_bus(host);
+                        mmc_power_off(host);
+                        mmc_release_host(host);
+                        host->pm_flags = 0;
+                        err = 0;
                 }
         }
         mmc_bus_put(host);
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index bf3c9b456aaf..ab3fc4617107 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -526,8 +526,10 @@ static int dw_mci_submit_data_dma(struct dw_mci *host, struct mmc_data *data)
                 return -ENODEV;
 
         sg_len = dw_mci_pre_dma_transfer(host, data, 0);
-        if (sg_len < 0)
+        if (sg_len < 0) {
+                host->dma_ops->stop(host);
                 return sg_len;
+        }
 
         host->using_dma = 1;
 
@@ -1879,7 +1881,8 @@ static void dw_mci_init_dma(struct dw_mci *host)
         if (!host->dma_ops)
                 goto no_dma;
 
-        if (host->dma_ops->init) {
+        if (host->dma_ops->init && host->dma_ops->start &&
+            host->dma_ops->stop && host->dma_ops->cleanup) {
                 if (host->dma_ops->init(host)) {
                         dev_err(&host->dev, "%s: Unable to initialize "
                                 "DMA Controller.\n", __func__);
diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index b0f2ef988188..e3f5af96ab87 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -363,6 +363,7 @@ static void mxs_mmc_bc(struct mxs_mmc_host *host)
                 goto out;
 
         dmaengine_submit(desc);
+        dma_async_issue_pending(host->dmach);
         return;
 
 out:
@@ -403,6 +404,7 @@ static void mxs_mmc_ac(struct mxs_mmc_host *host)
                 goto out;
 
         dmaengine_submit(desc);
+        dma_async_issue_pending(host->dmach);
         return;
 
 out:
@@ -531,6 +533,7 @@ static void mxs_mmc_adtc(struct mxs_mmc_host *host)
                 goto out;
 
         dmaengine_submit(desc);
+        dma_async_issue_pending(host->dmach);
         return;
 out:
         dev_warn(mmc_dev(host->mmc),
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 5c2b1c10af9c..56d4499d4388 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -249,7 +249,7 @@ static int omap_hsmmc_set_power(struct device *dev, int slot, int power_on,
          * the pbias cell programming support is still missing when
          * booting with Device tree
          */
-        if (of_have_populated_dt() && !vdd)
+        if (dev->of_node && !vdd)
                 return 0;
 
         if (mmc_slot(host).before_set_reg)
@@ -1549,7 +1549,7 @@ static void omap_hsmmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                          * can't be allowed when booting with device
                          * tree.
                          */
-                        (!of_have_populated_dt())) {
+                        !host->dev->of_node) {
                                 /*
                                  * The mmc_select_voltage fn of the core does
                                  * not seem to set the power_mode to
@@ -1741,7 +1741,7 @@ static const struct of_device_id omap_mmc_of_match[] = {
                 .data = &omap4_reg_offset,
         },
         {},
-}
+};
 MODULE_DEVICE_TABLE(of, omap_mmc_of_match);
 
 static struct omap_mmc_platform_data *of_get_hsmmc_pdata(struct device *dev)
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 6193a0d7bde5..8abdaf6697a8 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -467,8 +467,7 @@ static int __devinit sdhci_esdhc_imx_probe(struct platform_device *pdev)
         clk_prepare_enable(clk);
         pltfm_host->clk = clk;
 
-        if (!is_imx25_esdhc(imx_data))
-                host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
+        host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
 
         if (is_imx25_esdhc(imx_data) || is_imx35_esdhc(imx_data))
                 /* Fix errata ENGcm07207 present on i.MX25 and i.MX35 */
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 9aa77f3f04a8..ccefdebeff14 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -147,7 +147,7 @@ static void sdhci_set_card_detection(struct sdhci_host *host, bool enable)
         u32 present, irqs;
 
         if ((host->quirks & SDHCI_QUIRK_BROKEN_CARD_DETECTION) ||
-            !mmc_card_is_removable(host->mmc))
+            (host->mmc->caps & MMC_CAP_NONREMOVABLE))
                 return;
 
         present = sdhci_readl(host, SDHCI_PRESENT_STATE) &
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 94eb05b1afdf..58fc65f5c817 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -106,16 +106,14 @@ static int mtdchar_open(struct inode *inode, struct file *file)
         }
 
         if (mtd->type == MTD_ABSENT) {
-                put_mtd_device(mtd);
                 ret = -ENODEV;
-                goto out;
+                goto out1;
         }
 
         mtd_ino = iget_locked(mnt->mnt_sb, devnum);
         if (!mtd_ino) {
-                put_mtd_device(mtd);
                 ret = -ENOMEM;
-                goto out;
+                goto out1;
         }
         if (mtd_ino->i_state & I_NEW) {
                 mtd_ino->i_private = mtd;
@@ -127,23 +125,25 @@ static int mtdchar_open(struct inode *inode, struct file *file)
 
         /* You can't open it RW if it's not a writeable device */
         if ((file->f_mode & FMODE_WRITE) && !(mtd->flags & MTD_WRITEABLE)) {
-                iput(mtd_ino);
-                put_mtd_device(mtd);
                 ret = -EACCES;
-                goto out;
+                goto out2;
         }
 
         mfi = kzalloc(sizeof(*mfi), GFP_KERNEL);
         if (!mfi) {
-                iput(mtd_ino);
-                put_mtd_device(mtd);
                 ret = -ENOMEM;
-                goto out;
+                goto out2;
         }
         mfi->ino = mtd_ino;
         mfi->mtd = mtd;
         file->private_data = mfi;
+        mutex_unlock(&mtd_mutex);
+        return 0;
 
+out2:
+        iput(mtd_ino);
+out1:
+        put_mtd_device(mtd);
 out:
         mutex_unlock(&mtd_mutex);
         simple_release_fs(&mnt, &count);
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index 75b1dde16358..9ec51cec2e14 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -266,6 +266,7 @@ int start_dma_without_bch_irq(struct gpmi_nand_data *this,
         desc->callback          = dma_irq_callback;
         desc->callback_param    = this;
         dmaengine_submit(desc);
+        dma_async_issue_pending(get_dma_chan(this));
 
         /* Wait for the interrupt from the DMA block. */
         err = wait_for_completion_timeout(dma_c, msecs_to_jiffies(1000));
diff --git a/drivers/net/arcnet/arc-rimi.c b/drivers/net/arcnet/arc-rimi.c
index 25197b698dd6..b8b4c7ba884f 100644
--- a/drivers/net/arcnet/arc-rimi.c
+++ b/drivers/net/arcnet/arc-rimi.c
@@ -89,16 +89,16 @@ static int __init arcrimi_probe(struct net_device *dev)
         BUGLVL(D_NORMAL) printk(VERSION);
         BUGLVL(D_NORMAL) printk("E-mail me if you actually test the RIM I driver, please!\n");
 
-        BUGMSG(D_NORMAL, "Given: node %02Xh, shmem %lXh, irq %d\n",
+        BUGLVL(D_NORMAL) printk("Given: node %02Xh, shmem %lXh, irq %d\n",
                dev->dev_addr[0], dev->mem_start, dev->irq);
 
         if (dev->mem_start <= 0 || dev->irq <= 0) {
-                BUGMSG(D_NORMAL, "No autoprobe for RIM I; you "
+                BUGLVL(D_NORMAL) printk("No autoprobe for RIM I; you "
                        "must specify the shmem and irq!\n");
                 return -ENODEV;
         }
         if (dev->dev_addr[0] == 0) {
-                BUGMSG(D_NORMAL, "You need to specify your card's station "
+                BUGLVL(D_NORMAL) printk("You need to specify your card's station "
                        "ID!\n");
                 return -ENODEV;
         }
@@ -109,7 +109,7 @@ static int __init arcrimi_probe(struct net_device *dev)
          * will be taken.
          */
         if (!request_mem_region(dev->mem_start, MIRROR_SIZE, "arcnet (90xx)")) {
-                BUGMSG(D_NORMAL, "Card memory already allocated\n");
+                BUGLVL(D_NORMAL) printk("Card memory already allocated\n");
                 return -ENODEV;
         }
         return arcrimi_found(dev);
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index 9a66e2a910ae..9c1c8cd5223f 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -744,14 +744,14 @@ static void cfhsi_wake_up(struct work_struct *work)
                 size_t fifo_occupancy = 0;
 
                 /* Wakeup timeout */
-                dev_err(&cfhsi->ndev->dev, "%s: Timeout.\n",
+                dev_dbg(&cfhsi->ndev->dev, "%s: Timeout.\n",
                         __func__);
 
                 /* Check FIFO to check if modem has sent something. */
                 WARN_ON(cfhsi->dev->cfhsi_fifo_occupancy(cfhsi->dev,
                                         &fifo_occupancy));
 
-                dev_err(&cfhsi->ndev->dev, "%s: Bytes in FIFO: %u.\n",
+                dev_dbg(&cfhsi->ndev->dev, "%s: Bytes in FIFO: %u.\n",
                                 __func__, (unsigned) fifo_occupancy);
 
                 /* Check if we misssed the interrupt. */
@@ -1210,7 +1210,7 @@ int cfhsi_probe(struct platform_device *pdev)
 
 static void cfhsi_shutdown(struct cfhsi *cfhsi)
 {
-        u8 *tx_buf, *rx_buf;
+        u8 *tx_buf, *rx_buf, *flip_buf;
 
         /* Stop TXing */
         netif_tx_stop_all_queues(cfhsi->ndev);
@@ -1234,7 +1234,7 @@ static void cfhsi_shutdown(struct cfhsi *cfhsi)
         /* Store bufferes: will be freed later. */
         tx_buf = cfhsi->tx_buf;
         rx_buf = cfhsi->rx_buf;
-
+        flip_buf = cfhsi->rx_flip_buf;
         /* Flush transmit queues. */
         cfhsi_abort_tx(cfhsi);
 
@@ -1247,6 +1247,7 @@ static void cfhsi_shutdown(struct cfhsi *cfhsi)
         /* Free buffers. */
         kfree(tx_buf);
         kfree(rx_buf);
+        kfree(flip_buf);
 }
 
 int cfhsi_remove(struct platform_device *pdev)
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 5234586dff15..629c4ba5d49d 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -875,6 +875,7 @@ static int pcan_usb_pro_init(struct peak_usb_device *dev)
                                             PCAN_USBPRO_INFO_FW,
                                             &fi, sizeof(fi));
                 if (err) {
+                        kfree(usb_if);
                         dev_err(dev->netdev->dev.parent,
                                 "unable to read %s firmware info (err %d)\n",
                                 pcan_usb_pro.name, err);
@@ -885,6 +886,7 @@ static int pcan_usb_pro_init(struct peak_usb_device *dev)
                                             PCAN_USBPRO_INFO_BL,
                                             &bi, sizeof(bi));
                 if (err) {
+                        kfree(usb_if);
                         dev_err(dev->netdev->dev.parent,
                                 "unable to read %s bootloader info (err %d)\n",
                                 pcan_usb_pro.name, err);
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index d5c6d92f1ee7..442d91a2747b 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -107,14 +107,14 @@ static int dummy_dev_init(struct net_device *dev)
         return 0;
 }
 
-static void dummy_dev_free(struct net_device *dev)
+static void dummy_dev_uninit(struct net_device *dev)
 {
         free_percpu(dev->dstats);
-        free_netdev(dev);
 }
 
 static const struct net_device_ops dummy_netdev_ops = {
         .ndo_init               = dummy_dev_init,
+        .ndo_uninit             = dummy_dev_uninit,
         .ndo_start_xmit         = dummy_xmit,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_rx_mode        = set_multicast_list,
@@ -128,7 +128,7 @@ static void dummy_setup(struct net_device *dev)
 
         /* Initialize the device structure. */
         dev->netdev_ops = &dummy_netdev_ops;
-        dev->destructor = dummy_dev_free;
+        dev->destructor = free_netdev;
 
         /* Fill in device structure with ethernet-generic values. */
         dev->tx_queue_len = 0;
diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
index 40ac41436549..c926857e8205 100644
--- a/drivers/net/ethernet/atheros/atlx/atl1.c
+++ b/drivers/net/ethernet/atheros/atlx/atl1.c
@@ -2476,7 +2476,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
                                         "pcie phy link down %x\n", status);
                         if (netif_running(adapter->netdev)) {   /* reset MAC */
                                 iowrite32(0, adapter->hw.hw_addr + REG_IMR);
-                                schedule_work(&adapter->pcie_dma_to_rst_task);
+                                schedule_work(&adapter->reset_dev_task);
                                 return IRQ_HANDLED;
                         }
                 }
@@ -2488,7 +2488,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
                                         "pcie DMA r/w error (status = 0x%x)\n",
                                         status);
                         iowrite32(0, adapter->hw.hw_addr + REG_IMR);
-                        schedule_work(&adapter->pcie_dma_to_rst_task);
+                        schedule_work(&adapter->reset_dev_task);
                         return IRQ_HANDLED;
                 }
 
@@ -2633,10 +2633,10 @@ static void atl1_down(struct atl1_adapter *adapter)
         atl1_clean_rx_ring(adapter);
 }
 
-static void atl1_tx_timeout_task(struct work_struct *work)
+static void atl1_reset_dev_task(struct work_struct *work)
 {
         struct atl1_adapter *adapter =
-                container_of(work, struct atl1_adapter, tx_timeout_task);
+                container_of(work, struct atl1_adapter, reset_dev_task);
         struct net_device *netdev = adapter->netdev;
 
         netif_device_detach(netdev);
@@ -3038,12 +3038,10 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
                     (unsigned long)adapter);
         adapter->phy_timer_pending = false;
 
-        INIT_WORK(&adapter->tx_timeout_task, atl1_tx_timeout_task);
+        INIT_WORK(&adapter->reset_dev_task, atl1_reset_dev_task);
 
         INIT_WORK(&adapter->link_chg_task, atlx_link_chg_task);
 
-        INIT_WORK(&adapter->pcie_dma_to_rst_task, atl1_tx_timeout_task);
-
         err = register_netdev(netdev);
         if (err)
                 goto err_common;
diff --git a/drivers/net/ethernet/atheros/atlx/atl1.h b/drivers/net/ethernet/atheros/atlx/atl1.h
index 109d6da8be97..e04bf4d71e46 100644
--- a/drivers/net/ethernet/atheros/atlx/atl1.h
+++ b/drivers/net/ethernet/atheros/atlx/atl1.h
@@ -758,9 +758,8 @@ struct atl1_adapter {
         u16 link_speed;
         u16 link_duplex;
         spinlock_t lock;
-        struct work_struct tx_timeout_task;
+        struct work_struct reset_dev_task;
         struct work_struct link_chg_task;
-        struct work_struct pcie_dma_to_rst_task;
 
         struct timer_list phy_config_timer;
         bool phy_timer_pending;
diff --git a/drivers/net/ethernet/atheros/atlx/atlx.c b/drivers/net/ethernet/atheros/atlx/atlx.c
index 3cd8837236dc..c9e9dc57986c 100644
--- a/drivers/net/ethernet/atheros/atlx/atlx.c
+++ b/drivers/net/ethernet/atheros/atlx/atlx.c
@@ -194,7 +194,7 @@ static void atlx_tx_timeout(struct net_device *netdev)
 {
         struct atlx_adapter *adapter = netdev_priv(netdev);
         /* Do the reset outside of interrupt context */
-        schedule_work(&adapter->tx_timeout_task);
+        schedule_work(&adapter->reset_dev_task);
 }
 
 /*
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index ad95324dc042..64392ec410a3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -942,6 +942,12 @@ static int bnx2x_ets_e3b0_sp_pri_to_cos_set(const struct link_params *params,
         const u8 max_num_of_cos = (port) ? DCBX_E3B0_MAX_NUM_COS_PORT1 :
                 DCBX_E3B0_MAX_NUM_COS_PORT0;
 
+        if (pri >= max_num_of_cos) {
+                DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid "
+                   "parameter Illegal strict priority\n");
+            return -EINVAL;
+        }
+
         if (sp_pri_to_cos[pri] != DCBX_INVALID_COS) {
                 DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid "
                                    "parameter There can't be two COS's with "
@@ -949,12 +955,6 @@ static int bnx2x_ets_e3b0_sp_pri_to_cos_set(const struct link_params *params,
                 return -EINVAL;
         }
 
-        if (pri > max_num_of_cos) {
-                DP(NETIF_MSG_LINK, "bnx2x_ets_e3b0_sp_pri_to_cos_set invalid "
-                   "parameter Illegal strict priority\n");
-            return -EINVAL;
-        }
-
         sp_pri_to_cos[pri] = cos_entry;
         return 0;
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 062ac333fde6..ceeab8e852ef 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -879,8 +879,13 @@ static inline unsigned int tg3_has_work(struct tg3_napi *tnapi)
                 if (sblk->status & SD_STATUS_LINK_CHG)
                         work_exists = 1;
         }
-        /* check for RX/TX work to do */
-        if (sblk->idx[0].tx_consumer != tnapi->tx_cons ||
+
+        /* check for TX work to do */
+        if (sblk->idx[0].tx_consumer != tnapi->tx_cons)
+                work_exists = 1;
+
+        /* check for RX work to do */
+        if (tnapi->rx_rcb_prod_idx &&
             *(tnapi->rx_rcb_prod_idx) != tnapi->rx_rcb_ptr)
                 work_exists = 1;
 
@@ -6124,6 +6129,9 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int work_done, int budget)
                         return work_done;
         }
 
+        if (!tnapi->rx_rcb_prod_idx)
+                return work_done;
+
         /* run RX thread, within the bounds set by NAPI.
          * All RX "locking" is done by ensuring outside
          * code synchronizes with tg3->napi.poll()
@@ -7567,6 +7575,12 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                  */
                 switch (i) {
                 default:
+                        if (tg3_flag(tp, ENABLE_RSS)) {
+                                tnapi->rx_rcb_prod_idx = NULL;
+                                break;
+                        }
+                        /* Fall through */
+                case 1:
                         tnapi->rx_rcb_prod_idx = &sblk->idx[0].rx_producer;
                         break;
                 case 2:
diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index 63bfdd10bd6d..abb6ce7c1b7e 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -1150,6 +1150,48 @@ release_tpsram:
 }
 
 /**
+ * t3_synchronize_rx - wait for current Rx processing on a port to complete
+ * @adap: the adapter
+ * @p: the port
+ *
+ * Ensures that current Rx processing on any of the queues associated with
+ * the given port completes before returning.  We do this by acquiring and
+ * releasing the locks of the response queues associated with the port.
+ */
+static void t3_synchronize_rx(struct adapter *adap, const struct port_info *p)
+{
+        int i;
+
+        for (i = p->first_qset; i < p->first_qset + p->nqsets; i++) {
+                struct sge_rspq *q = &adap->sge.qs[i].rspq;
+
+                spin_lock_irq(&q->lock);
+                spin_unlock_irq(&q->lock);
+        }
+}
+
+static void cxgb_vlan_mode(struct net_device *dev, netdev_features_t features)
+{
+        struct port_info *pi = netdev_priv(dev);
+        struct adapter *adapter = pi->adapter;
+
+        if (adapter->params.rev > 0) {
+                t3_set_vlan_accel(adapter, 1 << pi->port_id,
+                                  features & NETIF_F_HW_VLAN_RX);
+        } else {
+                /* single control for all ports */
+                unsigned int i, have_vlans = features & NETIF_F_HW_VLAN_RX;
+
+                for_each_port(adapter, i)
+                        have_vlans |=
+                                adapter->port[i]->features & NETIF_F_HW_VLAN_RX;
+
+                t3_set_vlan_accel(adapter, 1, have_vlans);
+        }
+        t3_synchronize_rx(adapter, pi);
+}
+
+/**
  *      cxgb_up - enable the adapter
  *      @adapter: adapter being enabled
  *
@@ -1161,7 +1203,7 @@ release_tpsram:
  */
 static int cxgb_up(struct adapter *adap)
 {
-        int err;
+        int i, err;
 
         if (!(adap->flags & FULL_INIT_DONE)) {
                 err = t3_check_fw_version(adap);
@@ -1198,6 +1240,9 @@ static int cxgb_up(struct adapter *adap)
                 if (err)
                         goto out;
 
+                for_each_port(adap, i)
+                        cxgb_vlan_mode(adap->port[i], adap->port[i]->features);
+
                 setup_rss(adap);
                 if (!(adap->flags & NAPI_INIT))
                         init_napi(adap);
@@ -2508,48 +2553,6 @@ static int cxgb_set_mac_addr(struct net_device *dev, void *p)
         return 0;
 }
 
-/**
- * t3_synchronize_rx - wait for current Rx processing on a port to complete
- * @adap: the adapter
- * @p: the port
- *
- * Ensures that current Rx processing on any of the queues associated with
- * the given port completes before returning.  We do this by acquiring and
- * releasing the locks of the response queues associated with the port.
- */
-static void t3_synchronize_rx(struct adapter *adap, const struct port_info *p)
-{
-        int i;
-
-        for (i = p->first_qset; i < p->first_qset + p->nqsets; i++) {
-                struct sge_rspq *q = &adap->sge.qs[i].rspq;
-
-                spin_lock_irq(&q->lock);
-                spin_unlock_irq(&q->lock);
-        }
-}
-
-static void cxgb_vlan_mode(struct net_device *dev, netdev_features_t features)
-{
-        struct port_info *pi = netdev_priv(dev);
-        struct adapter *adapter = pi->adapter;
-
-        if (adapter->params.rev > 0) {
-                t3_set_vlan_accel(adapter, 1 << pi->port_id,
-                                  features & NETIF_F_HW_VLAN_RX);
-        } else {
-                /* single control for all ports */
-                unsigned int i, have_vlans = features & NETIF_F_HW_VLAN_RX;
-
-                for_each_port(adapter, i)
-                        have_vlans |=
-                                adapter->port[i]->features & NETIF_F_HW_VLAN_RX;
-
-                t3_set_vlan_accel(adapter, 1, have_vlans);
-        }
-        t3_synchronize_rx(adapter, pi);
-}
-
 static netdev_features_t cxgb_fix_features(struct net_device *dev,
         netdev_features_t features)
 {
@@ -3353,9 +3356,6 @@ static int __devinit init_one(struct pci_dev *pdev,
         err = sysfs_create_group(&adapter->port[0]->dev.kobj,
                                  &cxgb3_attr_group);
 
-        for_each_port(adapter, i)
-                cxgb_vlan_mode(adapter->port[i], adapter->port[i]->features);
-
         print_port_info(adapter, ai);
         return 0;
 
diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index b2dc2c81a147..2e09edb9cdf8 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -1259,55 +1259,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
 {
         int phy_addr;
         struct netdev_private *np = netdev_priv(dev);
-        struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
-
-        struct netdev_desc *desc;
-        int i;
+        struct mii_ioctl_data *miidata = if_mii(rq);
 
         phy_addr = np->phy_addr;
         switch (cmd) {
-        case SIOCDEVPRIVATE:
-                break;
-
-        case SIOCDEVPRIVATE + 1:
-                miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
+        case SIOCGMIIPHY:
+                miidata->phy_id = phy_addr;
                 break;
-        case SIOCDEVPRIVATE + 2:
-                mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
+        case SIOCGMIIREG:
+                miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
                 break;
-        case SIOCDEVPRIVATE + 3:
-                break;
-        case SIOCDEVPRIVATE + 4:
-                break;
-        case SIOCDEVPRIVATE + 5:
-                netif_stop_queue (dev);
+        case SIOCSMIIREG:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+                mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
                 break;
-        case SIOCDEVPRIVATE + 6:
-                netif_wake_queue (dev);
-                break;
-        case SIOCDEVPRIVATE + 7:
-                printk
-                    ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
-                     netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
-                     np->old_rx);
-                break;
-        case SIOCDEVPRIVATE + 8:
-                printk("TX ring:\n");
-                for (i = 0; i < TX_RING_SIZE; i++) {
-                        desc = &np->tx_ring[i];
-                        printk
-                            ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
-                             i,
-                             (u32) (np->tx_ring_dma + i * sizeof (*desc)),
-                             (u32)le64_to_cpu(desc->next_desc),
-                             (u32)le64_to_cpu(desc->status),
-                             (u32)(le64_to_cpu(desc->fraginfo) >> 32),
-                             (u32)le64_to_cpu(desc->fraginfo));
-                        printk ("\n");
-                }
-                printk ("\n");
-                break;
-
         default:
                 return -EOPNOTSUPP;
         }
diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
index ba0adcafa55a..30c2da3de548 100644
--- a/drivers/net/ethernet/dlink/dl2k.h
+++ b/drivers/net/ethernet/dlink/dl2k.h
@@ -365,13 +365,6 @@ struct ioctl_data {
         char *data;
 };
 
-struct mii_data {
-        __u16 reserved;
-        __u16 reg_num;
-        __u16 in_value;
-        __u16 out_value;
-};
-
 /* The Rx and Tx buffer descriptors. */
 struct netdev_desc {
         __le64 next_desc;
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 17a46e76123f..9ac14f804851 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -116,10 +116,10 @@ static struct ucc_geth_info ugeth_primary_info = {
         .maxGroupAddrInHash = 4,
         .maxIndAddrInHash = 4,
         .prel = 7,
-        .maxFrameLength = 1518,
+        .maxFrameLength = 1518+16, /* Add extra bytes for VLANs etc. */
         .minFrameLength = 64,
-        .maxD1Length = 1520,
-        .maxD2Length = 1520,
+        .maxD1Length = 1520+16, /* Add extra bytes for VLANs etc. */
+        .maxD2Length = 1520+16, /* Add extra bytes for VLANs etc. */
         .vlantype = 0x8100,
         .ecamptr = ((uint32_t) NULL),
         .eventRegMask = UCCE_OTHER,
diff --git a/drivers/net/ethernet/freescale/ucc_geth.h b/drivers/net/ethernet/freescale/ucc_geth.h
index 2e395a2566b8..f71b3e7b12de 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.h
+++ b/drivers/net/ethernet/freescale/ucc_geth.h
@@ -877,7 +877,7 @@ struct ucc_geth_hardware_statistics {
 
 /* Driver definitions */
 #define TX_BD_RING_LEN                          0x10
-#define RX_BD_RING_LEN                          0x10
+#define RX_BD_RING_LEN                          0x20
 
 #define TX_RING_MOD_MASK(size)                  (size-1)
 #define RX_RING_MOD_MASK(size)                  (size-1)
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 3516e17a399d..c9069a28832b 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -290,16 +290,18 @@ static void ehea_update_bcmc_registrations(void)
 
                                 arr[i].adh = adapter->handle;
                                 arr[i].port_id = port->logical_port_id;
-                                arr[i].reg_type = EHEA_BCMC_SCOPE_ALL |
-                                                  EHEA_BCMC_MULTICAST |
+                                arr[i].reg_type = EHEA_BCMC_MULTICAST |
                                                   EHEA_BCMC_UNTAGGED;
+                                if (mc_entry->macaddr == 0)
+                                        arr[i].reg_type |= EHEA_BCMC_SCOPE_ALL;
                                 arr[i++].macaddr = mc_entry->macaddr;
 
                                 arr[i].adh = adapter->handle;
                                 arr[i].port_id = port->logical_port_id;
-                                arr[i].reg_type = EHEA_BCMC_SCOPE_ALL |
-                                                  EHEA_BCMC_MULTICAST |
+                                arr[i].reg_type = EHEA_BCMC_MULTICAST |
                                                   EHEA_BCMC_VLANID_ALL;
+                                if (mc_entry->macaddr == 0)
+                                        arr[i].reg_type |= EHEA_BCMC_SCOPE_ALL;
                                 arr[i++].macaddr = mc_entry->macaddr;
                                 num_registrations -= 2;
                         }
@@ -1838,8 +1840,9 @@ static u64 ehea_multicast_reg_helper(struct ehea_port *port, u64 mc_mac_addr,
         u64 hret;
         u8 reg_type;
 
-        reg_type = EHEA_BCMC_SCOPE_ALL | EHEA_BCMC_MULTICAST
-                 | EHEA_BCMC_UNTAGGED;
+        reg_type = EHEA_BCMC_MULTICAST | EHEA_BCMC_UNTAGGED;
+        if (mc_mac_addr == 0)
+                reg_type |= EHEA_BCMC_SCOPE_ALL;
 
         hret = ehea_h_reg_dereg_bcmc(port->adapter->handle,
                                      port->logical_port_id,
@@ -1847,8 +1850,9 @@ static u64 ehea_multicast_reg_helper(struct ehea_port *port, u64 mc_mac_addr,
         if (hret)
                 goto out;
 
-        reg_type = EHEA_BCMC_SCOPE_ALL | EHEA_BCMC_MULTICAST
-                 | EHEA_BCMC_VLANID_ALL;
+        reg_type = EHEA_BCMC_MULTICAST | EHEA_BCMC_VLANID_ALL;
+        if (mc_mac_addr == 0)
+                reg_type |= EHEA_BCMC_SCOPE_ALL;
 
         hret = ehea_h_reg_dereg_bcmc(port->adapter->handle,
                                      port->logical_port_id,
@@ -1898,7 +1902,7 @@ static void ehea_allmulti(struct net_device *dev, int enable)
                                 netdev_err(dev,
                                            "failed enabling IFF_ALLMULTI\n");
                 }
-        } else
+        } else {
                 if (!enable) {
                         /* Disable ALLMULTI */
                         hret = ehea_multicast_reg_helper(port, 0, H_DEREG_BCMC);
@@ -1908,6 +1912,7 @@ static void ehea_allmulti(struct net_device *dev, int enable)
                                 netdev_err(dev,
                                            "failed disabling IFF_ALLMULTI\n");
                 }
+        }
 }
 
 static void ehea_add_multicast_entry(struct ehea_port *port, u8 *mc_mac_addr)
@@ -1941,11 +1946,7 @@ static void ehea_set_multicast_list(struct net_device *dev)
         struct netdev_hw_addr *ha;
         int ret;
 
-        if (port->promisc) {
-                ehea_promiscuous(dev, 1);
-                return;
-        }
-        ehea_promiscuous(dev, 0);
+        ehea_promiscuous(dev, !!(dev->flags & IFF_PROMISC));
 
         if (dev->flags & IFF_ALLMULTI) {
                 ehea_allmulti(dev, 1);
@@ -2463,6 +2464,7 @@ static int ehea_down(struct net_device *dev)
                 return 0;
 
         ehea_drop_multicast_list(dev);
+        ehea_allmulti(dev, 0);
         ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
 
         ehea_free_interrupts(dev);
@@ -3261,6 +3263,7 @@ static int __devinit ehea_probe_adapter(struct platform_device *dev,
         struct ehea_adapter *adapter;
         const u64 *adapter_handle;
         int ret;
+        int i;
 
         if (!dev || !dev->dev.of_node) {
                 pr_err("Invalid ibmebus device probed\n");
@@ -3314,17 +3317,9 @@ static int __devinit ehea_probe_adapter(struct platform_device *dev,
         tasklet_init(&adapter->neq_tasklet, ehea_neq_tasklet,
                      (unsigned long)adapter);
 
-        ret = ibmebus_request_irq(adapter->neq->attr.ist1,
-                                  ehea_interrupt_neq, IRQF_DISABLED,
-                                  "ehea_neq", adapter);
-        if (ret) {
-                dev_err(&dev->dev, "requesting NEQ IRQ failed\n");
-                goto out_kill_eq;
-        }
-
         ret = ehea_create_device_sysfs(dev);
         if (ret)
-                goto out_free_irq;
+                goto out_kill_eq;
 
         ret = ehea_setup_ports(adapter);
         if (ret) {
@@ -3332,15 +3327,28 @@ static int __devinit ehea_probe_adapter(struct platform_device *dev,
                 goto out_rem_dev_sysfs;
         }
 
+        ret = ibmebus_request_irq(adapter->neq->attr.ist1,
+                                  ehea_interrupt_neq, IRQF_DISABLED,
+                                  "ehea_neq", adapter);
+        if (ret) {
+                dev_err(&dev->dev, "requesting NEQ IRQ failed\n");
+                goto out_shutdown_ports;
+        }
+
+
         ret = 0;
         goto out;
 
+out_shutdown_ports:
+        for (i = 0; i < EHEA_MAX_PORTS; i++)
+                if (adapter->port[i]) {
+                        ehea_shutdown_single_port(adapter->port[i]);
+                        adapter->port[i] = NULL;
+                }
+
 out_rem_dev_sysfs:
         ehea_remove_device_sysfs(dev);
 
-out_free_irq:
-        ibmebus_free_irq(adapter->neq->attr.ist1, adapter);
-
 out_kill_eq:
         ehea_destroy_eq(adapter->neq);
 
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_phyp.h b/drivers/net/ethernet/ibm/ehea/ehea_phyp.h
index 52c456ec4d6c..8364815c32ff 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_phyp.h
+++ b/drivers/net/ethernet/ibm/ehea/ehea_phyp.h
@@ -450,7 +450,7 @@ u64 ehea_h_modify_ehea_port(const u64 adapter_handle, const u16 port_num,
                             void *cb_addr);
 
 #define H_REGBCMC_PN            EHEA_BMASK_IBM(48, 63)
-#define H_REGBCMC_REGTYPE       EHEA_BMASK_IBM(61, 63)
+#define H_REGBCMC_REGTYPE       EHEA_BMASK_IBM(60, 63)
 #define H_REGBCMC_MACADDR       EHEA_BMASK_IBM(16, 63)
 #define H_REGBCMC_VLANID        EHEA_BMASK_IBM(52, 63)
 
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 64c76443a7aa..b461c24945e3 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1310,10 +1310,6 @@ static s32 e1000_oem_bits_config_ich8lan(struct e1000_hw *hw, bool d0_state)
 
                 if (mac_reg & E1000_PHY_CTRL_D0A_LPLU)
                         oem_reg |= HV_OEM_BITS_LPLU;
-
-                /* Set Restart auto-neg to activate the bits */
-                if (!hw->phy.ops.check_reset_block(hw))
-                        oem_reg |= HV_OEM_BITS_RESTART_AN;
         } else {
                 if (mac_reg & (E1000_PHY_CTRL_GBE_DISABLE |
                                E1000_PHY_CTRL_NOND0A_GBE_DISABLE))
@@ -1324,6 +1320,11 @@ static s32 e1000_oem_bits_config_ich8lan(struct e1000_hw *hw, bool d0_state)
                         oem_reg |= HV_OEM_BITS_LPLU;
         }
 
+        /* Set Restart auto-neg to activate the bits */
+        if ((d0_state || (hw->mac.type != e1000_pchlan)) &&
+            !hw->phy.ops.check_reset_block(hw))
+                oem_reg |= HV_OEM_BITS_RESTART_AN;
+
         ret_val = hw->phy.ops.write_reg_locked(hw, HV_OEM_BITS, oem_reg);
 
 release:
@@ -3682,7 +3683,11 @@ void e1000_suspend_workarounds_ich8lan(struct e1000_hw *hw)
 
         if (hw->mac.type >= e1000_pchlan) {
                 e1000_oem_bits_config_ich8lan(hw, false);
-                e1000_phy_hw_reset_ich8lan(hw);
+
+                /* Reset PHY to activate OEM bits on 82577/8 */
+                if (hw->mac.type == e1000_pchlan)
+                        e1000e_phy_hw_reset_generic(hw);
+
                 ret_val = hw->phy.ops.acquire(hw);
                 if (ret_val)
                         return;
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 19ab2154802c..9520a6ac1f30 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3799,7 +3799,7 @@ static int e1000_test_msi_interrupt(struct e1000_adapter *adapter)
         /* fire an unusual interrupt on the test handler */
         ew32(ICS, E1000_ICS_RXSEQ);
         e1e_flush();
-        msleep(50);
+        msleep(100);
 
         e1000_irq_disable(adapter);
 
diff --git a/drivers/net/ethernet/intel/e1000e/param.c b/drivers/net/ethernet/intel/e1000e/param.c
index ff796e42c3eb..16adeb9418a8 100644
--- a/drivers/net/ethernet/intel/e1000e/param.c
+++ b/drivers/net/ethernet/intel/e1000e/param.c
@@ -106,7 +106,7 @@ E1000_PARAM(RxAbsIntDelay, "Receive Absolute Interrupt Delay");
 /*
  * Interrupt Throttle Rate (interrupts/sec)
  *
- * Valid Range: 100-100000 (0=off, 1=dynamic, 3=dynamic conservative)
+ * Valid Range: 100-100000 or one of: 0=off, 1=dynamic, 3=dynamic conservative
  */
 E1000_PARAM(InterruptThrottleRate, "Interrupt Throttling Rate");
 #define DEFAULT_ITR 3
@@ -344,53 +344,60 @@ void __devinit e1000e_check_options(struct e1000_adapter *adapter)
 
                 if (num_InterruptThrottleRate > bd) {
                         adapter->itr = InterruptThrottleRate[bd];
-                        switch (adapter->itr) {
-                        case 0:
-                                e_info("%s turned off\n", opt.name);
-                                break;
-                        case 1:
-                                e_info("%s set to dynamic mode\n", opt.name);
-                                adapter->itr_setting = adapter->itr;
-                                adapter->itr = 20000;
-                                break;
-                        case 3:
-                                e_info("%s set to dynamic conservative mode\n",
-                                        opt.name);
-                                adapter->itr_setting = adapter->itr;
-                                adapter->itr = 20000;
-                                break;
-                        case 4:
-                                e_info("%s set to simplified (2000-8000 ints) "
-                                       "mode\n", opt.name);
-                                adapter->itr_setting = 4;
-                                break;
-                        default:
-                                /*
-                                 * Save the setting, because the dynamic bits
-                                 * change itr.
-                                 */
-                                if (e1000_validate_option(&adapter->itr, &opt,
-                                                          adapter) &&
-                                    (adapter->itr == 3)) {
-                                        /*
-                                         * In case of invalid user value,
-                                         * default to conservative mode.
-                                         */
-                                        adapter->itr_setting = adapter->itr;
-                                        adapter->itr = 20000;
-                                } else {
-                                        /*
-                                         * Clear the lower two bits because
-                                         * they are used as control.
-                                         */
-                                        adapter->itr_setting =
-                                                adapter->itr & ~3;
-                                }
-                                break;
-                        }
+
+                        /*
+                         * Make sure a message is printed for non-special
+                         * values.  And in case of an invalid option, display
+                         * warning, use default and got through itr/itr_setting
+                         * adjustment logic below
+                         */
+                        if ((adapter->itr > 4) &&
+                            e1000_validate_option(&adapter->itr, &opt, adapter))
+                                adapter->itr = opt.def;
                 } else {
-                        adapter->itr_setting = opt.def;
+                        /*
+                         * If no option specified, use default value and go
+                         * through the logic below to adjust itr/itr_setting
+                         */
+                        adapter->itr = opt.def;
+
+                        /*
+                         * Make sure a message is printed for non-special
+                         * default values
+                         */
+                        if (adapter->itr > 40)
+                                e_info("%s set to default %d\n", opt.name,
+                                       adapter->itr);
+                }
+
+                adapter->itr_setting = adapter->itr;
+                switch (adapter->itr) {
+                case 0:
+                        e_info("%s turned off\n", opt.name);
+                        break;
+                case 1:
+                        e_info("%s set to dynamic mode\n", opt.name);
+                        adapter->itr = 20000;
+                        break;
+                case 3:
+                        e_info("%s set to dynamic conservative mode\n",
+                               opt.name);
                         adapter->itr = 20000;
+                        break;
+                case 4:
+                        e_info("%s set to simplified (2000-8000 ints) mode\n",
+                               opt.name);
+                        break;
+                default:
+                        /*
+                         * Save the setting, because the dynamic bits
+                         * change itr.
+                         *
+                         * Clear the lower two bits because
+                         * they are used as control.
+                         */
+                        adapter->itr_setting &= ~3;
+                        break;
                 }
         }
         { /* Interrupt Mode */
diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index d61ca2a732f0..8ec74b07f940 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -2731,14 +2731,14 @@ static int __devinit igbvf_probe(struct pci_dev *pdev,
                         netdev->addr_len);
         }
 
-        if (!is_valid_ether_addr(netdev->perm_addr)) {
+        if (!is_valid_ether_addr(netdev->dev_addr)) {
                 dev_err(&pdev->dev, "Invalid MAC Address: %pM\n",
                         netdev->dev_addr);
                 err = -EIO;
                 goto err_hw_init;
         }
 
-        memcpy(netdev->perm_addr, adapter->hw.mac.addr, netdev->addr_len);
+        memcpy(netdev->perm_addr, netdev->dev_addr, netdev->addr_len);
 
         setup_timer(&adapter->watchdog_timer, &igbvf_watchdog,
                     (unsigned long) adapter);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
index 77ea4b716535..bc07933d67da 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
@@ -437,6 +437,7 @@ int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
          */
         if ((fh->fh_r_ctl == FC_RCTL_DD_SOL_DATA) &&
             (fctl & FC_FC_END_SEQ)) {
+                skb_linearize(skb);
                 crc = (struct fcoe_crc_eof *)skb_put(skb, sizeof(*crc));
                 crc->fcoe_eof = FC_EOF_T;
         }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
index 027d7a75be39..ed1b47dc0834 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
@@ -622,6 +622,16 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter, int v_idx,
                 if (adapter->hw.mac.type == ixgbe_mac_82599EB)
                         set_bit(__IXGBE_RX_CSUM_UDP_ZERO_ERR, &ring->state);
 
+#ifdef IXGBE_FCOE
+                if (adapter->netdev->features & NETIF_F_FCOE_MTU) {
+                        struct ixgbe_ring_feature *f;
+                        f = &adapter->ring_feature[RING_F_FCOE];
+                        if ((rxr_idx >= f->mask) &&
+                            (rxr_idx < f->mask + f->indices))
+                                set_bit(__IXGBE_RX_FCOE_BUFSZ, &ring->state);
+                }
+
+#endif /* IXGBE_FCOE */
                 /* apply Rx specific ring traits */
                 ring->count = adapter->rx_ring_count;
                 ring->queue_index = rxr_idx;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 3e26b1f9ac75..88f6b2e9b72d 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -3154,14 +3154,6 @@ static void ixgbe_set_rx_buffer_len(struct ixgbe_adapter *adapter)
                         set_ring_rsc_enabled(rx_ring);
                 else
                         clear_ring_rsc_enabled(rx_ring);
-#ifdef IXGBE_FCOE
-                if (netdev->features & NETIF_F_FCOE_MTU) {
-                        struct ixgbe_ring_feature *f;
-                        f = &adapter->ring_feature[RING_F_FCOE];
-                        if ((i >= f->mask) && (i < f->mask + f->indices))
-                                set_bit(__IXGBE_RX_FCOE_BUFSZ, &rx_ring->state);
-                }
-#endif /* IXGBE_FCOE */
         }
 }
 
@@ -4836,7 +4828,9 @@ static int ixgbe_resume(struct pci_dev *pdev)
 
         pci_wake_from_d3(pdev, false);
 
+        rtnl_lock();
         err = ixgbe_init_interrupt_scheme(adapter);
+        rtnl_unlock();
         if (err) {
                 e_dev_err("Cannot initialize interrupts for device\n");
                 return err;
@@ -4879,10 +4873,6 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
         }
 
         ixgbe_clear_interrupt_scheme(adapter);
-#ifdef CONFIG_DCB
-        kfree(adapter->ixgbe_ieee_pfc);
-        kfree(adapter->ixgbe_ieee_ets);
-#endif
 
 #ifdef CONFIG_PM
         retval = pci_save_state(pdev);
@@ -4893,6 +4883,16 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
         if (wufc) {
                 ixgbe_set_rx_mode(netdev);
 
+                /*
+                 * enable the optics for both mult-speed fiber and
+                 * 82599 SFP+ fiber as we can WoL.
+                 */
+                if (hw->mac.ops.enable_tx_laser &&
+                    (hw->phy.multispeed_fiber ||
+                    (hw->mac.ops.get_media_type(hw) == ixgbe_media_type_fiber &&
+                     hw->mac.type == ixgbe_mac_82599EB)))
+                        hw->mac.ops.enable_tx_laser(hw);
+
                 /* turn on all-multi mode if wake on multicast is enabled */
                 if (wufc & IXGBE_WUFC_MC) {
                         fctrl = IXGBE_READ_REG(hw, IXGBE_FCTRL);
@@ -7220,6 +7220,11 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
 
         ixgbe_release_hw_control(adapter);
 
+#ifdef CONFIG_DCB
+        kfree(adapter->ixgbe_ieee_pfc);
+        kfree(adapter->ixgbe_ieee_ets);
+
+#endif
         iounmap(adapter->hw.hw_addr);
         pci_release_selected_regions(pdev, pci_select_bars(pdev,
                                      IORESOURCE_MEM));
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index c9b504e2dfc3..487a6c8bd4ec 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -2494,8 +2494,13 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2,
                 skb_copy_from_linear_data(re->skb, skb->data, length);
                 skb->ip_summed = re->skb->ip_summed;
                 skb->csum = re->skb->csum;
+                skb->rxhash = re->skb->rxhash;
+                skb->vlan_tci = re->skb->vlan_tci;
+
                 pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
                                                length, PCI_DMA_FROMDEVICE);
+                re->skb->vlan_tci = 0;
+                re->skb->rxhash = 0;
                 re->skb->ip_summed = CHECKSUM_NONE;
                 skb_put(skb, length);
         }
@@ -2580,9 +2585,6 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
         struct sk_buff *skb = NULL;
         u16 count = (status & GMR_FS_LEN) >> 16;
 
-        if (status & GMR_FS_VLAN)
-                count -= VLAN_HLEN;     /* Account for vlan tag */
-
         netif_printk(sky2, rx_status, KERN_DEBUG, dev,
                      "rx slot %u status 0x%x len %d\n",
                      sky2->rx_next, status, length);
@@ -2590,6 +2592,9 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
         sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending;
         prefetch(sky2->rx_ring + sky2->rx_next);
 
+        if (vlan_tx_tag_present(re->skb))
+                count -= VLAN_HLEN;     /* Account for vlan tag */
+
         /* This chip has hardware problems that generates bogus status.
          * So do only marginal checking and expect higher level protocols
          * to handle crap frames.
@@ -2647,11 +2652,8 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
 }
 
 static inline void sky2_skb_rx(const struct sky2_port *sky2,
-                               u32 status, struct sk_buff *skb)
+                               struct sk_buff *skb)
 {
-        if (status & GMR_FS_VLAN)
-                __vlan_hwaccel_put_tag(skb, be16_to_cpu(sky2->rx_tag));
-
         if (skb->ip_summed == CHECKSUM_NONE)
                 netif_receive_skb(skb);
         else
@@ -2705,6 +2707,14 @@ static void sky2_rx_checksum(struct sky2_port *sky2, u32 status)
         }
 }
 
+static void sky2_rx_tag(struct sky2_port *sky2, u16 length)
+{
+        struct sk_buff *skb;
+
+        skb = sky2->rx_ring[sky2->rx_next].skb;
+        __vlan_hwaccel_put_tag(skb, be16_to_cpu(length));
+}
+
 static void sky2_rx_hash(struct sky2_port *sky2, u32 status)
 {
         struct sk_buff *skb;
@@ -2763,8 +2773,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
                         }
 
                         skb->protocol = eth_type_trans(skb, dev);
-
-                        sky2_skb_rx(sky2, status, skb);
+                        sky2_skb_rx(sky2, skb);
 
                         /* Stop after net poll weight */
                         if (++work_done >= to_do)
@@ -2772,11 +2781,11 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
                         break;
 
                 case OP_RXVLAN:
-                        sky2->rx_tag = length;
+                        sky2_rx_tag(sky2, length);
                         break;
 
                 case OP_RXCHKSVLAN:
-                        sky2->rx_tag = length;
+                        sky2_rx_tag(sky2, length);
                         /* fall through */
                 case OP_RXCHKS:
                         if (likely(dev->features & NETIF_F_RXCSUM))
diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
index ff6f58bf822a..3c896ce80b71 100644
--- a/drivers/net/ethernet/marvell/sky2.h
+++ b/drivers/net/ethernet/marvell/sky2.h
@@ -2241,7 +2241,6 @@ struct sky2_port {
         u16                  rx_pending;
         u16                  rx_data_size;
         u16                  rx_nfrags;
-        u16                  rx_tag;
 
         struct {
                 unsigned long last;
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index c722aa607d07..f8dda009d3c0 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -889,16 +889,17 @@ static int ks8851_net_stop(struct net_device *dev)
         netif_stop_queue(dev);
 
         mutex_lock(&ks->lock);
+        /* turn off the IRQs and ack any outstanding */
+        ks8851_wrreg16(ks, KS_IER, 0x0000);
+        ks8851_wrreg16(ks, KS_ISR, 0xffff);
+        mutex_unlock(&ks->lock);
 
         /* stop any outstanding work */
         flush_work(&ks->irq_work);
         flush_work(&ks->tx_work);
         flush_work(&ks->rxctrl_work);
 
-        /* turn off the IRQs and ack any outstanding */
-        ks8851_wrreg16(ks, KS_IER, 0x0000);
-        ks8851_wrreg16(ks, KS_ISR, 0xffff);
-
+        mutex_lock(&ks->lock);
         /* shutdown RX process */
         ks8851_wrreg16(ks, KS_RXCR1, 0x0000);
 
@@ -907,6 +908,7 @@ static int ks8851_net_stop(struct net_device *dev)
 
         /* set powermode to soft power down to save power */
         ks8851_set_powermode(ks, PMECR_PM_SOFTDOWN);
+        mutex_unlock(&ks->lock);
 
         /* ensure any queued tx buffers are dumped */
         while (!skb_queue_empty(&ks->txq)) {
@@ -918,7 +920,6 @@ static int ks8851_net_stop(struct net_device *dev)
                 dev_kfree_skb(txb);
         }
 
-        mutex_unlock(&ks->lock);
         return 0;
 }
 
@@ -1418,6 +1419,7 @@ static int __devinit ks8851_probe(struct spi_device *spi)
         struct net_device *ndev;
         struct ks8851_net *ks;
         int ret;
+        unsigned cider;
 
         ndev = alloc_etherdev(sizeof(struct ks8851_net));
         if (!ndev)
@@ -1484,8 +1486,8 @@ static int __devinit ks8851_probe(struct spi_device *spi)
         ks8851_soft_reset(ks, GRR_GSR);
 
         /* simple check for a valid chip being connected to the bus */
-
-        if ((ks8851_rdreg16(ks, KS_CIDER) & ~CIDER_REV_MASK) != CIDER_ID) {
+        cider = ks8851_rdreg16(ks, KS_CIDER);
+        if ((cider & ~CIDER_REV_MASK) != CIDER_ID) {
                 dev_err(&spi->dev, "failed to read device ID\n");
                 ret = -ENODEV;
                 goto err_id;
@@ -1516,15 +1518,14 @@ static int __devinit ks8851_probe(struct spi_device *spi)
         }
 
         netdev_info(ndev, "revision %d, MAC %pM, IRQ %d, %s EEPROM\n",
-                    CIDER_REV_GET(ks8851_rdreg16(ks, KS_CIDER)),
-                    ndev->dev_addr, ndev->irq,
+                    CIDER_REV_GET(cider), ndev->dev_addr, ndev->irq,
                     ks->rc_ccr & CCR_EEPROM ? "has" : "no");
 
         return 0;
 
 
 err_netdev:
-        free_irq(ndev->irq, ndev);
+        free_irq(ndev->irq, ks);
 
 err_id:
 err_irq:
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index b8104d9f4081..5ffde23ac8fb 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -40,7 +40,7 @@
 #define DRV_NAME        "ks8851_mll"
 
 static u8 KS_DEFAULT_MAC_ADDRESS[] = { 0x00, 0x10, 0xA1, 0x86, 0x95, 0x11 };
-#define MAX_RECV_FRAMES                 32
+#define MAX_RECV_FRAMES                 255
 #define MAX_BUF_SIZE                    2048
 #define TX_BUF_SIZE                     2000
 #define RX_BUF_SIZE                     2000
diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
index ef723b185d85..eaf9ff0262a9 100644
--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
@@ -5675,7 +5675,7 @@ static int netdev_set_mac_address(struct net_device *dev, void *addr)
                 memcpy(hw->override_addr, mac->sa_data, ETH_ALEN);
         }
 
-        memcpy(dev->dev_addr, mac->sa_data, MAX_ADDR_LEN);
+        memcpy(dev->dev_addr, mac->sa_data, ETH_ALEN);
 
         interrupt = hw_block_intr(hw);
 
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index abc79076f867..b3287c0fe279 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -958,6 +958,11 @@ static inline void cp_start_hw (struct cp_private *cp)
         cpw8(Cmd, RxOn | TxOn);
 }
 
+static void cp_enable_irq(struct cp_private *cp)
+{
+        cpw16_f(IntrMask, cp_intr_mask);
+}
+
 static void cp_init_hw (struct cp_private *cp)
 {
         struct net_device *dev = cp->dev;
@@ -997,8 +1002,6 @@ static void cp_init_hw (struct cp_private *cp)
 
         cpw16(MultiIntr, 0);
 
-        cpw16_f(IntrMask, cp_intr_mask);
-
         cpw8_f(Cfg9346, Cfg9346_Lock);
 }
 
@@ -1130,6 +1133,8 @@ static int cp_open (struct net_device *dev)
         if (rc)
                 goto err_out_hw;
 
+        cp_enable_irq(cp);
+
         netif_carrier_off(dev);
         mii_check_media(&cp->mii_if, netif_msg_link(cp), true);
         netif_start_queue(dev);
@@ -2031,6 +2036,7 @@ static int cp_resume (struct pci_dev *pdev)
         /* FIXME: sh*t may happen if the Rx ring buffer is depleted */
         cp_init_rings_index (cp);
         cp_init_hw (cp);
+        cp_enable_irq(cp);
         netif_start_queue (dev);
 
         spin_lock_irqsave (&cp->lock, flags);
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index 4a6971027076..cd3defb11ffb 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -1166,10 +1166,8 @@ smsc911x_rx_counterrors(struct net_device *dev, unsigned int rxstat)
 
 /* Quickly dumps bad packets */
 static void
-smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktbytes)
+smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktwords)
 {
-        unsigned int pktwords = (pktbytes + NET_IP_ALIGN + 3) >> 2;
-
         if (likely(pktwords >= 4)) {
                 unsigned int timeout = 500;
                 unsigned int val;
@@ -1233,7 +1231,7 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
                         continue;
                 }
 
-                skb = netdev_alloc_skb(dev, pktlength + NET_IP_ALIGN);
+                skb = netdev_alloc_skb(dev, pktwords << 2);
                 if (unlikely(!skb)) {
                         SMSC_WARN(pdata, rx_err,
                                   "Unable to allocate skb for rx packet");
@@ -1243,14 +1241,12 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
                         break;
                 }
 
-                skb->data = skb->head;
-                skb_reset_tail_pointer(skb);
+                pdata->ops->rx_readfifo(pdata,
+                                 (unsigned int *)skb->data, pktwords);
 
                 /* Align IP on 16B boundary */
                 skb_reserve(skb, NET_IP_ALIGN);
                 skb_put(skb, pktlength - 4);
-                pdata->ops->rx_readfifo(pdata,
-                                 (unsigned int *)skb->head, pktwords);
                 skb->protocol = eth_type_trans(skb, dev);
                 skb_checksum_none_assert(skb);
                 netif_receive_skb(skb);
@@ -1565,7 +1561,7 @@ static int smsc911x_open(struct net_device *dev)
         smsc911x_reg_write(pdata, FIFO_INT, temp);
 
         /* set RX Data offset to 2 bytes for alignment */
-        smsc911x_reg_write(pdata, RX_CFG, (2 << 8));
+        smsc911x_reg_write(pdata, RX_CFG, (NET_IP_ALIGN << 8));
 
         /* enable NAPI polling before enabling RX interrupts */
         napi_enable(&pdata->napi);
@@ -2382,7 +2378,6 @@ static int __devinit smsc911x_drv_probe(struct platform_device *pdev)
         SET_NETDEV_DEV(dev, &pdev->dev);
 
         pdata = netdev_priv(dev);
-
         dev->irq = irq_res->start;
         irq_flags = irq_res->flags & IRQF_TRIGGER_MASK;
         pdata->ioaddr = ioremap_nocache(res->start, res_size);
@@ -2446,7 +2441,7 @@ static int __devinit smsc911x_drv_probe(struct platform_device *pdev)
         if (retval) {
                 SMSC_WARN(pdata, probe,
                           "Unable to claim requested irq: %d", dev->irq);
-                goto out_free_irq;
+                goto out_disable_resources;
         }
 
         retval = register_netdev(dev);
diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
index 558409ff4058..4ba969096717 100644
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -2339,7 +2339,7 @@ static int gem_suspend(struct pci_dev *pdev, pm_message_t state)
         netif_device_detach(dev);
 
         /* Switch off chip, remember WOL setting */
-        gp->asleep_wol = gp->wake_on_lan;
+        gp->asleep_wol = !!gp->wake_on_lan;
         gem_do_stop(dev, gp->asleep_wol);
 
         /* Unlock the network stack */
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 174a3348f676..08aff1a2087c 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1511,7 +1511,7 @@ static int emac_devioctl(struct net_device *ndev, struct ifreq *ifrq, int cmd)
 
 static int match_first_device(struct device *dev, void *data)
 {
-        return 1;
+        return !strncmp(dev_name(dev), "davinci_mdio", 12);
 }
 
 /**
diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c
index 2757c7d6e633..e4e47088e26b 100644
--- a/drivers/net/ethernet/ti/davinci_mdio.c
+++ b/drivers/net/ethernet/ti/davinci_mdio.c
@@ -181,6 +181,11 @@ static inline int wait_for_user_access(struct davinci_mdio_data *data)
                 __davinci_mdio_reset(data);
                 return -EAGAIN;
         }
+
+        reg = __raw_readl(&regs->user[0].access);
+        if ((reg & USERACCESS_GO) == 0)
+                return 0;
+
         dev_err(data->dev, "timed out waiting for user access\n");
         return -ETIMEDOUT;
 }
diff --git a/drivers/net/ethernet/ti/tlan.c b/drivers/net/ethernet/ti/tlan.c
index 817ad3bc4957..efd36691ce54 100644
--- a/drivers/net/ethernet/ti/tlan.c
+++ b/drivers/net/ethernet/ti/tlan.c
@@ -228,7 +228,7 @@ tlan_get_skb(const struct tlan_list *tag)
         unsigned long addr;
 
         addr = tag->buffer[9].address;
-        addr |= (tag->buffer[8].address << 16) << 16;
+        addr |= ((unsigned long) tag->buffer[8].address << 16) << 16;
         return (struct sk_buff *) addr;
 }
 
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet.h b/drivers/net/ethernet/xilinx/xilinx_axienet.h
index cc83af083fd7..44b8d2bad8c3 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet.h
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet.h
@@ -2,9 +2,7 @@
  * Definitions for Xilinx Axi Ethernet device driver.
  *
  * Copyright (c) 2009 Secret Lab Technologies, Ltd.
- * Copyright (c) 2010 Xilinx, Inc. All rights reserved.
- * Copyright (c) 2012 Daniel Borkmann, <daniel.borkmann@tik.ee.ethz.ch>
- * Copyright (c) 2012 Ariane Keller, <ariane.keller@tik.ee.ethz.ch>
+ * Copyright (c) 2010 - 2012 Xilinx, Inc. All rights reserved.
  */
 
 #ifndef XILINX_AXIENET_H
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 2fcbeba6814b..9c365e192a31 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -4,9 +4,9 @@
  * Copyright (c) 2008 Nissin Systems Co., Ltd.,  Yoshio Kashiwagi
  * Copyright (c) 2005-2008 DLA Systems,  David H. Lynch Jr. <dhlii@dlasys.net>
  * Copyright (c) 2008-2009 Secret Lab Technologies Ltd.
- * Copyright (c) 2010 Xilinx, Inc. All rights reserved.
- * Copyright (c) 2012 Daniel Borkmann, <daniel.borkmann@tik.ee.ethz.ch>
- * Copyright (c) 2012 Ariane Keller, <ariane.keller@tik.ee.ethz.ch>
+ * Copyright (c) 2010 - 2011 Michal Simek <monstr@monstr.eu>
+ * Copyright (c) 2010 - 2011 PetaLogix
+ * Copyright (c) 2010 - 2012 Xilinx, Inc. All rights reserved.
  *
  * This is a driver for the Xilinx Axi Ethernet which is used in the Virtex6
  * and Spartan6.
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
index d70b6e79f6c0..e90e1f46121e 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c
@@ -2,9 +2,9 @@
  * MDIO bus driver for the Xilinx Axi Ethernet device
  *
  * Copyright (c) 2009 Secret Lab Technologies, Ltd.
- * Copyright (c) 2010 Xilinx, Inc. All rights reserved.
- * Copyright (c) 2012 Daniel Borkmann, <daniel.borkmann@tik.ee.ethz.ch>
- * Copyright (c) 2012 Ariane Keller, <ariane.keller@tik.ee.ethz.ch>
+ * Copyright (c) 2010 - 2011 Michal Simek <monstr@monstr.eu>
+ * Copyright (c) 2010 - 2011 PetaLogix
+ * Copyright (c) 2010 - 2012 Xilinx, Inc. All rights reserved.
  */
 
 #include <linux/of_address.h>
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index dd294783b5c5..2d59138db7f3 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -44,6 +44,7 @@ struct net_device_context {
         /* point back to our device context */
         struct hv_device *device_ctx;
         struct delayed_work dwork;
+        struct work_struct work;
 };
 
 
@@ -51,30 +52,22 @@ static int ring_size = 128;
 module_param(ring_size, int, S_IRUGO);
 MODULE_PARM_DESC(ring_size, "Ring buffer size (# of pages)");
 
-struct set_multicast_work {
-        struct work_struct work;
-        struct net_device *net;
-};
-
 static void do_set_multicast(struct work_struct *w)
 {
-        struct set_multicast_work *swk =
-                container_of(w, struct set_multicast_work, work);
-        struct net_device *net = swk->net;
-
-        struct net_device_context *ndevctx = netdev_priv(net);
+        struct net_device_context *ndevctx =
+                container_of(w, struct net_device_context, work);
         struct netvsc_device *nvdev;
         struct rndis_device *rdev;
 
         nvdev = hv_get_drvdata(ndevctx->device_ctx);
-        if (nvdev == NULL)
-                goto out;
+        if (nvdev == NULL || nvdev->ndev == NULL)
+                return;
 
         rdev = nvdev->extension;
         if (rdev == NULL)
-                goto out;
+                return;
 
-        if (net->flags & IFF_PROMISC)
+        if (nvdev->ndev->flags & IFF_PROMISC)
                 rndis_filter_set_packet_filter(rdev,
                         NDIS_PACKET_TYPE_PROMISCUOUS);
         else
@@ -82,21 +75,13 @@ static void do_set_multicast(struct work_struct *w)
                         NDIS_PACKET_TYPE_BROADCAST |
                         NDIS_PACKET_TYPE_ALL_MULTICAST |
                         NDIS_PACKET_TYPE_DIRECTED);
-
-out:
-        kfree(w);
 }
 
 static void netvsc_set_multicast_list(struct net_device *net)
 {
-        struct set_multicast_work *swk =
-                kmalloc(sizeof(struct set_multicast_work), GFP_ATOMIC);
-        if (swk == NULL)
-                return;
+        struct net_device_context *net_device_ctx = netdev_priv(net);
 
-        swk->net = net;
-        INIT_WORK(&swk->work, do_set_multicast);
-        schedule_work(&swk->work);
+        schedule_work(&net_device_ctx->work);
 }
 
 static int netvsc_open(struct net_device *net)
@@ -125,6 +110,8 @@ static int netvsc_close(struct net_device *net)
 
         netif_tx_disable(net);
 
+        /* Make sure netvsc_set_multicast_list doesn't re-enable filter! */
+        cancel_work_sync(&net_device_ctx->work);
         ret = rndis_filter_close(device_obj);
         if (ret != 0)
                 netdev_err(net, "unable to close device (ret %d).\n", ret);
@@ -335,6 +322,7 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
 
         nvdev->start_remove = true;
         cancel_delayed_work_sync(&ndevctx->dwork);
+        cancel_work_sync(&ndevctx->work);
         netif_tx_disable(ndev);
         rndis_filter_device_remove(hdev);
 
@@ -403,6 +391,7 @@ static int netvsc_probe(struct hv_device *dev,
         net_device_ctx->device_ctx = dev;
         hv_set_drvdata(dev, net);
         INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_send_garp);
+        INIT_WORK(&net_device_ctx->work, do_set_multicast);
 
         net->netdev_ops = &device_ops;
 
@@ -456,6 +445,7 @@ static int netvsc_remove(struct hv_device *dev)
 
         ndev_ctx = netdev_priv(net);
         cancel_delayed_work_sync(&ndev_ctx->dwork);
+        cancel_work_sync(&ndev_ctx->work);
 
         /* Stop outbound asap */
         netif_tx_disable(net);
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index f08c85acf761..5ac46f5226f3 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -40,6 +40,7 @@ MODULE_LICENSE("GPL");
 #define IP1001_PHASE_SEL_MASK           3       /* IP1001 RX/TXPHASE_SEL */
 #define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
 #define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
+#define IP101A_G_IRQ_CONF_STATUS        0x11    /* Conf Info IRQ & Status Reg */
 
 static int ip175c_config_init(struct phy_device *phydev)
 {
@@ -185,6 +186,15 @@ static int ip175c_config_aneg(struct phy_device *phydev)
         return 0;
 }
 
+static int ip101a_g_ack_interrupt(struct phy_device *phydev)
+{
+        int err = phy_read(phydev, IP101A_G_IRQ_CONF_STATUS);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
 static struct phy_driver ip175c_driver = {
         .phy_id         = 0x02430d80,
         .name           = "ICPlus IP175C",
@@ -204,7 +214,6 @@ static struct phy_driver ip1001_driver = {
         .phy_id_mask    = 0x0ffffff0,
         .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
-        .flags          = PHY_HAS_INTERRUPT,
         .config_init    = &ip1001_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
@@ -220,6 +229,7 @@ static struct phy_driver ip101a_g_driver = {
         .features       = PHY_BASIC_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
         .flags          = PHY_HAS_INTERRUPT,
+        .ack_interrupt  = ip101a_g_ack_interrupt,
         .config_init    = &ip101a_g_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 33f8c51968b6..21d7151fb0ab 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -235,7 +235,7 @@ struct ppp_net {
 /* Prototypes. */
 static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
                         struct file *file, unsigned int cmd, unsigned long arg);
-static int ppp_xmit_process(struct ppp *ppp);
+static void ppp_xmit_process(struct ppp *ppp);
 static void ppp_send_frame(struct ppp *ppp, struct sk_buff *skb);
 static void ppp_push(struct ppp *ppp);
 static void ppp_channel_push(struct channel *pch);
@@ -969,8 +969,7 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev)
         put_unaligned_be16(proto, pp);
 
         skb_queue_tail(&ppp->file.xq, skb);
-        if (!ppp_xmit_process(ppp))
-                netif_stop_queue(dev);
+        ppp_xmit_process(ppp);
         return NETDEV_TX_OK;
 
  outf:
@@ -1048,11 +1047,10 @@ static void ppp_setup(struct net_device *dev)
  * Called to do any work queued up on the transmit side
  * that can now be done.
  */
-static int
+static void
 ppp_xmit_process(struct ppp *ppp)
 {
         struct sk_buff *skb;
-        int ret = 0;
 
         ppp_xmit_lock(ppp);
         if (!ppp->closing) {
@@ -1062,13 +1060,12 @@ ppp_xmit_process(struct ppp *ppp)
                         ppp_send_frame(ppp, skb);
                 /* If there's no work left to do, tell the core net
                    code that we can accept some more. */
-                if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq)) {
+                if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq))
                         netif_wake_queue(ppp->dev);
-                        ret = 1;
-                }
+                else
+                        netif_stop_queue(ppp->dev);
         }
         ppp_xmit_unlock(ppp);
-        return ret;
 }
 
 static inline struct sk_buff *
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 5ee032cafade..42b5151aa78a 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -355,7 +355,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
         u32 packet_len;
         u32 padbytes = 0xffff0000;
 
-        padlen = ((skb->len + 4) % 512) ? 0 : 4;
+        padlen = ((skb->len + 4) & (dev->maxpacket - 1)) ? 0 : 4;
 
         if ((!skb_cloned(skb)) &&
             ((headroom + tailroom) >= (4 + padlen))) {
@@ -377,7 +377,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
         cpu_to_le32s(&packet_len);
         skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
 
-        if ((skb->len % 512) == 0) {
+        if (padlen) {
                 cpu_to_le32s(&padbytes);
                 memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
                 skb_put(skb, sizeof(padbytes));
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 552d24bf862e..d316503b35d4 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -365,6 +365,27 @@ static const struct driver_info	qmi_wwan_force_int4 = {
         .data           = BIT(4), /* interface whitelist bitmap */
 };
 
+/* Sierra Wireless provide equally useless interface descriptors
+ * Devices in QMI mode can be switched between two different
+ * configurations:
+ *   a) USB interface #8 is QMI/wwan
+ *   b) USB interfaces #8, #19 and #20 are QMI/wwan
+ *
+ * Both configurations provide a number of other interfaces (serial++),
+ * some of which have the same endpoint configuration as we expect, so
+ * a whitelist or blacklist is necessary.
+ *
+ * FIXME: The below whitelist should include BIT(20).  It does not
+ * because I cannot get it to work...
+ */
+static const struct driver_info qmi_wwan_sierra = {
+        .description    = "Sierra Wireless wwan/QMI device",
+        .flags          = FLAG_WWAN,
+        .bind           = qmi_wwan_bind_gobi,
+        .unbind         = qmi_wwan_unbind_shared,
+        .manage_power   = qmi_wwan_manage_power,
+        .data           = BIT(8) | BIT(19), /* interface whitelist bitmap */
+};
 
 #define HUAWEI_VENDOR_ID        0x12D1
 #define QMI_GOBI_DEVICE(vend, prod) \
@@ -445,6 +466,15 @@ static const struct usb_device_id products[] = {
                 .bInterfaceProtocol = 0xff,
                 .driver_info        = (unsigned long)&qmi_wwan_force_int4,
         },
+        {       /* Sierra Wireless MC77xx in QMI mode */
+                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = 0x1199,
+                .idProduct          = 0x68a2,
+                .bInterfaceClass    = 0xff,
+                .bInterfaceSubClass = 0xff,
+                .bInterfaceProtocol = 0xff,
+                .driver_info        = (unsigned long)&qmi_wwan_sierra,
+        },
         {QMI_GOBI_DEVICE(0x05c6, 0x9212)},      /* Acer Gobi Modem Device */
         {QMI_GOBI_DEVICE(0x03f0, 0x1f1d)},      /* HP un2400 Gobi Modem Device */
         {QMI_GOBI_DEVICE(0x03f0, 0x371d)},      /* HP un2430 Mobile Broadband Module */
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 187d01ccb973..00103a8c5e04 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -98,7 +98,7 @@ static int __must_check smsc75xx_read_reg(struct usbnet *dev, u32 index,
 
         if (unlikely(ret < 0))
                 netdev_warn(dev->net,
-                        "Failed to read register index 0x%08x", index);
+                        "Failed to read reg index 0x%08x: %d", index, ret);
 
         le32_to_cpus(buf);
         *data = *buf;
@@ -128,7 +128,7 @@ static int __must_check smsc75xx_write_reg(struct usbnet *dev, u32 index,
 
         if (unlikely(ret < 0))
                 netdev_warn(dev->net,
-                        "Failed to write register index 0x%08x", index);
+                        "Failed to write reg index 0x%08x: %d", index, ret);
 
         kfree(buf);
 
@@ -171,7 +171,7 @@ static int smsc75xx_mdio_read(struct net_device *netdev, int phy_id, int idx)
         idx &= dev->mii.reg_num_mask;
         addr = ((phy_id << MII_ACCESS_PHY_ADDR_SHIFT) & MII_ACCESS_PHY_ADDR)
                 | ((idx << MII_ACCESS_REG_ADDR_SHIFT) & MII_ACCESS_REG_ADDR)
-                | MII_ACCESS_READ;
+                | MII_ACCESS_READ | MII_ACCESS_BUSY;
         ret = smsc75xx_write_reg(dev, MII_ACCESS, addr);
         check_warn_goto_done(ret, "Error writing MII_ACCESS");
 
@@ -210,7 +210,7 @@ static void smsc75xx_mdio_write(struct net_device *netdev, int phy_id, int idx,
         idx &= dev->mii.reg_num_mask;
         addr = ((phy_id << MII_ACCESS_PHY_ADDR_SHIFT) & MII_ACCESS_PHY_ADDR)
                 | ((idx << MII_ACCESS_REG_ADDR_SHIFT) & MII_ACCESS_REG_ADDR)
-                | MII_ACCESS_WRITE;
+                | MII_ACCESS_WRITE | MII_ACCESS_BUSY;
         ret = smsc75xx_write_reg(dev, MII_ACCESS, addr);
         check_warn_goto_done(ret, "Error writing MII_ACCESS");
 
@@ -508,9 +508,10 @@ static int smsc75xx_link_reset(struct usbnet *dev)
         u16 lcladv, rmtadv;
         int ret;
 
-        /* clear interrupt status */
+        /* read and write to clear phy interrupt status */
         ret = smsc75xx_mdio_read(dev->net, mii->phy_id, PHY_INT_SRC);
         check_warn_return(ret, "Error reading PHY_INT_SRC");
+        smsc75xx_mdio_write(dev->net, mii->phy_id, PHY_INT_SRC, 0xffff);
 
         ret = smsc75xx_write_reg(dev, INT_STS, INT_STS_CLEAR_ALL);
         check_warn_return(ret, "Error writing INT_STS");
@@ -643,7 +644,7 @@ static int smsc75xx_set_mac_address(struct usbnet *dev)
 
 static int smsc75xx_phy_initialize(struct usbnet *dev)
 {
-        int bmcr, timeout = 0;
+        int bmcr, ret, timeout = 0;
 
         /* Initialize MII structure */
         dev->mii.dev = dev->net;
@@ -651,6 +652,7 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
         dev->mii.mdio_write = smsc75xx_mdio_write;
         dev->mii.phy_id_mask = 0x1f;
         dev->mii.reg_num_mask = 0x1f;
+        dev->mii.supports_gmii = 1;
         dev->mii.phy_id = SMSC75XX_INTERNAL_PHY_ID;
 
         /* reset phy and wait for reset to complete */
@@ -661,7 +663,7 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
                 bmcr = smsc75xx_mdio_read(dev->net, dev->mii.phy_id, MII_BMCR);
                 check_warn_return(bmcr, "Error reading MII_BMCR");
                 timeout++;
-        } while ((bmcr & MII_BMCR) && (timeout < 100));
+        } while ((bmcr & BMCR_RESET) && (timeout < 100));
 
         if (timeout >= 100) {
                 netdev_warn(dev->net, "timeout on PHY Reset");
@@ -671,10 +673,13 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
         smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
                 ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
                 ADVERTISE_PAUSE_ASYM);
+        smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_CTRL1000,
+                ADVERTISE_1000FULL);
 
-        /* read to clear */
-        smsc75xx_mdio_read(dev->net, dev->mii.phy_id, PHY_INT_SRC);
-        check_warn_return(bmcr, "Error reading PHY_INT_SRC");
+        /* read and write to clear phy interrupt status */
+        ret = smsc75xx_mdio_read(dev->net, dev->mii.phy_id, PHY_INT_SRC);
+        check_warn_return(ret, "Error reading PHY_INT_SRC");
+        smsc75xx_mdio_write(dev->net, dev->mii.phy_id, PHY_INT_SRC, 0xffff);
 
         smsc75xx_mdio_write(dev->net, dev->mii.phy_id, PHY_INT_MASK,
                 PHY_INT_MASK_DEFAULT);
@@ -946,6 +951,14 @@ static int smsc75xx_reset(struct usbnet *dev)
         ret = smsc75xx_write_reg(dev, INT_EP_CTL, buf);
         check_warn_return(ret, "Failed to write INT_EP_CTL: %d", ret);
 
+        /* allow mac to detect speed and duplex from phy */
+        ret = smsc75xx_read_reg(dev, MAC_CR, &buf);
+        check_warn_return(ret, "Failed to read MAC_CR: %d", ret);
+
+        buf |= (MAC_CR_ADD | MAC_CR_ASD);
+        ret = smsc75xx_write_reg(dev, MAC_CR, buf);
+        check_warn_return(ret, "Failed to write MAC_CR: %d", ret);
+
         ret = smsc75xx_read_reg(dev, MAC_TX, &buf);
         check_warn_return(ret, "Failed to read MAC_TX: %d", ret);
 
@@ -1051,6 +1064,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->net->ethtool_ops = &smsc75xx_ethtool_ops;
         dev->net->flags |= IFF_MULTICAST;
         dev->net->hard_header_len += SMSC75XX_TX_OVERHEAD;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
         return 0;
 }
 
@@ -1211,7 +1225,7 @@ static const struct driver_info smsc75xx_info = {
         .rx_fixup       = smsc75xx_rx_fixup,
         .tx_fixup       = smsc75xx_tx_fixup,
         .status         = smsc75xx_status,
-        .flags          = FLAG_ETHER | FLAG_SEND_ZLP,
+        .flags          = FLAG_ETHER | FLAG_SEND_ZLP | FLAG_LINK_INTR,
 };
 
 static const struct usb_device_id products[] = {
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 5f19f84d3494..94ae66999f59 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1017,6 +1017,7 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->net->ethtool_ops = &smsc95xx_ethtool_ops;
         dev->net->flags |= IFF_MULTICAST;
         dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
         return 0;
 }
 
@@ -1191,7 +1192,7 @@ static const struct driver_info smsc95xx_info = {
         .rx_fixup       = smsc95xx_rx_fixup,
         .tx_fixup       = smsc95xx_tx_fixup,
         .status         = smsc95xx_status,
-        .flags          = FLAG_ETHER | FLAG_SEND_ZLP,
+        .flags          = FLAG_ETHER | FLAG_SEND_ZLP | FLAG_LINK_INTR,
 };
 
 static const struct usb_device_id products[] = {
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index b7b3f5b0d406..2d927fb4adf4 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -210,6 +210,7 @@ static int init_status (struct usbnet *dev, struct usb_interface *intf)
                 } else {
                         usb_fill_int_urb(dev->interrupt, dev->udev, pipe,
                                 buf, maxp, intr_complete, dev, period);
+                        dev->interrupt->transfer_flags |= URB_FREE_BUFFER;
                         dev_dbg(&intf->dev,
                                 "status ep%din, %d bytes period %d\n",
                                 usb_pipeendpoint(pipe), maxp, period);
@@ -1443,7 +1444,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 
         status = register_netdev (net);
         if (status)
-                goto out3;
+                goto out4;
         netif_info(dev, probe, dev->net,
                    "register '%s' at usb-%s-%s, %s, %pM\n",
                    udev->dev.driver->name,
@@ -1461,6 +1462,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 
         return 0;
 
+out4:
+        usb_free_urb(dev->interrupt);
 out3:
         if (info->unbind)
                 info->unbind (dev, udev);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 4de2760c5937..af8acc85f4bb 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -626,16 +626,15 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* This can happen with OOM and indirect buffers. */
         if (unlikely(capacity < 0)) {
                 if (likely(capacity == -ENOMEM)) {
-                        if (net_ratelimit()) {
+                        if (net_ratelimit())
                                 dev_warn(&dev->dev,
                                          "TX queue failure: out of memory\n");
-                        } else {
+                } else {
                         dev->stats.tx_fifo_errors++;
                         if (net_ratelimit())
                                 dev_warn(&dev->dev,
                                          "Unexpected TX queue failure: %d\n",
                                          capacity);
-                        }
                 }
                 dev->stats.tx_dropped++;
                 kfree_skb(skb);
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index ebb9f24eefb5..1a623183cbe5 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -2483,6 +2483,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 pr_err("Control memory remap failed\n");
                 pci_release_regions(pdev);
                 pci_disable_device(pdev);
+                iounmap(card->mem);
                 kfree(card);
                 return -ENODEV;
         }
diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
index 8faa129da5a0..aec33cc207fd 100644
--- a/drivers/net/wireless/ath/ath5k/ahb.c
+++ b/drivers/net/wireless/ath/ath5k/ahb.c
@@ -19,6 +19,7 @@
 #include <linux/nl80211.h>
 #include <linux/platform_device.h>
 #include <linux/etherdevice.h>
+#include <linux/export.h>
 #include <ar231x_platform.h>
 #include "ath5k.h"
 #include "debug.h"
@@ -119,7 +120,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         if (res == NULL) {
                 dev_err(&pdev->dev, "no IRQ resource found\n");
                 ret = -ENXIO;
-                goto err_out;
+                goto err_iounmap;
         }
 
         irq = res->start;
@@ -128,7 +129,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         if (hw == NULL) {
                 dev_err(&pdev->dev, "no memory for ieee80211_hw\n");
                 ret = -ENOMEM;
-                goto err_out;
+                goto err_iounmap;
         }
 
         ah = hw->priv;
@@ -185,6 +186,8 @@ static int ath_ahb_probe(struct platform_device *pdev)
  err_free_hw:
         ieee80211_free_hw(hw);
         platform_set_drvdata(pdev, NULL);
+ err_iounmap:
+        iounmap(mem);
  err_out:
         return ret;
 }
@@ -217,6 +220,7 @@ static int ath_ahb_remove(struct platform_device *pdev)
         }
 
         ath5k_deinit_ah(ah);
+        iounmap(ah->iobase);
         platform_set_drvdata(pdev, NULL);
         ieee80211_free_hw(hw);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index d7d8e9199140..aba088005b22 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -869,7 +869,7 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         ar5008_hw_set_channel_regs(ah, chan);
         ar5008_hw_init_chain_masks(ah);
         ath9k_olc_init(ah);
-        ath9k_hw_apply_txpower(ah, chan);
+        ath9k_hw_apply_txpower(ah, chan, false);
 
         /* Write analog registers */
         if (!ath9k_hw_set_rf_regs(ah, chan, freqIndex)) {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 59647a3ceb7f..3d400e8d6535 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -54,7 +54,7 @@ void ar9003_paprd_enable(struct ath_hw *ah, bool val)
 
         if (val) {
                 ah->paprd_table_write_done = true;
-                ath9k_hw_apply_txpower(ah, chan);
+                ath9k_hw_apply_txpower(ah, chan, false);
         }
 
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_CTRL0_B0,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index bc992b237ae5..deb6cfb2959a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -694,7 +694,7 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
         ar9003_hw_override_ini(ah);
         ar9003_hw_set_channel_regs(ah, chan);
         ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
-        ath9k_hw_apply_txpower(ah, chan);
+        ath9k_hw_apply_txpower(ah, chan, false);
 
         if (AR_SREV_9462(ah)) {
                 if (REG_READ_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_0,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index f272236d8053..b34e8b2990b1 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -824,6 +824,8 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
                         regulatory->max_power_level = ratesArray[i];
         }
 
+        ath9k_hw_update_regulatory_maxpower(ah);
+
         if (test)
                 return;
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 6c69e4e8b1cb..fa84e37bf091 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1454,7 +1454,7 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
                 return false;
         }
         ath9k_hw_set_clockrate(ah);
-        ath9k_hw_apply_txpower(ah, chan);
+        ath9k_hw_apply_txpower(ah, chan, false);
         ath9k_hw_rfbus_done(ah);
 
         if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
@@ -2652,7 +2652,8 @@ static int get_antenna_gain(struct ath_hw *ah, struct ath9k_channel *chan)
         return ah->eep_ops->get_eeprom(ah, gain_param);
 }
 
-void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan)
+void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan,
+                            bool test)
 {
         struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
         struct ieee80211_channel *channel;
@@ -2673,7 +2674,7 @@ void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan)
 
         ah->eep_ops->set_txpower(ah, chan,
                                  ath9k_regd_get_ctl(reg, chan),
-                                 ant_reduction, new_pwr, false);
+                                 ant_reduction, new_pwr, test);
 }
 
 void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
@@ -2686,7 +2687,7 @@ void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
         if (test)
                 channel->max_power = MAX_RATE_POWER / 2;
 
-        ath9k_hw_apply_txpower(ah, chan);
+        ath9k_hw_apply_txpower(ah, chan, test);
 
         if (test)
                 channel->max_power = DIV_ROUND_UP(reg->max_power_level, 2);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index aa1680a0c7fd..e88f182ff45c 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -985,7 +985,8 @@ void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len);
 /* PHY */
 void ath9k_hw_get_delta_slope_vals(struct ath_hw *ah, u32 coef_scaled,
                                    u32 *coef_mantissa, u32 *coef_exponent);
-void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan);
+void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan,
+                            bool test);
 
 /*
  * Code Specific to AR5008, AR9001 or AR9002,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 215eb2536b1e..798ea57252b4 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -118,15 +118,13 @@ void ath9k_ps_restore(struct ath_softc *sc)
         if (--sc->ps_usecount != 0)
                 goto unlock;
 
-        if (sc->ps_flags & PS_WAIT_FOR_TX_ACK)
-                goto unlock;
-
-        if (sc->ps_idle)
+        if (sc->ps_idle && (sc->ps_flags & PS_WAIT_FOR_TX_ACK))
                 mode = ATH9K_PM_FULL_SLEEP;
         else if (sc->ps_enabled &&
                  !(sc->ps_flags & (PS_WAIT_FOR_BEACON |
                               PS_WAIT_FOR_CAB |
-                              PS_WAIT_FOR_PSPOLL_DATA)))
+                              PS_WAIT_FOR_PSPOLL_DATA |
+                              PS_WAIT_FOR_TX_ACK)))
                 mode = ATH9K_PM_NETWORK_SLEEP;
         else
                 goto unlock;
@@ -1550,6 +1548,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_conf *conf = &hw->conf;
+        bool reset_channel = false;
 
         ath9k_ps_wakeup(sc);
         mutex_lock(&sc->mutex);
@@ -1558,6 +1557,12 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 sc->ps_idle = !!(conf->flags & IEEE80211_CONF_IDLE);
                 if (sc->ps_idle)
                         ath_cancel_work(sc);
+                else
+                        /*
+                         * The chip needs a reset to properly wake up from
+                         * full sleep
+                         */
+                        reset_channel = ah->chip_fullsleep;
         }
 
         /*
@@ -1586,7 +1591,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
-        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+        if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) || reset_channel) {
                 struct ieee80211_channel *curchan = hw->conf.channel;
                 int pos = curchan->hw_value;
                 int old_pos = -1;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 834e6bc45e8b..23eaa1b26ebe 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1820,6 +1820,7 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
         struct ath_frame_info *fi = get_frame_info(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ath_buf *bf;
+        int fragno;
         u16 seqno;
 
         bf = ath_tx_get_buffer(sc);
@@ -1831,9 +1832,16 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
         ATH_TXBUF_RESET(bf);
 
         if (tid) {
+                fragno = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
                 seqno = tid->seq_next;
                 hdr->seq_ctrl = cpu_to_le16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
-                INCR(tid->seq_next, IEEE80211_SEQ_MAX);
+
+                if (fragno)
+                        hdr->seq_ctrl |= cpu_to_le16(fragno);
+
+                if (!ieee80211_has_morefrags(hdr->frame_control))
+                        INCR(tid->seq_next, IEEE80211_SEQ_MAX);
+
                 bf->bf_state.seqno = seqno;
         }
 
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index c79e6638c88d..e4d6dc2e37d1 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4827,8 +4827,14 @@ static int b43_op_start(struct ieee80211_hw *hw)
  out_mutex_unlock:
         mutex_unlock(&wl->mutex);
 
-        /* reload configuration */
-        b43_op_config(hw, ~0);
+        /*
+         * Configuration may have been overwritten during initialization.
+         * Reload the configuration, but only if initialization was
+         * successful. Reloading the configuration after a failed init
+         * may hang the system.
+         */
+        if (!err)
+                b43_op_config(hw, ~0);
 
         return err;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 4688904908ec..758c115b556e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -108,9 +108,15 @@ static inline int brcmf_sdioh_f0_write_byte(struct brcmf_sdio_dev *sdiodev,
                         sdio_release_host(sdfunc);
                 }
         } else if (regaddr == SDIO_CCCR_ABORT) {
+                sdfunc = kmemdup(sdiodev->func[0], sizeof(struct sdio_func),
+                                 GFP_KERNEL);
+                if (!sdfunc)
+                        return -ENOMEM;
+                sdfunc->num = 0;
                 sdio_claim_host(sdfunc);
                 sdio_writeb(sdfunc, *byte, regaddr, &err_ret);
                 sdio_release_host(sdfunc);
+                kfree(sdfunc);
         } else if (regaddr < 0xF0) {
                 brcmf_dbg(ERROR, "F0 Wr:0x%02x: write disallowed\n", regaddr);
                 err_ret = -EPERM;
@@ -486,7 +492,7 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
                         kfree(bus_if);
                         return -ENOMEM;
                 }
-                sdiodev->func[0] = func->card->sdio_func[0];
+                sdiodev->func[0] = func;
                 sdiodev->func[1] = func;
                 sdiodev->bus_if = bus_if;
                 bus_if->bus_priv.sdio = sdiodev;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 2bf5dda29291..eb3829b03cd3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -574,6 +574,8 @@ struct brcmf_sdio {
 
         struct task_struct *dpc_tsk;
         struct completion dpc_wait;
+        struct list_head dpc_tsklst;
+        spinlock_t dpc_tl_lock;
 
         struct semaphore sdsem;
 
@@ -2594,29 +2596,58 @@ clkwait:
         return resched;
 }
 
+static inline void brcmf_sdbrcm_adddpctsk(struct brcmf_sdio *bus)
+{
+        struct list_head *new_hd;
+        unsigned long flags;
+
+        if (in_interrupt())
+                new_hd = kzalloc(sizeof(struct list_head), GFP_ATOMIC);
+        else
+                new_hd = kzalloc(sizeof(struct list_head), GFP_KERNEL);
+        if (new_hd == NULL)
+                return;
+
+        spin_lock_irqsave(&bus->dpc_tl_lock, flags);
+        list_add_tail(new_hd, &bus->dpc_tsklst);
+        spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
+}
+
 static int brcmf_sdbrcm_dpc_thread(void *data)
 {
         struct brcmf_sdio *bus = (struct brcmf_sdio *) data;
+        struct list_head *cur_hd, *tmp_hd;
+        unsigned long flags;
 
         allow_signal(SIGTERM);
         /* Run until signal received */
         while (1) {
                 if (kthread_should_stop())
                         break;
-                if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
-                        /* Call bus dpc unless it indicated down
-                        (then clean stop) */
-                        if (bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN) {
-                                if (brcmf_sdbrcm_dpc(bus))
-                                        complete(&bus->dpc_wait);
-                        } else {
+
+                if (list_empty(&bus->dpc_tsklst))
+                        if (wait_for_completion_interruptible(&bus->dpc_wait))
+                                break;
+
+                spin_lock_irqsave(&bus->dpc_tl_lock, flags);
+                list_for_each_safe(cur_hd, tmp_hd, &bus->dpc_tsklst) {
+                        spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
+
+                        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
                                 /* after stopping the bus, exit thread */
                                 brcmf_sdbrcm_bus_stop(bus->sdiodev->dev);
                                 bus->dpc_tsk = NULL;
                                 break;
                         }
-                } else
-                        break;
+
+                        if (brcmf_sdbrcm_dpc(bus))
+                                brcmf_sdbrcm_adddpctsk(bus);
+
+                        spin_lock_irqsave(&bus->dpc_tl_lock, flags);
+                        list_del(cur_hd);
+                        kfree(cur_hd);
+                }
+                spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
         }
         return 0;
 }
@@ -2669,8 +2700,10 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
         /* Schedule DPC if needed to send queued packet(s) */
         if (!bus->dpc_sched) {
                 bus->dpc_sched = true;
-                if (bus->dpc_tsk)
+                if (bus->dpc_tsk) {
+                        brcmf_sdbrcm_adddpctsk(bus);
                         complete(&bus->dpc_wait);
+                }
         }
 
         return ret;
@@ -3514,8 +3547,10 @@ void brcmf_sdbrcm_isr(void *arg)
                 brcmf_dbg(ERROR, "isr w/o interrupt configured!\n");
 
         bus->dpc_sched = true;
-        if (bus->dpc_tsk)
+        if (bus->dpc_tsk) {
+                brcmf_sdbrcm_adddpctsk(bus);
                 complete(&bus->dpc_wait);
+        }
 }
 
 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
@@ -3559,8 +3594,10 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                                 bus->ipend = true;
 
                                 bus->dpc_sched = true;
-                                if (bus->dpc_tsk)
+                                if (bus->dpc_tsk) {
+                                        brcmf_sdbrcm_adddpctsk(bus);
                                         complete(&bus->dpc_wait);
+                                }
                         }
                 }
 
@@ -3897,6 +3934,8 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         }
         /* Initialize DPC thread */
         init_completion(&bus->dpc_wait);
+        INIT_LIST_HEAD(&bus->dpc_tsklst);
+        spin_lock_init(&bus->dpc_tl_lock);
         bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
                                    bus, "brcmf_dpc");
         if (IS_ERR(bus->dpc_tsk)) {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 231ddf4a674f..b4d92792c502 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -847,8 +847,7 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
          */
         if (!(txs->status & TX_STATUS_AMPDU)
             && (txs->status & TX_STATUS_INTERMEDIATE)) {
-                wiphy_err(wlc->wiphy, "%s: INTERMEDIATE but not AMPDU\n",
-                          __func__);
+                BCMMSG(wlc->wiphy, "INTERMEDIATE but not AMPDU\n");
                 return false;
         }
 
@@ -7614,6 +7613,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
 {
         int len_mpdu;
         struct ieee80211_rx_status rx_status;
+        struct ieee80211_hdr *hdr;
 
         memset(&rx_status, 0, sizeof(rx_status));
         prep_mac80211_status(wlc, rxh, p, &rx_status);
@@ -7623,6 +7623,13 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
         skb_pull(p, D11_PHY_HDR_LEN);
         __skb_trim(p, len_mpdu);
 
+        /* unmute transmit */
+        if (wlc->hw->suspended_fifos) {
+                hdr = (struct ieee80211_hdr *)p->data;
+                if (ieee80211_is_beacon(hdr->frame_control))
+                        brcms_b_mute(wlc->hw, false);
+        }
+
         memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
         ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
 }
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 2b022571a859..1779db3aa2b0 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2191,6 +2191,7 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
 {
         int rc = 0;
         unsigned long flags;
+        unsigned long now, end;
 
         spin_lock_irqsave(&priv->lock, flags);
         if (priv->status & STATUS_HCMD_ACTIVE) {
@@ -2232,10 +2233,20 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
         }
         spin_unlock_irqrestore(&priv->lock, flags);
 
+        now = jiffies;
+        end = now + HOST_COMPLETE_TIMEOUT;
+again:
         rc = wait_event_interruptible_timeout(priv->wait_command_queue,
                                               !(priv->
                                                 status & STATUS_HCMD_ACTIVE),
-                                              HOST_COMPLETE_TIMEOUT);
+                                              end - now);
+        if (rc < 0) {
+                now = jiffies;
+                if (time_before(now, end))
+                        goto again;
+                rc = 0;
+        }
+
         if (rc == 0) {
                 spin_lock_irqsave(&priv->lock, flags);
                 if (priv->status & STATUS_HCMD_ACTIVE) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 5b0d888f746b..8d80e233bc7a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -46,8 +46,8 @@
 #include "iwl-prph.h"
 
 /* Highest firmware API version supported */
-#define IWL1000_UCODE_API_MAX 6
-#define IWL100_UCODE_API_MAX 6
+#define IWL1000_UCODE_API_MAX 5
+#define IWL100_UCODE_API_MAX 5
 
 /* Oldest version we won't warn about */
 #define IWL1000_UCODE_API_OK 5
@@ -226,5 +226,5 @@ const struct iwl_cfg iwl100_bg_cfg = {
         IWL_DEVICE_100,
 };
 
-MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_OK));
+MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 5635b9e2c69e..ea108622e0bd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -51,10 +51,10 @@
 #define IWL135_UCODE_API_MAX 6
 
 /* Oldest version we won't warn about */
-#define IWL2030_UCODE_API_OK 5
-#define IWL2000_UCODE_API_OK 5
-#define IWL105_UCODE_API_OK 5
-#define IWL135_UCODE_API_OK 5
+#define IWL2030_UCODE_API_OK 6
+#define IWL2000_UCODE_API_OK 6
+#define IWL105_UCODE_API_OK 6
+#define IWL135_UCODE_API_OK 6
 
 /* Lowest firmware API version supported */
 #define IWL2030_UCODE_API_MIN 5
@@ -328,7 +328,7 @@ const struct iwl_cfg iwl135_bgn_cfg = {
         .ht_params = &iwl2000_ht_params,
 };
 
-MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_OK));
+MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_OK));
+MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_OK));
+MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index a805e97b89af..de0920c74cdd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -51,6 +51,10 @@
 #define IWL5000_UCODE_API_MAX 5
 #define IWL5150_UCODE_API_MAX 2
 
+/* Oldest version we won't warn about */
+#define IWL5000_UCODE_API_OK 5
+#define IWL5150_UCODE_API_OK 2
+
 /* Lowest firmware API version supported */
 #define IWL5000_UCODE_API_MIN 1
 #define IWL5150_UCODE_API_MIN 1
@@ -326,6 +330,7 @@ static const struct iwl_ht_params iwl5000_ht_params = {
 #define IWL_DEVICE_5000                                         \
         .fw_name_pre = IWL5000_FW_PRE,                          \
         .ucode_api_max = IWL5000_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL5000_UCODE_API_OK,                   \
         .ucode_api_min = IWL5000_UCODE_API_MIN,                 \
         .max_inst_size = IWLAGN_RTC_INST_SIZE,                  \
         .max_data_size = IWLAGN_RTC_DATA_SIZE,                  \
@@ -371,6 +376,7 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .name = "Intel(R) WiMAX/WiFi Link 5350 AGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
+        .ucode_api_ok = IWL5000_UCODE_API_OK,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .max_inst_size = IWLAGN_RTC_INST_SIZE,
         .max_data_size = IWLAGN_RTC_DATA_SIZE,
@@ -386,6 +392,7 @@ const struct iwl_cfg iwl5350_agn_cfg = {
 #define IWL_DEVICE_5150                                         \
         .fw_name_pre = IWL5150_FW_PRE,                          \
         .ucode_api_max = IWL5150_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL5150_UCODE_API_OK,                   \
         .ucode_api_min = IWL5150_UCODE_API_MIN,                 \
         .max_inst_size = IWLAGN_RTC_INST_SIZE,                  \
         .max_data_size = IWLAGN_RTC_DATA_SIZE,                  \
@@ -409,5 +416,5 @@ const struct iwl_cfg iwl5150_abg_cfg = {
         IWL_DEVICE_5150,
 };
 
-MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_OK));
+MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 64060cd738b5..f0c91505a7f7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -53,6 +53,8 @@
 /* Oldest version we won't warn about */
 #define IWL6000_UCODE_API_OK 4
 #define IWL6000G2_UCODE_API_OK 5
+#define IWL6050_UCODE_API_OK 5
+#define IWL6000G2B_UCODE_API_OK 6
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
@@ -388,7 +390,7 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
 #define IWL_DEVICE_6030                                         \
         .fw_name_pre = IWL6030_FW_PRE,                          \
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,               \
-        .ucode_api_ok = IWL6000G2_UCODE_API_OK,                 \
+        .ucode_api_ok = IWL6000G2B_UCODE_API_OK,                \
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,               \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
@@ -557,6 +559,6 @@ const struct iwl_cfg iwl6000_3agn_cfg = {
 };
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_OK));
-MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_OK));
+MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_OK));
+MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2B_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index f1226dbf789d..2a9a16f901c3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -863,7 +863,6 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
 
 void iwlagn_prepare_restart(struct iwl_priv *priv)
 {
-        struct iwl_rxon_context *ctx;
         bool bt_full_concurrent;
         u8 bt_ci_compliance;
         u8 bt_load;
@@ -872,8 +871,6 @@ void iwlagn_prepare_restart(struct iwl_priv *priv)
 
         lockdep_assert_held(&priv->mutex);
 
-        for_each_context(priv, ctx)
-                ctx->vif = NULL;
         priv->is_open = 0;
 
         /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 90208094b8eb..74bce97a8600 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -104,15 +104,29 @@
  * (see struct iwl_tfd_frame).  These 16 pointer registers are offset by 0x04
  * bytes from one another.  Each TFD circular buffer in DRAM must be 256-byte
  * aligned (address bits 0-7 must be 0).
+ * Later devices have 20 (5000 series) or 30 (higher) queues, but the registers
+ * for them are in different places.
  *
  * Bit fields in each pointer register:
  *  27-0: TFD CB physical base address [35:8], must be 256-byte aligned
  */
-#define FH_MEM_CBBC_LOWER_BOUND          (FH_MEM_LOWER_BOUND + 0x9D0)
-#define FH_MEM_CBBC_UPPER_BOUND          (FH_MEM_LOWER_BOUND + 0xA10)
-
-/* Find TFD CB base pointer for given queue (range 0-15). */
-#define FH_MEM_CBBC_QUEUE(x)  (FH_MEM_CBBC_LOWER_BOUND + (x) * 0x4)
+#define FH_MEM_CBBC_0_15_LOWER_BOUND            (FH_MEM_LOWER_BOUND + 0x9D0)
+#define FH_MEM_CBBC_0_15_UPPER_BOUND            (FH_MEM_LOWER_BOUND + 0xA10)
+#define FH_MEM_CBBC_16_19_LOWER_BOUND           (FH_MEM_LOWER_BOUND + 0xBF0)
+#define FH_MEM_CBBC_16_19_UPPER_BOUND           (FH_MEM_LOWER_BOUND + 0xC00)
+#define FH_MEM_CBBC_20_31_LOWER_BOUND           (FH_MEM_LOWER_BOUND + 0xB20)
+#define FH_MEM_CBBC_20_31_UPPER_BOUND           (FH_MEM_LOWER_BOUND + 0xB80)
+
+/* Find TFD CB base pointer for given queue */
+static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl)
+{
+        if (chnl < 16)
+                return FH_MEM_CBBC_0_15_LOWER_BOUND + 4 * chnl;
+        if (chnl < 20)
+                return FH_MEM_CBBC_16_19_LOWER_BOUND + 4 * (chnl - 16);
+        WARN_ON_ONCE(chnl >= 32);
+        return FH_MEM_CBBC_20_31_LOWER_BOUND + 4 * (chnl - 20);
+}
 
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index b6805f8e9a01..c24a7134a6f9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -1244,6 +1244,7 @@ static int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
         struct iwl_rxon_context *tmp, *ctx = NULL;
         int err;
         enum nl80211_iftype viftype = ieee80211_vif_type_p2p(vif);
+        bool reset = false;
 
         IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n",
                            viftype, vif->addr);
@@ -1265,6 +1266,13 @@ static int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
                         tmp->interface_modes | tmp->exclusive_interface_modes;
 
                 if (tmp->vif) {
+                        /* On reset we need to add the same interface again */
+                        if (tmp->vif == vif) {
+                                reset = true;
+                                ctx = tmp;
+                                break;
+                        }
+
                         /* check if this busy context is exclusive */
                         if (tmp->exclusive_interface_modes &
                                                 BIT(tmp->vif->type)) {
@@ -1291,7 +1299,7 @@ static int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
         ctx->vif = vif;
 
         err = iwl_setup_interface(priv, ctx);
-        if (!err)
+        if (!err || reset)
                 goto out;
 
         ctx->vif = NULL;
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 75dc20bd965b..3b1069290fa9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -223,12 +223,33 @@
 #define SCD_AIT                 (SCD_BASE + 0x0c)
 #define SCD_TXFACT              (SCD_BASE + 0x10)
 #define SCD_ACTIVE              (SCD_BASE + 0x14)
-#define SCD_QUEUE_WRPTR(x)      (SCD_BASE + 0x18 + (x) * 4)
-#define SCD_QUEUE_RDPTR(x)      (SCD_BASE + 0x68 + (x) * 4)
 #define SCD_QUEUECHAIN_SEL      (SCD_BASE + 0xe8)
 #define SCD_AGGR_SEL            (SCD_BASE + 0x248)
 #define SCD_INTERRUPT_MASK      (SCD_BASE + 0x108)
-#define SCD_QUEUE_STATUS_BITS(x)        (SCD_BASE + 0x10c + (x) * 4)
+
+static inline unsigned int SCD_QUEUE_WRPTR(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x18 + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x284 + (chnl - 20) * 4;
+}
+
+static inline unsigned int SCD_QUEUE_RDPTR(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x68 + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x2B4 + (chnl - 20) * 4;
+}
+
+static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x10c + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x384 + (chnl - 20) * 4;
+}
 
 /*********************** END TX SCHEDULER *************************************/
 
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 3fa1ecebadfd..2fa879b015b6 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -103,7 +103,7 @@ static const u32 cipher_suites[] = {
  * Convert NL80211's auth_type to the one from Libertas, see chapter 5.9.1
  * in the firmware spec
  */
-static u8 lbs_auth_to_authtype(enum nl80211_auth_type auth_type)
+static int lbs_auth_to_authtype(enum nl80211_auth_type auth_type)
 {
         int ret = -ENOTSUPP;
 
@@ -1411,7 +1411,12 @@ static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
                 goto done;
         }
 
-        lbs_set_authtype(priv, sme);
+        ret = lbs_set_authtype(priv, sme);
+        if (ret == -ENOTSUPP) {
+                wiphy_err(wiphy, "unsupported authtype 0x%x\n", sme->auth_type);
+                goto done;
+        }
+
         lbs_set_radio(priv, preamble, 1);
 
         /* Do the actual association */
diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
index 445ff21772e2..2f218f9a3fd3 100644
--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -48,15 +48,15 @@
 #define PCIE_HOST_INT_STATUS_MASK                       0xC3C
 #define PCIE_SCRATCH_2_REG                              0xC40
 #define PCIE_SCRATCH_3_REG                              0xC44
-#define PCIE_SCRATCH_4_REG                              0xCC0
-#define PCIE_SCRATCH_5_REG                              0xCC4
-#define PCIE_SCRATCH_6_REG                              0xCC8
-#define PCIE_SCRATCH_7_REG                              0xCCC
-#define PCIE_SCRATCH_8_REG                              0xCD0
-#define PCIE_SCRATCH_9_REG                              0xCD4
-#define PCIE_SCRATCH_10_REG                             0xCD8
-#define PCIE_SCRATCH_11_REG                             0xCDC
-#define PCIE_SCRATCH_12_REG                             0xCE0
+#define PCIE_SCRATCH_4_REG                              0xCD0
+#define PCIE_SCRATCH_5_REG                              0xCD4
+#define PCIE_SCRATCH_6_REG                              0xCD8
+#define PCIE_SCRATCH_7_REG                              0xCDC
+#define PCIE_SCRATCH_8_REG                              0xCE0
+#define PCIE_SCRATCH_9_REG                              0xCE4
+#define PCIE_SCRATCH_10_REG                             0xCE8
+#define PCIE_SCRATCH_11_REG                             0xCEC
+#define PCIE_SCRATCH_12_REG                             0xCF0
 
 #define CPU_INTR_DNLD_RDY                               BIT(0)
 #define CPU_INTR_DOOR_BELL                              BIT(1)
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index fc9901e027c1..90cc5e772650 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1062,11 +1062,6 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
 
         set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
 
-        /*
-         * Register the extra components.
-         */
-        rt2x00rfkill_register(rt2x00dev);
-
         return 0;
 }
 
@@ -1210,6 +1205,7 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         rt2x00link_register(rt2x00dev);
         rt2x00leds_register(rt2x00dev);
         rt2x00debug_register(rt2x00dev);
+        rt2x00rfkill_register(rt2x00dev);
 
         return 0;
 
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 510023554e5f..e54488db0e10 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -838,7 +838,10 @@ void rtl_get_tcb_desc(struct ieee80211_hw *hw,
         __le16 fc = hdr->frame_control;
 
         txrate = ieee80211_get_tx_rate(hw, info);
-        tcb_desc->hw_rate = txrate->hw_value;
+        if (txrate)
+                tcb_desc->hw_rate = txrate->hw_value;
+        else
+                tcb_desc->hw_rate = 0;
 
         if (ieee80211_is_data(fc)) {
                 /*
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 07dd38efe62a..cc15fdb36060 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -912,8 +912,13 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
         memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
         ring = &rtlpci->tx_ring[BEACON_QUEUE];
         pskb = __skb_dequeue(&ring->queue);
-        if (pskb)
+        if (pskb) {
+                struct rtl_tx_desc *entry = &ring->desc[ring->idx];
+                pci_unmap_single(rtlpci->pdev, rtlpriv->cfg->ops->get_desc(
+                                 (u8 *) entry, true, HW_DESC_TXBUFF_ADDR),
+                                 pskb->len, PCI_DMA_TODEVICE);
                 kfree_skb(pskb);
+        }
 
         /*NB: the beacon data buffer must be 32-bit aligned. */
         pskb = ieee80211_beacon_get(hw, mac->vif);
@@ -1936,6 +1941,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
                 rtl_deinit_deferred_work(hw);
                 rtlpriv->intf_ops->adapter_stop(hw);
         }
+        rtlpriv->cfg->ops->disable_interrupt(hw);
 
         /*deinit rfkill */
         rtl_deinit_rfkill(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index 4898c502974d..480862c07f92 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -91,7 +91,6 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
         u8 tid;
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-        static int header_print;
 
         rtlpriv->dm.dm_initialgain_enable = true;
         rtlpriv->dm.dm_flag = 0;
@@ -171,10 +170,6 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
         for (tid = 0; tid < 8; tid++)
                 skb_queue_head_init(&rtlpriv->mac80211.skb_waitq[tid]);
 
-        /* Only load firmware for first MAC */
-        if (header_print)
-                return 0;
-
         /* for firmware buf */
         rtlpriv->rtlhal.pfirmware = vzalloc(0x8000);
         if (!rtlpriv->rtlhal.pfirmware) {
@@ -186,7 +181,6 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
         rtlpriv->max_fw_size = 0x8000;
         pr_info("Driver for Realtek RTL8192DE WLAN interface\n");
         pr_info("Loading firmware file %s\n", rtlpriv->cfg->fw_name);
-        header_print++;
 
         /* request fw */
         err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 2e1e352864bb..d04dbda13f5a 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -124,46 +124,38 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,
         return status;
 }
 
-static u32 _usb_read_sync(struct usb_device *udev, u32 addr, u16 len)
+static u32 _usb_read_sync(struct rtl_priv *rtlpriv, u32 addr, u16 len)
 {
+        struct device *dev = rtlpriv->io.dev;
+        struct usb_device *udev = to_usb_device(dev);
         u8 request;
         u16 wvalue;
         u16 index;
-        u32 *data;
-        u32 ret;
+        __le32 *data = &rtlpriv->usb_data[rtlpriv->usb_data_index];
 
-        data = kmalloc(sizeof(u32), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
         request = REALTEK_USB_VENQT_CMD_REQ;
         index = REALTEK_USB_VENQT_CMD_IDX; /* n/a */
 
         wvalue = (u16)addr;
         _usbctrl_vendorreq_sync_read(udev, request, wvalue, index, data, len);
-        ret = le32_to_cpu(*data);
-        kfree(data);
-        return ret;
+        if (++rtlpriv->usb_data_index >= RTL_USB_MAX_RX_COUNT)
+                rtlpriv->usb_data_index = 0;
+        return le32_to_cpu(*data);
 }
 
 static u8 _usb_read8_sync(struct rtl_priv *rtlpriv, u32 addr)
 {
-        struct device *dev = rtlpriv->io.dev;
-
-        return (u8)_usb_read_sync(to_usb_device(dev), addr, 1);
+        return (u8)_usb_read_sync(rtlpriv, addr, 1);
 }
 
 static u16 _usb_read16_sync(struct rtl_priv *rtlpriv, u32 addr)
 {
-        struct device *dev = rtlpriv->io.dev;
-
-        return (u16)_usb_read_sync(to_usb_device(dev), addr, 2);
+        return (u16)_usb_read_sync(rtlpriv, addr, 2);
 }
 
 static u32 _usb_read32_sync(struct rtl_priv *rtlpriv, u32 addr)
 {
-        struct device *dev = rtlpriv->io.dev;
-
-        return _usb_read_sync(to_usb_device(dev), addr, 4);
+        return _usb_read_sync(rtlpriv, addr, 4);
 }
 
 static void _usb_write_async(struct usb_device *udev, u32 addr, u32 val,
@@ -955,6 +947,11 @@ int __devinit rtl_usb_probe(struct usb_interface *intf,
                 return -ENOMEM;
         }
         rtlpriv = hw->priv;
+        rtlpriv->usb_data = kzalloc(RTL_USB_MAX_RX_COUNT * sizeof(u32),
+                                    GFP_KERNEL);
+        if (!rtlpriv->usb_data)
+                return -ENOMEM;
+        rtlpriv->usb_data_index = 0;
         init_completion(&rtlpriv->firmware_loading_complete);
         SET_IEEE80211_DEV(hw, &intf->dev);
         udev = interface_to_usbdev(intf);
@@ -1025,6 +1022,7 @@ void rtl_usb_disconnect(struct usb_interface *intf)
         /* rtl_deinit_rfkill(hw); */
         rtl_usb_deinit(hw);
         rtl_deinit_core(hw);
+        kfree(rtlpriv->usb_data);
         rtlpriv->cfg->ops->deinit_sw_leds(hw);
         rtlpriv->cfg->ops->deinit_sw_vars(hw);
         _rtl_usb_io_handler_release(hw);
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index b591614c3b9b..28ebc69218a3 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -67,7 +67,7 @@
 #define QOS_QUEUE_NUM                           4
 #define RTL_MAC80211_NUM_QUEUE                  5
 #define REALTEK_USB_VENQT_MAX_BUF_SIZE          254
-
+#define RTL_USB_MAX_RX_COUNT                    100
 #define QBSS_LOAD_SIZE                          5
 #define MAX_WMMELE_LENGTH                       64
 
@@ -1629,6 +1629,10 @@ struct rtl_priv {
            interface or hardware */
         unsigned long status;
 
+        /* data buffer pointer for USB reads */
+        __le32 *usb_data;
+        int usb_data_index;
+
         /*This must be the last item so
            that it points to the data allocated
            beyond  this structure like:
diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/wl1251/main.c
index 41302c7b1ad0..d1afb8e3b2ef 100644
--- a/drivers/net/wireless/wl1251/main.c
+++ b/drivers/net/wireless/wl1251/main.c
@@ -479,6 +479,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
         cancel_work_sync(&wl->irq_work);
         cancel_work_sync(&wl->tx_work);
         cancel_work_sync(&wl->filter_work);
+        cancel_delayed_work_sync(&wl->elp_work);
 
         mutex_lock(&wl->mutex);
 
diff --git a/drivers/net/wireless/wl1251/sdio.c b/drivers/net/wireless/wl1251/sdio.c
index f78694295c39..1b851f650e07 100644
--- a/drivers/net/wireless/wl1251/sdio.c
+++ b/drivers/net/wireless/wl1251/sdio.c
@@ -315,8 +315,8 @@ static void __devexit wl1251_sdio_remove(struct sdio_func *func)
 
         if (wl->irq)
                 free_irq(wl->irq, wl);
-        kfree(wl_sdio);
         wl1251_free_hw(wl);
+        kfree(wl_sdio);
 
         sdio_claim_host(func);
         sdio_release_irq(func);
diff --git a/drivers/of/gpio.c b/drivers/of/gpio.c
index bba81216b4db..bf984b6dc477 100644
--- a/drivers/of/gpio.c
+++ b/drivers/of/gpio.c
@@ -140,7 +140,7 @@ int of_gpio_simple_xlate(struct gpio_chip *gc,
         if (WARN_ON(gpiospec->args_count < gc->of_gpio_n_cells))
                 return -EINVAL;
 
-        if (gpiospec->args[0] > gc->ngpio)
+        if (gpiospec->args[0] >= gc->ngpio)
                 return -EINVAL;
 
         if (flags)
diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
index 083a49fee56a..165274c064bc 100644
--- a/drivers/pci/Makefile
+++ b/drivers/pci/Makefile
@@ -42,6 +42,7 @@ obj-$(CONFIG_UNICORE32) += setup-bus.o setup-irq.o
 obj-$(CONFIG_PARISC) += setup-bus.o
 obj-$(CONFIG_SUPERH) += setup-bus.o setup-irq.o
 obj-$(CONFIG_PPC) += setup-bus.o
+obj-$(CONFIG_FRV) += setup-bus.o
 obj-$(CONFIG_MIPS) += setup-bus.o setup-irq.o
 obj-$(CONFIG_X86_VISWS) += setup-irq.o
 obj-$(CONFIG_MN10300) += setup-bus.o
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 0f150f271c2a..1929c0c63b75 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -200,7 +200,7 @@ static pci_power_t acpi_pci_choose_state(struct pci_dev *pdev)
                 return PCI_D1;
         case ACPI_STATE_D2:
                 return PCI_D2;
-        case ACPI_STATE_D3:
+        case ACPI_STATE_D3_HOT:
                 return PCI_D3hot;
         case ACPI_STATE_D3_COLD:
                 return PCI_D3cold;
@@ -223,7 +223,7 @@ static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state)
                 [PCI_D0] = ACPI_STATE_D0,
                 [PCI_D1] = ACPI_STATE_D1,
                 [PCI_D2] = ACPI_STATE_D2,
-                [PCI_D3hot] = ACPI_STATE_D3,
+                [PCI_D3hot] = ACPI_STATE_D3_HOT,
                 [PCI_D3cold] = ACPI_STATE_D3
         };
         int error = -EINVAL;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 815674415267..111569ccab43 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -967,16 +967,59 @@ pci_save_state(struct pci_dev *dev)
         return 0;
 }
 
+static void pci_restore_config_dword(struct pci_dev *pdev, int offset,
+                                     u32 saved_val, int retry)
+{
+        u32 val;
+
+        pci_read_config_dword(pdev, offset, &val);
+        if (val == saved_val)
+                return;
+
+        for (;;) {
+                dev_dbg(&pdev->dev, "restoring config space at offset "
+                        "%#x (was %#x, writing %#x)\n", offset, val, saved_val);
+                pci_write_config_dword(pdev, offset, saved_val);
+                if (retry-- <= 0)
+                        return;
+
+                pci_read_config_dword(pdev, offset, &val);
+                if (val == saved_val)
+                        return;
+
+                mdelay(1);
+        }
+}
+
+static void pci_restore_config_space_range(struct pci_dev *pdev,
+                                           int start, int end, int retry)
+{
+        int index;
+
+        for (index = end; index >= start; index--)
+                pci_restore_config_dword(pdev, 4 * index,
+                                         pdev->saved_config_space[index],
+                                         retry);
+}
+
+static void pci_restore_config_space(struct pci_dev *pdev)
+{
+        if (pdev->hdr_type == PCI_HEADER_TYPE_NORMAL) {
+                pci_restore_config_space_range(pdev, 10, 15, 0);
+                /* Restore BARs before the command register. */
+                pci_restore_config_space_range(pdev, 4, 9, 10);
+                pci_restore_config_space_range(pdev, 0, 3, 0);
+        } else {
+                pci_restore_config_space_range(pdev, 0, 15, 0);
+        }
+}
+
 /** 
  * pci_restore_state - Restore the saved state of a PCI device
  * @dev: - PCI device that we're dealing with
  */
 void pci_restore_state(struct pci_dev *dev)
 {
-        int i;
-        u32 val;
-        int tries;
-
         if (!dev->state_saved)
                 return;
 
@@ -984,24 +1027,8 @@ void pci_restore_state(struct pci_dev *dev)
         pci_restore_pcie_state(dev);
         pci_restore_ats_state(dev);
 
-        /*
-         * The Base Address register should be programmed before the command
-         * register(s)
-         */
-        for (i = 15; i >= 0; i--) {
-                pci_read_config_dword(dev, i * 4, &val);
-                tries = 10;             
-                while (tries && val != dev->saved_config_space[i]) {
-                        dev_dbg(&dev->dev, "restoring config "
-                                "space at offset %#x (was %#x, writing %#x)\n",
-                                i, val, (int)dev->saved_config_space[i]);
-                        pci_write_config_dword(dev,i * 4,
-                                dev->saved_config_space[i]);
-                        pci_read_config_dword(dev, i * 4, &val);
-                        mdelay(10);
-                        tries--;
-                }
-        }
+        pci_restore_config_space(dev);
+
         pci_restore_pcix_state(dev);
         pci_restore_msi_state(dev);
         pci_restore_iov_state(dev);
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index ec3b8cc188af..df6296c5f47b 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -908,10 +908,6 @@ static int pinctrl_groups_show(struct seq_file *s, void *what)
         const struct pinctrl_ops *ops = pctldev->desc->pctlops;
         unsigned selector = 0;
 
-        /* No grouping */
-        if (!ops)
-                return 0;
-
         mutex_lock(&pinctrl_mutex);
 
         seq_puts(s, "registered pin groups:\n");
@@ -1225,6 +1221,19 @@ static void pinctrl_remove_device_debugfs(struct pinctrl_dev *pctldev)
 
 #endif
 
+static int pinctrl_check_ops(struct pinctrl_dev *pctldev)
+{
+        const struct pinctrl_ops *ops = pctldev->desc->pctlops;
+
+        if (!ops ||
+            !ops->list_groups ||
+            !ops->get_group_name ||
+            !ops->get_group_pins)
+                return -EINVAL;
+
+        return 0;
+}
+
 /**
  * pinctrl_register() - register a pin controller device
  * @pctldesc: descriptor for this pin controller
@@ -1256,6 +1265,14 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,
         INIT_LIST_HEAD(&pctldev->gpio_ranges);
         pctldev->dev = dev;
 
+        /* check core ops for sanity */
+        ret = pinctrl_check_ops(pctldev);
+        if (ret) {
+                pr_err("%s pinctrl ops lacks necessary functions\n",
+                        pctldesc->name);
+                goto out_err;
+        }
+
         /* If we're implementing pinmuxing, check the ops for sanity */
         if (pctldesc->pmxops) {
                 ret = pinmux_check_ops(pctldev);
diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
index bc8384c6f3eb..639db4d0aa76 100644
--- a/drivers/platform/x86/acerhdf.c
+++ b/drivers/platform/x86/acerhdf.c
@@ -50,7 +50,7 @@
  */
 #undef START_IN_KERNEL_MODE
 
-#define DRV_VER "0.5.24"
+#define DRV_VER "0.5.26"
 
 /*
  * According to the Atom N270 datasheet,
@@ -83,8 +83,8 @@ static int kernelmode;
 #endif
 
 static unsigned int interval = 10;
-static unsigned int fanon = 63000;
-static unsigned int fanoff = 58000;
+static unsigned int fanon = 60000;
+static unsigned int fanoff = 53000;
 static unsigned int verbose;
 static unsigned int fanstate = ACERHDF_FAN_AUTO;
 static char force_bios[16];
@@ -150,6 +150,8 @@ static const struct bios_settings_t bios_tbl[] = {
         {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} },
         {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} },
         {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} },
+        /* LT1005u */
+        {"Acer", "LT-10Q", "v0.3310", 0x55, 0x58, {0x20, 0x00} },
         /* Acer 1410 */
         {"Acer", "Aspire 1410", "v0.3108", 0x55, 0x58, {0x9e, 0x00} },
         {"Acer", "Aspire 1410", "v0.3113", 0x55, 0x58, {0x9e, 0x00} },
@@ -161,6 +163,7 @@ static const struct bios_settings_t bios_tbl[] = {
         {"Acer", "Aspire 1410", "v1.3303", 0x55, 0x58, {0x9e, 0x00} },
         {"Acer", "Aspire 1410", "v1.3308", 0x55, 0x58, {0x9e, 0x00} },
         {"Acer", "Aspire 1410", "v1.3310", 0x55, 0x58, {0x9e, 0x00} },
+        {"Acer", "Aspire 1410", "v1.3314", 0x55, 0x58, {0x9e, 0x00} },
         /* Acer 1810xx */
         {"Acer", "Aspire 1810TZ", "v0.3108", 0x55, 0x58, {0x9e, 0x00} },
         {"Acer", "Aspire 1810T",  "v0.3108", 0x55, 0x58, {0x9e, 0x00} },
@@ -183,29 +186,44 @@ static const struct bios_settings_t bios_tbl[] = {
         {"Acer", "Aspire 1810TZ", "v1.3310", 0x55, 0x58, {0x9e, 0x00} },
         {"Acer", "Aspire 1810T",  "v1.3310", 0x55, 0x58, {0x9e, 0x00} },
         {"Acer", "Aspire 1810TZ", "v1.3314", 0x55, 0x58, {0x9e, 0x00} },
+        {"Acer", "Aspire 1810T",  "v1.3314", 0x55, 0x58, {0x9e, 0x00} },
         /* Acer 531 */
+        {"Acer", "AO531h", "v0.3104", 0x55, 0x58, {0x20, 0x00} },
         {"Acer", "AO531h", "v0.3201", 0x55, 0x58, {0x20, 0x00} },
+        {"Acer", "AO531h", "v0.3304", 0x55, 0x58, {0x20, 0x00} },
+        /* Acer 751 */
+        {"Acer", "AO751h", "V0.3212", 0x55, 0x58, {0x21, 0x00} },
+        /* Acer 1825 */
+        {"Acer", "Aspire 1825PTZ", "V1.3118", 0x55, 0x58, {0x9e, 0x00} },
+        {"Acer", "Aspire 1825PTZ", "V1.3127", 0x55, 0x58, {0x9e, 0x00} },
+        /* Acer TravelMate 7730 */
+        {"Acer", "TravelMate 7730G", "v0.3509", 0x55, 0x58, {0xaf, 0x00} },
         /* Gateway */
-        {"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
-        {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} },
-        {"Gateway", "LT31",   "v1.3103", 0x55, 0x58, {0x9e, 0x00} },
-        {"Gateway", "LT31",   "v1.3201", 0x55, 0x58, {0x9e, 0x00} },
-        {"Gateway", "LT31",   "v1.3302", 0x55, 0x58, {0x9e, 0x00} },
+        {"Gateway", "AOA110", "v0.3103",  0x55, 0x58, {0x21, 0x00} },
+        {"Gateway", "AOA150", "v0.3103",  0x55, 0x58, {0x20, 0x00} },
+        {"Gateway", "LT31",   "v1.3103",  0x55, 0x58, {0x9e, 0x00} },
+        {"Gateway", "LT31",   "v1.3201",  0x55, 0x58, {0x9e, 0x00} },
+        {"Gateway", "LT31",   "v1.3302",  0x55, 0x58, {0x9e, 0x00} },
+        {"Gateway", "LT31",   "v1.3303t", 0x55, 0x58, {0x9e, 0x00} },
         /* Packard Bell */
-        {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} },
-        {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00} },
-        {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
-        {"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00} },
-        {"Packard Bell", "DOTMU",  "v1.3303", 0x55, 0x58, {0x9e, 0x00} },
-        {"Packard Bell", "DOTMU",  "v0.3120", 0x55, 0x58, {0x9e, 0x00} },
-        {"Packard Bell", "DOTMU",  "v0.3108", 0x55, 0x58, {0x9e, 0x00} },
-        {"Packard Bell", "DOTMU",  "v0.3113", 0x55, 0x58, {0x9e, 0x00} },
-        {"Packard Bell", "DOTMU",  "v0.3115", 0x55, 0x58, {0x9e, 0x00} },
-        {"Packard Bell", "DOTMU",  "v0.3117", 0x55, 0x58, {0x9e, 0x00} },
-        {"Packard Bell", "DOTMU",  "v0.3119", 0x55, 0x58, {0x9e, 0x00} },
-        {"Packard Bell", "DOTMU",  "v1.3204", 0x55, 0x58, {0x9e, 0x00} },
-        {"Packard Bell", "DOTMA",  "v1.3201", 0x55, 0x58, {0x9e, 0x00} },
-        {"Packard Bell", "DOTMA",  "v1.3302", 0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOA150",  "v0.3104",  0x55, 0x58, {0x21, 0x00} },
+        {"Packard Bell", "DOA150",  "v0.3105",  0x55, 0x58, {0x20, 0x00} },
+        {"Packard Bell", "AOA110",  "v0.3105",  0x55, 0x58, {0x21, 0x00} },
+        {"Packard Bell", "AOA150",  "v0.3105",  0x55, 0x58, {0x20, 0x00} },
+        {"Packard Bell", "ENBFT",   "V1.3118",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "ENBFT",   "V1.3127",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMU",   "v1.3303",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMU",   "v0.3120",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMU",   "v0.3108",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMU",   "v0.3113",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMU",   "v0.3115",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMU",   "v0.3117",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMU",   "v0.3119",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMU",   "v1.3204",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMA",   "v1.3201",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMA",   "v1.3302",  0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTMA",   "v1.3303t", 0x55, 0x58, {0x9e, 0x00} },
+        {"Packard Bell", "DOTVR46", "v1.3308",  0x55, 0x58, {0x9e, 0x00} },
         /* pewpew-terminator */
         {"", "", "", 0, 0, {0, 0} }
 };
@@ -701,15 +719,20 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Peter Feuerer");
 MODULE_DESCRIPTION("Aspire One temperature and fan driver");
 MODULE_ALIAS("dmi:*:*Acer*:pnAOA*:");
+MODULE_ALIAS("dmi:*:*Acer*:pnAO751h*:");
 MODULE_ALIAS("dmi:*:*Acer*:pnAspire*1410*:");
 MODULE_ALIAS("dmi:*:*Acer*:pnAspire*1810*:");
+MODULE_ALIAS("dmi:*:*Acer*:pnAspire*1825PTZ:");
 MODULE_ALIAS("dmi:*:*Acer*:pnAO531*:");
+MODULE_ALIAS("dmi:*:*Acer*:TravelMate*7730G:");
 MODULE_ALIAS("dmi:*:*Gateway*:pnAOA*:");
 MODULE_ALIAS("dmi:*:*Gateway*:pnLT31*:");
 MODULE_ALIAS("dmi:*:*Packard*Bell*:pnAOA*:");
 MODULE_ALIAS("dmi:*:*Packard*Bell*:pnDOA*:");
 MODULE_ALIAS("dmi:*:*Packard*Bell*:pnDOTMU*:");
+MODULE_ALIAS("dmi:*:*Packard*Bell*:pnENBFT*:");
 MODULE_ALIAS("dmi:*:*Packard*Bell*:pnDOTMA*:");
+MODULE_ALIAS("dmi:*:*Packard*Bell*:pnDOTVR46*:");
 
 module_init(acerhdf_init);
 module_exit(acerhdf_exit);
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index a05fc9c955d8..e6c08ee8d46c 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -212,6 +212,7 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
                 },
                 .driver_data = &quirk_dell_vostro_v130,
         },
+        { }
 };
 
 static struct calling_interface_buffer *buffer;
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index f7ba316e0ed6..0ffdb3cde2bb 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -1565,7 +1565,7 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
                 ips->poll_turbo_status = true;
 
         if (!ips_get_i915_syms(ips)) {
-                dev_err(&dev->dev, "failed to get i915 symbols, graphics turbo disabled\n");
+                dev_info(&dev->dev, "failed to get i915 symbols, graphics turbo disabled until i915 loads\n");
                 ips->gpu_turbo_enabled = false;
         } else {
                 dev_dbg(&dev->dev, "graphics turbo enabled\n");
diff --git a/drivers/platform/x86/intel_mid_powerbtn.c b/drivers/platform/x86/intel_mid_powerbtn.c
index 0a3594c7e912..bcbad8452a6f 100644
--- a/drivers/platform/x86/intel_mid_powerbtn.c
+++ b/drivers/platform/x86/intel_mid_powerbtn.c
@@ -78,7 +78,7 @@ static int __devinit mfld_pb_probe(struct platform_device *pdev)
 
         input_set_capability(input, EV_KEY, KEY_POWER);
 
-        error = request_threaded_irq(irq, NULL, mfld_pb_isr, 0,
+        error = request_threaded_irq(irq, NULL, mfld_pb_isr, IRQF_NO_SUSPEND,
                         DRIVER_NAME, input);
         if (error) {
                 dev_err(&pdev->dev, "Unable to request irq %d for mfld power"
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index 53969af17558..81fd606e47bc 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -214,7 +214,7 @@ static struct of_device_id __devinitdata of_anatop_regulator_match_tbl[] = {
         { /* end */ }
 };
 
-static struct platform_driver anatop_regulator = {
+static struct platform_driver anatop_regulator_driver = {
         .driver = {
                 .name   = "anatop_regulator",
                 .owner  = THIS_MODULE,
@@ -226,13 +226,13 @@ static struct platform_driver anatop_regulator = {
 
 static int __init anatop_regulator_init(void)
 {
-        return platform_driver_register(&anatop_regulator);
+        return platform_driver_register(&anatop_regulator_driver);
 }
 postcore_initcall(anatop_regulator_init);
 
 static void __exit anatop_regulator_exit(void)
 {
-        platform_driver_unregister(&anatop_regulator);
+        platform_driver_unregister(&anatop_regulator_driver);
 }
 module_exit(anatop_regulator_exit);
 
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index cd188ab72f79..c293d0cdb104 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -902,6 +902,7 @@ read_rtc:
                 }
                 ds1307->nvram->attr.name = "nvram";
                 ds1307->nvram->attr.mode = S_IRUGO | S_IWUSR;
+                sysfs_bin_attr_init(ds1307->nvram);
                 ds1307->nvram->read = ds1307_nvram_read,
                 ds1307->nvram->write = ds1307_nvram_write,
                 ds1307->nvram->size = chip->nvram_size;
diff --git a/drivers/rtc/rtc-efi.c b/drivers/rtc/rtc-efi.c
index 550292304b0f..c9f890b088da 100644
--- a/drivers/rtc/rtc-efi.c
+++ b/drivers/rtc/rtc-efi.c
@@ -213,7 +213,6 @@ static struct platform_driver efi_rtc_driver = {
                 .name = "rtc-efi",
                 .owner = THIS_MODULE,
         },
-        .probe = efi_rtc_probe,
         .remove = __exit_p(efi_rtc_remove),
 };
 
diff --git a/drivers/rtc/rtc-mpc5121.c b/drivers/rtc/rtc-mpc5121.c
index 42f5f829b3ee..029e421baaed 100644
--- a/drivers/rtc/rtc-mpc5121.c
+++ b/drivers/rtc/rtc-mpc5121.c
@@ -360,12 +360,11 @@ static int __devinit mpc5121_rtc_probe(struct platform_device *op)
                                                 &mpc5200_rtc_ops, THIS_MODULE);
         }
 
-        rtc->rtc->uie_unsupported = 1;
-
         if (IS_ERR(rtc->rtc)) {
                 err = PTR_ERR(rtc->rtc);
                 goto out_free_irq;
         }
+        rtc->rtc->uie_unsupported = 1;
 
         return 0;
 
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index 692de7360e94..684ef4bbfce4 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -339,8 +339,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
         dev_dbg(&adev->dev, "revision = 0x%01x\n", ldata->hw_revision);
 
         /* Enable the clockwatch on ST Variants */
-        if ((ldata->hw_designer == AMBA_VENDOR_ST) &&
-            (ldata->hw_revision > 1))
+        if (ldata->hw_designer == AMBA_VENDOR_ST)
                 writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
                        ldata->base + RTC_CR);
 
diff --git a/drivers/rtc/rtc-r9701.c b/drivers/rtc/rtc-r9701.c
index 7f8e6c247935..33b6ba0afa0d 100644
--- a/drivers/rtc/rtc-r9701.c
+++ b/drivers/rtc/rtc-r9701.c
@@ -122,6 +122,7 @@ static const struct rtc_class_ops r9701_rtc_ops = {
 static int __devinit r9701_probe(struct spi_device *spi)
 {
         struct rtc_device *rtc;
+        struct rtc_time dt;
         unsigned char tmp;
         int res;
 
@@ -132,6 +133,27 @@ static int __devinit r9701_probe(struct spi_device *spi)
                 return -ENODEV;
         }
 
+        /*
+         * The device seems to be present. Now check if the registers
+         * contain invalid values. If so, try to write a default date:
+         * 2000/1/1 00:00:00
+         */
+        r9701_get_datetime(&spi->dev, &dt);
+        if (rtc_valid_tm(&dt)) {
+                dev_info(&spi->dev, "trying to repair invalid date/time\n");
+                dt.tm_sec  = 0;
+                dt.tm_min  = 0;
+                dt.tm_hour = 0;
+                dt.tm_mday = 1;
+                dt.tm_mon  = 0;
+                dt.tm_year = 100;
+
+                if (r9701_set_datetime(&spi->dev, &dt)) {
+                        dev_err(&spi->dev, "cannot repair RTC register\n");
+                        return -ENODEV;
+                }
+        }
+
         rtc = rtc_device_register("r9701",
                                 &spi->dev, &r9701_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc))
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 9ccea134a996..3f3a29752369 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -40,6 +40,10 @@ enum s3c_cpu_type {
         TYPE_S3C64XX,
 };
 
+struct s3c_rtc_drv_data {
+        int cpu_type;
+};
+
 /* I have yet to find an S3C implementation with more than one
  * of these rtc blocks in */
 
@@ -446,10 +450,12 @@ static const struct of_device_id s3c_rtc_dt_match[];
 static inline int s3c_rtc_get_driver_data(struct platform_device *pdev)
 {
 #ifdef CONFIG_OF
+        struct s3c_rtc_drv_data *data;
         if (pdev->dev.of_node) {
                 const struct of_device_id *match;
                 match = of_match_node(s3c_rtc_dt_match, pdev->dev.of_node);
-                return match->data;
+                data = (struct s3c_rtc_drv_data *) match->data;
+                return data->cpu_type;
         }
 #endif
         return platform_get_device_id(pdev)->driver_data;
@@ -664,20 +670,27 @@ static int s3c_rtc_resume(struct platform_device *pdev)
 #define s3c_rtc_resume  NULL
 #endif
 
+static struct s3c_rtc_drv_data s3c_rtc_drv_data_array[] = {
+        [TYPE_S3C2410] = { TYPE_S3C2410 },
+        [TYPE_S3C2416] = { TYPE_S3C2416 },
+        [TYPE_S3C2443] = { TYPE_S3C2443 },
+        [TYPE_S3C64XX] = { TYPE_S3C64XX },
+};
+
 #ifdef CONFIG_OF
 static const struct of_device_id s3c_rtc_dt_match[] = {
         {
-                .compatible = "samsung,s3c2410-rtc"
-                .data = TYPE_S3C2410,
+                .compatible = "samsung,s3c2410-rtc",
+                .data = &s3c_rtc_drv_data_array[TYPE_S3C2410],
         }, {
-                .compatible = "samsung,s3c2416-rtc"
-                .data = TYPE_S3C2416,
+                .compatible = "samsung,s3c2416-rtc",
+                .data = &s3c_rtc_drv_data_array[TYPE_S3C2416],
         }, {
-                .compatible = "samsung,s3c2443-rtc"
-                .data = TYPE_S3C2443,
+                .compatible = "samsung,s3c2443-rtc",
+                .data = &s3c_rtc_drv_data_array[TYPE_S3C2443],
         }, {
-                .compatible = "samsung,s3c6410-rtc"
-                .data = TYPE_S3C64XX,
+                .compatible = "samsung,s3c6410-rtc",
+                .data = &s3c_rtc_drv_data_array[TYPE_S3C64XX],
         },
         {},
 };
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index 4c2c6df2a9ef..258abeabf624 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -112,6 +112,7 @@ static const u8 twl6030_rtc_reg_map[] = {
 #define BIT_RTC_CTRL_REG_TEST_MODE_M             0x10
 #define BIT_RTC_CTRL_REG_SET_32_COUNTER_M        0x20
 #define BIT_RTC_CTRL_REG_GET_TIME_M              0x40
+#define BIT_RTC_CTRL_REG_RTC_V_OPT               0x80
 
 /* RTC_STATUS_REG bitfields */
 #define BIT_RTC_STATUS_REG_RUN_M                 0x02
@@ -235,25 +236,57 @@ static int twl_rtc_read_time(struct device *dev, struct rtc_time *tm)
         unsigned char rtc_data[ALL_TIME_REGS + 1];
         int ret;
         u8 save_control;
+        u8 rtc_control;
 
         ret = twl_rtc_read_u8(&save_control, REG_RTC_CTRL_REG);
-        if (ret < 0)
+        if (ret < 0) {
+                dev_err(dev, "%s: reading CTRL_REG, error %d\n", __func__, ret);
                 return ret;
+        }
+        /* for twl6030/32 make sure BIT_RTC_CTRL_REG_GET_TIME_M is clear */
+        if (twl_class_is_6030()) {
+                if (save_control & BIT_RTC_CTRL_REG_GET_TIME_M) {
+                        save_control &= ~BIT_RTC_CTRL_REG_GET_TIME_M;
+                        ret = twl_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
+                        if (ret < 0) {
+                                dev_err(dev, "%s clr GET_TIME, error %d\n",
+                                        __func__, ret);
+                                return ret;
+                        }
+                }
+        }
 
-        save_control |= BIT_RTC_CTRL_REG_GET_TIME_M;
+        /* Copy RTC counting registers to static registers or latches */
+        rtc_control = save_control | BIT_RTC_CTRL_REG_GET_TIME_M;
 
-        ret = twl_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
-        if (ret < 0)
+        /* for twl6030/32 enable read access to static shadowed registers */
+        if (twl_class_is_6030())
+                rtc_control |= BIT_RTC_CTRL_REG_RTC_V_OPT;
+
+        ret = twl_rtc_write_u8(rtc_control, REG_RTC_CTRL_REG);
+        if (ret < 0) {
+                dev_err(dev, "%s: writing CTRL_REG, error %d\n", __func__, ret);
                 return ret;
+        }
 
         ret = twl_i2c_read(TWL_MODULE_RTC, rtc_data,
                         (rtc_reg_map[REG_SECONDS_REG]), ALL_TIME_REGS);
 
         if (ret < 0) {
-                dev_err(dev, "rtc_read_time error %d\n", ret);
+                dev_err(dev, "%s: reading data, error %d\n", __func__, ret);
                 return ret;
         }
 
+        /* for twl6030 restore original state of rtc control register */
+        if (twl_class_is_6030()) {
+                ret = twl_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
+                if (ret < 0) {
+                        dev_err(dev, "%s: restore CTRL_REG, error %d\n",
+                                __func__, ret);
+                        return ret;
+                }
+        }
+
         tm->tm_sec = bcd2bin(rtc_data[0]);
         tm->tm_min = bcd2bin(rtc_data[1]);
         tm->tm_hour = bcd2bin(rtc_data[2]);
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index c21871a4e73d..bc2e8a7c265b 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2844,6 +2844,7 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track(
         sector_t recid, trkid;
         unsigned int offs;
         unsigned int count, count_to_trk_end;
+        int ret;
 
         basedev = block->base;
         if (rq_data_dir(req) == READ) {
@@ -2884,8 +2885,8 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track(
 
         itcw = itcw_init(cqr->data, itcw_size, itcw_op, 0, ctidaw, 0);
         if (IS_ERR(itcw)) {
-                dasd_sfree_request(cqr, startdev);
-                return ERR_PTR(-EINVAL);
+                ret = -EINVAL;
+                goto out_error;
         }
         cqr->cpaddr = itcw_get_tcw(itcw);
         if (prepare_itcw(itcw, first_trk, last_trk,
@@ -2897,8 +2898,8 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track(
                 /* Clock not in sync and XRC is enabled.
                  * Try again later.
                  */
-                dasd_sfree_request(cqr, startdev);
-                return ERR_PTR(-EAGAIN);
+                ret = -EAGAIN;
+                goto out_error;
         }
         len_to_track_end = 0;
         /*
@@ -2937,8 +2938,10 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track(
                                         tidaw_flags = 0;
                                 last_tidaw = itcw_add_tidaw(itcw, tidaw_flags,
                                                             dst, part_len);
-                                if (IS_ERR(last_tidaw))
-                                        return ERR_PTR(-EINVAL);
+                                if (IS_ERR(last_tidaw)) {
+                                        ret = -EINVAL;
+                                        goto out_error;
+                                }
                                 dst += part_len;
                         }
                 }
@@ -2947,8 +2950,10 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track(
                         dst = page_address(bv->bv_page) + bv->bv_offset;
                         last_tidaw = itcw_add_tidaw(itcw, 0x00,
                                                     dst, bv->bv_len);
-                        if (IS_ERR(last_tidaw))
-                                return ERR_PTR(-EINVAL);
+                        if (IS_ERR(last_tidaw)) {
+                                ret = -EINVAL;
+                                goto out_error;
+                        }
                 }
         }
         last_tidaw->flags |= TIDAW_FLAGS_LAST;
@@ -2968,6 +2973,9 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track(
         cqr->buildclk = get_clock();
         cqr->status = DASD_CQR_FILLED;
         return cqr;
+out_error:
+        dasd_sfree_request(cqr, startdev);
+        return ERR_PTR(ret);
 }
 
 static struct dasd_ccw_req *dasd_eckd_build_cp(struct dasd_device *startdev,
diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index 85f4a9a5d12e..73bef0bd394c 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -903,7 +903,7 @@ static int ur_set_online(struct ccw_device *cdev)
                 goto fail_urdev_put;
         }
 
-        cdev_init(urd->char_device, &ur_fops);
+        urd->char_device->ops = &ur_fops;
         urd->char_device->dev = MKDEV(major, minor);
         urd->char_device->owner = ur_fops.owner;
 
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 120955c66410..8334dadc681d 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1672,7 +1672,8 @@ static void qeth_configure_blkt_default(struct qeth_card *card, char *prcd)
 {
         QETH_DBF_TEXT(SETUP, 2, "cfgblkt");
 
-        if (prcd[74] == 0xF0 && prcd[75] == 0xF0 && prcd[76] == 0xF5) {
+        if (prcd[74] == 0xF0 && prcd[75] == 0xF0 &&
+            (prcd[76] == 0xF5 || prcd[76] == 0xF6)) {
                 card->info.blkt.time_total = 250;
                 card->info.blkt.inter_packet = 5;
                 card->info.blkt.inter_packet_jumbo = 15;
@@ -4540,7 +4541,8 @@ static void qeth_determine_capabilities(struct qeth_card *card)
                 goto out_offline;
         }
         qeth_configure_unitaddr(card, prcd);
-        qeth_configure_blkt_default(card, prcd);
+        if (ddev_offline)
+                qeth_configure_blkt_default(card, prcd);
         kfree(prcd);
 
         rc = qdio_get_ssqd_desc(ddev, &card->ssqd);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index e002cd466e9a..467dc38246f9 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4549,8 +4549,12 @@ static int ipr_ata_slave_alloc(struct scsi_device *sdev)
         ENTER;
         if (sdev->sdev_target)
                 sata_port = sdev->sdev_target->hostdata;
-        if (sata_port)
+        if (sata_port) {
                 rc = ata_sas_port_init(sata_port->ap);
+                if (rc == 0)
+                        rc = ata_sas_sync_probe(sata_port->ap);
+        }
+
         if (rc)
                 ipr_slave_destroy(sdev);
 
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index ef9560dff295..cc83b66d45b7 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -1742,17 +1742,19 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
 
         mfs = ntohs(flp->fl_csp.sp_bb_data) &
                 FC_SP_BB_DATA_MASK;
-        if (mfs >= FC_SP_MIN_MAX_PAYLOAD &&
-            mfs <= lport->mfs) {
-                lport->mfs = mfs;
-                fc_host_maxframe_size(lport->host) = mfs;
-        } else {
+
+        if (mfs < FC_SP_MIN_MAX_PAYLOAD || mfs > FC_SP_MAX_MAX_PAYLOAD) {
                 FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, "
                              "lport->mfs:%hu\n", mfs, lport->mfs);
                 fc_lport_error(lport, fp);
                 goto err;
         }
 
+        if (mfs <= lport->mfs) {
+                lport->mfs = mfs;
+                fc_host_maxframe_size(lport->host) = mfs;
+        }
+
         csp_flags = ntohs(flp->fl_csp.sp_features);
         r_a_tov = ntohl(flp->fl_csp.sp_r_a_tov);
         e_d_tov = ntohl(flp->fl_csp.sp_e_d_tov);
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index bc0cecc6ad62..441d88ad99a7 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -546,11 +546,12 @@ static struct ata_port_info sata_port_info = {
         .port_ops = &sas_sata_ops
 };
 
-int sas_ata_init_host_and_port(struct domain_device *found_dev)
+int sas_ata_init(struct domain_device *found_dev)
 {
         struct sas_ha_struct *ha = found_dev->port->ha;
         struct Scsi_Host *shost = ha->core.shost;
         struct ata_port *ap;
+        int rc;
 
         ata_host_init(&found_dev->sata_dev.ata_host,
                       ha->dev,
@@ -567,8 +568,11 @@ int sas_ata_init_host_and_port(struct domain_device *found_dev)
         ap->private_data = found_dev;
         ap->cbl = ATA_CBL_SATA;
         ap->scsi_host = shost;
-        /* publish initialized ata port */
-        smp_wmb();
+        rc = ata_sas_port_init(ap);
+        if (rc) {
+                ata_sas_port_destroy(ap);
+                return rc;
+        }
         found_dev->sata_dev.ap = ap;
 
         return 0;
@@ -648,18 +652,13 @@ static void sas_get_ata_command_set(struct domain_device *dev)
 void sas_probe_sata(struct asd_sas_port *port)
 {
         struct domain_device *dev, *n;
-        int err;
 
         mutex_lock(&port->ha->disco_mutex);
-        list_for_each_entry_safe(dev, n, &port->disco_list, disco_list_node) {
+        list_for_each_entry(dev, &port->disco_list, disco_list_node) {
                 if (!dev_is_sata(dev))
                         continue;
 
-                err = sas_ata_init_host_and_port(dev);
-                if (err)
-                        sas_fail_probe(dev, __func__, err);
-                else
-                        ata_sas_async_port_init(dev->sata_dev.ap);
+                ata_sas_async_probe(dev->sata_dev.ap);
         }
         mutex_unlock(&port->ha->disco_mutex);
 
@@ -718,18 +717,6 @@ static void async_sas_ata_eh(void *data, async_cookie_t cookie)
         sas_put_device(dev);
 }
 
-static bool sas_ata_dev_eh_valid(struct domain_device *dev)
-{
-        struct ata_port *ap;
-
-        if (!dev_is_sata(dev))
-                return false;
-        ap = dev->sata_dev.ap;
-        /* consume fully initialized ata ports */
-        smp_rmb();
-        return !!ap;
-}
-
 void sas_ata_strategy_handler(struct Scsi_Host *shost)
 {
         struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(shost);
@@ -753,7 +740,7 @@ void sas_ata_strategy_handler(struct Scsi_Host *shost)
 
                 spin_lock(&port->dev_list_lock);
                 list_for_each_entry(dev, &port->dev_list, dev_list_node) {
-                        if (!sas_ata_dev_eh_valid(dev))
+                        if (!dev_is_sata(dev))
                                 continue;
                         async_schedule_domain(async_sas_ata_eh, dev, &async);
                 }
diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
index 364679675602..629a0865b130 100644
--- a/drivers/scsi/libsas/sas_discover.c
+++ b/drivers/scsi/libsas/sas_discover.c
@@ -72,6 +72,7 @@ static int sas_get_port_device(struct asd_sas_port *port)
         struct asd_sas_phy *phy;
         struct sas_rphy *rphy;
         struct domain_device *dev;
+        int rc = -ENODEV;
 
         dev = sas_alloc_device();
         if (!dev)
@@ -110,9 +111,16 @@ static int sas_get_port_device(struct asd_sas_port *port)
 
         sas_init_dev(dev);
 
+        dev->port = port;
         switch (dev->dev_type) {
-        case SAS_END_DEV:
         case SATA_DEV:
+                rc = sas_ata_init(dev);
+                if (rc) {
+                        rphy = NULL;
+                        break;
+                }
+                /* fall through */
+        case SAS_END_DEV:
                 rphy = sas_end_device_alloc(port->port);
                 break;
         case EDGE_DEV:
@@ -131,19 +139,14 @@ static int sas_get_port_device(struct asd_sas_port *port)
 
         if (!rphy) {
                 sas_put_device(dev);
-                return -ENODEV;
+                return rc;
         }
 
-        spin_lock_irq(&port->phy_list_lock);
-        list_for_each_entry(phy, &port->phy_list, port_phy_el)
-                sas_phy_set_target(phy, dev);
-        spin_unlock_irq(&port->phy_list_lock);
         rphy->identify.phy_identifier = phy->phy->identify.phy_identifier;
         memcpy(dev->sas_addr, port->attached_sas_addr, SAS_ADDR_SIZE);
         sas_fill_in_rphy(dev, rphy);
         sas_hash_addr(dev->hashed_sas_addr, dev->sas_addr);
         port->port_dev = dev;
-        dev->port = port;
         dev->linkrate = port->linkrate;
         dev->min_linkrate = port->linkrate;
         dev->max_linkrate = port->linkrate;
@@ -155,6 +158,7 @@ static int sas_get_port_device(struct asd_sas_port *port)
         sas_device_set_phy(dev, port->port);
 
         dev->rphy = rphy;
+        get_device(&dev->rphy->dev);
 
         if (dev_is_sata(dev) || dev->dev_type == SAS_END_DEV)
                 list_add_tail(&dev->disco_list_node, &port->disco_list);
@@ -164,6 +168,11 @@ static int sas_get_port_device(struct asd_sas_port *port)
                 spin_unlock_irq(&port->dev_list_lock);
         }
 
+        spin_lock_irq(&port->phy_list_lock);
+        list_for_each_entry(phy, &port->phy_list, port_phy_el)
+                sas_phy_set_target(phy, dev);
+        spin_unlock_irq(&port->phy_list_lock);
+
         return 0;
 }
 
@@ -205,8 +214,7 @@ void sas_notify_lldd_dev_gone(struct domain_device *dev)
 static void sas_probe_devices(struct work_struct *work)
 {
         struct domain_device *dev, *n;
-        struct sas_discovery_event *ev =
-                container_of(work, struct sas_discovery_event, work);
+        struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
 
         clear_bit(DISCE_PROBE, &port->disc.pending);
@@ -255,6 +263,9 @@ void sas_free_device(struct kref *kref)
 {
         struct domain_device *dev = container_of(kref, typeof(*dev), kref);
 
+        put_device(&dev->rphy->dev);
+        dev->rphy = NULL;
+
         if (dev->parent)
                 sas_put_device(dev->parent);
 
@@ -291,8 +302,7 @@ static void sas_unregister_common_dev(struct asd_sas_port *port, struct domain_d
 static void sas_destruct_devices(struct work_struct *work)
 {
         struct domain_device *dev, *n;
-        struct sas_discovery_event *ev =
-                container_of(work, struct sas_discovery_event, work);
+        struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
 
         clear_bit(DISCE_DESTRUCT, &port->disc.pending);
@@ -302,7 +312,6 @@ static void sas_destruct_devices(struct work_struct *work)
 
                 sas_remove_children(&dev->rphy->dev);
                 sas_rphy_delete(dev->rphy);
-                dev->rphy = NULL;
                 sas_unregister_common_dev(port, dev);
         }
 }
@@ -314,11 +323,11 @@ void sas_unregister_dev(struct asd_sas_port *port, struct domain_device *dev)
                 /* this rphy never saw sas_rphy_add */
                 list_del_init(&dev->disco_list_node);
                 sas_rphy_free(dev->rphy);
-                dev->rphy = NULL;
                 sas_unregister_common_dev(port, dev);
+                return;
         }
 
-        if (dev->rphy && !test_and_set_bit(SAS_DEV_DESTROY, &dev->state)) {
+        if (!test_and_set_bit(SAS_DEV_DESTROY, &dev->state)) {
                 sas_rphy_unlink(dev->rphy);
                 list_move_tail(&dev->disco_list_node, &port->destroy_list);
                 sas_discover_event(dev->port, DISCE_DESTRUCT);
@@ -377,8 +386,7 @@ static void sas_discover_domain(struct work_struct *work)
 {
         struct domain_device *dev;
         int error = 0;
-        struct sas_discovery_event *ev =
-                container_of(work, struct sas_discovery_event, work);
+        struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
 
         clear_bit(DISCE_DISCOVER_DOMAIN, &port->disc.pending);
@@ -419,8 +427,6 @@ static void sas_discover_domain(struct work_struct *work)
 
         if (error) {
                 sas_rphy_free(dev->rphy);
-                dev->rphy = NULL;
-
                 list_del_init(&dev->disco_list_node);
                 spin_lock_irq(&port->dev_list_lock);
                 list_del_init(&dev->dev_list_node);
@@ -437,8 +443,7 @@ static void sas_discover_domain(struct work_struct *work)
 static void sas_revalidate_domain(struct work_struct *work)
 {
         int res = 0;
-        struct sas_discovery_event *ev =
-                container_of(work, struct sas_discovery_event, work);
+        struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
         struct sas_ha_struct *ha = port->ha;
 
@@ -466,21 +471,25 @@ static void sas_revalidate_domain(struct work_struct *work)
 
 /* ---------- Events ---------- */
 
-static void sas_chain_work(struct sas_ha_struct *ha, struct work_struct *work)
+static void sas_chain_work(struct sas_ha_struct *ha, struct sas_work *sw)
 {
-        /* chained work is not subject to SA_HA_DRAINING or SAS_HA_REGISTERED */
-        scsi_queue_work(ha->core.shost, work);
+        /* chained work is not subject to SA_HA_DRAINING or
+         * SAS_HA_REGISTERED, because it is either submitted in the
+         * workqueue, or known to be submitted from a context that is
+         * not racing against draining
+         */
+        scsi_queue_work(ha->core.shost, &sw->work);
 }
 
 static void sas_chain_event(int event, unsigned long *pending,
-                            struct work_struct *work,
+                            struct sas_work *sw,
                             struct sas_ha_struct *ha)
 {
         if (!test_and_set_bit(event, pending)) {
                 unsigned long flags;
 
                 spin_lock_irqsave(&ha->state_lock, flags);
-                sas_chain_work(ha, work);
+                sas_chain_work(ha, sw);
                 spin_unlock_irqrestore(&ha->state_lock, flags);
         }
 }
@@ -519,7 +528,7 @@ void sas_init_disc(struct sas_discovery *disc, struct asd_sas_port *port)
 
         disc->pending = 0;
         for (i = 0; i < DISC_NUM_EVENTS; i++) {
-                INIT_WORK(&disc->disc_work[i].work, sas_event_fns[i]);
+                INIT_SAS_WORK(&disc->disc_work[i].work, sas_event_fns[i]);
                 disc->disc_work[i].port = port;
         }
 }
diff --git a/drivers/scsi/libsas/sas_event.c b/drivers/scsi/libsas/sas_event.c
index 16639bbae629..4e4292d210c1 100644
--- a/drivers/scsi/libsas/sas_event.c
+++ b/drivers/scsi/libsas/sas_event.c
@@ -27,19 +27,21 @@
 #include "sas_internal.h"
 #include "sas_dump.h"
 
-void sas_queue_work(struct sas_ha_struct *ha, struct work_struct *work)
+void sas_queue_work(struct sas_ha_struct *ha, struct sas_work *sw)
 {
         if (!test_bit(SAS_HA_REGISTERED, &ha->state))
                 return;
 
-        if (test_bit(SAS_HA_DRAINING, &ha->state))
-                list_add(&work->entry, &ha->defer_q);
-        else
-                scsi_queue_work(ha->core.shost, work);
+        if (test_bit(SAS_HA_DRAINING, &ha->state)) {
+                /* add it to the defer list, if not already pending */
+                if (list_empty(&sw->drain_node))
+                        list_add(&sw->drain_node, &ha->defer_q);
+        } else
+                scsi_queue_work(ha->core.shost, &sw->work);
 }
 
 static void sas_queue_event(int event, unsigned long *pending,
-                            struct work_struct *work,
+                            struct sas_work *work,
                             struct sas_ha_struct *ha)
 {
         if (!test_and_set_bit(event, pending)) {
@@ -55,7 +57,7 @@ static void sas_queue_event(int event, unsigned long *pending,
 void __sas_drain_work(struct sas_ha_struct *ha)
 {
         struct workqueue_struct *wq = ha->core.shost->work_q;
-        struct work_struct *w, *_w;
+        struct sas_work *sw, *_sw;
 
         set_bit(SAS_HA_DRAINING, &ha->state);
         /* flush submitters */
@@ -66,9 +68,9 @@ void __sas_drain_work(struct sas_ha_struct *ha)
 
         spin_lock_irq(&ha->state_lock);
         clear_bit(SAS_HA_DRAINING, &ha->state);
-        list_for_each_entry_safe(w, _w, &ha->defer_q, entry) {
-                list_del_init(&w->entry);
-                sas_queue_work(ha, w);
+        list_for_each_entry_safe(sw, _sw, &ha->defer_q, drain_node) {
+                list_del_init(&sw->drain_node);
+                sas_queue_work(ha, sw);
         }
         spin_unlock_irq(&ha->state_lock);
 }
@@ -151,7 +153,7 @@ int sas_init_events(struct sas_ha_struct *sas_ha)
         int i;
 
         for (i = 0; i < HA_NUM_EVENTS; i++) {
-                INIT_WORK(&sas_ha->ha_events[i].work, sas_ha_event_fns[i]);
+                INIT_SAS_WORK(&sas_ha->ha_events[i].work, sas_ha_event_fns[i]);
                 sas_ha->ha_events[i].ha = sas_ha;
         }
 
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 05acd9e35fc4..caa0525d2523 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -202,6 +202,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         u8 sas_addr[SAS_ADDR_SIZE];
         struct smp_resp *resp = rsp;
         struct discover_resp *dr = &resp->disc;
+        struct sas_ha_struct *ha = dev->port->ha;
         struct expander_device *ex = &dev->ex_dev;
         struct ex_phy *phy = &ex->ex_phy[phy_id];
         struct sas_rphy *rphy = dev->rphy;
@@ -209,6 +210,8 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         char *type;
 
         if (new_phy) {
+                if (WARN_ON_ONCE(test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state)))
+                        return;
                 phy->phy = sas_phy_alloc(&rphy->dev, phy_id);
 
                 /* FIXME: error_handling */
@@ -233,6 +236,8 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         memcpy(sas_addr, phy->attached_sas_addr, SAS_ADDR_SIZE);
 
         phy->attached_dev_type = to_dev_type(dr);
+        if (test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state))
+                goto out;
         phy->phy_id = phy_id;
         phy->linkrate = dr->linkrate;
         phy->attached_sata_host = dr->attached_sata_host;
@@ -240,7 +245,14 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         phy->attached_sata_ps   = dr->attached_sata_ps;
         phy->attached_iproto = dr->iproto << 1;
         phy->attached_tproto = dr->tproto << 1;
-        memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
+        /* help some expanders that fail to zero sas_address in the 'no
+         * device' case
+         */
+        if (phy->attached_dev_type == NO_DEVICE ||
+            phy->linkrate < SAS_LINK_RATE_1_5_GBPS)
+                memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+        else
+                memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
         phy->attached_phy_id = dr->attached_phy_id;
         phy->phy_change_count = dr->change_count;
         phy->routing_attr = dr->routing_attr;
@@ -266,6 +278,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
                         return;
                 }
 
+ out:
         switch (phy->attached_dev_type) {
         case SATA_PENDING:
                 type = "stp pending";
@@ -304,7 +317,15 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         else
                 return;
 
-        SAS_DPRINTK("ex %016llx phy%02d:%c:%X attached: %016llx (%s)\n",
+        /* if the attached device type changed and ata_eh is active,
+         * make sure we run revalidation when eh completes (see:
+         * sas_enable_revalidation)
+         */
+        if (test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state))
+                set_bit(DISCE_REVALIDATE_DOMAIN, &dev->port->disc.pending);
+
+        SAS_DPRINTK("%sex %016llx phy%02d:%c:%X attached: %016llx (%s)\n",
+                    test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state) ? "ata: " : "",
                     SAS_ADDR(dev->sas_addr), phy->phy_id,
                     sas_route_char(dev, phy), phy->linkrate,
                     SAS_ADDR(phy->attached_sas_addr), type);
@@ -776,13 +797,16 @@ static struct domain_device *sas_ex_discover_end_dev(
                 if (res)
                         goto out_free;
 
+                sas_init_dev(child);
+                res = sas_ata_init(child);
+                if (res)
+                        goto out_free;
                 rphy = sas_end_device_alloc(phy->port);
-                if (unlikely(!rphy))
+                if (!rphy)
                         goto out_free;
 
-                sas_init_dev(child);
-
                 child->rphy = rphy;
+                get_device(&rphy->dev);
 
                 list_add_tail(&child->disco_list_node, &parent->port->disco_list);
 
@@ -806,6 +830,7 @@ static struct domain_device *sas_ex_discover_end_dev(
                 sas_init_dev(child);
 
                 child->rphy = rphy;
+                get_device(&rphy->dev);
                 sas_fill_in_rphy(child, rphy);
 
                 list_add_tail(&child->disco_list_node, &parent->port->disco_list);
@@ -830,8 +855,6 @@ static struct domain_device *sas_ex_discover_end_dev(
 
  out_list_del:
         sas_rphy_free(child->rphy);
-        child->rphy = NULL;
-
         list_del(&child->disco_list_node);
         spin_lock_irq(&parent->port->dev_list_lock);
         list_del(&child->dev_list_node);
@@ -911,6 +934,7 @@ static struct domain_device *sas_ex_discover_expander(
         }
         port = parent->port;
         child->rphy = rphy;
+        get_device(&rphy->dev);
         edev = rphy_to_expander_device(rphy);
         child->dev_type = phy->attached_dev_type;
         kref_get(&parent->kref);
@@ -934,6 +958,7 @@ static struct domain_device *sas_ex_discover_expander(
 
         res = sas_discover_expander(child);
         if (res) {
+                sas_rphy_delete(rphy);
                 spin_lock_irq(&parent->port->dev_list_lock);
                 list_del(&child->dev_list_node);
                 spin_unlock_irq(&parent->port->dev_list_lock);
@@ -1718,9 +1743,17 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
                 int phy_change_count = 0;
 
                 res = sas_get_phy_change_count(dev, i, &phy_change_count);
-                if (res)
-                        goto out;
-                else if (phy_change_count != ex->ex_phy[i].phy_change_count) {
+                switch (res) {
+                case SMP_RESP_PHY_VACANT:
+                case SMP_RESP_NO_PHY:
+                        continue;
+                case SMP_RESP_FUNC_ACC:
+                        break;
+                default:
+                        return res;
+                }
+
+                if (phy_change_count != ex->ex_phy[i].phy_change_count) {
                         if (update)
                                 ex->ex_phy[i].phy_change_count =
                                         phy_change_count;
@@ -1728,8 +1761,7 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
                         return 0;
                 }
         }
-out:
-        return res;
+        return 0;
 }
 
 static int sas_get_ex_change_count(struct domain_device *dev, int *ecc)
diff --git a/drivers/scsi/libsas/sas_init.c b/drivers/scsi/libsas/sas_init.c
index 120bff64be30..10cb5ae30977 100644
--- a/drivers/scsi/libsas/sas_init.c
+++ b/drivers/scsi/libsas/sas_init.c
@@ -94,8 +94,7 @@ void sas_hash_addr(u8 *hashed, const u8 *sas_addr)
 
 void sas_hae_reset(struct work_struct *work)
 {
-        struct sas_ha_event *ev =
-                container_of(work, struct sas_ha_event, work);
+        struct sas_ha_event *ev = to_sas_ha_event(work);
         struct sas_ha_struct *ha = ev->ha;
 
         clear_bit(HAE_RESET, &ha->pending);
@@ -369,14 +368,14 @@ static void sas_phy_release(struct sas_phy *phy)
 
 static void phy_reset_work(struct work_struct *work)
 {
-        struct sas_phy_data *d = container_of(work, typeof(*d), reset_work);
+        struct sas_phy_data *d = container_of(work, typeof(*d), reset_work.work);
 
         d->reset_result = transport_sas_phy_reset(d->phy, d->hard_reset);
 }
 
 static void phy_enable_work(struct work_struct *work)
 {
-        struct sas_phy_data *d = container_of(work, typeof(*d), enable_work);
+        struct sas_phy_data *d = container_of(work, typeof(*d), enable_work.work);
 
         d->enable_result = sas_phy_enable(d->phy, d->enable);
 }
@@ -389,8 +388,8 @@ static int sas_phy_setup(struct sas_phy *phy)
                 return -ENOMEM;
 
         mutex_init(&d->event_lock);
-        INIT_WORK(&d->reset_work, phy_reset_work);
-        INIT_WORK(&d->enable_work, phy_enable_work);
+        INIT_SAS_WORK(&d->reset_work, phy_reset_work);
+        INIT_SAS_WORK(&d->enable_work, phy_enable_work);
         d->phy = phy;
         phy->hostdata = d;
 
diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
index f05c63879949..507e4cf12e56 100644
--- a/drivers/scsi/libsas/sas_internal.h
+++ b/drivers/scsi/libsas/sas_internal.h
@@ -45,10 +45,10 @@ struct sas_phy_data {
         struct mutex event_lock;
         int hard_reset;
         int reset_result;
-        struct work_struct reset_work;
+        struct sas_work reset_work;
         int enable;
         int enable_result;
-        struct work_struct enable_work;
+        struct sas_work enable_work;
 };
 
 void sas_scsi_recover_host(struct Scsi_Host *shost);
@@ -80,7 +80,7 @@ void sas_porte_broadcast_rcvd(struct work_struct *work);
 void sas_porte_link_reset_err(struct work_struct *work);
 void sas_porte_timer_event(struct work_struct *work);
 void sas_porte_hard_reset(struct work_struct *work);
-void sas_queue_work(struct sas_ha_struct *ha, struct work_struct *work);
+void sas_queue_work(struct sas_ha_struct *ha, struct sas_work *sw);
 
 int sas_notify_lldd_dev_found(struct domain_device *);
 void sas_notify_lldd_dev_gone(struct domain_device *);
diff --git a/drivers/scsi/libsas/sas_phy.c b/drivers/scsi/libsas/sas_phy.c
index dcfd4a9105c5..521422e857ab 100644
--- a/drivers/scsi/libsas/sas_phy.c
+++ b/drivers/scsi/libsas/sas_phy.c
@@ -32,8 +32,7 @@
 
 static void sas_phye_loss_of_signal(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PHYE_LOSS_OF_SIGNAL, &phy->phy_events_pending);
@@ -43,8 +42,7 @@ static void sas_phye_loss_of_signal(struct work_struct *work)
 
 static void sas_phye_oob_done(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PHYE_OOB_DONE, &phy->phy_events_pending);
@@ -53,8 +51,7 @@ static void sas_phye_oob_done(struct work_struct *work)
 
 static void sas_phye_oob_error(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
         struct sas_ha_struct *sas_ha = phy->ha;
         struct asd_sas_port *port = phy->port;
@@ -85,8 +82,7 @@ static void sas_phye_oob_error(struct work_struct *work)
 
 static void sas_phye_spinup_hold(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
         struct sas_ha_struct *sas_ha = phy->ha;
         struct sas_internal *i =
@@ -127,14 +123,12 @@ int sas_register_phys(struct sas_ha_struct *sas_ha)
                 phy->error = 0;
                 INIT_LIST_HEAD(&phy->port_phy_el);
                 for (k = 0; k < PORT_NUM_EVENTS; k++) {
-                        INIT_WORK(&phy->port_events[k].work,
-                                  sas_port_event_fns[k]);
+                        INIT_SAS_WORK(&phy->port_events[k].work, sas_port_event_fns[k]);
                         phy->port_events[k].phy = phy;
                 }
 
                 for (k = 0; k < PHY_NUM_EVENTS; k++) {
-                        INIT_WORK(&phy->phy_events[k].work,
-                                  sas_phy_event_fns[k]);
+                        INIT_SAS_WORK(&phy->phy_events[k].work, sas_phy_event_fns[k]);
                         phy->phy_events[k].phy = phy;
                 }
 
@@ -144,8 +138,7 @@ int sas_register_phys(struct sas_ha_struct *sas_ha)
                 spin_lock_init(&phy->sas_prim_lock);
                 phy->frame_rcvd_size = 0;
 
-                phy->phy = sas_phy_alloc(&sas_ha->core.shost->shost_gendev,
-                                         i);
+                phy->phy = sas_phy_alloc(&sas_ha->core.shost->shost_gendev, i);
                 if (!phy->phy)
                         return -ENOMEM;
 
diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
index eb19c016d500..e884a8c58a0c 100644
--- a/drivers/scsi/libsas/sas_port.c
+++ b/drivers/scsi/libsas/sas_port.c
@@ -123,7 +123,7 @@ static void sas_form_port(struct asd_sas_phy *phy)
         spin_unlock_irqrestore(&sas_ha->phy_port_lock, flags);
 
         if (!port->port) {
-                port->port = sas_port_alloc(phy->phy->dev.parent, phy->id);
+                port->port = sas_port_alloc(phy->phy->dev.parent, port->id);
                 BUG_ON(!port->port);
                 sas_port_add(port->port);
         }
@@ -208,8 +208,7 @@ void sas_deform_port(struct asd_sas_phy *phy, int gone)
 
 void sas_porte_bytes_dmaed(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PORTE_BYTES_DMAED, &phy->port_events_pending);
@@ -219,8 +218,7 @@ void sas_porte_bytes_dmaed(struct work_struct *work)
 
 void sas_porte_broadcast_rcvd(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
         unsigned long flags;
         u32 prim;
@@ -237,8 +235,7 @@ void sas_porte_broadcast_rcvd(struct work_struct *work)
 
 void sas_porte_link_reset_err(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PORTE_LINK_RESET_ERR, &phy->port_events_pending);
@@ -248,8 +245,7 @@ void sas_porte_link_reset_err(struct work_struct *work)
 
 void sas_porte_timer_event(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PORTE_TIMER_EVENT, &phy->port_events_pending);
@@ -259,8 +255,7 @@ void sas_porte_timer_event(struct work_struct *work)
 
 void sas_porte_hard_reset(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PORTE_HARD_RESET, &phy->port_events_pending);
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 2cfcbffa41fd..386f0c53bea7 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -835,7 +835,7 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, unsigned char *cmnd,
 
         scsi_eh_restore_cmnd(scmd, &ses);
 
-        if (sdrv->eh_action)
+        if (sdrv && sdrv->eh_action)
                 rtn = sdrv->eh_action(scmd, cmnd, cmnd_size, rtn);
 
         return rtn;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ead6405f3e51..5dfd7495d1a1 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1638,7 +1638,7 @@ struct request_queue *__scsi_alloc_queue(struct Scsi_Host *shost,
                                          request_fn_proc *request_fn)
 {
         struct request_queue *q;
-        struct device *dev = shost->shost_gendev.parent;
+        struct device *dev = shost->dma_dev;
 
         q = blk_init_queue(request_fn, NULL);
         if (!q)
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 3ed748355b98..00c024039c97 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -74,7 +74,7 @@ config SPI_ATMEL
           This selects a driver for the Atmel SPI Controller, present on
           many AT32 (AVR32) and AT91 (ARM) chips.
 
-config SPI_BFIN
+config SPI_BFIN5XX
         tristate "SPI controller driver for ADI Blackfin5xx"
         depends on BLACKFIN
         help
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index a1d48e0ba3dc..9d75d2198ff5 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -15,7 +15,7 @@ obj-$(CONFIG_SPI_ATMEL)			+= spi-atmel.o
 obj-$(CONFIG_SPI_ATH79)                 += spi-ath79.o
 obj-$(CONFIG_SPI_AU1550)                += spi-au1550.o
 obj-$(CONFIG_SPI_BCM63XX)               += spi-bcm63xx.o
-obj-$(CONFIG_SPI_BFIN)                  += spi-bfin5xx.o
+obj-$(CONFIG_SPI_BFIN5XX)               += spi-bfin5xx.o
 obj-$(CONFIG_SPI_BFIN_SPORT)            += spi-bfin-sport.o
 obj-$(CONFIG_SPI_BITBANG)               += spi-bitbang.o
 obj-$(CONFIG_SPI_BUTTERFLY)             += spi-butterfly.o
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index f01b2648452e..7491971139a6 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -1,7 +1,7 @@
 /*
  * Broadcom BCM63xx SPI controller support
  *
- * Copyright (C) 2009-2011 Florian Fainelli <florian@openwrt.org>
+ * Copyright (C) 2009-2012 Florian Fainelli <florian@openwrt.org>
  * Copyright (C) 2010 Tanguy Bouzeloc <tanguy.bouzeloc@efixo.com>
  *
  * This program is free software; you can redistribute it and/or
@@ -30,6 +30,8 @@
 #include <linux/spi/spi.h>
 #include <linux/completion.h>
 #include <linux/err.h>
+#include <linux/workqueue.h>
+#include <linux/pm_runtime.h>
 
 #include <bcm63xx_dev_spi.h>
 
@@ -37,8 +39,6 @@
 #define DRV_VER         "0.1.2"
 
 struct bcm63xx_spi {
-        spinlock_t              lock;
-        int                     stopping;
         struct completion       done;
 
         void __iomem            *regs;
@@ -96,17 +96,12 @@ static const unsigned bcm63xx_spi_freq_table[SPI_CLK_MASK][2] = {
         {   391000, SPI_CLK_0_391MHZ }
 };
 
-static int bcm63xx_spi_setup_transfer(struct spi_device *spi,
-                                      struct spi_transfer *t)
+static int bcm63xx_spi_check_transfer(struct spi_device *spi,
+                                        struct spi_transfer *t)
 {
-        struct bcm63xx_spi *bs = spi_master_get_devdata(spi->master);
         u8 bits_per_word;
-        u8 clk_cfg, reg;
-        u32 hz;
-        int i;
 
         bits_per_word = (t) ? t->bits_per_word : spi->bits_per_word;
-        hz = (t) ? t->speed_hz : spi->max_speed_hz;
         if (bits_per_word != 8) {
                 dev_err(&spi->dev, "%s, unsupported bits_per_word=%d\n",
                         __func__, bits_per_word);
@@ -119,6 +114,19 @@ static int bcm63xx_spi_setup_transfer(struct spi_device *spi,
                 return -EINVAL;
         }
 
+        return 0;
+}
+
+static void bcm63xx_spi_setup_transfer(struct spi_device *spi,
+                                      struct spi_transfer *t)
+{
+        struct bcm63xx_spi *bs = spi_master_get_devdata(spi->master);
+        u32 hz;
+        u8 clk_cfg, reg;
+        int i;
+
+        hz = (t) ? t->speed_hz : spi->max_speed_hz;
+
         /* Find the closest clock configuration */
         for (i = 0; i < SPI_CLK_MASK; i++) {
                 if (hz <= bcm63xx_spi_freq_table[i][0]) {
@@ -139,8 +147,6 @@ static int bcm63xx_spi_setup_transfer(struct spi_device *spi,
         bcm_spi_writeb(bs, reg, SPI_CLK_CFG);
         dev_dbg(&spi->dev, "Setting clock register to %02x (hz %d)\n",
                 clk_cfg, hz);
-
-        return 0;
 }
 
 /* the spi->mode bits understood by this driver: */
@@ -153,9 +159,6 @@ static int bcm63xx_spi_setup(struct spi_device *spi)
 
         bs = spi_master_get_devdata(spi->master);
 
-        if (bs->stopping)
-                return -ESHUTDOWN;
-
         if (!spi->bits_per_word)
                 spi->bits_per_word = 8;
 
@@ -165,7 +168,7 @@ static int bcm63xx_spi_setup(struct spi_device *spi)
                 return -EINVAL;
         }
 
-        ret = bcm63xx_spi_setup_transfer(spi, NULL);
+        ret = bcm63xx_spi_check_transfer(spi, NULL);
         if (ret < 0) {
                 dev_err(&spi->dev, "setup: unsupported mode bits %x\n",
                         spi->mode & ~MODEBITS);
@@ -190,28 +193,29 @@ static void bcm63xx_spi_fill_tx_fifo(struct bcm63xx_spi *bs)
         bs->remaining_bytes -= size;
 }
 
-static int bcm63xx_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
+static unsigned int bcm63xx_txrx_bufs(struct spi_device *spi,
+                                        struct spi_transfer *t)
 {
         struct bcm63xx_spi *bs = spi_master_get_devdata(spi->master);
         u16 msg_ctl;
         u16 cmd;
 
+        /* Disable the CMD_DONE interrupt */
+        bcm_spi_writeb(bs, 0, SPI_INT_MASK);
+
         dev_dbg(&spi->dev, "txrx: tx %p, rx %p, len %d\n",
                 t->tx_buf, t->rx_buf, t->len);
 
         /* Transmitter is inhibited */
         bs->tx_ptr = t->tx_buf;
         bs->rx_ptr = t->rx_buf;
-        init_completion(&bs->done);
 
         if (t->tx_buf) {
                 bs->remaining_bytes = t->len;
                 bcm63xx_spi_fill_tx_fifo(bs);
         }
 
-        /* Enable the command done interrupt which
-         * we use to determine completion of a command */
-        bcm_spi_writeb(bs, SPI_INTR_CMD_DONE, SPI_INT_MASK);
+        init_completion(&bs->done);
 
         /* Fill in the Message control register */
         msg_ctl = (t->len << SPI_BYTE_CNT_SHIFT);
@@ -230,33 +234,76 @@ static int bcm63xx_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
         cmd |= (0 << SPI_CMD_PREPEND_BYTE_CNT_SHIFT);
         cmd |= (spi->chip_select << SPI_CMD_DEVICE_ID_SHIFT);
         bcm_spi_writew(bs, cmd, SPI_CMD);
-        wait_for_completion(&bs->done);
 
-        /* Disable the CMD_DONE interrupt */
-        bcm_spi_writeb(bs, 0, SPI_INT_MASK);
+        /* Enable the CMD_DONE interrupt */
+        bcm_spi_writeb(bs, SPI_INTR_CMD_DONE, SPI_INT_MASK);
 
         return t->len - bs->remaining_bytes;
 }
 
-static int bcm63xx_transfer(struct spi_device *spi, struct spi_message *m)
+static int bcm63xx_spi_prepare_transfer(struct spi_master *master)
 {
-        struct bcm63xx_spi *bs = spi_master_get_devdata(spi->master);
-        struct spi_transfer *t;
-        int ret = 0;
+        struct bcm63xx_spi *bs = spi_master_get_devdata(master);
 
-        if (unlikely(list_empty(&m->transfers)))
-                return -EINVAL;
+        pm_runtime_get_sync(&bs->pdev->dev);
 
-        if (bs->stopping)
-                return -ESHUTDOWN;
+        return 0;
+}
+
+static int bcm63xx_spi_unprepare_transfer(struct spi_master *master)
+{
+        struct bcm63xx_spi *bs = spi_master_get_devdata(master);
+
+        pm_runtime_put(&bs->pdev->dev);
+
+        return 0;
+}
+
+static int bcm63xx_spi_transfer_one(struct spi_master *master,
+                                        struct spi_message *m)
+{
+        struct bcm63xx_spi *bs = spi_master_get_devdata(master);
+        struct spi_transfer *t;
+        struct spi_device *spi = m->spi;
+        int status = 0;
+        unsigned int timeout = 0;
 
         list_for_each_entry(t, &m->transfers, transfer_list) {
-                ret += bcm63xx_txrx_bufs(spi, t);
-        }
+                unsigned int len = t->len;
+                u8 rx_tail;
 
-        m->complete(m->context);
+                status = bcm63xx_spi_check_transfer(spi, t);
+                if (status < 0)
+                        goto exit;
 
-        return ret;
+                /* configure adapter for a new transfer */
+                bcm63xx_spi_setup_transfer(spi, t);
+
+                while (len) {
+                        /* send the data */
+                        len -= bcm63xx_txrx_bufs(spi, t);
+
+                        timeout = wait_for_completion_timeout(&bs->done, HZ);
+                        if (!timeout) {
+                                status = -ETIMEDOUT;
+                                goto exit;
+                        }
+
+                        /* read out all data */
+                        rx_tail = bcm_spi_readb(bs, SPI_RX_TAIL);
+
+                        /* Read out all the data */
+                        if (rx_tail)
+                                memcpy_fromio(bs->rx_ptr, bs->rx_io, rx_tail);
+                }
+
+                m->actual_length += t->len;
+        }
+exit:
+        m->status = status;
+        spi_finalize_current_message(master);
+
+        return 0;
 }
 
 /* This driver supports single master mode only. Hence
@@ -267,39 +314,15 @@ static irqreturn_t bcm63xx_spi_interrupt(int irq, void *dev_id)
         struct spi_master *master = (struct spi_master *)dev_id;
         struct bcm63xx_spi *bs = spi_master_get_devdata(master);
         u8 intr;
-        u16 cmd;
 
         /* Read interupts and clear them immediately */
         intr = bcm_spi_readb(bs, SPI_INT_STATUS);
         bcm_spi_writeb(bs, SPI_INTR_CLEAR_ALL, SPI_INT_STATUS);
         bcm_spi_writeb(bs, 0, SPI_INT_MASK);
 
-        /* A tansfer completed */
-        if (intr & SPI_INTR_CMD_DONE) {
-                u8 rx_tail;
-
-                rx_tail = bcm_spi_readb(bs, SPI_RX_TAIL);
-
-                /* Read out all the data */
-                if (rx_tail)
-                        memcpy_fromio(bs->rx_ptr, bs->rx_io, rx_tail);
-
-                /* See if there is more data to send */
-                if (bs->remaining_bytes > 0) {
-                        bcm63xx_spi_fill_tx_fifo(bs);
-
-                        /* Start the transfer */
-                        bcm_spi_writew(bs, SPI_HD_W << SPI_MSG_TYPE_SHIFT,
-                                       SPI_MSG_CTL);
-                        cmd = bcm_spi_readw(bs, SPI_CMD);
-                        cmd |= SPI_CMD_START_IMMEDIATE;
-                        cmd |= (0 << SPI_CMD_PREPEND_BYTE_CNT_SHIFT);
-                        bcm_spi_writeb(bs, SPI_INTR_CMD_DONE, SPI_INT_MASK);
-                        bcm_spi_writew(bs, cmd, SPI_CMD);
-                } else {
-                        complete(&bs->done);
-                }
-        }
+        /* A transfer completed */
+        if (intr & SPI_INTR_CMD_DONE)
+                complete(&bs->done);
 
         return IRQ_HANDLED;
 }
@@ -345,7 +368,6 @@ static int __devinit bcm63xx_spi_probe(struct platform_device *pdev)
         }
 
         bs = spi_master_get_devdata(master);
-        init_completion(&bs->done);
 
         platform_set_drvdata(pdev, master);
         bs->pdev = pdev;
@@ -379,12 +401,13 @@ static int __devinit bcm63xx_spi_probe(struct platform_device *pdev)
         master->bus_num = pdata->bus_num;
         master->num_chipselect = pdata->num_chipselect;
         master->setup = bcm63xx_spi_setup;
-        master->transfer = bcm63xx_transfer;
+        master->prepare_transfer_hardware = bcm63xx_spi_prepare_transfer;
+        master->unprepare_transfer_hardware = bcm63xx_spi_unprepare_transfer;
+        master->transfer_one_message = bcm63xx_spi_transfer_one;
+        master->mode_bits = MODEBITS;
         bs->speed_hz = pdata->speed_hz;
-        bs->stopping = 0;
         bs->tx_io = (u8 *)(bs->regs + bcm63xx_spireg(SPI_MSG_DATA));
         bs->rx_io = (const u8 *)(bs->regs + bcm63xx_spireg(SPI_RX_DATA));
-        spin_lock_init(&bs->lock);
 
         /* Initialize hardware */
         clk_enable(bs->clk);
@@ -418,18 +441,16 @@ static int __devexit bcm63xx_spi_remove(struct platform_device *pdev)
         struct spi_master *master = platform_get_drvdata(pdev);
         struct bcm63xx_spi *bs = spi_master_get_devdata(master);
 
+        spi_unregister_master(master);
+
         /* reset spi block */
         bcm_spi_writeb(bs, 0, SPI_INT_MASK);
-        spin_lock(&bs->lock);
-        bs->stopping = 1;
 
         /* HW shutdown */
         clk_disable(bs->clk);
         clk_put(bs->clk);
 
-        spin_unlock(&bs->lock);
         platform_set_drvdata(pdev, 0);
-        spi_unregister_master(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-bfin-sport.c b/drivers/spi/spi-bfin-sport.c
index 248a2cc671a9..1fe51198a622 100644
--- a/drivers/spi/spi-bfin-sport.c
+++ b/drivers/spi/spi-bfin-sport.c
@@ -252,19 +252,15 @@ static void
 bfin_sport_spi_restore_state(struct bfin_sport_spi_master_data *drv_data)
 {
         struct bfin_sport_spi_slave_data *chip = drv_data->cur_chip;
-        unsigned int bits = (drv_data->ops == &bfin_sport_transfer_ops_u8 ? 7 : 15);
 
         bfin_sport_spi_disable(drv_data);
         dev_dbg(drv_data->dev, "restoring spi ctl state\n");
 
         bfin_write(&drv_data->regs->tcr1, chip->ctl_reg);
-        bfin_write(&drv_data->regs->tcr2, bits);
         bfin_write(&drv_data->regs->tclkdiv, chip->baud);
-        bfin_write(&drv_data->regs->tfsdiv, bits);
         SSYNC();
 
         bfin_write(&drv_data->regs->rcr1, chip->ctl_reg & ~(ITCLK | ITFS));
-        bfin_write(&drv_data->regs->rcr2, bits);
         SSYNC();
 
         bfin_sport_spi_cs_active(chip);
@@ -420,11 +416,15 @@ bfin_sport_spi_pump_transfers(unsigned long data)
         drv_data->cs_change = transfer->cs_change;
 
         /* Bits per word setup */
-        bits_per_word = transfer->bits_per_word ? : message->spi->bits_per_word;
-        if (bits_per_word == 8)
-                drv_data->ops = &bfin_sport_transfer_ops_u8;
-        else
+        bits_per_word = transfer->bits_per_word ? :
+                message->spi->bits_per_word ? : 8;
+        if (bits_per_word % 16 == 0)
                 drv_data->ops = &bfin_sport_transfer_ops_u16;
+        else
+                drv_data->ops = &bfin_sport_transfer_ops_u8;
+        bfin_write(&drv_data->regs->tcr2, bits_per_word - 1);
+        bfin_write(&drv_data->regs->tfsdiv, bits_per_word - 1);
+        bfin_write(&drv_data->regs->rcr2, bits_per_word - 1);
 
         drv_data->state = RUNNING_STATE;
 
@@ -598,11 +598,12 @@ bfin_sport_spi_setup(struct spi_device *spi)
                         }
                         chip->cs_chg_udelay = chip_info->cs_chg_udelay;
                         chip->idle_tx_val = chip_info->idle_tx_val;
-                        spi->bits_per_word = chip_info->bits_per_word;
                 }
         }
 
-        if (spi->bits_per_word != 8 && spi->bits_per_word != 16) {
+        if (spi->bits_per_word % 8) {
+                dev_err(&spi->dev, "%d bits_per_word is not supported\n",
+                                spi->bits_per_word);
                 ret = -EINVAL;
                 goto error;
         }
diff --git a/drivers/spi/spi-bfin5xx.c b/drivers/spi/spi-bfin5xx.c
index 3b83ff8b1e2b..9bb4d4af8547 100644
--- a/drivers/spi/spi-bfin5xx.c
+++ b/drivers/spi/spi-bfin5xx.c
@@ -396,7 +396,7 @@ static irqreturn_t bfin_spi_pio_irq_handler(int irq, void *dev_id)
                 /* last read */
                 if (drv_data->rx) {
                         dev_dbg(&drv_data->pdev->dev, "last read\n");
-                        if (n_bytes % 2) {
+                        if (!(n_bytes % 2)) {
                                 u16 *buf = (u16 *)drv_data->rx;
                                 for (loop = 0; loop < n_bytes / 2; loop++)
                                         *buf++ = bfin_read(&drv_data->regs->rdbr);
@@ -424,7 +424,7 @@ static irqreturn_t bfin_spi_pio_irq_handler(int irq, void *dev_id)
         if (drv_data->rx && drv_data->tx) {
                 /* duplex */
                 dev_dbg(&drv_data->pdev->dev, "duplex: write_TDBR\n");
-                if (n_bytes % 2) {
+                if (!(n_bytes % 2)) {
                         u16 *buf = (u16 *)drv_data->rx;
                         u16 *buf2 = (u16 *)drv_data->tx;
                         for (loop = 0; loop < n_bytes / 2; loop++) {
@@ -442,7 +442,7 @@ static irqreturn_t bfin_spi_pio_irq_handler(int irq, void *dev_id)
         } else if (drv_data->rx) {
                 /* read */
                 dev_dbg(&drv_data->pdev->dev, "read: write_TDBR\n");
-                if (n_bytes % 2) {
+                if (!(n_bytes % 2)) {
                         u16 *buf = (u16 *)drv_data->rx;
                         for (loop = 0; loop < n_bytes / 2; loop++) {
                                 *buf++ = bfin_read(&drv_data->regs->rdbr);
@@ -458,7 +458,7 @@ static irqreturn_t bfin_spi_pio_irq_handler(int irq, void *dev_id)
         } else if (drv_data->tx) {
                 /* write */
                 dev_dbg(&drv_data->pdev->dev, "write: write_TDBR\n");
-                if (n_bytes % 2) {
+                if (!(n_bytes % 2)) {
                         u16 *buf = (u16 *)drv_data->tx;
                         for (loop = 0; loop < n_bytes / 2; loop++) {
                                 bfin_read(&drv_data->regs->rdbr);
@@ -587,6 +587,7 @@ static void bfin_spi_pump_transfers(unsigned long data)
         if (message->state == DONE_STATE) {
                 dev_dbg(&drv_data->pdev->dev, "transfer: all done!\n");
                 message->status = 0;
+                bfin_spi_flush(drv_data);
                 bfin_spi_giveback(drv_data);
                 return;
         }
@@ -870,8 +871,10 @@ static void bfin_spi_pump_transfers(unsigned long data)
                 message->actual_length += drv_data->len_in_bytes;
                 /* Move to next transfer of this msg */
                 message->state = bfin_spi_next_transfer(drv_data);
-                if (drv_data->cs_change)
+                if (drv_data->cs_change && message->state != DONE_STATE) {
+                        bfin_spi_flush(drv_data);
                         bfin_spi_cs_deactive(drv_data, chip);
+                }
         }
 
         /* Schedule next transfer tasklet */
@@ -1026,7 +1029,6 @@ static int bfin_spi_setup(struct spi_device *spi)
                 chip->cs_chg_udelay = chip_info->cs_chg_udelay;
                 chip->idle_tx_val = chip_info->idle_tx_val;
                 chip->pio_interrupt = chip_info->pio_interrupt;
-                spi->bits_per_word = chip_info->bits_per_word;
         } else {
                 /* force a default base state */
                 chip->ctl_reg &= bfin_ctl_reg;
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index 31bfba805cf4..9b2901feaf78 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -653,7 +653,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
                         dev_dbg(sdev, "Couldn't DMA map a %d bytes RX buffer\n",
                                                                 rx_buf_count);
                         if (t->tx_buf)
-                                dma_unmap_single(NULL, t->tx_dma, t->len,
+                                dma_unmap_single(&spi->dev, t->tx_dma, t->len,
                                                                 DMA_TO_DEVICE);
                         return -ENOMEM;
                 }
@@ -692,10 +692,10 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
         if (spicfg->io_type == SPI_IO_TYPE_DMA) {
 
                 if (t->tx_buf)
-                        dma_unmap_single(NULL, t->tx_dma, t->len,
+                        dma_unmap_single(&spi->dev, t->tx_dma, t->len,
                                                                 DMA_TO_DEVICE);
 
-                dma_unmap_single(NULL, t->rx_dma, rx_buf_count,
+                dma_unmap_single(&spi->dev, t->rx_dma, rx_buf_count,
                                                         DMA_FROM_DEVICE);
 
                 clear_io_bits(dspi->base + SPIINT, SPIINT_DMA_REQ_EN);
diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
index 6db2887852d6..e8055073e84d 100644
--- a/drivers/spi/spi-ep93xx.c
+++ b/drivers/spi/spi-ep93xx.c
@@ -545,13 +545,12 @@ static void ep93xx_spi_pio_transfer(struct ep93xx_spi *espi)
  * in case of failure.
  */
 static struct dma_async_tx_descriptor *
-ep93xx_spi_dma_prepare(struct ep93xx_spi *espi, enum dma_data_direction dir)
+ep93xx_spi_dma_prepare(struct ep93xx_spi *espi, enum dma_transfer_direction dir)
 {
         struct spi_transfer *t = espi->current_msg->state;
         struct dma_async_tx_descriptor *txd;
         enum dma_slave_buswidth buswidth;
         struct dma_slave_config conf;
-        enum dma_transfer_direction slave_dirn;
         struct scatterlist *sg;
         struct sg_table *sgt;
         struct dma_chan *chan;
@@ -567,14 +566,13 @@ ep93xx_spi_dma_prepare(struct ep93xx_spi *espi, enum dma_data_direction dir)
         memset(&conf, 0, sizeof(conf));
         conf.direction = dir;
 
-        if (dir == DMA_FROM_DEVICE) {
+        if (dir == DMA_DEV_TO_MEM) {
                 chan = espi->dma_rx;
                 buf = t->rx_buf;
                 sgt = &espi->rx_sgt;
 
                 conf.src_addr = espi->sspdr_phys;
                 conf.src_addr_width = buswidth;
-                slave_dirn = DMA_DEV_TO_MEM;
         } else {
                 chan = espi->dma_tx;
                 buf = t->tx_buf;
@@ -582,7 +580,6 @@ ep93xx_spi_dma_prepare(struct ep93xx_spi *espi, enum dma_data_direction dir)
 
                 conf.dst_addr = espi->sspdr_phys;
                 conf.dst_addr_width = buswidth;
-                slave_dirn = DMA_MEM_TO_DEV;
         }
 
         ret = dmaengine_slave_config(chan, &conf);
@@ -633,8 +630,7 @@ ep93xx_spi_dma_prepare(struct ep93xx_spi *espi, enum dma_data_direction dir)
         if (!nents)
                 return ERR_PTR(-ENOMEM);
 
-        txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents,
-                                        slave_dirn, DMA_CTRL_ACK);
+        txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, dir, DMA_CTRL_ACK);
         if (!txd) {
                 dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir);
                 return ERR_PTR(-ENOMEM);
@@ -651,12 +647,12 @@ ep93xx_spi_dma_prepare(struct ep93xx_spi *espi, enum dma_data_direction dir)
  * unmapped.
  */
 static void ep93xx_spi_dma_finish(struct ep93xx_spi *espi,
-                                  enum dma_data_direction dir)
+                                  enum dma_transfer_direction dir)
 {
         struct dma_chan *chan;
         struct sg_table *sgt;
 
-        if (dir == DMA_FROM_DEVICE) {
+        if (dir == DMA_DEV_TO_MEM) {
                 chan = espi->dma_rx;
                 sgt = &espi->rx_sgt;
         } else {
@@ -677,16 +673,16 @@ static void ep93xx_spi_dma_transfer(struct ep93xx_spi *espi)
         struct spi_message *msg = espi->current_msg;
         struct dma_async_tx_descriptor *rxd, *txd;
 
-        rxd = ep93xx_spi_dma_prepare(espi, DMA_FROM_DEVICE);
+        rxd = ep93xx_spi_dma_prepare(espi, DMA_DEV_TO_MEM);
         if (IS_ERR(rxd)) {
                 dev_err(&espi->pdev->dev, "DMA RX failed: %ld\n", PTR_ERR(rxd));
                 msg->status = PTR_ERR(rxd);
                 return;
         }
 
-        txd = ep93xx_spi_dma_prepare(espi, DMA_TO_DEVICE);
+        txd = ep93xx_spi_dma_prepare(espi, DMA_MEM_TO_DEV);
         if (IS_ERR(txd)) {
-                ep93xx_spi_dma_finish(espi, DMA_FROM_DEVICE);
+                ep93xx_spi_dma_finish(espi, DMA_DEV_TO_MEM);
                 dev_err(&espi->pdev->dev, "DMA TX failed: %ld\n", PTR_ERR(rxd));
                 msg->status = PTR_ERR(txd);
                 return;
@@ -705,8 +701,8 @@ static void ep93xx_spi_dma_transfer(struct ep93xx_spi *espi)
 
         wait_for_completion(&espi->wait);
 
-        ep93xx_spi_dma_finish(espi, DMA_TO_DEVICE);
-        ep93xx_spi_dma_finish(espi, DMA_FROM_DEVICE);
+        ep93xx_spi_dma_finish(espi, DMA_MEM_TO_DEV);
+        ep93xx_spi_dma_finish(espi, DMA_DEV_TO_MEM);
 }
 
 /**
diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index 24cacff57786..5f748c0d96bd 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -139,10 +139,12 @@ static void fsl_spi_change_mode(struct spi_device *spi)
 static void fsl_spi_chipselect(struct spi_device *spi, int value)
 {
         struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
-        struct fsl_spi_platform_data *pdata = spi->dev.parent->platform_data;
+        struct fsl_spi_platform_data *pdata;
         bool pol = spi->mode & SPI_CS_HIGH;
         struct spi_mpc8xxx_cs   *cs = spi->controller_state;
 
+        pdata = spi->dev.parent->parent->platform_data;
+
         if (value == BITBANG_CS_INACTIVE) {
                 if (pdata->cs_control)
                         pdata->cs_control(spi, !pol);
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 31054e3de4c1..570f22053be8 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -83,7 +83,7 @@ struct spi_imx_data {
         struct spi_bitbang bitbang;
 
         struct completion xfer_done;
-        void *base;
+        void __iomem *base;
         int irq;
         struct clk *clk;
         unsigned long spi_clk;
@@ -766,8 +766,12 @@ static int __devinit spi_imx_probe(struct platform_device *pdev)
         }
 
         ret = of_property_read_u32(np, "fsl,spi-num-chipselects", &num_cs);
-        if (ret < 0)
-                num_cs = mxc_platform_info->num_chipselect;
+        if (ret < 0) {
+                if (mxc_platform_info)
+                        num_cs = mxc_platform_info->num_chipselect;
+                else
+                        return ret;
+        }
 
         master = spi_alloc_master(&pdev->dev,
                         sizeof(struct spi_imx_data) + sizeof(int) * num_cs);
@@ -784,7 +788,7 @@ static int __devinit spi_imx_probe(struct platform_device *pdev)
 
         for (i = 0; i < master->num_chipselect; i++) {
                 int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
-                if (cs_gpio < 0)
+                if (cs_gpio < 0 && mxc_platform_info)
                         cs_gpio = mxc_platform_info->chipselect[i];
 
                 spi_imx->chipselect[i] = cs_gpio;
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 96f0da66b185..400ae2121a2a 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1667,9 +1667,15 @@ static int calculate_effective_freq(struct pl022 *pl022, int freq, struct
         /* cpsdvsr = 254 & scr = 255 */
         min_tclk = spi_rate(rate, CPSDVR_MAX, SCR_MAX);
 
-        if (!((freq <= max_tclk) && (freq >= min_tclk))) {
+        if (freq > max_tclk)
+                dev_warn(&pl022->adev->dev,
+                        "Max speed that can be programmed is %d Hz, you requested %d\n",
+                        max_tclk, freq);
+
+        if (freq < min_tclk) {
                 dev_err(&pl022->adev->dev,
-                        "controller data is incorrect: out of range frequency");
+                        "Requested frequency: %d Hz is less than minimum possible %d Hz\n",
+                        freq, min_tclk);
                 return -EINVAL;
         }
 
@@ -1681,26 +1687,37 @@ static int calculate_effective_freq(struct pl022 *pl022, int freq, struct
                 while (scr <= SCR_MAX) {
                         tmp = spi_rate(rate, cpsdvsr, scr);
 
-                        if (tmp > freq)
+                        if (tmp > freq) {
+                                /* we need lower freq */
                                 scr++;
+                                continue;
+                        }
+
                         /*
-                         * If found exact value, update and break.
-                         * If found more closer value, update and continue.
+                         * If found exact value, mark found and break.
+                         * If found more closer value, update and break.
                          */
-                        else if ((tmp == freq) || (tmp > best_freq)) {
+                        if (tmp > best_freq) {
                                 best_freq = tmp;
                                 best_cpsdvsr = cpsdvsr;
                                 best_scr = scr;
 
                                 if (tmp == freq)
-                                        break;
+                                        found = 1;
                         }
-                        scr++;
+                        /*
+                         * increased scr will give lower rates, which are not
+                         * required
+                         */
+                        break;
                 }
                 cpsdvsr += 2;
                 scr = SCR_MIN;
         }
 
+        WARN(!best_freq, "pl022: Matching cpsdvsr and scr not found for %d Hz rate \n",
+                        freq);
+
         clk_freq->cpsdvsr = (u8) (best_cpsdvsr & 0xFF);
         clk_freq->scr = (u8) (best_scr & 0xFF);
         dev_dbg(&pl022->adev->dev,
@@ -1823,9 +1840,12 @@ static int pl022_setup(struct spi_device *spi)
         } else
                 chip->cs_control = chip_info->cs_control;
 
-        if (bits <= 3) {
-                /* PL022 doesn't support less than 4-bits */
+        /* Check bits per word with vendor specific range */
+        if ((bits <= 3) || (bits > pl022->vendor->max_bpw)) {
                 status = -ENOTSUPP;
+                dev_err(&spi->dev, "illegal data size for this controller!\n");
+                dev_err(&spi->dev, "This controller can only handle 4 <= n <= %d bit words\n",
+                                pl022->vendor->max_bpw);
                 goto err_config_params;
         } else if (bits <= 8) {
                 dev_dbg(&spi->dev, "4 <= n <=8 bits per word\n");
@@ -1838,20 +1858,10 @@ static int pl022_setup(struct spi_device *spi)
                 chip->read = READING_U16;
                 chip->write = WRITING_U16;
         } else {
-                if (pl022->vendor->max_bpw >= 32) {
-                        dev_dbg(&spi->dev, "17 <= n <= 32 bits per word\n");
-                        chip->n_bytes = 4;
-                        chip->read = READING_U32;
-                        chip->write = WRITING_U32;
-                } else {
-                        dev_err(&spi->dev,
-                                "illegal data size for this controller!\n");
-                        dev_err(&spi->dev,
-                                "a standard pl022 can only handle "
-                                "1 <= n <= 16 bit words\n");
-                        status = -ENOTSUPP;
-                        goto err_config_params;
-                }
+                dev_dbg(&spi->dev, "17 <= n <= 32 bits per word\n");
+                chip->n_bytes = 4;
+                chip->read = READING_U32;
+                chip->write = WRITING_U32;
         }
 
         /* Now Initialize all register settings required for this chip */
@@ -2195,7 +2205,6 @@ static int pl022_runtime_suspend(struct device *dev)
         struct pl022 *pl022 = dev_get_drvdata(dev);
 
         clk_disable(pl022->clk);
-        amba_vcore_disable(pl022->adev);
 
         return 0;
 }
@@ -2204,7 +2213,6 @@ static int pl022_runtime_resume(struct device *dev)
 {
         struct pl022 *pl022 = dev_get_drvdata(dev);
 
-        amba_vcore_enable(pl022->adev);
         clk_enable(pl022->clk);
 
         return 0;
diff --git a/drivers/staging/android/Kconfig b/drivers/staging/android/Kconfig
index 08a3b1133d29..eb1dee26bda3 100644
--- a/drivers/staging/android/Kconfig
+++ b/drivers/staging/android/Kconfig
@@ -27,13 +27,14 @@ config ANDROID_LOGGER
 
 config ANDROID_PERSISTENT_RAM
         bool
+        depends on HAVE_MEMBLOCK
         select REED_SOLOMON
         select REED_SOLOMON_ENC8
         select REED_SOLOMON_DEC8
 
 config ANDROID_RAM_CONSOLE
         bool "Android RAM buffer console"
-        depends on !S390 && !UML
+        depends on !S390 && !UML && HAVE_MEMBLOCK
         select ANDROID_PERSISTENT_RAM
         default n
 
diff --git a/drivers/staging/android/lowmemorykiller.c b/drivers/staging/android/lowmemorykiller.c
index 052b43e4e505..b91e4bc332a7 100644
--- a/drivers/staging/android/lowmemorykiller.c
+++ b/drivers/staging/android/lowmemorykiller.c
@@ -55,7 +55,6 @@ static int lowmem_minfree[6] = {
 };
 static int lowmem_minfree_size = 4;
 
-static struct task_struct *lowmem_deathpending;
 static unsigned long lowmem_deathpending_timeout;
 
 #define lowmem_print(level, x...)                       \
@@ -64,24 +63,6 @@ static unsigned long lowmem_deathpending_timeout;
                         printk(x);                      \
         } while (0)
 
-static int
-task_notify_func(struct notifier_block *self, unsigned long val, void *data);
-
-static struct notifier_block task_nb = {
-        .notifier_call  = task_notify_func,
-};
-
-static int
-task_notify_func(struct notifier_block *self, unsigned long val, void *data)
-{
-        struct task_struct *task = data;
-
-        if (task == lowmem_deathpending)
-                lowmem_deathpending = NULL;
-
-        return NOTIFY_OK;
-}
-
 static int lowmem_shrink(struct shrinker *s, struct shrink_control *sc)
 {
         struct task_struct *tsk;
@@ -97,19 +78,6 @@ static int lowmem_shrink(struct shrinker *s, struct shrink_control *sc)
         int other_file = global_page_state(NR_FILE_PAGES) -
                                                 global_page_state(NR_SHMEM);
 
-        /*
-         * If we already have a death outstanding, then
-         * bail out right away; indicating to vmscan
-         * that we have nothing further to offer on
-         * this pass.
-         *
-         * Note: Currently you need CONFIG_PROFILING
-         * for this to work correctly.
-         */
-        if (lowmem_deathpending &&
-            time_before_eq(jiffies, lowmem_deathpending_timeout))
-                return 0;
-
         if (lowmem_adj_size < array_size)
                 array_size = lowmem_adj_size;
         if (lowmem_minfree_size < array_size)
@@ -148,6 +116,12 @@ static int lowmem_shrink(struct shrinker *s, struct shrink_control *sc)
                 if (!p)
                         continue;
 
+                if (test_tsk_thread_flag(p, TIF_MEMDIE) &&
+                    time_before_eq(jiffies, lowmem_deathpending_timeout)) {
+                        task_unlock(p);
+                        rcu_read_unlock();
+                        return 0;
+                }
                 oom_score_adj = p->signal->oom_score_adj;
                 if (oom_score_adj < min_score_adj) {
                         task_unlock(p);
@@ -174,15 +148,9 @@ static int lowmem_shrink(struct shrinker *s, struct shrink_control *sc)
                 lowmem_print(1, "send sigkill to %d (%s), adj %d, size %d\n",
                              selected->pid, selected->comm,
                              selected_oom_score_adj, selected_tasksize);
-                /*
-                 * If CONFIG_PROFILING is off, then we don't want to stall
-                 * the killer by setting lowmem_deathpending.
-                 */
-#ifdef CONFIG_PROFILING
-                lowmem_deathpending = selected;
                 lowmem_deathpending_timeout = jiffies + HZ;
-#endif
                 send_sig(SIGKILL, selected, 0);
+                set_tsk_thread_flag(selected, TIF_MEMDIE);
                 rem -= selected_tasksize;
         }
         lowmem_print(4, "lowmem_shrink %lu, %x, return %d\n",
@@ -198,7 +166,6 @@ static struct shrinker lowmem_shrinker = {
 
 static int __init lowmem_init(void)
 {
-        task_handoff_register(&task_nb);
         register_shrinker(&lowmem_shrinker);
         return 0;
 }
@@ -206,7 +173,6 @@ static int __init lowmem_init(void)
 static void __exit lowmem_exit(void)
 {
         unregister_shrinker(&lowmem_shrinker);
-        task_handoff_unregister(&task_nb);
 }
 
 module_param_named(cost, lowmem_shrinker.seeks, int, S_IRUGO | S_IWUSR);
diff --git a/drivers/staging/android/persistent_ram.c b/drivers/staging/android/persistent_ram.c
index e08f2574e30a..8d8c1e33e0ff 100644
--- a/drivers/staging/android/persistent_ram.c
+++ b/drivers/staging/android/persistent_ram.c
@@ -399,12 +399,12 @@ static  __init
 struct persistent_ram_zone *__persistent_ram_init(struct device *dev, bool ecc)
 {
         struct persistent_ram_zone *prz;
-        int ret;
+        int ret = -ENOMEM;
 
         prz = kzalloc(sizeof(struct persistent_ram_zone), GFP_KERNEL);
         if (!prz) {
                 pr_err("persistent_ram: failed to allocate persistent ram zone\n");
-                return ERR_PTR(-ENOMEM);
+                goto err;
         }
 
         INIT_LIST_HEAD(&prz->node);
@@ -412,13 +412,13 @@ struct persistent_ram_zone *__persistent_ram_init(struct device *dev, bool ecc)
         ret = persistent_ram_buffer_init(dev_name(dev), prz);
         if (ret) {
                 pr_err("persistent_ram: failed to initialize buffer\n");
-                return ERR_PTR(ret);
+                goto err;
         }
 
         prz->ecc = ecc;
         ret = persistent_ram_init_ecc(prz, prz->buffer_size);
         if (ret)
-                return ERR_PTR(ret);
+                goto err;
 
         if (prz->buffer->sig == PERSISTENT_RAM_SIG) {
                 if (buffer_size(prz) > prz->buffer_size ||
@@ -442,6 +442,9 @@ struct persistent_ram_zone *__persistent_ram_init(struct device *dev, bool ecc)
         atomic_set(&prz->buffer->size, 0);
 
         return prz;
+err:
+        kfree(prz);
+        return ERR_PTR(ret);
 }
 
 struct persistent_ram_zone * __init
diff --git a/drivers/staging/android/timed_gpio.c b/drivers/staging/android/timed_gpio.c
index bc723eff11af..45c522cbe784 100644
--- a/drivers/staging/android/timed_gpio.c
+++ b/drivers/staging/android/timed_gpio.c
@@ -85,7 +85,7 @@ static int timed_gpio_probe(struct platform_device *pdev)
         struct timed_gpio_platform_data *pdata = pdev->dev.platform_data;
         struct timed_gpio *cur_gpio;
         struct timed_gpio_data *gpio_data, *gpio_dat;
-        int i, j, ret = 0;
+        int i, ret;
 
         if (!pdata)
                 return -EBUSY;
@@ -108,18 +108,12 @@ static int timed_gpio_probe(struct platform_device *pdev)
                 gpio_dat->dev.get_time = gpio_get_time;
                 gpio_dat->dev.enable = gpio_enable;
                 ret = gpio_request(cur_gpio->gpio, cur_gpio->name);
-                if (ret >= 0) {
-                        ret = timed_output_dev_register(&gpio_dat->dev);
-                        if (ret < 0)
-                                gpio_free(cur_gpio->gpio);
-                }
+                if (ret < 0)
+                        goto err_out;
+                ret = timed_output_dev_register(&gpio_dat->dev);
                 if (ret < 0) {
-                        for (j = 0; j < i; j++) {
-                                timed_output_dev_unregister(&gpio_data[i].dev);
-                                gpio_free(gpio_data[i].gpio);
-                        }
-                        kfree(gpio_data);
-                        return ret;
+                        gpio_free(cur_gpio->gpio);
+                        goto err_out;
                 }
 
                 gpio_dat->gpio = cur_gpio->gpio;
@@ -131,6 +125,15 @@ static int timed_gpio_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, gpio_data);
 
         return 0;
+
+err_out:
+        while (--i >= 0) {
+                timed_output_dev_unregister(&gpio_data[i].dev);
+                gpio_free(gpio_data[i].gpio);
+        }
+        kfree(gpio_data);
+
+        return ret;
 }
 
 static int timed_gpio_remove(struct platform_device *pdev)
diff --git a/drivers/staging/iio/inkern.c b/drivers/staging/iio/inkern.c
index de2c8ea64965..ef07a02bf542 100644
--- a/drivers/staging/iio/inkern.c
+++ b/drivers/staging/iio/inkern.c
@@ -82,6 +82,7 @@ int iio_map_array_unregister(struct iio_dev *indio_dev,
                         ret = -ENODEV;
                         goto error_ret;
                 }
+                i++;
         }
 error_ret:
         mutex_unlock(&iio_map_list_lock);
diff --git a/drivers/staging/iio/magnetometer/ak8975.c b/drivers/staging/iio/magnetometer/ak8975.c
index d5ddac3d8831..ebc2d0840caf 100644
--- a/drivers/staging/iio/magnetometer/ak8975.c
+++ b/drivers/staging/iio/magnetometer/ak8975.c
@@ -108,7 +108,8 @@ static const int ak8975_index_to_reg[] = {
 static int ak8975_write_data(struct i2c_client *client,
                              u8 reg, u8 val, u8 mask, u8 shift)
 {
-        struct ak8975_data *data = i2c_get_clientdata(client);
+        struct iio_dev *indio_dev = i2c_get_clientdata(client);
+        struct ak8975_data *data = iio_priv(indio_dev);
         u8 regval;
         int ret;
 
@@ -159,7 +160,8 @@ static int ak8975_read_data(struct i2c_client *client,
  */
 static int ak8975_setup(struct i2c_client *client)
 {
-        struct ak8975_data *data = i2c_get_clientdata(client);
+        struct iio_dev *indio_dev = i2c_get_clientdata(client);
+        struct ak8975_data *data = iio_priv(indio_dev);
         u8 device_id;
         int ret;
 
@@ -509,6 +511,7 @@ static int ak8975_probe(struct i2c_client *client,
                 goto exit_gpio;
         }
         data = iio_priv(indio_dev);
+        i2c_set_clientdata(client, indio_dev);
         /* Perform some basic start-of-day setup of the device. */
         err = ak8975_setup(client);
         if (err < 0) {
@@ -516,7 +519,6 @@ static int ak8975_probe(struct i2c_client *client,
                 goto exit_free_iio;
         }
 
-        i2c_set_clientdata(client, indio_dev);
         data->client = client;
         mutex_init(&data->lock);
         data->eoc_irq = client->irq;
diff --git a/drivers/staging/iio/magnetometer/hmc5843.c b/drivers/staging/iio/magnetometer/hmc5843.c
index 91dd3da70cb4..e00b416c4d33 100644
--- a/drivers/staging/iio/magnetometer/hmc5843.c
+++ b/drivers/staging/iio/magnetometer/hmc5843.c
@@ -521,7 +521,9 @@ static int hmc5843_detect(struct i2c_client *client,
 /* Called when we have found a new HMC5843. */
 static void hmc5843_init_client(struct i2c_client *client)
 {
-        struct hmc5843_data *data = i2c_get_clientdata(client);
+        struct iio_dev *indio_dev = i2c_get_clientdata(client);
+        struct hmc5843_data *data = iio_priv(indio_dev);
+
         hmc5843_set_meas_conf(client, data->meas_conf);
         hmc5843_set_rate(client, data->rate);
         hmc5843_configure(client, data->operating_mode);
diff --git a/drivers/staging/media/as102/as102_fw.c b/drivers/staging/media/as102/as102_fw.c
index 43ebc43e6b9a..1075fb1df0d9 100644
--- a/drivers/staging/media/as102/as102_fw.c
+++ b/drivers/staging/media/as102/as102_fw.c
@@ -165,7 +165,7 @@ error:
 int as102_fw_upload(struct as10x_bus_adapter_t *bus_adap)
 {
         int errno = -EFAULT;
-        const struct firmware *firmware;
+        const struct firmware *firmware = NULL;
         unsigned char *cmd_buf = NULL;
         char *fw1, *fw2;
         struct usb_device *dev = bus_adap->usb_dev;
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index 400df8cbee53..d91751f9ffe8 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -36,6 +36,7 @@
 #include <linux/prefetch.h>
 #include <linux/ratelimit.h>
 #include <linux/smp.h>
+#include <linux/interrupt.h>
 #include <net/dst.h>
 #ifdef CONFIG_XFRM
 #include <linux/xfrm.h>
diff --git a/drivers/staging/octeon/ethernet-tx.c b/drivers/staging/octeon/ethernet-tx.c
index 56d74dc2fbd5..91a97b3e45c6 100644
--- a/drivers/staging/octeon/ethernet-tx.c
+++ b/drivers/staging/octeon/ethernet-tx.c
@@ -32,6 +32,7 @@
 #include <linux/ip.h>
 #include <linux/ratelimit.h>
 #include <linux/string.h>
+#include <linux/interrupt.h>
 #include <net/dst.h>
 #ifdef CONFIG_XFRM
 #include <linux/xfrm.h>
diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
index 9112cd882154..60cba8194de3 100644
--- a/drivers/staging/octeon/ethernet.c
+++ b/drivers/staging/octeon/ethernet.c
@@ -31,6 +31,7 @@
 #include <linux/etherdevice.h>
 #include <linux/phy.h>
 #include <linux/slab.h>
+#include <linux/interrupt.h>
 
 #include <net/dst.h>
 
diff --git a/drivers/staging/omapdrm/omap_drv.c b/drivers/staging/omapdrm/omap_drv.c
index 3df5b4c58ecd..620b8d54223d 100644
--- a/drivers/staging/omapdrm/omap_drv.c
+++ b/drivers/staging/omapdrm/omap_drv.c
@@ -803,9 +803,6 @@ static void pdev_shutdown(struct platform_device *device)
 static int pdev_probe(struct platform_device *device)
 {
         DBG("%s", device->name);
-        if (platform_driver_register(&omap_dmm_driver))
-                dev_err(&device->dev, "DMM registration failed\n");
-
         return drm_platform_init(&omap_drm_driver, device);
 }
 
@@ -833,6 +830,10 @@ struct platform_driver pdev = {
 static int __init omap_drm_init(void)
 {
         DBG("init");
+        if (platform_driver_register(&omap_dmm_driver)) {
+                /* we can continue on without DMM.. so not fatal */
+                dev_err(NULL, "DMM registration failed\n");
+        }
         return platform_driver_register(&pdev);
 }
 
diff --git a/drivers/staging/ozwpan/TODO b/drivers/staging/ozwpan/TODO
index f7a9c122f596..c2d30a7112f3 100644
--- a/drivers/staging/ozwpan/TODO
+++ b/drivers/staging/ozwpan/TODO
@@ -8,5 +8,7 @@ TODO:
         - code review by USB developer community.
         - testing with as many devices as possible.
 
-Please send any patches for this driver to Chris Kelly <ckelly@ozmodevices.com>
+Please send any patches for this driver to
+Rupesh Gujare <rgujare@ozmodevices.com>
+Chris Kelly <ckelly@ozmodevices.com>
 and Greg Kroah-Hartman <gregkh@linuxfoundation.org>.
diff --git a/drivers/staging/ozwpan/ozpd.c b/drivers/staging/ozwpan/ozpd.c
index 2b45d3d1800c..04cd57f2a6da 100644
--- a/drivers/staging/ozwpan/ozpd.c
+++ b/drivers/staging/ozwpan/ozpd.c
@@ -383,8 +383,6 @@ static void oz_tx_frame_free(struct oz_pd *pd, struct oz_tx_frame *f)
                 pd->tx_pool = &f->link;
                 pd->tx_pool_count++;
                 f = 0;
-        } else {
-                kfree(f);
         }
         spin_unlock_bh(&pd->tx_frame_lock);
         if (f)
diff --git a/drivers/staging/ramster/Kconfig b/drivers/staging/ramster/Kconfig
index 8b57b87edda4..4af1f8d4b953 100644
--- a/drivers/staging/ramster/Kconfig
+++ b/drivers/staging/ramster/Kconfig
@@ -1,10 +1,6 @@
-# Dependency on CONFIG_BROKEN is because there is a commit dependency
-# on a cleancache naming change to be submitted by Konrad Wilk
-# a39c00ded70339603ffe1b0ffdf3ade85bcf009a "Merge branch 'stable/cleancache.v13'
-# into linux-next.  Once this commit is present, BROKEN can be removed
 config RAMSTER
         bool "Cross-machine RAM capacity sharing, aka peer-to-peer tmem"
-        depends on (CLEANCACHE || FRONTSWAP) && CONFIGFS_FS=y && !ZCACHE && !XVMALLOC && !HIGHMEM && BROKEN
+        depends on (CLEANCACHE || FRONTSWAP) && CONFIGFS_FS=y && !ZCACHE && !XVMALLOC && !HIGHMEM
         select LZO_COMPRESS
         select LZO_DECOMPRESS
         default n
diff --git a/drivers/staging/rts_pstor/ms.c b/drivers/staging/rts_pstor/ms.c
index 66341dff8c99..f9a4498984cc 100644
--- a/drivers/staging/rts_pstor/ms.c
+++ b/drivers/staging/rts_pstor/ms.c
@@ -3498,7 +3498,8 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rtsx_chip *chip, u32
 
                 log_blk++;
 
-                for (seg_no = 0; seg_no < sizeof(ms_start_idx)/2; seg_no++) {
+                for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1;
+                                seg_no++) {
                         if (log_blk < ms_start_idx[seg_no+1])
                                 break;
                 }
diff --git a/drivers/staging/rts_pstor/rtsx.c b/drivers/staging/rts_pstor/rtsx.c
index a7feb3e328a0..1dccd933a7e4 100644
--- a/drivers/staging/rts_pstor/rtsx.c
+++ b/drivers/staging/rts_pstor/rtsx.c
@@ -1000,6 +1000,11 @@ static int __devinit rtsx_probe(struct pci_dev *pci,
 
         rtsx_init_chip(dev->chip);
 
+        /* set the supported max_lun and max_id for the scsi host
+         * NOTE: the minimal value of max_id is 1 */
+        host->max_id = 1;
+        host->max_lun = dev->chip->max_lun;
+
         /* Start up our control thread */
         th = kthread_run(rtsx_control_thread, dev, CR_DRIVER_NAME);
         if (IS_ERR(th)) {
diff --git a/drivers/staging/rts_pstor/rtsx_transport.c b/drivers/staging/rts_pstor/rtsx_transport.c
index 4e3d2c106af0..9b2e5c99870f 100644
--- a/drivers/staging/rts_pstor/rtsx_transport.c
+++ b/drivers/staging/rts_pstor/rtsx_transport.c
@@ -335,6 +335,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card,
         int sg_cnt, i, resid;
         int err = 0;
         long timeleft;
+        struct scatterlist *sg_ptr;
         u32 val = TRIG_DMA;
 
         if ((sg == NULL) || (num_sg <= 0) || !offset || !index)
@@ -371,7 +372,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card,
         sg_cnt = dma_map_sg(&(rtsx->pci->dev), sg, num_sg, dma_dir);
 
         resid = size;
-
+        sg_ptr = sg;
         chip->sgi = 0;
         /* Usually the next entry will be @sg@ + 1, but if this sg element
          * is part of a chained scatterlist, it could jump to the start of
@@ -379,14 +380,14 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card,
          * the proper sg
          */
         for (i = 0; i < *index; i++)
-                sg = sg_next(sg);
+                sg_ptr = sg_next(sg_ptr);
         for (i = *index; i < sg_cnt; i++) {
                 dma_addr_t addr;
                 unsigned int len;
                 u8 option;
 
-                addr = sg_dma_address(sg);
-                len = sg_dma_len(sg);
+                addr = sg_dma_address(sg_ptr);
+                len = sg_dma_len(sg_ptr);
 
                 RTSX_DEBUGP("DMA addr: 0x%x, Len: 0x%x\n",
                              (unsigned int)addr, len);
@@ -415,7 +416,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card,
                 if (!resid)
                         break;
 
-                sg = sg_next(sg);
+                sg_ptr = sg_next(sg_ptr);
         }
 
         RTSX_DEBUGP("SG table count = %d\n", chip->sgi);
diff --git a/drivers/staging/sep/sep_main.c b/drivers/staging/sep/sep_main.c
index ad54c2e5c932..f1701bc6e312 100644
--- a/drivers/staging/sep/sep_main.c
+++ b/drivers/staging/sep/sep_main.c
@@ -3114,7 +3114,7 @@ static long sep_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                         current->pid);
                 if (1 == test_bit(SEP_LEGACY_SENDMSG_DONE_OFFSET,
                                   &call_status->status)) {
-                        dev_warn(&sep->pdev->dev,
+                        dev_dbg(&sep->pdev->dev,
                                 "[PID%d] dcb prep needed before send msg\n",
                                 current->pid);
                         error = -EPROTO;
@@ -3122,9 +3122,9 @@ static long sep_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 }
 
                 if (!arg) {
-                        dev_warn(&sep->pdev->dev,
+                        dev_dbg(&sep->pdev->dev,
                                 "[PID%d] dcb null arg\n", current->pid);
-                        error = EINVAL;
+                        error = -EINVAL;
                         goto end_function;
                 }
 
diff --git a/drivers/staging/tidspbridge/core/tiomap3430.c b/drivers/staging/tidspbridge/core/tiomap3430.c
index 7862513cc295..9cf29fcea11e 100644
--- a/drivers/staging/tidspbridge/core/tiomap3430.c
+++ b/drivers/staging/tidspbridge/core/tiomap3430.c
@@ -79,10 +79,6 @@
 #define OMAP343X_CONTROL_IVA2_BOOTADDR (OMAP2_CONTROL_GENERAL + 0x0190)
 #define OMAP343X_CONTROL_IVA2_BOOTMOD (OMAP2_CONTROL_GENERAL + 0x0194)
 
-#define OMAP343X_CTRL_REGADDR(reg) \
-        OMAP2_L4_IO_ADDRESS(OMAP343X_CTRL_BASE + (reg))
-
-
 /* Forward Declarations: */
 static int bridge_brd_monitor(struct bridge_dev_context *dev_ctxt);
 static int bridge_brd_read(struct bridge_dev_context *dev_ctxt,
@@ -418,19 +414,27 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
 
                 /* Assert RST1 i.e only the RST only for DSP megacell */
                 if (!status) {
+                        /*
+                         * XXX: ioremapping  MUST be removed once ctrl
+                         * function is made available.
+                         */
+                        void __iomem *ctrl = ioremap(OMAP343X_CTRL_BASE, SZ_4K);
+                        if (!ctrl)
+                                return -ENOMEM;
+
                         (*pdata->dsp_prm_rmw_bits)(OMAP3430_RST1_IVA2_MASK,
                                         OMAP3430_RST1_IVA2_MASK, OMAP3430_IVA2_MOD,
                                         OMAP2_RM_RSTCTRL);
                         /* Mask address with 1K for compatibility */
                         __raw_writel(dsp_addr & OMAP3_IVA2_BOOTADDR_MASK,
-                                        OMAP343X_CTRL_REGADDR(
-                                        OMAP343X_CONTROL_IVA2_BOOTADDR));
+                                        ctrl + OMAP343X_CONTROL_IVA2_BOOTADDR);
                         /*
                          * Set bootmode to self loop if dsp_debug flag is true
                          */
                         __raw_writel((dsp_debug) ? OMAP3_IVA2_BOOTMOD_IDLE : 0,
-                                        OMAP343X_CTRL_REGADDR(
-                                        OMAP343X_CONTROL_IVA2_BOOTMOD));
+                                        ctrl + OMAP343X_CONTROL_IVA2_BOOTMOD);
+
+                        iounmap(ctrl);
                 }
         }
         if (!status) {
diff --git a/drivers/staging/tidspbridge/core/wdt.c b/drivers/staging/tidspbridge/core/wdt.c
index 70055c8111ed..870f934f4f3b 100644
--- a/drivers/staging/tidspbridge/core/wdt.c
+++ b/drivers/staging/tidspbridge/core/wdt.c
@@ -53,7 +53,10 @@ int dsp_wdt_init(void)
         int ret = 0;
 
         dsp_wdt.sm_wdt = NULL;
-        dsp_wdt.reg_base = OMAP2_L4_IO_ADDRESS(OMAP34XX_WDT3_BASE);
+        dsp_wdt.reg_base = ioremap(OMAP34XX_WDT3_BASE, SZ_4K);
+        if (!dsp_wdt.reg_base)
+                return -ENOMEM;
+
         tasklet_init(&dsp_wdt.wdt3_tasklet, dsp_wdt_dpc, 0);
 
         dsp_wdt.fclk = clk_get(NULL, "wdt3_fck");
@@ -99,6 +102,9 @@ void dsp_wdt_exit(void)
         dsp_wdt.fclk = NULL;
         dsp_wdt.iclk = NULL;
         dsp_wdt.sm_wdt = NULL;
+
+        if (dsp_wdt.reg_base)
+                iounmap(dsp_wdt.reg_base);
         dsp_wdt.reg_base = NULL;
 }
 
diff --git a/drivers/staging/vme/devices/vme_pio2_core.c b/drivers/staging/vme/devices/vme_pio2_core.c
index 9fedc442a779..573c80003f0c 100644
--- a/drivers/staging/vme/devices/vme_pio2_core.c
+++ b/drivers/staging/vme/devices/vme_pio2_core.c
@@ -35,10 +35,10 @@ static int vector[PIO2_CARDS_MAX];
 static int vector_num;
 static int level[PIO2_CARDS_MAX];
 static int level_num;
-static const char *variant[PIO2_CARDS_MAX];
+static char *variant[PIO2_CARDS_MAX];
 static int variant_num;
 
-static int loopback;
+static bool loopback;
 
 static int pio2_match(struct vme_dev *);
 static int __devinit pio2_probe(struct vme_dev *);
diff --git a/drivers/staging/vt6655/key.c b/drivers/staging/vt6655/key.c
index 0ff8d7bbf2a7..774b0d4a7e06 100644
--- a/drivers/staging/vt6655/key.c
+++ b/drivers/staging/vt6655/key.c
@@ -655,6 +655,9 @@ bool KeybSetDefaultKey (
         return (false);
     }
 
+    if (uKeyLength > MAX_KEY_LEN)
+            return false;
+
     pTable->KeyTable[MAX_KEY_TABLE-1].bInUse = true;
     for(ii=0;ii<ETH_ALEN;ii++)
         pTable->KeyTable[MAX_KEY_TABLE-1].abyBSSID[ii] = 0xFF;
diff --git a/drivers/staging/vt6656/ioctl.c b/drivers/staging/vt6656/ioctl.c
index 1463d76895f0..d59456c29df1 100644
--- a/drivers/staging/vt6656/ioctl.c
+++ b/drivers/staging/vt6656/ioctl.c
@@ -565,7 +565,7 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
                         result = -ENOMEM;
                         break;
                 }
-                pNodeList = (PSNodeList)kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC);
+                pNodeList = kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC);
                 if (pNodeList == NULL) {
                         result = -ENOMEM;
                         break;
@@ -601,6 +601,7 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
                         }
                 }
                 if (copy_to_user(pReq->data, pNodeList, sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)))) {
+                        kfree(pNodeList);
                         result = -EFAULT;
                         break;
                 }
diff --git a/drivers/staging/vt6656/key.c b/drivers/staging/vt6656/key.c
index 27bb523c8a97..ee62a06a75f4 100644
--- a/drivers/staging/vt6656/key.c
+++ b/drivers/staging/vt6656/key.c
@@ -684,6 +684,9 @@ BOOL KeybSetDefaultKey(
         return (FALSE);
     }
 
+    if (uKeyLength > MAX_KEY_LEN)
+            return false;
+
     pTable->KeyTable[MAX_KEY_TABLE-1].bInUse = TRUE;
     for (ii = 0; ii < ETH_ALEN; ii++)
         pTable->KeyTable[MAX_KEY_TABLE-1].abyBSSID[ii] = 0xFF;
diff --git a/drivers/staging/xgifb/vb_init.c b/drivers/staging/xgifb/vb_init.c
index 94d5c35e22fb..3650bbff7686 100644
--- a/drivers/staging/xgifb/vb_init.c
+++ b/drivers/staging/xgifb/vb_init.c
@@ -61,7 +61,7 @@ XGINew_GetXG20DRAMType(struct xgi_hw_device_info *HwDeviceExtension,
                 }
                 temp = xgifb_reg_get(pVBInfo->P3c4, 0x3B);
                 /* SR3B[7][3]MAA15 MAA11 (Power on Trapping) */
-                if ((temp & 0x88) == 0x80)
+                if (((temp & 0x88) == 0x80) || ((temp & 0x88) == 0x08))
                         data = 0; /* DDR */
                 else
                         data = 1; /* DDRII */
diff --git a/drivers/staging/xgifb/vb_setmode.c b/drivers/staging/xgifb/vb_setmode.c
index 2919924213c4..60d4adf99923 100644
--- a/drivers/staging/xgifb/vb_setmode.c
+++ b/drivers/staging/xgifb/vb_setmode.c
@@ -152,6 +152,7 @@ void InitTo330Pointer(unsigned char ChipType, struct vb_device_info *pVBInfo)
                 pVBInfo->pXGINew_CR97 = &XG20_CR97;
 
         if (ChipType == XG27) {
+                unsigned char temp;
                 pVBInfo->MCLKData
                         = (struct SiS_MCLKData *) XGI27New_MCLKData;
                 pVBInfo->CR40 = XGI27_cr41;
@@ -162,7 +163,13 @@ void InitTo330Pointer(unsigned char ChipType, struct vb_device_info *pVBInfo)
                 pVBInfo->pCRDE = XG27_CRDE;
                 pVBInfo->pSR40 = &XG27_SR40;
                 pVBInfo->pSR41 = &XG27_SR41;
+                pVBInfo->SR15 = XG27_SR13;
 
+                /*Z11m DDR*/
+                temp = xgifb_reg_get(pVBInfo->P3c4, 0x3B);
+                /* SR3B[7][3]MAA15 MAA11 (Power on Trapping) */
+                if (((temp & 0x88) == 0x80) || ((temp & 0x88) == 0x08))
+                        pVBInfo->pXGINew_CR97 = &Z11m_CR97;
         }
 
         if (ChipType >= XG20) {
diff --git a/drivers/staging/xgifb/vb_table.h b/drivers/staging/xgifb/vb_table.h
index dddf261ed53d..e8d6f674b274 100644
--- a/drivers/staging/xgifb/vb_table.h
+++ b/drivers/staging/xgifb/vb_table.h
@@ -33,6 +33,13 @@ static struct XGI_ECLKDataStruct XGI340_ECLKData[] = {
         {0x5c, 0x23, 0x01, 166}
 };
 
+static unsigned char XG27_SR13[4][8] = {
+        {0x35, 0x45, 0xb1, 0x00, 0x00, 0x00, 0x00, 0x00}, /* SR13 */
+        {0x41, 0x51, 0x5c, 0x00, 0x00, 0x00, 0x00, 0x00}, /* SR14 */
+        {0x32, 0x32, 0x42, 0x00, 0x00, 0x00, 0x00, 0x00}, /* SR18 */
+        {0x03, 0x03, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00}  /* SR1B */
+};
+
 static unsigned char XGI340_SR13[4][8] = {
         {0x35, 0x45, 0xb1, 0x00, 0x00, 0x00, 0x00, 0x00}, /* SR13 */
         {0x41, 0x51, 0x5c, 0x00, 0x00, 0x00, 0x00, 0x00}, /* SR14 */
@@ -71,7 +78,7 @@ static unsigned char XGI27_cr41[24][8] = {
         {0x20, 0x40, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00}, /* 0 CR41 */
         {0xC4, 0x40, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00}, /* 1 CR8A */
         {0xC4, 0x40, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00}, /* 2 CR8B */
-        {0xB5, 0x13, 0xa4, 0x00, 0x00, 0x00, 0x00, 0x00}, /* 3 CR40[7],
+        {0xB3, 0x13, 0xa4, 0x00, 0x00, 0x00, 0x00, 0x00}, /* 3 CR40[7],
                                                                CR99[2:0],
                                                                CR45[3:0]*/
         {0xf0, 0xf5, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00}, /* 4 CR59 */
@@ -2803,6 +2810,8 @@ static unsigned char XG27_CRDE[2];
 static unsigned char XG27_SR40 = 0x04 ;
 static unsigned char XG27_SR41 = 0x00 ;
 
+static unsigned char Z11m_CR97 = 0x80 ;
+
 static struct XGI330_VCLKDataStruct XGI_VCLKData[] = {
         /* SR2B,SR2C,SR2D */
         {0x1B, 0xE1,  25}, /* 00 (25.175MHz) */
diff --git a/drivers/staging/zcache/Kconfig b/drivers/staging/zcache/Kconfig
index 3ed2c8f656a5..7048e01f0817 100644
--- a/drivers/staging/zcache/Kconfig
+++ b/drivers/staging/zcache/Kconfig
@@ -2,7 +2,7 @@ config ZCACHE
         bool "Dynamic compression of swap pages and clean pagecache pages"
         # X86 dependency is because zsmalloc uses non-portable pte/tlb
         # functions
-        depends on (CLEANCACHE || FRONTSWAP) && CRYPTO && X86
+        depends on (CLEANCACHE || FRONTSWAP) && CRYPTO=y && X86
         select ZSMALLOC
         select CRYPTO_LZO
         default n
diff --git a/drivers/staging/zsmalloc/zsmalloc-main.c b/drivers/staging/zsmalloc/zsmalloc-main.c
index 09caa4f2687e..917461c66014 100644
--- a/drivers/staging/zsmalloc/zsmalloc-main.c
+++ b/drivers/staging/zsmalloc/zsmalloc-main.c
@@ -267,33 +267,39 @@ static unsigned long obj_idx_to_offset(struct page *page,
         return off + obj_idx * class_size;
 }
 
+static void reset_page(struct page *page)
+{
+        clear_bit(PG_private, &page->flags);
+        clear_bit(PG_private_2, &page->flags);
+        set_page_private(page, 0);
+        page->mapping = NULL;
+        page->freelist = NULL;
+        reset_page_mapcount(page);
+}
+
 static void free_zspage(struct page *first_page)
 {
-        struct page *nextp, *tmp;
+        struct page *nextp, *tmp, *head_extra;
 
         BUG_ON(!is_first_page(first_page));
         BUG_ON(first_page->inuse);
 
-        nextp = (struct page *)page_private(first_page);
+        head_extra = (struct page *)page_private(first_page);
 
-        clear_bit(PG_private, &first_page->flags);
-        clear_bit(PG_private_2, &first_page->flags);
-        set_page_private(first_page, 0);
-        first_page->mapping = NULL;
-        first_page->freelist = NULL;
-        reset_page_mapcount(first_page);
+        reset_page(first_page);
         __free_page(first_page);
 
         /* zspage with only 1 system page */
-        if (!nextp)
+        if (!head_extra)
                 return;
 
-        list_for_each_entry_safe(nextp, tmp, &nextp->lru, lru) {
+        list_for_each_entry_safe(nextp, tmp, &head_extra->lru, lru) {
                 list_del(&nextp->lru);
-                clear_bit(PG_private_2, &nextp->flags);
-                nextp->index = 0;
+                reset_page(nextp);
                 __free_page(nextp);
         }
+        reset_page(head_extra);
+        __free_page(head_extra);
 }
 
 /* Initialize a newly allocated zspage */
diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c
index 24145c30c9b0..6cc4358f68c1 100644
--- a/drivers/tty/amiserial.c
+++ b/drivers/tty/amiserial.c
@@ -1073,8 +1073,10 @@ static int set_serial_info(struct tty_struct *tty, struct serial_state *state,
                     (new_serial.close_delay != port->close_delay) ||
                     (new_serial.xmit_fifo_size != state->xmit_fifo_size) ||
                     ((new_serial.flags & ~ASYNC_USR_MASK) !=
-                     (port->flags & ~ASYNC_USR_MASK)))
+                     (port->flags & ~ASYNC_USR_MASK))) {
+                        tty_unlock();
                         return -EPERM;
+                }
                 port->flags = ((port->flags & ~ASYNC_USR_MASK) |
                                (new_serial.flags & ASYNC_USR_MASK));
                 state->custom_divisor = new_serial.custom_divisor;
diff --git a/drivers/tty/serial/8250/8250.c b/drivers/tty/serial/8250/8250.c
index 5b149b466ec8..5c27f7e6c9f1 100644
--- a/drivers/tty/serial/8250/8250.c
+++ b/drivers/tty/serial/8250/8250.c
@@ -1572,13 +1572,11 @@ static irqreturn_t serial8250_interrupt(int irq, void *dev_id)
         do {
                 struct uart_8250_port *up;
                 struct uart_port *port;
-                bool skip;
 
                 up = list_entry(l, struct uart_8250_port, list);
                 port = &up->port;
-                skip = pass_counter && up->port.flags & UPF_IIR_ONCE;
 
-                if (!skip && port->handle_irq(port)) {
+                if (port->handle_irq(port)) {
                         handled = 1;
                         end = NULL;
                 } else if (end == NULL)
@@ -2037,10 +2035,12 @@ static int serial8250_startup(struct uart_port *port)
                 spin_unlock_irqrestore(&port->lock, flags);
 
                 /*
-                 * If the interrupt is not reasserted, setup a timer to
-                 * kick the UART on a regular basis.
+                 * If the interrupt is not reasserted, or we otherwise
+                 * don't trust the iir, setup a timer to kick the UART
+                 * on a regular basis.
                  */
-                if (!(iir1 & UART_IIR_NO_INT) && (iir & UART_IIR_NO_INT)) {
+                if ((!(iir1 & UART_IIR_NO_INT) && (iir & UART_IIR_NO_INT)) ||
+                    up->port.flags & UPF_BUG_THRE) {
                         up->bugs |= UART_BUG_THRE;
                         pr_debug("ttyS%d - using backup timer\n",
                                  serial_index(port));
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index da2b0b0a183f..858dca865d6a 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1096,7 +1096,7 @@ static int kt_serial_setup(struct serial_private *priv,
                            const struct pciserial_board *board,
                            struct uart_port *port, int idx)
 {
-        port->flags |= UPF_IIR_ONCE;
+        port->flags |= UPF_BUG_THRE;
         return skip_tx_en_setup(priv, board, port, idx);
 }
 
@@ -1118,18 +1118,6 @@ pci_xr17c154_setup(struct serial_private *priv,
         return pci_default_setup(priv, board, port, idx);
 }
 
-static int try_enable_msi(struct pci_dev *dev)
-{
-        /* use msi if available, but fallback to legacy otherwise */
-        pci_enable_msi(dev);
-        return 0;
-}
-
-static void disable_msi(struct pci_dev *dev)
-{
-        pci_disable_msi(dev);
-}
-
 #define PCI_VENDOR_ID_SBSMODULARIO      0x124B
 #define PCI_SUBVENDOR_ID_SBSMODULARIO   0x124B
 #define PCI_DEVICE_ID_OCTPRO            0x0001
@@ -1249,9 +1237,7 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                 .device         = PCI_DEVICE_ID_INTEL_PATSBURG_KT,
                 .subvendor      = PCI_ANY_ID,
                 .subdevice      = PCI_ANY_ID,
-                .init           = try_enable_msi,
                 .setup          = kt_serial_setup,
-                .exit           = disable_msi,
         },
         /*
          * ITE
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 665beb68f670..070b442c1f81 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1041,7 +1041,7 @@ config SERIAL_OMAP
 
 config SERIAL_OMAP_CONSOLE
         bool "Console on OMAP serial port"
-        depends on SERIAL_OMAP
+        depends on SERIAL_OMAP=y
         select SERIAL_CORE_CONSOLE
         help
           Select this option if you would like to use omap serial port as
diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
index e7903751e058..1f0330915d5a 100644
--- a/drivers/tty/serial/altera_uart.c
+++ b/drivers/tty/serial/altera_uart.c
@@ -556,7 +556,7 @@ static int __devinit altera_uart_probe(struct platform_device *pdev)
         res_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (res_mem)
                 port->mapbase = res_mem->start;
-        else if (platp->mapbase)
+        else if (platp)
                 port->mapbase = platp->mapbase;
         else
                 return -EINVAL;
@@ -564,7 +564,7 @@ static int __devinit altera_uart_probe(struct platform_device *pdev)
         res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
         if (res_irq)
                 port->irq = res_irq->start;
-        else if (platp->irq)
+        else if (platp)
                 port->irq = platp->irq;
 
         /* Check platform data first so we can override device node data */
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 0c65c9e66986..3d569cd68f58 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1946,10 +1946,6 @@ static int pl011_probe(struct amba_device *dev, const struct amba_id *id)
                 goto unmap;
         }
 
-        /* Ensure interrupts from this UART are masked and cleared */
-        writew(0, uap->port.membase + UART011_IMSC);
-        writew(0xffff, uap->port.membase + UART011_ICR);
-
         uap->vendor = vendor;
         uap->lcrh_rx = vendor->lcrh_rx;
         uap->lcrh_tx = vendor->lcrh_tx;
@@ -1967,6 +1963,10 @@ static int pl011_probe(struct amba_device *dev, const struct amba_id *id)
         uap->port.line = i;
         pl011_dma_probe(uap);
 
+        /* Ensure interrupts from this UART are masked and cleared */
+        writew(0, uap->port.membase + UART011_IMSC);
+        writew(0xffff, uap->port.membase + UART011_ICR);
+
         snprintf(uap->type, sizeof(uap->type), "PL011 rev%u", amba_rev(dev));
 
         amba_ports[i] = uap;
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index f9a6be7a9bed..3d7e1ee2fa57 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -389,6 +389,8 @@ static void atmel_start_rx(struct uart_port *port)
 {
         UART_PUT_CR(port, ATMEL_US_RSTSTA);  /* reset status and receiver */
 
+        UART_PUT_CR(port, ATMEL_US_RXEN);
+
         if (atmel_use_dma_rx(port)) {
                 /* enable PDC controller */
                 UART_PUT_IER(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT |
@@ -404,6 +406,8 @@ static void atmel_start_rx(struct uart_port *port)
  */
 static void atmel_stop_rx(struct uart_port *port)
 {
+        UART_PUT_CR(port, ATMEL_US_RXDIS);
+
         if (atmel_use_dma_rx(port)) {
                 /* disable PDC receive */
                 UART_PUT_PTCR(port, ATMEL_PDC_RXTDIS);
diff --git a/drivers/tty/serial/clps711x.c b/drivers/tty/serial/clps711x.c
index e6c3dbd781d6..836fe2731234 100644
--- a/drivers/tty/serial/clps711x.c
+++ b/drivers/tty/serial/clps711x.c
@@ -154,10 +154,9 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
                 port->x_char = 0;
                 return IRQ_HANDLED;
         }
-        if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
-                clps711xuart_stop_tx(port);
-                return IRQ_HANDLED;
-        }
+
+        if (uart_circ_empty(xmit) || uart_tx_stopped(port))
+                goto disable_tx_irq;
 
         count = port->fifosize >> 1;
         do {
@@ -171,8 +170,11 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                 uart_write_wakeup(port);
 
-        if (uart_circ_empty(xmit))
-                clps711xuart_stop_tx(port);
+        if (uart_circ_empty(xmit)) {
+        disable_tx_irq:
+                disable_irq_nosync(TX_IRQ(port));
+                tx_enabled(port) = 0;
+        }
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index 0121486ac4fa..d00b38eb268e 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -1381,29 +1381,24 @@ static int serial_omap_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        if (!request_mem_region(mem->start, resource_size(mem),
+        if (!devm_request_mem_region(&pdev->dev, mem->start, resource_size(mem),
                                 pdev->dev.driver->name)) {
                 dev_err(&pdev->dev, "memory region already claimed\n");
                 return -EBUSY;
         }
 
         dma_rx = platform_get_resource_byname(pdev, IORESOURCE_DMA, "rx");
-        if (!dma_rx) {
-                ret = -EINVAL;
-                goto err;
-        }
+        if (!dma_rx)
+                return -ENXIO;
 
         dma_tx = platform_get_resource_byname(pdev, IORESOURCE_DMA, "tx");
-        if (!dma_tx) {
-                ret = -EINVAL;
-                goto err;
-        }
+        if (!dma_tx)
+                return -ENXIO;
+
+        up = devm_kzalloc(&pdev->dev, sizeof(*up), GFP_KERNEL);
+        if (!up)
+                return -ENOMEM;
 
-        up = kzalloc(sizeof(*up), GFP_KERNEL);
-        if (up == NULL) {
-                ret = -ENOMEM;
-                goto do_release_region;
-        }
         up->pdev = pdev;
         up->port.dev = &pdev->dev;
         up->port.type = PORT_OMAP;
@@ -1423,16 +1418,17 @@ static int serial_omap_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "failed to get alias/pdev id, errno %d\n",
                                                                 up->port.line);
                 ret = -ENODEV;
-                goto err;
+                goto err_port_line;
         }
 
         sprintf(up->name, "OMAP UART%d", up->port.line);
         up->port.mapbase = mem->start;
-        up->port.membase = ioremap(mem->start, resource_size(mem));
+        up->port.membase = devm_ioremap(&pdev->dev, mem->start,
+                                                resource_size(mem));
         if (!up->port.membase) {
                 dev_err(&pdev->dev, "can't ioremap UART\n");
                 ret = -ENOMEM;
-                goto err;
+                goto err_ioremap;
         }
 
         up->port.flags = omap_up_info->flags;
@@ -1478,16 +1474,19 @@ static int serial_omap_probe(struct platform_device *pdev)
 
         ret = uart_add_one_port(&serial_omap_reg, &up->port);
         if (ret != 0)
-                goto do_release_region;
+                goto err_add_port;
 
         pm_runtime_put(&pdev->dev);
         platform_set_drvdata(pdev, up);
         return 0;
-err:
+
+err_add_port:
+        pm_runtime_put(&pdev->dev);
+        pm_runtime_disable(&pdev->dev);
+err_ioremap:
+err_port_line:
         dev_err(&pdev->dev, "[UART%d]: failure [%s]: %d\n",
                                 pdev->id, __func__, ret);
-do_release_region:
-        release_mem_region(mem->start, resource_size(mem));
         return ret;
 }
 
@@ -1499,8 +1498,6 @@ static int serial_omap_remove(struct platform_device *dev)
                 pm_runtime_disable(&up->pdev->dev);
                 uart_remove_one_port(&serial_omap_reg, &up->port);
                 pm_qos_remove_request(&up->pm_qos_request);
-
-                kfree(up);
         }
 
         platform_set_drvdata(dev, NULL);
diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index 08b9962b8fda..c2816f494807 100644
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -210,6 +210,7 @@ enum {
 #define CMITC_UARTCLK   192000000 /* 192.0000 MHz */
 #define FRI2_64_UARTCLK  64000000 /*  64.0000 MHz */
 #define FRI2_48_UARTCLK  48000000 /*  48.0000 MHz */
+#define NTC1_UARTCLK     64000000 /*  64.0000 MHz */
 
 struct pch_uart_buffer {
         unsigned char *buf;
@@ -384,6 +385,12 @@ static int pch_uart_get_uartclk(void)
         if (cmp && strstr(cmp, "Fish River Island II"))
                 return FRI2_48_UARTCLK;
 
+        /* Kontron COMe-mTT10 (nanoETXexpress-TT) */
+        cmp = dmi_get_system_info(DMI_BOARD_NAME);
+        if (cmp && (strstr(cmp, "COMe-mTT") ||
+                    strstr(cmp, "nanoETXexpress-TT")))
+                return NTC1_UARTCLK;
+
         return DEFAULT_UARTCLK;
 }
 
@@ -1440,9 +1447,11 @@ static int pch_uart_verify_port(struct uart_port *port,
                         __func__);
                 return -EOPNOTSUPP;
 #endif
-                priv->use_dma = 1;
                 priv->use_dma_flag = 1;
                 dev_info(priv->port.dev, "PCH UART : Use DMA Mode\n");
+                if (!priv->use_dma)
+                        pch_request_dma(port);
+                priv->use_dma = 1;
         }
 
         return 0;
@@ -1651,6 +1660,7 @@ static struct eg20t_port *pch_uart_init_port(struct pci_dev *pdev,
         }
 
         pci_enable_msi(pdev);
+        pci_set_master(pdev);
 
         iobase = pci_resource_start(pdev, 0);
         mapbase = pci_resource_start(pdev, 1);
diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index 08ebe901bb59..654755a990df 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
@@ -469,7 +469,7 @@ static irqreturn_t pmz_interrupt(int irq, void *dev_id)
         tty = NULL;
         if (r3 & (CHAEXT | CHATxIP | CHARxIP)) {
                 if (!ZS_IS_OPEN(uap_a)) {
-                        pmz_debug("ChanA interrupt while open !\n");
+                        pmz_debug("ChanA interrupt while not open !\n");
                         goto skip_a;
                 }
                 write_zsreg(uap_a, R0, RES_H_IUS);
@@ -493,8 +493,8 @@ static irqreturn_t pmz_interrupt(int irq, void *dev_id)
         spin_lock(&uap_b->port.lock);
         tty = NULL;
         if (r3 & (CHBEXT | CHBTxIP | CHBRxIP)) {
-                if (!ZS_IS_OPEN(uap_a)) {
-                        pmz_debug("ChanB interrupt while open !\n");
+                if (!ZS_IS_OPEN(uap_b)) {
+                        pmz_debug("ChanB interrupt while not open !\n");
                         goto skip_b;
                 }
                 write_zsreg(uap_b, R0, RES_H_IUS);
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index de249d265bec..d8b0aee35632 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -982,6 +982,7 @@ static void s3c24xx_serial_resetport(struct uart_port *port,
 
         ucon &= ucon_mask;
         wr_regl(port, S3C2410_UCON,  ucon | cfg->ucon);
+        wr_regl(port, S3C2410_ULCON, cfg->ulcon);
 
         /* reset both fifos */
         wr_regl(port, S3C2410_UFCON, cfg->ufcon | S3C2410_UFCON_RESETBOTH);
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 86dd1e302bb3..29ca20dbd335 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -1085,15 +1085,21 @@ void vt_set_led_state(int console, int leds)
  *
  *      Handle console start. This is a wrapper for the VT layer
  *      so that we can keep kbd knowledge internal
+ *
+ *      FIXME: We eventually need to hold the kbd lock here to protect
+ *      the LED updating. We can't do it yet because fn_hold calls stop_tty
+ *      and start_tty under the kbd_event_lock, while normal tty paths
+ *      don't hold the lock. We probably need to split out an LED lock
+ *      but not during an -rc release!
  */
 void vt_kbd_con_start(int console)
 {
         struct kbd_struct * kbd = kbd_table + console;
-        unsigned long flags;
-        spin_lock_irqsave(&kbd_event_lock, flags);
+/*      unsigned long flags; */
+/*      spin_lock_irqsave(&kbd_event_lock, flags); */
         clr_vc_kbd_led(kbd, VC_SCROLLOCK);
         set_leds();
-        spin_unlock_irqrestore(&kbd_event_lock, flags);
+/*      spin_unlock_irqrestore(&kbd_event_lock, flags); */
 }
 
 /**
@@ -1102,22 +1108,28 @@ void vt_kbd_con_start(int console)
  *
  *      Handle console stop. This is a wrapper for the VT layer
  *      so that we can keep kbd knowledge internal
+ *
+ *      FIXME: We eventually need to hold the kbd lock here to protect
+ *      the LED updating. We can't do it yet because fn_hold calls stop_tty
+ *      and start_tty under the kbd_event_lock, while normal tty paths
+ *      don't hold the lock. We probably need to split out an LED lock
+ *      but not during an -rc release!
  */
 void vt_kbd_con_stop(int console)
 {
         struct kbd_struct * kbd = kbd_table + console;
-        unsigned long flags;
-        spin_lock_irqsave(&kbd_event_lock, flags);
+/*      unsigned long flags; */
+/*      spin_lock_irqsave(&kbd_event_lock, flags); */
         set_vc_kbd_led(kbd, VC_SCROLLOCK);
         set_leds();
-        spin_unlock_irqrestore(&kbd_event_lock, flags);
+/*      spin_unlock_irqrestore(&kbd_event_lock, flags); */
 }
 
 /*
  * This is the tasklet that updates LED state on all keyboards
  * attached to the box. The reason we use tasklet is that we
  * need to handle the scenario when keyboard handler is not
- * registered yet but we already getting updates form VT to
+ * registered yet but we already getting updates from the VT to
  * update led state.
  */
 static void kbd_bh(unsigned long dummy)
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 3bdd4b19dd06..2156188db4a6 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -2932,11 +2932,10 @@ static int __init con_init(void)
         gotoxy(vc, vc->vc_x, vc->vc_y);
         csi_J(vc, 0);
         update_screen(vc);
-        pr_info("Console: %s %s %dx%d",
+        pr_info("Console: %s %s %dx%d\n",
                 vc->vc_can_do_color ? "colour" : "mono",
                 display_desc, vc->vc_cols, vc->vc_rows);
         printable = 1;
-        printk("\n");
 
         console_unlock();
 
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index cbd8f5f80596..76316a33061b 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -2,14 +2,6 @@
 # USB device configuration
 #
 
-menuconfig USB_SUPPORT
-        bool "USB support"
-        depends on HAS_IOMEM
-        default y
-        ---help---
-          This option adds core support for Universal Serial Bus (USB).
-          You will also need drivers from the following menu to make use of it.
-
 # many non-PCI SOC chips embed OHCI
 config USB_ARCH_HAS_OHCI
         boolean
@@ -63,6 +55,14 @@ config USB_ARCH_HAS_XHCI
         boolean
         default PCI
 
+menuconfig USB_SUPPORT
+        bool "USB support"
+        depends on HAS_IOMEM
+        default y
+        ---help---
+          This option adds core support for Universal Serial Bus (USB).
+          You will also need drivers from the following menu to make use of it.
+
 if USB_SUPPORT
 
 config USB_COMMON
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index c6f6560d436c..0bb2b3248dad 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -157,8 +157,9 @@ static void wdm_out_callback(struct urb *urb)
         spin_lock(&desc->iuspin);
         desc->werr = urb->status;
         spin_unlock(&desc->iuspin);
-        clear_bit(WDM_IN_USE, &desc->flags);
         kfree(desc->outbuf);
+        desc->outbuf = NULL;
+        clear_bit(WDM_IN_USE, &desc->flags);
         wake_up(&desc->wait);
 }
 
@@ -338,7 +339,7 @@ static ssize_t wdm_write
         if (we < 0)
                 return -EIO;
 
-        desc->outbuf = buf = kmalloc(count, GFP_KERNEL);
+        buf = kmalloc(count, GFP_KERNEL);
         if (!buf) {
                 rv = -ENOMEM;
                 goto outnl;
@@ -406,10 +407,12 @@ static ssize_t wdm_write
         req->wIndex = desc->inum;
         req->wLength = cpu_to_le16(count);
         set_bit(WDM_IN_USE, &desc->flags);
+        desc->outbuf = buf;
 
         rv = usb_submit_urb(desc->command, GFP_KERNEL);
         if (rv < 0) {
                 kfree(buf);
+                desc->outbuf = NULL;
                 clear_bit(WDM_IN_USE, &desc->flags);
                 dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
         } else {
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f8e2d6d52e5c..9a56635dc19c 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1189,8 +1189,13 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
         if (status == 0) {
                 status = usb_suspend_device(udev, msg);
 
-                /* Again, ignore errors during system sleep transitions */
-                if (!PMSG_IS_AUTO(msg))
+                /*
+                 * Ignore errors from non-root-hub devices during
+                 * system sleep transitions.  For the most part,
+                 * these devices should go to low power anyway when
+                 * the entire bus is suspended.
+                 */
+                if (udev->parent && !PMSG_IS_AUTO(msg))
                         status = 0;
         }
 
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 622b4a48e732..57ed9e400c06 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -493,6 +493,15 @@ static int hcd_pci_suspend_noirq(struct device *dev)
 
         pci_save_state(pci_dev);
 
+        /*
+         * Some systems crash if an EHCI controller is in D3 during
+         * a sleep transition.  We have to leave such controllers in D0.
+         */
+        if (hcd->broken_pci_sleep) {
+                dev_dbg(dev, "Staying in PCI D0\n");
+                return retval;
+        }
+
         /* If the root hub is dead rather than suspended, disallow remote
          * wakeup.  usb_hc_died() should ensure that both hosts are marked as
          * dying, so we only need to check the primary roothub.
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 9d7fc9a39933..140d3e11f212 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1978,6 +1978,18 @@ int hcd_bus_suspend(struct usb_device *rhdev, pm_message_t msg)
         if (status == 0) {
                 usb_set_device_state(rhdev, USB_STATE_SUSPENDED);
                 hcd->state = HC_STATE_SUSPENDED;
+
+                /* Did we race with a root-hub wakeup event? */
+                if (rhdev->do_remote_wakeup) {
+                        char    buffer[6];
+
+                        status = hcd->driver->hub_status_data(hcd, buffer);
+                        if (status != 0) {
+                                dev_dbg(&rhdev->dev, "suspend raced with wakeup event\n");
+                                hcd_bus_resume(rhdev, PMSG_AUTO_RESUME);
+                                status = -EBUSY;
+                        }
+                }
         } else {
                 spin_lock_irq(&hcd_root_hub_lock);
                 if (!HCD_DEAD(hcd)) {
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 28664eb7f555..ec6c97dadbe4 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1667,7 +1667,6 @@ void usb_disconnect(struct usb_device **pdev)
 {
         struct usb_device       *udev = *pdev;
         int                     i;
-        struct usb_hcd          *hcd = bus_to_hcd(udev->bus);
 
         /* mark the device as inactive, so any further urb submissions for
          * this device (and any of its children) will fail immediately.
@@ -1690,9 +1689,7 @@ void usb_disconnect(struct usb_device **pdev)
          * so that the hardware is now fully quiesced.
          */
         dev_dbg (&udev->dev, "unregistering device\n");
-        mutex_lock(hcd->bandwidth_mutex);
         usb_disable_device(udev, 0);
-        mutex_unlock(hcd->bandwidth_mutex);
         usb_hcd_synchronize_unlinks(udev);
 
         usb_remove_ep_devs(&udev->ep0);
@@ -3163,6 +3160,22 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
         if (retval)
                 goto fail;
 
+        /*
+         * Some superspeed devices have finished the link training process
+         * and attached to a superspeed hub port, but the device descriptor
+         * got from those devices show they aren't superspeed devices. Warm
+         * reset the port attached by the devices can fix them.
+         */
+        if ((udev->speed == USB_SPEED_SUPER) &&
+                        (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0300)) {
+                dev_err(&udev->dev, "got a wrong device descriptor, "
+                                "warm reset device\n");
+                hub_port_reset(hub, port1, udev,
+                                HUB_BH_RESET_TIME, true);
+                retval = -EINVAL;
+                goto fail;
+        }
+
         if (udev->descriptor.bMaxPacketSize0 == 0xff ||
                         udev->speed == USB_SPEED_SUPER)
                 i = 512;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index b3bdfede45e6..ca717da3be95 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -308,7 +308,8 @@ static void sg_complete(struct urb *urb)
                                 retval = usb_unlink_urb(io->urbs [i]);
                                 if (retval != -EINPROGRESS &&
                                     retval != -ENODEV &&
-                                    retval != -EBUSY)
+                                    retval != -EBUSY &&
+                                    retval != -EIDRM)
                                         dev_err(&io->dev->dev,
                                                 "%s, unlink --> %d\n",
                                                 __func__, retval);
@@ -317,7 +318,6 @@ static void sg_complete(struct urb *urb)
                 }
                 spin_lock(&io->lock);
         }
-        urb->dev = NULL;
 
         /* on the last completion, signal usb_sg_wait() */
         io->bytes += urb->actual_length;
@@ -524,7 +524,6 @@ void usb_sg_wait(struct usb_sg_request *io)
                 case -ENXIO:    /* hc didn't queue this one */
                 case -EAGAIN:
                 case -ENOMEM:
-                        io->urbs[i]->dev = NULL;
                         retval = 0;
                         yield();
                         break;
@@ -542,7 +541,6 @@ void usb_sg_wait(struct usb_sg_request *io)
 
                         /* fail any uncompleted urbs */
                 default:
-                        io->urbs[i]->dev = NULL;
                         io->urbs[i]->status = retval;
                         dev_dbg(&io->dev->dev, "%s, submit --> %d\n",
                                 __func__, retval);
@@ -593,7 +591,10 @@ void usb_sg_cancel(struct usb_sg_request *io)
                         if (!io->urbs [i]->dev)
                                 continue;
                         retval = usb_unlink_urb(io->urbs [i]);
-                        if (retval != -EINPROGRESS && retval != -EBUSY)
+                        if (retval != -EINPROGRESS
+                                        && retval != -ENODEV
+                                        && retval != -EBUSY
+                                        && retval != -EIDRM)
                                 dev_warn(&io->dev->dev, "%s, unlink --> %d\n",
                                         __func__, retval);
                 }
@@ -1135,8 +1136,6 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
  * Deallocates hcd/hardware state for the endpoints (nuking all or most
  * pending urbs) and usbcore state for the interfaces, so that usbcore
  * must usb_set_configuration() before any interfaces could be used.
- *
- * Must be called with hcd->bandwidth_mutex held.
  */
 void usb_disable_device(struct usb_device *dev, int skip_ep0)
 {
@@ -1189,7 +1188,9 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
                         usb_disable_endpoint(dev, i + USB_DIR_IN, false);
                 }
                 /* Remove endpoints from the host controller internal state */
+                mutex_lock(hcd->bandwidth_mutex);
                 usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
+                mutex_unlock(hcd->bandwidth_mutex);
                 /* Second pass: remove endpoint pointers */
         }
         for (i = skip_ep0; i < 16; ++i) {
@@ -1749,7 +1750,6 @@ free_interfaces:
         /* if it's already configured, clear out old state first.
          * getting rid of old interfaces means unbinding their drivers.
          */
-        mutex_lock(hcd->bandwidth_mutex);
         if (dev->state != USB_STATE_ADDRESS)
                 usb_disable_device(dev, 1);     /* Skip ep0 */
 
@@ -1762,6 +1762,7 @@ free_interfaces:
          * host controller will not allow submissions to dropped endpoints.  If
          * this call fails, the device state is unchanged.
          */
+        mutex_lock(hcd->bandwidth_mutex);
         ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
         if (ret < 0) {
                 mutex_unlock(hcd->bandwidth_mutex);
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index 7239a73c1b8c..cd9b3a2cd8a7 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -539,6 +539,10 @@ EXPORT_SYMBOL_GPL(usb_submit_urb);
  * never submitted, or it was unlinked before, or the hardware is already
  * finished with it), even if the completion handler has not yet run.
  *
+ * The URB must not be deallocated while this routine is running.  In
+ * particular, when a driver calls this routine, it must insure that the
+ * completion handler cannot deallocate the URB.
+ *
  * Unlinking and Endpoint Queues:
  *
  * [The behaviors and guarantees described below do not apply to virtual
@@ -603,6 +607,10 @@ EXPORT_SYMBOL_GPL(usb_unlink_urb);
  * with error -EPERM.  Thus even if the URB's completion handler always
  * tries to resubmit, it will not succeed and the URB will become idle.
  *
+ * The URB must not be deallocated while this routine is running.  In
+ * particular, when a driver calls this routine, it must insure that the
+ * completion handler cannot deallocate the URB.
+ *
  * This routine may not be used in an interrupt context (such as a bottom
  * half or a completion handler), or when holding a spinlock, or in other
  * situations where the caller can't schedule().
@@ -640,6 +648,10 @@ EXPORT_SYMBOL_GPL(usb_kill_urb);
  * with error -EPERM.  Thus even if the URB's completion handler always
  * tries to resubmit, it will not succeed and the URB will become idle.
  *
+ * The URB must not be deallocated while this routine is running.  In
+ * particular, when a driver calls this routine, it must insure that the
+ * completion handler cannot deallocate the URB.
+ *
  * This routine may not be used in an interrupt context (such as a bottom
  * half or a completion handler), or when holding a spinlock, or in other
  * situations where the caller can't schedule().
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 7bd815a507e8..99b58d84553a 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -206,11 +206,11 @@ static void dwc3_free_event_buffers(struct dwc3 *dwc)
 
         for (i = 0; i < dwc->num_event_buffers; i++) {
                 evt = dwc->ev_buffs[i];
-                if (evt) {
+                if (evt)
                         dwc3_free_one_event_buffer(dwc, evt);
-                        dwc->ev_buffs[i] = NULL;
-                }
         }
+
+        kfree(dwc->ev_buffs);
 }
 
 /**
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 25910e251c04..3584a169886f 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -353,6 +353,9 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc,
 
                         dwc->test_mode_nr = wIndex >> 8;
                         dwc->test_mode = true;
+                        break;
+                default:
+                        return -EINVAL;
                 }
                 break;
 
@@ -559,15 +562,20 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
         length = trb->size & DWC3_TRB_SIZE_MASK;
 
         if (dwc->ep0_bounced) {
+                unsigned transfer_size = ur->length;
+                unsigned maxp = ep0->endpoint.maxpacket;
+
+                transfer_size += (maxp - (transfer_size % maxp));
                 transferred = min_t(u32, ur->length,
-                                ep0->endpoint.maxpacket - length);
+                                transfer_size - length);
                 memcpy(ur->buf, dwc->ep0_bounce, transferred);
                 dwc->ep0_bounced = false;
         } else {
                 transferred = ur->length - length;
-                ur->actual += transferred;
         }
 
+        ur->actual += transferred;
+
         if ((epnum & 1) && ur->actual < ur->length) {
                 /* for some reason we did not get everything out */
 
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 0c935d7c65bd..9d7bcd910074 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1863,8 +1863,8 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
                         mod_timer(&udc->vbus_timer,
                                   jiffies + VBUS_POLL_TIMEOUT);
                 } else {
-                        if (request_irq(udc->board.vbus_pin, at91_vbus_irq,
-                                        0, driver_name, udc)) {
+                        if (request_irq(gpio_to_irq(udc->board.vbus_pin),
+                                        at91_vbus_irq, 0, driver_name, udc)) {
                                 DBG("request vbus irq %d failed\n",
                                     udc->board.vbus_pin);
                                 retval = -EBUSY;
@@ -1886,7 +1886,7 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
         return 0;
 fail4:
         if (gpio_is_valid(udc->board.vbus_pin) && !udc->board.vbus_polled)
-                free_irq(udc->board.vbus_pin, udc);
+                free_irq(gpio_to_irq(udc->board.vbus_pin), udc);
 fail3:
         if (gpio_is_valid(udc->board.vbus_pin))
                 gpio_free(udc->board.vbus_pin);
@@ -1924,7 +1924,7 @@ static int __exit at91udc_remove(struct platform_device *pdev)
         device_init_wakeup(&pdev->dev, 0);
         remove_debug_file(udc);
         if (gpio_is_valid(udc->board.vbus_pin)) {
-                free_irq(udc->board.vbus_pin, udc);
+                free_irq(gpio_to_irq(udc->board.vbus_pin), udc);
                 gpio_free(udc->board.vbus_pin);
         }
         free_irq(udc->udp_irq, udc);
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index a6dfd2164166..170cbe89d9f8 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -927,7 +927,6 @@ static int dummy_udc_stop(struct usb_gadget *g,
 
         dum->driver = NULL;
 
-        dummy_pullup(&dum->gadget, 0);
         return 0;
 }
 
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 1cbba70836bc..f52cb1ae45d9 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -712,7 +712,7 @@ static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
         if (code == FUNCTIONFS_INTERFACE_REVMAP) {
                 struct ffs_function *func = ffs->func;
                 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
-        } else if (gadget->ops->ioctl) {
+        } else if (gadget && gadget->ops->ioctl) {
                 ret = gadget->ops->ioctl(gadget, code, value);
         } else {
                 ret = -ENOTTY;
@@ -1382,6 +1382,7 @@ static void functionfs_unbind(struct ffs_data *ffs)
                 ffs->ep0req = NULL;
                 ffs->gadget = NULL;
                 ffs_data_put(ffs);
+                clear_bit(FFS_FL_BOUND, &ffs->flags);
         }
 }
 
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index a371e966425f..cb8c162cae5a 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -2189,7 +2189,7 @@ unknown_cmnd:
                 common->data_size_from_cmnd = 0;
                 sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
                 reply = check_command(common, common->cmnd_size,
-                                      DATA_DIR_UNKNOWN, 0xff, 0, unknown);
+                                      DATA_DIR_UNKNOWN, ~0, 0, unknown);
                 if (reply == 0) {
                         common->curlun->sense_data = SS_INVALID_COMMAND;
                         reply = -EINVAL;
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 7b1cf18df5e3..52343654f5df 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -500,6 +500,7 @@ rndis_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
                         if (buf) {
                                 memcpy(req->buf, buf, n);
                                 req->complete = rndis_response_complete;
+                                req->context = rndis;
                                 rndis_free_response(rndis->config, buf);
                                 value = n;
                         }
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index 4fac56927741..a896d73f7a93 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -2579,7 +2579,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                 fsg->data_size_from_cmnd = 0;
                 sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
                 if ((reply = check_command(fsg, fsg->cmnd_size,
-                                DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
+                                DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) {
                         fsg->curlun->sense_data = SS_INVALID_COMMAND;
                         reply = -EINVAL;
                 }
diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
index 5f94e79cd6b9..55abfb6bd612 100644
--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
@@ -730,7 +730,7 @@ static void fsl_queue_td(struct fsl_ep *ep, struct fsl_req *req)
                 : (1 << (ep_index(ep)));
 
         /* check if the pipe is empty */
-        if (!(list_empty(&ep->queue))) {
+        if (!(list_empty(&ep->queue)) && !(ep_index(ep) == 0)) {
                 /* Add td to the end */
                 struct fsl_req *lastreq;
                 lastreq = list_entry(ep->queue.prev, struct fsl_req, queue);
@@ -918,10 +918,6 @@ fsl_ep_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
                 return -ENOMEM;
         }
 
-        /* Update ep0 state */
-        if ((ep_index(ep) == 0))
-                udc->ep0_state = DATA_STATE_XMIT;
-
         /* irq handler advances the queue */
         if (req != NULL)
                 list_add_tail(&req->queue, &ep->queue);
@@ -1279,7 +1275,8 @@ static int ep0_prime_status(struct fsl_udc *udc, int direction)
                 udc->ep0_dir = USB_DIR_OUT;
 
         ep = &udc->eps[0];
-        udc->ep0_state = WAIT_FOR_OUT_STATUS;
+        if (udc->ep0_state != DATA_STATE_XMIT)
+                udc->ep0_state = WAIT_FOR_OUT_STATUS;
 
         req->ep = ep;
         req->req.length = 0;
@@ -1384,6 +1381,9 @@ static void ch9getstatus(struct fsl_udc *udc, u8 request_type, u16 value,
 
         list_add_tail(&req->queue, &ep->queue);
         udc->ep0_state = DATA_STATE_XMIT;
+        if (ep0_prime_status(udc, EP_DIR_OUT))
+                ep0stall(udc);
+
         return;
 stall:
         ep0stall(udc);
@@ -1492,6 +1492,14 @@ static void setup_received_irq(struct fsl_udc *udc,
                 spin_lock(&udc->lock);
                 udc->ep0_state = (setup->bRequestType & USB_DIR_IN)
                                 ?  DATA_STATE_XMIT : DATA_STATE_RECV;
+                /*
+                 * If the data stage is IN, send status prime immediately.
+                 * See 2.0 Spec chapter 8.5.3.3 for detail.
+                 */
+                if (udc->ep0_state == DATA_STATE_XMIT)
+                        if (ep0_prime_status(udc, EP_DIR_OUT))
+                                ep0stall(udc);
+
         } else {
                 /* No data phase, IN status from gadget */
                 udc->ep0_dir = USB_DIR_IN;
@@ -1520,9 +1528,8 @@ static void ep0_req_complete(struct fsl_udc *udc, struct fsl_ep *ep0,
 
         switch (udc->ep0_state) {
         case DATA_STATE_XMIT:
-                /* receive status phase */
-                if (ep0_prime_status(udc, EP_DIR_OUT))
-                        ep0stall(udc);
+                /* already primed at setup_received_irq */
+                udc->ep0_state = WAIT_FOR_OUT_STATUS;
                 break;
         case DATA_STATE_RECV:
                 /* send status phase */
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index 331cd6729d3c..a85eaf40b948 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -161,7 +161,7 @@ static struct usb_composite_driver gfs_driver = {
 static struct ffs_data *gfs_ffs_data;
 static unsigned long gfs_registered;
 
-static int  gfs_init(void)
+static int __init gfs_init(void)
 {
         ENTER();
 
@@ -169,7 +169,7 @@ static int  gfs_init(void)
 }
 module_init(gfs_init);
 
-static void  gfs_exit(void)
+static void __exit gfs_exit(void)
 {
         ENTER();
 
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 8793f32bab11..e58b16442971 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1574,7 +1574,6 @@ static void destroy_ep_files (struct dev_data *dev)
         DBG (dev, "%s %d\n", __func__, dev->state);
 
         /* dev->state must prevent interference */
-restart:
         spin_lock_irq (&dev->lock);
         while (!list_empty(&dev->epfiles)) {
                 struct ep_data  *ep;
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 69295ba9d99a..105b206cd844 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -340,7 +340,7 @@ static void s3c_hsotg_init_fifo(struct s3c_hsotg *hsotg)
         /* currently we allocate TX FIFOs for all possible endpoints,
          * and assume that they are all the same size. */
 
-        for (ep = 0; ep <= 15; ep++) {
+        for (ep = 1; ep <= 15; ep++) {
                 val = addr;
                 val |= size << S3C_DPTXFSIZn_DPTxFSize_SHIFT;
                 addr += size;
@@ -741,7 +741,7 @@ static void s3c_hsotg_start_req(struct s3c_hsotg *hsotg,
         /* write size / packets */
         writel(epsize, hsotg->regs + epsize_reg);
 
-        if (using_dma(hsotg)) {
+        if (using_dma(hsotg) && !continuing) {
                 unsigned int dma_reg;
 
                 /* write DMA address to control register, buffer already
@@ -1696,10 +1696,12 @@ static void s3c_hsotg_set_ep_maxpacket(struct s3c_hsotg *hsotg,
         reg |= mpsval;
         writel(reg, regs + S3C_DIEPCTL(ep));
 
-        reg = readl(regs + S3C_DOEPCTL(ep));
-        reg &= ~S3C_DxEPCTL_MPS_MASK;
-        reg |= mpsval;
-        writel(reg, regs + S3C_DOEPCTL(ep));
+        if (ep) {
+                reg = readl(regs + S3C_DOEPCTL(ep));
+                reg &= ~S3C_DxEPCTL_MPS_MASK;
+                reg |= mpsval;
+                writel(reg, regs + S3C_DOEPCTL(ep));
+        }
 
         return;
 
@@ -1919,7 +1921,8 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
                     ints & S3C_DIEPMSK_TxFIFOEmpty) {
                         dev_dbg(hsotg->dev, "%s: ep%d: TxFIFOEmpty\n",
                                 __func__, idx);
-                        s3c_hsotg_trytx(hsotg, hs_ep);
+                        if (!using_dma(hsotg))
+                                s3c_hsotg_trytx(hsotg, hs_ep);
                 }
         }
 }
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index 56da49f31d6c..e5e44f8cde9a 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -263,9 +263,9 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
 
         if (udc_is_newstyle(udc)) {
                 udc->driver->disconnect(udc->gadget);
+                usb_gadget_disconnect(udc->gadget);
                 udc->driver->unbind(udc->gadget);
                 usb_gadget_udc_stop(udc->gadget, udc->driver);
-                usb_gadget_disconnect(udc->gadget);
         } else {
                 usb_gadget_stop(udc->gadget, udc->driver);
         }
@@ -411,9 +411,13 @@ static ssize_t usb_udc_softconn_store(struct device *dev,
         struct usb_udc          *udc = container_of(dev, struct usb_udc, dev);
 
         if (sysfs_streq(buf, "connect")) {
+                if (udc_is_newstyle(udc))
+                        usb_gadget_udc_start(udc->gadget, udc->driver);
                 usb_gadget_connect(udc->gadget);
         } else if (sysfs_streq(buf, "disconnect")) {
                 usb_gadget_disconnect(udc->gadget);
+                if (udc_is_newstyle(udc))
+                        usb_gadget_udc_stop(udc->gadget, udc->driver);
         } else {
                 dev_err(dev, "unsupported command '%s'\n", buf);
                 return -EINVAL;
diff --git a/drivers/usb/gadget/uvc.h b/drivers/usb/gadget/uvc.h
index bc78c606c12b..ca4e03a1c73a 100644
--- a/drivers/usb/gadget/uvc.h
+++ b/drivers/usb/gadget/uvc.h
@@ -28,7 +28,7 @@
 
 struct uvc_request_data
 {
-        unsigned int length;
+        __s32 length;
         __u8 data[60];
 };
 
diff --git a/drivers/usb/gadget/uvc_queue.c b/drivers/usb/gadget/uvc_queue.c
index d776adb2da67..0cdf89d32a15 100644
--- a/drivers/usb/gadget/uvc_queue.c
+++ b/drivers/usb/gadget/uvc_queue.c
@@ -543,11 +543,11 @@ done:
         return ret;
 }
 
+/* called with queue->irqlock held.. */
 static struct uvc_buffer *
 uvc_queue_next_buffer(struct uvc_video_queue *queue, struct uvc_buffer *buf)
 {
         struct uvc_buffer *nextbuf;
-        unsigned long flags;
 
         if ((queue->flags & UVC_QUEUE_DROP_INCOMPLETE) &&
             buf->buf.length != buf->buf.bytesused) {
@@ -556,14 +556,12 @@ uvc_queue_next_buffer(struct uvc_video_queue *queue, struct uvc_buffer *buf)
                 return buf;
         }
 
-        spin_lock_irqsave(&queue->irqlock, flags);
         list_del(&buf->queue);
         if (!list_empty(&queue->irqqueue))
                 nextbuf = list_first_entry(&queue->irqqueue, struct uvc_buffer,
                                            queue);
         else
                 nextbuf = NULL;
-        spin_unlock_irqrestore(&queue->irqlock, flags);
 
         buf->buf.sequence = queue->sequence++;
         do_gettimeofday(&buf->buf.timestamp);
diff --git a/drivers/usb/gadget/uvc_v4l2.c b/drivers/usb/gadget/uvc_v4l2.c
index f6e083b50191..54d7ca559cb2 100644
--- a/drivers/usb/gadget/uvc_v4l2.c
+++ b/drivers/usb/gadget/uvc_v4l2.c
@@ -39,7 +39,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data)
         if (data->length < 0)
                 return usb_ep_set_halt(cdev->gadget->ep0);
 
-        req->length = min(uvc->event_length, data->length);
+        req->length = min_t(unsigned int, uvc->event_length, data->length);
         req->zero = data->length < uvc->event_length;
         req->dma = DMA_ADDR_INVALID;
 
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 3e7345172e03..d0a84bd3f3eb 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -218,6 +218,9 @@ static void ehci_fsl_setup_phy(struct ehci_hcd *ehci,
         u32 portsc;
         struct usb_hcd *hcd = ehci_to_hcd(ehci);
         void __iomem *non_ehci = hcd->regs;
+        struct fsl_usb2_platform_data *pdata;
+
+        pdata = hcd->self.controller->platform_data;
 
         portsc = ehci_readl(ehci, &ehci->regs->port_status[port_offset]);
         portsc &= ~(PORT_PTS_MSK | PORT_PTS_PTW);
@@ -234,7 +237,9 @@ static void ehci_fsl_setup_phy(struct ehci_hcd *ehci,
                 /* fall through */
         case FSL_USB2_PHY_UTMI:
                 /* enable UTMI PHY */
-                setbits32(non_ehci + FSL_SOC_USB_CTRL, CTRL_UTMI_PHY_EN);
+                if (pdata->have_sysif_regs)
+                        setbits32(non_ehci + FSL_SOC_USB_CTRL,
+                                  CTRL_UTMI_PHY_EN);
                 portsc |= PORT_PTS_UTMI;
                 break;
         case FSL_USB2_PHY_NONE:
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 057cdda7a489..4a3bc5b7a06f 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -347,6 +347,8 @@ static int ehci_reset (struct ehci_hcd *ehci)
         if (ehci->debug)
                 dbgp_external_startup();
 
+        ehci->port_c_suspend = ehci->suspended_ports =
+                        ehci->resuming_ports = 0;
         return retval;
 }
 
@@ -856,8 +858,13 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                 goto dead;
         }
 
+        /*
+         * We don't use STS_FLR, but some controllers don't like it to
+         * remain on, so mask it out along with the other status bits.
+         */
+        masked_status = status & (INTR_MASK | STS_FLR);
+
         /* Shared IRQ? */
-        masked_status = status & INTR_MASK;
         if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
                 spin_unlock(&ehci->lock);
                 return IRQ_NONE;
@@ -908,7 +915,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                 pcd_status = status;
 
                 /* resume root hub? */
-                if (!(cmd & CMD_RUN))
+                if (ehci->rh_state == EHCI_RH_SUSPENDED)
                         usb_hcd_resume_root_hub(hcd);
 
                 /* get per-port change detect bits */
@@ -939,6 +946,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                          * like usb_port_resume() does.
                          */
                         ehci->reset_done[i] = jiffies + msecs_to_jiffies(25);
+                        set_bit(i, &ehci->resuming_ports);
                         ehci_dbg (ehci, "port %d remote wakeup\n", i + 1);
                         mod_timer(&hcd->rh_timer, ehci->reset_done[i]);
                 }
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 256fbd42e48c..38fe07623152 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -223,15 +223,10 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
          * remote wakeup, we must fail the suspend.
          */
         if (hcd->self.root_hub->do_remote_wakeup) {
-                port = HCS_N_PORTS(ehci->hcs_params);
-                while (port--) {
-                        if (ehci->reset_done[port] != 0) {
-                                spin_unlock_irq(&ehci->lock);
-                                ehci_dbg(ehci, "suspend failed because "
-                                                "port %d is resuming\n",
-                                                port + 1);
-                                return -EBUSY;
-                        }
+                if (ehci->resuming_ports) {
+                        spin_unlock_irq(&ehci->lock);
+                        ehci_dbg(ehci, "suspend failed because a port is resuming\n");
+                        return -EBUSY;
                 }
         }
 
@@ -554,16 +549,12 @@ static int
 ehci_hub_status_data (struct usb_hcd *hcd, char *buf)
 {
         struct ehci_hcd *ehci = hcd_to_ehci (hcd);
-        u32             temp, status = 0;
+        u32             temp, status;
         u32             mask;
         int             ports, i, retval = 1;
         unsigned long   flags;
         u32             ppcd = 0;
 
-        /* if !USB_SUSPEND, root hub timers won't get shut down ... */
-        if (ehci->rh_state != EHCI_RH_RUNNING)
-                return 0;
-
         /* init status to no-changes */
         buf [0] = 0;
         ports = HCS_N_PORTS (ehci->hcs_params);
@@ -572,6 +563,11 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf)
                 retval++;
         }
 
+        /* Inform the core about resumes-in-progress by returning
+         * a non-zero value even if there are no status changes.
+         */
+        status = ehci->resuming_ports;
+
         /* Some boards (mostly VIA?) report bogus overcurrent indications,
          * causing massive log spam unless we completely ignore them.  It
          * may be relevant that VIA VT8235 controllers, where PORT_POWER is
@@ -846,6 +842,7 @@ static int ehci_hub_control (
                                 ehci_writel(ehci,
                                         temp & ~(PORT_RWC_BITS | PORT_RESUME),
                                         status_reg);
+                                clear_bit(wIndex, &ehci->resuming_ports);
                                 retval = handshake(ehci, status_reg,
                                            PORT_RESUME, 0, 2000 /* 2msec */);
                                 if (retval != 0) {
@@ -864,6 +861,7 @@ static int ehci_hub_control (
                                         ehci->reset_done[wIndex])) {
                         status |= USB_PORT_STAT_C_RESET << 16;
                         ehci->reset_done [wIndex] = 0;
+                        clear_bit(wIndex, &ehci->resuming_ports);
 
                         /* force reset to complete */
                         ehci_writel(ehci, temp & ~(PORT_RWC_BITS | PORT_RESET),
@@ -884,8 +882,10 @@ static int ehci_hub_control (
                                         ehci_readl(ehci, status_reg));
                 }
 
-                if (!(temp & (PORT_RESUME|PORT_RESET)))
+                if (!(temp & (PORT_RESUME|PORT_RESET))) {
                         ehci->reset_done[wIndex] = 0;
+                        clear_bit(wIndex, &ehci->resuming_ports);
+                }
 
                 /* transfer dedicated ports to the companion hc */
                 if ((temp & PORT_CONNECT) &&
@@ -920,6 +920,7 @@ static int ehci_hub_control (
                         status |= USB_PORT_STAT_SUSPEND;
                 } else if (test_bit(wIndex, &ehci->suspended_ports)) {
                         clear_bit(wIndex, &ehci->suspended_ports);
+                        clear_bit(wIndex, &ehci->resuming_ports);
                         ehci->reset_done[wIndex] = 0;
                         if (temp & PORT_PE)
                                 set_bit(wIndex, &ehci->port_c_suspend);
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index bba9850f32f0..5c78f9e71466 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -42,6 +42,7 @@
 #include <plat/usb.h>
 #include <linux/regulator/consumer.h>
 #include <linux/pm_runtime.h>
+#include <linux/gpio.h>
 
 /* EHCI Register Set */
 #define EHCI_INSNREG04                                  (0xA0)
@@ -191,6 +192,19 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
                 }
         }
 
+        if (pdata->phy_reset) {
+                if (gpio_is_valid(pdata->reset_gpio_port[0]))
+                        gpio_request_one(pdata->reset_gpio_port[0],
+                                         GPIOF_OUT_INIT_LOW, "USB1 PHY reset");
+
+                if (gpio_is_valid(pdata->reset_gpio_port[1]))
+                        gpio_request_one(pdata->reset_gpio_port[1],
+                                         GPIOF_OUT_INIT_LOW, "USB2 PHY reset");
+
+                /* Hold the PHY in RESET for enough time till DIR is high */
+                udelay(10);
+        }
+
         pm_runtime_enable(dev);
         pm_runtime_get_sync(dev);
 
@@ -237,6 +251,19 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
         /* root ports should always stay powered */
         ehci_port_power(omap_ehci, 1);
 
+        if (pdata->phy_reset) {
+                /* Hold the PHY in RESET for enough time till
+                 * PHY is settled and ready
+                 */
+                udelay(10);
+
+                if (gpio_is_valid(pdata->reset_gpio_port[0]))
+                        gpio_set_value(pdata->reset_gpio_port[0], 1);
+
+                if (gpio_is_valid(pdata->reset_gpio_port[1]))
+                        gpio_set_value(pdata->reset_gpio_port[1], 1);
+        }
+
         return 0;
 
 err_add_hcd:
@@ -259,8 +286,9 @@ err_io:
  */
 static int ehci_hcd_omap_remove(struct platform_device *pdev)
 {
-        struct device *dev      = &pdev->dev;
-        struct usb_hcd *hcd     = dev_get_drvdata(dev);
+        struct device *dev                              = &pdev->dev;
+        struct usb_hcd *hcd                             = dev_get_drvdata(dev);
+        struct ehci_hcd_omap_platform_data *pdata       = dev->platform_data;
 
         usb_remove_hcd(hcd);
         disable_put_regulator(dev->platform_data);
@@ -269,6 +297,13 @@ static int ehci_hcd_omap_remove(struct platform_device *pdev)
         pm_runtime_put_sync(dev);
         pm_runtime_disable(dev);
 
+        if (pdata->phy_reset) {
+                if (gpio_is_valid(pdata->reset_gpio_port[0]))
+                        gpio_free(pdata->reset_gpio_port[0]);
+
+                if (gpio_is_valid(pdata->reset_gpio_port[1]))
+                        gpio_free(pdata->reset_gpio_port[1]);
+        }
         return 0;
 }
 
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 01bb7241d6ef..fe8dc069164e 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -144,6 +144,14 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                         hcd->has_tt = 1;
                         tdi_reset(ehci);
                 }
+                if (pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK) {
+                        /* EHCI #1 or #2 on 6 Series/C200 Series chipset */
+                        if (pdev->device == 0x1c26 || pdev->device == 0x1c2d) {
+                                ehci_info(ehci, "broken D3 during system sleep on ASUS\n");
+                                hcd->broken_pci_sleep = 1;
+                                device_set_wakeup_capable(&pdev->dev, false);
+                        }
+                }
                 break;
         case PCI_VENDOR_ID_TDI:
                 if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
index 3de48a2d7955..f214a80cdee2 100644
--- a/drivers/usb/host/ehci-tegra.c
+++ b/drivers/usb/host/ehci-tegra.c
@@ -24,6 +24,7 @@
 #include <linux/gpio.h>
 #include <linux/of.h>
 #include <linux/of_gpio.h>
+#include <linux/pm_runtime.h>
 
 #include <mach/usb_phy.h>
 #include <mach/iomap.h>
@@ -37,9 +38,7 @@ struct tegra_ehci_hcd {
         struct clk *emc_clk;
         struct usb_phy *transceiver;
         int host_resumed;
-        int bus_suspended;
         int port_resuming;
-        int power_down_on_bus_suspend;
         enum tegra_usb_phy_port_speed port_speed;
 };
 
@@ -224,6 +223,7 @@ static int tegra_ehci_hub_control(
                 temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS);
                 /* start resume signalling */
                 ehci_writel(ehci, temp | PORT_RESUME, status_reg);
+                set_bit(wIndex-1, &ehci->resuming_ports);
 
                 spin_unlock_irqrestore(&ehci->lock, flags);
                 msleep(20);
@@ -236,6 +236,7 @@ static int tegra_ehci_hub_control(
                         pr_err("%s: timeout waiting for SUSPEND\n", __func__);
 
                 ehci->reset_done[wIndex-1] = 0;
+                clear_bit(wIndex-1, &ehci->resuming_ports);
 
                 tegra->port_resuming = 1;
                 goto done;
@@ -271,120 +272,6 @@ static void tegra_ehci_restart(struct usb_hcd *hcd)
         up_write(&ehci_cf_port_reset_rwsem);
 }
 
-static int tegra_usb_suspend(struct usb_hcd *hcd)
-{
-        struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
-        struct ehci_regs __iomem *hw = tegra->ehci->regs;
-        unsigned long flags;
-
-        spin_lock_irqsave(&tegra->ehci->lock, flags);
-
-        tegra->port_speed = (readl(&hw->port_status[0]) >> 26) & 0x3;
-        ehci_halt(tegra->ehci);
-        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
-
-        spin_unlock_irqrestore(&tegra->ehci->lock, flags);
-
-        tegra_ehci_power_down(hcd);
-        return 0;
-}
-
-static int tegra_usb_resume(struct usb_hcd *hcd)
-{
-        struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
-        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
-        struct ehci_regs __iomem *hw = ehci->regs;
-        unsigned long val;
-
-        set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
-        tegra_ehci_power_up(hcd);
-
-        if (tegra->port_speed > TEGRA_USB_PHY_PORT_SPEED_HIGH) {
-                /* Wait for the phy to detect new devices
-                 * before we restart the controller */
-                msleep(10);
-                goto restart;
-        }
-
-        /* Force the phy to keep data lines in suspend state */
-        tegra_ehci_phy_restore_start(tegra->phy, tegra->port_speed);
-
-        /* Enable host mode */
-        tdi_reset(ehci);
-
-        /* Enable Port Power */
-        val = readl(&hw->port_status[0]);
-        val |= PORT_POWER;
-        writel(val, &hw->port_status[0]);
-        udelay(10);
-
-        /* Check if the phy resume from LP0. When the phy resume from LP0
-         * USB register will be reset. */
-        if (!readl(&hw->async_next)) {
-                /* Program the field PTC based on the saved speed mode */
-                val = readl(&hw->port_status[0]);
-                val &= ~PORT_TEST(~0);
-                if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_HIGH)
-                        val |= PORT_TEST_FORCE;
-                else if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_FULL)
-                        val |= PORT_TEST(6);
-                else if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_LOW)
-                        val |= PORT_TEST(7);
-                writel(val, &hw->port_status[0]);
-                udelay(10);
-
-                /* Disable test mode by setting PTC field to NORMAL_OP */
-                val = readl(&hw->port_status[0]);
-                val &= ~PORT_TEST(~0);
-                writel(val, &hw->port_status[0]);
-                udelay(10);
-        }
-
-        /* Poll until CCS is enabled */
-        if (handshake(ehci, &hw->port_status[0], PORT_CONNECT,
-                                                 PORT_CONNECT, 2000)) {
-                pr_err("%s: timeout waiting for PORT_CONNECT\n", __func__);
-                goto restart;
-        }
-
-        /* Poll until PE is enabled */
-        if (handshake(ehci, &hw->port_status[0], PORT_PE,
-                                                 PORT_PE, 2000)) {
-                pr_err("%s: timeout waiting for USB_PORTSC1_PE\n", __func__);
-                goto restart;
-        }
-
-        /* Clear the PCI status, to avoid an interrupt taken upon resume */
-        val = readl(&hw->status);
-        val |= STS_PCD;
-        writel(val, &hw->status);
-
-        /* Put controller in suspend mode by writing 1 to SUSP bit of PORTSC */
-        val = readl(&hw->port_status[0]);
-        if ((val & PORT_POWER) && (val & PORT_PE)) {
-                val |= PORT_SUSPEND;
-                writel(val, &hw->port_status[0]);
-
-                /* Wait until port suspend completes */
-                if (handshake(ehci, &hw->port_status[0], PORT_SUSPEND,
-                                                         PORT_SUSPEND, 1000)) {
-                        pr_err("%s: timeout waiting for PORT_SUSPEND\n",
-                                                                __func__);
-                        goto restart;
-                }
-        }
-
-        tegra_ehci_phy_restore_end(tegra->phy);
-        return 0;
-
-restart:
-        if (tegra->port_speed <= TEGRA_USB_PHY_PORT_SPEED_HIGH)
-                tegra_ehci_phy_restore_end(tegra->phy);
-
-        tegra_ehci_restart(hcd);
-        return 0;
-}
-
 static void tegra_ehci_shutdown(struct usb_hcd *hcd)
 {
         struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
@@ -432,36 +319,6 @@ static int tegra_ehci_setup(struct usb_hcd *hcd)
         return retval;
 }
 
-#ifdef CONFIG_PM
-static int tegra_ehci_bus_suspend(struct usb_hcd *hcd)
-{
-        struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
-        int error_status = 0;
-
-        error_status = ehci_bus_suspend(hcd);
-        if (!error_status && tegra->power_down_on_bus_suspend) {
-                tegra_usb_suspend(hcd);
-                tegra->bus_suspended = 1;
-        }
-
-        return error_status;
-}
-
-static int tegra_ehci_bus_resume(struct usb_hcd *hcd)
-{
-        struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
-
-        if (tegra->bus_suspended && tegra->power_down_on_bus_suspend) {
-                tegra_usb_resume(hcd);
-                tegra->bus_suspended = 0;
-        }
-
-        tegra_usb_phy_preresume(tegra->phy);
-        tegra->port_resuming = 1;
-        return ehci_bus_resume(hcd);
-}
-#endif
-
 struct temp_buffer {
         void *kmalloc_ptr;
         void *old_xfer_buffer;
@@ -572,8 +429,8 @@ static const struct hc_driver tegra_ehci_hc_driver = {
         .hub_control            = tegra_ehci_hub_control,
         .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
 #ifdef CONFIG_PM
-        .bus_suspend            = tegra_ehci_bus_suspend,
-        .bus_resume             = tegra_ehci_bus_resume,
+        .bus_suspend            = ehci_bus_suspend,
+        .bus_resume             = ehci_bus_resume,
 #endif
         .relinquish_port        = ehci_relinquish_port,
         .port_handed_over       = ehci_port_handed_over,
@@ -601,11 +458,187 @@ static int setup_vbus_gpio(struct platform_device *pdev)
                 dev_err(&pdev->dev, "can't enable vbus\n");
                 return err;
         }
-        gpio_set_value(gpio, 1);
 
         return err;
 }
 
+#ifdef CONFIG_PM
+
+static int controller_suspend(struct device *dev)
+{
+        struct tegra_ehci_hcd *tegra =
+                        platform_get_drvdata(to_platform_device(dev));
+        struct ehci_hcd *ehci = tegra->ehci;
+        struct usb_hcd *hcd = ehci_to_hcd(ehci);
+        struct ehci_regs __iomem *hw = ehci->regs;
+        unsigned long flags;
+
+        if (time_before(jiffies, ehci->next_statechange))
+                msleep(10);
+
+        spin_lock_irqsave(&ehci->lock, flags);
+
+        tegra->port_speed = (readl(&hw->port_status[0]) >> 26) & 0x3;
+        ehci_halt(ehci);
+        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+
+        spin_unlock_irqrestore(&ehci->lock, flags);
+
+        tegra_ehci_power_down(hcd);
+        return 0;
+}
+
+static int controller_resume(struct device *dev)
+{
+        struct tegra_ehci_hcd *tegra =
+                        platform_get_drvdata(to_platform_device(dev));
+        struct ehci_hcd *ehci = tegra->ehci;
+        struct usb_hcd *hcd = ehci_to_hcd(ehci);
+        struct ehci_regs __iomem *hw = ehci->regs;
+        unsigned long val;
+
+        set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+        tegra_ehci_power_up(hcd);
+
+        if (tegra->port_speed > TEGRA_USB_PHY_PORT_SPEED_HIGH) {
+                /* Wait for the phy to detect new devices
+                 * before we restart the controller */
+                msleep(10);
+                goto restart;
+        }
+
+        /* Force the phy to keep data lines in suspend state */
+        tegra_ehci_phy_restore_start(tegra->phy, tegra->port_speed);
+
+        /* Enable host mode */
+        tdi_reset(ehci);
+
+        /* Enable Port Power */
+        val = readl(&hw->port_status[0]);
+        val |= PORT_POWER;
+        writel(val, &hw->port_status[0]);
+        udelay(10);
+
+        /* Check if the phy resume from LP0. When the phy resume from LP0
+         * USB register will be reset. */
+        if (!readl(&hw->async_next)) {
+                /* Program the field PTC based on the saved speed mode */
+                val = readl(&hw->port_status[0]);
+                val &= ~PORT_TEST(~0);
+                if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_HIGH)
+                        val |= PORT_TEST_FORCE;
+                else if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_FULL)
+                        val |= PORT_TEST(6);
+                else if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_LOW)
+                        val |= PORT_TEST(7);
+                writel(val, &hw->port_status[0]);
+                udelay(10);
+
+                /* Disable test mode by setting PTC field to NORMAL_OP */
+                val = readl(&hw->port_status[0]);
+                val &= ~PORT_TEST(~0);
+                writel(val, &hw->port_status[0]);
+                udelay(10);
+        }
+
+        /* Poll until CCS is enabled */
+        if (handshake(ehci, &hw->port_status[0], PORT_CONNECT,
+                                                 PORT_CONNECT, 2000)) {
+                pr_err("%s: timeout waiting for PORT_CONNECT\n", __func__);
+                goto restart;
+        }
+
+        /* Poll until PE is enabled */
+        if (handshake(ehci, &hw->port_status[0], PORT_PE,
+                                                 PORT_PE, 2000)) {
+                pr_err("%s: timeout waiting for USB_PORTSC1_PE\n", __func__);
+                goto restart;
+        }
+
+        /* Clear the PCI status, to avoid an interrupt taken upon resume */
+        val = readl(&hw->status);
+        val |= STS_PCD;
+        writel(val, &hw->status);
+
+        /* Put controller in suspend mode by writing 1 to SUSP bit of PORTSC */
+        val = readl(&hw->port_status[0]);
+        if ((val & PORT_POWER) && (val & PORT_PE)) {
+                val |= PORT_SUSPEND;
+                writel(val, &hw->port_status[0]);
+
+                /* Wait until port suspend completes */
+                if (handshake(ehci, &hw->port_status[0], PORT_SUSPEND,
+                                                         PORT_SUSPEND, 1000)) {
+                        pr_err("%s: timeout waiting for PORT_SUSPEND\n",
+                                                                __func__);
+                        goto restart;
+                }
+        }
+
+        tegra_ehci_phy_restore_end(tegra->phy);
+        goto done;
+
+ restart:
+        if (tegra->port_speed <= TEGRA_USB_PHY_PORT_SPEED_HIGH)
+                tegra_ehci_phy_restore_end(tegra->phy);
+
+        tegra_ehci_restart(hcd);
+
+ done:
+        tegra_usb_phy_preresume(tegra->phy);
+        tegra->port_resuming = 1;
+        return 0;
+}
+
+static int tegra_ehci_suspend(struct device *dev)
+{
+        struct tegra_ehci_hcd *tegra =
+                        platform_get_drvdata(to_platform_device(dev));
+        struct usb_hcd *hcd = ehci_to_hcd(tegra->ehci);
+        int rc = 0;
+
+        /*
+         * When system sleep is supported and USB controller wakeup is
+         * implemented: If the controller is runtime-suspended and the
+         * wakeup setting needs to be changed, call pm_runtime_resume().
+         */
+        if (HCD_HW_ACCESSIBLE(hcd))
+                rc = controller_suspend(dev);
+        return rc;
+}
+
+static int tegra_ehci_resume(struct device *dev)
+{
+        int rc;
+
+        rc = controller_resume(dev);
+        if (rc == 0) {
+                pm_runtime_disable(dev);
+                pm_runtime_set_active(dev);
+                pm_runtime_enable(dev);
+        }
+        return rc;
+}
+
+static int tegra_ehci_runtime_suspend(struct device *dev)
+{
+        return controller_suspend(dev);
+}
+
+static int tegra_ehci_runtime_resume(struct device *dev)
+{
+        return controller_resume(dev);
+}
+
+static const struct dev_pm_ops tegra_ehci_pm_ops = {
+        .suspend        = tegra_ehci_suspend,
+        .resume         = tegra_ehci_resume,
+        .runtime_suspend = tegra_ehci_runtime_suspend,
+        .runtime_resume = tegra_ehci_runtime_resume,
+};
+
+#endif
+
 static u64 tegra_ehci_dma_mask = DMA_BIT_MASK(32);
 
 static int tegra_ehci_probe(struct platform_device *pdev)
@@ -720,7 +753,6 @@ static int tegra_ehci_probe(struct platform_device *pdev)
         }
 
         tegra->host_resumed = 1;
-        tegra->power_down_on_bus_suspend = pdata->power_down_on_bus_suspend;
         tegra->ehci = hcd_to_ehci(hcd);
 
         irq = platform_get_irq(pdev, 0);
@@ -729,7 +761,6 @@ static int tegra_ehci_probe(struct platform_device *pdev)
                 err = -ENODEV;
                 goto fail;
         }
-        set_irq_flags(irq, IRQF_VALID);
 
 #ifdef CONFIG_USB_OTG_UTILS
         if (pdata->operating_mode == TEGRA_USB_OTG) {
@@ -745,6 +776,14 @@ static int tegra_ehci_probe(struct platform_device *pdev)
                 goto fail;
         }
 
+        pm_runtime_set_active(&pdev->dev);
+        pm_runtime_get_noresume(&pdev->dev);
+
+        /* Don't skip the pm_runtime_forbid call if wakeup isn't working */
+        /* if (!pdata->power_down_on_bus_suspend) */
+                pm_runtime_forbid(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+        pm_runtime_put_sync(&pdev->dev);
         return err;
 
 fail:
@@ -771,33 +810,6 @@ fail_hcd:
         return err;
 }
 
-#ifdef CONFIG_PM
-static int tegra_ehci_resume(struct platform_device *pdev)
-{
-        struct tegra_ehci_hcd *tegra = platform_get_drvdata(pdev);
-        struct usb_hcd *hcd = ehci_to_hcd(tegra->ehci);
-
-        if (tegra->bus_suspended)
-                return 0;
-
-        return tegra_usb_resume(hcd);
-}
-
-static int tegra_ehci_suspend(struct platform_device *pdev, pm_message_t state)
-{
-        struct tegra_ehci_hcd *tegra = platform_get_drvdata(pdev);
-        struct usb_hcd *hcd = ehci_to_hcd(tegra->ehci);
-
-        if (tegra->bus_suspended)
-                return 0;
-
-        if (time_before(jiffies, tegra->ehci->next_statechange))
-                msleep(10);
-
-        return tegra_usb_suspend(hcd);
-}
-#endif
-
 static int tegra_ehci_remove(struct platform_device *pdev)
 {
         struct tegra_ehci_hcd *tegra = platform_get_drvdata(pdev);
@@ -806,6 +818,10 @@ static int tegra_ehci_remove(struct platform_device *pdev)
         if (tegra == NULL || hcd == NULL)
                 return -EINVAL;
 
+        pm_runtime_get_sync(&pdev->dev);
+        pm_runtime_disable(&pdev->dev);
+        pm_runtime_put_noidle(&pdev->dev);
+
 #ifdef CONFIG_USB_OTG_UTILS
         if (tegra->transceiver) {
                 otg_set_host(tegra->transceiver->otg, NULL);
@@ -846,13 +862,12 @@ static struct of_device_id tegra_ehci_of_match[] __devinitdata = {
 static struct platform_driver tegra_ehci_driver = {
         .probe          = tegra_ehci_probe,
         .remove         = tegra_ehci_remove,
-#ifdef CONFIG_PM
-        .suspend        = tegra_ehci_suspend,
-        .resume         = tegra_ehci_resume,
-#endif
         .shutdown       = tegra_ehci_hcd_shutdown,
         .driver         = {
                 .name   = "tegra-ehci",
                 .of_match_table = tegra_ehci_of_match,
+#ifdef CONFIG_PM
+                .pm     = &tegra_ehci_pm_ops,
+#endif
         }
 };
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 8f9acbc96fde..2694ed6558d2 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -117,6 +117,8 @@ struct ehci_hcd {			/* one per controller */
                         the change-suspend feature turned on */
         unsigned long           suspended_ports;        /* which ports are
                         suspended */
+        unsigned long           resuming_ports;         /* which ports have
+                        started to resume */
 
         /* per-HC memory pools (could be per-bus, but ...) */
         struct dma_pool         *qh_pool;       /* qh per active urb */
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 09f597ad6e00..13ebeca8e73e 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -94,7 +94,7 @@ static void at91_stop_hc(struct platform_device *pdev)
 
 /*-------------------------------------------------------------------------*/
 
-static void usb_hcd_at91_remove (struct usb_hcd *, struct platform_device *);
+static void __devexit usb_hcd_at91_remove (struct usb_hcd *, struct platform_device *);
 
 /* configure so an HC device and id are always provided */
 /* always called with process context; sleeping is OK */
@@ -108,7 +108,7 @@ static void usb_hcd_at91_remove (struct usb_hcd *, struct platform_device *);
  * then invokes the start() method for the HCD associated with it
  * through the hotplug entry's driver_data.
  */
-static int usb_hcd_at91_probe(const struct hc_driver *driver,
+static int __devinit usb_hcd_at91_probe(const struct hc_driver *driver,
                         struct platform_device *pdev)
 {
         int retval;
@@ -203,7 +203,7 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
  * context, "rmmod" or something similar.
  *
  */
-static void usb_hcd_at91_remove(struct usb_hcd *hcd,
+static void __devexit usb_hcd_at91_remove(struct usb_hcd *hcd,
                                 struct platform_device *pdev)
 {
         usb_remove_hcd(hcd);
@@ -545,7 +545,7 @@ static int __devinit ohci_at91_of_init(struct platform_device *pdev)
 
 /*-------------------------------------------------------------------------*/
 
-static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
+static int __devinit ohci_hcd_at91_drv_probe(struct platform_device *pdev)
 {
         struct at91_usbh_data   *pdata;
         int                     i;
@@ -620,7 +620,7 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
         return usb_hcd_at91_probe(&ohci_at91_hc_driver, pdev);
 }
 
-static int ohci_hcd_at91_drv_remove(struct platform_device *pdev)
+static int __devexit ohci_hcd_at91_drv_remove(struct platform_device *pdev)
 {
         struct at91_usbh_data   *pdata = pdev->dev.platform_data;
         int                     i;
@@ -696,7 +696,7 @@ MODULE_ALIAS("platform:at91_ohci");
 
 static struct platform_driver ohci_hcd_at91_driver = {
         .probe          = ohci_hcd_at91_drv_probe,
-        .remove         = ohci_hcd_at91_drv_remove,
+        .remove         = __devexit_p(ohci_hcd_at91_drv_remove),
         .shutdown       = usb_hcd_platform_shutdown,
         .suspend        = ohci_hcd_at91_drv_suspend,
         .resume         = ohci_hcd_at91_drv_resume,
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 11de5f1be981..32dada8c8b4f 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -825,9 +825,13 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
                 }
         }
 
-        /* Disable any BIOS SMIs */
-        writel(XHCI_LEGACY_DISABLE_SMI,
-                        base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
+        val = readl(base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
+        /* Mask off (turn off) any enabled SMIs */
+        val &= XHCI_LEGACY_DISABLE_SMI;
+        /* Mask all SMI events bits, RW1C */
+        val |= XHCI_LEGACY_SMI_EVENTS;
+        /* Disable any BIOS SMIs and clear all SMI events*/
+        writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
 
         if (usb_is_intel_switchable_xhci(pdev))
                 usb_enable_xhci_ports(pdev);
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index 045cde4cbc3d..768d54295a20 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -196,11 +196,12 @@ static int uhci_hub_status_data(struct usb_hcd *hcd, char *buf)
         status = get_hub_status_data(uhci, buf);
 
         switch (uhci->rh_state) {
-            case UHCI_RH_SUSPENDING:
             case UHCI_RH_SUSPENDED:
                 /* if port change, ask to be resumed */
-                if (status || uhci->resuming_ports)
+                if (status || uhci->resuming_ports) {
+                        status = 1;
                         usb_hcd_resume_root_hub(hcd);
+                }
                 break;
 
             case UHCI_RH_AUTO_STOPPED:
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index e9b0f043455d..4b436f5a4171 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -119,7 +119,7 @@ static void xhci_print_command_reg(struct xhci_hcd *xhci)
         xhci_dbg(xhci, "  Event Interrupts %s\n",
                         (temp & CMD_EIE) ? "enabled " : "disabled");
         xhci_dbg(xhci, "  Host System Error Interrupts %s\n",
-                        (temp & CMD_EIE) ? "enabled " : "disabled");
+                        (temp & CMD_HSEIE) ? "enabled " : "disabled");
         xhci_dbg(xhci, "  HC has %sfinished light reset\n",
                         (temp & CMD_LRESET) ? "not " : "");
 }
diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
index c7f33123d4c0..377f4242dabb 100644
--- a/drivers/usb/host/xhci-ext-caps.h
+++ b/drivers/usb/host/xhci-ext-caps.h
@@ -62,8 +62,9 @@
 /* USB Legacy Support Control and Status Register  - section 7.1.2 */
 /* Add this offset, plus the value of xECP in HCCPARAMS to the base address */
 #define XHCI_LEGACY_CONTROL_OFFSET      (0x04)
-/* bits 1:2, 5:12, and 17:19 need to be preserved; bits 21:28 should be zero */
-#define XHCI_LEGACY_DISABLE_SMI         ((0x3 << 1) + (0xff << 5) + (0x7 << 17))
+/* bits 1:3, 5:12, and 17:19 need to be preserved; bits 21:28 should be zero */
+#define XHCI_LEGACY_DISABLE_SMI         ((0x7 << 1) + (0xff << 5) + (0x7 << 17))
+#define XHCI_LEGACY_SMI_EVENTS          (0x7 << 29)
 
 /* USB 2.0 xHCI 0.96 L1C capability - section 7.2.2.1.3.2 */
 #define XHCI_L1C               (1 << 16)
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index cae4c6f2845a..68eaa908ac8e 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1796,11 +1796,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         int i;
 
         /* Free the Event Ring Segment Table and the actual Event Ring */
-        if (xhci->ir_set) {
-                xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
-                xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
-                xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
-        }
         size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
         if (xhci->erst.entries)
                 dma_free_coherent(&pdev->dev, size,
@@ -1812,7 +1807,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         xhci->event_ring = NULL;
         xhci_dbg(xhci, "Freed event ring\n");
 
-        xhci_write_64(xhci, 0, &xhci->op_regs->cmd_ring);
         if (xhci->cmd_ring)
                 xhci_ring_free(xhci, xhci->cmd_ring);
         xhci->cmd_ring = NULL;
@@ -1841,7 +1835,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         xhci->medium_streams_pool = NULL;
         xhci_dbg(xhci, "Freed medium stream array pool\n");
 
-        xhci_write_64(xhci, 0, &xhci->op_regs->dcbaa_ptr);
         if (xhci->dcbaa)
                 dma_free_coherent(&pdev->dev, sizeof(*xhci->dcbaa),
                                 xhci->dcbaa, xhci->dcbaa->dma);
@@ -2459,6 +2452,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 
 fail:
         xhci_warn(xhci, "Couldn't initialize memory\n");
+        xhci_halt(xhci);
+        xhci_reset(xhci);
         xhci_mem_cleanup(xhci);
         return -ENOMEM;
 }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index ef98b38626fb..7a856a767e77 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -95,6 +95,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 xhci->quirks |= XHCI_RESET_ON_RESUME;
                 xhci_dbg(xhci, "QUIRK: Resetting on resume\n");
         }
+        if (pdev->vendor == PCI_VENDOR_ID_VIA)
+                xhci->quirks |= XHCI_RESET_ON_RESUME;
 }
 
 /* called during probe() after chip reset completes */
@@ -326,7 +328,7 @@ int __init xhci_register_pci(void)
         return pci_register_driver(&xhci_pci_driver);
 }
 
-void __exit xhci_unregister_pci(void)
+void xhci_unregister_pci(void)
 {
         pci_unregister_driver(&xhci_pci_driver);
 }
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 6bd9d53062eb..3d9422f16a20 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2417,7 +2417,7 @@ hw_died:
                 u32 irq_pending;
                 /* Acknowledge the PCI interrupt */
                 irq_pending = xhci_readl(xhci, &xhci->ir_set->irq_pending);
-                irq_pending |= 0x3;
+                irq_pending |= IMAN_IP;
                 xhci_writel(xhci, irq_pending, &xhci->ir_set->irq_pending);
         }
 
@@ -2734,7 +2734,7 @@ int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                                 urb->dev->speed == USB_SPEED_FULL)
                         urb->interval /= 8;
         }
-        return xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb, slot_id, ep_index);
+        return xhci_queue_bulk_tx(xhci, mem_flags, urb, slot_id, ep_index);
 }
 
 /*
@@ -3514,7 +3514,7 @@ int xhci_queue_isoc_tx_prepare(struct xhci_hcd *xhci, gfp_t mem_flags,
         }
         ep_ring->num_trbs_free_temp = ep_ring->num_trbs_free;
 
-        return xhci_queue_isoc_tx(xhci, GFP_ATOMIC, urb, slot_id, ep_index);
+        return xhci_queue_isoc_tx(xhci, mem_flags, urb, slot_id, ep_index);
 }
 
 /****           Command Ring Operations         ****/
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index e1963d4a430f..36641a7f2371 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -106,6 +106,9 @@ int xhci_halt(struct xhci_hcd *xhci)
                         STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC);
         if (!ret)
                 xhci->xhc_state |= XHCI_STATE_HALTED;
+        else
+                xhci_warn(xhci, "Host not halted after %u microseconds.\n",
+                                XHCI_MAX_HALT_USEC);
         return ret;
 }
 
@@ -664,11 +667,11 @@ static void xhci_save_registers(struct xhci_hcd *xhci)
         xhci->s3.dev_nt = xhci_readl(xhci, &xhci->op_regs->dev_notification);
         xhci->s3.dcbaa_ptr = xhci_read_64(xhci, &xhci->op_regs->dcbaa_ptr);
         xhci->s3.config_reg = xhci_readl(xhci, &xhci->op_regs->config_reg);
-        xhci->s3.irq_pending = xhci_readl(xhci, &xhci->ir_set->irq_pending);
-        xhci->s3.irq_control = xhci_readl(xhci, &xhci->ir_set->irq_control);
         xhci->s3.erst_size = xhci_readl(xhci, &xhci->ir_set->erst_size);
         xhci->s3.erst_base = xhci_read_64(xhci, &xhci->ir_set->erst_base);
         xhci->s3.erst_dequeue = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
+        xhci->s3.irq_pending = xhci_readl(xhci, &xhci->ir_set->irq_pending);
+        xhci->s3.irq_control = xhci_readl(xhci, &xhci->ir_set->irq_control);
 }
 
 static void xhci_restore_registers(struct xhci_hcd *xhci)
@@ -677,10 +680,11 @@ static void xhci_restore_registers(struct xhci_hcd *xhci)
         xhci_writel(xhci, xhci->s3.dev_nt, &xhci->op_regs->dev_notification);
         xhci_write_64(xhci, xhci->s3.dcbaa_ptr, &xhci->op_regs->dcbaa_ptr);
         xhci_writel(xhci, xhci->s3.config_reg, &xhci->op_regs->config_reg);
-        xhci_writel(xhci, xhci->s3.irq_pending, &xhci->ir_set->irq_pending);
-        xhci_writel(xhci, xhci->s3.irq_control, &xhci->ir_set->irq_control);
         xhci_writel(xhci, xhci->s3.erst_size, &xhci->ir_set->erst_size);
         xhci_write_64(xhci, xhci->s3.erst_base, &xhci->ir_set->erst_base);
+        xhci_write_64(xhci, xhci->s3.erst_dequeue, &xhci->ir_set->erst_dequeue);
+        xhci_writel(xhci, xhci->s3.irq_pending, &xhci->ir_set->irq_pending);
+        xhci_writel(xhci, xhci->s3.irq_control, &xhci->ir_set->irq_control);
 }
 
 static void xhci_set_cmd_ring_deq(struct xhci_hcd *xhci)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 91074fdab3eb..3d69c4b2b542 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -205,6 +205,10 @@ struct xhci_op_regs {
 #define CMD_PM_INDEX    (1 << 11)
 /* bits 12:31 are reserved (and should be preserved on writes). */
 
+/* IMAN - Interrupt Management Register */
+#define IMAN_IP         (1 << 1)
+#define IMAN_IE         (1 << 0)
+
 /* USBSTS - USB status - status bitmasks */
 /* HC not running - set to 1 when run/stop bit is cleared. */
 #define STS_HALT        XHCI_STS_HALT
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 959145baf3cf..9dcb68f04f03 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -423,7 +423,7 @@ alloc_sglist(int nents, int max, int vary)
         unsigned                i;
         unsigned                size = max;
 
-        sg = kmalloc(nents * sizeof *sg, GFP_KERNEL);
+        sg = kmalloc_array(nents, sizeof *sg, GFP_KERNEL);
         if (!sg)
                 return NULL;
         sg_init_table(sg, nents);
@@ -904,6 +904,9 @@ test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
         struct ctrl_ctx         context;
         int                     i;
 
+        if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
+                return -EOPNOTSUPP;
+
         spin_lock_init(&context.lock);
         context.dev = dev;
         init_completion(&context.complete);
@@ -1981,8 +1984,6 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
 
         /* queued control messaging */
         case 10:
-                if (param->sglen == 0)
-                        break;
                 retval = 0;
                 dev_info(&intf->dev,
                                 "TEST 10:  queue %d control calls, %d times\n",
@@ -2276,6 +2277,8 @@ usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
                         if (status < 0) {
                                 WARNING(dev, "couldn't get endpoints, %d\n",
                                                 status);
+                                kfree(dev->buf);
+                                kfree(dev);
                                 return status;
                         }
                         /* may find bulk or ISO pipes */
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 897edda42270..70201462e19c 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -99,9 +99,7 @@ static void yurex_delete(struct kref *kref)
         usb_put_dev(dev->udev);
         if (dev->cntl_urb) {
                 usb_kill_urb(dev->cntl_urb);
-                if (dev->cntl_req)
-                        usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
-                                dev->cntl_req, dev->cntl_urb->setup_dma);
+                kfree(dev->cntl_req);
                 if (dev->cntl_buffer)
                         usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
                                 dev->cntl_buffer, dev->cntl_urb->transfer_dma);
@@ -234,9 +232,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
         }
 
         /* allocate buffer for control req */
-        dev->cntl_req = usb_alloc_coherent(dev->udev, YUREX_BUF_SIZE,
-                                           GFP_KERNEL,
-                                           &dev->cntl_urb->setup_dma);
+        dev->cntl_req = kmalloc(YUREX_BUF_SIZE, GFP_KERNEL);
         if (!dev->cntl_req) {
                 err("Could not allocate cntl_req");
                 goto error;
@@ -286,7 +282,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
                          usb_rcvintpipe(dev->udev, dev->int_in_endpointAddr),
                          dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt,
                          dev, 1);
-        dev->cntl_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+        dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
         if (usb_submit_urb(dev->urb, GFP_KERNEL)) {
                 retval = -EIO;
                 err("Could not submitting URB");
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 97ab975fa442..768b4b55c816 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -386,7 +386,7 @@ static int davinci_musb_init(struct musb *musb)
         usb_nop_xceiv_register();
         musb->xceiv = usb_get_transceiver();
         if (!musb->xceiv)
-                return -ENODEV;
+                goto unregister;
 
         musb->mregs += DAVINCI_BASE_OFFSET;
 
@@ -444,6 +444,7 @@ static int davinci_musb_init(struct musb *musb)
 
 fail:
         usb_put_transceiver(musb->xceiv);
+unregister:
         usb_nop_xceiv_unregister();
         return -ENODEV;
 }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 0f8b82918a40..66aaccf04490 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -137,6 +137,9 @@ static int musb_ulpi_read(struct usb_phy *phy, u32 offset)
         int     i = 0;
         u8      r;
         u8      power;
+        int     ret;
+
+        pm_runtime_get_sync(phy->io_dev);
 
         /* Make sure the transceiver is not in low power mode */
         power = musb_readb(addr, MUSB_POWER);
@@ -154,15 +157,22 @@ static int musb_ulpi_read(struct usb_phy *phy, u32 offset)
         while (!(musb_readb(addr, MUSB_ULPI_REG_CONTROL)
                                 & MUSB_ULPI_REG_CMPLT)) {
                 i++;
-                if (i == 10000)
-                        return -ETIMEDOUT;
+                if (i == 10000) {
+                        ret = -ETIMEDOUT;
+                        goto out;
+                }
 
         }
         r = musb_readb(addr, MUSB_ULPI_REG_CONTROL);
         r &= ~MUSB_ULPI_REG_CMPLT;
         musb_writeb(addr, MUSB_ULPI_REG_CONTROL, r);
 
-        return musb_readb(addr, MUSB_ULPI_REG_DATA);
+        ret = musb_readb(addr, MUSB_ULPI_REG_DATA);
+
+out:
+        pm_runtime_put(phy->io_dev);
+
+        return ret;
 }
 
 static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data)
@@ -171,6 +181,9 @@ static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data)
         int     i = 0;
         u8      r = 0;
         u8      power;
+        int     ret = 0;
+
+        pm_runtime_get_sync(phy->io_dev);
 
         /* Make sure the transceiver is not in low power mode */
         power = musb_readb(addr, MUSB_POWER);
@@ -184,15 +197,20 @@ static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data)
         while (!(musb_readb(addr, MUSB_ULPI_REG_CONTROL)
                                 & MUSB_ULPI_REG_CMPLT)) {
                 i++;
-                if (i == 10000)
-                        return -ETIMEDOUT;
+                if (i == 10000) {
+                        ret = -ETIMEDOUT;
+                        goto out;
+                }
         }
 
         r = musb_readb(addr, MUSB_ULPI_REG_CONTROL);
         r &= ~MUSB_ULPI_REG_CMPLT;
         musb_writeb(addr, MUSB_ULPI_REG_CONTROL, r);
 
-        return 0;
+out:
+        pm_runtime_put(phy->io_dev);
+
+        return ret;
 }
 #else
 #define musb_ulpi_read          NULL
@@ -1904,14 +1922,17 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
 
         if (!musb->isr) {
                 status = -ENODEV;
-                goto fail3;
+                goto fail2;
         }
 
         if (!musb->xceiv->io_ops) {
+                musb->xceiv->io_dev = musb->controller;
                 musb->xceiv->io_priv = musb->mregs;
                 musb->xceiv->io_ops = &musb_ulpi_access;
         }
 
+        pm_runtime_get_sync(musb->controller);
+
 #ifndef CONFIG_MUSB_PIO_ONLY
         if (use_dma && dev->dma_mask) {
                 struct dma_controller   *c;
@@ -2023,6 +2044,8 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
                 goto fail5;
 #endif
 
+        pm_runtime_put(musb->controller);
+
         dev_info(dev, "USB %s mode controller at %p using %s, IRQ %d\n",
                         ({char *s;
                          switch (musb->board_mode) {
@@ -2047,6 +2070,9 @@ fail4:
                 musb_gadget_cleanup(musb);
 
 fail3:
+        pm_runtime_put_sync(musb->controller);
+
+fail2:
         if (musb->irq_wake)
                 device_init_wakeup(dev, 0);
         musb_platform_exit(musb);
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 93de517a32a0..f4a40f001c88 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -449,7 +449,7 @@ struct musb {
          * We added this flag to forcefully disable double
          * buffering until we get it working.
          */
-        unsigned                double_buffer_not_ok:1 __deprecated;
+        unsigned                double_buffer_not_ok:1;
 
         struct musb_hdrc_config *config;
 
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 79cb0af779fa..ef8d744800ac 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2098,7 +2098,7 @@ static int musb_cleanup_urb(struct urb *urb, struct musb_qh *qh)
         }
 
         /* turn off DMA requests, discard state, stop polling ... */
-        if (is_in) {
+        if (ep->epnum && is_in) {
                 /* giveback saves bulk toggle */
                 csr = musb_h_flush_rxfifo(ep, 0);
 
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 2ae0bb309994..c7785e81254c 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -282,7 +282,8 @@ static void musb_otg_notifier_work(struct work_struct *data_notifier_work)
 
 static int omap2430_musb_init(struct musb *musb)
 {
-        u32 l, status = 0;
+        u32 l;
+        int status = 0;
         struct device *dev = musb->controller;
         struct musb_hdrc_platform_data *plat = dev->platform_data;
         struct omap_musb_board_data *data = plat->board_data;
@@ -301,7 +302,7 @@ static int omap2430_musb_init(struct musb *musb)
 
         status = pm_runtime_get_sync(dev);
         if (status < 0) {
-                dev_err(dev, "pm_runtime_get_sync FAILED");
+                dev_err(dev, "pm_runtime_get_sync FAILED %d\n", status);
                 goto err1;
         }
 
@@ -333,6 +334,7 @@ static int omap2430_musb_init(struct musb *musb)
 
         setup_timer(&musb_idle_timer, musb_do_idle, (unsigned long) musb);
 
+        pm_runtime_put_noidle(musb->controller);
         return 0;
 
 err1:
@@ -452,14 +454,14 @@ static int __devinit omap2430_probe(struct platform_device *pdev)
                 goto err2;
         }
 
+        pm_runtime_enable(&pdev->dev);
+
         ret = platform_device_add(musb);
         if (ret) {
                 dev_err(&pdev->dev, "failed to register musb device\n");
                 goto err2;
         }
 
-        pm_runtime_enable(&pdev->dev);
-
         return 0;
 
 err2:
@@ -478,7 +480,6 @@ static int __devexit omap2430_remove(struct platform_device *pdev)
 
         platform_device_del(glue->musb);
         platform_device_put(glue->musb);
-        pm_runtime_put(&pdev->dev);
         kfree(glue);
 
         return 0;
@@ -491,11 +492,13 @@ static int omap2430_runtime_suspend(struct device *dev)
         struct omap2430_glue            *glue = dev_get_drvdata(dev);
         struct musb                     *musb = glue_to_musb(glue);
 
-        musb->context.otg_interfsel = musb_readl(musb->mregs,
-                                                OTG_INTERFSEL);
+        if (musb) {
+                musb->context.otg_interfsel = musb_readl(musb->mregs,
+                                OTG_INTERFSEL);
 
-        omap2430_low_level_exit(musb);
-        usb_phy_set_suspend(musb->xceiv, 1);
+                omap2430_low_level_exit(musb);
+                usb_phy_set_suspend(musb->xceiv, 1);
+        }
 
         return 0;
 }
@@ -505,11 +508,13 @@ static int omap2430_runtime_resume(struct device *dev)
         struct omap2430_glue            *glue = dev_get_drvdata(dev);
         struct musb                     *musb = glue_to_musb(glue);
 
-        omap2430_low_level_init(musb);
-        musb_writel(musb->mregs, OTG_INTERFSEL,
-                                        musb->context.otg_interfsel);
+        if (musb) {
+                omap2430_low_level_init(musb);
+                musb_writel(musb->mregs, OTG_INTERFSEL,
+                                musb->context.otg_interfsel);
 
-        usb_phy_set_suspend(musb->xceiv, 0);
+                usb_phy_set_suspend(musb->xceiv, 0);
+        }
 
         return 0;
 }
diff --git a/drivers/usb/otg/gpio_vbus.c b/drivers/usb/otg/gpio_vbus.c
index 3ece43a2e4c1..a0a2178974fe 100644
--- a/drivers/usb/otg/gpio_vbus.c
+++ b/drivers/usb/otg/gpio_vbus.c
@@ -96,7 +96,7 @@ static void gpio_vbus_work(struct work_struct *work)
         struct gpio_vbus_data *gpio_vbus =
                 container_of(work, struct gpio_vbus_data, work);
         struct gpio_vbus_mach_info *pdata = gpio_vbus->dev->platform_data;
-        int gpio;
+        int gpio, status;
 
         if (!gpio_vbus->phy.otg->gadget)
                 return;
@@ -108,7 +108,9 @@ static void gpio_vbus_work(struct work_struct *work)
          */
         gpio = pdata->gpio_pullup;
         if (is_vbus_powered(pdata)) {
+                status = USB_EVENT_VBUS;
                 gpio_vbus->phy.state = OTG_STATE_B_PERIPHERAL;
+                gpio_vbus->phy.last_event = status;
                 usb_gadget_vbus_connect(gpio_vbus->phy.otg->gadget);
 
                 /* drawing a "unit load" is *always* OK, except for OTG */
@@ -117,6 +119,9 @@ static void gpio_vbus_work(struct work_struct *work)
                 /* optionally enable D+ pullup */
                 if (gpio_is_valid(gpio))
                         gpio_set_value(gpio, !pdata->gpio_pullup_inverted);
+
+                atomic_notifier_call_chain(&gpio_vbus->phy.notifier,
+                                           status, gpio_vbus->phy.otg->gadget);
         } else {
                 /* optionally disable D+ pullup */
                 if (gpio_is_valid(gpio))
@@ -125,7 +130,12 @@ static void gpio_vbus_work(struct work_struct *work)
                 set_vbus_draw(gpio_vbus, 0);
 
                 usb_gadget_vbus_disconnect(gpio_vbus->phy.otg->gadget);
+                status = USB_EVENT_NONE;
                 gpio_vbus->phy.state = OTG_STATE_B_IDLE;
+                gpio_vbus->phy.last_event = status;
+
+                atomic_notifier_call_chain(&gpio_vbus->phy.notifier,
+                                           status, gpio_vbus->phy.otg->gadget);
         }
 }
 
@@ -287,6 +297,9 @@ static int __init gpio_vbus_probe(struct platform_device *pdev)
                         irq, err);
                 goto err_irq;
         }
+
+        ATOMIC_INIT_NOTIFIER_HEAD(&gpio_vbus->phy.notifier);
+
         INIT_WORK(&gpio_vbus->work, gpio_vbus_work);
 
         gpio_vbus->vbus_draw = regulator_get(&pdev->dev, "vbus_draw");
diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
index 7f547dc3a590..ed8adb052ca7 100644
--- a/drivers/usb/serial/bus.c
+++ b/drivers/usb/serial/bus.c
@@ -60,8 +60,6 @@ static int usb_serial_device_probe(struct device *dev)
                 retval = -ENODEV;
                 goto exit;
         }
-        if (port->dev_state != PORT_REGISTERING)
-                goto exit;
 
         driver = port->serial->type;
         if (driver->port_probe) {
@@ -98,9 +96,6 @@ static int usb_serial_device_remove(struct device *dev)
         if (!port)
                 return -ENODEV;
 
-        if (port->dev_state != PORT_UNREGISTERING)
-                return retval;
-
         device_remove_file(&port->dev, &dev_attr_port_number);
 
         driver = port->serial->type;
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 0310e2df59f5..ec30f95ef399 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -287,7 +287,8 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
         /* Issue the request, attempting to read 'size' bytes */
         result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                                 request, REQTYPE_DEVICE_TO_HOST, 0x0000,
-                                port_priv->bInterfaceNumber, buf, size, 300);
+                                port_priv->bInterfaceNumber, buf, size,
+                                USB_CTRL_GET_TIMEOUT);
 
         /* Convert data into an array of integers */
         for (i = 0; i < length; i++)
@@ -340,12 +341,14 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
                 result = usb_control_msg(serial->dev,
                                 usb_sndctrlpipe(serial->dev, 0),
                                 request, REQTYPE_HOST_TO_DEVICE, 0x0000,
-                                port_priv->bInterfaceNumber, buf, size, 300);
+                                port_priv->bInterfaceNumber, buf, size,
+                                USB_CTRL_SET_TIMEOUT);
         } else {
                 result = usb_control_msg(serial->dev,
                                 usb_sndctrlpipe(serial->dev, 0),
                                 request, REQTYPE_HOST_TO_DEVICE, data[0],
-                                port_priv->bInterfaceNumber, NULL, 0, 300);
+                                port_priv->bInterfaceNumber, NULL, 0,
+                                USB_CTRL_SET_TIMEOUT);
         }
 
         kfree(buf);
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index ff8605b4b4be..02e7f2d32d52 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -75,7 +75,8 @@ struct ftdi_private {
         unsigned long last_dtr_rts;     /* saved modem control outputs */
         struct async_icount     icount;
         wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
-        char prev_status, diff_status;        /* Used for TIOCMIWAIT */
+        char prev_status;        /* Used for TIOCMIWAIT */
+        bool dev_gone;        /* Used to abort TIOCMIWAIT */
         char transmit_empty;    /* If transmitter is empty or not */
         struct usb_serial_port *port;
         __u16 interface;        /* FT2232C, FT2232H or FT4232H port interface
@@ -1681,6 +1682,7 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
         init_waitqueue_head(&priv->delta_msr_wait);
 
         priv->flags = ASYNC_LOW_LATENCY;
+        priv->dev_gone = false;
 
         if (quirk && quirk->port_probe)
                 quirk->port_probe(priv);
@@ -1839,6 +1841,9 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
 
         dbg("%s", __func__);
 
+        priv->dev_gone = true;
+        wake_up_interruptible_all(&priv->delta_msr_wait);
+
         remove_sysfs_attrs(port);
 
         kref_put(&priv->kref, ftdi_sio_priv_release);
@@ -1982,17 +1987,19 @@ static int ftdi_process_packet(struct tty_struct *tty,
            N.B. packet may be processed more than once, but differences
            are only processed once.  */
         status = packet[0] & FTDI_STATUS_B0_MASK;
-        if (status & FTDI_RS0_CTS)
-                priv->icount.cts++;
-        if (status & FTDI_RS0_DSR)
-                priv->icount.dsr++;
-        if (status & FTDI_RS0_RI)
-                priv->icount.rng++;
-        if (status & FTDI_RS0_RLSD)
-                priv->icount.dcd++;
         if (status != priv->prev_status) {
-                priv->diff_status |= status ^ priv->prev_status;
-                wake_up_interruptible(&priv->delta_msr_wait);
+                char diff_status = status ^ priv->prev_status;
+
+                if (diff_status & FTDI_RS0_CTS)
+                        priv->icount.cts++;
+                if (diff_status & FTDI_RS0_DSR)
+                        priv->icount.dsr++;
+                if (diff_status & FTDI_RS0_RI)
+                        priv->icount.rng++;
+                if (diff_status & FTDI_RS0_RLSD)
+                        priv->icount.dcd++;
+
+                wake_up_interruptible_all(&priv->delta_msr_wait);
                 priv->prev_status = status;
         }
 
@@ -2395,15 +2402,12 @@ static int ftdi_ioctl(struct tty_struct *tty,
          */
         case TIOCMIWAIT:
                 cprev = priv->icount;
-                while (1) {
+                while (!priv->dev_gone) {
                         interruptible_sleep_on(&priv->delta_msr_wait);
                         /* see if a signal did it */
                         if (signal_pending(current))
                                 return -ERESTARTSYS;
                         cnow = priv->icount;
-                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
-                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
-                                return -EIO; /* no change => error */
                         if (((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
                             ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
                             ((arg & TIOCM_CD)  && (cnow.dcd != cprev.dcd)) ||
@@ -2412,7 +2416,7 @@ static int ftdi_ioctl(struct tty_struct *tty,
                         }
                         cprev = cnow;
                 }
-                /* not reached */
+                return -EIO;
                 break;
         case TIOCSERGETLSR:
                 return get_lsr_info(port, (struct serial_struct __user *)arg);
diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
index 6e1622f2a297..08d16e8c002d 100644
--- a/drivers/usb/serial/metro-usb.c
+++ b/drivers/usb/serial/metro-usb.c
@@ -27,8 +27,8 @@
 
 /* Product information. */
 #define FOCUS_VENDOR_ID                 0x0C2E
-#define FOCUS_PRODUCT_ID                0x0720
-#define FOCUS_PRODUCT_ID_UNI            0x0710
+#define FOCUS_PRODUCT_ID_BI             0x0720
+#define FOCUS_PRODUCT_ID_UNI            0x0700
 
 #define METROUSB_SET_REQUEST_TYPE       0x40
 #define METROUSB_SET_MODEM_CTRL_REQUEST 10
@@ -47,7 +47,7 @@ struct metrousb_private {
 
 /* Device table list. */
 static struct usb_device_id id_table[] = {
-        { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID) },
+        { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_BI) },
         { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_UNI) },
         { }, /* Terminating entry. */
 };
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 836cfa9a515f..f4465ccddc35 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -708,6 +708,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_FULLSPEED) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_HIGHSPEED) },
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED3) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED4) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED5) },
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index ff4a174fa5de..a1a9062954c4 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -420,7 +420,7 @@ static void pl2303_set_termios(struct tty_struct *tty,
         control = priv->line_control;
         if ((cflag & CBAUD) == B0)
                 priv->line_control &= ~(CONTROL_DTR | CONTROL_RTS);
-        else
+        else if ((old_termios->c_cflag & CBAUD) == B0)
                 priv->line_control |= (CONTROL_DTR | CONTROL_RTS);
         if (control != priv->line_control) {
                 control = priv->line_control;
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index f14465a83dd1..8c8bf806f6fa 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -221,7 +221,7 @@ static const struct sierra_iface_info typeB_interface_list = {
 };
 
 /* 'blacklist' of interfaces not served by this driver */
-static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11 };
+static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11, 19, 20 };
 static const struct sierra_iface_info direct_ip_interface_blacklist = {
         .infolen = ARRAY_SIZE(direct_ip_non_serial_ifaces),
         .ifaceinfo = direct_ip_non_serial_ifaces,
@@ -298,6 +298,9 @@ static const struct usb_device_id id_table[] = {
         /* Sierra Wireless HSPA Non-Composite Device */
         { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6892, 0xFF, 0xFF, 0xFF)},
         { USB_DEVICE(0x1199, 0x6893) }, /* Sierra Wireless Device */
+        { USB_DEVICE(0x1199, 0x68A2),   /* Sierra Wireless MC77xx in QMI mode */
+          .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+        },
         { USB_DEVICE(0x1199, 0x68A3),   /* Sierra Wireless Direct IP modems */
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
         },
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 69230f01056a..97355a15bbea 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1059,6 +1059,12 @@ int usb_serial_probe(struct usb_interface *interface,
                 serial->attached = 1;
         }
 
+        /* Avoid race with tty_open and serial_install by setting the
+         * disconnected flag and not clearing it until all ports have been
+         * registered.
+         */
+        serial->disconnected = 1;
+
         if (get_free_serial(serial, num_ports, &minor) == NULL) {
                 dev_err(&interface->dev, "No more free serial devices\n");
                 goto probe_error;
@@ -1070,19 +1076,16 @@ int usb_serial_probe(struct usb_interface *interface,
                 port = serial->port[i];
                 dev_set_name(&port->dev, "ttyUSB%d", port->number);
                 dbg ("%s - registering %s", __func__, dev_name(&port->dev));
-                port->dev_state = PORT_REGISTERING;
                 device_enable_async_suspend(&port->dev);
 
                 retval = device_add(&port->dev);
-                if (retval) {
+                if (retval)
                         dev_err(&port->dev, "Error registering port device, "
                                 "continuing\n");
-                        port->dev_state = PORT_UNREGISTERED;
-                } else {
-                        port->dev_state = PORT_REGISTERED;
-                }
         }
 
+        serial->disconnected = 0;
+
         usb_serial_console_init(debug, minor);
 
 exit:
@@ -1124,22 +1127,8 @@ void usb_serial_disconnect(struct usb_interface *interface)
                         }
                         kill_traffic(port);
                         cancel_work_sync(&port->work);
-                        if (port->dev_state == PORT_REGISTERED) {
-
-                                /* Make sure the port is bound so that the
-                                 * driver's port_remove method is called.
-                                 */
-                                if (!port->dev.driver) {
-                                        int rc;
-
-                                        port->dev.driver =
-                                                        &serial->type->driver;
-                                        rc = device_bind_driver(&port->dev);
-                                }
-                                port->dev_state = PORT_UNREGISTERING;
+                        if (device_is_registered(&port->dev))
                                 device_del(&port->dev);
-                                port->dev_state = PORT_UNREGISTERED;
-                        }
                 }
         }
         serial->type->disconnect(serial);
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index c18538e4a6db..2653e73db623 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -132,6 +132,35 @@ static struct us_unusual_dev for_dynamic_ids =
 #undef COMPLIANT_DEV
 #undef USUAL_DEV
 
+#ifdef CONFIG_LOCKDEP
+
+static struct lock_class_key us_interface_key[USB_MAXINTERFACES];
+
+static void us_set_lock_class(struct mutex *mutex,
+                struct usb_interface *intf)
+{
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct usb_host_config *config = udev->actconfig;
+        int i;
+
+        for (i = 0; i < config->desc.bNumInterfaces; i++) {
+                if (config->interface[i] == intf)
+                        break;
+        }
+
+        BUG_ON(i == config->desc.bNumInterfaces);
+
+        lockdep_set_class(mutex, &us_interface_key[i]);
+}
+
+#else
+
+static void us_set_lock_class(struct mutex *mutex,
+                struct usb_interface *intf)
+{
+}
+
+#endif
 
 #ifdef CONFIG_PM        /* Minimal support for suspend and resume */
 
@@ -895,6 +924,7 @@ int usb_stor_probe1(struct us_data **pus,
         *pus = us = host_to_us(host);
         memset(us, 0, sizeof(struct us_data));
         mutex_init(&(us->dev_mutex));
+        us_set_lock_class(&us->dev_mutex, intf);
         init_completion(&us->cmnd_ready);
         init_completion(&(us->notify));
         init_waitqueue_head(&us->delay_wait);
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 66797e9c5010..810c90ae2c55 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -645,7 +645,8 @@ void hwarc_neep_cb(struct urb *urb)
                 dev_err(dev, "NEEP: URB error %d\n", urb->status);
         }
         result = usb_submit_urb(urb, GFP_ATOMIC);
-        if (result < 0) {
+        if (result < 0 && result != -ENODEV && result != -EPERM) {
+                /* ignoring unrecoverable errors */
                 dev_err(dev, "NEEP: Can't resubmit URB (%d) resetting device\n",
                         result);
                 goto error;
diff --git a/drivers/uwb/neh.c b/drivers/uwb/neh.c
index a269937be1b8..8cb71bb333c2 100644
--- a/drivers/uwb/neh.c
+++ b/drivers/uwb/neh.c
@@ -107,6 +107,7 @@ struct uwb_rc_neh {
         u8 evt_type;
         __le16 evt;
         u8 context;
+        u8 completed;
         uwb_rc_cmd_cb_f cb;
         void *arg;
 
@@ -409,6 +410,7 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
         struct device *dev = &rc->uwb_dev.dev;
         struct uwb_rc_neh *neh;
         struct uwb_rceb *notif;
+        unsigned long flags;
 
         if (rceb->bEventContext == 0) {
                 notif = kmalloc(size, GFP_ATOMIC);
@@ -422,7 +424,11 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
         } else {
                 neh = uwb_rc_neh_lookup(rc, rceb);
                 if (neh) {
-                        del_timer_sync(&neh->timer);
+                        spin_lock_irqsave(&rc->neh_lock, flags);
+                        /* to guard against a timeout */
+                        neh->completed = 1;
+                        del_timer(&neh->timer);
+                        spin_unlock_irqrestore(&rc->neh_lock, flags);
                         uwb_rc_neh_cb(neh, rceb, size);
                 } else
                         dev_warn(dev, "event 0x%02x/%04x/%02x (%zu bytes): nobody cared\n",
@@ -568,6 +574,10 @@ static void uwb_rc_neh_timer(unsigned long arg)
         unsigned long flags;
 
         spin_lock_irqsave(&rc->neh_lock, flags);
+        if (neh->completed) {
+                spin_unlock_irqrestore(&rc->neh_lock, flags);
+                return;
+        }
         if (neh->context)
                 __uwb_rc_neh_rm(rc, neh);
         else
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index f0da2c32fbde..1f21d2a1e528 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -238,7 +238,7 @@ static void handle_tx(struct vhost_net *net)
 
                                 vq->heads[vq->upend_idx].len = len;
                                 ubuf->callback = vhost_zerocopy_callback;
-                                ubuf->arg = vq->ubufs;
+                                ubuf->ctx = vq->ubufs;
                                 ubuf->desc = vq->upend_idx;
                                 msg.msg_control = ubuf;
                                 msg.msg_controllen = sizeof(ubuf);
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index fc9a1d75281f..3de00d9fae2e 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -155,7 +155,7 @@ static int vhost_test_release(struct inode *inode, struct file *f)
 
         vhost_test_stop(n, &private);
         vhost_test_flush(n);
-        vhost_dev_cleanup(&n->dev);
+        vhost_dev_cleanup(&n->dev, false);
         /* We do an extra flush before freeing memory,
          * since jobs can re-queue themselves. */
         vhost_test_flush(n);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 947f00d8e091..51e4c1eeec4f 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1598,10 +1598,9 @@ void vhost_ubuf_put_and_wait(struct vhost_ubuf_ref *ubufs)
         kfree(ubufs);
 }
 
-void vhost_zerocopy_callback(void *arg)
+void vhost_zerocopy_callback(struct ubuf_info *ubuf)
 {
-        struct ubuf_info *ubuf = arg;
-        struct vhost_ubuf_ref *ubufs = ubuf->arg;
+        struct vhost_ubuf_ref *ubufs = ubuf->ctx;
         struct vhost_virtqueue *vq = ubufs->vq;
 
         /* set len = 1 to mark this desc buffers done DMA */
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 8dcf4cca6bf2..8de1fd5b8efb 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -188,7 +188,7 @@ bool vhost_enable_notify(struct vhost_dev *, struct vhost_virtqueue *);
 
 int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
                     unsigned int log_num, u64 len);
-void vhost_zerocopy_callback(void *arg);
+void vhost_zerocopy_callback(struct ubuf_info *);
 int vhost_zerocopy_signal_used(struct vhost_virtqueue *vq);
 
 #define vq_err(vq, fmt, ...) do {                                  \
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index befcbd8ef019..ffbce4525468 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -499,7 +499,8 @@ static int __devinit au1100fb_drv_probe(struct platform_device *dev)
         au1100fb_fix.mmio_start = regs_res->start;
         au1100fb_fix.mmio_len = resource_size(regs_res);
 
-        if (!devm_request_mem_region(au1100fb_fix.mmio_start,
+        if (!devm_request_mem_region(&dev->dev,
+                                     au1100fb_fix.mmio_start,
                                      au1100fb_fix.mmio_len,
                                      DRIVER_NAME)) {
                 print_err("fail to lock memory region at 0x%08lx",
@@ -516,7 +517,7 @@ static int __devinit au1100fb_drv_probe(struct platform_device *dev)
         fbdev->fb_len = fbdev->panel->xres * fbdev->panel->yres *
                         (fbdev->panel->bpp >> 3) * AU1100FB_NBR_VIDEO_BUFFERS;
 
-        fbdev->fb_mem = dmam_alloc_coherent(&dev->dev, &dev->dev,
+        fbdev->fb_mem = dmam_alloc_coherent(&dev->dev,
                                             PAGE_ALIGN(fbdev->fb_len),
                                             &fbdev->fb_phys, GFP_KERNEL);
         if (!fbdev->fb_mem) {
diff --git a/drivers/video/au1200fb.c b/drivers/video/au1200fb.c
index 3e9a773db09f..7ca79f02056e 100644
--- a/drivers/video/au1200fb.c
+++ b/drivers/video/au1200fb.c
@@ -1724,7 +1724,7 @@ static int __devinit au1200fb_drv_probe(struct platform_device *dev)
                 /* Allocate the framebuffer to the maximum screen size */
                 fbdev->fb_len = (win->w[plane].xres * win->w[plane].yres * bpp) / 8;
 
-                fbdev->fb_mem = dmam_alloc_noncoherent(&dev->dev, &dev->dev,
+                fbdev->fb_mem = dmam_alloc_noncoherent(&dev->dev,
                                 PAGE_ALIGN(fbdev->fb_len),
                                 &fbdev->fb_phys, GFP_KERNEL);
                 if (!fbdev->fb_mem) {
diff --git a/drivers/video/bfin-lq035q1-fb.c b/drivers/video/bfin-lq035q1-fb.c
index 86922ac84412..353c02fe8a95 100644
--- a/drivers/video/bfin-lq035q1-fb.c
+++ b/drivers/video/bfin-lq035q1-fb.c
@@ -13,6 +13,7 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/fb.h>
+#include <linux/gpio.h>
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/types.h>
diff --git a/drivers/video/kyro/STG4000Reg.h b/drivers/video/kyro/STG4000Reg.h
index 5d6269882589..50f4670e9252 100644
--- a/drivers/video/kyro/STG4000Reg.h
+++ b/drivers/video/kyro/STG4000Reg.h
@@ -73,210 +73,210 @@ typedef enum _OVRL_PIX_FORMAT {
 /* Register Table */
 typedef struct {
         /* 0h  */
-        volatile unsigned long Thread0Enable;   /* 0x0000 */
-        volatile unsigned long Thread1Enable;   /* 0x0004 */
-        volatile unsigned long Thread0Recover;  /* 0x0008 */
-        volatile unsigned long Thread1Recover;  /* 0x000C */
-        volatile unsigned long Thread0Step;     /* 0x0010 */
-        volatile unsigned long Thread1Step;     /* 0x0014 */
-        volatile unsigned long VideoInStatus;   /* 0x0018 */
-        volatile unsigned long Core2InSignStart;        /* 0x001C */
-        volatile unsigned long Core1ResetVector;        /* 0x0020 */
-        volatile unsigned long Core1ROMOffset;  /* 0x0024 */
-        volatile unsigned long Core1ArbiterPriority;    /* 0x0028 */
-        volatile unsigned long VideoInControl;  /* 0x002C */
-        volatile unsigned long VideoInReg0CtrlA;        /* 0x0030 */
-        volatile unsigned long VideoInReg0CtrlB;        /* 0x0034 */
-        volatile unsigned long VideoInReg1CtrlA;        /* 0x0038 */
-        volatile unsigned long VideoInReg1CtrlB;        /* 0x003C */
-        volatile unsigned long Thread0Kicker;   /* 0x0040 */
-        volatile unsigned long Core2InputSign;  /* 0x0044 */
-        volatile unsigned long Thread0ProgCtr;  /* 0x0048 */
-        volatile unsigned long Thread1ProgCtr;  /* 0x004C */
-        volatile unsigned long Thread1Kicker;   /* 0x0050 */
-        volatile unsigned long GPRegister1;     /* 0x0054 */
-        volatile unsigned long GPRegister2;     /* 0x0058 */
-        volatile unsigned long GPRegister3;     /* 0x005C */
-        volatile unsigned long GPRegister4;     /* 0x0060 */
-        volatile unsigned long SerialIntA;      /* 0x0064 */
-
-        volatile unsigned long Fill0[6];        /* GAP 0x0068 - 0x007C */
-
-        volatile unsigned long SoftwareReset;   /* 0x0080 */
-        volatile unsigned long SerialIntB;      /* 0x0084 */
-
-        volatile unsigned long Fill1[37];       /* GAP 0x0088 - 0x011C */
-
-        volatile unsigned long ROMELQV; /* 0x011C */
-        volatile unsigned long WLWH;    /* 0x0120 */
-        volatile unsigned long ROMELWL; /* 0x0124 */
-
-        volatile unsigned long dwFill_1;        /* GAP 0x0128 */
-
-        volatile unsigned long IntStatus;       /* 0x012C */
-        volatile unsigned long IntMask; /* 0x0130 */
-        volatile unsigned long IntClear;        /* 0x0134 */
-
-        volatile unsigned long Fill2[6];        /* GAP 0x0138 - 0x014C */
-
-        volatile unsigned long ROMGPIOA;        /* 0x0150 */
-        volatile unsigned long ROMGPIOB;        /* 0x0154 */
-        volatile unsigned long ROMGPIOC;        /* 0x0158 */
-        volatile unsigned long ROMGPIOD;        /* 0x015C */
-
-        volatile unsigned long Fill3[2];        /* GAP 0x0160 - 0x0168 */
-
-        volatile unsigned long AGPIntID;        /* 0x0168 */
-        volatile unsigned long AGPIntClassCode; /* 0x016C */
-        volatile unsigned long AGPIntBIST;      /* 0x0170 */
-        volatile unsigned long AGPIntSSID;      /* 0x0174 */
-        volatile unsigned long AGPIntPMCSR;     /* 0x0178 */
-        volatile unsigned long VGAFrameBufBase; /* 0x017C */
-        volatile unsigned long VGANotify;       /* 0x0180 */
-        volatile unsigned long DACPLLMode;      /* 0x0184 */
-        volatile unsigned long Core1VideoClockDiv;      /* 0x0188 */
-        volatile unsigned long AGPIntStat;      /* 0x018C */
+        volatile u32 Thread0Enable;     /* 0x0000 */
+        volatile u32 Thread1Enable;     /* 0x0004 */
+        volatile u32 Thread0Recover;    /* 0x0008 */
+        volatile u32 Thread1Recover;    /* 0x000C */
+        volatile u32 Thread0Step;       /* 0x0010 */
+        volatile u32 Thread1Step;       /* 0x0014 */
+        volatile u32 VideoInStatus;     /* 0x0018 */
+        volatile u32 Core2InSignStart;  /* 0x001C */
+        volatile u32 Core1ResetVector;  /* 0x0020 */
+        volatile u32 Core1ROMOffset;    /* 0x0024 */
+        volatile u32 Core1ArbiterPriority;      /* 0x0028 */
+        volatile u32 VideoInControl;    /* 0x002C */
+        volatile u32 VideoInReg0CtrlA;  /* 0x0030 */
+        volatile u32 VideoInReg0CtrlB;  /* 0x0034 */
+        volatile u32 VideoInReg1CtrlA;  /* 0x0038 */
+        volatile u32 VideoInReg1CtrlB;  /* 0x003C */
+        volatile u32 Thread0Kicker;     /* 0x0040 */
+        volatile u32 Core2InputSign;    /* 0x0044 */
+        volatile u32 Thread0ProgCtr;    /* 0x0048 */
+        volatile u32 Thread1ProgCtr;    /* 0x004C */
+        volatile u32 Thread1Kicker;     /* 0x0050 */
+        volatile u32 GPRegister1;       /* 0x0054 */
+        volatile u32 GPRegister2;       /* 0x0058 */
+        volatile u32 GPRegister3;       /* 0x005C */
+        volatile u32 GPRegister4;       /* 0x0060 */
+        volatile u32 SerialIntA;        /* 0x0064 */
+
+        volatile u32 Fill0[6];  /* GAP 0x0068 - 0x007C */
+
+        volatile u32 SoftwareReset;     /* 0x0080 */
+        volatile u32 SerialIntB;        /* 0x0084 */
+
+        volatile u32 Fill1[37]; /* GAP 0x0088 - 0x011C */
+
+        volatile u32 ROMELQV;   /* 0x011C */
+        volatile u32 WLWH;      /* 0x0120 */
+        volatile u32 ROMELWL;   /* 0x0124 */
+
+        volatile u32 dwFill_1;  /* GAP 0x0128 */
+
+        volatile u32 IntStatus; /* 0x012C */
+        volatile u32 IntMask;   /* 0x0130 */
+        volatile u32 IntClear;  /* 0x0134 */
+
+        volatile u32 Fill2[6];  /* GAP 0x0138 - 0x014C */
+
+        volatile u32 ROMGPIOA;  /* 0x0150 */
+        volatile u32 ROMGPIOB;  /* 0x0154 */
+        volatile u32 ROMGPIOC;  /* 0x0158 */
+        volatile u32 ROMGPIOD;  /* 0x015C */
+
+        volatile u32 Fill3[2];  /* GAP 0x0160 - 0x0168 */
+
+        volatile u32 AGPIntID;  /* 0x0168 */
+        volatile u32 AGPIntClassCode;   /* 0x016C */
+        volatile u32 AGPIntBIST;        /* 0x0170 */
+        volatile u32 AGPIntSSID;        /* 0x0174 */
+        volatile u32 AGPIntPMCSR;       /* 0x0178 */
+        volatile u32 VGAFrameBufBase;   /* 0x017C */
+        volatile u32 VGANotify; /* 0x0180 */
+        volatile u32 DACPLLMode;        /* 0x0184 */
+        volatile u32 Core1VideoClockDiv;        /* 0x0188 */
+        volatile u32 AGPIntStat;        /* 0x018C */
 
         /*
-           volatile unsigned long Fill4[0x0400/4 - 0x0190/4]; //GAP 0x0190 - 0x0400
-           volatile unsigned long Fill5[0x05FC/4 - 0x0400/4]; //GAP 0x0400 - 0x05FC Fog Table
-           volatile unsigned long Fill6[0x0604/4 - 0x0600/4]; //GAP 0x0600 - 0x0604
-           volatile unsigned long Fill7[0x0680/4 - 0x0608/4]; //GAP 0x0608 - 0x0680
-           volatile unsigned long Fill8[0x07FC/4 - 0x0684/4]; //GAP 0x0684 - 0x07FC
+           volatile u32 Fill4[0x0400/4 - 0x0190/4]; //GAP 0x0190 - 0x0400
+           volatile u32 Fill5[0x05FC/4 - 0x0400/4]; //GAP 0x0400 - 0x05FC Fog Table
+           volatile u32 Fill6[0x0604/4 - 0x0600/4]; //GAP 0x0600 - 0x0604
+           volatile u32 Fill7[0x0680/4 - 0x0608/4]; //GAP 0x0608 - 0x0680
+           volatile u32 Fill8[0x07FC/4 - 0x0684/4]; //GAP 0x0684 - 0x07FC
          */
-        volatile unsigned long Fill4[412];      /* 0x0190 - 0x07FC */
-
-        volatile unsigned long TACtrlStreamBase;        /* 0x0800 */
-        volatile unsigned long TAObjDataBase;   /* 0x0804 */
-        volatile unsigned long TAPtrDataBase;   /* 0x0808 */
-        volatile unsigned long TARegionDataBase;        /* 0x080C */
-        volatile unsigned long TATailPtrBase;   /* 0x0810 */
-        volatile unsigned long TAPtrRegionSize; /* 0x0814 */
-        volatile unsigned long TAConfiguration; /* 0x0818 */
-        volatile unsigned long TAObjDataStartAddr;      /* 0x081C */
-        volatile unsigned long TAObjDataEndAddr;        /* 0x0820 */
-        volatile unsigned long TAXScreenClip;   /* 0x0824 */
-        volatile unsigned long TAYScreenClip;   /* 0x0828 */
-        volatile unsigned long TARHWClamp;      /* 0x082C */
-        volatile unsigned long TARHWCompare;    /* 0x0830 */
-        volatile unsigned long TAStart; /* 0x0834 */
-        volatile unsigned long TAObjReStart;    /* 0x0838 */
-        volatile unsigned long TAPtrReStart;    /* 0x083C */
-        volatile unsigned long TAStatus1;       /* 0x0840 */
-        volatile unsigned long TAStatus2;       /* 0x0844 */
-        volatile unsigned long TAIntStatus;     /* 0x0848 */
-        volatile unsigned long TAIntMask;       /* 0x084C */
-
-        volatile unsigned long Fill5[235];      /* GAP 0x0850 - 0x0BF8 */
-
-        volatile unsigned long TextureAddrThresh;       /* 0x0BFC */
-        volatile unsigned long Core1Translation;        /* 0x0C00 */
-        volatile unsigned long TextureAddrReMap;        /* 0x0C04 */
-        volatile unsigned long RenderOutAGPRemap;       /* 0x0C08 */
-        volatile unsigned long _3DRegionReadTrans;      /* 0x0C0C */
-        volatile unsigned long _3DPtrReadTrans; /* 0x0C10 */
-        volatile unsigned long _3DParamReadTrans;       /* 0x0C14 */
-        volatile unsigned long _3DRegionReadThresh;     /* 0x0C18 */
-        volatile unsigned long _3DPtrReadThresh;        /* 0x0C1C */
-        volatile unsigned long _3DParamReadThresh;      /* 0x0C20 */
-        volatile unsigned long _3DRegionReadAGPRemap;   /* 0x0C24 */
-        volatile unsigned long _3DPtrReadAGPRemap;      /* 0x0C28 */
-        volatile unsigned long _3DParamReadAGPRemap;    /* 0x0C2C */
-        volatile unsigned long ZBufferAGPRemap; /* 0x0C30 */
-        volatile unsigned long TAIndexAGPRemap; /* 0x0C34 */
-        volatile unsigned long TAVertexAGPRemap;        /* 0x0C38 */
-        volatile unsigned long TAUVAddrTrans;   /* 0x0C3C */
-        volatile unsigned long TATailPtrCacheTrans;     /* 0x0C40 */
-        volatile unsigned long TAParamWriteTrans;       /* 0x0C44 */
-        volatile unsigned long TAPtrWriteTrans; /* 0x0C48 */
-        volatile unsigned long TAParamWriteThresh;      /* 0x0C4C */
-        volatile unsigned long TAPtrWriteThresh;        /* 0x0C50 */
-        volatile unsigned long TATailPtrCacheAGPRe;     /* 0x0C54 */
-        volatile unsigned long TAParamWriteAGPRe;       /* 0x0C58 */
-        volatile unsigned long TAPtrWriteAGPRe; /* 0x0C5C */
-        volatile unsigned long SDRAMArbiterConf;        /* 0x0C60 */
-        volatile unsigned long SDRAMConf0;      /* 0x0C64 */
-        volatile unsigned long SDRAMConf1;      /* 0x0C68 */
-        volatile unsigned long SDRAMConf2;      /* 0x0C6C */
-        volatile unsigned long SDRAMRefresh;    /* 0x0C70 */
-        volatile unsigned long SDRAMPowerStat;  /* 0x0C74 */
-
-        volatile unsigned long Fill6[2];        /* GAP 0x0C78 - 0x0C7C */
-
-        volatile unsigned long RAMBistData;     /* 0x0C80 */
-        volatile unsigned long RAMBistCtrl;     /* 0x0C84 */
-        volatile unsigned long FIFOBistKey;     /* 0x0C88 */
-        volatile unsigned long RAMBistResult;   /* 0x0C8C */
-        volatile unsigned long FIFOBistResult;  /* 0x0C90 */
+        volatile u32 Fill4[412];        /* 0x0190 - 0x07FC */
+
+        volatile u32 TACtrlStreamBase;  /* 0x0800 */
+        volatile u32 TAObjDataBase;     /* 0x0804 */
+        volatile u32 TAPtrDataBase;     /* 0x0808 */
+        volatile u32 TARegionDataBase;  /* 0x080C */
+        volatile u32 TATailPtrBase;     /* 0x0810 */
+        volatile u32 TAPtrRegionSize;   /* 0x0814 */
+        volatile u32 TAConfiguration;   /* 0x0818 */
+        volatile u32 TAObjDataStartAddr;        /* 0x081C */
+        volatile u32 TAObjDataEndAddr;  /* 0x0820 */
+        volatile u32 TAXScreenClip;     /* 0x0824 */
+        volatile u32 TAYScreenClip;     /* 0x0828 */
+        volatile u32 TARHWClamp;        /* 0x082C */
+        volatile u32 TARHWCompare;      /* 0x0830 */
+        volatile u32 TAStart;   /* 0x0834 */
+        volatile u32 TAObjReStart;      /* 0x0838 */
+        volatile u32 TAPtrReStart;      /* 0x083C */
+        volatile u32 TAStatus1; /* 0x0840 */
+        volatile u32 TAStatus2; /* 0x0844 */
+        volatile u32 TAIntStatus;       /* 0x0848 */
+        volatile u32 TAIntMask; /* 0x084C */
+
+        volatile u32 Fill5[235];        /* GAP 0x0850 - 0x0BF8 */
+
+        volatile u32 TextureAddrThresh; /* 0x0BFC */
+        volatile u32 Core1Translation;  /* 0x0C00 */
+        volatile u32 TextureAddrReMap;  /* 0x0C04 */
+        volatile u32 RenderOutAGPRemap; /* 0x0C08 */
+        volatile u32 _3DRegionReadTrans;        /* 0x0C0C */
+        volatile u32 _3DPtrReadTrans;   /* 0x0C10 */
+        volatile u32 _3DParamReadTrans; /* 0x0C14 */
+        volatile u32 _3DRegionReadThresh;       /* 0x0C18 */
+        volatile u32 _3DPtrReadThresh;  /* 0x0C1C */
+        volatile u32 _3DParamReadThresh;        /* 0x0C20 */
+        volatile u32 _3DRegionReadAGPRemap;     /* 0x0C24 */
+        volatile u32 _3DPtrReadAGPRemap;        /* 0x0C28 */
+        volatile u32 _3DParamReadAGPRemap;      /* 0x0C2C */
+        volatile u32 ZBufferAGPRemap;   /* 0x0C30 */
+        volatile u32 TAIndexAGPRemap;   /* 0x0C34 */
+        volatile u32 TAVertexAGPRemap;  /* 0x0C38 */
+        volatile u32 TAUVAddrTrans;     /* 0x0C3C */
+        volatile u32 TATailPtrCacheTrans;       /* 0x0C40 */
+        volatile u32 TAParamWriteTrans; /* 0x0C44 */
+        volatile u32 TAPtrWriteTrans;   /* 0x0C48 */
+        volatile u32 TAParamWriteThresh;        /* 0x0C4C */
+        volatile u32 TAPtrWriteThresh;  /* 0x0C50 */
+        volatile u32 TATailPtrCacheAGPRe;       /* 0x0C54 */
+        volatile u32 TAParamWriteAGPRe; /* 0x0C58 */
+        volatile u32 TAPtrWriteAGPRe;   /* 0x0C5C */
+        volatile u32 SDRAMArbiterConf;  /* 0x0C60 */
+        volatile u32 SDRAMConf0;        /* 0x0C64 */
+        volatile u32 SDRAMConf1;        /* 0x0C68 */
+        volatile u32 SDRAMConf2;        /* 0x0C6C */
+        volatile u32 SDRAMRefresh;      /* 0x0C70 */
+        volatile u32 SDRAMPowerStat;    /* 0x0C74 */
+
+        volatile u32 Fill6[2];  /* GAP 0x0C78 - 0x0C7C */
+
+        volatile u32 RAMBistData;       /* 0x0C80 */
+        volatile u32 RAMBistCtrl;       /* 0x0C84 */
+        volatile u32 FIFOBistKey;       /* 0x0C88 */
+        volatile u32 RAMBistResult;     /* 0x0C8C */
+        volatile u32 FIFOBistResult;    /* 0x0C90 */
 
         /*
-           volatile unsigned long Fill11[0x0CBC/4 - 0x0C94/4]; //GAP 0x0C94 - 0x0CBC
-           volatile unsigned long Fill12[0x0CD0/4 - 0x0CC0/4]; //GAP 0x0CC0 - 0x0CD0 3DRegisters
+           volatile u32 Fill11[0x0CBC/4 - 0x0C94/4]; //GAP 0x0C94 - 0x0CBC
+           volatile u32 Fill12[0x0CD0/4 - 0x0CC0/4]; //GAP 0x0CC0 - 0x0CD0 3DRegisters
          */
 
-        volatile unsigned long Fill7[16];       /* 0x0c94 - 0x0cd0 */
+        volatile u32 Fill7[16]; /* 0x0c94 - 0x0cd0 */
 
-        volatile unsigned long SDRAMAddrSign;   /* 0x0CD4 */
-        volatile unsigned long SDRAMDataSign;   /* 0x0CD8 */
-        volatile unsigned long SDRAMSignConf;   /* 0x0CDC */
+        volatile u32 SDRAMAddrSign;     /* 0x0CD4 */
+        volatile u32 SDRAMDataSign;     /* 0x0CD8 */
+        volatile u32 SDRAMSignConf;     /* 0x0CDC */
 
         /* DWFILL; //GAP 0x0CE0 */
-        volatile unsigned long dwFill_2;
-
-        volatile unsigned long ISPSignature;    /* 0x0CE4 */
-
-        volatile unsigned long Fill8[454];      /*GAP 0x0CE8 - 0x13FC */
-
-        volatile unsigned long DACPrimAddress;  /* 0x1400 */
-        volatile unsigned long DACPrimSize;     /* 0x1404 */
-        volatile unsigned long DACCursorAddr;   /* 0x1408 */
-        volatile unsigned long DACCursorCtrl;   /* 0x140C */
-        volatile unsigned long DACOverlayAddr;  /* 0x1410 */
-        volatile unsigned long DACOverlayUAddr; /* 0x1414 */
-        volatile unsigned long DACOverlayVAddr; /* 0x1418 */
-        volatile unsigned long DACOverlaySize;  /* 0x141C */
-        volatile unsigned long DACOverlayVtDec; /* 0x1420 */
-
-        volatile unsigned long Fill9[9];        /* GAP 0x1424 - 0x1444 */
-
-        volatile unsigned long DACVerticalScal; /* 0x1448 */
-        volatile unsigned long DACPixelFormat;  /* 0x144C */
-        volatile unsigned long DACHorizontalScal;       /* 0x1450 */
-        volatile unsigned long DACVidWinStart;  /* 0x1454 */
-        volatile unsigned long DACVidWinEnd;    /* 0x1458 */
-        volatile unsigned long DACBlendCtrl;    /* 0x145C */
-        volatile unsigned long DACHorTim1;      /* 0x1460 */
-        volatile unsigned long DACHorTim2;      /* 0x1464 */
-        volatile unsigned long DACHorTim3;      /* 0x1468 */
-        volatile unsigned long DACVerTim1;      /* 0x146C */
-        volatile unsigned long DACVerTim2;      /* 0x1470 */
-        volatile unsigned long DACVerTim3;      /* 0x1474 */
-        volatile unsigned long DACBorderColor;  /* 0x1478 */
-        volatile unsigned long DACSyncCtrl;     /* 0x147C */
-        volatile unsigned long DACStreamCtrl;   /* 0x1480 */
-        volatile unsigned long DACLUTAddress;   /* 0x1484 */
-        volatile unsigned long DACLUTData;      /* 0x1488 */
-        volatile unsigned long DACBurstCtrl;    /* 0x148C */
-        volatile unsigned long DACCrcTrigger;   /* 0x1490 */
-        volatile unsigned long DACCrcDone;      /* 0x1494 */
-        volatile unsigned long DACCrcResult1;   /* 0x1498 */
-        volatile unsigned long DACCrcResult2;   /* 0x149C */
-        volatile unsigned long DACLinecount;    /* 0x14A0 */
-
-        volatile unsigned long Fill10[151];     /*GAP 0x14A4 - 0x16FC */
-
-        volatile unsigned long DigVidPortCtrl;  /* 0x1700 */
-        volatile unsigned long DigVidPortStat;  /* 0x1704 */
+        volatile u32 dwFill_2;
+
+        volatile u32 ISPSignature;      /* 0x0CE4 */
+
+        volatile u32 Fill8[454];        /*GAP 0x0CE8 - 0x13FC */
+
+        volatile u32 DACPrimAddress;    /* 0x1400 */
+        volatile u32 DACPrimSize;       /* 0x1404 */
+        volatile u32 DACCursorAddr;     /* 0x1408 */
+        volatile u32 DACCursorCtrl;     /* 0x140C */
+        volatile u32 DACOverlayAddr;    /* 0x1410 */
+        volatile u32 DACOverlayUAddr;   /* 0x1414 */
+        volatile u32 DACOverlayVAddr;   /* 0x1418 */
+        volatile u32 DACOverlaySize;    /* 0x141C */
+        volatile u32 DACOverlayVtDec;   /* 0x1420 */
+
+        volatile u32 Fill9[9];  /* GAP 0x1424 - 0x1444 */
+
+        volatile u32 DACVerticalScal;   /* 0x1448 */
+        volatile u32 DACPixelFormat;    /* 0x144C */
+        volatile u32 DACHorizontalScal; /* 0x1450 */
+        volatile u32 DACVidWinStart;    /* 0x1454 */
+        volatile u32 DACVidWinEnd;      /* 0x1458 */
+        volatile u32 DACBlendCtrl;      /* 0x145C */
+        volatile u32 DACHorTim1;        /* 0x1460 */
+        volatile u32 DACHorTim2;        /* 0x1464 */
+        volatile u32 DACHorTim3;        /* 0x1468 */
+        volatile u32 DACVerTim1;        /* 0x146C */
+        volatile u32 DACVerTim2;        /* 0x1470 */
+        volatile u32 DACVerTim3;        /* 0x1474 */
+        volatile u32 DACBorderColor;    /* 0x1478 */
+        volatile u32 DACSyncCtrl;       /* 0x147C */
+        volatile u32 DACStreamCtrl;     /* 0x1480 */
+        volatile u32 DACLUTAddress;     /* 0x1484 */
+        volatile u32 DACLUTData;        /* 0x1488 */
+        volatile u32 DACBurstCtrl;      /* 0x148C */
+        volatile u32 DACCrcTrigger;     /* 0x1490 */
+        volatile u32 DACCrcDone;        /* 0x1494 */
+        volatile u32 DACCrcResult1;     /* 0x1498 */
+        volatile u32 DACCrcResult2;     /* 0x149C */
+        volatile u32 DACLinecount;      /* 0x14A0 */
+
+        volatile u32 Fill10[151];       /*GAP 0x14A4 - 0x16FC */
+
+        volatile u32 DigVidPortCtrl;    /* 0x1700 */
+        volatile u32 DigVidPortStat;    /* 0x1704 */
 
         /*
-           volatile unsigned long Fill11[0x1FFC/4 - 0x1708/4]; //GAP 0x1708 - 0x1FFC
-           volatile unsigned long Fill17[0x3000/4 - 0x2FFC/4]; //GAP 0x2000 - 0x2FFC ALUT
+           volatile u32 Fill11[0x1FFC/4 - 0x1708/4]; //GAP 0x1708 - 0x1FFC
+           volatile u32 Fill17[0x3000/4 - 0x2FFC/4]; //GAP 0x2000 - 0x2FFC ALUT
          */
 
-        volatile unsigned long Fill11[1598];
+        volatile u32 Fill11[1598];
 
         /* DWFILL; //GAP 0x3000          ALUT 256MB offset */
-        volatile unsigned long Fill_3;
+        volatile u32 Fill_3;
 
 } STG4000REG;
 
diff --git a/drivers/video/msm/mddi.c b/drivers/video/msm/mddi.c
index 4527cbf0a4ec..b061d709bc44 100644
--- a/drivers/video/msm/mddi.c
+++ b/drivers/video/msm/mddi.c
@@ -420,7 +420,7 @@ static void mddi_resume(struct msm_mddi_client_data *cdata)
         mddi_set_auto_hibernate(&mddi->client_data, 1);
 }
 
-static int __init mddi_get_client_caps(struct mddi_info *mddi)
+static int __devinit mddi_get_client_caps(struct mddi_info *mddi)
 {
         int i, j;
 
@@ -622,9 +622,9 @@ uint32_t mddi_remote_read(struct msm_mddi_client_data *cdata, uint32_t reg)
 
 static struct mddi_info mddi_info[2];
 
-static int __init mddi_clk_setup(struct platform_device *pdev,
-                                 struct mddi_info *mddi,
-                                 unsigned long clk_rate)
+static int __devinit mddi_clk_setup(struct platform_device *pdev,
+                                    struct mddi_info *mddi,
+                                    unsigned long clk_rate)
 {
         int ret;
 
diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
index 260cca7ddb41..26e83d7fdd6f 100644
--- a/drivers/video/uvesafb.c
+++ b/drivers/video/uvesafb.c
@@ -815,8 +815,15 @@ static int __devinit uvesafb_vbe_init(struct fb_info *info)
         par->pmi_setpal = pmi_setpal;
         par->ypan = ypan;
 
-        if (par->pmi_setpal || par->ypan)
-                uvesafb_vbe_getpmi(task, par);
+        if (par->pmi_setpal || par->ypan) {
+                if (__supported_pte_mask & _PAGE_NX) {
+                        par->pmi_setpal = par->ypan = 0;
+                        printk(KERN_WARNING "uvesafb: NX protection is actively."
+                                "We have better not to use the PMI.\n");
+                } else {
+                        uvesafb_vbe_getpmi(task, par);
+                }
+        }
 #else
         /* The protected mode interface is not available on non-x86. */
         par->pmi_setpal = par->ypan = 0;
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 05f0a80818a2..c2d05a8279fd 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -28,6 +28,13 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 
+/*
+ * Balloon device works in 4K page units.  So each page is pointed to by
+ * multiple balloon pages.  All memory counters in this driver are in balloon
+ * page units.
+ */
+#define VIRTIO_BALLOON_PAGES_PER_PAGE (PAGE_SIZE >> VIRTIO_BALLOON_PFN_SHIFT)
+
 struct virtio_balloon
 {
         struct virtio_device *vdev;
@@ -42,8 +49,13 @@ struct virtio_balloon
         /* Waiting for host to ack the pages we released. */
         struct completion acked;
 
-        /* The pages we've told the Host we're not using. */
+        /* Number of balloon pages we've told the Host we're not using. */
         unsigned int num_pages;
+        /*
+         * The pages we've told the Host we're not using.
+         * Each page on this list adds VIRTIO_BALLOON_PAGES_PER_PAGE
+         * to num_pages above.
+         */
         struct list_head pages;
 
         /* The array of pfns we tell the Host about. */
@@ -66,7 +78,13 @@ static u32 page_to_balloon_pfn(struct page *page)
 
         BUILD_BUG_ON(PAGE_SHIFT < VIRTIO_BALLOON_PFN_SHIFT);
         /* Convert pfn from Linux page size to balloon page size. */
-        return pfn >> (PAGE_SHIFT - VIRTIO_BALLOON_PFN_SHIFT);
+        return pfn * VIRTIO_BALLOON_PAGES_PER_PAGE;
+}
+
+static struct page *balloon_pfn_to_page(u32 pfn)
+{
+        BUG_ON(pfn % VIRTIO_BALLOON_PAGES_PER_PAGE);
+        return pfn_to_page(pfn / VIRTIO_BALLOON_PAGES_PER_PAGE);
 }
 
 static void balloon_ack(struct virtqueue *vq)
@@ -96,12 +114,23 @@ static void tell_host(struct virtio_balloon *vb, struct virtqueue *vq)
         wait_for_completion(&vb->acked);
 }
 
+static void set_page_pfns(u32 pfns[], struct page *page)
+{
+        unsigned int i;
+
+        /* Set balloon pfns pointing at this page.
+         * Note that the first pfn points at start of the page. */
+        for (i = 0; i < VIRTIO_BALLOON_PAGES_PER_PAGE; i++)
+                pfns[i] = page_to_balloon_pfn(page) + i;
+}
+
 static void fill_balloon(struct virtio_balloon *vb, size_t num)
 {
         /* We can only do one array worth at a time. */
         num = min(num, ARRAY_SIZE(vb->pfns));
 
-        for (vb->num_pfns = 0; vb->num_pfns < num; vb->num_pfns++) {
+        for (vb->num_pfns = 0; vb->num_pfns < num;
+             vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) {
                 struct page *page = alloc_page(GFP_HIGHUSER | __GFP_NORETRY |
                                         __GFP_NOMEMALLOC | __GFP_NOWARN);
                 if (!page) {
@@ -113,9 +142,9 @@ static void fill_balloon(struct virtio_balloon *vb, size_t num)
                         msleep(200);
                         break;
                 }
-                vb->pfns[vb->num_pfns] = page_to_balloon_pfn(page);
+                set_page_pfns(vb->pfns + vb->num_pfns, page);
+                vb->num_pages += VIRTIO_BALLOON_PAGES_PER_PAGE;
                 totalram_pages--;
-                vb->num_pages++;
                 list_add(&page->lru, &vb->pages);
         }
 
@@ -130,8 +159,9 @@ static void release_pages_by_pfn(const u32 pfns[], unsigned int num)
 {
         unsigned int i;
 
-        for (i = 0; i < num; i++) {
-                __free_page(pfn_to_page(pfns[i]));
+        /* Find pfns pointing at start of each page, get pages and free them. */
+        for (i = 0; i < num; i += VIRTIO_BALLOON_PAGES_PER_PAGE) {
+                __free_page(balloon_pfn_to_page(pfns[i]));
                 totalram_pages++;
         }
 }
@@ -143,11 +173,12 @@ static void leak_balloon(struct virtio_balloon *vb, size_t num)
         /* We can only do one array worth at a time. */
         num = min(num, ARRAY_SIZE(vb->pfns));
 
-        for (vb->num_pfns = 0; vb->num_pfns < num; vb->num_pfns++) {
+        for (vb->num_pfns = 0; vb->num_pfns < num;
+             vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) {
                 page = list_first_entry(&vb->pages, struct page, lru);
                 list_del(&page->lru);
-                vb->pfns[vb->num_pfns] = page_to_balloon_pfn(page);
-                vb->num_pages--;
+                set_page_pfns(vb->pfns + vb->num_pfns, page);
+                vb->num_pages -= VIRTIO_BALLOON_PAGES_PER_PAGE;
         }
 
         /*
@@ -234,11 +265,14 @@ static void virtballoon_changed(struct virtio_device *vdev)
 
 static inline s64 towards_target(struct virtio_balloon *vb)
 {
-        u32 v;
+        __le32 v;
+        s64 target;
+
         vb->vdev->config->get(vb->vdev,
                               offsetof(struct virtio_balloon_config, num_pages),
                               &v, sizeof(v));
-        return (s64)v - vb->num_pages;
+        target = le32_to_cpu(v);
+        return target - vb->num_pages;
 }
 
 static void update_balloon_size(struct virtio_balloon *vb)
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index cbc7ceef2786..9f13b897fd64 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -435,16 +435,16 @@ static void hpwdt_start(void)
 {
         reload = SECS_TO_TICKS(soft_margin);
         iowrite16(reload, hpwdt_timer_reg);
-        iowrite16(0x85, hpwdt_timer_con);
+        iowrite8(0x85, hpwdt_timer_con);
 }
 
 static void hpwdt_stop(void)
 {
         unsigned long data;
 
-        data = ioread16(hpwdt_timer_con);
+        data = ioread8(hpwdt_timer_con);
         data &= 0xFE;
-        iowrite16(data, hpwdt_timer_con);
+        iowrite8(data, hpwdt_timer_con);
 }
 
 static void hpwdt_ping(void)
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 4b33acd8ed4e..0a8a17cd80be 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -274,7 +274,7 @@ static unsigned int cpu_from_evtchn(unsigned int evtchn)
 
 static bool pirq_check_eoi_map(unsigned irq)
 {
-        return test_bit(irq, pirq_eoi_map);
+        return test_bit(pirq_from_irq(irq), pirq_eoi_map);
 }
 
 static bool pirq_needs_eoi_flag(unsigned irq)
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 99d8151c824a..1ffd03bf8e10 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -722,7 +722,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
         vma->vm_flags |= VM_RESERVED|VM_DONTEXPAND;
 
         if (use_ptemod)
-                vma->vm_flags |= VM_DONTCOPY|VM_PFNMAP;
+                vma->vm_flags |= VM_DONTCOPY;
 
         vma->vm_private_data = map;
 
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index b4d4eac761db..f100ce20b16b 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1029,6 +1029,7 @@ int gnttab_init(void)
         int i;
         unsigned int max_nr_glist_frames, nr_glist_frames;
         unsigned int nr_init_grefs;
+        int ret;
 
         nr_grant_frames = 1;
         boot_max_nr_grant_frames = __max_nr_grant_frames();
@@ -1047,12 +1048,16 @@ int gnttab_init(void)
         nr_glist_frames = (nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;
         for (i = 0; i < nr_glist_frames; i++) {
                 gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_KERNEL);
-                if (gnttab_list[i] == NULL)
+                if (gnttab_list[i] == NULL) {
+                        ret = -ENOMEM;
                         goto ini_nomem;
+                }
         }
 
-        if (gnttab_resume() < 0)
-                return -ENODEV;
+        if (gnttab_resume() < 0) {
+                ret = -ENODEV;
+                goto ini_nomem;
+        }
 
         nr_init_grefs = nr_grant_frames * GREFS_PER_GRANT_FRAME;
 
@@ -1070,7 +1075,7 @@ int gnttab_init(void)
         for (i--; i >= 0; i--)
                 free_page((unsigned long)gnttab_list[i]);
         kfree(gnttab_list);
-        return -ENOMEM;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(gnttab_init);
 
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 9e14ae6cd49c..412b96cc5305 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -132,6 +132,7 @@ static void do_suspend(void)
         err = dpm_suspend_end(PMSG_FREEZE);
         if (err) {
                 printk(KERN_ERR "dpm_suspend_end failed: %d\n", err);
+                si.cancelled = 0;
                 goto out_resume;
         }
 
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index 174b5653cd8a..0b48579a9cd6 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -128,7 +128,10 @@ static int push_cxx_to_hypervisor(struct acpi_processor *_pr)
                         pr_debug("     C%d: %s %d uS\n",
                                  cx->type, cx->desc, (u32)cx->latency);
                 }
-        } else
+        } else if (ret != -EINVAL)
+                /* EINVAL means the ACPI ID is incorrect - meaning the ACPI
+                 * table is referencing a non-existing CPU - which can happen
+                 * with broken ACPI tables. */
                 pr_err(DRV_NAME "(CX): Hypervisor error (%d) for ACPI CPU%u\n",
                        ret, _pr->acpi_id);
 
diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index f20c5f178b40..a31b54d48839 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -135,7 +135,7 @@ static int read_backend_details(struct xenbus_device *xendev)
         return xenbus_read_otherend_details(xendev, "backend-id", "backend");
 }
 
-static int is_device_connecting(struct device *dev, void *data)
+static int is_device_connecting(struct device *dev, void *data, bool ignore_nonessential)
 {
         struct xenbus_device *xendev = to_xenbus_device(dev);
         struct device_driver *drv = data;
@@ -152,16 +152,41 @@ static int is_device_connecting(struct device *dev, void *data)
         if (drv && (dev->driver != drv))
                 return 0;
 
+        if (ignore_nonessential) {
+                /* With older QEMU, for PVonHVM guests the guest config files
+                 * could contain: vfb = [ 'vnc=1, vnclisten=0.0.0.0']
+                 * which is nonsensical as there is no PV FB (there can be
+                 * a PVKB) running as HVM guest. */
+
+                if ((strncmp(xendev->nodename, "device/vkbd", 11) == 0))
+                        return 0;
+
+                if ((strncmp(xendev->nodename, "device/vfb", 10) == 0))
+                        return 0;
+        }
         xendrv = to_xenbus_driver(dev->driver);
         return (xendev->state < XenbusStateConnected ||
                 (xendev->state == XenbusStateConnected &&
                  xendrv->is_ready && !xendrv->is_ready(xendev)));
 }
+static int essential_device_connecting(struct device *dev, void *data)
+{
+        return is_device_connecting(dev, data, true /* ignore PV[KBB+FB] */);
+}
+static int non_essential_device_connecting(struct device *dev, void *data)
+{
+        return is_device_connecting(dev, data, false);
+}
 
-static int exists_connecting_device(struct device_driver *drv)
+static int exists_essential_connecting_device(struct device_driver *drv)
 {
         return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
-                                is_device_connecting);
+                                essential_device_connecting);
+}
+static int exists_non_essential_connecting_device(struct device_driver *drv)
+{
+        return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
+                                non_essential_device_connecting);
 }
 
 static int print_device_status(struct device *dev, void *data)
@@ -192,6 +217,23 @@ static int print_device_status(struct device *dev, void *data)
 /* We only wait for device setup after most initcalls have run. */
 static int ready_to_wait_for_devices;
 
+static bool wait_loop(unsigned long start, unsigned int max_delay,
+                     unsigned int *seconds_waited)
+{
+        if (time_after(jiffies, start + (*seconds_waited+5)*HZ)) {
+                if (!*seconds_waited)
+                        printk(KERN_WARNING "XENBUS: Waiting for "
+                               "devices to initialise: ");
+                *seconds_waited += 5;
+                printk("%us...", max_delay - *seconds_waited);
+                if (*seconds_waited == max_delay)
+                        return true;
+        }
+
+        schedule_timeout_interruptible(HZ/10);
+
+        return false;
+}
 /*
  * On a 5-minute timeout, wait for all devices currently configured.  We need
  * to do this to guarantee that the filesystems and / or network devices
@@ -215,19 +257,14 @@ static void wait_for_devices(struct xenbus_driver *xendrv)
         if (!ready_to_wait_for_devices || !xen_domain())
                 return;
 
-        while (exists_connecting_device(drv)) {
-                if (time_after(jiffies, start + (seconds_waited+5)*HZ)) {
-                        if (!seconds_waited)
-                                printk(KERN_WARNING "XENBUS: Waiting for "
-                                       "devices to initialise: ");
-                        seconds_waited += 5;
-                        printk("%us...", 300 - seconds_waited);
-                        if (seconds_waited == 300)
-                                break;
-                }
-
-                schedule_timeout_interruptible(HZ/10);
-        }
+        while (exists_non_essential_connecting_device(drv))
+                if (wait_loop(start, 30, &seconds_waited))
+                        break;
+
+        /* Skips PVKB and PVFB check.*/
+        while (exists_essential_connecting_device(drv))
+                if (wait_loop(start, 270, &seconds_waited))
+                        break;
 
         if (seconds_waited)
                 printk("\n");
diff --git a/fs/aio.c b/fs/aio.c
index da887604dfc5..67a6db3e1b6f 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -93,9 +93,8 @@ static void aio_free_ring(struct kioctx *ctx)
                 put_page(info->ring_pages[i]);
 
         if (info->mmap_size) {
-                down_write(&ctx->mm->mmap_sem);
-                do_munmap(ctx->mm, info->mmap_base, info->mmap_size);
-                up_write(&ctx->mm->mmap_sem);
+                BUG_ON(ctx->mm != current->mm);
+                vm_munmap(info->mmap_base, info->mmap_size);
         }
 
         if (info->ring_pages && info->ring_pages != info->internal_pages)
@@ -389,6 +388,17 @@ void exit_aio(struct mm_struct *mm)
                                 "exit_aio:ioctx still alive: %d %d %d\n",
                                 atomic_read(&ctx->users), ctx->dead,
                                 ctx->reqs_active);
+                /*
+                 * We don't need to bother with munmap() here -
+                 * exit_mmap(mm) is coming and it'll unmap everything.
+                 * Since aio_free_ring() uses non-zero ->mmap_size
+                 * as indicator that it needs to unmap the area,
+                 * just set it to 0; aio_free_ring() is the only
+                 * place that uses ->mmap_size, so it's safe.
+                 * That way we get all munmap done to current->mm -
+                 * all other callers have ctx->mm == current->mm.
+                 */
+                ctx->ring_info.mmap_size = 0;
                 put_ioctx(ctx);
         }
 }
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index eb1cc92cd67d..908e18455413 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -110,7 +110,6 @@ struct autofs_sb_info {
         int sub_version;
         int min_proto;
         int max_proto;
-        int compat_daemon;
         unsigned long exp_timeout;
         unsigned int type;
         int reghost_enabled;
@@ -270,6 +269,17 @@ int autofs4_fill_super(struct super_block *, void *, int);
 struct autofs_info *autofs4_new_ino(struct autofs_sb_info *);
 void autofs4_clean_ino(struct autofs_info *);
 
+static inline int autofs_prepare_pipe(struct file *pipe)
+{
+        if (!pipe->f_op || !pipe->f_op->write)
+                return -EINVAL;
+        if (!S_ISFIFO(pipe->f_dentry->d_inode->i_mode))
+                return -EINVAL;
+        /* We want a packet pipe */
+        pipe->f_flags |= O_DIRECT;
+        return 0;
+}
+
 /* Queue management functions */
 
 int autofs4_wait(struct autofs_sb_info *,struct dentry *, enum autofs_notify);
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 9dacb8586701..aa9103f8f01b 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -376,7 +376,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                         err = -EBADF;
                         goto out;
                 }
-                if (!pipe->f_op || !pipe->f_op->write) {
+                if (autofs_prepare_pipe(pipe) < 0) {
                         err = -EPIPE;
                         fput(pipe);
                         goto out;
@@ -385,7 +385,6 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                 sbi->pipefd = pipefd;
                 sbi->pipe = pipe;
                 sbi->catatonic = 0;
-                sbi->compat_daemon = is_compat_task();
         }
 out:
         mutex_unlock(&sbi->wq_mutex);
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index d8dc002e9cc3..6e488ebe7784 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -19,7 +19,6 @@
 #include <linux/parser.h>
 #include <linux/bitops.h>
 #include <linux/magic.h>
-#include <linux/compat.h>
 #include "autofs_i.h"
 #include <linux/module.h>
 
@@ -225,7 +224,6 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         set_autofs_type_indirect(&sbi->type);
         sbi->min_proto = 0;
         sbi->max_proto = 0;
-        sbi->compat_daemon = is_compat_task();
         mutex_init(&sbi->wq_mutex);
         mutex_init(&sbi->pipe_mutex);
         spin_lock_init(&sbi->fs_lock);
@@ -292,7 +290,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
                 printk("autofs: could not open pipe file descriptor\n");
                 goto fail_dput;
         }
-        if (!pipe->f_op || !pipe->f_op->write)
+        if (autofs_prepare_pipe(pipe) < 0)
                 goto fail_fput;
         sbi->pipe = pipe;
         sbi->pipefd = pipefd;
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 9c098db43344..da8876d38a7b 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -91,24 +91,7 @@ static int autofs4_write(struct autofs_sb_info *sbi,
 
         return (bytes > 0);
 }
-
-/*
- * The autofs_v5 packet was misdesigned.
- *
- * The packets are identical on x86-32 and x86-64, but have different
- * alignment. Which means that 'sizeof()' will give different results.
- * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
- */
-static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
-{
-        size_t pktsz = sizeof(struct autofs_v5_packet);
-#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
-        if (sbi->compat_daemon > 0)
-                pktsz -= 4;
-#endif
-        return pktsz;
-}
-
+        
 static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                                  struct autofs_wait_queue *wq,
                                  int type)
@@ -172,7 +155,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
         {
                 struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
 
-                pktsz = autofs_v5_packet_size(sbi);
+                pktsz = sizeof(*packet);
+
                 packet->wait_queue_token = wq->wait_queue_token;
                 packet->len = wq->name.len;
                 memcpy(packet->name, wq->name.name, wq->name.len);
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index 2eb12f13593d..d146e181d10d 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -50,9 +50,7 @@ static int set_brk(unsigned long start, unsigned long end)
         end = PAGE_ALIGN(end);
         if (end > start) {
                 unsigned long addr;
-                down_write(&current->mm->mmap_sem);
-                addr = do_brk(start, end - start);
-                up_write(&current->mm->mmap_sem);
+                addr = vm_brk(start, end - start);
                 if (BAD_ADDR(addr))
                         return addr;
         }
@@ -280,9 +278,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
                 pos = 32;
                 map_size = ex.a_text+ex.a_data;
 #endif
-                down_write(&current->mm->mmap_sem);
-                error = do_brk(text_addr & PAGE_MASK, map_size);
-                up_write(&current->mm->mmap_sem);
+                error = vm_brk(text_addr & PAGE_MASK, map_size);
                 if (error != (text_addr & PAGE_MASK)) {
                         send_sig(SIGKILL, current, 0);
                         return error;
@@ -313,9 +309,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 
                 if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) {
                         loff_t pos = fd_offset;
-                        down_write(&current->mm->mmap_sem);
-                        do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
-                        up_write(&current->mm->mmap_sem);
+                        vm_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
                         bprm->file->f_op->read(bprm->file,
                                         (char __user *)N_TXTADDR(ex),
                                         ex.a_text+ex.a_data, &pos);
@@ -325,24 +319,20 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
                         goto beyond_if;
                 }
 
-                down_write(&current->mm->mmap_sem);
-                error = do_mmap(bprm->file, N_TXTADDR(ex), ex.a_text,
+                error = vm_mmap(bprm->file, N_TXTADDR(ex), ex.a_text,
                         PROT_READ | PROT_EXEC,
                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
                         fd_offset);
-                up_write(&current->mm->mmap_sem);
 
                 if (error != N_TXTADDR(ex)) {
                         send_sig(SIGKILL, current, 0);
                         return error;
                 }
 
-                down_write(&current->mm->mmap_sem);
-                error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
+                error = vm_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
                                 PROT_READ | PROT_WRITE | PROT_EXEC,
                                 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
                                 fd_offset + ex.a_text);
-                up_write(&current->mm->mmap_sem);
                 if (error != N_DATADDR(ex)) {
                         send_sig(SIGKILL, current, 0);
                         return error;
@@ -412,9 +402,7 @@ static int load_aout_library(struct file *file)
                                "N_TXTOFF is not page aligned. Please convert library: %s\n",
                                file->f_path.dentry->d_name.name);
                 }
-                down_write(&current->mm->mmap_sem);
-                do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
-                up_write(&current->mm->mmap_sem);
+                vm_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
                 
                 file->f_op->read(file, (char __user *)start_addr,
                         ex.a_text + ex.a_data, &pos);
@@ -425,12 +413,10 @@ static int load_aout_library(struct file *file)
                 goto out;
         }
         /* Now use mmap to map the library into memory. */
-        down_write(&current->mm->mmap_sem);
-        error = do_mmap(file, start_addr, ex.a_text + ex.a_data,
+        error = vm_mmap(file, start_addr, ex.a_text + ex.a_data,
                         PROT_READ | PROT_WRITE | PROT_EXEC,
                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
                         N_TXTOFF(ex));
-        up_write(&current->mm->mmap_sem);
         retval = error;
         if (error != start_addr)
                 goto out;
@@ -438,9 +424,7 @@ static int load_aout_library(struct file *file)
         len = PAGE_ALIGN(ex.a_text + ex.a_data);
         bss = ex.a_text + ex.a_data + ex.a_bss;
         if (bss > len) {
-                down_write(&current->mm->mmap_sem);
-                error = do_brk(start_addr + len, bss - len);
-                up_write(&current->mm->mmap_sem);
+                error = vm_brk(start_addr + len, bss - len);
                 retval = error;
                 if (error != start_addr + len)
                         goto out;
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 48ffb3dc610a..16f735417072 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -82,9 +82,7 @@ static int set_brk(unsigned long start, unsigned long end)
         end = ELF_PAGEALIGN(end);
         if (end > start) {
                 unsigned long addr;
-                down_write(&current->mm->mmap_sem);
-                addr = do_brk(start, end - start);
-                up_write(&current->mm->mmap_sem);
+                addr = vm_brk(start, end - start);
                 if (BAD_ADDR(addr))
                         return addr;
         }
@@ -514,9 +512,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
                 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 
                 /* Map the last of the bss segment */
-                down_write(&current->mm->mmap_sem);
-                error = do_brk(elf_bss, last_bss - elf_bss);
-                up_write(&current->mm->mmap_sem);
+                error = vm_brk(elf_bss, last_bss - elf_bss);
                 if (BAD_ADDR(error))
                         goto out_close;
         }
@@ -962,10 +958,8 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                    and some applications "depend" upon this behavior.
                    Since we do not have the power to recompile these, we
                    emulate the SVr4 behavior. Sigh. */
-                down_write(&current->mm->mmap_sem);
-                error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
+                error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
                                 MAP_FIXED | MAP_PRIVATE, 0);
-                up_write(&current->mm->mmap_sem);
         }
 
 #ifdef ELF_PLAT_INIT
@@ -1050,8 +1044,7 @@ static int load_elf_library(struct file *file)
                 eppnt++;
 
         /* Now use mmap to map the library into memory. */
-        down_write(&current->mm->mmap_sem);
-        error = do_mmap(file,
+        error = vm_mmap(file,
                         ELF_PAGESTART(eppnt->p_vaddr),
                         (eppnt->p_filesz +
                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
@@ -1059,7 +1052,6 @@ static int load_elf_library(struct file *file)
                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
                         (eppnt->p_offset -
                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
-        up_write(&current->mm->mmap_sem);
         if (error != ELF_PAGESTART(eppnt->p_vaddr))
                 goto out_free_ph;
 
@@ -1072,11 +1064,8 @@ static int load_elf_library(struct file *file)
         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
                             ELF_MIN_ALIGN - 1);
         bss = eppnt->p_memsz + eppnt->p_vaddr;
-        if (bss > len) {
-                down_write(&current->mm->mmap_sem);
-                do_brk(len, bss - len);
-                up_write(&current->mm->mmap_sem);
-        }
+        if (bss > len)
+                vm_brk(len, bss - len);
         error = 0;
 
 out_free_ph:
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 9bd5612a8224..d390a0fffc65 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -390,21 +390,17 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
             (executable_stack == EXSTACK_DEFAULT && VM_STACK_FLAGS & VM_EXEC))
                 stack_prot |= PROT_EXEC;
 
-        down_write(&current->mm->mmap_sem);
-        current->mm->start_brk = do_mmap(NULL, 0, stack_size, stack_prot,
+        current->mm->start_brk = vm_mmap(NULL, 0, stack_size, stack_prot,
                                          MAP_PRIVATE | MAP_ANONYMOUS |
                                          MAP_UNINITIALIZED | MAP_GROWSDOWN,
                                          0);
 
         if (IS_ERR_VALUE(current->mm->start_brk)) {
-                up_write(&current->mm->mmap_sem);
                 retval = current->mm->start_brk;
                 current->mm->start_brk = 0;
                 goto error_kill;
         }
 
-        up_write(&current->mm->mmap_sem);
-
         current->mm->brk = current->mm->start_brk;
         current->mm->context.end_brk = current->mm->start_brk;
         current->mm->context.end_brk +=
@@ -955,10 +951,8 @@ static int elf_fdpic_map_file_constdisp_on_uclinux(
         if (params->flags & ELF_FDPIC_FLAG_EXECUTABLE)
                 mflags |= MAP_EXECUTABLE;
 
-        down_write(&mm->mmap_sem);
-        maddr = do_mmap(NULL, load_addr, top - base,
+        maddr = vm_mmap(NULL, load_addr, top - base,
                         PROT_READ | PROT_WRITE | PROT_EXEC, mflags, 0);
-        up_write(&mm->mmap_sem);
         if (IS_ERR_VALUE(maddr))
                 return (int) maddr;
 
@@ -1096,10 +1090,8 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
 
                 /* create the mapping */
                 disp = phdr->p_vaddr & ~PAGE_MASK;
-                down_write(&mm->mmap_sem);
-                maddr = do_mmap(file, maddr, phdr->p_memsz + disp, prot, flags,
+                maddr = vm_mmap(file, maddr, phdr->p_memsz + disp, prot, flags,
                                 phdr->p_offset - disp);
-                up_write(&mm->mmap_sem);
 
                 kdebug("mmap[%d] <file> sz=%lx pr=%x fl=%x of=%lx --> %08lx",
                        loop, phdr->p_memsz + disp, prot, flags,
@@ -1143,10 +1135,8 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
                         unsigned long xmaddr;
 
                         flags |= MAP_FIXED | MAP_ANONYMOUS;
-                        down_write(&mm->mmap_sem);
-                        xmaddr = do_mmap(NULL, xaddr, excess - excess1,
+                        xmaddr = vm_mmap(NULL, xaddr, excess - excess1,
                                          prot, flags, 0);
-                        up_write(&mm->mmap_sem);
 
                         kdebug("mmap[%d] <anon>"
                                " ad=%lx sz=%lx pr=%x fl=%x of=0 --> %08lx",
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 024d20ee3ca3..6b2daf99fab8 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -542,10 +542,8 @@ static int load_flat_file(struct linux_binprm * bprm,
                  */
                 DBG_FLT("BINFMT_FLAT: ROM mapping of file (we hope)\n");
 
-                down_write(&current->mm->mmap_sem);
-                textpos = do_mmap(bprm->file, 0, text_len, PROT_READ|PROT_EXEC,
+                textpos = vm_mmap(bprm->file, 0, text_len, PROT_READ|PROT_EXEC,
                                   MAP_PRIVATE|MAP_EXECUTABLE, 0);
-                up_write(&current->mm->mmap_sem);
                 if (!textpos || IS_ERR_VALUE(textpos)) {
                         if (!textpos)
                                 textpos = (unsigned long) -ENOMEM;
@@ -556,10 +554,8 @@ static int load_flat_file(struct linux_binprm * bprm,
 
                 len = data_len + extra + MAX_SHARED_LIBS * sizeof(unsigned long);
                 len = PAGE_ALIGN(len);
-                down_write(&current->mm->mmap_sem);
-                realdatastart = do_mmap(0, 0, len,
+                realdatastart = vm_mmap(0, 0, len,
                         PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
-                up_write(&current->mm->mmap_sem);
 
                 if (realdatastart == 0 || IS_ERR_VALUE(realdatastart)) {
                         if (!realdatastart)
@@ -603,10 +599,8 @@ static int load_flat_file(struct linux_binprm * bprm,
 
                 len = text_len + data_len + extra + MAX_SHARED_LIBS * sizeof(unsigned long);
                 len = PAGE_ALIGN(len);
-                down_write(&current->mm->mmap_sem);
-                textpos = do_mmap(0, 0, len,
+                textpos = vm_mmap(0, 0, len,
                         PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);
-                up_write(&current->mm->mmap_sem);
 
                 if (!textpos || IS_ERR_VALUE(textpos)) {
                         if (!textpos)
diff --git a/fs/binfmt_som.c b/fs/binfmt_som.c
index e4fc746629a7..4517aaff61b4 100644
--- a/fs/binfmt_som.c
+++ b/fs/binfmt_som.c
@@ -147,10 +147,8 @@ static int map_som_binary(struct file *file,
         code_size = SOM_PAGEALIGN(hpuxhdr->exec_tsize);
         current->mm->start_code = code_start;
         current->mm->end_code = code_start + code_size;
-        down_write(&current->mm->mmap_sem);
-        retval = do_mmap(file, code_start, code_size, prot,
+        retval = vm_mmap(file, code_start, code_size, prot,
                         flags, SOM_PAGESTART(hpuxhdr->exec_tfile));
-        up_write(&current->mm->mmap_sem);
         if (retval < 0 && retval > -1024)
                 goto out;
 
@@ -158,20 +156,16 @@ static int map_som_binary(struct file *file,
         data_size = SOM_PAGEALIGN(hpuxhdr->exec_dsize);
         current->mm->start_data = data_start;
         current->mm->end_data = bss_start = data_start + data_size;
-        down_write(&current->mm->mmap_sem);
-        retval = do_mmap(file, data_start, data_size,
+        retval = vm_mmap(file, data_start, data_size,
                         prot | PROT_WRITE, flags,
                         SOM_PAGESTART(hpuxhdr->exec_dfile));
-        up_write(&current->mm->mmap_sem);
         if (retval < 0 && retval > -1024)
                 goto out;
 
         som_brk = bss_start + SOM_PAGEALIGN(hpuxhdr->exec_bsize);
         current->mm->start_brk = current->mm->brk = som_brk;
-        down_write(&current->mm->mmap_sem);
-        retval = do_mmap(NULL, bss_start, som_brk - bss_start,
+        retval = vm_mmap(NULL, bss_start, som_brk - bss_start,
                         prot | PROT_WRITE, MAP_FIXED | MAP_PRIVATE, 0);
-        up_write(&current->mm->mmap_sem);
         if (retval > 0 || retval < -1024)
                 retval = 0;
 out:
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index f4e90748940a..bcec06750232 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -22,6 +22,7 @@
 #include "ulist.h"
 #include "transaction.h"
 #include "delayed-ref.h"
+#include "locking.h"
 
 /*
  * this structure records all encountered refs on the way up to the root
@@ -893,18 +894,22 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
         s64 bytes_left = size - 1;
         struct extent_buffer *eb = eb_in;
         struct btrfs_key found_key;
+        int leave_spinning = path->leave_spinning;
 
         if (bytes_left >= 0)
                 dest[bytes_left] = '\0';
 
+        path->leave_spinning = 1;
         while (1) {
                 len = btrfs_inode_ref_name_len(eb, iref);
                 bytes_left -= len;
                 if (bytes_left >= 0)
                         read_extent_buffer(eb, dest + bytes_left,
                                                 (unsigned long)(iref + 1), len);
-                if (eb != eb_in)
+                if (eb != eb_in) {
+                        btrfs_tree_read_unlock_blocking(eb);
                         free_extent_buffer(eb);
+                }
                 ret = inode_ref_info(parent, 0, fs_root, path, &found_key);
                 if (ret > 0)
                         ret = -ENOENT;
@@ -919,8 +924,11 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                 slot = path->slots[0];
                 eb = path->nodes[0];
                 /* make sure we can use eb after releasing the path */
-                if (eb != eb_in)
+                if (eb != eb_in) {
                         atomic_inc(&eb->refs);
+                        btrfs_tree_read_lock(eb);
+                        btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
+                }
                 btrfs_release_path(path);
 
                 iref = btrfs_item_ptr(eb, slot, struct btrfs_inode_ref);
@@ -931,6 +939,7 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
         }
 
         btrfs_release_path(path);
+        path->leave_spinning = leave_spinning;
 
         if (ret)
                 return ERR_PTR(ret);
@@ -1247,7 +1256,7 @@ static int iterate_irefs(u64 inum, struct btrfs_root *fs_root,
                                 struct btrfs_path *path,
                                 iterate_irefs_t *iterate, void *ctx)
 {
-        int ret;
+        int ret = 0;
         int slot;
         u32 cur;
         u32 len;
@@ -1259,7 +1268,8 @@ static int iterate_irefs(u64 inum, struct btrfs_root *fs_root,
         struct btrfs_inode_ref *iref;
         struct btrfs_key found_key;
 
-        while (1) {
+        while (!ret) {
+                path->leave_spinning = 1;
                 ret = inode_ref_info(inum, parent ? parent+1 : 0, fs_root, path,
                                         &found_key);
                 if (ret < 0)
@@ -1275,6 +1285,8 @@ static int iterate_irefs(u64 inum, struct btrfs_root *fs_root,
                 eb = path->nodes[0];
                 /* make sure we can use eb after releasing the path */
                 atomic_inc(&eb->refs);
+                btrfs_tree_read_lock(eb);
+                btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
                 btrfs_release_path(path);
 
                 item = btrfs_item_nr(eb, slot);
@@ -1288,13 +1300,12 @@ static int iterate_irefs(u64 inum, struct btrfs_root *fs_root,
                                  (unsigned long long)found_key.objectid,
                                  (unsigned long long)fs_root->objectid);
                         ret = iterate(parent, iref, eb, ctx);
-                        if (ret) {
-                                free_extent_buffer(eb);
+                        if (ret)
                                 break;
-                        }
                         len = sizeof(*iref) + name_len;
                         iref = (struct btrfs_inode_ref *)((char *)iref + len);
                 }
+                btrfs_tree_read_unlock_blocking(eb);
                 free_extent_buffer(eb);
         }
 
@@ -1414,6 +1425,8 @@ struct inode_fs_paths *init_ipath(s32 total_bytes, struct btrfs_root *fs_root,
 
 void free_ipath(struct inode_fs_paths *ipath)
 {
+        if (!ipath)
+                return;
         kfree(ipath->fspath);
         kfree(ipath);
 }
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index d286b40a5671..86eff48dab78 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -405,6 +405,7 @@ int btrfs_submit_compressed_write(struct inode *inode, u64 start,
                         bio_put(bio);
 
                         bio = compressed_bio_alloc(bdev, first_byte, GFP_NOFS);
+                        BUG_ON(!bio);
                         bio->bi_private = cb;
                         bio->bi_end_io = end_compressed_bio_write;
                         bio_add_page(bio, page, PAGE_CACHE_SIZE, 0);
@@ -687,6 +688,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
 
                         comp_bio = compressed_bio_alloc(bdev, cur_disk_byte,
                                                         GFP_NOFS);
+                        BUG_ON(!comp_bio);
                         comp_bio->bi_private = cb;
                         comp_bio->bi_end_io = end_compressed_bio_read;
 
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index e801f226d7e0..4106264fbc65 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -220,10 +220,12 @@ struct extent_buffer *btrfs_read_lock_root_node(struct btrfs_root *root)
  */
 static void add_root_to_dirty_list(struct btrfs_root *root)
 {
+        spin_lock(&root->fs_info->trans_lock);
         if (root->track_dirty && list_empty(&root->dirty_list)) {
                 list_add(&root->dirty_list,
                          &root->fs_info->dirty_cowonly_roots);
         }
+        spin_unlock(&root->fs_info->trans_lock);
 }
 
 /*
@@ -723,7 +725,7 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
 
                 cur = btrfs_find_tree_block(root, blocknr, blocksize);
                 if (cur)
-                        uptodate = btrfs_buffer_uptodate(cur, gen);
+                        uptodate = btrfs_buffer_uptodate(cur, gen, 0);
                 else
                         uptodate = 0;
                 if (!cur || !uptodate) {
@@ -1358,7 +1360,12 @@ static noinline int reada_for_balance(struct btrfs_root *root,
                 block1 = btrfs_node_blockptr(parent, slot - 1);
                 gen = btrfs_node_ptr_generation(parent, slot - 1);
                 eb = btrfs_find_tree_block(root, block1, blocksize);
-                if (eb && btrfs_buffer_uptodate(eb, gen))
+                /*
+                 * if we get -eagain from btrfs_buffer_uptodate, we
+                 * don't want to return eagain here.  That will loop
+                 * forever
+                 */
+                if (eb && btrfs_buffer_uptodate(eb, gen, 1) != 0)
                         block1 = 0;
                 free_extent_buffer(eb);
         }
@@ -1366,7 +1373,7 @@ static noinline int reada_for_balance(struct btrfs_root *root,
                 block2 = btrfs_node_blockptr(parent, slot + 1);
                 gen = btrfs_node_ptr_generation(parent, slot + 1);
                 eb = btrfs_find_tree_block(root, block2, blocksize);
-                if (eb && btrfs_buffer_uptodate(eb, gen))
+                if (eb && btrfs_buffer_uptodate(eb, gen, 1) != 0)
                         block2 = 0;
                 free_extent_buffer(eb);
         }
@@ -1504,8 +1511,9 @@ read_block_for_search(struct btrfs_trans_handle *trans,
 
         tmp = btrfs_find_tree_block(root, blocknr, blocksize);
         if (tmp) {
-                if (btrfs_buffer_uptodate(tmp, 0)) {
-                        if (btrfs_buffer_uptodate(tmp, gen)) {
+                /* first we do an atomic uptodate check */
+                if (btrfs_buffer_uptodate(tmp, 0, 1) > 0) {
+                        if (btrfs_buffer_uptodate(tmp, gen, 1) > 0) {
                                 /*
                                  * we found an up to date block without
                                  * sleeping, return
@@ -1523,8 +1531,9 @@ read_block_for_search(struct btrfs_trans_handle *trans,
                         free_extent_buffer(tmp);
                         btrfs_set_path_blocking(p);
 
+                        /* now we're allowed to do a blocking uptodate check */
                         tmp = read_tree_block(root, blocknr, blocksize, gen);
-                        if (tmp && btrfs_buffer_uptodate(tmp, gen)) {
+                        if (tmp && btrfs_buffer_uptodate(tmp, gen, 0) > 0) {
                                 *eb_ret = tmp;
                                 return 0;
                         }
@@ -1559,7 +1568,7 @@ read_block_for_search(struct btrfs_trans_handle *trans,
                  * and give up so that our caller doesn't loop forever
                  * on our EAGAINs.
                  */
-                if (!btrfs_buffer_uptodate(tmp, 0))
+                if (!btrfs_buffer_uptodate(tmp, 0, 0))
                         ret = -EIO;
                 free_extent_buffer(tmp);
         }
@@ -4043,7 +4052,7 @@ again:
                         tmp = btrfs_find_tree_block(root, blockptr,
                                             btrfs_level_size(root, level - 1));
 
-                        if (tmp && btrfs_buffer_uptodate(tmp, gen)) {
+                        if (tmp && btrfs_buffer_uptodate(tmp, gen, 1) > 0) {
                                 free_extent_buffer(tmp);
                                 break;
                         }
@@ -4166,7 +4175,8 @@ next:
                                 struct extent_buffer *cur;
                                 cur = btrfs_find_tree_block(root, blockptr,
                                             btrfs_level_size(root, level - 1));
-                                if (!cur || !btrfs_buffer_uptodate(cur, gen)) {
+                                if (!cur ||
+                                    btrfs_buffer_uptodate(cur, gen, 1) <= 0) {
                                         slot++;
                                         if (cur)
                                                 free_extent_buffer(cur);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 5b8ef8eb3521..8fd72331d600 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1078,7 +1078,7 @@ struct btrfs_fs_info {
          * is required instead of the faster short fsync log commits
          */
         u64 last_trans_log_full_commit;
-        unsigned long mount_opt:21;
+        unsigned long mount_opt;
         unsigned long compress_type:4;
         u64 max_inline;
         u64 alloc_start;
@@ -2166,7 +2166,7 @@ BTRFS_SETGET_STACK_FUNCS(root_last_snapshot, struct btrfs_root_item,
 
 static inline bool btrfs_root_readonly(struct btrfs_root *root)
 {
-        return root->root_item.flags & BTRFS_ROOT_SUBVOL_RDONLY;
+        return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_RDONLY)) != 0;
 }
 
 /* struct btrfs_root_backup */
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 20196f411206..a7ffc88a7dbe 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -323,7 +323,8 @@ static int csum_tree_block(struct btrfs_root *root, struct extent_buffer *buf,
  * in the wrong place.
  */
 static int verify_parent_transid(struct extent_io_tree *io_tree,
-                                 struct extent_buffer *eb, u64 parent_transid)
+                                 struct extent_buffer *eb, u64 parent_transid,
+                                 int atomic)
 {
         struct extent_state *cached_state = NULL;
         int ret;
@@ -331,6 +332,9 @@ static int verify_parent_transid(struct extent_io_tree *io_tree,
         if (!parent_transid || btrfs_header_generation(eb) == parent_transid)
                 return 0;
 
+        if (atomic)
+                return -EAGAIN;
+
         lock_extent_bits(io_tree, eb->start, eb->start + eb->len - 1,
                          0, &cached_state);
         if (extent_buffer_uptodate(eb) &&
@@ -372,7 +376,8 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root,
                 ret = read_extent_buffer_pages(io_tree, eb, start,
                                                WAIT_COMPLETE,
                                                btree_get_extent, mirror_num);
-                if (!ret && !verify_parent_transid(io_tree, eb, parent_transid))
+                if (!ret && !verify_parent_transid(io_tree, eb,
+                                                   parent_transid, 0))
                         break;
 
                 /*
@@ -383,17 +388,16 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root,
                 if (test_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags))
                         break;
 
-                if (!failed_mirror) {
-                        failed = 1;
-                        printk(KERN_ERR "failed mirror was %d\n", eb->failed_mirror);
-                        failed_mirror = eb->failed_mirror;
-                }
-
                 num_copies = btrfs_num_copies(&root->fs_info->mapping_tree,
                                               eb->start, eb->len);
                 if (num_copies == 1)
                         break;
 
+                if (!failed_mirror) {
+                        failed = 1;
+                        failed_mirror = eb->read_mirror;
+                }
+
                 mirror_num++;
                 if (mirror_num == failed_mirror)
                         mirror_num++;
@@ -564,7 +568,7 @@ struct extent_buffer *find_eb_for_page(struct extent_io_tree *tree,
 }
 
 static int btree_readpage_end_io_hook(struct page *page, u64 start, u64 end,
-                               struct extent_state *state)
+                               struct extent_state *state, int mirror)
 {
         struct extent_io_tree *tree;
         u64 found_start;
@@ -589,6 +593,7 @@ static int btree_readpage_end_io_hook(struct page *page, u64 start, u64 end,
         if (!reads_done)
                 goto err;
 
+        eb->read_mirror = mirror;
         if (test_bit(EXTENT_BUFFER_IOERR, &eb->bflags)) {
                 ret = -EIO;
                 goto err;
@@ -652,7 +657,7 @@ static int btree_io_failed_hook(struct page *page, int failed_mirror)
 
         eb = (struct extent_buffer *)page->private;
         set_bit(EXTENT_BUFFER_IOERR, &eb->bflags);
-        eb->failed_mirror = failed_mirror;
+        eb->read_mirror = failed_mirror;
         if (test_and_clear_bit(EXTENT_BUFFER_READAHEAD, &eb->bflags))
                 btree_readahead_hook(root, eb, eb->start, -EIO);
         return -EIO;    /* we fixed nothing */
@@ -1202,7 +1207,7 @@ static int __must_check find_and_setup_root(struct btrfs_root *tree_root,
         root->commit_root = NULL;
         root->node = read_tree_block(root, btrfs_root_bytenr(&root->root_item),
                                      blocksize, generation);
-        if (!root->node || !btrfs_buffer_uptodate(root->node, generation)) {
+        if (!root->node || !btrfs_buffer_uptodate(root->node, generation, 0)) {
                 free_extent_buffer(root->node);
                 root->node = NULL;
                 return -EIO;
@@ -2254,9 +2259,9 @@ int open_ctree(struct super_block *sb,
                 goto fail_sb_buffer;
         }
 
-        if (sectorsize < PAGE_SIZE) {
-                printk(KERN_WARNING "btrfs: Incompatible sector size "
-                       "found on %s\n", sb->s_id);
+        if (sectorsize != PAGE_SIZE) {
+                printk(KERN_WARNING "btrfs: Incompatible sector size(%lu) "
+                       "found on %s\n", (unsigned long)sectorsize, sb->s_id);
                 goto fail_sb_buffer;
         }
 
@@ -3143,7 +3148,8 @@ int close_ctree(struct btrfs_root *root)
         return 0;
 }
 
-int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid)
+int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid,
+                          int atomic)
 {
         int ret;
         struct inode *btree_inode = buf->pages[0]->mapping->host;
@@ -3153,7 +3159,9 @@ int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid)
                 return ret;
 
         ret = verify_parent_transid(&BTRFS_I(btree_inode)->io_tree, buf,
-                                    parent_transid);
+                                    parent_transid, atomic);
+        if (ret == -EAGAIN)
+                return ret;
         return !ret;
 }
 
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index a7ace1a2dd12..ab1830aaf0ed 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -66,7 +66,8 @@ void btrfs_btree_balance_dirty(struct btrfs_root *root, unsigned long nr);
 void __btrfs_btree_balance_dirty(struct btrfs_root *root, unsigned long nr);
 void btrfs_free_fs_root(struct btrfs_fs_info *fs_info, struct btrfs_root *root);
 void btrfs_mark_buffer_dirty(struct extent_buffer *buf);
-int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid);
+int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid,
+                          int atomic);
 int btrfs_set_buffer_uptodate(struct extent_buffer *buf);
 int btrfs_read_buffer(struct extent_buffer *buf, u64 parent_transid);
 u32 btrfs_csum_data(struct btrfs_root *root, char *data, u32 seed, size_t len);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index a84420491c11..49fd7b66d57b 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -529,9 +529,7 @@ static int cache_block_group(struct btrfs_block_group_cache *cache,
          * allocate blocks for the tree root we can't do the fast caching since
          * we likely hold important locks.
          */
-        if (trans && (!trans->transaction->in_commit) &&
-            (root && root != root->fs_info->tree_root) &&
-            btrfs_test_opt(root, SPACE_CACHE)) {
+        if (fs_info->mount_opt & BTRFS_MOUNT_SPACE_CACHE) {
                 ret = load_free_space_cache(fs_info, cache);
 
                 spin_lock(&cache->lock);
@@ -2303,6 +2301,7 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
 
                                 if (ret) {
                                         printk(KERN_DEBUG "btrfs: run_delayed_extent_op returned %d\n", ret);
+                                        spin_lock(&delayed_refs->lock);
                                         return ret;
                                 }
 
@@ -2333,6 +2332,7 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
 
                 if (ret) {
                         printk(KERN_DEBUG "btrfs: run_one_delayed_ref returned %d\n", ret);
+                        spin_lock(&delayed_refs->lock);
                         return ret;
                 }
 
@@ -3152,15 +3152,14 @@ static void set_avail_alloc_bits(struct btrfs_fs_info *fs_info, u64 flags)
 /*
  * returns target flags in extended format or 0 if restripe for this
  * chunk_type is not in progress
+ *
+ * should be called with either volume_mutex or balance_lock held
  */
 static u64 get_restripe_target(struct btrfs_fs_info *fs_info, u64 flags)
 {
         struct btrfs_balance_control *bctl = fs_info->balance_ctl;
         u64 target = 0;
 
-        BUG_ON(!mutex_is_locked(&fs_info->volume_mutex) &&
-               !spin_is_locked(&fs_info->balance_lock));
-
         if (!bctl)
                 return 0;
 
@@ -3772,13 +3771,10 @@ again:
                  */
                 if (current->journal_info)
                         return -EAGAIN;
-                ret = wait_event_interruptible(space_info->wait,
-                                               !space_info->flush);
-                /* Must have been interrupted, return */
-                if (ret) {
-                        printk(KERN_DEBUG "btrfs: %s returning -EINTR\n", __func__);
+                ret = wait_event_killable(space_info->wait, !space_info->flush);
+                /* Must have been killed, return */
+                if (ret)
                         return -EINTR;
-                }
 
                 spin_lock(&space_info->lock);
         }
@@ -4205,7 +4201,7 @@ static u64 calc_global_metadata_size(struct btrfs_fs_info *fs_info)
         num_bytes += div64_u64(data_used + meta_used, 50);
 
         if (num_bytes * 3 > meta_used)
-                num_bytes = div64_u64(meta_used, 3) * 2;
+                num_bytes = div64_u64(meta_used, 3);
 
         return ALIGN(num_bytes, fs_info->extent_root->leafsize << 10);
 }
@@ -4218,8 +4214,8 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
 
         num_bytes = calc_global_metadata_size(fs_info);
 
-        spin_lock(&block_rsv->lock);
         spin_lock(&sinfo->lock);
+        spin_lock(&block_rsv->lock);
 
         block_rsv->size = num_bytes;
 
@@ -4245,8 +4241,8 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
                 block_rsv->full = 1;
         }
 
-        spin_unlock(&sinfo->lock);
         spin_unlock(&block_rsv->lock);
+        spin_unlock(&sinfo->lock);
 }
 
 static void init_global_block_rsv(struct btrfs_fs_info *fs_info)
@@ -6572,7 +6568,7 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
                         goto skip;
         }
 
-        if (!btrfs_buffer_uptodate(next, generation)) {
+        if (!btrfs_buffer_uptodate(next, generation, 0)) {
                 btrfs_tree_unlock(next);
                 free_extent_buffer(next);
                 next = NULL;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 8d904dd7ea9f..c9018a05036e 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -402,20 +402,28 @@ static int split_state(struct extent_io_tree *tree, struct extent_state *orig,
         return 0;
 }
 
+static struct extent_state *next_state(struct extent_state *state)
+{
+        struct rb_node *next = rb_next(&state->rb_node);
+        if (next)
+                return rb_entry(next, struct extent_state, rb_node);
+        else
+                return NULL;
+}
+
 /*
  * utility function to clear some bits in an extent state struct.
- * it will optionally wake up any one waiting on this state (wake == 1), or
- * forcibly remove the state from the tree (delete == 1).
+ * it will optionally wake up any one waiting on this state (wake == 1)
  *
  * If no bits are set on the state struct after clearing things, the
  * struct is freed and removed from the tree
  */
-static int clear_state_bit(struct extent_io_tree *tree,
-                            struct extent_state *state,
-                            int *bits, int wake)
+static struct extent_state *clear_state_bit(struct extent_io_tree *tree,
+                                            struct extent_state *state,
+                                            int *bits, int wake)
 {
+        struct extent_state *next;
         int bits_to_clear = *bits & ~EXTENT_CTLBITS;
-        int ret = state->state & bits_to_clear;
 
         if ((bits_to_clear & EXTENT_DIRTY) && (state->state & EXTENT_DIRTY)) {
                 u64 range = state->end - state->start + 1;
@@ -427,6 +435,7 @@ static int clear_state_bit(struct extent_io_tree *tree,
         if (wake)
                 wake_up(&state->wq);
         if (state->state == 0) {
+                next = next_state(state);
                 if (state->tree) {
                         rb_erase(&state->rb_node, &tree->state);
                         state->tree = NULL;
@@ -436,8 +445,9 @@ static int clear_state_bit(struct extent_io_tree *tree,
                 }
         } else {
                 merge_state(tree, state);
+                next = next_state(state);
         }
-        return ret;
+        return next;
 }
 
 static struct extent_state *
@@ -476,7 +486,6 @@ int clear_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
         struct extent_state *state;
         struct extent_state *cached;
         struct extent_state *prealloc = NULL;
-        struct rb_node *next_node;
         struct rb_node *node;
         u64 last_end;
         int err;
@@ -528,14 +537,11 @@ hit_next:
         WARN_ON(state->end < start);
         last_end = state->end;
 
-        if (state->end < end && !need_resched())
-                next_node = rb_next(&state->rb_node);
-        else
-                next_node = NULL;
-
         /* the state doesn't have the wanted bits, go ahead */
-        if (!(state->state & bits))
+        if (!(state->state & bits)) {
+                state = next_state(state);
                 goto next;
+        }
 
         /*
          *     | ---- desired range ---- |
@@ -593,16 +599,13 @@ hit_next:
                 goto out;
         }
 
-        clear_state_bit(tree, state, &bits, wake);
+        state = clear_state_bit(tree, state, &bits, wake);
 next:
         if (last_end == (u64)-1)
                 goto out;
         start = last_end + 1;
-        if (start <= end && next_node) {
-                state = rb_entry(next_node, struct extent_state,
-                                 rb_node);
+        if (start <= end && state && !need_resched())
                 goto hit_next;
-        }
         goto search_again;
 
 out:
@@ -1937,7 +1940,7 @@ int repair_eb_io_failure(struct btrfs_root *root, struct extent_buffer *eb,
         struct btrfs_mapping_tree *map_tree = &root->fs_info->mapping_tree;
         u64 start = eb->start;
         unsigned long i, num_pages = num_extent_pages(eb->start, eb->len);
-        int ret;
+        int ret = 0;
 
         for (i = 0; i < num_pages; i++) {
                 struct page *p = extent_buffer_page(eb, i);
@@ -2180,6 +2183,10 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
         }
 
         bio = bio_alloc(GFP_NOFS, 1);
+        if (!bio) {
+                free_io_failure(inode, failrec, 0);
+                return -EIO;
+        }
         bio->bi_private = state;
         bio->bi_end_io = failed_bio->bi_end_io;
         bio->bi_sector = failrec->logical >> 9;
@@ -2297,7 +2304,7 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
         u64 start;
         u64 end;
         int whole_page;
-        int failed_mirror;
+        int mirror;
         int ret;
 
         if (err)
@@ -2336,20 +2343,18 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                 }
                 spin_unlock(&tree->lock);
 
+                mirror = (int)(unsigned long)bio->bi_bdev;
                 if (uptodate && tree->ops && tree->ops->readpage_end_io_hook) {
                         ret = tree->ops->readpage_end_io_hook(page, start, end,
-                                                              state);
+                                                              state, mirror);
                         if (ret)
                                 uptodate = 0;
                         else
                                 clean_io_failure(start, page);
                 }
 
-                if (!uptodate)
-                        failed_mirror = (int)(unsigned long)bio->bi_bdev;
-
                 if (!uptodate && tree->ops && tree->ops->readpage_io_failed_hook) {
-                        ret = tree->ops->readpage_io_failed_hook(page, failed_mirror);
+                        ret = tree->ops->readpage_io_failed_hook(page, mirror);
                         if (!ret && !err &&
                             test_bit(BIO_UPTODATE, &bio->bi_flags))
                                 uptodate = 1;
@@ -2364,8 +2369,7 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                          * can't handle the error it will return -EIO and we
                          * remain responsible for that page.
                          */
-                        ret = bio_readpage_error(bio, page, start, end,
-                                                        failed_mirror, NULL);
+                        ret = bio_readpage_error(bio, page, start, end, mirror, NULL);
                         if (ret == 0) {
                                 uptodate =
                                         test_bit(BIO_UPTODATE, &bio->bi_flags);
@@ -4116,6 +4120,7 @@ struct extent_buffer *alloc_extent_buffer(struct extent_io_tree *tree,
                         if (atomic_inc_not_zero(&exists->refs)) {
                                 spin_unlock(&mapping->private_lock);
                                 unlock_page(p);
+                                page_cache_release(p);
                                 mark_extent_buffer_accessed(exists);
                                 goto free_eb;
                         }
@@ -4195,8 +4200,7 @@ free_eb:
                         unlock_page(eb->pages[i]);
         }
 
-        if (!atomic_dec_and_test(&eb->refs))
-                return exists;
+        WARN_ON(!atomic_dec_and_test(&eb->refs));
         btrfs_release_extent_buffer(eb);
         return exists;
 }
@@ -4458,7 +4462,7 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
         }
 
         clear_bit(EXTENT_BUFFER_IOERR, &eb->bflags);
-        eb->failed_mirror = 0;
+        eb->read_mirror = 0;
         atomic_set(&eb->io_pages, num_reads);
         for (i = start_i; i < num_pages; i++) {
                 page = extent_buffer_page(eb, i);
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index faf10eb57f75..b516c3b8dec6 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -79,7 +79,7 @@ struct extent_io_ops {
                                         u64 start, u64 end,
                                        struct extent_state *state);
         int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
-                                    struct extent_state *state);
+                                    struct extent_state *state, int mirror);
         int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
                                       struct extent_state *state, int uptodate);
         void (*set_bit_hook)(struct inode *inode, struct extent_state *state,
@@ -135,7 +135,7 @@ struct extent_buffer {
         spinlock_t refs_lock;
         atomic_t refs;
         atomic_t io_pages;
-        int failed_mirror;
+        int read_mirror;
         struct list_head leak_list;
         struct rcu_head rcu_head;
         pid_t lock_owner;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index d83260d7498f..53bf2d764bbc 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -567,6 +567,7 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, struct inode *inode,
         int extent_type;
         int recow;
         int ret;
+        int modify_tree = -1;
 
         if (drop_cache)
                 btrfs_drop_extent_cache(inode, start, end - 1, 0);
@@ -575,10 +576,13 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, struct inode *inode,
         if (!path)
                 return -ENOMEM;
 
+        if (start >= BTRFS_I(inode)->disk_i_size)
+                modify_tree = 0;
+
         while (1) {
                 recow = 0;
                 ret = btrfs_lookup_file_extent(trans, root, path, ino,
-                                               search_start, -1);
+                                               search_start, modify_tree);
                 if (ret < 0)
                         break;
                 if (ret > 0 && path->slots[0] > 0 && search_start == start) {
@@ -634,7 +638,8 @@ next_slot:
                 }
 
                 search_start = max(key.offset, start);
-                if (recow) {
+                if (recow || !modify_tree) {
+                        modify_tree = -1;
                         btrfs_release_path(path);
                         continue;
                 }
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index e88330d3df52..202008ec367d 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -748,13 +748,6 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info,
         u64 used = btrfs_block_group_used(&block_group->item);
 
         /*
-         * If we're unmounting then just return, since this does a search on the
-         * normal root and not the commit root and we could deadlock.
-         */
-        if (btrfs_fs_closing(fs_info))
-                return 0;
-
-        /*
          * If this block group has been marked to be cleared for one reason or
          * another then we can't trust the on disk cache, so just return.
          */
@@ -768,6 +761,8 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info,
         path = btrfs_alloc_path();
         if (!path)
                 return 0;
+        path->search_commit_root = 1;
+        path->skip_locking = 1;
 
         inode = lookup_free_space_inode(root, block_group, path);
         if (IS_ERR(inode)) {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 115bc05e42b0..61b16c641ce0 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1947,7 +1947,7 @@ static int btrfs_writepage_end_io_hook(struct page *page, u64 start, u64 end,
  * extent_io.c will try to find good copies for us.
  */
 static int btrfs_readpage_end_io_hook(struct page *page, u64 start, u64 end,
-                               struct extent_state *state)
+                               struct extent_state *state, int mirror)
 {
         size_t offset = start - ((u64)page->index << PAGE_CACHE_SHIFT);
         struct inode *inode = page->mapping->host;
@@ -4069,7 +4069,7 @@ static struct inode *new_simple_dir(struct super_block *s,
         BTRFS_I(inode)->dummy_inode = 1;
 
         inode->i_ino = BTRFS_EMPTY_SUBVOL_DIR_OBJECTID;
-        inode->i_op = &simple_dir_inode_operations;
+        inode->i_op = &btrfs_dir_ro_inode_operations;
         inode->i_fop = &simple_dir_operations;
         inode->i_mode = S_IFDIR | S_IRUGO | S_IWUSR | S_IXUGO;
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
@@ -4140,14 +4140,18 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
 static int btrfs_dentry_delete(const struct dentry *dentry)
 {
         struct btrfs_root *root;
+        struct inode *inode = dentry->d_inode;
 
-        if (!dentry->d_inode && !IS_ROOT(dentry))
-                dentry = dentry->d_parent;
+        if (!inode && !IS_ROOT(dentry))
+                inode = dentry->d_parent->d_inode;
 
-        if (dentry->d_inode) {
-                root = BTRFS_I(dentry->d_inode)->root;
+        if (inode) {
+                root = BTRFS_I(inode)->root;
                 if (btrfs_root_refs(&root->root_item) == 0)
                         return 1;
+
+                if (btrfs_ino(inode) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)
+                        return 1;
         }
         return 0;
 }
@@ -4188,7 +4192,6 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
         struct btrfs_path *path;
         struct list_head ins_list;
         struct list_head del_list;
-        struct qstr q;
         int ret;
         struct extent_buffer *leaf;
         int slot;
@@ -4279,7 +4282,6 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
 
                 while (di_cur < di_total) {
                         struct btrfs_key location;
-                        struct dentry *tmp;
 
                         if (verify_dir_item(root, leaf, di))
                                 break;
@@ -4300,35 +4302,15 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
                         d_type = btrfs_filetype_table[btrfs_dir_type(leaf, di)];
                         btrfs_dir_item_key_to_cpu(leaf, di, &location);
 
-                        q.name = name_ptr;
-                        q.len = name_len;
-                        q.hash = full_name_hash(q.name, q.len);
-                        tmp = d_lookup(filp->f_dentry, &q);
-                        if (!tmp) {
-                                struct btrfs_key *newkey;
-
-                                newkey = kzalloc(sizeof(struct btrfs_key),
-                                                 GFP_NOFS);
-                                if (!newkey)
-                                        goto no_dentry;
-                                tmp = d_alloc(filp->f_dentry, &q);
-                                if (!tmp) {
-                                        kfree(newkey);
-                                        dput(tmp);
-                                        goto no_dentry;
-                                }
-                                memcpy(newkey, &location,
-                                       sizeof(struct btrfs_key));
-                                tmp->d_fsdata = newkey;
-                                tmp->d_flags |= DCACHE_NEED_LOOKUP;
-                                d_rehash(tmp);
-                                dput(tmp);
-                        } else {
-                                dput(tmp);
-                        }
-no_dentry:
+
                         /* is this a reference to our own snapshot? If so
-                         * skip it
+                         * skip it.
+                         *
+                         * In contrast to old kernels, we insert the snapshot's
+                         * dir item and dir index after it has been created, so
+                         * we won't find a reference to our own snapshot. We
+                         * still keep the following code for backward
+                         * compatibility.
                          */
                         if (location.type == BTRFS_ROOT_ITEM_KEY &&
                             location.objectid == root->root_key.objectid) {
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 18cc23d164a8..14f8e1faa46e 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2262,7 +2262,10 @@ static long btrfs_ioctl_dev_info(struct btrfs_root *root, void __user *arg)
         di_args->bytes_used = dev->bytes_used;
         di_args->total_bytes = dev->total_bytes;
         memcpy(di_args->uuid, dev->uuid, sizeof(di_args->uuid));
-        strncpy(di_args->path, dev->name, sizeof(di_args->path));
+        if (dev->name)
+                strncpy(di_args->path, dev->name, sizeof(di_args->path));
+        else
+                di_args->path[0] = '\0';
 
 out:
         if (ret == 0 && copy_to_user(arg, di_args, sizeof(*di_args)))
diff --git a/fs/btrfs/ioctl.h b/fs/btrfs/ioctl.h
index 4f69028a68c4..086e6bdae1c4 100644
--- a/fs/btrfs/ioctl.h
+++ b/fs/btrfs/ioctl.h
@@ -252,7 +252,7 @@ struct btrfs_data_container {
 
 struct btrfs_ioctl_ino_path_args {
         __u64                           inum;           /* in */
-        __u32                           size;           /* in */
+        __u64                           size;           /* in */
         __u64                           reserved[4];
         /* struct btrfs_data_container  *fspath;           out */
         __u64                           fspath;         /* out */
@@ -260,7 +260,7 @@ struct btrfs_ioctl_ino_path_args {
 
 struct btrfs_ioctl_logical_ino_args {
         __u64                           logical;        /* in */
-        __u32                           size;           /* in */
+        __u64                           size;           /* in */
         __u64                           reserved[4];
         /* struct btrfs_data_container  *inodes;        out   */
         __u64                           inodes;
diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index dc5d33146fdb..ac5d01085884 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -250,14 +250,12 @@ static struct reada_zone *reada_find_zone(struct btrfs_fs_info *fs_info,
                                           struct btrfs_bio *bbio)
 {
         int ret;
-        int looped = 0;
         struct reada_zone *zone;
         struct btrfs_block_group_cache *cache = NULL;
         u64 start;
         u64 end;
         int i;
 
-again:
         zone = NULL;
         spin_lock(&fs_info->reada_lock);
         ret = radix_tree_gang_lookup(&dev->reada_zones, (void **)&zone,
@@ -274,9 +272,6 @@ again:
                 spin_unlock(&fs_info->reada_lock);
         }
 
-        if (looped)
-                return NULL;
-
         cache = btrfs_lookup_block_group(fs_info, logical);
         if (!cache)
                 return NULL;
@@ -307,13 +302,15 @@ again:
         ret = radix_tree_insert(&dev->reada_zones,
                                 (unsigned long)(zone->end >> PAGE_CACHE_SHIFT),
                                 zone);
-        spin_unlock(&fs_info->reada_lock);
 
-        if (ret) {
+        if (ret == -EEXIST) {
                 kfree(zone);
-                looped = 1;
-                goto again;
+                ret = radix_tree_gang_lookup(&dev->reada_zones, (void **)&zone,
+                                             logical >> PAGE_CACHE_SHIFT, 1);
+                if (ret == 1)
+                        kref_get(&zone->refcnt);
         }
+        spin_unlock(&fs_info->reada_lock);
 
         return zone;
 }
@@ -323,26 +320,26 @@ static struct reada_extent *reada_find_extent(struct btrfs_root *root,
                                               struct btrfs_key *top, int level)
 {
         int ret;
-        int looped = 0;
         struct reada_extent *re = NULL;
+        struct reada_extent *re_exist = NULL;
         struct btrfs_fs_info *fs_info = root->fs_info;
         struct btrfs_mapping_tree *map_tree = &fs_info->mapping_tree;
         struct btrfs_bio *bbio = NULL;
         struct btrfs_device *dev;
+        struct btrfs_device *prev_dev;
         u32 blocksize;
         u64 length;
         int nzones = 0;
         int i;
         unsigned long index = logical >> PAGE_CACHE_SHIFT;
 
-again:
         spin_lock(&fs_info->reada_lock);
         re = radix_tree_lookup(&fs_info->reada_tree, index);
         if (re)
                 kref_get(&re->refcnt);
         spin_unlock(&fs_info->reada_lock);
 
-        if (re || looped)
+        if (re)
                 return re;
 
         re = kzalloc(sizeof(*re), GFP_NOFS);
@@ -398,16 +395,31 @@ again:
         /* insert extent in reada_tree + all per-device trees, all or nothing */
         spin_lock(&fs_info->reada_lock);
         ret = radix_tree_insert(&fs_info->reada_tree, index, re);
+        if (ret == -EEXIST) {
+                re_exist = radix_tree_lookup(&fs_info->reada_tree, index);
+                BUG_ON(!re_exist);
+                kref_get(&re_exist->refcnt);
+                spin_unlock(&fs_info->reada_lock);
+                goto error;
+        }
         if (ret) {
                 spin_unlock(&fs_info->reada_lock);
-                if (ret != -ENOMEM) {
-                        /* someone inserted the extent in the meantime */
-                        looped = 1;
-                }
                 goto error;
         }
+        prev_dev = NULL;
         for (i = 0; i < nzones; ++i) {
                 dev = bbio->stripes[i].dev;
+                if (dev == prev_dev) {
+                        /*
+                         * in case of DUP, just add the first zone. As both
+                         * are on the same device, there's nothing to gain
+                         * from adding both.
+                         * Also, it wouldn't work, as the tree is per device
+                         * and adding would fail with EEXIST
+                         */
+                        continue;
+                }
+                prev_dev = dev;
                 ret = radix_tree_insert(&dev->reada_extents, index, re);
                 if (ret) {
                         while (--i >= 0) {
@@ -450,9 +462,7 @@ error:
         }
         kfree(bbio);
         kfree(re);
-        if (looped)
-                goto again;
-        return NULL;
+        return re_exist;
 }
 
 static void reada_kref_dummy(struct kref *kr)
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 017281dbb2a7..646ee21bb035 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1279,7 +1279,9 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
                 if (rb_node)
                         backref_tree_panic(rb_node, -EEXIST, node->bytenr);
         } else {
+                spin_lock(&root->fs_info->trans_lock);
                 list_del_init(&root->root_list);
+                spin_unlock(&root->fs_info->trans_lock);
                 kfree(node);
         }
         return 0;
@@ -3811,7 +3813,7 @@ restart:
 
                 ret = btrfs_block_rsv_check(rc->extent_root, rc->block_rsv, 5);
                 if (ret < 0) {
-                        if (ret != -EAGAIN) {
+                        if (ret != -ENOSPC) {
                                 err = ret;
                                 WARN_ON(1);
                                 break;
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 90acc82046c3..2f3d6f917fb3 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -998,6 +998,7 @@ static int scrub_setup_recheck_block(struct scrub_dev *sdev,
                         page = sblock->pagev + page_index;
                         page->logical = logical;
                         page->physical = bbio->stripes[mirror_index].physical;
+                        /* for missing devices, bdev is NULL */
                         page->bdev = bbio->stripes[mirror_index].dev->bdev;
                         page->mirror_num = mirror_index + 1;
                         page->page = alloc_page(GFP_NOFS);
@@ -1042,8 +1043,16 @@ static int scrub_recheck_block(struct btrfs_fs_info *fs_info,
                 struct scrub_page *page = sblock->pagev + page_num;
                 DECLARE_COMPLETION_ONSTACK(complete);
 
+                if (page->bdev == NULL) {
+                        page->io_error = 1;
+                        sblock->no_io_error_seen = 0;
+                        continue;
+                }
+
                 BUG_ON(!page->page);
                 bio = bio_alloc(GFP_NOFS, 1);
+                if (!bio)
+                        return -EIO;
                 bio->bi_bdev = page->bdev;
                 bio->bi_sector = page->physical >> 9;
                 bio->bi_end_io = scrub_complete_bio_end_io;
@@ -1171,6 +1180,8 @@ static int scrub_repair_page_from_good_copy(struct scrub_block *sblock_bad,
                 DECLARE_COMPLETION_ONSTACK(complete);
 
                 bio = bio_alloc(GFP_NOFS, 1);
+                if (!bio)
+                        return -EIO;
                 bio->bi_bdev = page_bad->bdev;
                 bio->bi_sector = page_bad->physical >> 9;
                 bio->bi_end_io = scrub_complete_bio_end_io;
@@ -1253,12 +1264,6 @@ static int scrub_checksum_data(struct scrub_block *sblock)
         if (memcmp(csum, on_disk_csum, sdev->csum_size))
                 fail = 1;
 
-        if (fail) {
-                spin_lock(&sdev->stat_lock);
-                ++sdev->stat.csum_errors;
-                spin_unlock(&sdev->stat_lock);
-        }
-
         return fail;
 }
 
@@ -1331,15 +1336,6 @@ static int scrub_checksum_tree_block(struct scrub_block *sblock)
         if (memcmp(calculated_csum, on_disk_csum, sdev->csum_size))
                 ++crc_fail;
 
-        if (crc_fail || fail) {
-                spin_lock(&sdev->stat_lock);
-                if (crc_fail)
-                        ++sdev->stat.csum_errors;
-                if (fail)
-                        ++sdev->stat.verify_errors;
-                spin_unlock(&sdev->stat_lock);
-        }
-
         return fail || crc_fail;
 }
 
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 8d5d380f7bdb..c5f8fca4195f 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -815,7 +815,6 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
                 return 0;
         }
 
-        btrfs_start_delalloc_inodes(root, 0);
         btrfs_wait_ordered_extents(root, 0, 0);
 
         trans = btrfs_start_transaction(root, 0);
@@ -1148,13 +1147,15 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                 if (ret)
                         goto restore;
         } else {
-                if (fs_info->fs_devices->rw_devices == 0)
+                if (fs_info->fs_devices->rw_devices == 0) {
                         ret = -EACCES;
                         goto restore;
+                }
 
-                if (btrfs_super_log_root(fs_info->super_copy) != 0)
+                if (btrfs_super_log_root(fs_info->super_copy) != 0) {
                         ret = -EINVAL;
                         goto restore;
+                }
 
                 ret = btrfs_cleanup_fs_roots(fs_info);
                 if (ret)
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 8da29e8e4de1..36422254ef67 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -73,8 +73,10 @@ loop:
 
         cur_trans = root->fs_info->running_transaction;
         if (cur_trans) {
-                if (cur_trans->aborted)
+                if (cur_trans->aborted) {
+                        spin_unlock(&root->fs_info->trans_lock);
                         return cur_trans->aborted;
+                }
                 atomic_inc(&cur_trans->use_count);
                 atomic_inc(&cur_trans->num_writers);
                 cur_trans->num_joined++;
@@ -480,6 +482,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
         struct btrfs_transaction *cur_trans = trans->transaction;
         struct btrfs_fs_info *info = root->fs_info;
         int count = 0;
+        int err = 0;
 
         if (--trans->use_count) {
                 trans->block_rsv = trans->orig_rsv;
@@ -532,18 +535,18 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
 
         if (current->journal_info == trans)
                 current->journal_info = NULL;
-        memset(trans, 0, sizeof(*trans));
-        kmem_cache_free(btrfs_trans_handle_cachep, trans);
 
         if (throttle)
                 btrfs_run_delayed_iputs(root);
 
         if (trans->aborted ||
             root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
-                return -EIO;
+                err = -EIO;
         }
 
-        return 0;
+        memset(trans, 0, sizeof(*trans));
+        kmem_cache_free(btrfs_trans_handle_cachep, trans);
+        return err;
 }
 
 int btrfs_end_transaction(struct btrfs_trans_handle *trans,
@@ -1399,6 +1402,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         ret = commit_fs_roots(trans, root);
         if (ret) {
                 mutex_unlock(&root->fs_info->tree_log_mutex);
+                mutex_unlock(&root->fs_info->reloc_mutex);
                 goto cleanup_transaction;
         }
 
@@ -1410,6 +1414,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         ret = commit_cowonly_roots(trans, root);
         if (ret) {
                 mutex_unlock(&root->fs_info->tree_log_mutex);
+                mutex_unlock(&root->fs_info->reloc_mutex);
                 goto cleanup_transaction;
         }
 
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index d017283ae6f5..eb1ae908582c 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -279,7 +279,7 @@ static int process_one_buffer(struct btrfs_root *log,
                                                 log->fs_info->extent_root,
                                                 eb->start, eb->len);
 
-        if (btrfs_buffer_uptodate(eb, gen)) {
+        if (btrfs_buffer_uptodate(eb, gen, 0)) {
                 if (wc->write)
                         btrfs_write_tree_block(eb);
                 if (wc->wait)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index a872b48be0ae..1411b99555a4 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3324,12 +3324,14 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
         stripe_size = devices_info[ndevs-1].max_avail;
         num_stripes = ndevs * dev_stripes;
 
-        if (stripe_size * num_stripes > max_chunk_size * ncopies) {
+        if (stripe_size * ndevs > max_chunk_size * ncopies) {
                 stripe_size = max_chunk_size * ncopies;
-                do_div(stripe_size, num_stripes);
+                do_div(stripe_size, ndevs);
         }
 
         do_div(stripe_size, dev_stripes);
+
+        /* align to BTRFS_STRIPE_LEN */
         do_div(stripe_size, BTRFS_STRIPE_LEN);
         stripe_size *= BTRFS_STRIPE_LEN;
 
@@ -3805,10 +3807,11 @@ static int __btrfs_map_block(struct btrfs_mapping_tree *map_tree, int rw,
                 else if (mirror_num)
                         stripe_index += mirror_num - 1;
                 else {
+                        int old_stripe_index = stripe_index;
                         stripe_index = find_live_mirror(map, stripe_index,
                                               map->sub_stripes, stripe_index +
                                               current->pid % map->sub_stripes);
-                        mirror_num = stripe_index + 1;
+                        mirror_num = stripe_index - old_stripe_index + 1;
                 }
         } else {
                 /*
@@ -3833,6 +3836,7 @@ static int __btrfs_map_block(struct btrfs_mapping_tree *map_tree, int rw,
                 int sub_stripes = 0;
                 u64 stripes_per_dev = 0;
                 u32 remaining_stripes = 0;
+                u32 last_stripe = 0;
 
                 if (map->type &
                     (BTRFS_BLOCK_GROUP_RAID0 | BTRFS_BLOCK_GROUP_RAID10)) {
@@ -3846,6 +3850,8 @@ static int __btrfs_map_block(struct btrfs_mapping_tree *map_tree, int rw,
                                                       stripe_nr_orig,
                                                       factor,
                                                       &remaining_stripes);
+                        div_u64_rem(stripe_nr_end - 1, factor, &last_stripe);
+                        last_stripe *= sub_stripes;
                 }
 
                 for (i = 0; i < num_stripes; i++) {
@@ -3858,16 +3864,29 @@ static int __btrfs_map_block(struct btrfs_mapping_tree *map_tree, int rw,
                                          BTRFS_BLOCK_GROUP_RAID10)) {
                                 bbio->stripes[i].length = stripes_per_dev *
                                                           map->stripe_len;
+
                                 if (i / sub_stripes < remaining_stripes)
                                         bbio->stripes[i].length +=
                                                 map->stripe_len;
+
+                                /*
+                                 * Special for the first stripe and
+                                 * the last stripe:
+                                 *
+                                 * |-------|...|-------|
+                                 *     |----------|
+                                 *    off     end_off
+                                 */
                                 if (i < sub_stripes)
                                         bbio->stripes[i].length -=
                                                 stripe_offset;
-                                if ((i / sub_stripes + 1) %
-                                    sub_stripes == remaining_stripes)
+
+                                if (stripe_index >= last_stripe &&
+                                    stripe_index <= (last_stripe +
+                                                     sub_stripes - 1))
                                         bbio->stripes[i].length -=
                                                 stripe_end_offset;
+
                                 if (i == sub_stripes - 1)
                                         stripe_offset = 0;
                         } else
@@ -4334,8 +4353,10 @@ static int open_seed_devices(struct btrfs_root *root, u8 *fsid)
 
         ret = __btrfs_open_devices(fs_devices, FMODE_READ,
                                    root->fs_info->bdev_holder);
-        if (ret)
+        if (ret) {
+                free_fs_devices(fs_devices);
                 goto out;
+        }
 
         if (!fs_devices->seeding) {
                 __btrfs_close_devices(fs_devices);
diff --git a/fs/buffer.c b/fs/buffer.c
index 36d66653b931..351e18ea2e53 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -985,7 +985,6 @@ grow_dev_page(struct block_device *bdev, sector_t block,
         return page;
 
 failed:
-        BUG();
         unlock_page(page);
         page_cache_release(page);
         return NULL;
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index d34212822444..ca6a3796a33b 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -370,13 +370,13 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
                                    (int)(srcaddr->sa_family));
         }
 
-        seq_printf(s, ",uid=%d", cifs_sb->mnt_uid);
+        seq_printf(s, ",uid=%u", cifs_sb->mnt_uid);
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_UID)
                 seq_printf(s, ",forceuid");
         else
                 seq_printf(s, ",noforceuid");
 
-        seq_printf(s, ",gid=%d", cifs_sb->mnt_gid);
+        seq_printf(s, ",gid=%u", cifs_sb->mnt_gid);
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID)
                 seq_printf(s, ",forcegid");
         else
@@ -434,11 +434,15 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
                 seq_printf(s, ",noperm");
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_STRICT_IO)
                 seq_printf(s, ",strictcache");
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_BACKUPUID)
+                seq_printf(s, ",backupuid=%u", cifs_sb->mnt_backupuid);
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_BACKUPGID)
+                seq_printf(s, ",backupgid=%u", cifs_sb->mnt_backupgid);
 
-        seq_printf(s, ",rsize=%d", cifs_sb->rsize);
-        seq_printf(s, ",wsize=%d", cifs_sb->wsize);
+        seq_printf(s, ",rsize=%u", cifs_sb->rsize);
+        seq_printf(s, ",wsize=%u", cifs_sb->wsize);
         /* convert actimeo and display it in seconds */
-                seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ);
+        seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ);
 
         return 0;
 }
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index d1389bb33ceb..65365358c976 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -125,5 +125,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "1.77"
+#define CIFS_VERSION   "1.78"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index f52c5ab78f9d..da2f5446fa7a 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4844,8 +4844,12 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 max_len = data_end - temp;
                 node->node_name = cifs_strndup_from_utf16(temp, max_len,
                                                 is_unicode, nls_codepage);
-                if (!node->node_name)
+                if (!node->node_name) {
                         rc = -ENOMEM;
+                        goto parse_DFS_referrals_exit;
+                }
+
+                ref++;
         }
 
 parse_DFS_referrals_exit:
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index d81e933a796b..5dcc55197fb3 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -109,6 +109,8 @@ enum {
 
         /* Options which could be blank */
         Opt_blank_pass,
+        Opt_blank_user,
+        Opt_blank_ip,
 
         Opt_err
 };
@@ -183,11 +185,15 @@ static const match_table_t cifs_mount_option_tokens = {
         { Opt_wsize, "wsize=%s" },
         { Opt_actimeo, "actimeo=%s" },
 
+        { Opt_blank_user, "user=" },
+        { Opt_blank_user, "username=" },
         { Opt_user, "user=%s" },
         { Opt_user, "username=%s" },
         { Opt_blank_pass, "pass=" },
         { Opt_pass, "pass=%s" },
         { Opt_pass, "password=%s" },
+        { Opt_blank_ip, "ip=" },
+        { Opt_blank_ip, "addr=" },
         { Opt_ip, "ip=%s" },
         { Opt_ip, "addr=%s" },
         { Opt_unc, "unc=%s" },
@@ -209,6 +215,8 @@ static const match_table_t cifs_mount_option_tokens = {
 
         { Opt_ignore, "cred" },
         { Opt_ignore, "credentials" },
+        { Opt_ignore, "cred=%s" },
+        { Opt_ignore, "credentials=%s" },
         { Opt_ignore, "guest" },
         { Opt_ignore, "rw" },
         { Opt_ignore, "ro" },
@@ -1117,7 +1125,7 @@ static int get_option_ul(substring_t args[], unsigned long *option)
         string = match_strdup(args);
         if (string == NULL)
                 return -ENOMEM;
-        rc = kstrtoul(string, 10, option);
+        rc = kstrtoul(string, 0, option);
         kfree(string);
 
         return rc;
@@ -1534,15 +1542,17 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
 
                 /* String Arguments */
 
+                case Opt_blank_user:
+                        /* null user, ie. anonymous authentication */
+                        vol->nullauth = 1;
+                        vol->username = NULL;
+                        break;
                 case Opt_user:
                         string = match_strdup(args);
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                /* null user, ie. anonymous authentication */
-                                vol->nullauth = 1;
-                        } else if (strnlen(string, MAX_USERNAME_SIZE) >
+                        if (strnlen(string, MAX_USERNAME_SIZE) >
                                                         MAX_USERNAME_SIZE) {
                                 printk(KERN_WARNING "CIFS: username too long\n");
                                 goto cifs_parse_mount_err;
@@ -1611,14 +1621,15 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         }
                         vol->password[j] = '\0';
                         break;
+                case Opt_blank_ip:
+                        vol->UNCip = NULL;
+                        break;
                 case Opt_ip:
                         string = match_strdup(args);
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                vol->UNCip = NULL;
-                        } else if (strnlen(string, INET6_ADDRSTRLEN) >
+                        if (strnlen(string, INET6_ADDRSTRLEN) >
                                                 INET6_ADDRSTRLEN) {
                                 printk(KERN_WARNING "CIFS: ip address "
                                                     "too long\n");
@@ -1636,12 +1647,6 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                printk(KERN_WARNING "CIFS: invalid path to "
-                                                    "network resource\n");
-                                goto cifs_parse_mount_err;
-                        }
-
                         temp_len = strnlen(string, 300);
                         if (temp_len  == 300) {
                                 printk(KERN_WARNING "CIFS: UNC name too long\n");
@@ -1670,11 +1675,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                printk(KERN_WARNING "CIFS: invalid domain"
-                                                    " name\n");
-                                goto cifs_parse_mount_err;
-                        } else if (strnlen(string, 256) == 256) {
+                        if (strnlen(string, 256) == 256) {
                                 printk(KERN_WARNING "CIFS: domain name too"
                                                     " long\n");
                                 goto cifs_parse_mount_err;
@@ -1693,11 +1694,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                printk(KERN_WARNING "CIFS: srcaddr value not"
-                                                    " specified\n");
-                                goto cifs_parse_mount_err;
-                        } else if (!cifs_convert_address(
+                        if (!cifs_convert_address(
                                         (struct sockaddr *)&vol->srcaddr,
                                         string, strlen(string))) {
                                 printk(KERN_WARNING "CIFS:  Could not parse"
@@ -1710,11 +1707,6 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                printk(KERN_WARNING "CIFS: Invalid path"
-                                                    " prefix\n");
-                                goto cifs_parse_mount_err;
-                        }
                         temp_len = strnlen(string, 1024);
                         if (string[0] != '/')
                                 temp_len++; /* missing leading slash */
@@ -1742,11 +1734,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                printk(KERN_WARNING "CIFS: Invalid iocharset"
-                                                    " specified\n");
-                                goto cifs_parse_mount_err;
-                        } else if (strnlen(string, 1024) >= 65) {
+                        if (strnlen(string, 1024) >= 65) {
                                 printk(KERN_WARNING "CIFS: iocharset name "
                                                     "too long.\n");
                                 goto cifs_parse_mount_err;
@@ -1771,11 +1759,6 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                printk(KERN_WARNING "CIFS: No socket option"
-                                                    " specified\n");
-                                goto cifs_parse_mount_err;
-                        }
                         if (strnicmp(string, "TCP_NODELAY", 11) == 0)
                                 vol->sockopt_tcp_nodelay = 1;
                         break;
@@ -1784,12 +1767,6 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                printk(KERN_WARNING "CIFS: Invalid (empty)"
-                                                    " netbiosname\n");
-                                break;
-                        }
-
                         memset(vol->source_rfc1001_name, 0x20,
                                 RFC1001_NAME_LEN);
                         /*
@@ -1817,11 +1794,6 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                printk(KERN_WARNING "CIFS: Empty server"
-                                        " netbiosname specified\n");
-                                break;
-                        }
                         /* last byte, type, is 0x20 for servr type */
                         memset(vol->target_rfc1001_name, 0x20,
                                 RFC1001_NAME_LEN_WITH_NULL);
@@ -1848,12 +1820,6 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                cERROR(1, "no protocol version specified"
-                                          " after vers= mount option");
-                                goto cifs_parse_mount_err;
-                        }
-
                         if (strnicmp(string, "cifs", 4) == 0 ||
                             strnicmp(string, "1", 1) == 0) {
                                 /* This is the default */
@@ -1868,12 +1834,6 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (!*string) {
-                                printk(KERN_WARNING "CIFS: no security flavor"
-                                                    " specified\n");
-                                break;
-                        }
-
                         if (cifs_parse_security_flavors(string, vol) != 0)
                                 goto cifs_parse_mount_err;
                         break;
@@ -2225,6 +2185,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
         tcp_ses->session_estab = false;
         tcp_ses->sequence_number = 0;
         tcp_ses->lstrp = jiffies;
+        spin_lock_init(&tcp_ses->req_lock);
         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
@@ -3270,10 +3231,6 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 
         cifs_sb->mnt_uid = pvolume_info->linux_uid;
         cifs_sb->mnt_gid = pvolume_info->linux_gid;
-        if (pvolume_info->backupuid_specified)
-                cifs_sb->mnt_backupuid = pvolume_info->backupuid;
-        if (pvolume_info->backupgid_specified)
-                cifs_sb->mnt_backupgid = pvolume_info->backupgid;
         cifs_sb->mnt_file_mode = pvolume_info->file_mode;
         cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
         cFYI(1, "file mode: 0x%hx  dir mode: 0x%hx",
@@ -3304,10 +3261,14 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_RWPIDFORWARD;
         if (pvolume_info->cifs_acl)
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
-        if (pvolume_info->backupuid_specified)
+        if (pvolume_info->backupuid_specified) {
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPUID;
-        if (pvolume_info->backupgid_specified)
+                cifs_sb->mnt_backupuid = pvolume_info->backupuid;
+        }
+        if (pvolume_info->backupgid_specified) {
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPGID;
+                cifs_sb->mnt_backupgid = pvolume_info->backupgid;
+        }
         if (pvolume_info->override_uid)
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
         if (pvolume_info->override_gid)
@@ -3656,22 +3617,6 @@ cifs_get_volume_info(char *mount_data, const char *devname)
         return volume_info;
 }
 
-/* make sure ra_pages is a multiple of rsize */
-static inline unsigned int
-cifs_ra_pages(struct cifs_sb_info *cifs_sb)
-{
-        unsigned int reads;
-        unsigned int rsize_pages = cifs_sb->rsize / PAGE_CACHE_SIZE;
-
-        if (rsize_pages >= default_backing_dev_info.ra_pages)
-                return default_backing_dev_info.ra_pages;
-        else if (rsize_pages == 0)
-                return rsize_pages;
-
-        reads = default_backing_dev_info.ra_pages / rsize_pages;
-        return reads * rsize_pages;
-}
-
 int
 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
 {
@@ -3759,7 +3704,7 @@ try_mount_again:
         cifs_sb->rsize = cifs_negotiate_rsize(tcon, volume_info);
 
         /* tune readahead according to rsize */
-        cifs_sb->bdi.ra_pages = cifs_ra_pages(cifs_sb);
+        cifs_sb->bdi.ra_pages = cifs_sb->rsize / PAGE_CACHE_SIZE;
 
 remote_path_check:
 #ifdef CONFIG_CIFS_DFS_UPCALL
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index d172c8ed9017..ec4e9a2a12f8 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -668,12 +668,19 @@ cifs_d_revalidate(struct dentry *direntry, struct nameidata *nd)
                         return 0;
                 else {
                         /*
-                         * Forcibly invalidate automounting directory inodes
-                         * (remote DFS directories) so to have them
-                         * instantiated again for automount
+                         * If the inode wasn't known to be a dfs entry when
+                         * the dentry was instantiated, such as when created
+                         * via ->readdir(), it needs to be set now since the
+                         * attributes will have been updated by
+                         * cifs_revalidate_dentry().
                          */
-                        if (IS_AUTOMOUNT(direntry->d_inode))
-                                return 0;
+                        if (IS_AUTOMOUNT(direntry->d_inode) &&
+                           !(direntry->d_flags & DCACHE_NEED_AUTOMOUNT)) {
+                                spin_lock(&direntry->d_lock);
+                                direntry->d_flags |= DCACHE_NEED_AUTOMOUNT;
+                                spin_unlock(&direntry->d_lock);
+                        }
+
                         return 1;
                 }
         }
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index fae765dac934..81725e9286e9 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2178,7 +2178,7 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
         unsigned long nr_pages, i;
         size_t copied, len, cur_len;
         ssize_t total_written = 0;
-        loff_t offset = *poffset;
+        loff_t offset;
         struct iov_iter it;
         struct cifsFileInfo *open_file;
         struct cifs_tcon *tcon;
@@ -2200,6 +2200,7 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
         cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
         open_file = file->private_data;
         tcon = tlink_tcon(open_file->tlink);
+        offset = *poffset;
 
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_RWPIDFORWARD)
                 pid = open_file->pid;
diff --git a/fs/dcache.c b/fs/dcache.c
index b60ddc41d783..b80531c91779 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -141,18 +141,29 @@ int proc_nr_dentry(ctl_table *table, int write, void __user *buffer,
  * Compare 2 name strings, return 0 if they match, otherwise non-zero.
  * The strings are both count bytes long, and count is non-zero.
  */
+#ifdef CONFIG_DCACHE_WORD_ACCESS
+
+#include <asm/word-at-a-time.h>
+/*
+ * NOTE! 'cs' and 'scount' come from a dentry, so it has a
+ * aligned allocation for this particular component. We don't
+ * strictly need the load_unaligned_zeropad() safety, but it
+ * doesn't hurt either.
+ *
+ * In contrast, 'ct' and 'tcount' can be from a pathname, and do
+ * need the careful unaligned handling.
+ */
 static inline int dentry_cmp(const unsigned char *cs, size_t scount,
                                 const unsigned char *ct, size_t tcount)
 {
-#ifdef CONFIG_DCACHE_WORD_ACCESS
         unsigned long a,b,mask;
 
         if (unlikely(scount != tcount))
                 return 1;
 
         for (;;) {
-                a = *(unsigned long *)cs;
-                b = *(unsigned long *)ct;
+                a = load_unaligned_zeropad(cs);
+                b = load_unaligned_zeropad(ct);
                 if (tcount < sizeof(unsigned long))
                         break;
                 if (unlikely(a != b))
@@ -165,7 +176,13 @@ static inline int dentry_cmp(const unsigned char *cs, size_t scount,
         }
         mask = ~(~0ul << tcount*8);
         return unlikely(!!((a ^ b) & mask));
+}
+
 #else
+
+static inline int dentry_cmp(const unsigned char *cs, size_t scount,
+                                const unsigned char *ct, size_t tcount)
+{
         if (scount != tcount)
                 return 1;
 
@@ -177,9 +194,10 @@ static inline int dentry_cmp(const unsigned char *cs, size_t scount,
                 tcount--;
         } while (tcount);
         return 0;
-#endif
 }
 
+#endif
+
 static void __d_free(struct rcu_head *head)
 {
         struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index fa5c07d51dcc..4c58d4a3adc4 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -1737,6 +1737,18 @@ static int _can_be_granted(struct dlm_rsb *r, struct dlm_lkb *lkb, int now)
                 return 1;
 
         /*
+         * Even if the convert is compat with all granted locks,
+         * QUECVT forces it behind other locks on the convert queue.
+         */
+
+        if (now && conv && (lkb->lkb_exflags & DLM_LKF_QUECVT)) {
+                if (list_empty(&r->res_convertqueue))
+                        return 1;
+                else
+                        goto out;
+        }
+
+        /*
          * The NOORDER flag is set to avoid the standard vms rules on grant
          * order.
          */
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 739b0985b398..c0b3c70ee87a 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1663,8 +1663,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
         if (op == EPOLL_CTL_ADD) {
                 if (is_file_epoll(tfile)) {
                         error = -ELOOP;
-                        if (ep_loop_check(ep, tfile) != 0)
+                        if (ep_loop_check(ep, tfile) != 0) {
+                                clear_tfile_check_list();
                                 goto error_tgt_fput;
+                        }
                 } else
                         list_add(&tfile->f_tfile_llink, &tfile_check_list);
         }
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index ab2594a30f86..0e01e90add8b 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1203,9 +1203,6 @@ struct ext4_sb_info {
         unsigned long s_ext_blocks;
         unsigned long s_ext_extents;
 #endif
-        /* ext4 extent cache stats */
-        unsigned long extent_cache_hits;
-        unsigned long extent_cache_misses;
 
         /* for buddy allocator */
         struct ext4_group_info ***s_group_info;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 1421938e6792..abcdeab67f52 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2066,10 +2066,6 @@ static int ext4_ext_check_cache(struct inode *inode, ext4_lblk_t block,
                 ret = 1;
         }
 errout:
-        if (!ret)
-                sbi->extent_cache_misses++;
-        else
-                sbi->extent_cache_hits++;
         trace_ext4_ext_in_cache(inode, block, ret);
         spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
         return ret;
@@ -2882,7 +2878,7 @@ static int ext4_split_extent_at(handle_t *handle,
                 if (err)
                         goto fix_extent_len;
                 /* update the extent length and mark as initialized */
-                ex->ee_len = cpu_to_le32(ee_len);
+                ex->ee_len = cpu_to_le16(ee_len);
                 ext4_ext_try_to_merge(inode, path, ex);
                 err = ext4_ext_dirty(handle, inode, path + depth);
                 goto out;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index ceebaf853beb..e1fb1d5de58e 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1305,20 +1305,20 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
                 ext4_msg(sb, KERN_ERR,
                         "Cannot change journaled "
                         "quota options when quota turned on");
-                return 0;
+                return -1;
         }
         qname = match_strdup(args);
         if (!qname) {
                 ext4_msg(sb, KERN_ERR,
                         "Not enough memory for storing quotafile name");
-                return 0;
+                return -1;
         }
         if (sbi->s_qf_names[qtype] &&
                 strcmp(sbi->s_qf_names[qtype], qname)) {
                 ext4_msg(sb, KERN_ERR,
                         "%s quota file already specified", QTYPE2NAME(qtype));
                 kfree(qname);
-                return 0;
+                return -1;
         }
         sbi->s_qf_names[qtype] = qname;
         if (strchr(sbi->s_qf_names[qtype], '/')) {
@@ -1326,7 +1326,7 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
                         "quotafile must be on filesystem root");
                 kfree(sbi->s_qf_names[qtype]);
                 sbi->s_qf_names[qtype] = NULL;
-                return 0;
+                return -1;
         }
         set_opt(sb, QUOTA);
         return 1;
@@ -1341,7 +1341,7 @@ static int clear_qf_name(struct super_block *sb, int qtype)
                 sbi->s_qf_names[qtype]) {
                 ext4_msg(sb, KERN_ERR, "Cannot change journaled quota options"
                         " when quota turned on");
-                return 0;
+                return -1;
         }
         /*
          * The space will be released later when all options are confirmed
@@ -1450,6 +1450,16 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
         const struct mount_opts *m;
         int arg = 0;
 
+#ifdef CONFIG_QUOTA
+        if (token == Opt_usrjquota)
+                return set_qf_name(sb, USRQUOTA, &args[0]);
+        else if (token == Opt_grpjquota)
+                return set_qf_name(sb, GRPQUOTA, &args[0]);
+        else if (token == Opt_offusrjquota)
+                return clear_qf_name(sb, USRQUOTA);
+        else if (token == Opt_offgrpjquota)
+                return clear_qf_name(sb, GRPQUOTA);
+#endif
         if (args->from && match_int(args, &arg))
                 return -1;
         switch (token) {
@@ -1549,18 +1559,6 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
                                 sbi->s_mount_opt |= m->mount_opt;
                         }
 #ifdef CONFIG_QUOTA
-                } else if (token == Opt_usrjquota) {
-                        if (!set_qf_name(sb, USRQUOTA, &args[0]))
-                                return -1;
-                } else if (token == Opt_grpjquota) {
-                        if (!set_qf_name(sb, GRPQUOTA, &args[0]))
-                                return -1;
-                } else if (token == Opt_offusrjquota) {
-                        if (!clear_qf_name(sb, USRQUOTA))
-                                return -1;
-                } else if (token == Opt_offgrpjquota) {
-                        if (!clear_qf_name(sb, GRPQUOTA))
-                                return -1;
                 } else if (m->flags & MOPT_QFMT) {
                         if (sb_any_quota_loaded(sb) &&
                             sbi->s_jquota_fmt != m->mount_opt) {
@@ -1599,7 +1597,9 @@ static int parse_options(char *options, struct super_block *sb,
                          unsigned int *journal_ioprio,
                          int is_remount)
 {
+#ifdef CONFIG_QUOTA
         struct ext4_sb_info *sbi = EXT4_SB(sb);
+#endif
         char *p;
         substring_t args[MAX_OPT_ARGS];
         int token;
@@ -2366,18 +2366,6 @@ static ssize_t lifetime_write_kbytes_show(struct ext4_attr *a,
                           EXT4_SB(sb)->s_sectors_written_start) >> 1)));
 }
 
-static ssize_t extent_cache_hits_show(struct ext4_attr *a,
-                                      struct ext4_sb_info *sbi, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%lu\n", sbi->extent_cache_hits);
-}
-
-static ssize_t extent_cache_misses_show(struct ext4_attr *a,
-                                        struct ext4_sb_info *sbi, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%lu\n", sbi->extent_cache_misses);
-}
-
 static ssize_t inode_readahead_blks_store(struct ext4_attr *a,
                                           struct ext4_sb_info *sbi,
                                           const char *buf, size_t count)
@@ -2435,8 +2423,6 @@ static struct ext4_attr ext4_attr_##name = __ATTR(name, mode, show, store)
 EXT4_RO_ATTR(delayed_allocation_blocks);
 EXT4_RO_ATTR(session_write_kbytes);
 EXT4_RO_ATTR(lifetime_write_kbytes);
-EXT4_RO_ATTR(extent_cache_hits);
-EXT4_RO_ATTR(extent_cache_misses);
 EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, sbi_ui_show,
                  inode_readahead_blks_store, s_inode_readahead_blks);
 EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal);
@@ -2452,8 +2438,6 @@ static struct attribute *ext4_attrs[] = {
         ATTR_LIST(delayed_allocation_blocks),
         ATTR_LIST(session_write_kbytes),
         ATTR_LIST(lifetime_write_kbytes),
-        ATTR_LIST(extent_cache_hits),
-        ATTR_LIST(extent_cache_misses),
         ATTR_LIST(inode_readahead_blks),
         ATTR_LIST(inode_goal),
         ATTR_LIST(mb_stats),
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 206632887bb4..df5ac048dc74 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -387,9 +387,6 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry,
         if (fc->no_create)
                 return -ENOSYS;
 
-        if (flags & O_DIRECT)
-                return -EINVAL;
-
         forget = fuse_alloc_forget();
         if (!forget)
                 return -ENOMEM;
@@ -644,13 +641,12 @@ static int fuse_unlink(struct inode *dir, struct dentry *entry)
         fuse_put_request(fc, req);
         if (!err) {
                 struct inode *inode = entry->d_inode;
+                struct fuse_inode *fi = get_fuse_inode(inode);
 
-                /*
-                 * Set nlink to zero so the inode can be cleared, if the inode
-                 * does have more links this will be discovered at the next
-                 * lookup/getattr.
-                 */
-                clear_nlink(inode);
+                spin_lock(&fc->lock);
+                fi->attr_version = ++fc->attr_version;
+                drop_nlink(inode);
+                spin_unlock(&fc->lock);
                 fuse_invalidate_attr(inode);
                 fuse_invalidate_attr(dir);
                 fuse_invalidate_entry_cache(entry);
@@ -762,8 +758,17 @@ static int fuse_link(struct dentry *entry, struct inode *newdir,
            will reflect changes in the backing inode (link count,
            etc.)
         */
-        if (!err || err == -EINTR)
+        if (!err) {
+                struct fuse_inode *fi = get_fuse_inode(inode);
+
+                spin_lock(&fc->lock);
+                fi->attr_version = ++fc->attr_version;
+                inc_nlink(inode);
+                spin_unlock(&fc->lock);
+                fuse_invalidate_attr(inode);
+        } else if (err == -EINTR) {
                 fuse_invalidate_attr(inode);
+        }
         return err;
 }
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a841868bf9ce..504e61b7fd75 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -194,10 +194,6 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
         struct fuse_conn *fc = get_fuse_conn(inode);
         int err;
 
-        /* VFS checks this, but only _after_ ->open() */
-        if (file->f_flags & O_DIRECT)
-                return -EINVAL;
-
         err = generic_file_open(inode, file);
         if (err)
                 return err;
@@ -932,17 +928,23 @@ static ssize_t fuse_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         struct file *file = iocb->ki_filp;
         struct address_space *mapping = file->f_mapping;
         size_t count = 0;
+        size_t ocount = 0;
         ssize_t written = 0;
+        ssize_t written_buffered = 0;
         struct inode *inode = mapping->host;
         ssize_t err;
         struct iov_iter i;
+        loff_t endbyte = 0;
 
         WARN_ON(iocb->ki_pos != pos);
 
-        err = generic_segment_checks(iov, &nr_segs, &count, VERIFY_READ);
+        ocount = 0;
+        err = generic_segment_checks(iov, &nr_segs, &ocount, VERIFY_READ);
         if (err)
                 return err;
 
+        count = ocount;
+
         mutex_lock(&inode->i_mutex);
         vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
 
@@ -962,11 +964,41 @@ static ssize_t fuse_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
 
         file_update_time(file);
 
-        iov_iter_init(&i, iov, nr_segs, count, 0);
-        written = fuse_perform_write(file, mapping, &i, pos);
-        if (written >= 0)
-                iocb->ki_pos = pos + written;
+        if (file->f_flags & O_DIRECT) {
+                written = generic_file_direct_write(iocb, iov, &nr_segs,
+                                                    pos, &iocb->ki_pos,
+                                                    count, ocount);
+                if (written < 0 || written == count)
+                        goto out;
+
+                pos += written;
+                count -= written;
 
+                iov_iter_init(&i, iov, nr_segs, count, written);
+                written_buffered = fuse_perform_write(file, mapping, &i, pos);
+                if (written_buffered < 0) {
+                        err = written_buffered;
+                        goto out;
+                }
+                endbyte = pos + written_buffered - 1;
+
+                err = filemap_write_and_wait_range(file->f_mapping, pos,
+                                                   endbyte);
+                if (err)
+                        goto out;
+
+                invalidate_mapping_pages(file->f_mapping,
+                                         pos >> PAGE_CACHE_SHIFT,
+                                         endbyte >> PAGE_CACHE_SHIFT);
+
+                written += written_buffered;
+                iocb->ki_pos = pos + written_buffered;
+        } else {
+                iov_iter_init(&i, iov, nr_segs, count, 0);
+                written = fuse_perform_write(file, mapping, &i, pos);
+                if (written >= 0)
+                        iocb->ki_pos = pos + written;
+        }
 out:
         current->backing_dev_info = NULL;
         mutex_unlock(&inode->i_mutex);
@@ -1101,30 +1133,41 @@ static ssize_t fuse_direct_read(struct file *file, char __user *buf,
         return res;
 }
 
-static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
-                                 size_t count, loff_t *ppos)
+static ssize_t __fuse_direct_write(struct file *file, const char __user *buf,
+                                   size_t count, loff_t *ppos)
 {
         struct inode *inode = file->f_path.dentry->d_inode;
         ssize_t res;
 
-        if (is_bad_inode(inode))
-                return -EIO;
-
-        /* Don't allow parallel writes to the same file */
-        mutex_lock(&inode->i_mutex);
         res = generic_write_checks(file, ppos, &count, 0);
         if (!res) {
                 res = fuse_direct_io(file, buf, count, ppos, 1);
                 if (res > 0)
                         fuse_write_update_size(inode, *ppos);
         }
-        mutex_unlock(&inode->i_mutex);
 
         fuse_invalidate_attr(inode);
 
         return res;
 }
 
+static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
+                                 size_t count, loff_t *ppos)
+{
+        struct inode *inode = file->f_path.dentry->d_inode;
+        ssize_t res;
+
+        if (is_bad_inode(inode))
+                return -EIO;
+
+        /* Don't allow parallel writes to the same file */
+        mutex_lock(&inode->i_mutex);
+        res = __fuse_direct_write(file, buf, count, ppos);
+        mutex_unlock(&inode->i_mutex);
+
+        return res;
+}
+
 static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
 {
         __free_page(req->pages[0]);
@@ -2077,6 +2120,57 @@ int fuse_notify_poll_wakeup(struct fuse_conn *fc,
         return 0;
 }
 
+static ssize_t fuse_loop_dio(struct file *filp, const struct iovec *iov,
+                             unsigned long nr_segs, loff_t *ppos, int rw)
+{
+        const struct iovec *vector = iov;
+        ssize_t ret = 0;
+
+        while (nr_segs > 0) {
+                void __user *base;
+                size_t len;
+                ssize_t nr;
+
+                base = vector->iov_base;
+                len = vector->iov_len;
+                vector++;
+                nr_segs--;
+
+                if (rw == WRITE)
+                        nr = __fuse_direct_write(filp, base, len, ppos);
+                else
+                        nr = fuse_direct_read(filp, base, len, ppos);
+
+                if (nr < 0) {
+                        if (!ret)
+                                ret = nr;
+                        break;
+                }
+                ret += nr;
+                if (nr != len)
+                        break;
+        }
+
+        return ret;
+}
+
+
+static ssize_t
+fuse_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
+                        loff_t offset, unsigned long nr_segs)
+{
+        ssize_t ret = 0;
+        struct file *file = NULL;
+        loff_t pos = 0;
+
+        file = iocb->ki_filp;
+        pos = offset;
+
+        ret = fuse_loop_dio(file, iov, nr_segs, &pos, rw);
+
+        return ret;
+}
+
 static const struct file_operations fuse_file_operations = {
         .llseek         = fuse_file_llseek,
         .read           = do_sync_read,
@@ -2120,6 +2214,7 @@ static const struct address_space_operations fuse_file_aops  = {
         .readpages      = fuse_readpages,
         .set_page_dirty = __set_page_dirty_nobuffers,
         .bmap           = fuse_bmap,
+        .direct_IO      = fuse_direct_IO,
 };
 
 void fuse_init_file_inode(struct inode *inode)
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 4aec5995867e..26783eb2b1fc 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -947,6 +947,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_magic = FUSE_SUPER_MAGIC;
         sb->s_op = &fuse_super_operations;
         sb->s_maxbytes = MAX_LFS_FILESIZE;
+        sb->s_time_gran = 1;
         sb->s_export_op = &fuse_export_operations;
 
         file = fget(d.fd);
diff --git a/fs/gfs2/Kconfig b/fs/gfs2/Kconfig
index c465ae066c62..eb08c9e43c2a 100644
--- a/fs/gfs2/Kconfig
+++ b/fs/gfs2/Kconfig
@@ -1,10 +1,6 @@
 config GFS2_FS
         tristate "GFS2 file system support"
         depends on (64BIT || LBDAF)
-        select DLM if GFS2_FS_LOCKING_DLM
-        select CONFIGFS_FS if GFS2_FS_LOCKING_DLM
-        select SYSFS if GFS2_FS_LOCKING_DLM
-        select IP_SCTP if DLM_SCTP
         select FS_POSIX_ACL
         select CRC32
         select QUOTACTL
@@ -29,7 +25,8 @@ config GFS2_FS
 
 config GFS2_FS_LOCKING_DLM
         bool "GFS2 DLM locking"
-        depends on (GFS2_FS!=n) && NET && INET && (IPV6 || IPV6=n) && HOTPLUG
+        depends on (GFS2_FS!=n) && NET && INET && (IPV6 || IPV6=n) && \
+                HOTPLUG && DLM && CONFIGFS_FS && SYSFS
         help
           Multiple node locking module for GFS2
 
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 38b7a74a0f91..9b2ff0e851b1 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -807,7 +807,7 @@ static int gfs2_stuffed_write_end(struct inode *inode, struct buffer_head *dibh,
 
         if (inode == sdp->sd_rindex) {
                 adjust_fs_space(inode);
-                ip->i_gh.gh_flags |= GL_NOCACHE;
+                sdp->sd_rindex_uptodate = 0;
         }
 
         brelse(dibh);
@@ -873,7 +873,7 @@ static int gfs2_write_end(struct file *file, struct address_space *mapping,
 
         if (inode == sdp->sd_rindex) {
                 adjust_fs_space(inode);
-                ip->i_gh.gh_flags |= GL_NOCACHE;
+                sdp->sd_rindex_uptodate = 0;
         }
 
         brelse(dibh);
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 197c5c47e577..03c04febe26f 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -724,7 +724,11 @@ static int do_strip(struct gfs2_inode *ip, struct buffer_head *dibh,
         int metadata;
         unsigned int revokes = 0;
         int x;
-        int error = 0;
+        int error;
+
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
 
         if (!*top)
                 sm->sm_first = 0;
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index c35573abd371..a836056343f0 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -1844,6 +1844,10 @@ static int leaf_dealloc(struct gfs2_inode *dip, u32 index, u32 len,
         unsigned int x, size = len * sizeof(u64);
         int error;
 
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
+
         memset(&rlist, 0, sizeof(struct gfs2_rgrp_list));
 
         ht = kzalloc(size, GFP_NOFS);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index c98a60ee6dfd..a9ba2444e077 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1031,7 +1031,13 @@ static int gfs2_unlink(struct inode *dir, struct dentry *dentry)
         struct buffer_head *bh;
         struct gfs2_holder ghs[3];
         struct gfs2_rgrpd *rgd;
-        int error = -EROFS;
+        int error;
+
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
+
+        error = -EROFS;
 
         gfs2_holder_init(dip->i_gl, LM_ST_EXCLUSIVE, 0, ghs);
         gfs2_holder_init(ip->i_gl,  LM_ST_EXCLUSIVE, 0, ghs + 1);
@@ -1224,6 +1230,10 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
                         return 0;
         }
 
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
+
         if (odip != ndip) {
                 error = gfs2_glock_nq_init(sdp->sd_rename_gl, LM_ST_EXCLUSIVE,
                                            0, &r_gh);
@@ -1345,7 +1355,6 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
         error = alloc_required;
         if (error < 0)
                 goto out_gunlock;
-        error = 0;
 
         if (alloc_required) {
                 struct gfs2_qadata *qa = gfs2_qadata_get(ndip);
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index f8411bd1b805..5f5e70e047dc 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -200,10 +200,11 @@ static int make_mode(const unsigned int lmstate)
         return -1;
 }
 
-static u32 make_flags(const u32 lkid, const unsigned int gfs_flags,
+static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags,
                       const int req)
 {
         u32 lkf = DLM_LKF_VALBLK;
+        u32 lkid = gl->gl_lksb.sb_lkid;
 
         if (gfs_flags & LM_FLAG_TRY)
                 lkf |= DLM_LKF_NOQUEUE;
@@ -227,8 +228,11 @@ static u32 make_flags(const u32 lkid, const unsigned int gfs_flags,
                         BUG();
         }
 
-        if (lkid != 0) 
+        if (lkid != 0) {
                 lkf |= DLM_LKF_CONVERT;
+                if (test_bit(GLF_BLOCKING, &gl->gl_flags))
+                        lkf |= DLM_LKF_QUECVT;
+        }
 
         return lkf;
 }
@@ -250,7 +254,7 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state,
         char strname[GDLM_STRNAME_BYTES] = "";
 
         req = make_mode(req_state);
-        lkf = make_flags(gl->gl_lksb.sb_lkid, flags, req);
+        lkf = make_flags(gl, flags, req);
         gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
         gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
         if (gl->gl_lksb.sb_lkid) {
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 19bde40b4864..3df65c9ab73b 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -332,9 +332,6 @@ struct gfs2_rgrpd *gfs2_blk2rgrpd(struct gfs2_sbd *sdp, u64 blk, bool exact)
         struct rb_node *n, *next;
         struct gfs2_rgrpd *cur;
 
-        if (gfs2_rindex_update(sdp))
-                return NULL;
-
         spin_lock(&sdp->sd_rindex_spin);
         n = sdp->sd_rindex_tree.rb_node;
         while (n) {
@@ -640,6 +637,7 @@ static int read_rindex_entry(struct gfs2_inode *ip,
                 return 0;
 
         error = 0; /* someone else read in the rgrp; free it and ignore it */
+        gfs2_glock_put(rgd->rd_gl);
 
 fail:
         kfree(rgd->rd_bits);
@@ -927,6 +925,10 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
         } else if (copy_from_user(&r, argp, sizeof(r)))
                 return -EFAULT;
 
+        ret = gfs2_rindex_update(sdp);
+        if (ret)
+                return ret;
+
         rgd = gfs2_blk2rgrpd(sdp, r.start, 0);
         rgd_end = gfs2_blk2rgrpd(sdp, r.start + r.len, 0);
 
diff --git a/fs/gfs2/xattr.c b/fs/gfs2/xattr.c
index 2e5ba425cae7..927f4df874ae 100644
--- a/fs/gfs2/xattr.c
+++ b/fs/gfs2/xattr.c
@@ -238,6 +238,10 @@ static int ea_dealloc_unstuffed(struct gfs2_inode *ip, struct buffer_head *bh,
         unsigned int x;
         int error;
 
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
+
         if (GFS2_EA_IS_STUFFED(ea))
                 return 0;
 
@@ -1330,6 +1334,10 @@ static int ea_dealloc_indirect(struct gfs2_inode *ip)
         unsigned int x;
         int error;
 
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
+
         memset(&rlist, 0, sizeof(struct gfs2_rgrp_list));
 
         error = gfs2_meta_read(ip->i_gl, ip->i_eattr, DIO_WAIT, &indbh);
@@ -1439,6 +1447,10 @@ static int ea_dealloc_block(struct gfs2_inode *ip)
         struct gfs2_holder gh;
         int error;
 
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
+
         rgd = gfs2_blk2rgrpd(sdp, ip->i_eattr, 1);
         if (!rgd) {
                 gfs2_consist_inode(ip);
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 4dfbfec357e8..ec2a9c23f0c9 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -366,6 +366,10 @@ int hfsplus_rename_cat(u32 cnid,
         err = hfs_brec_find(&src_fd);
         if (err)
                 goto out;
+        if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
+                err = -EIO;
+                goto out;
+        }
 
         hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
                                 src_fd.entrylength);
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 88e155f895c6..26b53fb09f68 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -150,6 +150,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 filp->f_pos++;
                 /* fall through */
         case 1:
+                if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+                        err = -EIO;
+                        goto out;
+                }
+
                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
                         fd.entrylength);
                 if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
@@ -181,6 +186,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         err = -EIO;
                         goto out;
                 }
+
+                if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+                        err = -EIO;
+                        goto out;
+                }
+
                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
                         fd.entrylength);
                 type = be16_to_cpu(entry.type);
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 28cf06e4ec84..001ef01d2fe2 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -485,6 +485,7 @@ static struct inode *hugetlbfs_get_root(struct super_block *sb,
                 inode->i_fop = &simple_dir_operations;
                 /* directory inodes start off with i_nlink == 2 (for "." entry) */
                 inc_nlink(inode);
+                lockdep_annotate_inode_mutex_key(inode);
         }
         return inode;
 }
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 806525a7269c..840f70f50792 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -723,7 +723,7 @@ start_journal_io:
         if (commit_transaction->t_need_data_flush &&
             (journal->j_fs_dev != journal->j_dev) &&
             (journal->j_flags & JBD2_BARRIER))
-                blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+                blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
 
         /* Done it all: now write the commit record asynchronously. */
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
@@ -859,7 +859,7 @@ wait_for_iobuf:
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
                                       JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
             journal->j_flags & JBD2_BARRIER) {
-                blkdev_issue_flush(journal->j_dev, GFP_KERNEL, NULL);
+                blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL);
         }
 
         if (err)
diff --git a/fs/libfs.c b/fs/libfs.c
index 358094f0433d..18d08f5db53a 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -529,6 +529,7 @@ int simple_fill_super(struct super_block *s, unsigned long magic,
         return 0;
 out:
         d_genocide(root);
+        shrink_dcache_parent(root);
         dput(root);
         return -ENOMEM;
 }
diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
index 3ddcbb1c0a43..13ad1539fbf2 100644
--- a/fs/lockd/clnt4xdr.c
+++ b/fs/lockd/clnt4xdr.c
@@ -241,7 +241,7 @@ static int decode_nlm4_stat(struct xdr_stream *xdr, __be32 *stat)
         p = xdr_inline_decode(xdr, 4);
         if (unlikely(p == NULL))
                 goto out_overflow;
-        if (unlikely(*p > nlm4_failed))
+        if (unlikely(ntohl(*p) > ntohl(nlm4_failed)))
                 goto out_bad_xdr;
         *stat = *p;
         return 0;
diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
index 3d35e3e80c1c..d269ada7670e 100644
--- a/fs/lockd/clntxdr.c
+++ b/fs/lockd/clntxdr.c
@@ -236,7 +236,7 @@ static int decode_nlm_stat(struct xdr_stream *xdr,
         p = xdr_inline_decode(xdr, 4);
         if (unlikely(p == NULL))
                 goto out_overflow;
-        if (unlikely(*p > nlm_lck_denied_grace_period))
+        if (unlikely(ntohl(*p) > ntohl(nlm_lck_denied_grace_period)))
                 goto out_enum;
         *stat = *p;
         return 0;
diff --git a/fs/namei.c b/fs/namei.c
index 0062dd17eb55..c42791914f82 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1429,7 +1429,7 @@ unsigned int full_name_hash(const unsigned char *name, unsigned int len)
         unsigned long hash = 0;
 
         for (;;) {
-                a = *(unsigned long *)name;
+                a = load_unaligned_zeropad(name);
                 if (len < sizeof(unsigned long))
                         break;
                 hash += a;
@@ -1459,7 +1459,7 @@ static inline unsigned long hash_name(const char *name, unsigned int *hashp)
         do {
                 hash = (hash + a) * 9;
                 len += sizeof(unsigned long);
-                a = *(unsigned long *)(name+len);
+                a = load_unaligned_zeropad(name+len);
                 /* Do we have any NUL or '/' bytes in this word? */
                 mask = has_zero(a) | has_zero(a ^ REPEAT_BYTE('/'));
         } while (!mask);
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index 9c94297bb70e..7f6a23f0244e 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -38,6 +38,8 @@
 #include <linux/buffer_head.h>  /* various write calls */
 #include <linux/prefetch.h>
 
+#include "../pnfs.h"
+#include "../internal.h"
 #include "blocklayout.h"
 
 #define NFSDBG_FACILITY NFSDBG_PNFS_LD
@@ -868,7 +870,7 @@ nfs4_blk_get_deviceinfo(struct nfs_server *server, const struct nfs_fh *fh,
          * GETDEVICEINFO's maxcount
          */
         max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
-        max_pages = max_resp_sz >> PAGE_SHIFT;
+        max_pages = nfs_page_array_len(0, max_resp_sz);
         dprintk("%s max_resp_sz %u max_pages %d\n",
                 __func__, max_resp_sz, max_pages);
 
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index da7b5e4ff9ec..60f7e4ec842c 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1729,7 +1729,8 @@ error:
  */
 struct nfs_server *nfs_clone_server(struct nfs_server *source,
                                     struct nfs_fh *fh,
-                                    struct nfs_fattr *fattr)
+                                    struct nfs_fattr *fattr,
+                                    rpc_authflavor_t flavor)
 {
         struct nfs_server *server;
         struct nfs_fattr *fattr_fsinfo;
@@ -1758,7 +1759,7 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
 
         error = nfs_init_server_rpcclient(server,
                         source->client->cl_timeout,
-                        source->client->cl_auth->au_flavor);
+                        flavor);
         if (error < 0)
                 goto out_free_server;
         if (!IS_ERR(source->client_acl))
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 4aaf0316d76a..8789210c6905 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1429,7 +1429,7 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
         }
 
         open_flags = nd->intent.open.flags;
-        attr.ia_valid = 0;
+        attr.ia_valid = ATTR_OPEN;
 
         ctx = create_nfs_open_context(dentry, open_flags);
         res = ERR_CAST(ctx);
@@ -1536,7 +1536,7 @@ static int nfs_open_revalidate(struct dentry *dentry, struct nameidata *nd)
         if (IS_ERR(ctx))
                 goto out;
 
-        attr.ia_valid = 0;
+        attr.ia_valid = ATTR_OPEN;
         if (openflags & O_TRUNC) {
                 attr.ia_valid |= ATTR_SIZE;
                 attr.ia_size = 0;
diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index b7f348bb618b..ba3019f5934c 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -554,12 +554,16 @@ static int rpc_pipefs_event(struct notifier_block *nb, unsigned long event,
         struct nfs_client *clp;
         int error = 0;
 
+        if (!try_module_get(THIS_MODULE))
+                return 0;
+
         while ((clp = nfs_get_client_for_event(sb->s_fs_info, event))) {
                 error = __rpc_pipefs_event(clp, event, sb);
                 nfs_put_client(clp);
                 if (error)
                         break;
         }
+        module_put(THIS_MODULE);
         return error;
 }
 
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 2476dc69365f..b777bdaba4c5 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -165,7 +165,8 @@ extern struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *,
 extern void nfs_free_server(struct nfs_server *server);
 extern struct nfs_server *nfs_clone_server(struct nfs_server *,
                                            struct nfs_fh *,
-                                           struct nfs_fattr *);
+                                           struct nfs_fattr *,
+                                           rpc_authflavor_t);
 extern void nfs_mark_client_ready(struct nfs_client *clp, int state);
 extern int nfs4_check_client_ready(struct nfs_client *clp);
 extern struct nfs_client *nfs4_set_ds_client(struct nfs_client* mds_clp,
@@ -186,10 +187,10 @@ static inline void nfs_fs_proc_exit(void)
 
 /* nfs4namespace.c */
 #ifdef CONFIG_NFS_V4
-extern struct vfsmount *nfs_do_refmount(struct dentry *dentry);
+extern struct vfsmount *nfs_do_refmount(struct rpc_clnt *client, struct dentry *dentry);
 #else
 static inline
-struct vfsmount *nfs_do_refmount(struct dentry *dentry)
+struct vfsmount *nfs_do_refmount(struct rpc_clnt *client, struct dentry *dentry)
 {
         return ERR_PTR(-ENOENT);
 }
@@ -234,7 +235,6 @@ extern const u32 nfs41_maxwrite_overhead;
 /* nfs4proc.c */
 #ifdef CONFIG_NFS_V4
 extern struct rpc_procinfo nfs4_procedures[];
-void nfs_fixup_secinfo_attributes(struct nfs_fattr *, struct nfs_fh *);
 #endif
 
 extern int nfs4_init_ds_session(struct nfs_client *clp);
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 1807866bb3ab..d51868e5683c 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -148,66 +148,31 @@ rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors)
         return pseudoflavor;
 }
 
-static int nfs_negotiate_security(const struct dentry *parent,
-                                  const struct dentry *dentry,
-                                  rpc_authflavor_t *flavor)
+static struct rpc_clnt *nfs_lookup_mountpoint(struct inode *dir,
+                                              struct qstr *name,
+                                              struct nfs_fh *fh,
+                                              struct nfs_fattr *fattr)
 {
-        struct page *page;
-        struct nfs4_secinfo_flavors *flavors;
-        int (*secinfo)(struct inode *, const struct qstr *, struct nfs4_secinfo_flavors *);
-        int ret = -EPERM;
-
-        secinfo = NFS_PROTO(parent->d_inode)->secinfo;
-        if (secinfo != NULL) {
-                page = alloc_page(GFP_KERNEL);
-                if (!page) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
-                flavors = page_address(page);
-                ret = secinfo(parent->d_inode, &dentry->d_name, flavors);
-                *flavor = nfs_find_best_sec(flavors);
-                put_page(page);
-        }
-
-out:
-        return ret;
-}
-
-static int nfs_lookup_with_sec(struct nfs_server *server, struct dentry *parent,
-                               struct dentry *dentry, struct path *path,
-                               struct nfs_fh *fh, struct nfs_fattr *fattr,
-                               rpc_authflavor_t *flavor)
-{
-        struct rpc_clnt *clone;
-        struct rpc_auth *auth;
         int err;
 
-        err = nfs_negotiate_security(parent, path->dentry, flavor);
-        if (err < 0)
-                goto out;
-        clone  = rpc_clone_client(server->client);
-        auth   = rpcauth_create(*flavor, clone);
-        if (!auth) {
-                err = -EIO;
-                goto out_shutdown;
-        }
-        err = server->nfs_client->rpc_ops->lookup(clone, parent->d_inode,
-                                                  &path->dentry->d_name,
-                                                  fh, fattr);
-out_shutdown:
-        rpc_shutdown_client(clone);
-out:
-        return err;
+        if (NFS_PROTO(dir)->version == 4)
+                return nfs4_proc_lookup_mountpoint(dir, name, fh, fattr);
+
+        err = NFS_PROTO(dir)->lookup(NFS_SERVER(dir)->client, dir, name, fh, fattr);
+        if (err)
+                return ERR_PTR(err);
+        return rpc_clone_client(NFS_SERVER(dir)->client);
 }
 #else /* CONFIG_NFS_V4 */
-static inline int nfs_lookup_with_sec(struct nfs_server *server,
-                                      struct dentry *parent, struct dentry *dentry,
-                                      struct path *path, struct nfs_fh *fh,
-                                      struct nfs_fattr *fattr,
-                                      rpc_authflavor_t *flavor)
+static inline struct rpc_clnt *nfs_lookup_mountpoint(struct inode *dir,
+                                                     struct qstr *name,
+                                                     struct nfs_fh *fh,
+                                                     struct nfs_fattr *fattr)
 {
-        return -EPERM;
+        int err = NFS_PROTO(dir)->lookup(NFS_SERVER(dir)->client, dir, name, fh, fattr);
+        if (err)
+                return ERR_PTR(err);
+        return rpc_clone_client(NFS_SERVER(dir)->client);
 }
 #endif /* CONFIG_NFS_V4 */
 
@@ -226,12 +191,10 @@ static inline int nfs_lookup_with_sec(struct nfs_server *server,
 struct vfsmount *nfs_d_automount(struct path *path)
 {
         struct vfsmount *mnt;
-        struct nfs_server *server = NFS_SERVER(path->dentry->d_inode);
         struct dentry *parent;
         struct nfs_fh *fh = NULL;
         struct nfs_fattr *fattr = NULL;
-        int err;
-        rpc_authflavor_t flavor = RPC_AUTH_UNIX;
+        struct rpc_clnt *client;
 
         dprintk("--> nfs_d_automount()\n");
 
@@ -249,21 +212,19 @@ struct vfsmount *nfs_d_automount(struct path *path)
 
         /* Look it up again to get its attributes */
         parent = dget_parent(path->dentry);
-        err = server->nfs_client->rpc_ops->lookup(server->client, parent->d_inode,
-                                                  &path->dentry->d_name,
-                                                  fh, fattr);
-        if (err == -EPERM && NFS_PROTO(parent->d_inode)->secinfo != NULL)
-                err = nfs_lookup_with_sec(server, parent, path->dentry, path, fh, fattr, &flavor);
+        client = nfs_lookup_mountpoint(parent->d_inode, &path->dentry->d_name, fh, fattr);
         dput(parent);
-        if (err != 0) {
-                mnt = ERR_PTR(err);
+        if (IS_ERR(client)) {
+                mnt = ERR_CAST(client);
                 goto out;
         }
 
         if (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)
-                mnt = nfs_do_refmount(path->dentry);
+                mnt = nfs_do_refmount(client, path->dentry);
         else
-                mnt = nfs_do_submount(path->dentry, fh, fattr, flavor);
+                mnt = nfs_do_submount(path->dentry, fh, fattr, client->cl_auth->au_flavor);
+        rpc_shutdown_client(client);
+
         if (IS_ERR(mnt))
                 goto out;
 
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 97ecc863dd76..8d75021020b3 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -59,6 +59,7 @@ struct nfs_unique_id {
 
 #define NFS_SEQID_CONFIRMED 1
 struct nfs_seqid_counter {
+        ktime_t create_time;
         int owner_id;
         int flags;
         u32 counter;
@@ -204,6 +205,9 @@ struct nfs4_state_maintenance_ops {
 extern const struct dentry_operations nfs4_dentry_operations;
 extern const struct inode_operations nfs4_dir_inode_operations;
 
+/* nfs4namespace.c */
+struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *, struct inode *, struct qstr *);
+
 /* nfs4proc.c */
 extern int nfs4_proc_setclientid(struct nfs_client *, u32, unsigned short, struct rpc_cred *, struct nfs4_setclientid_res *);
 extern int nfs4_proc_setclientid_confirm(struct nfs_client *, struct nfs4_setclientid_res *arg, struct rpc_cred *);
@@ -212,8 +216,11 @@ extern int nfs4_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs41_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_do_close(struct nfs4_state *state, gfp_t gfp_mask, int wait, bool roc);
 extern int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle);
-extern int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
-                struct nfs4_fs_locations *fs_locations, struct page *page);
+extern int nfs4_proc_fs_locations(struct rpc_clnt *, struct inode *, const struct qstr *,
+                                  struct nfs4_fs_locations *, struct page *);
+extern struct rpc_clnt *nfs4_proc_lookup_mountpoint(struct inode *, struct qstr *,
+                            struct nfs_fh *, struct nfs_fattr *);
+extern int nfs4_proc_secinfo(struct inode *, const struct qstr *, struct nfs4_secinfo_flavors *);
 extern int nfs4_release_lockowner(struct nfs4_lock_state *);
 extern const struct xattr_handler *nfs4_xattr_handlers[];
 
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index a866bbd2890a..c9cff9adb2d3 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -699,7 +699,7 @@ get_device_info(struct inode *inode, struct nfs4_deviceid *dev_id, gfp_t gfp_fla
          * GETDEVICEINFO's maxcount
          */
         max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
-        max_pages = max_resp_sz >> PAGE_SHIFT;
+        max_pages = nfs_page_array_len(0, max_resp_sz);
         dprintk("%s inode %p max_resp_sz %u max_pages %d\n",
                 __func__, inode, max_resp_sz, max_pages);
 
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 9c8eca315f43..a7f3dedc4ec7 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -52,6 +52,30 @@ Elong:
 }
 
 /*
+ * return the path component of "<server>:<path>"
+ *  nfspath - the "<server>:<path>" string
+ *  end - one past the last char that could contain "<server>:"
+ * returns NULL on failure
+ */
+static char *nfs_path_component(const char *nfspath, const char *end)
+{
+        char *p;
+
+        if (*nfspath == '[') {
+                /* parse [] escaped IPv6 addrs */
+                p = strchr(nfspath, ']');
+                if (p != NULL && ++p < end && *p == ':')
+                        return p + 1;
+        } else {
+                /* otherwise split on first colon */
+                p = strchr(nfspath, ':');
+                if (p != NULL && p < end)
+                        return p + 1;
+        }
+        return NULL;
+}
+
+/*
  * Determine the mount path as a string
  */
 static char *nfs4_path(struct dentry *dentry, char *buffer, ssize_t buflen)
@@ -59,9 +83,9 @@ static char *nfs4_path(struct dentry *dentry, char *buffer, ssize_t buflen)
         char *limit;
         char *path = nfs_path(&limit, dentry, buffer, buflen);
         if (!IS_ERR(path)) {
-                char *colon = strchr(path, ':');
-                if (colon && colon < limit)
-                        path = colon + 1;
+                char *path_component = nfs_path_component(path, limit);
+                if (path_component)
+                        return path_component;
         }
         return path;
 }
@@ -108,6 +132,58 @@ static size_t nfs_parse_server_name(char *string, size_t len,
         return ret;
 }
 
+static rpc_authflavor_t nfs4_negotiate_security(struct inode *inode, struct qstr *name)
+{
+        struct page *page;
+        struct nfs4_secinfo_flavors *flavors;
+        rpc_authflavor_t flavor;
+        int err;
+
+        page = alloc_page(GFP_KERNEL);
+        if (!page)
+                return -ENOMEM;
+        flavors = page_address(page);
+
+        err = nfs4_proc_secinfo(inode, name, flavors);
+        if (err < 0) {
+                flavor = err;
+                goto out;
+        }
+
+        flavor = nfs_find_best_sec(flavors);
+
+out:
+        put_page(page);
+        return flavor;
+}
+
+/*
+ * Please call rpc_shutdown_client() when you are done with this client.
+ */
+struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *clnt, struct inode *inode,
+                                        struct qstr *name)
+{
+        struct rpc_clnt *clone;
+        struct rpc_auth *auth;
+        rpc_authflavor_t flavor;
+
+        flavor = nfs4_negotiate_security(inode, name);
+        if (flavor < 0)
+                return ERR_PTR(flavor);
+
+        clone = rpc_clone_client(clnt);
+        if (IS_ERR(clone))
+                return clone;
+
+        auth = rpcauth_create(flavor, clone);
+        if (!auth) {
+                rpc_shutdown_client(clone);
+                clone = ERR_PTR(-EIO);
+        }
+
+        return clone;
+}
+
 static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                                      char *page, char *page2,
                                      const struct nfs4_fs_location *location)
@@ -224,7 +300,7 @@ out:
  * @dentry - dentry of referral
  *
  */
-struct vfsmount *nfs_do_refmount(struct dentry *dentry)
+struct vfsmount *nfs_do_refmount(struct rpc_clnt *client, struct dentry *dentry)
 {
         struct vfsmount *mnt = ERR_PTR(-ENOMEM);
         struct dentry *parent;
@@ -250,7 +326,7 @@ struct vfsmount *nfs_do_refmount(struct dentry *dentry)
         dprintk("%s: getting locations for %s/%s\n",
                 __func__, parent->d_name.name, dentry->d_name.name);
 
-        err = nfs4_proc_fs_locations(parent->d_inode, &dentry->d_name, fs_locations, page);
+        err = nfs4_proc_fs_locations(client, parent->d_inode, &dentry->d_name, fs_locations, page);
         dput(parent);
         if (err != 0 ||
             fs_locations->nlocations <= 0 ||
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f82bde005a82..99650aaf8937 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -838,7 +838,8 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
         p->o_arg.open_flags = flags;
         p->o_arg.fmode = fmode & (FMODE_READ|FMODE_WRITE);
         p->o_arg.clientid = server->nfs_client->cl_clientid;
-        p->o_arg.id = sp->so_seqid.owner_id;
+        p->o_arg.id.create_time = ktime_to_ns(sp->so_seqid.create_time);
+        p->o_arg.id.uniquifier = sp->so_seqid.owner_id;
         p->o_arg.name = &dentry->d_name;
         p->o_arg.server = server;
         p->o_arg.bitmask = server->attr_bitmask;
@@ -1466,8 +1467,7 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
                         goto unlock_no_action;
                 rcu_read_unlock();
         }
-        /* Update sequence id. */
-        data->o_arg.id = sp->so_seqid.owner_id;
+        /* Update client id. */
         data->o_arg.clientid = sp->so_server->nfs_client->cl_clientid;
         if (data->o_arg.claim == NFS4_OPEN_CLAIM_PREVIOUS) {
                 task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_NOATTR];
@@ -1954,10 +1954,19 @@ static int nfs4_do_setattr(struct inode *inode, struct rpc_cred *cred,
         };
         int err;
         do {
-                err = nfs4_handle_exception(server,
-                                _nfs4_do_setattr(inode, cred, fattr, sattr, state),
-                                &exception);
+                err = _nfs4_do_setattr(inode, cred, fattr, sattr, state);
+                switch (err) {
+                case -NFS4ERR_OPENMODE:
+                        if (state && !(state->state & FMODE_WRITE)) {
+                                err = -EBADF;
+                                if (sattr->ia_valid & ATTR_OPEN)
+                                        err = -EACCES;
+                                goto out;
+                        }
+                }
+                err = nfs4_handle_exception(server, err, &exception);
         } while (exception.retry);
+out:
         return err;
 }
 
@@ -2368,8 +2377,9 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
  * Note that we'll actually follow the referral later when
  * we detect fsid mismatch in inode revalidation
  */
-static int nfs4_get_referral(struct inode *dir, const struct qstr *name,
-                             struct nfs_fattr *fattr, struct nfs_fh *fhandle)
+static int nfs4_get_referral(struct rpc_clnt *client, struct inode *dir,
+                             const struct qstr *name, struct nfs_fattr *fattr,
+                             struct nfs_fh *fhandle)
 {
         int status = -ENOMEM;
         struct page *page = NULL;
@@ -2382,7 +2392,7 @@ static int nfs4_get_referral(struct inode *dir, const struct qstr *name,
         if (locations == NULL)
                 goto out;
 
-        status = nfs4_proc_fs_locations(dir, name, locations, page);
+        status = nfs4_proc_fs_locations(client, dir, name, locations, page);
         if (status != 0)
                 goto out;
         /* Make sure server returned a different fsid for the referral */
@@ -2519,39 +2529,84 @@ static int _nfs4_proc_lookup(struct rpc_clnt *clnt, struct inode *dir,
         return status;
 }
 
-void nfs_fixup_secinfo_attributes(struct nfs_fattr *fattr, struct nfs_fh *fh)
+static void nfs_fixup_secinfo_attributes(struct nfs_fattr *fattr)
 {
-        memset(fh, 0, sizeof(struct nfs_fh));
-        fattr->fsid.major = 1;
         fattr->valid |= NFS_ATTR_FATTR_TYPE | NFS_ATTR_FATTR_MODE |
-                NFS_ATTR_FATTR_NLINK | NFS_ATTR_FATTR_FSID | NFS_ATTR_FATTR_MOUNTPOINT;
+                NFS_ATTR_FATTR_NLINK | NFS_ATTR_FATTR_MOUNTPOINT;
         fattr->mode = S_IFDIR | S_IRUGO | S_IXUGO;
         fattr->nlink = 2;
 }
 
-static int nfs4_proc_lookup(struct rpc_clnt *clnt, struct inode *dir, struct qstr *name,
-                            struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+static int nfs4_proc_lookup_common(struct rpc_clnt **clnt, struct inode *dir,
+                                   struct qstr *name, struct nfs_fh *fhandle,
+                                   struct nfs_fattr *fattr)
 {
         struct nfs4_exception exception = { };
+        struct rpc_clnt *client = *clnt;
         int err;
         do {
-                int status;
-
-                status = _nfs4_proc_lookup(clnt, dir, name, fhandle, fattr);
-                switch (status) {
+                err = _nfs4_proc_lookup(client, dir, name, fhandle, fattr);
+                switch (err) {
                 case -NFS4ERR_BADNAME:
-                        return -ENOENT;
+                        err = -ENOENT;
+                        goto out;
                 case -NFS4ERR_MOVED:
-                        return nfs4_get_referral(dir, name, fattr, fhandle);
+                        err = nfs4_get_referral(client, dir, name, fattr, fhandle);
+                        goto out;
                 case -NFS4ERR_WRONGSEC:
-                        nfs_fixup_secinfo_attributes(fattr, fhandle);
+                        err = -EPERM;
+                        if (client != *clnt)
+                                goto out;
+
+                        client = nfs4_create_sec_client(client, dir, name);
+                        if (IS_ERR(client))
+                                return PTR_ERR(client);
+
+                        exception.retry = 1;
+                        break;
+                default:
+                        err = nfs4_handle_exception(NFS_SERVER(dir), err, &exception);
                 }
-                err = nfs4_handle_exception(NFS_SERVER(dir),
-                                status, &exception);
         } while (exception.retry);
+
+out:
+        if (err == 0)
+                *clnt = client;
+        else if (client != *clnt)
+                rpc_shutdown_client(client);
+
         return err;
 }
 
+static int nfs4_proc_lookup(struct rpc_clnt *clnt, struct inode *dir, struct qstr *name,
+                            struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+{
+        int status;
+        struct rpc_clnt *client = NFS_CLIENT(dir);
+
+        status = nfs4_proc_lookup_common(&client, dir, name, fhandle, fattr);
+        if (client != NFS_CLIENT(dir)) {
+                rpc_shutdown_client(client);
+                nfs_fixup_secinfo_attributes(fattr);
+        }
+        return status;
+}
+
+struct rpc_clnt *
+nfs4_proc_lookup_mountpoint(struct inode *dir, struct qstr *name,
+                            struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+{
+        int status;
+        struct rpc_clnt *client = rpc_clone_client(NFS_CLIENT(dir));
+
+        status = nfs4_proc_lookup_common(&client, dir, name, fhandle, fattr);
+        if (status < 0) {
+                rpc_shutdown_client(client);
+                return ERR_PTR(status);
+        }
+        return client;
+}
+
 static int _nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
 {
         struct nfs_server *server = NFS_SERVER(inode);
@@ -3619,16 +3674,16 @@ out:
         return ret;
 }
 
-static void nfs4_write_cached_acl(struct inode *inode, const char *buf, size_t acl_len)
+static void nfs4_write_cached_acl(struct inode *inode, struct page **pages, size_t pgbase, size_t acl_len)
 {
         struct nfs4_cached_acl *acl;
 
-        if (buf && acl_len <= PAGE_SIZE) {
+        if (pages && acl_len <= PAGE_SIZE) {
                 acl = kmalloc(sizeof(*acl) + acl_len, GFP_KERNEL);
                 if (acl == NULL)
                         goto out;
                 acl->cached = 1;
-                memcpy(acl->data, buf, acl_len);
+                _copy_from_pages(acl->data, pages, pgbase, acl_len);
         } else {
                 acl = kmalloc(sizeof(*acl), GFP_KERNEL);
                 if (acl == NULL)
@@ -3661,7 +3716,6 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         struct nfs_getaclres res = {
                 .acl_len = buflen,
         };
-        void *resp_buf;
         struct rpc_message msg = {
                 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_GETACL],
                 .rpc_argp = &args,
@@ -3675,24 +3729,27 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         if (npages == 0)
                 npages = 1;
 
+        /* Add an extra page to handle the bitmap returned */
+        npages++;
+
         for (i = 0; i < npages; i++) {
                 pages[i] = alloc_page(GFP_KERNEL);
                 if (!pages[i])
                         goto out_free;
         }
-        if (npages > 1) {
-                /* for decoding across pages */
-                res.acl_scratch = alloc_page(GFP_KERNEL);
-                if (!res.acl_scratch)
-                        goto out_free;
-        }
+
+        /* for decoding across pages */
+        res.acl_scratch = alloc_page(GFP_KERNEL);
+        if (!res.acl_scratch)
+                goto out_free;
+
         args.acl_len = npages * PAGE_SIZE;
         args.acl_pgbase = 0;
+
         /* Let decode_getfacl know not to fail if the ACL data is larger than
          * the page we send as a guess */
         if (buf == NULL)
                 res.acl_flags |= NFS4_ACL_LEN_REQUEST;
-        resp_buf = page_address(pages[0]);
 
         dprintk("%s  buf %p buflen %zu npages %d args.acl_len %zu\n",
                 __func__, buf, buflen, npages, args.acl_len);
@@ -3703,9 +3760,9 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
 
         acl_len = res.acl_len - res.acl_data_offset;
         if (acl_len > args.acl_len)
-                nfs4_write_cached_acl(inode, NULL, acl_len);
+                nfs4_write_cached_acl(inode, NULL, 0, acl_len);
         else
-                nfs4_write_cached_acl(inode, resp_buf + res.acl_data_offset,
+                nfs4_write_cached_acl(inode, pages, res.acl_data_offset,
                                       acl_len);
         if (buf) {
                 ret = -ERANGE;
@@ -4558,7 +4615,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
 static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
-        struct nfs4_exception exception = { };
+        struct nfs4_exception exception = {
+                .inode = state->inode,
+        };
         int err;
 
         do {
@@ -4576,7 +4635,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
 static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
-        struct nfs4_exception exception = { };
+        struct nfs4_exception exception = {
+                .inode = state->inode,
+        };
         int err;
 
         err = nfs4_set_lock_state(state, request);
@@ -4676,6 +4737,7 @@ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *
 {
         struct nfs4_exception exception = {
                 .state = state,
+                .inode = state->inode,
         };
         int err;
 
@@ -4721,6 +4783,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
 
         if (state == NULL)
                 return -ENOLCK;
+        /*
+         * Don't rely on the VFS having checked the file open mode,
+         * since it won't do this for flock() locks.
+         */
+        switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) {
+        case F_RDLCK:
+                if (!(filp->f_mode & FMODE_READ))
+                        return -EBADF;
+                break;
+        case F_WRLCK:
+                if (!(filp->f_mode & FMODE_WRITE))
+                        return -EBADF;
+        }
+
         do {
                 status = nfs4_proc_setlk(state, cmd, request);
                 if ((status != -EAGAIN) || IS_SETLK(cmd))
@@ -4891,8 +4967,10 @@ static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr)
         fattr->nlink = 2;
 }
 
-int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
-                struct nfs4_fs_locations *fs_locations, struct page *page)
+static int _nfs4_proc_fs_locations(struct rpc_clnt *client, struct inode *dir,
+                                   const struct qstr *name,
+                                   struct nfs4_fs_locations *fs_locations,
+                                   struct page *page)
 {
         struct nfs_server *server = NFS_SERVER(dir);
         u32 bitmask[2] = {
@@ -4926,11 +5004,26 @@ int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
         nfs_fattr_init(&fs_locations->fattr);
         fs_locations->server = server;
         fs_locations->nlocations = 0;
-        status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, &res.seq_res, 0);
+        status = nfs4_call_sync(client, server, &msg, &args.seq_args, &res.seq_res, 0);
         dprintk("%s: returned status = %d\n", __func__, status);
         return status;
 }
 
+int nfs4_proc_fs_locations(struct rpc_clnt *client, struct inode *dir,
+                           const struct qstr *name,
+                           struct nfs4_fs_locations *fs_locations,
+                           struct page *page)
+{
+        struct nfs4_exception exception = { };
+        int err;
+        do {
+                err = nfs4_handle_exception(NFS_SERVER(dir),
+                                _nfs4_proc_fs_locations(client, dir, name, fs_locations, page),
+                                &exception);
+        } while (exception.retry);
+        return err;
+}
+
 static int _nfs4_proc_secinfo(struct inode *dir, const struct qstr *name, struct nfs4_secinfo_flavors *flavors)
 {
         int status;
@@ -4953,8 +5046,8 @@ static int _nfs4_proc_secinfo(struct inode *dir, const struct qstr *name, struct
         return status;
 }
 
-static int nfs4_proc_secinfo(struct inode *dir, const struct qstr *name,
-                struct nfs4_secinfo_flavors *flavors)
+int nfs4_proc_secinfo(struct inode *dir, const struct qstr *name,
+                      struct nfs4_secinfo_flavors *flavors)
 {
         struct nfs4_exception exception = { };
         int err;
@@ -5029,10 +5122,9 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
         nfs4_construct_boot_verifier(clp, &verifier);
 
         args.id_len = scnprintf(args.id, sizeof(args.id),
-                                "%s/%s.%s/%u",
+                                "%s/%s/%u",
                                 clp->cl_ipaddr,
-                                init_utsname()->nodename,
-                                init_utsname()->domainname,
+                                clp->cl_rpcclient->cl_nodename,
                                 clp->cl_rpcclient->cl_auth->au_flavor);
 
         res.server_scope = kzalloc(sizeof(struct server_scope), GFP_KERNEL);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 0f43414eb25a..7f0fcfc1fe9d 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -393,6 +393,7 @@ nfs4_remove_state_owner_locked(struct nfs4_state_owner *sp)
 static void
 nfs4_init_seqid_counter(struct nfs_seqid_counter *sc)
 {
+        sc->create_time = ktime_get();
         sc->flags = 0;
         sc->counter = 0;
         spin_lock_init(&sc->lock);
@@ -434,13 +435,17 @@ nfs4_alloc_state_owner(struct nfs_server *server,
 static void
 nfs4_drop_state_owner(struct nfs4_state_owner *sp)
 {
-        if (!RB_EMPTY_NODE(&sp->so_server_node)) {
+        struct rb_node *rb_node = &sp->so_server_node;
+
+        if (!RB_EMPTY_NODE(rb_node)) {
                 struct nfs_server *server = sp->so_server;
                 struct nfs_client *clp = server->nfs_client;
 
                 spin_lock(&clp->cl_lock);
-                rb_erase(&sp->so_server_node, &server->state_owners);
-                RB_CLEAR_NODE(&sp->so_server_node);
+                if (!RB_EMPTY_NODE(rb_node)) {
+                        rb_erase(rb_node, &server->state_owners);
+                        RB_CLEAR_NODE(rb_node);
+                }
                 spin_unlock(&clp->cl_lock);
         }
 }
@@ -516,6 +521,14 @@ out:
 /**
  * nfs4_put_state_owner - Release a nfs4_state_owner
  * @sp: state owner data to release
+ *
+ * Note that we keep released state owners on an LRU
+ * list.
+ * This caches valid state owners so that they can be
+ * reused, to avoid the OPEN_CONFIRM on minor version 0.
+ * It also pins the uniquifier of dropped state owners for
+ * a while, to ensure that those state owner names are
+ * never reused.
  */
 void nfs4_put_state_owner(struct nfs4_state_owner *sp)
 {
@@ -525,15 +538,9 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp)
         if (!atomic_dec_and_lock(&sp->so_count, &clp->cl_lock))
                 return;
 
-        if (!RB_EMPTY_NODE(&sp->so_server_node)) {
-                sp->so_expires = jiffies;
-                list_add_tail(&sp->so_lru, &server->state_owners_lru);
-                spin_unlock(&clp->cl_lock);
-        } else {
-                nfs4_remove_state_owner_locked(sp);
-                spin_unlock(&clp->cl_lock);
-                nfs4_free_state_owner(sp);
-        }
+        sp->so_expires = jiffies;
+        list_add_tail(&sp->so_lru, &server->state_owners_lru);
+        spin_unlock(&clp->cl_lock);
 }
 
 /**
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index c74fdb114b48..c54aae364bee 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -74,7 +74,7 @@ static int nfs4_stat_to_errno(int);
 /* lock,open owner id:
  * we currently use size 2 (u64) out of (NFS4_OPAQUE_LIMIT  >> 2)
  */
-#define open_owner_id_maxsz     (1 + 1 + 4)
+#define open_owner_id_maxsz     (1 + 2 + 1 + 1 + 2)
 #define lock_owner_id_maxsz     (1 + 1 + 4)
 #define decode_lockowner_maxsz  (1 + XDR_QUADLEN(IDMAP_NAMESZ))
 #define compound_encode_hdr_maxsz       (3 + (NFS4_MAXTAGLEN >> 2))
@@ -1340,12 +1340,13 @@ static inline void encode_openhdr(struct xdr_stream *xdr, const struct nfs_opena
  */
         encode_nfs4_seqid(xdr, arg->seqid);
         encode_share_access(xdr, arg->fmode);
-        p = reserve_space(xdr, 32);
+        p = reserve_space(xdr, 36);
         p = xdr_encode_hyper(p, arg->clientid);
-        *p++ = cpu_to_be32(20);
+        *p++ = cpu_to_be32(24);
         p = xdr_encode_opaque_fixed(p, "open id:", 8);
         *p++ = cpu_to_be32(arg->server->s_dev);
-        xdr_encode_hyper(p, arg->id);
+        *p++ = cpu_to_be32(arg->id.uniquifier);
+        xdr_encode_hyper(p, arg->id.create_time);
 }
 
 static inline void encode_createmode(struct xdr_stream *xdr, const struct nfs_openargs *arg)
@@ -4257,8 +4258,6 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
         status = decode_attr_error(xdr, bitmap, &err);
         if (status < 0)
                 goto xdr_error;
-        if (err == -NFS4ERR_WRONGSEC)
-                nfs_fixup_secinfo_attributes(fattr, fh);
 
         status = decode_attr_filehandle(xdr, bitmap, fh);
         if (status < 0)
@@ -4901,11 +4900,19 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                  bitmap[3] = {0};
         struct kvec *iov = req->rq_rcv_buf.head;
         int status;
+        size_t page_len = xdr->buf->page_len;
 
         res->acl_len = 0;
         if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0)
                 goto out;
+
         bm_p = xdr->p;
+        res->acl_data_offset = be32_to_cpup(bm_p) + 2;
+        res->acl_data_offset <<= 2;
+        /* Check if the acl data starts beyond the allocated buffer */
+        if (res->acl_data_offset > page_len)
+                return -ERANGE;
+
         if ((status = decode_attr_bitmap(xdr, bitmap)) != 0)
                 goto out;
         if ((status = decode_attr_length(xdr, &attrlen, &savep)) != 0)
@@ -4915,28 +4922,24 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                 return -EIO;
         if (likely(bitmap[0] & FATTR4_WORD0_ACL)) {
                 size_t hdrlen;
-                u32 recvd;
 
                 /* The bitmap (xdr len + bitmaps) and the attr xdr len words
                  * are stored with the acl data to handle the problem of
                  * variable length bitmaps.*/
                 xdr->p = bm_p;
-                res->acl_data_offset = be32_to_cpup(bm_p) + 2;
-                res->acl_data_offset <<= 2;
 
                 /* We ignore &savep and don't do consistency checks on
                  * the attr length.  Let userspace figure it out.... */
                 hdrlen = (u8 *)xdr->p - (u8 *)iov->iov_base;
                 attrlen += res->acl_data_offset;
-                recvd = req->rq_rcv_buf.len - hdrlen;
-                if (attrlen > recvd) {
+                if (attrlen > page_len) {
                         if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
                                 /* getxattr interface called with a NULL buf */
                                 res->acl_len = attrlen;
                                 goto out;
                         }
-                        dprintk("NFS: acl reply: attrlen %u > recvd %u\n",
-                                        attrlen, recvd);
+                        dprintk("NFS: acl reply: attrlen %u > page_len %zu\n",
+                                        attrlen, page_len);
                         return -EINVAL;
                 }
                 xdr_read_pages(xdr, attrlen);
@@ -5089,16 +5092,13 @@ out_err:
         return -EINVAL;
 }
 
-static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
+static int decode_secinfo_common(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
 {
         struct nfs4_secinfo_flavor *sec_flavor;
         int status;
         __be32 *p;
         int i, num_flavors;
 
-        status = decode_op_hdr(xdr, OP_SECINFO);
-        if (status)
-                goto out;
         p = xdr_inline_decode(xdr, 4);
         if (unlikely(!p))
                 goto out_overflow;
@@ -5124,6 +5124,7 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
                 res->flavors->num_flavors++;
         }
 
+        status = 0;
 out:
         return status;
 out_overflow:
@@ -5131,7 +5132,23 @@ out_overflow:
         return -EIO;
 }
 
+static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
+{
+        int status = decode_op_hdr(xdr, OP_SECINFO);
+        if (status)
+                return status;
+        return decode_secinfo_common(xdr, res);
+}
+
 #if defined(CONFIG_NFS_V4_1)
+static int decode_secinfo_no_name(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
+{
+        int status = decode_op_hdr(xdr, OP_SECINFO_NO_NAME);
+        if (status)
+                return status;
+        return decode_secinfo_common(xdr, res);
+}
+
 static int decode_exchange_id(struct xdr_stream *xdr,
                               struct nfs41_exchange_id_res *res)
 {
@@ -6816,7 +6833,7 @@ static int nfs4_xdr_dec_secinfo_no_name(struct rpc_rqst *rqstp,
         status = decode_putrootfh(xdr);
         if (status)
                 goto out;
-        status = decode_secinfo(xdr, res);
+        status = decode_secinfo_no_name(xdr, res);
 out:
         return status;
 }
diff --git a/fs/nfs/objlayout/objlayout.c b/fs/nfs/objlayout/objlayout.c
index 8d45f1c318ce..595c5fc21a19 100644
--- a/fs/nfs/objlayout/objlayout.c
+++ b/fs/nfs/objlayout/objlayout.c
@@ -604,7 +604,6 @@ int objlayout_get_deviceinfo(struct pnfs_layout_hdr *pnfslay,
 {
         struct objlayout_deviceinfo *odi;
         struct pnfs_device pd;
-        struct super_block *sb;
         struct page *page, **pages;
         u32 *p;
         int err;
@@ -623,7 +622,6 @@ int objlayout_get_deviceinfo(struct pnfs_layout_hdr *pnfslay,
         pd.pglen = PAGE_SIZE;
         pd.mincount = 0;
 
-        sb = pnfslay->plh_inode->i_sb;
         err = nfs4_proc_getdeviceinfo(NFS_SERVER(pnfslay->plh_inode), &pd);
         dprintk("%s nfs_getdeviceinfo returned %d\n", __func__, err);
         if (err)
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index b5d451586943..38512bcd2e98 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -587,7 +587,7 @@ send_layoutget(struct pnfs_layout_hdr *lo,
 
         /* allocate pages for xdr post processing */
         max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
-        max_pages = max_resp_sz >> PAGE_SHIFT;
+        max_pages = nfs_page_array_len(0, max_resp_sz);
 
         pages = kcalloc(max_pages, sizeof(struct page *), gfp_flags);
         if (!pages)
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 9a0e8ef4a409..0a4be28c2ea3 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -322,7 +322,7 @@ out_bad:
         while (!list_empty(res)) {
                 data = list_entry(res->next, struct nfs_read_data, list);
                 list_del(&data->list);
-                nfs_readdata_free(data);
+                nfs_readdata_release(data);
         }
         nfs_readpage_release(req);
         return -ENOMEM;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 37412f706b32..4ac7fca7e4bf 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2428,7 +2428,7 @@ nfs_xdev_mount(struct file_system_type *fs_type, int flags,
         dprintk("--> nfs_xdev_mount()\n");
 
         /* create a new volume representation */
-        server = nfs_clone_server(NFS_SB(data->sb), data->fh, data->fattr);
+        server = nfs_clone_server(NFS_SB(data->sb), data->fh, data->fattr, data->authflavor);
         if (IS_ERR(server)) {
                 error = PTR_ERR(server);
                 goto out_err_noserver;
@@ -2767,11 +2767,15 @@ static struct vfsmount *nfs_do_root_mount(struct file_system_type *fs_type,
         char *root_devname;
         size_t len;
 
-        len = strlen(hostname) + 3;
+        len = strlen(hostname) + 5;
         root_devname = kmalloc(len, GFP_KERNEL);
         if (root_devname == NULL)
                 return ERR_PTR(-ENOMEM);
-        snprintf(root_devname, len, "%s:/", hostname);
+        /* Does hostname needs to be enclosed in brackets? */
+        if (strchr(hostname, ':'))
+                snprintf(root_devname, len, "[%s]:/", hostname);
+        else
+                snprintf(root_devname, len, "%s:/", hostname);
         root_mnt = vfs_kern_mount(fs_type, flags, root_devname, data);
         kfree(root_devname);
         return root_mnt;
@@ -2951,7 +2955,7 @@ nfs4_xdev_mount(struct file_system_type *fs_type, int flags,
         dprintk("--> nfs4_xdev_mount()\n");
 
         /* create a new volume representation */
-        server = nfs_clone_server(NFS_SB(data->sb), data->fh, data->fattr);
+        server = nfs_clone_server(NFS_SB(data->sb), data->fh, data->fattr, data->authflavor);
         if (IS_ERR(server)) {
                 error = PTR_ERR(server);
                 goto out_err_noserver;
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 2c68818f68ac..c07462320f6b 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -682,7 +682,8 @@ static struct nfs_page *nfs_try_to_update_request(struct inode *inode,
                 req->wb_bytes = rqend - req->wb_offset;
 out_unlock:
         spin_unlock(&inode->i_lock);
-        nfs_clear_request_commit(req);
+        if (req)
+                nfs_clear_request_commit(req);
         return req;
 out_flushme:
         spin_unlock(&inode->i_lock);
@@ -1018,7 +1019,7 @@ out_bad:
         while (!list_empty(res)) {
                 data = list_entry(res->next, struct nfs_write_data, list);
                 list_del(&data->list);
-                nfs_writedata_free(data);
+                nfs_writedata_release(data);
         }
         nfs_redirty_request(req);
         return -ENOMEM;
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 08c6e36ab2eb..43f46cd9edea 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -803,13 +803,13 @@ encode_entry_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name,
         return p;
 }
 
-static int
+static __be32
 compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
                 const char *name, int namlen)
 {
         struct svc_export       *exp;
         struct dentry           *dparent, *dchild;
-        int rv = 0;
+        __be32 rv = nfserr_noent;
 
         dparent = cd->fh.fh_dentry;
         exp  = cd->fh.fh_export;
@@ -817,26 +817,20 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
         if (isdotent(name, namlen)) {
                 if (namlen == 2) {
                         dchild = dget_parent(dparent);
-                        if (dchild == dparent) {
-                                /* filesystem root - cannot return filehandle for ".." */
-                                dput(dchild);
-                                return -ENOENT;
-                        }
+                        /* filesystem root - cannot return filehandle for ".." */
+                        if (dchild == dparent)
+                                goto out;
                 } else
                         dchild = dget(dparent);
         } else
                 dchild = lookup_one_len(name, dparent, namlen);
         if (IS_ERR(dchild))
-                return -ENOENT;
-        rv = -ENOENT;
+                return rv;
         if (d_mountpoint(dchild))
                 goto out;
-        rv = fh_compose(fhp, exp, dchild, &cd->fh);
-        if (rv)
-                goto out;
         if (!dchild->d_inode)
                 goto out;
-        rv = 0;
+        rv = fh_compose(fhp, exp, dchild, &cd->fh);
 out:
         dput(dchild);
         return rv;
@@ -845,7 +839,7 @@ out:
 static __be32 *encode_entryplus_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name, int namlen)
 {
         struct svc_fh   fh;
-        int err;
+        __be32 err;
 
         fh_init(&fh, NFS3_FHSIZE);
         err = compose_entry_fh(cd, &fh, name, namlen);
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 2ed14dfd00a2..987e719fbae8 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -235,17 +235,17 @@ do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_o
                  */
                 if (open->op_createmode == NFS4_CREATE_EXCLUSIVE && status == 0)
                         open->op_bmval[1] = (FATTR4_WORD1_TIME_ACCESS |
-                                                FATTR4_WORD1_TIME_MODIFY);
+                                                        FATTR4_WORD1_TIME_MODIFY);
         } else {
                 status = nfsd_lookup(rqstp, current_fh,
                                      open->op_fname.data, open->op_fname.len, resfh);
                 fh_unlock(current_fh);
-                if (status)
-                        goto out;
-                status = nfsd_check_obj_isreg(resfh);
         }
         if (status)
                 goto out;
+        status = nfsd_check_obj_isreg(resfh);
+        if (status)
+                goto out;
 
         if (is_create_with_attrs(open) && open->op_acl != NULL)
                 do_set_nfs4_acl(rqstp, resfh, open->op_acl, open->op_bmval);
@@ -841,6 +841,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
               struct nfsd4_setattr *setattr)
 {
         __be32 status = nfs_ok;
+        int err;
 
         if (setattr->sa_iattr.ia_valid & ATTR_SIZE) {
                 nfs4_lock_state();
@@ -852,9 +853,9 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                         return status;
                 }
         }
-        status = fh_want_write(&cstate->current_fh);
-        if (status)
-                return status;
+        err = fh_want_write(&cstate->current_fh);
+        if (err)
+                return nfserrno(err);
         status = nfs_ok;
 
         status = check_attr_support(rqstp, cstate, setattr->sa_bmval,
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 4767429264a2..ed3f9206a0ee 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -577,7 +577,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         struct cld_net *cn = nn->cld_net;
 
         if (mlen != sizeof(*cmsg)) {
-                dprintk("%s: got %lu bytes, expected %lu\n", __func__, mlen,
+                dprintk("%s: got %zu bytes, expected %zu\n", __func__, mlen,
                         sizeof(*cmsg));
                 return -EINVAL;
         }
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 1841f8bf845e..7f71c69cdcdf 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4211,16 +4211,14 @@ out:
  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
  * inode operation.)
  */
-static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
+static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
 {
         struct file *file;
-        int err;
-
-        err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
-        if (err)
-                return err;
-        err = vfs_test_lock(file, lock);
-        nfsd_close(file);
+        __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
+        if (!err) {
+                err = nfserrno(vfs_test_lock(file, lock));
+                nfsd_close(file);
+        }
         return err;
 }
 
@@ -4234,7 +4232,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         struct inode *inode;
         struct file_lock file_lock;
         struct nfs4_lockowner *lo;
-        int error;
         __be32 status;
 
         if (locks_in_grace())
@@ -4280,12 +4277,10 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
         nfs4_transform_lock_offset(&file_lock);
 
-        status = nfs_ok;
-        error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
-        if (error) {
-                status = nfserrno(error);
+        status = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+        if (status)
                 goto out;
-        }
+
         if (file_lock.fl_type != F_UNLCK) {
                 status = nfserr_denied;
                 nfs4_set_lock_denied(&file_lock, &lockt->lt_denied);
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index bcd8904ab1e3..74c00bc92b9a 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1392,7 +1392,7 @@ nfsd4_decode_test_stateid(struct nfsd4_compoundargs *argp, struct nfsd4_test_sta
         for (i = 0; i < test_stateid->ts_num_ids; i++) {
                 stateid = kmalloc(sizeof(struct nfsd4_test_stateid_id), GFP_KERNEL);
                 if (!stateid) {
-                        status = PTR_ERR(stateid);
+                        status = nfserrno(-ENOMEM);
                         goto out;
                 }
 
@@ -3410,7 +3410,7 @@ nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, int nfserr,
         *p++ = htonl(test_stateid->ts_num_ids);
 
         list_for_each_entry_safe(stateid, next, &test_stateid->ts_stateid_list, ts_id_list) {
-                *p++ = htonl(stateid->ts_id_status);
+                *p++ = stateid->ts_id_status;
         }
 
         ADJUST_ARGS();
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 296d671654d6..568666156ea4 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1458,7 +1458,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 switch (createmode) {
                 case NFS3_CREATE_UNCHECKED:
                         if (! S_ISREG(dchild->d_inode->i_mode))
-                                err = nfserr_exist;
+                                goto out;
                         else if (truncp) {
                                 /* in nfsv4, we need to treat this case a little
                                  * differently.  we don't want to truncate the
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 3165aebb43c8..31b9463fba1f 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -1134,7 +1134,7 @@ static int ocfs2_adjust_rightmost_branch(handle_t *handle,
         }
 
         el = path_leaf_el(path);
-        rec = &el->l_recs[le32_to_cpu(el->l_next_free_rec) - 1];
+        rec = &el->l_recs[le16_to_cpu(el->l_next_free_rec) - 1];
 
         ocfs2_adjust_rightmost_records(handle, et, path, rec);
 
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index cf7823382664..9f32d7cbb7a3 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -1036,14 +1036,14 @@ static int ocfs2_get_refcount_cpos_end(struct ocfs2_caching_info *ci,
 
         tmp_el = left_path->p_node[subtree_root].el;
         blkno = left_path->p_node[subtree_root+1].bh->b_blocknr;
-        for (i = 0; i < le32_to_cpu(tmp_el->l_next_free_rec); i++) {
+        for (i = 0; i < le16_to_cpu(tmp_el->l_next_free_rec); i++) {
                 if (le64_to_cpu(tmp_el->l_recs[i].e_blkno) == blkno) {
                         *cpos_end = le32_to_cpu(tmp_el->l_recs[i+1].e_cpos);
                         break;
                 }
         }
 
-        BUG_ON(i == le32_to_cpu(tmp_el->l_next_free_rec));
+        BUG_ON(i == le16_to_cpu(tmp_el->l_next_free_rec));
 
 out:
         ocfs2_free_path(left_path);
@@ -1468,7 +1468,7 @@ static int ocfs2_divide_leaf_refcount_block(struct buffer_head *ref_leaf_bh,
 
         trace_ocfs2_divide_leaf_refcount_block(
                 (unsigned long long)ref_leaf_bh->b_blocknr,
-                le32_to_cpu(rl->rl_count), le32_to_cpu(rl->rl_used));
+                le16_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
 
         /*
          * XXX: Improvement later.
@@ -2411,7 +2411,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
                                 rb = (struct ocfs2_refcount_block *)
                                                         prev_bh->b_data;
 
-                                if (le64_to_cpu(rb->rf_records.rl_used) +
+                                if (le16_to_cpu(rb->rf_records.rl_used) +
                                     recs_add >
                                     le16_to_cpu(rb->rf_records.rl_count))
                                         ref_blocks++;
@@ -2476,7 +2476,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
         if (prev_bh) {
                 rb = (struct ocfs2_refcount_block *)prev_bh->b_data;
 
-                if (le64_to_cpu(rb->rf_records.rl_used) + recs_add >
+                if (le16_to_cpu(rb->rf_records.rl_used) + recs_add >
                     le16_to_cpu(rb->rf_records.rl_count))
                         ref_blocks++;
 
@@ -3629,7 +3629,7 @@ int ocfs2_refcounted_xattr_delete_need(struct inode *inode,
                          * one will split a refcount rec, so totally we need
                          * clusters * 2 new refcount rec.
                          */
-                        if (le64_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
+                        if (le16_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
                             le16_to_cpu(rb->rf_records.rl_count))
                                 ref_blocks++;
 
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index ba5d97e4a73e..f169da4624fd 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -600,7 +600,7 @@ static void ocfs2_bg_alloc_cleanup(handle_t *handle,
                 ret = ocfs2_free_clusters(handle, cluster_ac->ac_inode,
                                           cluster_ac->ac_bh,
                                           le64_to_cpu(rec->e_blkno),
-                                          le32_to_cpu(rec->e_leaf_clusters));
+                                          le16_to_cpu(rec->e_leaf_clusters));
                 if (ret)
                         mlog_errno(ret);
                 /* Try all the clusters to free */
@@ -1628,7 +1628,7 @@ static int ocfs2_bg_discontig_fix_by_rec(struct ocfs2_suballoc_result *res,
 {
         unsigned int bpc = le16_to_cpu(cl->cl_bpc);
         unsigned int bitoff = le32_to_cpu(rec->e_cpos) * bpc;
-        unsigned int bitcount = le32_to_cpu(rec->e_leaf_clusters) * bpc;
+        unsigned int bitcount = le16_to_cpu(rec->e_leaf_clusters) * bpc;
 
         if (res->sr_bit_offset < bitoff)
                 return 0;
diff --git a/fs/pipe.c b/fs/pipe.c
index 25feaa3faac0..fec5e4ad071a 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -346,6 +346,16 @@ static const struct pipe_buf_operations anon_pipe_buf_ops = {
         .get = generic_pipe_buf_get,
 };
 
+static const struct pipe_buf_operations packet_pipe_buf_ops = {
+        .can_merge = 0,
+        .map = generic_pipe_buf_map,
+        .unmap = generic_pipe_buf_unmap,
+        .confirm = generic_pipe_buf_confirm,
+        .release = anon_pipe_buf_release,
+        .steal = generic_pipe_buf_steal,
+        .get = generic_pipe_buf_get,
+};
+
 static ssize_t
 pipe_read(struct kiocb *iocb, const struct iovec *_iov,
            unsigned long nr_segs, loff_t pos)
@@ -407,6 +417,13 @@ redo:
                         ret += chars;
                         buf->offset += chars;
                         buf->len -= chars;
+
+                        /* Was it a packet buffer? Clean up and exit */
+                        if (buf->flags & PIPE_BUF_FLAG_PACKET) {
+                                total_len = chars;
+                                buf->len = 0;
+                        }
+
                         if (!buf->len) {
                                 buf->ops = NULL;
                                 ops->release(pipe, buf);
@@ -459,6 +476,11 @@ redo:
         return ret;
 }
 
+static inline int is_packetized(struct file *file)
+{
+        return (file->f_flags & O_DIRECT) != 0;
+}
+
 static ssize_t
 pipe_write(struct kiocb *iocb, const struct iovec *_iov,
             unsigned long nr_segs, loff_t ppos)
@@ -593,6 +615,11 @@ redo2:
                         buf->ops = &anon_pipe_buf_ops;
                         buf->offset = 0;
                         buf->len = chars;
+                        buf->flags = 0;
+                        if (is_packetized(filp)) {
+                                buf->ops = &packet_pipe_buf_ops;
+                                buf->flags = PIPE_BUF_FLAG_PACKET;
+                        }
                         pipe->nrbufs = ++bufs;
                         pipe->tmp_page = NULL;
 
@@ -1013,7 +1040,7 @@ struct file *create_write_pipe(int flags)
                 goto err_dentry;
         f->f_mapping = inode->i_mapping;
 
-        f->f_flags = O_WRONLY | (flags & O_NONBLOCK);
+        f->f_flags = O_WRONLY | (flags & (O_NONBLOCK | O_DIRECT));
         f->f_version = 0;
 
         return f;
@@ -1057,7 +1084,7 @@ int do_pipe_flags(int *fd, int flags)
         int error;
         int fdw, fdr;
 
-        if (flags & ~(O_CLOEXEC | O_NONBLOCK))
+        if (flags & ~(O_CLOEXEC | O_NONBLOCK | O_DIRECT))
                 return -EINVAL;
 
         fw = create_write_pipe(flags);
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 6a0c62d6e442..64c3b3172367 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -18,19 +18,39 @@
 #ifndef arch_irq_stat
 #define arch_irq_stat() 0
 #endif
-#ifndef arch_idle_time
-#define arch_idle_time(cpu) 0
-#endif
+
+#ifdef arch_idle_time
+
+static cputime64_t get_idle_time(int cpu)
+{
+        cputime64_t idle;
+
+        idle = kcpustat_cpu(cpu).cpustat[CPUTIME_IDLE];
+        if (cpu_online(cpu) && !nr_iowait_cpu(cpu))
+                idle += arch_idle_time(cpu);
+        return idle;
+}
+
+static cputime64_t get_iowait_time(int cpu)
+{
+        cputime64_t iowait;
+
+        iowait = kcpustat_cpu(cpu).cpustat[CPUTIME_IOWAIT];
+        if (cpu_online(cpu) && nr_iowait_cpu(cpu))
+                iowait += arch_idle_time(cpu);
+        return iowait;
+}
+
+#else
 
 static u64 get_idle_time(int cpu)
 {
         u64 idle, idle_time = get_cpu_idle_time_us(cpu, NULL);
 
-        if (idle_time == -1ULL) {
+        if (idle_time == -1ULL)
                 /* !NO_HZ so we can rely on cpustat.idle */
                 idle = kcpustat_cpu(cpu).cpustat[CPUTIME_IDLE];
-                idle += arch_idle_time(cpu);
-        } else
+        else
                 idle = usecs_to_cputime64(idle_time);
 
         return idle;
@@ -49,6 +69,8 @@ static u64 get_iowait_time(int cpu)
         return iowait;
 }
 
+#endif
+
 static int show_stat(struct seq_file *p, void *v)
 {
         int i, j;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 2b9a7607cbd5..2d60492d6df8 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -597,9 +597,6 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
                 if (!page)
                         continue;
 
-                if (PageReserved(page))
-                        continue;
-
                 /* Clear accessed and referenced bits. */
                 ptep_test_and_clear_young(vma, addr, pte);
                 ClearPageReferenced(page);
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 2a7a3f5d1ca6..35a36d39fa2c 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -729,6 +729,9 @@ int sysfs_create_dir(struct kobject * kobj)
         else
                 parent_sd = &sysfs_root;
 
+        if (!parent_sd)
+                return -ENOENT;
+
         if (sysfs_ns_type(parent_sd))
                 ns = kobj->ktype->namespace(kobj);
         type = sysfs_read_ns_type(kobj);
@@ -878,7 +881,6 @@ int sysfs_rename(struct sysfs_dirent *sd,
 
                 dup_name = sd->s_name;
                 sd->s_name = new_name;
-                sd->s_hash = sysfs_name_hash(sd->s_ns, sd->s_name);
         }
 
         /* Move to the appropriate place in the appropriate directories rbtree. */
@@ -886,6 +888,7 @@ int sysfs_rename(struct sysfs_dirent *sd,
         sysfs_get(new_parent_sd);
         sysfs_put(sd->s_parent);
         sd->s_ns = new_ns;
+        sd->s_hash = sysfs_name_hash(sd->s_ns, sd->s_name);
         sd->s_parent = new_parent_sd;
         sysfs_link_sibling(sd);
 
diff --git a/fs/sysfs/group.c b/fs/sysfs/group.c
index dd1701caecc9..2df555c66d57 100644
--- a/fs/sysfs/group.c
+++ b/fs/sysfs/group.c
@@ -67,7 +67,11 @@ static int internal_create_group(struct kobject *kobj, int update,
         /* Updates may happen before the object has been instantiated */
         if (unlikely(update && !kobj->sd))
                 return -EINVAL;
-
+        if (!grp->attrs) {
+                WARN(1, "sysfs: attrs not set by subsystem for group: %s/%s\n",
+                        kobj->name, grp->name ? "" : grp->name);
+                return -EINVAL;
+        }
         if (grp->name) {
                 error = sysfs_create_subdir(kobj, grp->name, &sd);
                 if (error)
diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
index eba66043cf1b..e8bcc4742e0e 100644
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -499,9 +499,10 @@ typedef u64 acpi_integer;
 #define ACPI_STATE_D0                   (u8) 0
 #define ACPI_STATE_D1                   (u8) 1
 #define ACPI_STATE_D2                   (u8) 2
-#define ACPI_STATE_D3                   (u8) 3
-#define ACPI_STATE_D3_COLD              (u8) 4
-#define ACPI_D_STATES_MAX               ACPI_STATE_D3_COLD
+#define ACPI_STATE_D3_HOT               (u8) 3
+#define ACPI_STATE_D3                   (u8) 4
+#define ACPI_STATE_D3_COLD              ACPI_STATE_D3
+#define ACPI_D_STATES_MAX               ACPI_STATE_D3
 #define ACPI_D_STATE_COUNT              5
 
 #define ACPI_STATE_C0                   (u8) 0
diff --git a/include/asm-generic/siginfo.h b/include/asm-generic/siginfo.h
index 0dd4e87f6fba..5e5e3865f1ed 100644
--- a/include/asm-generic/siginfo.h
+++ b/include/asm-generic/siginfo.h
@@ -35,6 +35,14 @@ typedef union sigval {
 #define __ARCH_SI_BAND_T long
 #endif
 
+#ifndef __ARCH_SI_CLOCK_T
+#define __ARCH_SI_CLOCK_T __kernel_clock_t
+#endif
+
+#ifndef __ARCH_SI_ATTRIBUTES
+#define __ARCH_SI_ATTRIBUTES
+#endif
+
 #ifndef HAVE_ARCH_SIGINFO_T
 
 typedef struct siginfo {
@@ -72,8 +80,8 @@ typedef struct siginfo {
                         __kernel_pid_t _pid;    /* which child */
                         __ARCH_SI_UID_T _uid;   /* sender's uid */
                         int _status;            /* exit code */
-                        __kernel_clock_t _utime;
-                        __kernel_clock_t _stime;
+                        __ARCH_SI_CLOCK_T _utime;
+                        __ARCH_SI_CLOCK_T _stime;
                 } _sigchld;
 
                 /* SIGILL, SIGFPE, SIGSEGV, SIGBUS */
@@ -91,7 +99,7 @@ typedef struct siginfo {
                         int _fd;
                 } _sigpoll;
         } _sifields;
-} siginfo_t;
+} __ARCH_SI_ATTRIBUTES siginfo_t;
 
 #endif
 
diff --git a/include/asm-generic/statfs.h b/include/asm-generic/statfs.h
index 0fd28e028de1..c749af9c0983 100644
--- a/include/asm-generic/statfs.h
+++ b/include/asm-generic/statfs.h
@@ -15,7 +15,7 @@ typedef __kernel_fsid_t	fsid_t;
  * with a 10' pole.
  */
 #ifndef __statfs_word
-#if BITS_PER_LONG == 64
+#if __BITS_PER_LONG == 64
 #define __statfs_word long
 #else
 #define __statfs_word __u32
diff --git a/include/drm/exynos_drm.h b/include/drm/exynos_drm.h
index 3963116083ae..e478de4e5d56 100644
--- a/include/drm/exynos_drm.h
+++ b/include/drm/exynos_drm.h
@@ -85,7 +85,7 @@ struct drm_exynos_gem_mmap {
 struct drm_exynos_vidi_connection {
         unsigned int connection;
         unsigned int extensions;
-        uint64_t *edid;
+        uint64_t edid;
 };
 
 struct drm_exynos_plane_set_zpos {
@@ -96,7 +96,8 @@ struct drm_exynos_plane_set_zpos {
 /* memory type definitions. */
 enum e_drm_exynos_gem_mem_type {
         /* Physically Non-Continuous memory. */
-        EXYNOS_BO_NONCONTIG     = 1 << 0
+        EXYNOS_BO_NONCONTIG     = 1 << 0,
+        EXYNOS_BO_MASK          = EXYNOS_BO_NONCONTIG
 };
 
 #define DRM_EXYNOS_GEM_CREATE           0x00
diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h
index 7847e197730a..8d54f79457ba 100644
--- a/include/linux/amba/bus.h
+++ b/include/linux/amba/bus.h
@@ -30,7 +30,6 @@ struct amba_device {
         struct device           dev;
         struct resource         res;
         struct clk              *pclk;
-        struct regulator        *vcore;
         u64                     dma_mask;
         unsigned int            periphid;
         unsigned int            irq[AMBA_NR_IRQS];
@@ -75,12 +74,6 @@ void amba_release_regions(struct amba_device *);
 #define amba_pclk_disable(d)    \
         do { if (!IS_ERR((d)->pclk)) clk_disable((d)->pclk); } while (0)
 
-#define amba_vcore_enable(d)    \
-        (IS_ERR((d)->vcore) ? 0 : regulator_enable((d)->vcore))
-
-#define amba_vcore_disable(d)   \
-        do { if (!IS_ERR((d)->vcore)) regulator_disable((d)->vcore); } while (0)
-
 /* Some drivers don't use the struct amba_device */
 #define AMBA_CONFIG_BITS(a) (((a) >> 24) & 0xff)
 #define AMBA_REV_BITS(a) (((a) >> 20) & 0x0f)
diff --git a/include/linux/amba/pl022.h b/include/linux/amba/pl022.h
index b8c51124ed19..76dd1b199a1b 100644
--- a/include/linux/amba/pl022.h
+++ b/include/linux/amba/pl022.h
@@ -25,6 +25,8 @@
 #ifndef _SSP_PL022_H
 #define _SSP_PL022_H
 
+#include <linux/types.h>
+
 /**
  * whether SSP is in loopback mode or not
  */
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 606cf339bb56..2aa24664a5b5 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -426,14 +426,10 @@ struct request_queue {
                                  (1 << QUEUE_FLAG_SAME_COMP)    |       \
                                  (1 << QUEUE_FLAG_ADD_RANDOM))
 
-static inline int queue_is_locked(struct request_queue *q)
+static inline void queue_lockdep_assert_held(struct request_queue *q)
 {
-#ifdef CONFIG_SMP
-        spinlock_t *lock = q->queue_lock;
-        return lock && spin_is_locked(lock);
-#else
-        return 1;
-#endif
+        if (q->queue_lock)
+                lockdep_assert_held(q->queue_lock);
 }
 
 static inline void queue_flag_set_unlocked(unsigned int flag,
@@ -445,7 +441,7 @@ static inline void queue_flag_set_unlocked(unsigned int flag,
 static inline int queue_flag_test_and_clear(unsigned int flag,
                                             struct request_queue *q)
 {
-        WARN_ON_ONCE(!queue_is_locked(q));
+        queue_lockdep_assert_held(q);
 
         if (test_bit(flag, &q->queue_flags)) {
                 __clear_bit(flag, &q->queue_flags);
@@ -458,7 +454,7 @@ static inline int queue_flag_test_and_clear(unsigned int flag,
 static inline int queue_flag_test_and_set(unsigned int flag,
                                           struct request_queue *q)
 {
-        WARN_ON_ONCE(!queue_is_locked(q));
+        queue_lockdep_assert_held(q);
 
         if (!test_bit(flag, &q->queue_flags)) {
                 __set_bit(flag, &q->queue_flags);
@@ -470,7 +466,7 @@ static inline int queue_flag_test_and_set(unsigned int flag,
 
 static inline void queue_flag_set(unsigned int flag, struct request_queue *q)
 {
-        WARN_ON_ONCE(!queue_is_locked(q));
+        queue_lockdep_assert_held(q);
         __set_bit(flag, &q->queue_flags);
 }
 
@@ -487,7 +483,7 @@ static inline int queue_in_flight(struct request_queue *q)
 
 static inline void queue_flag_clear(unsigned int flag, struct request_queue *q)
 {
-        WARN_ON_ONCE(!queue_is_locked(q));
+        queue_lockdep_assert_held(q);
         __clear_bit(flag, &q->queue_flags);
 }
 
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 676f967390ae..f9a2e5e67a54 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -974,6 +974,7 @@ int dma_async_device_register(struct dma_device *device);
 void dma_async_device_unregister(struct dma_device *device);
 void dma_run_dependencies(struct dma_async_tx_descriptor *tx);
 struct dma_chan *dma_find_channel(enum dma_transaction_type tx_type);
+struct dma_chan *net_dma_find_channel(void);
 #define dma_request_channel(mask, x, y) __dma_request_channel(&(mask), x, y)
 
 /* --- Helper iov-locking functions --- */
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 88ec80670d5f..ec45ccd8708a 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -554,7 +554,18 @@ extern int __init efi_setup_pcdp_console(char *);
 #define EFI_VARIABLE_NON_VOLATILE       0x0000000000000001
 #define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x0000000000000002
 #define EFI_VARIABLE_RUNTIME_ACCESS     0x0000000000000004
-
+#define EFI_VARIABLE_HARDWARE_ERROR_RECORD 0x0000000000000008
+#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS 0x0000000000000010
+#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS 0x0000000000000020
+#define EFI_VARIABLE_APPEND_WRITE       0x0000000000000040
+
+#define EFI_VARIABLE_MASK       (EFI_VARIABLE_NON_VOLATILE | \
+                                EFI_VARIABLE_BOOTSERVICE_ACCESS | \
+                                EFI_VARIABLE_RUNTIME_ACCESS | \
+                                EFI_VARIABLE_HARDWARE_ERROR_RECORD | \
+                                EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | \
+                                EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \
+                                EFI_VARIABLE_APPEND_WRITE)
 /*
  * The type of search to perform when calling boottime->locate_handle
  */
diff --git a/include/linux/fuse.h b/include/linux/fuse.h
index 8ba2c9460b28..8f2ab8fef929 100644
--- a/include/linux/fuse.h
+++ b/include/linux/fuse.h
@@ -593,7 +593,7 @@ struct fuse_dirent {
         __u64   off;
         __u32   namelen;
         __u32   type;
-        char name[0];
+        char name[];
 };
 
 #define FUSE_NAME_OFFSET offsetof(struct fuse_dirent, name)
diff --git a/include/linux/gpio-pxa.h b/include/linux/gpio-pxa.h
index 05071ee34c3f..d755b28ba635 100644
--- a/include/linux/gpio-pxa.h
+++ b/include/linux/gpio-pxa.h
@@ -13,4 +13,8 @@ extern int pxa_last_gpio;
 
 extern int pxa_irq_to_gpio(int irq);
 
+struct pxa_gpio_platform_data {
+        int (*gpio_set_wake)(unsigned int gpio, unsigned int on);
+};
+
 #endif /* __GPIO_PXA_H */
diff --git a/include/linux/hsi/hsi.h b/include/linux/hsi/hsi.h
index 4b178067f405..56fae865e272 100644
--- a/include/linux/hsi/hsi.h
+++ b/include/linux/hsi/hsi.h
@@ -26,9 +26,9 @@
 #include <linux/device.h>
 #include <linux/mutex.h>
 #include <linux/scatterlist.h>
-#include <linux/spinlock.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/notifier.h>
 
 /* HSI message ttype */
 #define HSI_MSG_READ    0
@@ -121,18 +121,18 @@ static inline int hsi_register_board_info(struct hsi_board_info const *info,
  * @device: Driver model representation of the device
  * @tx_cfg: HSI TX configuration
  * @rx_cfg: HSI RX configuration
- * @hsi_start_rx: Called after incoming wake line goes high
- * @hsi_stop_rx: Called after incoming wake line goes low
+ * @e_handler: Callback for handling port events (RX Wake High/Low)
+ * @pclaimed: Keeps tracks if the clients claimed its associated HSI port
+ * @nb: Notifier block for port events
  */
 struct hsi_client {
         struct device           device;
         struct hsi_config       tx_cfg;
         struct hsi_config       rx_cfg;
-        void                    (*hsi_start_rx)(struct hsi_client *cl);
-        void                    (*hsi_stop_rx)(struct hsi_client *cl);
         /* private: */
+        void                    (*ehandler)(struct hsi_client *, unsigned long);
         unsigned int            pclaimed:1;
-        struct list_head        link;
+        struct notifier_block   nb;
 };
 
 #define to_hsi_client(dev) container_of(dev, struct hsi_client, device)
@@ -147,6 +147,10 @@ static inline void *hsi_client_drvdata(struct hsi_client *cl)
         return dev_get_drvdata(&cl->device);
 }
 
+int hsi_register_port_event(struct hsi_client *cl,
+                        void (*handler)(struct hsi_client *, unsigned long));
+int hsi_unregister_port_event(struct hsi_client *cl);
+
 /**
  * struct hsi_client_driver - Driver associated to an HSI client
  * @driver: Driver model representation of the driver
@@ -214,8 +218,7 @@ void hsi_free_msg(struct hsi_msg *msg);
  * @start_tx: Callback to inform that a client wants to TX data
  * @stop_tx: Callback to inform that a client no longer wishes to TX data
  * @release: Callback to inform that a client no longer uses the port
- * @clients: List of hsi_clients using the port.
- * @clock: Lock to serialize access to the clients list.
+ * @n_head: Notifier chain for signaling port events to the clients.
  */
 struct hsi_port {
         struct device                   device;
@@ -231,14 +234,14 @@ struct hsi_port {
         int                             (*start_tx)(struct hsi_client *cl);
         int                             (*stop_tx)(struct hsi_client *cl);
         int                             (*release)(struct hsi_client *cl);
-        struct list_head                clients;
-        spinlock_t                      clock;
+        /* private */
+        struct atomic_notifier_head     n_head;
 };
 
 #define to_hsi_port(dev) container_of(dev, struct hsi_port, device)
 #define hsi_get_port(cl) to_hsi_port((cl)->device.parent)
 
-void hsi_event(struct hsi_port *port, unsigned int event);
+int hsi_event(struct hsi_port *port, unsigned long event);
 int hsi_claim_port(struct hsi_client *cl, unsigned int share);
 void hsi_release_port(struct hsi_client *cl);
 
@@ -270,13 +273,13 @@ struct hsi_controller {
         struct module           *owner;
         unsigned int            id;
         unsigned int            num_ports;
-        struct hsi_port         *port;
+        struct hsi_port         **port;
 };
 
 #define to_hsi_controller(dev) container_of(dev, struct hsi_controller, device)
 
 struct hsi_controller *hsi_alloc_controller(unsigned int n_ports, gfp_t flags);
-void hsi_free_controller(struct hsi_controller *hsi);
+void hsi_put_controller(struct hsi_controller *hsi);
 int hsi_register_controller(struct hsi_controller *hsi);
 void hsi_unregister_controller(struct hsi_controller *hsi);
 
@@ -294,7 +297,7 @@ static inline void *hsi_controller_drvdata(struct hsi_controller *hsi)
 static inline struct hsi_port *hsi_find_port_num(struct hsi_controller *hsi,
                                                         unsigned int num)
 {
-        return (num < hsi->num_ports) ? &hsi->port[num] : NULL;
+        return (num < hsi->num_ports) ? hsi->port[num] : NULL;
 }
 
 /*
diff --git a/include/linux/i2c/twl.h b/include/linux/i2c/twl.h
index 2463b6100333..1f90de0cfdbe 100644
--- a/include/linux/i2c/twl.h
+++ b/include/linux/i2c/twl.h
@@ -666,23 +666,11 @@ struct twl4030_codec_data {
         unsigned int check_defaults:1;
         unsigned int reset_registers:1;
         unsigned int hs_extmute:1;
-        u16 hs_left_step;
-        u16 hs_right_step;
-        u16 hf_left_step;
-        u16 hf_right_step;
         void (*set_hs_extmute)(int mute);
 };
 
 struct twl4030_vibra_data {
         unsigned int    coexist;
-
-        /* twl6040 */
-        unsigned int vibldrv_res;       /* left driver resistance */
-        unsigned int vibrdrv_res;       /* right driver resistance */
-        unsigned int viblmotor_res;     /* left motor resistance */
-        unsigned int vibrmotor_res;     /* right motor resistance */
-        int vddvibl_uV;                 /* VDDVIBL volt, set 0 for fixed reg */
-        int vddvibr_uV;                 /* VDDVIBR volt, set 0 for fixed reg */
 };
 
 struct twl4030_audio_data {
diff --git a/include/linux/irq.h b/include/linux/irq.h
index bff29c58da23..b27cfcfd3a59 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -49,6 +49,12 @@ typedef	void (*irq_preflow_handler_t)(struct irq_data *data);
  * IRQ_TYPE_LEVEL_LOW           - low level triggered
  * IRQ_TYPE_LEVEL_MASK          - Mask to filter out the level bits
  * IRQ_TYPE_SENSE_MASK          - Mask for all the above bits
+ * IRQ_TYPE_DEFAULT             - For use by some PICs to ask irq_set_type
+ *                                to setup the HW to a sane default (used
+ *                                by irqdomain map() callbacks to synchronize
+ *                                the HW state and SW flags for a newly
+ *                                allocated descriptor).
+ *
  * IRQ_TYPE_PROBE               - Special flag for probing in progress
  *
  * Bits which can be modified via irq_set/clear/modify_status_flags()
@@ -77,6 +83,7 @@ enum {
         IRQ_TYPE_LEVEL_LOW      = 0x00000008,
         IRQ_TYPE_LEVEL_MASK     = (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH),
         IRQ_TYPE_SENSE_MASK     = 0x0000000f,
+        IRQ_TYPE_DEFAULT        = IRQ_TYPE_SENSE_MASK,
 
         IRQ_TYPE_PROBE          = 0x00000010,
 
@@ -263,6 +270,11 @@ static inline void irqd_clr_chained_irq_inprogress(struct irq_data *d)
         d->state_use_accessors &= ~IRQD_IRQ_INPROGRESS;
 }
 
+static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
+{
+        return d->hwirq;
+}
+
 /**
  * struct irq_chip - hardware interrupt chip descriptor
  *
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index ead4a4215797..c65740d76e66 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -42,12 +42,6 @@ struct of_device_id;
 /* Number of irqs reserved for a legacy isa controller */
 #define NUM_ISA_INTERRUPTS      16
 
-/* This type is the placeholder for a hardware interrupt number. It has to
- * be big enough to enclose whatever representation is used by a given
- * platform.
- */
-typedef unsigned long irq_hw_number_t;
-
 /**
  * struct irq_domain_ops - Methods for irq_domain objects
  * @match: Match an interrupt controller device node to a host, returns
@@ -104,6 +98,9 @@ struct irq_domain {
                         unsigned int size;
                         unsigned int *revmap;
                 } linear;
+                struct {
+                        unsigned int max_irq;
+                } nomap;
                 struct radix_tree_root tree;
         } revmap_data;
         const struct irq_domain_ops *ops;
@@ -126,6 +123,7 @@ struct irq_domain *irq_domain_add_linear(struct device_node *of_node,
                                          const struct irq_domain_ops *ops,
                                          void *host_data);
 struct irq_domain *irq_domain_add_nomap(struct device_node *of_node,
+                                         unsigned int max_irq,
                                          const struct irq_domain_ops *ops,
                                          void *host_data);
 struct irq_domain *irq_domain_add_tree(struct device_node *of_node,
@@ -134,7 +132,6 @@ struct irq_domain *irq_domain_add_tree(struct device_node *of_node,
 
 extern struct irq_domain *irq_find_host(struct device_node *node);
 extern void irq_set_default_host(struct irq_domain *host);
-extern void irq_set_virq_count(unsigned int count);
 
 static inline struct irq_domain *irq_domain_add_legacy_isa(
                                 struct device_node *of_node,
@@ -146,7 +143,6 @@ static inline struct irq_domain *irq_domain_add_legacy_isa(
 }
 extern struct irq_domain *irq_find_host(struct device_node *node);
 extern void irq_set_default_host(struct irq_domain *host);
-extern void irq_set_virq_count(unsigned int count);
 
 
 extern unsigned int irq_create_mapping(struct irq_domain *host,
diff --git a/include/linux/kconfig.h b/include/linux/kconfig.h
index 067eda0e4b32..be342b94c640 100644
--- a/include/linux/kconfig.h
+++ b/include/linux/kconfig.h
@@ -4,29 +4,43 @@
 #include <generated/autoconf.h>
 
 /*
- * Helper macros to use CONFIG_ options in C expressions. Note that
+ * Helper macros to use CONFIG_ options in C/CPP expressions. Note that
  * these only work with boolean and tristate options.
  */
 
 /*
+ * Getting something that works in C and CPP for an arg that may or may
+ * not be defined is tricky.  Here, if we have "#define CONFIG_BOOGER 1"
+ * we match on the placeholder define, insert the "0," for arg1 and generate
+ * the triplet (0, 1, 0).  Then the last step cherry picks the 2nd arg (a one).
+ * When CONFIG_BOOGER is not defined, we generate a (... 1, 0) pair, and when
+ * the last step cherry picks the 2nd arg, we get a zero.
+ */
+#define __ARG_PLACEHOLDER_1 0,
+#define config_enabled(cfg) _config_enabled(cfg)
+#define _config_enabled(value) __config_enabled(__ARG_PLACEHOLDER_##value)
+#define __config_enabled(arg1_or_junk) ___config_enabled(arg1_or_junk 1, 0)
+#define ___config_enabled(__ignored, val, ...) val
+
+/*
  * IS_ENABLED(CONFIG_FOO) evaluates to 1 if CONFIG_FOO is set to 'y' or 'm',
  * 0 otherwise.
  *
  */
 #define IS_ENABLED(option) \
-        (__enabled_ ## option || __enabled_ ## option ## _MODULE)
+        (config_enabled(option) || config_enabled(option##_MODULE))
 
 /*
  * IS_BUILTIN(CONFIG_FOO) evaluates to 1 if CONFIG_FOO is set to 'y', 0
  * otherwise. For boolean options, this is equivalent to
  * IS_ENABLED(CONFIG_FOO).
  */
-#define IS_BUILTIN(option) __enabled_ ## option
+#define IS_BUILTIN(option) config_enabled(option)
 
 /*
  * IS_MODULE(CONFIG_FOO) evaluates to 1 if CONFIG_FOO is set to 'm', 0
  * otherwise.
  */
-#define IS_MODULE(option) __enabled_ ## option ## _MODULE
+#define IS_MODULE(option) config_enabled(option##_MODULE)
 
 #endif /* __LINUX_KCONFIG_H */
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 665a260c7e09..72cbf08d45fb 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -596,6 +596,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id);
 
 #ifdef CONFIG_IOMMU_API
 int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
+void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
 int kvm_iommu_map_guest(struct kvm *kvm);
 int kvm_iommu_unmap_guest(struct kvm *kvm);
 int kvm_assign_device(struct kvm *kvm,
@@ -609,6 +610,11 @@ static inline int kvm_iommu_map_pages(struct kvm *kvm,
         return 0;
 }
 
+static inline void kvm_iommu_unmap_pages(struct kvm *kvm,
+                                         struct kvm_memory_slot *slot)
+{
+}
+
 static inline int kvm_iommu_map_guest(struct kvm *kvm)
 {
         return -ENODEV;
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 42378d637ffb..e926df7b54c9 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -996,7 +996,8 @@ extern int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *dev,
 extern void ata_sas_port_destroy(struct ata_port *);
 extern struct ata_port *ata_sas_port_alloc(struct ata_host *,
                                            struct ata_port_info *, struct Scsi_Host *);
-extern int ata_sas_async_port_init(struct ata_port *);
+extern void ata_sas_async_probe(struct ata_port *ap);
+extern int ata_sas_sync_probe(struct ata_port *ap);
 extern int ata_sas_port_init(struct ata_port *);
 extern int ata_sas_port_start(struct ata_port *ap);
 extern void ata_sas_port_stop(struct ata_port *ap);
diff --git a/include/linux/mfd/db5500-prcmu.h b/include/linux/mfd/db5500-prcmu.h
index 9890687f582d..5a049dfaf153 100644
--- a/include/linux/mfd/db5500-prcmu.h
+++ b/include/linux/mfd/db5500-prcmu.h
@@ -8,41 +8,14 @@
 #ifndef __MFD_DB5500_PRCMU_H
 #define __MFD_DB5500_PRCMU_H
 
-#ifdef CONFIG_MFD_DB5500_PRCMU
-
-void db5500_prcmu_early_init(void);
-int db5500_prcmu_set_epod(u16 epod_id, u8 epod_state);
-int db5500_prcmu_set_display_clocks(void);
-int db5500_prcmu_disable_dsipll(void);
-int db5500_prcmu_enable_dsipll(void);
-int db5500_prcmu_abb_read(u8 slave, u8 reg, u8 *value, u8 size);
-int db5500_prcmu_abb_write(u8 slave, u8 reg, u8 *value, u8 size);
-void db5500_prcmu_enable_wakeups(u32 wakeups);
-int db5500_prcmu_request_clock(u8 clock, bool enable);
-void db5500_prcmu_config_abb_event_readout(u32 abb_events);
-void db5500_prcmu_get_abb_event_buffer(void __iomem **buf);
-int prcmu_resetout(u8 resoutn, u8 state);
-int db5500_prcmu_set_power_state(u8 state, bool keep_ulp_clk,
-        bool keep_ap_pll);
-int db5500_prcmu_config_esram0_deep_sleep(u8 state);
-void db5500_prcmu_system_reset(u16 reset_code);
-u16 db5500_prcmu_get_reset_code(void);
-bool db5500_prcmu_is_ac_wake_requested(void);
-int db5500_prcmu_set_arm_opp(u8 opp);
-int db5500_prcmu_get_arm_opp(void);
-
-#else /* !CONFIG_UX500_SOC_DB5500 */
-
-static inline void db5500_prcmu_early_init(void) {}
-
-static inline int db5500_prcmu_abb_read(u8 slave, u8 reg, u8 *value, u8 size)
+static inline int prcmu_resetout(u8 resoutn, u8 state)
 {
-        return -ENOSYS;
+        return 0;
 }
 
-static inline int db5500_prcmu_abb_write(u8 slave, u8 reg, u8 *value, u8 size)
+static inline int db5500_prcmu_set_epod(u16 epod_id, u8 epod_state)
 {
-        return -ENOSYS;
+        return 0;
 }
 
 static inline int db5500_prcmu_request_clock(u8 clock, bool enable)
@@ -50,69 +23,82 @@ static inline int db5500_prcmu_request_clock(u8 clock, bool enable)
         return 0;
 }
 
-static inline int db5500_prcmu_set_display_clocks(void)
+static inline int db5500_prcmu_set_power_state(u8 state, bool keep_ulp_clk,
+        bool keep_ap_pll)
 {
         return 0;
 }
 
-static inline int db5500_prcmu_disable_dsipll(void)
+static inline int db5500_prcmu_config_esram0_deep_sleep(u8 state)
 {
         return 0;
 }
 
-static inline int db5500_prcmu_enable_dsipll(void)
+static inline u16 db5500_prcmu_get_reset_code(void)
 {
         return 0;
 }
 
-static inline int db5500_prcmu_config_esram0_deep_sleep(u8 state)
+static inline bool db5500_prcmu_is_ac_wake_requested(void)
 {
         return 0;
 }
 
-static inline void db5500_prcmu_enable_wakeups(u32 wakeups) {}
-
-static inline int prcmu_resetout(u8 resoutn, u8 state)
+static inline int db5500_prcmu_set_arm_opp(u8 opp)
 {
         return 0;
 }
 
-static inline int db5500_prcmu_set_epod(u16 epod_id, u8 epod_state)
+static inline int db5500_prcmu_get_arm_opp(void)
 {
         return 0;
 }
 
-static inline void db5500_prcmu_get_abb_event_buffer(void __iomem **buf) {}
 static inline void db5500_prcmu_config_abb_event_readout(u32 abb_events) {}
 
-static inline int db5500_prcmu_set_power_state(u8 state, bool keep_ulp_clk,
-        bool keep_ap_pll)
-{
-        return 0;
-}
+static inline void db5500_prcmu_get_abb_event_buffer(void __iomem **buf) {}
 
 static inline void db5500_prcmu_system_reset(u16 reset_code) {}
 
-static inline u16 db5500_prcmu_get_reset_code(void)
+static inline void db5500_prcmu_enable_wakeups(u32 wakeups) {}
+
+#ifdef CONFIG_MFD_DB5500_PRCMU
+
+void db5500_prcmu_early_init(void);
+int db5500_prcmu_set_display_clocks(void);
+int db5500_prcmu_disable_dsipll(void);
+int db5500_prcmu_enable_dsipll(void);
+int db5500_prcmu_abb_read(u8 slave, u8 reg, u8 *value, u8 size);
+int db5500_prcmu_abb_write(u8 slave, u8 reg, u8 *value, u8 size);
+
+#else /* !CONFIG_UX500_SOC_DB5500 */
+
+static inline void db5500_prcmu_early_init(void) {}
+
+static inline int db5500_prcmu_abb_read(u8 slave, u8 reg, u8 *value, u8 size)
 {
-        return 0;
+        return -ENOSYS;
 }
 
-static inline bool db5500_prcmu_is_ac_wake_requested(void)
+static inline int db5500_prcmu_abb_write(u8 slave, u8 reg, u8 *value, u8 size)
 {
-        return 0;
+        return -ENOSYS;
 }
 
-static inline int db5500_prcmu_set_arm_opp(u8 opp)
+static inline int db5500_prcmu_set_display_clocks(void)
 {
         return 0;
 }
 
-static inline int db5500_prcmu_get_arm_opp(void)
+static inline int db5500_prcmu_disable_dsipll(void)
 {
         return 0;
 }
 
+static inline int db5500_prcmu_enable_dsipll(void)
+{
+        return 0;
+}
 
 #endif /* CONFIG_MFD_DB5500_PRCMU */
 
diff --git a/include/linux/mfd/rc5t583.h b/include/linux/mfd/rc5t583.h
index a2c61609d21d..0b64b19d81ab 100644
--- a/include/linux/mfd/rc5t583.h
+++ b/include/linux/mfd/rc5t583.h
@@ -26,6 +26,7 @@
 
 #include <linux/mutex.h>
 #include <linux/types.h>
+#include <linux/regmap.h>
 
 #define RC5T583_MAX_REGS                0xF8
 
@@ -279,14 +280,44 @@ struct rc5t583_platform_data {
         bool            enable_shutdown;
 };
 
-int rc5t583_write(struct device *dev, u8 reg, uint8_t val);
-int rc5t583_read(struct device *dev, uint8_t reg, uint8_t *val);
-int rc5t583_set_bits(struct device *dev, unsigned int reg,
-                unsigned int bit_mask);
-int rc5t583_clear_bits(struct device *dev, unsigned int reg,
-                unsigned int bit_mask);
-int rc5t583_update(struct device *dev, unsigned int reg,
-                unsigned int val, unsigned int mask);
+static inline int rc5t583_write(struct device *dev, uint8_t reg, uint8_t val)
+{
+        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
+        return regmap_write(rc5t583->regmap, reg, val);
+}
+
+static inline int rc5t583_read(struct device *dev, uint8_t reg, uint8_t *val)
+{
+        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
+        unsigned int ival;
+        int ret;
+        ret = regmap_read(rc5t583->regmap, reg, &ival);
+        if (!ret)
+                *val = (uint8_t)ival;
+        return ret;
+}
+
+static inline int rc5t583_set_bits(struct device *dev, unsigned int reg,
+                        unsigned int bit_mask)
+{
+        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
+        return regmap_update_bits(rc5t583->regmap, reg, bit_mask, bit_mask);
+}
+
+static inline int rc5t583_clear_bits(struct device *dev, unsigned int reg,
+                        unsigned int bit_mask)
+{
+        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
+        return regmap_update_bits(rc5t583->regmap, reg, bit_mask, 0);
+}
+
+static inline int rc5t583_update(struct device *dev, unsigned int reg,
+                unsigned int val, unsigned int mask)
+{
+        struct rc5t583 *rc5t583 = dev_get_drvdata(dev);
+        return regmap_update_bits(rc5t583->regmap, reg, mask, val);
+}
+
 int rc5t583_ext_power_req_config(struct device *dev, int deepsleep_id,
         int ext_pwr_req, int deepsleep_slot_nr);
 int rc5t583_irq_init(struct rc5t583 *rc5t583, int irq, int irq_base);
diff --git a/include/linux/mfd/twl6040.h b/include/linux/mfd/twl6040.h
index 9bc9ac651dad..b15b5f03f5c4 100644
--- a/include/linux/mfd/twl6040.h
+++ b/include/linux/mfd/twl6040.h
@@ -174,8 +174,35 @@
 #define TWL6040_SYSCLK_SEL_LPPLL        0
 #define TWL6040_SYSCLK_SEL_HPPLL        1
 
+struct twl6040_codec_data {
+        u16 hs_left_step;
+        u16 hs_right_step;
+        u16 hf_left_step;
+        u16 hf_right_step;
+};
+
+struct twl6040_vibra_data {
+        unsigned int vibldrv_res;       /* left driver resistance */
+        unsigned int vibrdrv_res;       /* right driver resistance */
+        unsigned int viblmotor_res;     /* left motor resistance */
+        unsigned int vibrmotor_res;     /* right motor resistance */
+        int vddvibl_uV;                 /* VDDVIBL volt, set 0 for fixed reg */
+        int vddvibr_uV;                 /* VDDVIBR volt, set 0 for fixed reg */
+};
+
+struct twl6040_platform_data {
+        int audpwron_gpio;      /* audio power-on gpio */
+        unsigned int irq_base;
+
+        struct twl6040_codec_data *codec;
+        struct twl6040_vibra_data *vibra;
+};
+
+struct regmap;
+
 struct twl6040 {
         struct device *dev;
+        struct regmap *regmap;
         struct mutex mutex;
         struct mutex io_mutex;
         struct mutex irq_mutex;
diff --git a/include/linux/mm.h b/include/linux/mm.h
index d8738a464b94..74aa71bea1e4 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1393,29 +1393,20 @@ extern int install_special_mapping(struct mm_struct *mm,
 
 extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
 
-extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
-        unsigned long len, unsigned long prot,
-        unsigned long flag, unsigned long pgoff);
 extern unsigned long mmap_region(struct file *file, unsigned long addr,
         unsigned long len, unsigned long flags,
         vm_flags_t vm_flags, unsigned long pgoff);
-
-static inline unsigned long do_mmap(struct file *file, unsigned long addr,
-        unsigned long len, unsigned long prot,
-        unsigned long flag, unsigned long offset)
-{
-        unsigned long ret = -EINVAL;
-        if ((offset + PAGE_ALIGN(len)) < offset)
-                goto out;
-        if (!(offset & ~PAGE_MASK))
-                ret = do_mmap_pgoff(file, addr, len, prot, flag, offset >> PAGE_SHIFT);
-out:
-        return ret;
-}
-
+extern unsigned long do_mmap(struct file *, unsigned long,
+        unsigned long, unsigned long,
+        unsigned long, unsigned long);
 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
 
-extern unsigned long do_brk(unsigned long, unsigned long);
+/* These take the mm semaphore themselves */
+extern unsigned long vm_brk(unsigned long, unsigned long);
+extern int vm_munmap(unsigned long, size_t);
+extern unsigned long vm_mmap(struct file *, unsigned long,
+        unsigned long, unsigned long,
+        unsigned long, unsigned long);
 
 /* truncate.c */
 extern void truncate_inode_pages(struct address_space *, loff_t);
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index 01beae78f079..629b823f8836 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -481,7 +481,7 @@ struct mmc_driver {
         struct device_driver drv;
         int (*probe)(struct mmc_card *);
         void (*remove)(struct mmc_card *);
-        int (*suspend)(struct mmc_card *, pm_message_t);
+        int (*suspend)(struct mmc_card *);
         int (*resume)(struct mmc_card *);
 };
 
diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 0ddd161f3b06..31d2844e6572 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -104,9 +104,18 @@ struct bridge_skb_cb {
         } daddr;
 };
 
+static inline void br_drop_fake_rtable(struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+
+        if (dst && (dst->flags & DST_FAKE_RTABLE))
+                skb_dst_drop(skb);
+}
+
 #else
 #define nf_bridge_maybe_copy_header(skb)        (0)
 #define nf_bridge_pad(skb)                      (0)
+#define br_drop_fake_rtable(skb)                do { } while (0)
 #endif /* CONFIG_BRIDGE_NETFILTER */
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index f549adccc94c..1bc898b14a80 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -287,7 +287,17 @@ extern unsigned int ip6t_do_table(struct sk_buff *skb,
                                   struct xt_table *table);
 
 /* Check for an extension */
-extern int ip6t_ext_hdr(u8 nexthdr);
+static inline int
+ip6t_ext_hdr(u8 nexthdr)
+{       return (nexthdr == IPPROTO_HOPOPTS) ||
+               (nexthdr == IPPROTO_ROUTING) ||
+               (nexthdr == IPPROTO_FRAGMENT) ||
+               (nexthdr == IPPROTO_ESP) ||
+               (nexthdr == IPPROTO_AH) ||
+               (nexthdr == IPPROTO_NONE) ||
+               (nexthdr == IPPROTO_DSTOPTS);
+}
+
 /* find specified header and get offset to it */
 extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                          int target, unsigned short *fragoff);
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index bfd0d1bf6707..7ba3551a0414 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -312,6 +312,11 @@ struct nfs4_layoutreturn {
         int rpc_status;
 };
 
+struct stateowner_id {
+        __u64   create_time;
+        __u32   uniquifier;
+};
+
 /*
  * Arguments to the open call.
  */
@@ -321,7 +326,7 @@ struct nfs_openargs {
         int                     open_flags;
         fmode_t                 fmode;
         __u64                   clientid;
-        __u64                   id;
+        struct stateowner_id    id;
         union {
                 struct {
                         struct iattr *  attrs;    /* UNCHECKED, GUARDED */
diff --git a/include/linux/nfsd/Kbuild b/include/linux/nfsd/Kbuild
index b8d4001212b3..5b7d84ac954a 100644
--- a/include/linux/nfsd/Kbuild
+++ b/include/linux/nfsd/Kbuild
@@ -1,3 +1,4 @@
+header-y += cld.h
 header-y += debug.h
 header-y += export.h
 header-y += nfsfh.h
diff --git a/include/linux/pinctrl/machine.h b/include/linux/pinctrl/machine.h
index fee4349364f7..e4d1de742502 100644
--- a/include/linux/pinctrl/machine.h
+++ b/include/linux/pinctrl/machine.h
@@ -12,6 +12,8 @@
 #ifndef __LINUX_PINCTRL_MACHINE_H
 #define __LINUX_PINCTRL_MACHINE_H
 
+#include <linux/bug.h>
+
 #include "pinctrl-state.h"
 
 enum pinctrl_map_type {
@@ -148,7 +150,7 @@ struct pinctrl_map {
 #define PIN_MAP_CONFIGS_GROUP_HOG_DEFAULT(dev, grp, cfgs)               \
         PIN_MAP_CONFIGS_GROUP(dev, PINCTRL_STATE_DEFAULT, dev, grp, cfgs)
 
-#ifdef CONFIG_PINMUX
+#ifdef CONFIG_PINCTRL
 
 extern int pinctrl_register_mappings(struct pinctrl_map const *map,
                                 unsigned num_maps);
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 6d626ff0cfd0..e1ac1ce16fb0 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -6,6 +6,7 @@
 #define PIPE_BUF_FLAG_LRU       0x01    /* page is on the LRU */
 #define PIPE_BUF_FLAG_ATOMIC    0x02    /* was atomically mapped */
 #define PIPE_BUF_FLAG_GIFT      0x04    /* page is a gift */
+#define PIPE_BUF_FLAG_PACKET    0x08    /* read() as a packet */
 
 /**
  *      struct pipe_buffer - a linux kernel pipe buffer
diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
index c6db9fb33c44..600060e25ec6 100644
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -141,7 +141,7 @@ static inline unsigned __read_seqcount_begin(const seqcount_t *s)
         unsigned ret;
 
 repeat:
-        ret = s->sequence;
+        ret = ACCESS_ONCE(s->sequence);
         if (unlikely(ret & 1)) {
                 cpu_relax();
                 goto repeat;
@@ -166,6 +166,27 @@ static inline unsigned read_seqcount_begin(const seqcount_t *s)
 }
 
 /**
+ * raw_seqcount_begin - begin a seq-read critical section
+ * @s: pointer to seqcount_t
+ * Returns: count to be passed to read_seqcount_retry
+ *
+ * raw_seqcount_begin opens a read critical section of the given seqcount.
+ * Validity of the critical section is tested by checking read_seqcount_retry
+ * function.
+ *
+ * Unlike read_seqcount_begin(), this function will not wait for the count
+ * to stabilize. If a writer is active when we begin, we will fail the
+ * read_seqcount_retry() instead of stabilizing at the beginning of the
+ * critical section.
+ */
+static inline unsigned raw_seqcount_begin(const seqcount_t *s)
+{
+        unsigned ret = ACCESS_ONCE(s->sequence);
+        smp_rmb();
+        return ret & ~1;
+}
+
+/**
  * __read_seqcount_retry - end a seq-read critical section (without barrier)
  * @s: pointer to seqcount_t
  * @start: count, from read_seqcount_begin
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index f51bf2e70c69..2db407a40051 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -357,7 +357,7 @@ struct uart_port {
 #define UPF_CONS_FLOW           ((__force upf_t) (1 << 23))
 #define UPF_SHARE_IRQ           ((__force upf_t) (1 << 24))
 #define UPF_EXAR_EFR            ((__force upf_t) (1 << 25))
-#define UPF_IIR_ONCE            ((__force upf_t) (1 << 26))
+#define UPF_BUG_THRE            ((__force upf_t) (1 << 26))
 /* The exact UART type is known and should not be probed.  */
 #define UPF_FIXED_TYPE          ((__force upf_t) (1 << 27))
 #define UPF_BOOT_AUTOCONF       ((__force upf_t) (1 << 28))
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 33370271b8b2..111f26b6e28b 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -238,11 +238,12 @@ enum {
 /*
  * The callback notifies userspace to release buffers when skb DMA is done in
  * lower device, the skb last reference should be 0 when calling this.
- * The desc is used to track userspace buffer index.
+ * The ctx field is used to track device context.
+ * The desc field is used to track userspace buffer index.
  */
 struct ubuf_info {
-        void (*callback)(void *);
-        void *arg;
+        void (*callback)(struct ubuf_info *);
+        void *ctx;
         unsigned long desc;
 };
 
@@ -481,6 +482,7 @@ struct sk_buff {
         union {
                 __u32           mark;
                 __u32           dropcount;
+                __u32           avail_size;
         };
 
         sk_buff_data_t          transport_header;
@@ -1018,7 +1020,7 @@ static inline void skb_queue_splice(const struct sk_buff_head *list,
 }
 
 /**
- *      skb_queue_splice - join two skb lists and reinitialise the emptied list
+ *      skb_queue_splice_init - join two skb lists and reinitialise the emptied list
  *      @list: the new list to add
  *      @head: the place to add it in the first list
  *
@@ -1049,7 +1051,7 @@ static inline void skb_queue_splice_tail(const struct sk_buff_head *list,
 }
 
 /**
- *      skb_queue_splice_tail - join two skb lists and reinitialise the emptied list
+ *      skb_queue_splice_tail_init - join two skb lists and reinitialise the emptied list
  *      @list: the new list to add
  *      @head: the place to add it in the first list
  *
@@ -1366,6 +1368,18 @@ static inline int skb_tailroom(const struct sk_buff *skb)
 }
 
 /**
+ *      skb_availroom - bytes at buffer end
+ *      @skb: buffer to check
+ *
+ *      Return the number of bytes of free space at the tail of an sk_buff
+ *      allocated by sk_stream_alloc()
+ */
+static inline int skb_availroom(const struct sk_buff *skb)
+{
+        return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
+}
+
+/**
  *      skb_reserve - adjust headroom
  *      @skb: buffer to alter
  *      @len: bytes to move
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index 98679b061b63..fa702aeb5038 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -254,7 +254,7 @@ static inline void spi_unregister_driver(struct spi_driver *sdrv)
  *      driver is finished with this message, it must call
  *      spi_finalize_current_message() so the subsystem can issue the next
  *      transfer
- * @prepare_transfer_hardware: there are currently no more messages on the
+ * @unprepare_transfer_hardware: there are currently no more messages on the
  *      queue so the subsystem notifies the driver that it may relax the
  *      hardware by issuing this call
  *
diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 6a40c76bdcf1..1747b6787b9e 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -3,14 +3,10 @@
 
 #include <linux/compiler.h>
 
+#ifdef __KERNEL__
+
 #undef NULL
-#if defined(__cplusplus)
-#define NULL 0
-#else
 #define NULL ((void *)0)
-#endif
-
-#ifdef __KERNEL__
 
 enum {
         false   = 0,
diff --git a/include/linux/types.h b/include/linux/types.h
index e5fa50345516..7f480db60231 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -210,6 +210,12 @@ typedef u32 phys_addr_t;
 
 typedef phys_addr_t resource_size_t;
 
+/*
+ * This type is the placeholder for a hardware interrupt number. It has to be
+ * big enough to enclose whatever representation is used by a given platform.
+ */
+typedef unsigned long irq_hw_number_t;
+
 typedef struct {
         int counter;
 } atomic_t;
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 5de415707c23..d28cc78a38e4 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -126,6 +126,8 @@ struct usb_hcd {
         unsigned                wireless:1;     /* Wireless USB HCD */
         unsigned                authorized_default:1;
         unsigned                has_tt:1;       /* Integrated TT in root hub */
+        unsigned                broken_pci_sleep:1;     /* Don't put the
+                        controller in PCI-D3 for system sleep */
 
         unsigned int            irq;            /* irq allocated */
         void __iomem            *regs;          /* device memory/io */
diff --git a/include/linux/usb/otg.h b/include/linux/usb/otg.h
index f67810f8f21b..38ab3f46346f 100644
--- a/include/linux/usb/otg.h
+++ b/include/linux/usb/otg.h
@@ -94,6 +94,7 @@ struct usb_phy {
 
         struct usb_otg          *otg;
 
+        struct device           *io_dev;
         struct usb_phy_io_ops   *io_ops;
         void __iomem            *io_priv;
 
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index fbb666b1b670..474283888233 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -28,13 +28,6 @@
 /* parity check flag */
 #define RELEVANT_IFLAG(iflag)   (iflag & (IGNBRK|BRKINT|IGNPAR|PARMRK|INPCK))
 
-enum port_dev_state {
-        PORT_UNREGISTERED,
-        PORT_REGISTERING,
-        PORT_REGISTERED,
-        PORT_UNREGISTERING,
-};
-
 /* USB serial flags */
 #define USB_SERIAL_WRITE_BUSY   0
 
@@ -124,7 +117,6 @@ struct usb_serial_port {
         char                    throttle_req;
         unsigned long           sysrq; /* sysrq timeout */
         struct device           dev;
-        enum port_dev_state     dev_state;
 };
 #define to_usb_serial_port(d) container_of(d, struct usb_serial_port, dev)
 
diff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h
index 9c3120dca294..b572f80bdfd5 100644
--- a/include/linux/vgaarb.h
+++ b/include/linux/vgaarb.h
@@ -47,6 +47,8 @@
  */
 #define VGA_DEFAULT_DEVICE     (NULL)
 
+struct pci_dev;
+
 /* For use by clients */
 
 /**
diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h
index 03b90cdc1921..06f8e3858251 100644
--- a/include/linux/vm_event_item.h
+++ b/include/linux/vm_event_item.h
@@ -26,13 +26,14 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
                 PGFREE, PGACTIVATE, PGDEACTIVATE,
                 PGFAULT, PGMAJFAULT,
                 FOR_ALL_ZONES(PGREFILL),
-                FOR_ALL_ZONES(PGSTEAL),
+                FOR_ALL_ZONES(PGSTEAL_KSWAPD),
+                FOR_ALL_ZONES(PGSTEAL_DIRECT),
                 FOR_ALL_ZONES(PGSCAN_KSWAPD),
                 FOR_ALL_ZONES(PGSCAN_DIRECT),
 #ifdef CONFIG_NUMA
                 PGSCAN_ZONE_RECLAIM_FAILED,
 #endif
-                PGINODESTEAL, SLABS_SCANNED, KSWAPD_STEAL, KSWAPD_INODESTEAL,
+                PGINODESTEAL, SLABS_SCANNED, KSWAPD_INODESTEAL,
                 KSWAPD_LOW_WMARK_HIT_QUICKLY, KSWAPD_HIGH_WMARK_HIT_QUICKLY,
                 KSWAPD_SKIP_CONGESTION_WAIT,
                 PAGEOUTRUN, ALLOCSTALL, PGROTATED,
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 344b0f972828..d47e523c9d83 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -92,6 +92,7 @@ enum {
         HCI_SERVICE_CACHE,
         HCI_LINK_KEYS,
         HCI_DEBUG_KEYS,
+        HCI_UNREGISTER,
 
         HCI_LE_SCAN,
         HCI_SSP_ENABLED,
@@ -1327,8 +1328,8 @@ struct sockaddr_hci {
 #define HCI_DEV_NONE    0xffff
 
 #define HCI_CHANNEL_RAW         0
-#define HCI_CHANNEL_CONTROL     1
 #define HCI_CHANNEL_MONITOR     2
+#define HCI_CHANNEL_CONTROL     3
 
 struct hci_filter {
         unsigned long type_mask;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index daefaac51131..db1c5df45224 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -314,6 +314,7 @@ struct hci_conn {
 
         __u8            remote_cap;
         __u8            remote_auth;
+        bool            flush_key;
 
         unsigned int    sent;
 
@@ -427,7 +428,7 @@ enum {
 static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
 {
         struct hci_dev *hdev = conn->hdev;
-        return (test_bit(HCI_SSP_ENABLED, &hdev->flags) &&
+        return (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
                                 test_bit(HCI_CONN_SSP_ENABLED, &conn->flags));
 }
 
@@ -907,11 +908,13 @@ static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
 
 static inline bool eir_has_data_type(u8 *data, size_t data_len, u8 type)
 {
-        u8 field_len;
-        size_t parsed;
+        size_t parsed = 0;
 
-        for (parsed = 0; parsed < data_len - 1; parsed += field_len) {
-                field_len = data[0];
+        if (data_len < 2)
+                return false;
+
+        while (parsed < data_len - 1) {
+                u8 field_len = data[0];
 
                 if (field_len == 0)
                         break;
@@ -978,7 +981,7 @@ int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable);
 int mgmt_connectable(struct hci_dev *hdev, u8 connectable);
 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status);
 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
-                      u8 persistent);
+                      bool persistent);
 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
                           u8 *dev_class);
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index ffc1377e092e..ebfd91fc20f8 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -117,7 +117,7 @@ struct mgmt_mode {
 #define MGMT_OP_SET_DISCOVERABLE        0x0006
 struct mgmt_cp_set_discoverable {
         __u8    val;
-        __u16   timeout;
+        __le16  timeout;
 } __packed;
 #define MGMT_SET_DISCOVERABLE_SIZE      3
 
diff --git a/include/net/dst.h b/include/net/dst.h
index 59c5d18cc385..bed833d9796a 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -36,7 +36,11 @@ struct dst_entry {
         struct net_device       *dev;
         struct  dst_ops         *ops;
         unsigned long           _metrics;
-        unsigned long           expires;
+        union {
+                unsigned long           expires;
+                /* point to where the dst_entry copied from */
+                struct dst_entry        *from;
+        };
         struct dst_entry        *path;
         struct neighbour __rcu  *_neighbour;
 #ifdef CONFIG_XFRM
@@ -55,6 +59,7 @@ struct dst_entry {
 #define DST_NOCACHE             0x0010
 #define DST_NOCOUNT             0x0020
 #define DST_NOPEER              0x0040
+#define DST_FAKE_RTABLE         0x0080
 
         short                   error;
         short                   obsolete;
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index b26bb8101981..0ae759a6c76e 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -123,6 +123,54 @@ static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
         return ((struct rt6_info *)dst)->rt6i_idev;
 }
 
+static inline void rt6_clean_expires(struct rt6_info *rt)
+{
+        if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from)
+                dst_release(rt->dst.from);
+
+        rt->rt6i_flags &= ~RTF_EXPIRES;
+        rt->dst.from = NULL;
+}
+
+static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
+{
+        if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from)
+                dst_release(rt->dst.from);
+
+        rt->rt6i_flags |= RTF_EXPIRES;
+        rt->dst.expires = expires;
+}
+
+static inline void rt6_update_expires(struct rt6_info *rt, int timeout)
+{
+        if (!(rt->rt6i_flags & RTF_EXPIRES)) {
+                if (rt->dst.from)
+                        dst_release(rt->dst.from);
+                /* dst_set_expires relies on expires == 0 
+                 * if it has not been set previously.
+                 */
+                rt->dst.expires = 0;
+        }
+
+        dst_set_expires(&rt->dst, timeout);
+        rt->rt6i_flags |= RTF_EXPIRES;
+}
+
+static inline void rt6_set_from(struct rt6_info *rt, struct rt6_info *from)
+{
+        struct dst_entry *new = (struct dst_entry *) from;
+
+        if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from) {
+                if (new == rt->dst.from)
+                        return;
+                dst_release(rt->dst.from);
+        }
+
+        rt->rt6i_flags &= ~RTF_EXPIRES;
+        rt->dst.from = new;
+        dst_hold(new);
+}
+
 struct fib6_walker_t {
         struct list_head lh;
         struct fib6_node *root, *node;
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 2bdee51ba30d..72522f087375 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -393,7 +393,7 @@ struct ip_vs_protocol {
 
         void (*exit)(struct ip_vs_protocol *pp);
 
-        void (*init_netns)(struct net *net, struct ip_vs_proto_data *pd);
+        int (*init_netns)(struct net *net, struct ip_vs_proto_data *pd);
 
         void (*exit_netns)(struct net *net, struct ip_vs_proto_data *pd);
 
@@ -1203,6 +1203,8 @@ ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
 
 extern int ip_vs_use_count_inc(void);
 extern void ip_vs_use_count_dec(void);
+extern int ip_vs_register_nl_ioctl(void);
+extern void ip_vs_unregister_nl_ioctl(void);
 extern int ip_vs_control_init(void);
 extern void ip_vs_control_cleanup(void);
 extern struct ip_vs_dest *
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 87d203ff7a8a..9210bdc7bd8d 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1327,7 +1327,7 @@ static inline struct ieee80211_rate *
 ieee80211_get_tx_rate(const struct ieee80211_hw *hw,
                       const struct ieee80211_tx_info *c)
 {
-        if (WARN_ON(c->control.rates[0].idx < 0))
+        if (WARN_ON_ONCE(c->control.rates[0].idx < 0))
                 return NULL;
         return &hw->wiphy->bands[c->band]->bitrates[c->control.rates[0].idx];
 }
diff --git a/include/net/red.h b/include/net/red.h
index 77d4c3745cb5..ef46058d35bf 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -245,7 +245,7 @@ static inline unsigned long red_calc_qavg_from_idle_time(const struct red_parms
          *
          * dummy packets as a burst after idle time, i.e.
          *
-         *      p->qavg *= (1-W)^m
+         *      v->qavg *= (1-W)^m
          *
          * This is an apparently overcomplicated solution (f.e. we have to
          * precompute a table to make this calculation in reasonable time)
@@ -279,7 +279,7 @@ static inline unsigned long red_calc_qavg_no_idle_time(const struct red_parms *p
                                                        unsigned int backlog)
 {
         /*
-         * NOTE: p->qavg is fixed point number with point at Wlog.
+         * NOTE: v->qavg is fixed point number with point at Wlog.
          * The formula below is equvalent to floating point
          * version:
          *
@@ -390,7 +390,7 @@ static inline void red_adaptative_algo(struct red_parms *p, struct red_vars *v)
         if (red_is_idling(v))
                 qavg = red_calc_qavg_from_idle_time(p, v);
 
-        /* p->qavg is fixed point number with point at Wlog */
+        /* v->qavg is fixed point number with point at Wlog */
         qavg >>= p->Wlog;
 
         if (qavg > p->target_max && p->max_P <= MAX_P_MAX)
diff --git a/include/net/sock.h b/include/net/sock.h
index a6ba1f8871fd..5a0a58ac4126 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -246,6 +246,7 @@ struct cg_proto;
   *     @sk_user_data: RPC layer private data
   *     @sk_sndmsg_page: cached page for sendmsg
   *     @sk_sndmsg_off: cached offset for sendmsg
+  *     @sk_peek_off: current peek_offset value
   *     @sk_send_head: front of stuff to transmit
   *     @sk_security: used by security modules
   *     @sk_mark: generic packet mark
@@ -1128,9 +1129,9 @@ sk_sockets_allocated_read_positive(struct sock *sk)
         struct proto *prot = sk->sk_prot;
 
         if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
-                return percpu_counter_sum_positive(sk->sk_cgrp->sockets_allocated);
+                return percpu_counter_read_positive(sk->sk_cgrp->sockets_allocated);
 
-        return percpu_counter_sum_positive(prot->sockets_allocated);
+        return percpu_counter_read_positive(prot->sockets_allocated);
 }
 
 static inline int
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
index 5f5ed1b8b41b..f4f1c96dca72 100644
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -217,11 +217,29 @@ struct domain_device {
         struct kref kref;
 };
 
-struct sas_discovery_event {
+struct sas_work {
+        struct list_head drain_node;
         struct work_struct work;
+};
+
+static inline void INIT_SAS_WORK(struct sas_work *sw, void (*fn)(struct work_struct *))
+{
+        INIT_WORK(&sw->work, fn);
+        INIT_LIST_HEAD(&sw->drain_node);
+}
+
+struct sas_discovery_event {
+        struct sas_work work;
         struct asd_sas_port *port;
 };
 
+static inline struct sas_discovery_event *to_sas_discovery_event(struct work_struct *work)
+{
+        struct sas_discovery_event *ev = container_of(work, typeof(*ev), work.work);
+
+        return ev;
+}
+
 struct sas_discovery {
         struct sas_discovery_event disc_work[DISC_NUM_EVENTS];
         unsigned long    pending;
@@ -244,7 +262,7 @@ struct asd_sas_port {
         struct list_head destroy_list;
         enum   sas_linkrate linkrate;
 
-        struct work_struct work;
+        struct sas_work work;
 
 /* public: */
         int id;
@@ -270,10 +288,17 @@ struct asd_sas_port {
 };
 
 struct asd_sas_event {
-        struct work_struct work;
+        struct sas_work work;
         struct asd_sas_phy *phy;
 };
 
+static inline struct asd_sas_event *to_asd_sas_event(struct work_struct *work)
+{
+        struct asd_sas_event *ev = container_of(work, typeof(*ev), work.work);
+
+        return ev;
+}
+
 /* The phy pretty much is controlled by the LLDD.
  * The class only reads those fields.
  */
@@ -333,10 +358,17 @@ struct scsi_core {
 };
 
 struct sas_ha_event {
-        struct work_struct work;
+        struct sas_work work;
         struct sas_ha_struct *ha;
 };
 
+static inline struct sas_ha_event *to_sas_ha_event(struct work_struct *work)
+{
+        struct sas_ha_event *ev = container_of(work, typeof(*ev), work.work);
+
+        return ev;
+}
+
 enum sas_ha_state {
         SAS_HA_REGISTERED,
         SAS_HA_DRAINING,
diff --git a/include/scsi/sas_ata.h b/include/scsi/sas_ata.h
index cdccd2eb7b6c..77670e823ed8 100644
--- a/include/scsi/sas_ata.h
+++ b/include/scsi/sas_ata.h
@@ -37,7 +37,7 @@ static inline int dev_is_sata(struct domain_device *dev)
 }
 
 int sas_get_ata_info(struct domain_device *dev, struct ex_phy *phy);
-int sas_ata_init_host_and_port(struct domain_device *found_dev);
+int sas_ata_init(struct domain_device *dev);
 void sas_ata_task_abort(struct sas_task *task);
 void sas_ata_strategy_handler(struct Scsi_Host *shost);
 void sas_ata_eh(struct Scsi_Host *shost, struct list_head *work_q,
@@ -52,7 +52,7 @@ static inline int dev_is_sata(struct domain_device *dev)
 {
         return 0;
 }
-static inline int sas_ata_init_host_and_port(struct domain_device *found_dev)
+static inline int sas_ata_init(struct domain_device *dev)
 {
         return 0;
 }
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index 377df4a28512..1e1198546c72 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -134,6 +134,9 @@ struct scsi_cmnd {
 
 static inline struct scsi_driver *scsi_cmd_to_driver(struct scsi_cmnd *cmd)
 {
+        if (!cmd->request->rq_disk)
+                return NULL;
+
         return *(struct scsi_driver **)cmd->request->rq_disk->private_data;
 }
 
diff --git a/include/sound/core.h b/include/sound/core.h
index b6e0f57d451d..bc056687f647 100644
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -325,6 +325,13 @@ void release_and_free_resource(struct resource *res);
 
 /* --- */
 
+/* sound printk debug levels */
+enum {
+        SND_PR_ALWAYS,
+        SND_PR_DEBUG,
+        SND_PR_VERBOSE,
+};
+
 #if defined(CONFIG_SND_DEBUG) || defined(CONFIG_SND_VERBOSE_PRINTK)
 __printf(4, 5)
 void __snd_printk(unsigned int level, const char *file, int line,
@@ -354,6 +361,8 @@ void __snd_printk(unsigned int level, const char *file, int line,
  */
 #define snd_printd(fmt, args...) \
         __snd_printk(1, __FILE__, __LINE__, fmt, ##args)
+#define _snd_printd(level, fmt, args...) \
+        __snd_printk(level, __FILE__, __LINE__, fmt, ##args)
 
 /**
  * snd_BUG - give a BUG warning message and stack trace
@@ -383,6 +392,7 @@ void __snd_printk(unsigned int level, const char *file, int line,
 #else /* !CONFIG_SND_DEBUG */
 
 #define snd_printd(fmt, args...)        do { } while (0)
+#define _snd_printd(level, fmt, args...) do { } while (0)
 #define snd_BUG()                       do { } while (0)
 static inline int __snd_bug_on(int cond)
 {
diff --git a/init/do_mounts.c b/init/do_mounts.c
index 0e93f92a0345..42b0707c3481 100644
--- a/init/do_mounts.c
+++ b/init/do_mounts.c
@@ -472,7 +472,7 @@ void __init change_floppy(char *fmt, ...)
 void __init mount_root(void)
 {
 #ifdef CONFIG_ROOT_NFS
-        if (MAJOR(ROOT_DEV) == UNNAMED_MAJOR) {
+        if (ROOT_DEV == Root_NFS) {
                 if (mount_nfs_root())
                         return;
 
diff --git a/init/main.c b/init/main.c
index 9d454f09f3b1..44b2433334c7 100644
--- a/init/main.c
+++ b/init/main.c
@@ -225,13 +225,9 @@ static int __init loglevel(char *str)
 
 early_param("loglevel", loglevel);
 
-/*
- * Unknown boot options get handed to init, unless they look like
- * unused parameters (modprobe will find them in /proc/cmdline).
- */
-static int __init unknown_bootoption(char *param, char *val)
+/* Change NUL term back to "=", to make "param" the whole string. */
+static int __init repair_env_string(char *param, char *val)
 {
-        /* Change NUL term back to "=", to make "param" the whole string. */
         if (val) {
                 /* param=val or param="val"? */
                 if (val == param+strlen(param)+1)
@@ -243,6 +239,16 @@ static int __init unknown_bootoption(char *param, char *val)
                 } else
                         BUG();
         }
+        return 0;
+}
+
+/*
+ * Unknown boot options get handed to init, unless they look like
+ * unused parameters (modprobe will find them in /proc/cmdline).
+ */
+static int __init unknown_bootoption(char *param, char *val)
+{
+        repair_env_string(param, val);
 
         /* Handle obsolete-style parameters */
         if (obsolete_checksetup(param))
@@ -732,11 +738,6 @@ static char *initcall_level_names[] __initdata = {
         "late parameters",
 };
 
-static int __init ignore_unknown_bootoption(char *param, char *val)
-{
-        return 0;
-}
-
 static void __init do_initcall_level(int level)
 {
         extern const struct kernel_param __start___param[], __stop___param[];
@@ -747,7 +748,7 @@ static void __init do_initcall_level(int level)
                    static_command_line, __start___param,
                    __stop___param - __start___param,
                    level, level,
-                   ignore_unknown_bootoption);
+                   repair_env_string);
 
         for (fn = initcall_levels[level]; fn < initcall_levels[level+1]; fn++)
                 do_one_initcall(*fn);
diff --git a/kernel/cred.c b/kernel/cred.c
index 97b36eeca4c9..e70683d9ec32 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -386,6 +386,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
         struct cred *new;
         int ret;
 
+        p->replacement_session_keyring = NULL;
+
         if (
 #ifdef CONFIG_KEYS
                 !p->cred->thread_keyring &&
diff --git a/kernel/events/core.c b/kernel/events/core.c
index a6a9ec4cd8f5..fd126f82b57c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3183,7 +3183,7 @@ static void perf_event_for_each(struct perf_event *event,
         perf_event_for_each_child(event, func);
         func(event);
         list_for_each_entry(sibling, &event->sibling_list, group_entry)
-                perf_event_for_each_child(event, func);
+                perf_event_for_each_child(sibling, func);
         mutex_unlock(&ctx->mutex);
 }
 
diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
index cf1a4a68ce44..d1a758bc972a 100644
--- a/kernel/irq/Kconfig
+++ b/kernel/irq/Kconfig
@@ -62,7 +62,7 @@ config IRQ_DOMAIN_DEBUG
         help
           This option will show the mapping relationship between hardware irq
           numbers and Linux irq numbers. The mapping is exposed via debugfs
-          in the file "virq_mapping".
+          in the file "irq_domain_mapping".
 
           If you don't know what this means you don't need it.
 
diff --git a/kernel/irq/debug.h b/kernel/irq/debug.h
index 97a8bfadc88a..e75e29e4434a 100644
--- a/kernel/irq/debug.h
+++ b/kernel/irq/debug.h
@@ -4,10 +4,10 @@
 
 #include <linux/kallsyms.h>
 
-#define P(f) if (desc->status_use_accessors & f) printk("%14s set\n", #f)
-#define PS(f) if (desc->istate & f) printk("%14s set\n", #f)
+#define ___P(f) if (desc->status_use_accessors & f) printk("%14s set\n", #f)
+#define ___PS(f) if (desc->istate & f) printk("%14s set\n", #f)
 /* FIXME */
-#define PD(f) do { } while (0)
+#define ___PD(f) do { } while (0)
 
 static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc)
 {
@@ -23,23 +23,23 @@ static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc)
                 print_symbol("%s\n", (unsigned long)desc->action->handler);
         }
 
-        P(IRQ_LEVEL);
-        P(IRQ_PER_CPU);
-        P(IRQ_NOPROBE);
-        P(IRQ_NOREQUEST);
-        P(IRQ_NOTHREAD);
-        P(IRQ_NOAUTOEN);
+        ___P(IRQ_LEVEL);
+        ___P(IRQ_PER_CPU);
+        ___P(IRQ_NOPROBE);
+        ___P(IRQ_NOREQUEST);
+        ___P(IRQ_NOTHREAD);
+        ___P(IRQ_NOAUTOEN);
 
-        PS(IRQS_AUTODETECT);
-        PS(IRQS_REPLAY);
-        PS(IRQS_WAITING);
-        PS(IRQS_PENDING);
+        ___PS(IRQS_AUTODETECT);
+        ___PS(IRQS_REPLAY);
+        ___PS(IRQS_WAITING);
+        ___PS(IRQS_PENDING);
 
-        PD(IRQS_INPROGRESS);
-        PD(IRQS_DISABLED);
-        PD(IRQS_MASKED);
+        ___PD(IRQS_INPROGRESS);
+        ___PD(IRQS_DISABLED);
+        ___PD(IRQS_MASKED);
 }
 
-#undef P
-#undef PS
-#undef PD
+#undef ___P
+#undef ___PS
+#undef ___PD
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 3601f3fbf67c..0e0ba5f840b2 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -23,7 +23,6 @@ static LIST_HEAD(irq_domain_list);
 static DEFINE_MUTEX(irq_domain_mutex);
 
 static DEFINE_MUTEX(revmap_trees_mutex);
-static unsigned int irq_virq_count = NR_IRQS;
 static struct irq_domain *irq_default_domain;
 
 /**
@@ -184,13 +183,16 @@ struct irq_domain *irq_domain_add_linear(struct device_node *of_node,
 }
 
 struct irq_domain *irq_domain_add_nomap(struct device_node *of_node,
+                                         unsigned int max_irq,
                                          const struct irq_domain_ops *ops,
                                          void *host_data)
 {
         struct irq_domain *domain = irq_domain_alloc(of_node,
                                         IRQ_DOMAIN_MAP_NOMAP, ops, host_data);
-        if (domain)
+        if (domain) {
+                domain->revmap_data.nomap.max_irq = max_irq ? max_irq : ~0;
                 irq_domain_add(domain);
+        }
         return domain;
 }
 
@@ -262,22 +264,6 @@ void irq_set_default_host(struct irq_domain *domain)
         irq_default_domain = domain;
 }
 
-/**
- * irq_set_virq_count() - Set the maximum number of linux irqs
- * @count: number of linux irqs, capped with NR_IRQS
- *
- * This is mainly for use by platforms like iSeries who want to program
- * the virtual irq number in the controller to avoid the reverse mapping
- */
-void irq_set_virq_count(unsigned int count)
-{
-        pr_debug("irq: Trying to set virq count to %d\n", count);
-
-        BUG_ON(count < NUM_ISA_INTERRUPTS);
-        if (count < NR_IRQS)
-                irq_virq_count = count;
-}
-
 static int irq_setup_virq(struct irq_domain *domain, unsigned int virq,
                             irq_hw_number_t hwirq)
 {
@@ -320,13 +306,12 @@ unsigned int irq_create_direct_mapping(struct irq_domain *domain)
                 pr_debug("irq: create_direct virq allocation failed\n");
                 return 0;
         }
-        if (virq >= irq_virq_count) {
+        if (virq >= domain->revmap_data.nomap.max_irq) {
                 pr_err("ERROR: no free irqs available below %i maximum\n",
-                        irq_virq_count);
+                        domain->revmap_data.nomap.max_irq);
                 irq_free_desc(virq);
                 return 0;
         }
-
         pr_debug("irq: create_direct obtained virq %d\n", virq);
 
         if (irq_setup_virq(domain, virq, virq)) {
@@ -350,7 +335,8 @@ unsigned int irq_create_direct_mapping(struct irq_domain *domain)
 unsigned int irq_create_mapping(struct irq_domain *domain,
                                 irq_hw_number_t hwirq)
 {
-        unsigned int virq, hint;
+        unsigned int hint;
+        int virq;
 
         pr_debug("irq: irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq);
 
@@ -377,13 +363,13 @@ unsigned int irq_create_mapping(struct irq_domain *domain,
                 return irq_domain_legacy_revmap(domain, hwirq);
 
         /* Allocate a virtual interrupt number */
-        hint = hwirq % irq_virq_count;
+        hint = hwirq % nr_irqs;
         if (hint == 0)
                 hint++;
         virq = irq_alloc_desc_from(hint, 0);
-        if (!virq)
+        if (virq <= 0)
                 virq = irq_alloc_desc_from(1, 0);
-        if (!virq) {
+        if (virq <= 0) {
                 pr_debug("irq: -> virq allocation failed\n");
                 return 0;
         }
@@ -515,7 +501,7 @@ unsigned int irq_find_mapping(struct irq_domain *domain,
                               irq_hw_number_t hwirq)
 {
         unsigned int i;
-        unsigned int hint = hwirq % irq_virq_count;
+        unsigned int hint = hwirq % nr_irqs;
 
         /* Look for default domain if nececssary */
         if (domain == NULL)
@@ -536,7 +522,7 @@ unsigned int irq_find_mapping(struct irq_domain *domain,
                 if (data && (data->domain == domain) && (data->hwirq == hwirq))
                         return i;
                 i++;
-                if (i >= irq_virq_count)
+                if (i >= nr_irqs)
                         i = 1;
         } while(i != hint);
         return 0;
@@ -642,8 +628,9 @@ static int virq_debug_show(struct seq_file *m, void *private)
         void *data;
         int i;
 
-        seq_printf(m, "%-5s  %-7s  %-15s  %-18s  %s\n", "virq", "hwirq",
-                      "chip name", "chip data", "domain name");
+        seq_printf(m, "%-5s  %-7s  %-15s  %-*s  %s\n", "irq", "hwirq",
+                      "chip name", (int)(2 * sizeof(void *) + 2), "chip data",
+                      "domain name");
 
         for (i = 1; i < nr_irqs; i++) {
                 desc = irq_to_desc(i);
@@ -666,7 +653,7 @@ static int virq_debug_show(struct seq_file *m, void *private)
                         seq_printf(m, "%-15s  ", p);
 
                         data = irq_desc_get_chip_data(desc);
-                        seq_printf(m, "0x%16p  ", data);
+                        seq_printf(m, data ? "0x%p  " : "  %p  ", data);
 
                         if (desc->irq_data.domain && desc->irq_data.domain->of_node)
                                 p = desc->irq_data.domain->of_node->full_name;
diff --git a/kernel/irq_work.c b/kernel/irq_work.c
index 0c56d44b9fd5..1588e3b2871b 100644
--- a/kernel/irq_work.c
+++ b/kernel/irq_work.c
@@ -11,6 +11,7 @@
 #include <linux/irq_work.h>
 #include <linux/percpu.h>
 #include <linux/hardirq.h>
+#include <linux/irqflags.h>
 #include <asm/processor.h>
 
 /*
diff --git a/kernel/itimer.c b/kernel/itimer.c
index 22000c3db0dd..8d262b467573 100644
--- a/kernel/itimer.c
+++ b/kernel/itimer.c
@@ -284,8 +284,12 @@ SYSCALL_DEFINE3(setitimer, int, which, struct itimerval __user *, value,
         if (value) {
                 if(copy_from_user(&set_buffer, value, sizeof(set_buffer)))
                         return -EFAULT;
-        } else
-                memset((char *) &set_buffer, 0, sizeof(set_buffer));
+        } else {
+                memset(&set_buffer, 0, sizeof(set_buffer));
+                printk_once(KERN_WARNING "%s calls setitimer() with new_value NULL pointer."
+                            " Misfeature support will be removed\n",
+                            current->comm);
+        }
 
         error = do_setitimer(which, &set_buffer, ovalue ? &get_buffer : NULL);
         if (error || !ovalue)
diff --git a/kernel/panic.c b/kernel/panic.c
index 80aed44e345a..8ed89a175d79 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -97,7 +97,7 @@ void panic(const char *fmt, ...)
         /*
          * Avoid nested stack-dumping if a panic occurs during oops processing
          */
-        if (!oops_in_progress)
+        if (!test_taint(TAINT_DIE) && oops_in_progress <= 1)
                 dump_stack();
 #endif
 
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 8742fd013a94..eef311a58a64 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -51,6 +51,23 @@
 
 #define MAP_PAGE_ENTRIES        (PAGE_SIZE / sizeof(sector_t) - 1)
 
+/*
+ * Number of free pages that are not high.
+ */
+static inline unsigned long low_free_pages(void)
+{
+        return nr_free_pages() - nr_free_highpages();
+}
+
+/*
+ * Number of pages required to be kept free while writing the image. Always
+ * half of all available low pages before the writing starts.
+ */
+static inline unsigned long reqd_free_pages(void)
+{
+        return low_free_pages() / 2;
+}
+
 struct swap_map_page {
         sector_t entries[MAP_PAGE_ENTRIES];
         sector_t next_swap;
@@ -72,7 +89,7 @@ struct swap_map_handle {
         sector_t cur_swap;
         sector_t first_sector;
         unsigned int k;
-        unsigned long nr_free_pages, written;
+        unsigned long reqd_free_pages;
         u32 crc32;
 };
 
@@ -316,8 +333,7 @@ static int get_swap_writer(struct swap_map_handle *handle)
                 goto err_rel;
         }
         handle->k = 0;
-        handle->nr_free_pages = nr_free_pages() >> 1;
-        handle->written = 0;
+        handle->reqd_free_pages = reqd_free_pages();
         handle->first_sector = handle->cur_swap;
         return 0;
 err_rel:
@@ -352,11 +368,11 @@ static int swap_write_page(struct swap_map_handle *handle, void *buf,
                 handle->cur_swap = offset;
                 handle->k = 0;
         }
-        if (bio_chain && ++handle->written > handle->nr_free_pages) {
+        if (bio_chain && low_free_pages() <= handle->reqd_free_pages) {
                 error = hib_wait_on_bio_chain(bio_chain);
                 if (error)
                         goto out;
-                handle->written = 0;
+                handle->reqd_free_pages = reqd_free_pages();
         }
  out:
         return error;
@@ -618,7 +634,7 @@ static int save_image_lzo(struct swap_map_handle *handle,
          * Adjust number of free pages after all allocations have been done.
          * We don't want to run out of pages when writing.
          */
-        handle->nr_free_pages = nr_free_pages() >> 1;
+        handle->reqd_free_pages = reqd_free_pages();
 
         /*
          * Start the CRC32 thread.
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 1050d6d3922c..d0c5baf1ab18 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -1820,7 +1820,6 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
          * a quiescent state betweentimes.
          */
         local_irq_save(flags);
-        WARN_ON_ONCE(cpu_is_offline(smp_processor_id()));
         rdp = this_cpu_ptr(rsp->rda);
 
         /* Add the callback to our list. */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 4603b9d8f30a..0533a688ce22 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6405,16 +6405,26 @@ static void __sdt_free(const struct cpumask *cpu_map)
                 struct sd_data *sdd = &tl->data;
 
                 for_each_cpu(j, cpu_map) {
-                        struct sched_domain *sd = *per_cpu_ptr(sdd->sd, j);
-                        if (sd && (sd->flags & SD_OVERLAP))
-                                free_sched_groups(sd->groups, 0);
-                        kfree(*per_cpu_ptr(sdd->sd, j));
-                        kfree(*per_cpu_ptr(sdd->sg, j));
-                        kfree(*per_cpu_ptr(sdd->sgp, j));
+                        struct sched_domain *sd;
+
+                        if (sdd->sd) {
+                                sd = *per_cpu_ptr(sdd->sd, j);
+                                if (sd && (sd->flags & SD_OVERLAP))
+                                        free_sched_groups(sd->groups, 0);
+                                kfree(*per_cpu_ptr(sdd->sd, j));
+                        }
+
+                        if (sdd->sg)
+                                kfree(*per_cpu_ptr(sdd->sg, j));
+                        if (sdd->sgp)
+                                kfree(*per_cpu_ptr(sdd->sgp, j));
                 }
                 free_percpu(sdd->sd);
+                sdd->sd = NULL;
                 free_percpu(sdd->sg);
+                sdd->sg = NULL;
                 free_percpu(sdd->sgp);
+                sdd->sgp = NULL;
         }
 }
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 0d97ebdc58f0..e9553640c1c3 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -784,7 +784,7 @@ account_entity_enqueue(struct cfs_rq *cfs_rq, struct sched_entity *se)
                 update_load_add(&rq_of(cfs_rq)->load, se->load.weight);
 #ifdef CONFIG_SMP
         if (entity_is_task(se))
-                list_add_tail(&se->group_node, &rq_of(cfs_rq)->cfs_tasks);
+                list_add(&se->group_node, &rq_of(cfs_rq)->cfs_tasks);
 #endif
         cfs_rq->nr_running++;
 }
@@ -3215,6 +3215,8 @@ static int move_one_task(struct lb_env *env)
 
 static unsigned long task_h_load(struct task_struct *p);
 
+static const unsigned int sched_nr_migrate_break = 32;
+
 /*
  * move_tasks tries to move up to load_move weighted load from busiest to
  * this_rq, as part of a balancing operation within domain "sd".
@@ -3242,7 +3244,7 @@ static int move_tasks(struct lb_env *env)
 
                 /* take a breather every nr_migrate tasks */
                 if (env->loop > env->loop_break) {
-                        env->loop_break += sysctl_sched_nr_migrate;
+                        env->loop_break += sched_nr_migrate_break;
                         env->flags |= LBF_NEED_BREAK;
                         break;
                 }
@@ -3252,7 +3254,7 @@ static int move_tasks(struct lb_env *env)
 
                 load = task_h_load(p);
 
-                if (load < 16 && !env->sd->nr_balance_failed)
+                if (sched_feat(LB_MIN) && load < 16 && !env->sd->nr_balance_failed)
                         goto next;
 
                 if ((load / 2) > env->load_move)
@@ -4407,7 +4409,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
                 .dst_cpu        = this_cpu,
                 .dst_rq         = this_rq,
                 .idle           = idle,
-                .loop_break     = sysctl_sched_nr_migrate,
+                .loop_break     = sched_nr_migrate_break,
         };
 
         cpumask_copy(cpus, cpu_active_mask);
@@ -4445,10 +4447,10 @@ redo:
                  * correctly treated as an imbalance.
                  */
                 env.flags |= LBF_ALL_PINNED;
-                env.load_move = imbalance;
-                env.src_cpu = busiest->cpu;
-                env.src_rq = busiest;
-                env.loop_max = busiest->nr_running;
+                env.load_move   = imbalance;
+                env.src_cpu     = busiest->cpu;
+                env.src_rq      = busiest;
+                env.loop_max    = min_t(unsigned long, sysctl_sched_nr_migrate, busiest->nr_running);
 
 more_balance:
                 local_irq_save(flags);
diff --git a/kernel/sched/features.h b/kernel/sched/features.h
index e61fd73913d0..de00a486c5c6 100644
--- a/kernel/sched/features.h
+++ b/kernel/sched/features.h
@@ -68,3 +68,4 @@ SCHED_FEAT(TTWU_QUEUE, true)
 
 SCHED_FEAT(FORCE_SD_OVERLAP, false)
 SCHED_FEAT(RT_RUNTIME_SHARE, true)
+SCHED_FEAT(LB_MIN, false)
diff --git a/kernel/time/Kconfig b/kernel/time/Kconfig
index 2cf9cc7aa103..a20dc8a3c949 100644
--- a/kernel/time/Kconfig
+++ b/kernel/time/Kconfig
@@ -1,6 +1,10 @@
 #
 # Timer subsystem related configuration options
 #
+
+# Core internal switch. Selected by NO_HZ / HIGH_RES_TIMERS. This is
+# only related to the tick functionality. Oneshot clockevent devices
+# are supported independ of this.
 config TICK_ONESHOT
         bool
 
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index e883f57a3cd3..f113755695e2 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -346,7 +346,8 @@ int tick_resume_broadcast(void)
                                                      tick_get_broadcast_mask());
                         break;
                 case TICKDEV_MODE_ONESHOT:
-                        broadcast = tick_resume_broadcast_oneshot(bc);
+                        if (!cpumask_empty(tick_get_broadcast_mask()))
+                                broadcast = tick_resume_broadcast_oneshot(bc);
                         break;
                 }
         }
@@ -373,6 +374,9 @@ static int tick_broadcast_set_event(ktime_t expires, int force)
 {
         struct clock_event_device *bc = tick_broadcast_device.evtdev;
 
+        if (bc->mode != CLOCK_EVT_MODE_ONESHOT)
+                clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
+
         return clockevents_program_event(bc, expires, force);
 }
 
@@ -531,7 +535,6 @@ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
                 int was_periodic = bc->mode == CLOCK_EVT_MODE_PERIODIC;
 
                 bc->event_handler = tick_handle_oneshot_broadcast;
-                clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
 
                 /* Take the do_timer update */
                 tick_do_timer_cpu = cpu;
@@ -549,6 +552,7 @@ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
                            to_cpumask(tmpmask));
 
                 if (was_periodic && !cpumask_empty(to_cpumask(tmpmask))) {
+                        clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
                         tick_broadcast_init_next_event(to_cpumask(tmpmask),
                                                        tick_next_period);
                         tick_broadcast_set_event(tick_next_period, 1);
@@ -575,15 +579,12 @@ void tick_broadcast_switch_to_oneshot(void)
         unsigned long flags;
 
         raw_spin_lock_irqsave(&tick_broadcast_lock, flags);
-        if (cpumask_empty(tick_get_broadcast_mask()))
-                goto end;
 
         tick_broadcast_device.mode = TICKDEV_MODE_ONESHOT;
         bc = tick_broadcast_device.evtdev;
         if (bc)
                 tick_broadcast_setup_oneshot(bc);
 
-end:
         raw_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
 }
 
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 3526038f2836..6a3a5b9ff561 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -534,9 +534,9 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now)
                                 hrtimer_get_expires(&ts->sched_timer), 0))
                                 break;
                 }
-                /* Update jiffies and reread time */
-                tick_do_update_jiffies64(now);
+                /* Reread time and update jiffies */
                 now = ktime_get();
+                tick_do_update_jiffies64(now);
         }
 }
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index ed7b5d1e12f4..2a22255c1010 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4629,7 +4629,8 @@ static ssize_t
 rb_simple_read(struct file *filp, char __user *ubuf,
                size_t cnt, loff_t *ppos)
 {
-        struct ring_buffer *buffer = filp->private_data;
+        struct trace_array *tr = filp->private_data;
+        struct ring_buffer *buffer = tr->buffer;
         char buf[64];
         int r;
 
@@ -4647,7 +4648,8 @@ static ssize_t
 rb_simple_write(struct file *filp, const char __user *ubuf,
                 size_t cnt, loff_t *ppos)
 {
-        struct ring_buffer *buffer = filp->private_data;
+        struct trace_array *tr = filp->private_data;
+        struct ring_buffer *buffer = tr->buffer;
         unsigned long val;
         int ret;
 
@@ -4734,7 +4736,7 @@ static __init int tracer_init_debugfs(void)
                           &trace_clock_fops);
 
         trace_create_file("tracing_on", 0644, d_tracer,
-                            global_trace.buffer, &rb_simple_fops);
+                            &global_trace, &rb_simple_fops);
 
 #ifdef CONFIG_DYNAMIC_FTRACE
         trace_create_file("dyn_ftrace_total_info", 0444, d_tracer,
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 95059f091a24..f95d65da6db8 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -836,11 +836,11 @@ extern const char *__stop___trace_bprintk_fmt[];
                      filter)
 #include "trace_entries.h"
 
-#ifdef CONFIG_FUNCTION_TRACER
+#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_FUNCTION_TRACER)
 int perf_ftrace_event_register(struct ftrace_event_call *call,
                                enum trace_reg type, void *data);
 #else
 #define perf_ftrace_event_register NULL
-#endif /* CONFIG_FUNCTION_TRACER */
+#endif
 
 #endif /* _LINUX_KERNEL_TRACE_H */
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index 859fae6b1825..df611a0e76c5 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -652,6 +652,8 @@ int trace_print_lat_context(struct trace_iterator *iter)
 {
         u64 next_ts;
         int ret;
+        /* trace_find_next_entry will reset ent_size */
+        int ent_size = iter->ent_size;
         struct trace_seq *s = &iter->seq;
         struct trace_entry *entry = iter->ent,
                            *next_entry = trace_find_next_entry(iter, NULL,
@@ -660,6 +662,9 @@ int trace_print_lat_context(struct trace_iterator *iter)
         unsigned long abs_usecs = ns2usecs(iter->ts - iter->tr->time_start);
         unsigned long rel_usecs;
 
+        /* Restore the original ent_size */
+        iter->ent_size = ent_size;
+
         if (!next_entry)
                 next_ts = iter->ts;
         rel_usecs = ns2usecs(next_ts - iter->ts);
diff --git a/lib/kobject.c b/lib/kobject.c
index 21dee7c19afd..aeefa8bc8b1c 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -192,14 +192,14 @@ static int kobject_add_internal(struct kobject *kobj)
 
                 /* be noisy on error issues */
                 if (error == -EEXIST)
-                        printk(KERN_ERR "%s failed for %s with "
-                               "-EEXIST, don't try to register things with "
-                               "the same name in the same directory.\n",
-                               __func__, kobject_name(kobj));
+                        WARN(1, "%s failed for %s with "
+                             "-EEXIST, don't try to register things with "
+                             "the same name in the same directory.\n",
+                             __func__, kobject_name(kobj));
                 else
-                        printk(KERN_ERR "%s failed for %s (%d)\n",
-                               __func__, kobject_name(kobj), error);
-                dump_stack();
+                        WARN(1, "%s failed for %s (error: %d parent: %s)\n",
+                             __func__, kobject_name(kobj), error,
+                             parent ? kobject_name(parent) : "'none'");
         } else
                 kobj->state_in_sysfs = 1;
 
diff --git a/lib/mpi/mpi-bit.c b/lib/mpi/mpi-bit.c
index 2f526627e4f5..0c505361da19 100644
--- a/lib/mpi/mpi-bit.c
+++ b/lib/mpi/mpi-bit.c
@@ -177,8 +177,8 @@ int mpi_rshift(MPI x, MPI a, unsigned n)
  */
 int mpi_lshift_limbs(MPI a, unsigned int count)
 {
-        mpi_ptr_t ap = a->d;
-        int n = a->nlimbs;
+        const int n = a->nlimbs;
+        mpi_ptr_t ap;
         int i;
 
         if (!count || !n)
@@ -187,6 +187,7 @@ int mpi_lshift_limbs(MPI a, unsigned int count)
         if (RESIZE_IF_NEEDED(a, n + count) < 0)
                 return -ENOMEM;
 
+        ap = a->d;
         for (i = n - 1; i >= 0; i--)
                 ap[i + count] = ap[i];
         for (i = 0; i < count; i++)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b8ce6f450956..5a16423a512c 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -532,7 +532,7 @@ static struct page *dequeue_huge_page_vma(struct hstate *h,
                                 struct vm_area_struct *vma,
                                 unsigned long address, int avoid_reserve)
 {
-        struct page *page;
+        struct page *page = NULL;
         struct mempolicy *mpol;
         nodemask_t *nodemask;
         struct zonelist *zonelist;
@@ -2791,6 +2791,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
          * so no worry about deadlock.
          */
         page = pte_page(entry);
+        get_page(page);
         if (page != pagecache_page)
                 lock_page(page);
 
@@ -2822,6 +2823,7 @@ out_page_table_lock:
         }
         if (page != pagecache_page)
                 unlock_page(page);
+        put_page(page);
 
 out_mutex:
         mutex_unlock(&hugetlb_instantiation_mutex);
diff --git a/mm/memblock.c b/mm/memblock.c
index 99f285599501..a44eab3157f8 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -330,6 +330,9 @@ static int __init_memblock memblock_add_region(struct memblock_type *type,
         phys_addr_t end = base + memblock_cap_size(base, &size);
         int i, nr_new;
 
+        if (!size)
+                return 0;
+
         /* special case for empty array */
         if (type->regions[0].size == 0) {
                 WARN_ON(type->cnt != 1 || type->total_size);
@@ -430,6 +433,9 @@ static int __init_memblock memblock_isolate_range(struct memblock_type *type,
 
         *start_rgn = *end_rgn = 0;
 
+        if (!size)
+                return 0;
+
         /* we'll create at most two more regions */
         while (type->cnt + 2 > type->max)
                 if (memblock_double_array(type) < 0)
@@ -514,7 +520,6 @@ int __init_memblock memblock_reserve(phys_addr_t base, phys_addr_t size)
                      (unsigned long long)base,
                      (unsigned long long)base + size,
                      (void *)_RET_IP_);
-        BUG_ON(0 == size);
 
         return memblock_add_region(_rgn, base, size, MAX_NUMNODES);
 }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 7d698df4a067..31ab9c3f0178 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2165,7 +2165,7 @@ static int __cpuinit memcg_cpu_hotplug_callback(struct notifier_block *nb,
         if (action == CPU_ONLINE)
                 return NOTIFY_OK;
 
-        if ((action != CPU_DEAD) || action != CPU_DEAD_FROZEN)
+        if (action != CPU_DEAD && action != CPU_DEAD_FROZEN)
                 return NOTIFY_OK;
 
         for_each_mem_cgroup(iter)
@@ -2476,10 +2476,10 @@ struct mem_cgroup *try_get_mem_cgroup_from_page(struct page *page)
 static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                                        struct page *page,
                                        unsigned int nr_pages,
-                                       struct page_cgroup *pc,
                                        enum charge_type ctype,
                                        bool lrucare)
 {
+        struct page_cgroup *pc = lookup_page_cgroup(page);
         struct zone *uninitialized_var(zone);
         bool was_on_lru = false;
         bool anon;
@@ -2716,7 +2716,6 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
 {
         struct mem_cgroup *memcg = NULL;
         unsigned int nr_pages = 1;
-        struct page_cgroup *pc;
         bool oom = true;
         int ret;
 
@@ -2730,11 +2729,10 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
                 oom = false;
         }
 
-        pc = lookup_page_cgroup(page);
         ret = __mem_cgroup_try_charge(mm, gfp_mask, nr_pages, &memcg, oom);
         if (ret == -ENOMEM)
                 return ret;
-        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype, false);
+        __mem_cgroup_commit_charge(memcg, page, nr_pages, ctype, false);
         return 0;
 }
 
@@ -2831,16 +2829,13 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *memcg,
                                         enum charge_type ctype)
 {
-        struct page_cgroup *pc;
-
         if (mem_cgroup_disabled())
                 return;
         if (!memcg)
                 return;
         cgroup_exclude_rmdir(&memcg->css);
 
-        pc = lookup_page_cgroup(page);
-        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype, true);
+        __mem_cgroup_commit_charge(memcg, page, 1, ctype, true);
         /*
          * Now swap is on-memory. This means this page may be
          * counted both as mem and swap....double count.
@@ -3298,14 +3293,13 @@ int mem_cgroup_prepare_migration(struct page *page,
          * page. In the case new page is migrated but not remapped, new page's
          * mapcount will be finally 0 and we call uncharge in end_migration().
          */
-        pc = lookup_page_cgroup(newpage);
         if (PageAnon(page))
                 ctype = MEM_CGROUP_CHARGE_TYPE_MAPPED;
         else if (page_is_file_cache(page))
                 ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
         else
                 ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
-        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype, false);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, ctype, false);
         return ret;
 }
 
@@ -3392,7 +3386,7 @@ void mem_cgroup_replace_page_cache(struct page *oldpage,
          * the newpage may be on LRU(or pagevec for LRU) already. We lock
          * LRU while we overwrite pc->mem_cgroup.
          */
-        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, type, true);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, type, true);
 }
 
 #ifdef CONFIG_DEBUG_VM
@@ -3763,7 +3757,7 @@ move_account:
                         goto try_to_free;
                 cond_resched();
         /* "ret" should also be checked to ensure all lists are empty. */
-        } while (memcg->res.usage > 0 || ret);
+        } while (res_counter_read_u64(&memcg->res, RES_USAGE) > 0 || ret);
 out:
         css_put(&memcg->css);
         return ret;
@@ -3778,7 +3772,7 @@ try_to_free:
         lru_add_drain_all();
         /* try to free all pages in this cgroup */
         shrink = 1;
-        while (nr_retries && memcg->res.usage > 0) {
+        while (nr_retries && res_counter_read_u64(&memcg->res, RES_USAGE) > 0) {
                 int progress;
 
                 if (signal_pending(current)) {
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index cfb6c8678754..b19569137529 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1361,11 +1361,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
 
         mm = get_task_mm(task);
         put_task_struct(task);
-        if (mm)
-                err = do_migrate_pages(mm, old, new,
-                        capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
-        else
+
+        if (!mm) {
                 err = -EINVAL;
+                goto out;
+        }
+
+        err = do_migrate_pages(mm, old, new,
+                capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
 
         mmput(mm);
 out:
diff --git a/mm/migrate.c b/mm/migrate.c
index 51c08a0c6f68..11072383ae12 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1388,14 +1388,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
         mm = get_task_mm(task);
         put_task_struct(task);
 
-        if (mm) {
-                if (nodes)
-                        err = do_pages_move(mm, task_nodes, nr_pages, pages,
-                                            nodes, status, flags);
-                else
-                        err = do_pages_stat(mm, nr_pages, pages, status);
-        } else
-                err = -EINVAL;
+        if (!mm)
+                return -EINVAL;
+
+        if (nodes)
+                err = do_pages_move(mm, task_nodes, nr_pages, pages,
+                                    nodes, status, flags);
+        else
+                err = do_pages_stat(mm, nr_pages, pages, status);
 
         mmput(mm);
         return err;
diff --git a/mm/mmap.c b/mm/mmap.c
index a7bf6a31c9f6..848ef52d9603 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -240,6 +240,8 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
         return next;
 }
 
+static unsigned long do_brk(unsigned long addr, unsigned long len);
+
 SYSCALL_DEFINE1(brk, unsigned long, brk)
 {
         unsigned long rlim, retval;
@@ -951,7 +953,7 @@ static inline unsigned long round_hint_to_min(unsigned long hint)
  * The caller must hold down_write(&current->mm->mmap_sem).
  */
 
-unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+static unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
                         unsigned long len, unsigned long prot,
                         unsigned long flags, unsigned long pgoff)
 {
@@ -1087,7 +1089,32 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
 
         return mmap_region(file, addr, len, flags, vm_flags, pgoff);
 }
-EXPORT_SYMBOL(do_mmap_pgoff);
+
+unsigned long do_mmap(struct file *file, unsigned long addr,
+        unsigned long len, unsigned long prot,
+        unsigned long flag, unsigned long offset)
+{
+        if (unlikely(offset + PAGE_ALIGN(len) < offset))
+                return -EINVAL;
+        if (unlikely(offset & ~PAGE_MASK))
+                return -EINVAL;
+        return do_mmap_pgoff(file, addr, len, prot, flag, offset >> PAGE_SHIFT);
+}
+EXPORT_SYMBOL(do_mmap);
+
+unsigned long vm_mmap(struct file *file, unsigned long addr,
+        unsigned long len, unsigned long prot,
+        unsigned long flag, unsigned long offset)
+{
+        unsigned long ret;
+        struct mm_struct *mm = current->mm;
+
+        down_write(&mm->mmap_sem);
+        ret = do_mmap(file, addr, len, prot, flag, offset);
+        up_write(&mm->mmap_sem);
+        return ret;
+}
+EXPORT_SYMBOL(vm_mmap);
 
 SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
                 unsigned long, prot, unsigned long, flags,
@@ -2105,21 +2132,25 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
 
         return 0;
 }
-
 EXPORT_SYMBOL(do_munmap);
 
-SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+int vm_munmap(unsigned long start, size_t len)
 {
         int ret;
         struct mm_struct *mm = current->mm;
 
-        profile_munmap(addr);
-
         down_write(&mm->mmap_sem);
-        ret = do_munmap(mm, addr, len);
+        ret = do_munmap(mm, start, len);
         up_write(&mm->mmap_sem);
         return ret;
 }
+EXPORT_SYMBOL(vm_munmap);
+
+SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+{
+        profile_munmap(addr);
+        return vm_munmap(addr, len);
+}
 
 static inline void verify_mm_writelocked(struct mm_struct *mm)
 {
@@ -2136,7 +2167,7 @@ static inline void verify_mm_writelocked(struct mm_struct *mm)
  *  anonymous maps.  eventually we may be able to do some
  *  brk-specific accounting here.
  */
-unsigned long do_brk(unsigned long addr, unsigned long len)
+static unsigned long do_brk(unsigned long addr, unsigned long len)
 {
         struct mm_struct * mm = current->mm;
         struct vm_area_struct * vma, * prev;
@@ -2232,7 +2263,17 @@ out:
         return addr;
 }
 
-EXPORT_SYMBOL(do_brk);
+unsigned long vm_brk(unsigned long addr, unsigned long len)
+{
+        struct mm_struct *mm = current->mm;
+        unsigned long ret;
+
+        down_write(&mm->mmap_sem);
+        ret = do_brk(addr, len);
+        up_write(&mm->mmap_sem);
+        return ret;
+}
+EXPORT_SYMBOL(vm_brk);
 
 /* Release all mmaps. */
 void exit_mmap(struct mm_struct *mm)
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index 24f0fc1a56d6..e53bb8a256b1 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -298,13 +298,19 @@ void * __init __alloc_bootmem_node(pg_data_t *pgdat, unsigned long size,
         if (WARN_ON_ONCE(slab_is_available()))
                 return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
 
+again:
         ptr = __alloc_memory_core_early(pgdat->node_id, size, align,
                                          goal, -1ULL);
         if (ptr)
                 return ptr;
 
-        return __alloc_memory_core_early(MAX_NUMNODES, size, align,
-                                         goal, -1ULL);
+        ptr = __alloc_memory_core_early(MAX_NUMNODES, size, align,
+                                        goal, -1ULL);
+        if (!ptr && goal) {
+                goal = 0;
+                goto again;
+        }
+        return ptr;
 }
 
 void * __init __alloc_bootmem_node_high(pg_data_t *pgdat, unsigned long size,
diff --git a/mm/nommu.c b/mm/nommu.c
index f59e170fceb4..bb8f4f004a82 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1233,7 +1233,7 @@ enomem:
 /*
  * handle mapping creation for uClinux
  */
-unsigned long do_mmap_pgoff(struct file *file,
+static unsigned long do_mmap_pgoff(struct file *file,
                             unsigned long addr,
                             unsigned long len,
                             unsigned long prot,
@@ -1470,7 +1470,32 @@ error_getting_region:
         show_free_areas(0);
         return -ENOMEM;
 }
-EXPORT_SYMBOL(do_mmap_pgoff);
+
+unsigned long do_mmap(struct file *file, unsigned long addr,
+        unsigned long len, unsigned long prot,
+        unsigned long flag, unsigned long offset)
+{
+        if (unlikely(offset + PAGE_ALIGN(len) < offset))
+                return -EINVAL;
+        if (unlikely(offset & ~PAGE_MASK))
+                return -EINVAL;
+        return do_mmap_pgoff(file, addr, len, prot, flag, offset >> PAGE_SHIFT);
+}
+EXPORT_SYMBOL(do_mmap);
+
+unsigned long vm_mmap(struct file *file, unsigned long addr,
+        unsigned long len, unsigned long prot,
+        unsigned long flag, unsigned long offset)
+{
+        unsigned long ret;
+        struct mm_struct *mm = current->mm;
+
+        down_write(&mm->mmap_sem);
+        ret = do_mmap(file, addr, len, prot, flag, offset);
+        up_write(&mm->mmap_sem);
+        return ret;
+}
+EXPORT_SYMBOL(vm_mmap);
 
 SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
                 unsigned long, prot, unsigned long, flags,
@@ -1709,16 +1734,22 @@ erase_whole_vma:
 }
 EXPORT_SYMBOL(do_munmap);
 
-SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+int vm_munmap(unsigned long addr, size_t len)
 {
-        int ret;
         struct mm_struct *mm = current->mm;
+        int ret;
 
         down_write(&mm->mmap_sem);
         ret = do_munmap(mm, addr, len);
         up_write(&mm->mmap_sem);
         return ret;
 }
+EXPORT_SYMBOL(vm_munmap);
+
+SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+{
+        return vm_munmap(addr, len);
+}
 
 /*
  * release all the mappings made in a process's VM space
@@ -1744,7 +1775,7 @@ void exit_mmap(struct mm_struct *mm)
         kleave("");
 }
 
-unsigned long do_brk(unsigned long addr, unsigned long len)
+unsigned long vm_brk(unsigned long addr, unsigned long len)
 {
         return -ENOMEM;
 }
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 9d3dd3763cf7..4c5ff7f284d9 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -26,7 +26,7 @@
  */
 static const struct address_space_operations swap_aops = {
         .writepage      = swap_writepage,
-        .set_page_dirty = __set_page_dirty_nobuffers,
+        .set_page_dirty = __set_page_dirty_no_writeback,
         .migratepage    = migrate_page,
 };
 
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 33c332bbab73..33dc256033b5 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1568,9 +1568,14 @@ shrink_inactive_list(unsigned long nr_to_scan, struct mem_cgroup_zone *mz,
         reclaim_stat->recent_scanned[0] += nr_anon;
         reclaim_stat->recent_scanned[1] += nr_file;
 
-        if (current_is_kswapd())
-                __count_vm_events(KSWAPD_STEAL, nr_reclaimed);
-        __count_zone_vm_events(PGSTEAL, zone, nr_reclaimed);
+        if (global_reclaim(sc)) {
+                if (current_is_kswapd())
+                        __count_zone_vm_events(PGSTEAL_KSWAPD, zone,
+                                               nr_reclaimed);
+                else
+                        __count_zone_vm_events(PGSTEAL_DIRECT, zone,
+                                               nr_reclaimed);
+        }
 
         putback_inactive_pages(mz, &page_list);
 
@@ -2107,12 +2112,7 @@ restart:
                  * with multiple processes reclaiming pages, the total
                  * freeing target can get unreasonably large.
                  */
-                if (nr_reclaimed >= nr_to_reclaim)
-                        nr_to_reclaim = 0;
-                else
-                        nr_to_reclaim -= nr_reclaimed;
-
-                if (!nr_to_reclaim && priority < DEF_PRIORITY)
+                if (nr_reclaimed >= nr_to_reclaim && priority < DEF_PRIORITY)
                         break;
         }
         blk_finish_plug(&plug);
diff --git a/mm/vmstat.c b/mm/vmstat.c
index f600557a7659..7db1b9bab492 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -738,7 +738,8 @@ const char * const vmstat_text[] = {
         "pgmajfault",
 
         TEXTS_FOR_ZONES("pgrefill")
-        TEXTS_FOR_ZONES("pgsteal")
+        TEXTS_FOR_ZONES("pgsteal_kswapd")
+        TEXTS_FOR_ZONES("pgsteal_direct")
         TEXTS_FOR_ZONES("pgscan_kswapd")
         TEXTS_FOR_ZONES("pgscan_direct")
 
@@ -747,7 +748,6 @@ const char * const vmstat_text[] = {
 #endif
         "pginodesteal",
         "slabs_scanned",
-        "kswapd_steal",
         "kswapd_inodesteal",
         "kswapd_low_wmark_hit_quickly",
         "kswapd_high_wmark_hit_quickly",
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 0906c194a413..9d9a6a3edbd5 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -2011,16 +2011,17 @@ static void __exit ax25_exit(void)
         proc_net_remove(&init_net, "ax25_route");
         proc_net_remove(&init_net, "ax25");
         proc_net_remove(&init_net, "ax25_calls");
-        ax25_rt_free();
-        ax25_uid_free();
-        ax25_dev_free();
 
-        ax25_unregister_sysctl();
         unregister_netdevice_notifier(&ax25_dev_notifier);
+        ax25_unregister_sysctl();
 
         dev_remove_pack(&ax25_packet_type);
 
         sock_unregister(PF_AX25);
         proto_unregister(&ax25_proto);
+
+        ax25_rt_free();
+        ax25_uid_free();
+        ax25_dev_free();
 }
 module_exit(ax25_exit);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e33af63a884a..edfd61addcec 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -665,6 +665,11 @@ int hci_dev_open(__u16 dev)
 
         hci_req_lock(hdev);
 
+        if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
+                ret = -ENODEV;
+                goto done;
+        }
+
         if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
                 ret = -ERFKILL;
                 goto done;
@@ -1210,40 +1215,40 @@ struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
         return NULL;
 }
 
-static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
+static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
                                                 u8 key_type, u8 old_key_type)
 {
         /* Legacy key */
         if (key_type < 0x03)
-                return 1;
+                return true;
 
         /* Debug keys are insecure so don't store them persistently */
         if (key_type == HCI_LK_DEBUG_COMBINATION)
-                return 0;
+                return false;
 
         /* Changed combination key and there's no previous one */
         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
-                return 0;
+                return false;
 
         /* Security mode 3 case */
         if (!conn)
-                return 1;
+                return true;
 
         /* Neither local nor remote side had no-bonding as requirement */
         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
-                return 1;
+                return true;
 
         /* Local side had dedicated bonding as requirement */
         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
-                return 1;
+                return true;
 
         /* Remote side had dedicated bonding as requirement */
         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
-                return 1;
+                return true;
 
         /* If none of the above criteria match, then don't store the key
          * persistently */
-        return 0;
+        return false;
 }
 
 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
@@ -1280,7 +1285,8 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
 {
         struct link_key *key, *old_key;
-        u8 old_key_type, persistent;
+        u8 old_key_type;
+        bool persistent;
 
         old_key = hci_find_link_key(hdev, bdaddr);
         if (old_key) {
@@ -1323,10 +1329,8 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 
         mgmt_new_link_key(hdev, key, persistent);
 
-        if (!persistent) {
-                list_del(&key->list);
-                kfree(key);
-        }
+        if (conn)
+                conn->flush_key = !persistent;
 
         return 0;
 }
@@ -1849,6 +1853,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
 
         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
+        set_bit(HCI_UNREGISTER, &hdev->dev_flags);
+
         write_lock(&hci_dev_list_lock);
         list_del(&hdev->list);
         write_unlock(&hci_dev_list_lock);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b37531094c49..6c065254afc0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1901,6 +1901,8 @@ static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff
         }
 
         if (ev->status == 0) {
+                if (conn->type == ACL_LINK && conn->flush_key)
+                        hci_remove_link_key(hdev, &conn->dst);
                 hci_proto_disconn_cfm(conn, ev->reason);
                 hci_conn_del(conn);
         }
@@ -2311,6 +2313,7 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
 
         case HCI_OP_USER_PASSKEY_NEG_REPLY:
                 hci_cc_user_passkey_neg_reply(hdev, skb);
+                break;
 
         case HCI_OP_LE_SET_SCAN_PARAM:
                 hci_cc_le_set_scan_param(hdev, skb);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b8e17e4dac8b..94552b33d528 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1308,6 +1308,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
         if (chan->retry_count >= chan->remote_max_tx) {
                 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
                 l2cap_chan_unlock(chan);
+                l2cap_chan_put(chan);
                 return;
         }
 
@@ -1316,6 +1317,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
 
         l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
         l2cap_chan_unlock(chan);
+        l2cap_chan_put(chan);
 }
 
 static void l2cap_retrans_timeout(struct work_struct *work)
@@ -1335,6 +1337,7 @@ static void l2cap_retrans_timeout(struct work_struct *work)
         l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
 
         l2cap_chan_unlock(chan);
+        l2cap_chan_put(chan);
 }
 
 static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index c4fe583b0af6..29122ed28ea9 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -82,7 +82,7 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         }
 
         if (la.l2_cid)
-                err = l2cap_add_scid(chan, la.l2_cid);
+                err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
         else
                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 
@@ -123,7 +123,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
         if (la.l2_cid && la.l2_psm)
                 return -EINVAL;
 
-        err = l2cap_chan_connect(chan, la.l2_psm, la.l2_cid, &la.l2_bdaddr);
+        err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
+                                &la.l2_bdaddr);
         if (err)
                 return err;
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 7fcff8887131..4bb03b111122 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2523,13 +2523,18 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
 
         if (cp->val) {
                 type = PAGE_SCAN_TYPE_INTERLACED;
-                acp.interval = 0x0024;  /* 22.5 msec page scan interval */
+
+                /* 22.5 msec page scan interval */
+                acp.interval = __constant_cpu_to_le16(0x0024);
         } else {
                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
-                acp.interval = 0x0800;  /* default 1.28 sec page scan */
+
+                /* default 1.28 sec page scan */
+                acp.interval = __constant_cpu_to_le16(0x0800);
         }
 
-        acp.window = 0x0012;    /* default 11.25 msec page scan window */
+        /* default 11.25 msec page scan window */
+        acp.window = __constant_cpu_to_le16(0x0012);
 
         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
                            &acp);
@@ -2879,7 +2884,7 @@ int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
         return 0;
 }
 
-int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, u8 persistent)
+int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, bool persistent)
 {
         struct mgmt_ev_new_link_key ev;
 
@@ -2936,7 +2941,7 @@ int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                                           name, name_len);
 
         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
-                eir_len = eir_append_data(&ev->eir[eir_len], eir_len,
+                eir_len = eir_append_data(ev->eir, eir_len,
                                           EIR_CLASS_OF_DEV, dev_class, 3);
 
         put_unaligned_le16(eir_len, &ev->eir_len);
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 61f65344e711..a2098e3de500 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -47,6 +47,7 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
                 kfree_skb(skb);
         } else {
                 skb_push(skb, ETH_HLEN);
+                br_drop_fake_rtable(skb);
                 dev_queue_xmit(skb);
         }
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 702a1ae9220b..27ca25ed7021 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -241,7 +241,6 @@ static void br_multicast_group_expired(unsigned long data)
         hlist_del_rcu(&mp->hlist[mdb->ver]);
         mdb->size--;
 
-        del_timer(&mp->query_timer);
         call_rcu_bh(&mp->rcu, br_multicast_free_group);
 
 out:
@@ -271,7 +270,6 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 rcu_assign_pointer(*pp, p->next);
                 hlist_del_init(&p->mglist);
                 del_timer(&p->timer);
-                del_timer(&p->query_timer);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
                 if (!mp->ports && !mp->mglist &&
@@ -507,74 +505,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
         return NULL;
 }
 
-static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
-{
-        struct net_bridge *br = mp->br;
-        struct sk_buff *skb;
-
-        skb = br_multicast_alloc_query(br, &mp->addr);
-        if (!skb)
-                goto timer;
-
-        netif_rx(skb);
-
-timer:
-        if (++mp->queries_sent < br->multicast_last_member_count)
-                mod_timer(&mp->query_timer,
-                          jiffies + br->multicast_last_member_interval);
-}
-
-static void br_multicast_group_query_expired(unsigned long data)
-{
-        struct net_bridge_mdb_entry *mp = (void *)data;
-        struct net_bridge *br = mp->br;
-
-        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || !mp->mglist ||
-            mp->queries_sent >= br->multicast_last_member_count)
-                goto out;
-
-        br_multicast_send_group_query(mp);
-
-out:
-        spin_unlock(&br->multicast_lock);
-}
-
-static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
-{
-        struct net_bridge_port *port = pg->port;
-        struct net_bridge *br = port->br;
-        struct sk_buff *skb;
-
-        skb = br_multicast_alloc_query(br, &pg->addr);
-        if (!skb)
-                goto timer;
-
-        br_deliver(port, skb);
-
-timer:
-        if (++pg->queries_sent < br->multicast_last_member_count)
-                mod_timer(&pg->query_timer,
-                          jiffies + br->multicast_last_member_interval);
-}
-
-static void br_multicast_port_group_query_expired(unsigned long data)
-{
-        struct net_bridge_port_group *pg = (void *)data;
-        struct net_bridge_port *port = pg->port;
-        struct net_bridge *br = port->br;
-
-        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
-            pg->queries_sent >= br->multicast_last_member_count)
-                goto out;
-
-        br_multicast_send_port_group_query(pg);
-
-out:
-        spin_unlock(&br->multicast_lock);
-}
-
 static struct net_bridge_mdb_entry *br_multicast_get_group(
         struct net_bridge *br, struct net_bridge_port *port,
         struct br_ip *group, int hash)
@@ -690,8 +620,6 @@ rehash:
         mp->addr = *group;
         setup_timer(&mp->timer, br_multicast_group_expired,
                     (unsigned long)mp);
-        setup_timer(&mp->query_timer, br_multicast_group_query_expired,
-                    (unsigned long)mp);
 
         hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
         mdb->size++;
@@ -746,8 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br,
         hlist_add_head(&p->mglist, &port->mglist);
         setup_timer(&p->timer, br_multicast_port_group_expired,
                     (unsigned long)p);
-        setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
-                    (unsigned long)p);
 
         rcu_assign_pointer(*pp, p);
 
@@ -1291,9 +1217,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      time_after(mp->timer.expires, time) :
                      try_to_del_timer_sync(&mp->timer) >= 0)) {
                         mod_timer(&mp->timer, time);
-
-                        mp->queries_sent = 0;
-                        mod_timer(&mp->query_timer, now);
                 }
 
                 goto out;
@@ -1310,9 +1233,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      time_after(p->timer.expires, time) :
                      try_to_del_timer_sync(&p->timer) >= 0)) {
                         mod_timer(&p->timer, time);
-
-                        p->queries_sent = 0;
-                        mod_timer(&p->query_timer, now);
                 }
 
                 break;
@@ -1681,7 +1601,6 @@ void br_multicast_stop(struct net_bridge *br)
                 hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
                                           hlist[ver]) {
                         del_timer(&mp->timer);
-                        del_timer(&mp->query_timer);
                         call_rcu_bh(&mp->rcu, br_multicast_free_group);
                 }
         }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index dec4f3817133..d7f49b63ab0f 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -156,7 +156,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         rt->dst.dev = br->dev;
         rt->dst.path = &rt->dst;
         dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
-        rt->dst.flags   = DST_NOXFRM | DST_NOPEER;
+        rt->dst.flags   = DST_NOXFRM | DST_NOPEER | DST_FAKE_RTABLE;
         rt->dst.ops = &fake_dst_ops;
 }
 
@@ -694,11 +694,7 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
                                    const struct net_device *out,
                                    int (*okfn)(struct sk_buff *))
 {
-        struct rtable *rt = skb_rtable(skb);
-
-        if (rt && rt == bridge_parent_rtable(in))
-                skb_dst_drop(skb);
-
+        br_drop_fake_rtable(skb);
         return NF_ACCEPT;
 }
 
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 0b67a63ad7a8..e1d882257877 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -82,9 +82,7 @@ struct net_bridge_port_group {
         struct hlist_node               mglist;
         struct rcu_head                 rcu;
         struct timer_list               timer;
-        struct timer_list               query_timer;
         struct br_ip                    addr;
-        u32                             queries_sent;
 };
 
 struct net_bridge_mdb_entry
@@ -94,10 +92,8 @@ struct net_bridge_mdb_entry
         struct net_bridge_port_group __rcu *ports;
         struct rcu_head                 rcu;
         struct timer_list               timer;
-        struct timer_list               query_timer;
         struct br_ip                    addr;
         bool                            mglist;
-        u32                             queries_sent;
 };
 
 struct net_bridge_mdb_htable
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 20618dd3088b..d09340e1523f 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -103,6 +103,7 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
                 skb->protocol = htons(ETH_P_IPV6);
                 break;
         default:
+                kfree_skb(skb);
                 priv->netdev->stats.rx_errors++;
                 return -EINVAL;
         }
@@ -220,14 +221,16 @@ static int chnl_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (skb->len > priv->netdev->mtu) {
                 pr_warn("Size of skb exceeded MTU\n");
+                kfree_skb(skb);
                 dev->stats.tx_errors++;
-                return -ENOSPC;
+                return NETDEV_TX_OK;
         }
 
         if (!priv->flowenabled) {
                 pr_debug("dropping packets flow off\n");
+                kfree_skb(skb);
                 dev->stats.tx_dropped++;
-                return NETDEV_TX_BUSY;
+                return NETDEV_TX_OK;
         }
 
         if (priv->conn_req.protocol == CAIFPROTO_DATAGRAM_LOOP)
@@ -242,7 +245,7 @@ static int chnl_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
         result = priv->chnl.dn->transmit(priv->chnl.dn, pkt);
         if (result) {
                 dev->stats.tx_dropped++;
-                return result;
+                return NETDEV_TX_OK;
         }
 
         /* Update statistics. */
diff --git a/net/core/dev.c b/net/core/dev.c
index c25d453b2803..9bb8f87c4cda 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1409,14 +1409,34 @@ EXPORT_SYMBOL(register_netdevice_notifier);
  *      register_netdevice_notifier(). The notifier is unlinked into the
  *      kernel structures and may then be reused. A negative errno code
  *      is returned on a failure.
+ *
+ *      After unregistering unregister and down device events are synthesized
+ *      for all devices on the device list to the removed notifier to remove
+ *      the need for special case cleanup code.
  */
 
 int unregister_netdevice_notifier(struct notifier_block *nb)
 {
+        struct net_device *dev;
+        struct net *net;
         int err;
 
         rtnl_lock();
         err = raw_notifier_chain_unregister(&netdev_chain, nb);
+        if (err)
+                goto unlock;
+
+        for_each_net(net) {
+                for_each_netdev(net, dev) {
+                        if (dev->flags & IFF_UP) {
+                                nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
+                                nb->notifier_call(nb, NETDEV_DOWN, dev);
+                        }
+                        nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
+                        nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
+                }
+        }
+unlock:
         rtnl_unlock();
         return err;
 }
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 7f36b38e060f..a7cad741df01 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -42,13 +42,14 @@ static void send_dm_alert(struct work_struct *unused);
  * netlink alerts
  */
 static int trace_state = TRACE_OFF;
-static DEFINE_SPINLOCK(trace_state_lock);
+static DEFINE_MUTEX(trace_state_mutex);
 
 struct per_cpu_dm_data {
         struct work_struct dm_alert_work;
-        struct sk_buff *skb;
+        struct sk_buff __rcu *skb;
         atomic_t dm_hit_count;
         struct timer_list send_timer;
+        int cpu;
 };
 
 struct dm_hw_stat_delta {
@@ -79,29 +80,53 @@ static void reset_per_cpu_data(struct per_cpu_dm_data *data)
         size_t al;
         struct net_dm_alert_msg *msg;
         struct nlattr *nla;
+        struct sk_buff *skb;
+        struct sk_buff *oskb = rcu_dereference_protected(data->skb, 1);
 
         al = sizeof(struct net_dm_alert_msg);
         al += dm_hit_limit * sizeof(struct net_dm_drop_point);
         al += sizeof(struct nlattr);
 
-        data->skb = genlmsg_new(al, GFP_KERNEL);
-        genlmsg_put(data->skb, 0, 0, &net_drop_monitor_family,
-                        0, NET_DM_CMD_ALERT);
-        nla = nla_reserve(data->skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
-        msg = nla_data(nla);
-        memset(msg, 0, al);
-        atomic_set(&data->dm_hit_count, dm_hit_limit);
+        skb = genlmsg_new(al, GFP_KERNEL);
+
+        if (skb) {
+                genlmsg_put(skb, 0, 0, &net_drop_monitor_family,
+                                0, NET_DM_CMD_ALERT);
+                nla = nla_reserve(skb, NLA_UNSPEC,
+                                  sizeof(struct net_dm_alert_msg));
+                msg = nla_data(nla);
+                memset(msg, 0, al);
+        } else
+                schedule_work_on(data->cpu, &data->dm_alert_work);
+
+        /*
+         * Don't need to lock this, since we are guaranteed to only
+         * run this on a single cpu at a time.
+         * Note also that we only update data->skb if the old and new skb
+         * pointers don't match.  This ensures that we don't continually call
+         * synchornize_rcu if we repeatedly fail to alloc a new netlink message.
+         */
+        if (skb != oskb) {
+                rcu_assign_pointer(data->skb, skb);
+
+                synchronize_rcu();
+
+                atomic_set(&data->dm_hit_count, dm_hit_limit);
+        }
+
 }
 
 static void send_dm_alert(struct work_struct *unused)
 {
         struct sk_buff *skb;
-        struct per_cpu_dm_data *data = &__get_cpu_var(dm_cpu_data);
+        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
+
+        WARN_ON_ONCE(data->cpu != smp_processor_id());
 
         /*
          * Grab the skb we're about to send
          */
-        skb = data->skb;
+        skb = rcu_dereference_protected(data->skb, 1);
 
         /*
          * Replace it with a new one
@@ -111,8 +136,10 @@ static void send_dm_alert(struct work_struct *unused)
         /*
          * Ship it!
          */
-        genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
+        if (skb)
+                genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
 
+        put_cpu_var(dm_cpu_data);
 }
 
 /*
@@ -123,9 +150,11 @@ static void send_dm_alert(struct work_struct *unused)
  */
 static void sched_send_work(unsigned long unused)
 {
-        struct per_cpu_dm_data *data =  &__get_cpu_var(dm_cpu_data);
+        struct per_cpu_dm_data *data =  &get_cpu_var(dm_cpu_data);
+
+        schedule_work_on(smp_processor_id(), &data->dm_alert_work);
 
-        schedule_work(&data->dm_alert_work);
+        put_cpu_var(dm_cpu_data);
 }
 
 static void trace_drop_common(struct sk_buff *skb, void *location)
@@ -134,8 +163,15 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         struct nlmsghdr *nlh;
         struct nlattr *nla;
         int i;
-        struct per_cpu_dm_data *data = &__get_cpu_var(dm_cpu_data);
+        struct sk_buff *dskb;
+        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
+
+
+        rcu_read_lock();
+        dskb = rcu_dereference(data->skb);
 
+        if (!dskb)
+                goto out;
 
         if (!atomic_add_unless(&data->dm_hit_count, -1, 0)) {
                 /*
@@ -144,12 +180,13 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
                 goto out;
         }
 
-        nlh = (struct nlmsghdr *)data->skb->data;
+        nlh = (struct nlmsghdr *)dskb->data;
         nla = genlmsg_data(nlmsg_data(nlh));
         msg = nla_data(nla);
         for (i = 0; i < msg->entries; i++) {
                 if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
                         msg->points[i].count++;
+                        atomic_inc(&data->dm_hit_count);
                         goto out;
                 }
         }
@@ -157,7 +194,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         /*
          * We need to create a new entry
          */
-        __nla_reserve_nohdr(data->skb, sizeof(struct net_dm_drop_point));
+        __nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point));
         nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
         memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
         msg->points[msg->entries].count = 1;
@@ -169,6 +206,8 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         }
 
 out:
+        rcu_read_unlock();
+        put_cpu_var(dm_cpu_data);
         return;
 }
 
@@ -213,7 +252,7 @@ static int set_all_monitor_traces(int state)
         struct dm_hw_stat_delta *new_stat = NULL;
         struct dm_hw_stat_delta *temp;
 
-        spin_lock(&trace_state_lock);
+        mutex_lock(&trace_state_mutex);
 
         if (state == trace_state) {
                 rc = -EAGAIN;
@@ -252,7 +291,7 @@ static int set_all_monitor_traces(int state)
                 rc = -EINPROGRESS;
 
 out_unlock:
-        spin_unlock(&trace_state_lock);
+        mutex_unlock(&trace_state_mutex);
 
         return rc;
 }
@@ -295,12 +334,12 @@ static int dropmon_net_event(struct notifier_block *ev_block,
 
                 new_stat->dev = dev;
                 new_stat->last_rx = jiffies;
-                spin_lock(&trace_state_lock);
+                mutex_lock(&trace_state_mutex);
                 list_add_rcu(&new_stat->list, &hw_stats_list);
-                spin_unlock(&trace_state_lock);
+                mutex_unlock(&trace_state_mutex);
                 break;
         case NETDEV_UNREGISTER:
-                spin_lock(&trace_state_lock);
+                mutex_lock(&trace_state_mutex);
                 list_for_each_entry_safe(new_stat, tmp, &hw_stats_list, list) {
                         if (new_stat->dev == dev) {
                                 new_stat->dev = NULL;
@@ -311,7 +350,7 @@ static int dropmon_net_event(struct notifier_block *ev_block,
                                 }
                         }
                 }
-                spin_unlock(&trace_state_lock);
+                mutex_unlock(&trace_state_mutex);
                 break;
         }
 out:
@@ -367,13 +406,15 @@ static int __init init_net_drop_monitor(void)
 
         for_each_present_cpu(cpu) {
                 data = &per_cpu(dm_cpu_data, cpu);
-                reset_per_cpu_data(data);
+                data->cpu = cpu;
                 INIT_WORK(&data->dm_alert_work, send_dm_alert);
                 init_timer(&data->send_timer);
                 data->send_timer.data = cpu;
                 data->send_timer.function = sched_send_work;
+                reset_per_cpu_data(data);
         }
 
+
         goto out;
 
 out_unreg:
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 0e950fda9a0a..31a5ae51a45c 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -83,21 +83,29 @@ assign:
 
 static int ops_init(const struct pernet_operations *ops, struct net *net)
 {
-        int err;
+        int err = -ENOMEM;
+        void *data = NULL;
+
         if (ops->id && ops->size) {
-                void *data = kzalloc(ops->size, GFP_KERNEL);
+                data = kzalloc(ops->size, GFP_KERNEL);
                 if (!data)
-                        return -ENOMEM;
+                        goto out;
 
                 err = net_assign_generic(net, *ops->id, data);
-                if (err) {
-                        kfree(data);
-                        return err;
-                }
+                if (err)
+                        goto cleanup;
         }
+        err = 0;
         if (ops->init)
-                return ops->init(net);
-        return 0;
+                err = ops->init(net);
+        if (!err)
+                return 0;
+
+cleanup:
+        kfree(data);
+
+out:
+        return err;
 }
 
 static void ops_free(const struct pernet_operations *ops, struct net *net)
@@ -448,12 +456,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)
 static int __register_pernet_operations(struct list_head *list,
                                         struct pernet_operations *ops)
 {
-        int err = 0;
-        err = ops_init(ops, &init_net);
-        if (err)
-                ops_free(ops, &init_net);
-        return err;
-        
+        return ops_init(ops, &init_net);
 }
 
 static void __unregister_pernet_operations(struct pernet_operations *ops)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index baf8d281152c..e59840010d45 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -952,9 +952,11 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                 goto adjust_others;
         }
 
-        data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
+        data = kmalloc(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
+                       gfp_mask);
         if (!data)
                 goto nodata;
+        size = SKB_WITH_OVERHEAD(ksize(data));
 
         /* Copy only real data... and, alas, header. This should be
          * optimized for the cases when header is void.
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 368515885368..840821b90bcd 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -1044,6 +1044,24 @@ static void lowpan_dev_free(struct net_device *dev)
         free_netdev(dev);
 }
 
+static struct wpan_phy *lowpan_get_phy(const struct net_device *dev)
+{
+        struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
+        return ieee802154_mlme_ops(real_dev)->get_phy(real_dev);
+}
+
+static u16 lowpan_get_pan_id(const struct net_device *dev)
+{
+        struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
+        return ieee802154_mlme_ops(real_dev)->get_pan_id(real_dev);
+}
+
+static u16 lowpan_get_short_addr(const struct net_device *dev)
+{
+        struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
+        return ieee802154_mlme_ops(real_dev)->get_short_addr(real_dev);
+}
+
 static struct header_ops lowpan_header_ops = {
         .create = lowpan_header_create,
 };
@@ -1053,6 +1071,12 @@ static const struct net_device_ops lowpan_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
 };
 
+static struct ieee802154_mlme_ops lowpan_mlme = {
+        .get_pan_id = lowpan_get_pan_id,
+        .get_phy = lowpan_get_phy,
+        .get_short_addr = lowpan_get_short_addr,
+};
+
 static void lowpan_setup(struct net_device *dev)
 {
         pr_debug("(%s)\n", __func__);
@@ -1070,6 +1094,7 @@ static void lowpan_setup(struct net_device *dev)
 
         dev->netdev_ops         = &lowpan_netdev_ops;
         dev->header_ops         = &lowpan_header_ops;
+        dev->ml_priv            = &lowpan_mlme;
         dev->destructor         = lowpan_dev_free;
 }
 
@@ -1143,6 +1168,8 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
         list_add_tail(&entry->list, &lowpan_devices);
         mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx);
 
+        spin_lock_init(&flist_lock);
+
         register_netdevice(dev);
 
         return 0;
@@ -1152,11 +1179,20 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head)
 {
         struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev);
         struct net_device *real_dev = lowpan_dev->real_dev;
-        struct lowpan_dev_record *entry;
-        struct lowpan_dev_record *tmp;
+        struct lowpan_dev_record *entry, *tmp;
+        struct lowpan_fragment *frame, *tframe;
 
         ASSERT_RTNL();
 
+        spin_lock(&flist_lock);
+        list_for_each_entry_safe(frame, tframe, &lowpan_fragments, list) {
+                del_timer(&frame->timer);
+                list_del(&frame->list);
+                dev_kfree_skb(frame->skb);
+                kfree(frame);
+        }
+        spin_unlock(&flist_lock);
+
         mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
         list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) {
                 if (entry->ldev == dev) {
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 8d25a1c557eb..8f8db724bfaf 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -141,7 +141,7 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                         goto rtattr_failure;
 
         if (icsk == NULL) {
-                r->idiag_rqueue = r->idiag_wqueue = 0;
+                handler->idiag_get_info(sk, r, NULL);
                 goto out;
         }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index de9da21113a1..cf73cc70ed2d 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -74,16 +74,24 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 
         iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
         if (iph == NULL)
-                return -NF_DROP;
+                return -NF_ACCEPT;
 
         /* Conntrack defragments packets, we might still see fragments
          * inside ICMP packets though. */
         if (iph->frag_off & htons(IP_OFFSET))
-                return -NF_DROP;
+                return -NF_ACCEPT;
 
         *dataoff = nhoff + (iph->ihl << 2);
         *protonum = iph->protocol;
 
+        /* Check bogus IP headers */
+        if (*dataoff > skb->len) {
+                pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
+                         "nhoff %u, ihl %u, skblen %u\n",
+                         nhoff, iph->ihl << 2, skb->len);
+                return -NF_ACCEPT;
+        }
+
         return NF_ACCEPT;
 }
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5d54ed30e821..1272a88c2a63 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -701,11 +701,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
         skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
         if (skb) {
                 if (sk_wmem_schedule(sk, skb->truesize)) {
+                        skb_reserve(skb, sk->sk_prot->max_header);
                         /*
                          * Make sure that we have exactly size bytes
                          * available to the caller, no more, no less.
                          */
-                        skb_reserve(skb, skb_tailroom(skb) - size);
+                        skb->avail_size = size;
                         return skb;
                 }
                 __kfree_skb(skb);
@@ -995,10 +996,9 @@ new_segment:
                                 copy = seglen;
 
                         /* Where to copy to? */
-                        if (skb_tailroom(skb) > 0) {
+                        if (skb_availroom(skb) > 0) {
                                 /* We have some space in skb head. Superb! */
-                                if (copy > skb_tailroom(skb))
-                                        copy = skb_tailroom(skb);
+                                copy = min_t(int, copy, skb_availroom(skb));
                                 err = skb_add_data_nocache(sk, skb, from, copy);
                                 if (err)
                                         goto do_fault;
@@ -1452,7 +1452,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 if ((available < target) &&
                     (len > sysctl_tcp_dma_copybreak) && !(flags & MSG_PEEK) &&
                     !sysctl_tcp_low_latency &&
-                    dma_find_channel(DMA_MEMCPY)) {
+                    net_dma_find_channel()) {
                         preempt_enable_no_resched();
                         tp->ucopy.pinned_list =
                                         dma_pin_iovec_pages(msg->msg_iov, len);
@@ -1667,7 +1667,7 @@ do_prequeue:
                 if (!(flags & MSG_TRUNC)) {
 #ifdef CONFIG_NET_DMA
                         if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                                tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                                tp->ucopy.dma_chan = net_dma_find_channel();
 
                         if (tp->ucopy.dma_chan) {
                                 tp->ucopy.dma_cookie = dma_skb_copy_datagram_iovec(
@@ -3243,7 +3243,7 @@ void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
         unsigned long limit;
-        int max_share, cnt;
+        int max_rshare, max_wshare, cnt;
         unsigned int i;
         unsigned long jiffy = jiffies;
 
@@ -3302,17 +3302,17 @@ void __init tcp_init(void)
 
         tcp_init_mem(&init_net);
         /* Set per-socket limits to no more than 1/128 the pressure threshold */
-        limit = nr_free_buffer_pages() << (PAGE_SHIFT - 10);
-        limit = max(limit, 128UL);
-        max_share = min(4UL*1024*1024, limit);
+        limit = nr_free_buffer_pages() << (PAGE_SHIFT - 7);
+        max_wshare = min(4UL*1024*1024, limit);
+        max_rshare = min(6UL*1024*1024, limit);
 
         sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_wmem[1] = 16*1024;
-        sysctl_tcp_wmem[2] = max(64*1024, max_share);
+        sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
 
         sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_rmem[1] = 87380;
-        sysctl_tcp_rmem[2] = max(87380, max_share);
+        sysctl_tcp_rmem[2] = max(87380, max_rshare);
 
         pr_info("Hash tables configured (established %u bind %u)\n",
                 tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e886e2f7fa8d..257b61789eeb 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -85,7 +85,7 @@ int sysctl_tcp_ecn __read_mostly = 2;
 EXPORT_SYMBOL(sysctl_tcp_ecn);
 int sysctl_tcp_dsack __read_mostly = 1;
 int sysctl_tcp_app_win __read_mostly = 31;
-int sysctl_tcp_adv_win_scale __read_mostly = 2;
+int sysctl_tcp_adv_win_scale __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 int sysctl_tcp_stdurg __read_mostly;
@@ -335,6 +335,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
                         incr = __tcp_grow_window(sk, skb);
 
                 if (incr) {
+                        incr = max_t(int, incr, 2 * skb->len);
                         tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
                                                tp->window_clamp);
                         inet_csk(sk)->icsk_ack.quick |= 1;
@@ -474,8 +475,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
                 if (!win_dep) {
                         m -= (new_sample >> 3);
                         new_sample += m;
-                } else if (m < new_sample)
-                        new_sample = m << 3;
+                } else {
+                        m <<= 3;
+                        if (m < new_sample)
+                                new_sample = m;
+                }
         } else {
                 /* No previous measure. */
                 new_sample = m << 3;
@@ -491,7 +495,7 @@ static inline void tcp_rcv_rtt_measure(struct tcp_sock *tp)
                 goto new_measure;
         if (before(tp->rcv_nxt, tp->rcv_rtt_est.seq))
                 return;
-        tcp_rcv_rtt_update(tp, jiffies - tp->rcv_rtt_est.time, 1);
+        tcp_rcv_rtt_update(tp, tcp_time_stamp - tp->rcv_rtt_est.time, 1);
 
 new_measure:
         tp->rcv_rtt_est.seq = tp->rcv_nxt + tp->rcv_wnd;
@@ -2864,11 +2868,14 @@ static inline void tcp_complete_cwr(struct sock *sk)
 
         /* Do not moderate cwnd if it's already undone in cwr or recovery. */
         if (tp->undo_marker) {
-                if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR)
+                if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR) {
                         tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
-                else /* PRR */
+                        tp->snd_cwnd_stamp = tcp_time_stamp;
+                } else if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH) {
+                        /* PRR algorithm. */
                         tp->snd_cwnd = tp->snd_ssthresh;
-                tp->snd_cwnd_stamp = tcp_time_stamp;
+                        tp->snd_cwnd_stamp = tcp_time_stamp;
+                }
         }
         tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
 }
@@ -5225,7 +5232,7 @@ static int tcp_dma_try_early_copy(struct sock *sk, struct sk_buff *skb,
                 return 0;
 
         if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                tp->ucopy.dma_chan = net_dma_find_channel();
 
         if (tp->ucopy.dma_chan && skb_csum_unnecessary(skb)) {
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3a25cf743f8b..0cb86ceb652f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1730,7 +1730,7 @@ process:
 #ifdef CONFIG_NET_DMA
                 struct tcp_sock *tp = tcp_sk(sk);
                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                        tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                        tp->ucopy.dma_chan = net_dma_find_channel();
                 if (tp->ucopy.dma_chan)
                         ret = tcp_v4_do_rcv(sk, skb);
                 else
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 364784a91939..7ac6423117ad 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1096,6 +1096,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
         eat = min_t(int, len, skb_headlen(skb));
         if (eat) {
                 __skb_pull(skb, eat);
+                skb->avail_size -= eat;
                 len -= eat;
                 if (!len)
                         return;
@@ -2060,7 +2061,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
                 /* Punt if not enough space exists in the first SKB for
                  * the data in the second
                  */
-                if (skb->len > skb_tailroom(to))
+                if (skb->len > skb_availroom(to))
                         break;
 
                 if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
index 8a949f19deb6..a7f86a3cd502 100644
--- a/net/ipv4/udp_diag.c
+++ b/net/ipv4/udp_diag.c
@@ -146,9 +146,17 @@ static int udp_diag_dump_one(struct sk_buff *in_skb, const struct nlmsghdr *nlh,
         return udp_dump_one(&udp_table, in_skb, nlh, req);
 }
 
+static void udp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
+                void *info)
+{
+        r->idiag_rqueue = sk_rmem_alloc_get(sk);
+        r->idiag_wqueue = sk_wmem_alloc_get(sk);
+}
+
 static const struct inet_diag_handler udp_diag_handler = {
         .dump            = udp_diag_dump,
         .dump_one        = udp_diag_dump_one,
+        .idiag_get_info  = udp_diag_get_info,
         .idiag_type      = IPPROTO_UDP,
 };
 
@@ -167,6 +175,7 @@ static int udplite_diag_dump_one(struct sk_buff *in_skb, const struct nlmsghdr *
 static const struct inet_diag_handler udplite_diag_handler = {
         .dump            = udplite_diag_dump,
         .dump_one        = udplite_diag_dump_one,
+        .idiag_get_info  = udp_diag_get_info,
         .idiag_type      = IPPROTO_UDPLITE,
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 6a3bb6077e19..7d5cb975cc6f 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -803,8 +803,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                                 ip6_del_rt(rt);
                                 rt = NULL;
                         } else if (!(rt->rt6i_flags & RTF_EXPIRES)) {
-                                rt->dst.expires = expires;
-                                rt->rt6i_flags |= RTF_EXPIRES;
+                                rt6_set_expires(rt, expires);
                         }
                 }
                 dst_release(&rt->dst);
@@ -1887,11 +1886,9 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
                                 rt = NULL;
                         } else if (addrconf_finite_timeout(rt_expires)) {
                                 /* not infinity */
-                                rt->dst.expires = jiffies + rt_expires;
-                                rt->rt6i_flags |= RTF_EXPIRES;
+                                rt6_set_expires(rt, jiffies + rt_expires);
                         } else {
-                                rt->rt6i_flags &= ~RTF_EXPIRES;
-                                rt->dst.expires = 0;
+                                rt6_clean_expires(rt);
                         }
                 } else if (valid_lft) {
                         clock_t expires = 0;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 5b27fbcae346..93717435013e 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -673,11 +673,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                                             &rt->rt6i_gateway)) {
                                 if (!(iter->rt6i_flags & RTF_EXPIRES))
                                         return -EEXIST;
-                                iter->dst.expires = rt->dst.expires;
-                                if (!(rt->rt6i_flags & RTF_EXPIRES)) {
-                                        iter->rt6i_flags &= ~RTF_EXPIRES;
-                                        iter->dst.expires = 0;
-                                }
+                                if (!(rt->rt6i_flags & RTF_EXPIRES))
+                                        rt6_clean_expires(iter);
+                                else
+                                        rt6_set_expires(iter, rt->dst.expires);
                                 return -EEXIST;
                         }
                 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 3dcdb81ec3e8..176b469322ac 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1264,8 +1264,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         }
 
         if (rt)
-                rt->dst.expires = jiffies + (HZ * lifetime);
-
+                rt6_set_expires(rt, jiffies + (HZ * lifetime));
         if (ra_msg->icmph.icmp6_hop_limit) {
                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
                 if (rt)
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 94874b0bdcdc..9d4e15559319 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -78,19 +78,6 @@ EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
 
    Hence the start of any table is given by get_table() below.  */
 
-/* Check for an extension */
-int
-ip6t_ext_hdr(u8 nexthdr)
-{
-        return  (nexthdr == IPPROTO_HOPOPTS)   ||
-                (nexthdr == IPPROTO_ROUTING)   ||
-                (nexthdr == IPPROTO_FRAGMENT)  ||
-                (nexthdr == IPPROTO_ESP)       ||
-                (nexthdr == IPPROTO_AH)        ||
-                (nexthdr == IPPROTO_NONE)      ||
-                (nexthdr == IPPROTO_DSTOPTS);
-}
-
 /* Returns whether matches rule or not. */
 /* Performance critical - called for every packet */
 static inline bool
@@ -2366,7 +2353,6 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 EXPORT_SYMBOL(ip6t_register_table);
 EXPORT_SYMBOL(ip6t_unregister_table);
 EXPORT_SYMBOL(ip6t_do_table);
-EXPORT_SYMBOL(ip6t_ext_hdr);
 EXPORT_SYMBOL(ipv6_find_hdr);
 
 module_init(ip6_tables_init);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3992e26a6039..bc4888d902b2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -62,7 +62,7 @@
 #include <linux/sysctl.h>
 #endif
 
-static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
+static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                                     const struct in6_addr *dest);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
@@ -285,6 +285,10 @@ static void ip6_dst_destroy(struct dst_entry *dst)
                 rt->rt6i_idev = NULL;
                 in6_dev_put(idev);
         }
+
+        if (!(rt->rt6i_flags & RTF_EXPIRES) && dst->from)
+                dst_release(dst->from);
+
         if (peer) {
                 rt->rt6i_peer = NULL;
                 inet_putpeer(peer);
@@ -329,8 +333,17 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 
 static __inline__ int rt6_check_expired(const struct rt6_info *rt)
 {
-        return (rt->rt6i_flags & RTF_EXPIRES) &&
-                time_after(jiffies, rt->dst.expires);
+        struct rt6_info *ort = NULL;
+
+        if (rt->rt6i_flags & RTF_EXPIRES) {
+                if (time_after(jiffies, rt->dst.expires))
+                        return 1;
+        } else if (rt->dst.from) {
+                ort = (struct rt6_info *) rt->dst.from;
+                return (ort->rt6i_flags & RTF_EXPIRES) &&
+                        time_after(jiffies, ort->dst.expires);
+        }
+        return 0;
 }
 
 static inline int rt6_need_strict(const struct in6_addr *daddr)
@@ -620,12 +633,11 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
                                  (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
 
         if (rt) {
-                if (!addrconf_finite_timeout(lifetime)) {
-                        rt->rt6i_flags &= ~RTF_EXPIRES;
-                } else {
-                        rt->dst.expires = jiffies + HZ * lifetime;
-                        rt->rt6i_flags |= RTF_EXPIRES;
-                }
+                if (!addrconf_finite_timeout(lifetime))
+                        rt6_clean_expires(rt);
+                else
+                        rt6_set_expires(rt, jiffies + HZ * lifetime);
+
                 dst_release(&rt->dst);
         }
         return 0;
@@ -730,7 +742,7 @@ int ip6_ins_rt(struct rt6_info *rt)
         return __ip6_ins_rt(rt, &info);
 }
 
-static struct rt6_info *rt6_alloc_cow(const struct rt6_info *ort,
+static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
                                       const struct in6_addr *daddr,
                                       const struct in6_addr *saddr)
 {
@@ -954,10 +966,10 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
                 rt->rt6i_idev = ort->rt6i_idev;
                 if (rt->rt6i_idev)
                         in6_dev_hold(rt->rt6i_idev);
-                rt->dst.expires = 0;
 
                 rt->rt6i_gateway = ort->rt6i_gateway;
-                rt->rt6i_flags = ort->rt6i_flags & ~RTF_EXPIRES;
+                rt->rt6i_flags = ort->rt6i_flags;
+                rt6_clean_expires(rt);
                 rt->rt6i_metric = 0;
 
                 memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
@@ -1019,10 +1031,9 @@ static void ip6_link_failure(struct sk_buff *skb)
 
         rt = (struct rt6_info *) skb_dst(skb);
         if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE) {
-                        dst_set_expires(&rt->dst, 0);
-                        rt->rt6i_flags |= RTF_EXPIRES;
-                } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
+                if (rt->rt6i_flags & RTF_CACHE)
+                        rt6_update_expires(rt, 0);
+                else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
                         rt->rt6i_node->fn_sernum = -1;
         }
 }
@@ -1289,9 +1300,12 @@ int ip6_route_add(struct fib6_config *cfg)
         }
 
         rt->dst.obsolete = -1;
-        rt->dst.expires = (cfg->fc_flags & RTF_EXPIRES) ?
-                                jiffies + clock_t_to_jiffies(cfg->fc_expires) :
-                                0;
+
+        if (cfg->fc_flags & RTF_EXPIRES)
+                rt6_set_expires(rt, jiffies +
+                                clock_t_to_jiffies(cfg->fc_expires));
+        else
+                rt6_clean_expires(rt);
 
         if (cfg->fc_protocol == RTPROT_UNSPEC)
                 cfg->fc_protocol = RTPROT_BOOT;
@@ -1736,8 +1750,8 @@ again:
                         features |= RTAX_FEATURE_ALLFRAG;
                         dst_metric_set(&rt->dst, RTAX_FEATURES, features);
                 }
-                dst_set_expires(&rt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
-                rt->rt6i_flags |= RTF_MODIFIED|RTF_EXPIRES;
+                rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
+                rt->rt6i_flags |= RTF_MODIFIED;
                 goto out;
         }
 
@@ -1765,9 +1779,8 @@ again:
                  * which is 10 mins. After 10 mins the decreased pmtu is expired
                  * and detecting PMTU increase will be automatically happened.
                  */
-                dst_set_expires(&nrt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
-                nrt->rt6i_flags |= RTF_DYNAMIC|RTF_EXPIRES;
-
+                rt6_update_expires(nrt, net->ipv6.sysctl.ip6_rt_mtu_expires);
+                nrt->rt6i_flags |= RTF_DYNAMIC;
                 ip6_ins_rt(nrt);
         }
 out:
@@ -1799,7 +1812,7 @@ void rt6_pmtu_discovery(const struct in6_addr *daddr, const struct in6_addr *sad
  *      Misc support functions
  */
 
-static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
+static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                                     const struct in6_addr *dest)
 {
         struct net *net = dev_net(ort->dst.dev);
@@ -1819,10 +1832,14 @@ static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
                 if (rt->rt6i_idev)
                         in6_dev_hold(rt->rt6i_idev);
                 rt->dst.lastuse = jiffies;
-                rt->dst.expires = 0;
 
                 rt->rt6i_gateway = ort->rt6i_gateway;
-                rt->rt6i_flags = ort->rt6i_flags & ~RTF_EXPIRES;
+                rt->rt6i_flags = ort->rt6i_flags;
+                if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
+                    (RTF_DEFAULT | RTF_ADDRCONF))
+                        rt6_set_from(rt, ort);
+                else
+                        rt6_clean_expires(rt);
                 rt->rt6i_metric = 0;
 
 #ifdef CONFIG_IPV6_SUBTREES
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 12c6ece67f39..98256cf72f9d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1383,6 +1383,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
         newtp->advmss = dst_metric_advmss(dst);
+        if (tcp_sk(sk)->rx_opt.user_mss &&
+            tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
+                newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
+
         tcp_initialize_rcv_mss(newsk);
         if (tcp_rsk(req)->snt_synack)
                 tcp_valid_rtt_meas(newsk,
@@ -1645,7 +1649,7 @@ process:
 #ifdef CONFIG_NET_DMA
                 struct tcp_sock *tp = tcp_sk(sk);
                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                        tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                        tp->ucopy.dma_chan = net_dma_find_channel();
                 if (tp->ucopy.dma_chan)
                         ret = tcp_v6_do_rcv(sk, skb);
                 else
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 11dbb2255ccb..7e5d927b576f 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3480,7 +3480,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
 
         /* Addresses to be used by KM for negotiation, if ext is available */
         if (k != NULL && (set_sadb_kmaddress(skb, k) < 0))
-                return -EINVAL;
+                goto err;
 
         /* selector src */
         set_sadb_address(skb, sasize_sel, SADB_EXT_ADDRESS_SRC, sel);
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 55670ec3cd0f..6274f0be82b0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -232,7 +232,7 @@ static void l2tp_ip_close(struct sock *sk, long timeout)
 {
         write_lock_bh(&l2tp_ip_lock);
         hlist_del_init(&sk->sk_bind_node);
-        hlist_del_init(&sk->sk_node);
+        sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip_lock);
         sk_common_release(sk);
 }
@@ -271,7 +271,8 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
             chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
                 goto out;
 
-        inet->inet_rcv_saddr = inet->inet_saddr = addr->l2tp_addr.s_addr;
+        if (addr->l2tp_addr.s_addr)
+                inet->inet_rcv_saddr = inet->inet_saddr = addr->l2tp_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
                 inet->inet_saddr = 0;  /* Use device */
         sk_dst_reset(sk);
@@ -441,8 +442,9 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
 
                 daddr = lip->l2tp_addr.s_addr;
         } else {
+                rc = -EDESTADDRREQ;
                 if (sk->sk_state != TCP_ESTABLISHED)
-                        return -EDESTADDRREQ;
+                        goto out;
 
                 daddr = inet->inet_daddr;
                 connected = 1;
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 33fd8d9f714e..cef7c29214a8 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -457,8 +457,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                          * fall back to HT20 if we don't use or use
                          * the other extension channel
                          */
-                        if ((channel_type == NL80211_CHAN_HT40MINUS ||
-                             channel_type == NL80211_CHAN_HT40PLUS) &&
+                        if (!(channel_type == NL80211_CHAN_HT40MINUS ||
+                              channel_type == NL80211_CHAN_HT40PLUS) ||
                             channel_type != sdata->u.ibss.channel_type)
                                 sta_ht_cap_new.cap &=
                                         ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index d9798a307f20..db8fae51714c 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1210,7 +1210,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                   struct sk_buff *skb);
 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
-void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata);
+void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 401c01f0731e..c20051b7ffcd 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -486,6 +486,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 /* free all potentially still buffered bcast frames */
                 local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps_bc_buf);
                 skb_queue_purge(&sdata->u.ap.ps_bc_buf);
+        } else if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                ieee80211_mgd_stop(sdata);
         }
 
         if (going_down)
@@ -644,8 +646,6 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
 
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 mesh_rmc_free(sdata);
-        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                ieee80211_mgd_teardown(sdata);
 
         flushed = sta_info_flush(local, sdata);
         WARN_ON(flushed);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 576fb25456dd..20c680bfc3ae 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3387,8 +3387,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                  */
                 printk(KERN_DEBUG "%s: waiting for beacon from %pM\n",
                        sdata->name, ifmgd->bssid);
-                assoc_data->timeout = jiffies +
-                                TU_TO_EXP_TIME(req->bss->beacon_interval);
+                assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
         } else {
                 assoc_data->have_beacon = true;
                 assoc_data->sent_assoc = false;
@@ -3498,7 +3497,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata)
+void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bcfe8c77c839..d64e285400aa 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -103,7 +103,7 @@ static void
 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                                  struct sk_buff *skb,
                                  struct ieee80211_rate *rate,
-                                 int rtap_len)
+                                 int rtap_len, bool has_fcs)
 {
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_radiotap_header *rthdr;
@@ -134,7 +134,7 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         }
 
         /* IEEE80211_RADIOTAP_FLAGS */
-        if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
+        if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))
                 *pos |= IEEE80211_RADIOTAP_F_FCS;
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
                 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
@@ -294,7 +294,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         }
 
         /* prepend radiotap information */
-        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
+        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
+                                         true);
 
         skb_reset_mac_header(skb);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -2571,7 +2572,8 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
                 goto out_free_skb;
 
         /* prepend radiotap information */
-        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
+        ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
+                                         false);
 
         skb_set_mac_header(skb, 0);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 782a60198df4..e76facc69e95 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1158,7 +1158,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
                 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
                         return TX_DROP;
-        } else if (info->flags & IEEE80211_TX_CTL_INJECTED) {
+        } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
+                   tx->sdata->control_port_protocol == tx->skb->protocol) {
                 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
         }
         if (!tx->sta)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 2555816e7788..00bdb1d9d690 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1924,6 +1924,7 @@ protocol_fail:
 control_fail:
         ip_vs_estimator_net_cleanup(net);
 estimator_fail:
+        net->ipvs = NULL;
         return -ENOMEM;
 }
 
@@ -1936,6 +1937,7 @@ static void __net_exit __ip_vs_cleanup(struct net *net)
         ip_vs_control_net_cleanup(net);
         ip_vs_estimator_net_cleanup(net);
         IP_VS_DBG(2, "ipvs netns %d released\n", net_ipvs(net)->gen);
+        net->ipvs = NULL;
 }
 
 static void __net_exit __ip_vs_dev_cleanup(struct net *net)
@@ -1993,10 +1995,18 @@ static int __init ip_vs_init(void)
                 goto cleanup_dev;
         }
 
+        ret = ip_vs_register_nl_ioctl();
+        if (ret < 0) {
+                pr_err("can't register netlink/ioctl.\n");
+                goto cleanup_hooks;
+        }
+
         pr_info("ipvs loaded.\n");
 
         return ret;
 
+cleanup_hooks:
+        nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
 cleanup_dev:
         unregister_pernet_device(&ipvs_core_dev_ops);
 cleanup_sub:
@@ -2012,6 +2022,7 @@ exit:
 
 static void __exit ip_vs_cleanup(void)
 {
+        ip_vs_unregister_nl_ioctl();
         nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
         unregister_pernet_device(&ipvs_core_dev_ops);
         unregister_pernet_subsys(&ipvs_core_ops);       /* free ip_vs struct */
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index b3afe189af61..f5589987fc80 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3680,7 +3680,7 @@ int __net_init ip_vs_control_net_init_sysctl(struct net *net)
         return 0;
 }
 
-void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
+void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -3692,7 +3692,7 @@ void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
 #else
 
 int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
-void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net) { }
+void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
 
 #endif
 
@@ -3750,21 +3750,10 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
         free_percpu(ipvs->tot_stats.cpustats);
 }
 
-int __init ip_vs_control_init(void)
+int __init ip_vs_register_nl_ioctl(void)
 {
-        int idx;
         int ret;
 
-        EnterFunction(2);
-
-        /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
-        for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
-                INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
-                INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
-        }
-
-        smp_wmb();      /* Do we really need it now ? */
-
         ret = nf_register_sockopt(&ip_vs_sockopts);
         if (ret) {
                 pr_err("cannot register sockopt.\n");
@@ -3776,28 +3765,47 @@ int __init ip_vs_control_init(void)
                 pr_err("cannot register Generic Netlink interface.\n");
                 goto err_genl;
         }
-
-        ret = register_netdevice_notifier(&ip_vs_dst_notifier);
-        if (ret < 0)
-                goto err_notf;
-
-        LeaveFunction(2);
         return 0;
 
-err_notf:
-        ip_vs_genl_unregister();
 err_genl:
         nf_unregister_sockopt(&ip_vs_sockopts);
 err_sock:
         return ret;
 }
 
+void ip_vs_unregister_nl_ioctl(void)
+{
+        ip_vs_genl_unregister();
+        nf_unregister_sockopt(&ip_vs_sockopts);
+}
+
+int __init ip_vs_control_init(void)
+{
+        int idx;
+        int ret;
+
+        EnterFunction(2);
+
+        /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
+        for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
+                INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
+                INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
+        }
+
+        smp_wmb();      /* Do we really need it now ? */
+
+        ret = register_netdevice_notifier(&ip_vs_dst_notifier);
+        if (ret < 0)
+                return ret;
+
+        LeaveFunction(2);
+        return 0;
+}
+
 
 void ip_vs_control_cleanup(void)
 {
         EnterFunction(2);
         unregister_netdevice_notifier(&ip_vs_dst_notifier);
-        ip_vs_genl_unregister();
-        nf_unregister_sockopt(&ip_vs_sockopts);
         LeaveFunction(2);
 }
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 538d74ee4f68..e39f693dd3e4 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -439,6 +439,8 @@ static int __net_init __ip_vs_ftp_init(struct net *net)
         struct ip_vs_app *app;
         struct netns_ipvs *ipvs = net_ipvs(net);
 
+        if (!ipvs)
+                return -ENOENT;
         app = kmemdup(&ip_vs_ftp, sizeof(struct ip_vs_app), GFP_KERNEL);
         if (!app)
                 return -ENOMEM;
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 0f16283fd058..caa43704e55e 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -551,6 +551,9 @@ static int __net_init __ip_vs_lblc_init(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
+        if (!ipvs)
+                return -ENOENT;
+
         if (!net_eq(net, &init_net)) {
                 ipvs->lblc_ctl_table = kmemdup(vs_vars_table,
                                                 sizeof(vs_vars_table),
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index eec797f8cce7..548bf37aa29e 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -745,6 +745,9 @@ static int __net_init __ip_vs_lblcr_init(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
+        if (!ipvs)
+                return -ENOENT;
+
         if (!net_eq(net, &init_net)) {
                 ipvs->lblcr_ctl_table = kmemdup(vs_vars_table,
                                                 sizeof(vs_vars_table),
diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c
index f843a8833250..ed835e67a07e 100644
--- a/net/netfilter/ipvs/ip_vs_proto.c
+++ b/net/netfilter/ipvs/ip_vs_proto.c
@@ -59,9 +59,6 @@ static int __used __init register_ip_vs_protocol(struct ip_vs_protocol *pp)
         return 0;
 }
 
-#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP) || \
-    defined(CONFIG_IP_VS_PROTO_SCTP) || defined(CONFIG_IP_VS_PROTO_AH) || \
-    defined(CONFIG_IP_VS_PROTO_ESP)
 /*
  *      register an ipvs protocols netns related data
  */
@@ -81,12 +78,18 @@ register_ip_vs_proto_netns(struct net *net, struct ip_vs_protocol *pp)
         ipvs->proto_data_table[hash] = pd;
         atomic_set(&pd->appcnt, 0);     /* Init app counter */
 
-        if (pp->init_netns != NULL)
-                pp->init_netns(net, pd);
+        if (pp->init_netns != NULL) {
+                int ret = pp->init_netns(net, pd);
+                if (ret) {
+                        /* unlink an free proto data */
+                        ipvs->proto_data_table[hash] = pd->next;
+                        kfree(pd);
+                        return ret;
+                }
+        }
 
         return 0;
 }
-#endif
 
 /*
  *      unregister an ipvs protocol
@@ -316,22 +319,35 @@ ip_vs_tcpudp_debug_packet(int af, struct ip_vs_protocol *pp,
  */
 int __net_init ip_vs_protocol_net_init(struct net *net)
 {
+        int i, ret;
+        static struct ip_vs_protocol *protos[] = {
 #ifdef CONFIG_IP_VS_PROTO_TCP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_tcp);
+        &ip_vs_protocol_tcp,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_UDP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_udp);
+        &ip_vs_protocol_udp,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_SCTP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_sctp);
+        &ip_vs_protocol_sctp,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_AH
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_ah);
+        &ip_vs_protocol_ah,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_ESP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_esp);
+        &ip_vs_protocol_esp,
 #endif
+        };
+
+        for (i = 0; i < ARRAY_SIZE(protos); i++) {
+                ret = register_ip_vs_proto_netns(net, protos[i]);
+                if (ret < 0)
+                        goto cleanup;
+        }
         return 0;
+
+cleanup:
+        ip_vs_protocol_net_cleanup(net);
+        return ret;
 }
 
 void __net_exit ip_vs_protocol_net_cleanup(struct net *net)
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 1fbf7a2816f5..9f3fb751c491 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -1090,7 +1090,7 @@ out:
  *   timeouts is netns related now.
  * ---------------------------------------------
  */
-static void __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
+static int __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -1098,6 +1098,9 @@ static void __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
         spin_lock_init(&ipvs->sctp_app_lock);
         pd->timeout_table = ip_vs_create_timeout_table((int *)sctp_timeouts,
                                                         sizeof(sctp_timeouts));
+        if (!pd->timeout_table)
+                return -ENOMEM;
+        return 0;
 }
 
 static void __ip_vs_sctp_exit(struct net *net, struct ip_vs_proto_data *pd)
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index ef8641f7af83..cd609cc62721 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -677,7 +677,7 @@ void ip_vs_tcp_conn_listen(struct net *net, struct ip_vs_conn *cp)
  *   timeouts is netns related now.
  * ---------------------------------------------
  */
-static void __ip_vs_tcp_init(struct net *net, struct ip_vs_proto_data *pd)
+static int __ip_vs_tcp_init(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -685,7 +685,10 @@ static void __ip_vs_tcp_init(struct net *net, struct ip_vs_proto_data *pd)
         spin_lock_init(&ipvs->tcp_app_lock);
         pd->timeout_table = ip_vs_create_timeout_table((int *)tcp_timeouts,
                                                         sizeof(tcp_timeouts));
+        if (!pd->timeout_table)
+                return -ENOMEM;
         pd->tcp_state_table =  tcp_states;
+        return 0;
 }
 
 static void __ip_vs_tcp_exit(struct net *net, struct ip_vs_proto_data *pd)
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index f4b7262896bb..2fedb2dcb3d1 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -467,7 +467,7 @@ udp_state_transition(struct ip_vs_conn *cp, int direction,
         cp->timeout = pd->timeout_table[IP_VS_UDP_S_NORMAL];
 }
 
-static void __udp_init(struct net *net, struct ip_vs_proto_data *pd)
+static int __udp_init(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -475,6 +475,9 @@ static void __udp_init(struct net *net, struct ip_vs_proto_data *pd)
         spin_lock_init(&ipvs->udp_app_lock);
         pd->timeout_table = ip_vs_create_timeout_table((int *)udp_timeouts,
                                                         sizeof(udp_timeouts));
+        if (!pd->timeout_table)
+                return -ENOMEM;
+        return 0;
 }
 
 static void __udp_exit(struct net *net, struct ip_vs_proto_data *pd)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 3cc4487ac349..729f157a0efa 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1592,7 +1592,7 @@ static int nf_conntrack_init_net(struct net *net)
         return 0;
 
 err_timeout:
-        nf_conntrack_timeout_fini(net);
+        nf_conntrack_ecache_fini(net);
 err_ecache:
         nf_conntrack_tstamp_fini(net);
 err_tstamp:
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 361eade62a09..0d07a1dcf605 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -584,8 +584,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
                          * Let's try to use the data from the packet.
                          */
                         sender->td_end = end;
-                        win <<= sender->td_scale;
-                        sender->td_maxwin = (win == 0 ? 1 : win);
+                        swin = win << sender->td_scale;
+                        sender->td_maxwin = (swin == 0 ? 1 : swin);
                         sender->td_maxend = end + sender->td_maxwin;
                         /*
                          * We haven't seen traffic in the other direction yet
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 59530e93fa58..3746d8b9a478 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -227,7 +227,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
         }
 
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-        if (info->timeout) {
+        if (info->timeout[0]) {
                 typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
                 struct nf_conn_timeout *timeout_ext;
 
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index 7b76eb7192f3..ef10ffcb4b6f 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -474,7 +474,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         while (remaining_len > 0) {
 
-                frag_len = min_t(u16, local->remote_miu, remaining_len);
+                frag_len = min_t(size_t, local->remote_miu, remaining_len);
 
                 pr_debug("Fragment %zd bytes remaining %zd",
                          frag_len, remaining_len);
@@ -497,7 +497,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
                 release_sock(sk);
 
                 remaining_len -= frag_len;
-                msg_ptr += len;
+                msg_ptr += frag_len;
         }
 
         kfree(msg_data);
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 9b9a85ecc4c7..bf5cf69c820a 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -331,23 +331,6 @@ static int __net_init phonet_init_net(struct net *net)
 
 static void __net_exit phonet_exit_net(struct net *net)
 {
-        struct phonet_net *pnn = phonet_pernet(net);
-        struct net_device *dev;
-        unsigned i;
-
-        rtnl_lock();
-        for_each_netdev(net, dev)
-                phonet_device_destroy(dev);
-
-        for (i = 0; i < 64; i++) {
-                dev = pnn->routes.table[i];
-                if (dev) {
-                        rtm_phonet_notify(RTM_DELROUTE, dev, i);
-                        dev_put(dev);
-                }
-        }
-        rtnl_unlock();
-
         proc_net_remove(net, "phonet");
 }
 
@@ -361,7 +344,7 @@ static struct pernet_operations phonet_net_ops = {
 /* Initialize Phonet devices list */
 int __init phonet_device_init(void)
 {
-        int err = register_pernet_device(&phonet_net_ops);
+        int err = register_pernet_subsys(&phonet_net_ops);
         if (err)
                 return err;
 
@@ -377,7 +360,7 @@ void phonet_device_exit(void)
 {
         rtnl_unregister_all(PF_PHONET);
         unregister_netdevice_notifier(&phonet_device_notifier);
-        unregister_pernet_device(&phonet_net_ops);
+        unregister_pernet_subsys(&phonet_net_ops);
         proc_net_remove(&init_net, "pnresource");
 }
 
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 0b15236be7b6..8179494c269a 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -565,11 +565,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
                 opt.packets     = q->packetsin;
                 opt.bytesin     = q->bytesin;
 
-                if (gred_wred_mode(table)) {
-                        q->vars.qidlestart =
-                                table->tab[table->def]->vars.qidlestart;
-                        q->vars.qavg = table->tab[table->def]->vars.qavg;
-                }
+                if (gred_wred_mode(table))
+                        gred_load_wred_set(table, q);
 
                 opt.qave = red_calc_qavg(&q->parms, &q->vars, q->vars.qavg);
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 5da548fa7ae9..ebd22966f748 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -408,10 +408,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
                 if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
                     (skb->ip_summed == CHECKSUM_PARTIAL &&
-                     skb_checksum_help(skb))) {
-                        sch->qstats.drops++;
-                        return NET_XMIT_DROP;
-                }
+                     skb_checksum_help(skb)))
+                        return qdisc_drop(skb, sch);
 
                 skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
         }
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 67972462a543..adf2990acebf 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -176,16 +176,22 @@ rpc_setup_pipedir(struct rpc_clnt *clnt, const char *dir_name)
         return 0;
 }
 
-static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
-                                struct super_block *sb)
+static inline int rpc_clnt_skip_event(struct rpc_clnt *clnt, unsigned long event)
+{
+        if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) ||
+            ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry))
+                return 1;
+        return 0;
+}
+
+static int __rpc_clnt_handle_event(struct rpc_clnt *clnt, unsigned long event,
+                                   struct super_block *sb)
 {
         struct dentry *dentry;
         int err = 0;
 
         switch (event) {
         case RPC_PIPEFS_MOUNT:
-                if (clnt->cl_program->pipe_dir_name == NULL)
-                        break;
                 dentry = rpc_setup_pipedir_sb(sb, clnt,
                                               clnt->cl_program->pipe_dir_name);
                 BUG_ON(dentry == NULL);
@@ -208,6 +214,20 @@ static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
         return err;
 }
 
+static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
+                                struct super_block *sb)
+{
+        int error = 0;
+
+        for (;; clnt = clnt->cl_parent) {
+                if (!rpc_clnt_skip_event(clnt, event))
+                        error = __rpc_clnt_handle_event(clnt, event, sb);
+                if (error || clnt == clnt->cl_parent)
+                        break;
+        }
+        return error;
+}
+
 static struct rpc_clnt *rpc_get_client_for_event(struct net *net, int event)
 {
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
@@ -215,10 +235,12 @@ static struct rpc_clnt *rpc_get_client_for_event(struct net *net, int event)
 
         spin_lock(&sn->rpc_client_lock);
         list_for_each_entry(clnt, &sn->all_clients, cl_clients) {
-                if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) ||
-                    ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry))
+                if (clnt->cl_program->pipe_dir_name == NULL)
+                        break;
+                if (rpc_clnt_skip_event(clnt, event))
+                        continue;
+                if (atomic_inc_not_zero(&clnt->cl_count) == 0)
                         continue;
-                atomic_inc(&clnt->cl_count);
                 spin_unlock(&sn->rpc_client_lock);
                 return clnt;
         }
@@ -257,6 +279,14 @@ void rpc_clients_notifier_unregister(void)
         return rpc_pipefs_notifier_unregister(&rpc_clients_block);
 }
 
+static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
+{
+        clnt->cl_nodelen = strlen(nodename);
+        if (clnt->cl_nodelen > UNX_MAXNODENAME)
+                clnt->cl_nodelen = UNX_MAXNODENAME;
+        memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen);
+}
+
 static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, struct rpc_xprt *xprt)
 {
         const struct rpc_program *program = args->program;
@@ -337,10 +367,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
         }
 
         /* save the nodename */
-        clnt->cl_nodelen = strlen(init_utsname()->nodename);
-        if (clnt->cl_nodelen > UNX_MAXNODENAME)
-                clnt->cl_nodelen = UNX_MAXNODENAME;
-        memcpy(clnt->cl_nodename, init_utsname()->nodename, clnt->cl_nodelen);
+        rpc_clnt_set_nodename(clnt, utsname()->nodename);
         rpc_register_client(clnt);
         return clnt;
 
@@ -499,6 +526,7 @@ rpc_clone_client(struct rpc_clnt *clnt)
         err = rpc_setup_pipedir(new, clnt->cl_program->pipe_dir_name);
         if (err != 0)
                 goto out_no_path;
+        rpc_clnt_set_nodename(new, utsname()->nodename);
         if (new->cl_auth)
                 atomic_inc(&new->cl_auth->au_count);
         atomic_inc(&clnt->cl_count);
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 0af37fc46818..3b62cf288031 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -1126,19 +1126,20 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
                 return -ENOMEM;
         dprintk("RPC:   sending pipefs MOUNT notification for net %p%s\n", net,
                                                                 NET_NAME(net));
+        sn->pipefs_sb = sb;
         err = blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                            RPC_PIPEFS_MOUNT,
                                            sb);
         if (err)
                 goto err_depopulate;
         sb->s_fs_info = get_net(net);
-        sn->pipefs_sb = sb;
         return 0;
 
 err_depopulate:
         blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                            RPC_PIPEFS_UMOUNT,
                                            sb);
+        sn->pipefs_sb = NULL;
         __rpc_depopulate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF);
         return err;
 }
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index 8adfc88e793a..3d6498af9adc 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -75,20 +75,21 @@ static struct pernet_operations sunrpc_net_ops = {
 static int __init
 init_sunrpc(void)
 {
-        int err = register_rpc_pipefs();
+        int err = rpc_init_mempool();
         if (err)
                 goto out;
-        err = rpc_init_mempool();
-        if (err)
-                goto out2;
         err = rpcauth_init_module();
         if (err)
-                goto out3;
+                goto out2;
 
         cache_initialize();
 
         err = register_pernet_subsys(&sunrpc_net_ops);
         if (err)
+                goto out3;
+
+        err = register_rpc_pipefs();
+        if (err)
                 goto out4;
 #ifdef RPC_DEBUG
         rpc_register_sysctl();
@@ -98,11 +99,11 @@ init_sunrpc(void)
         return 0;
 
 out4:
-        rpcauth_remove_module();
+        unregister_pernet_subsys(&sunrpc_net_ops);
 out3:
-        rpc_destroy_mempool();
+        rpcauth_remove_module();
 out2:
-        unregister_rpc_pipefs();
+        rpc_destroy_mempool();
 out:
         return err;
 }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e49da2797022..f432c57af05d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1294,6 +1294,11 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         goto bad_res;
                 }
 
+                if (!netif_running(netdev)) {
+                        result = -ENETDOWN;
+                        goto bad_res;
+                }
+
                 nla_for_each_nested(nl_txq_params,
                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
                                     rem_txq_params) {
@@ -6384,7 +6389,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_get_key,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6416,7 +6421,7 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
                 .doit = nl80211_set_beacon,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6424,7 +6429,7 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
                 .doit = nl80211_start_ap,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6432,7 +6437,7 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
                 .doit = nl80211_stop_ap,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6448,7 +6453,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_station,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6464,7 +6469,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_del_station,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6497,7 +6502,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_del_mpath,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6505,7 +6510,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_bss,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6531,7 +6536,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_get_mesh_config,
                 .policy = nl80211_policy,
                 /* can be retrieved by unprivileged users */
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6664,7 +6669,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_setdel_pmksa,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6672,7 +6677,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_setdel_pmksa,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6680,7 +6685,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_flush_pmksa,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
@@ -6840,7 +6845,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_probe_client,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
         {
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 1b7a08df933c..957f25621617 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -989,7 +989,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                         if (rdev->wiphy.software_iftypes & BIT(iftype))
                                 continue;
                         for (j = 0; j < c->n_limits; j++) {
-                                if (!(limits[j].types & iftype))
+                                if (!(limits[j].types & BIT(iftype)))
                                         continue;
                                 if (limits[j].max < num[iftype])
                                         goto cont;
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 0af7f54e4f61..af648e08e61b 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -780,8 +780,10 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                 if (cmd == SIOCSIWENCODEEXT) {
                         struct iw_encode_ext *ee = (void *) extra;
 
-                        if (iwp->length < sizeof(*ee) + ee->key_len)
-                                return -EFAULT;
+                        if (iwp->length < sizeof(*ee) + ee->key_len) {
+                                err = -EFAULT;
+                                goto out;
+                        }
                 }
         }
 
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index de639eeeed50..faea0ec612bf 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1869,12 +1869,6 @@ sub process {
                             "No space is necessary after a cast\n" . $hereprev);
                 }
 
-                if ($rawline =~ /^\+[ \t]*\/\*[ \t]*$/ &&
-                    $prevrawline =~ /^\+[ \t]*$/) {
-                        CHK("BLOCK_COMMENT_STYLE",
-                            "Don't begin block comments with only a /* line, use /* comment...\n" . $hereprev);
-                }
-
 # check for spaces at the beginning of a line.
 # Exceptions:
 #  1) within comments
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index 0586085136d1..52577f052bc1 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -540,35 +540,6 @@ static struct conf_printer header_printer_cb =
 };
 
 /*
- * Generate the __enabled_CONFIG_* and __enabled_CONFIG_*_MODULE macros for
- * use by the IS_{ENABLED,BUILTIN,MODULE} macros. The _MODULE variant is
- * generated even for booleans so that the IS_ENABLED() macro works.
- */
-static void
-header_print__enabled_symbol(FILE *fp, struct symbol *sym, const char *value, void *arg)
-{
-
-        switch (sym->type) {
-        case S_BOOLEAN:
-        case S_TRISTATE: {
-                fprintf(fp, "#define __enabled_" CONFIG_ "%s %d\n",
-                    sym->name, (*value == 'y'));
-                fprintf(fp, "#define __enabled_" CONFIG_ "%s_MODULE %d\n",
-                    sym->name, (*value == 'm'));
-                break;
-        }
-        default:
-                break;
-        }
-}
-
-static struct conf_printer header__enabled_printer_cb =
-{
-        .print_symbol = header_print__enabled_symbol,
-        .print_comment = header_print_comment,
-};
-
-/*
  * Tristate printer
  *
  * This printer is used when generating the `include/config/tristate.conf' file.
@@ -949,16 +920,11 @@ int conf_write_autoconf(void)
         conf_write_heading(out_h, &header_printer_cb, NULL);
 
         for_all_symbols(i, sym) {
-                if (!sym->name)
-                        continue;
-
                 sym_calc_value(sym);
-
-                conf_write_symbol(out_h, sym, &header__enabled_printer_cb, NULL);
-
-                if (!(sym->flags & SYMBOL_WRITE))
+                if (!(sym->flags & SYMBOL_WRITE) || !sym->name)
                         continue;
 
+                /* write symbol to auto.conf, tristate and header files */
                 conf_write_symbol(out, sym, &kconfig_printer_cb, (void *)1);
 
                 conf_write_symbol(tristate, sym, &tristate_printer_cb, (void *)1);
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 8e730ccc3f2b..44ddaa542db6 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -1100,6 +1100,10 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
         if (!sym->st_shndx || get_secindex(info, sym) >= info->num_sections)
                 return;
 
+        /* We're looking for an object */
+        if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT)
+                return;
+
         /* All our symbols are of form <prefix>__mod_XXX_device_table. */
         name = strstr(symname, "__mod_");
         if (!name)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 3f01fd908730..c4e7d1510f9d 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -132,8 +132,10 @@ static struct module *new_module(char *modname)
         /* strip trailing .o */
         s = strrchr(p, '.');
         if (s != NULL)
-                if (strcmp(s, ".o") == 0)
+                if (strcmp(s, ".o") == 0) {
                         *s = '\0';
+                        mod->is_dot_o = 1;
+                }
 
         /* add to list */
         mod->name = p;
@@ -587,7 +589,8 @@ static void handle_modversions(struct module *mod, struct elf_info *info,
         unsigned int crc;
         enum export export;
 
-        if (!is_vmlinux(mod->name) && strncmp(symname, "__ksymtab", 9) == 0)
+        if ((!is_vmlinux(mod->name) || mod->is_dot_o) &&
+            strncmp(symname, "__ksymtab", 9) == 0)
                 export = export_from_secname(info, get_secindex(info, sym));
         else
                 export = export_from_sec(info, get_secindex(info, sym));
diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
index 2031119080dc..51207e4d5f8b 100644
--- a/scripts/mod/modpost.h
+++ b/scripts/mod/modpost.h
@@ -113,6 +113,7 @@ struct module {
         int has_cleanup;
         struct buffer dev_table_buf;
         char         srcversion[25];
+        int is_dot_o;
 };
 
 struct elf_info {
diff --git a/scripts/xz_wrap.sh b/scripts/xz_wrap.sh
index 17a5798c29da..7a2d372f4885 100644
--- a/scripts/xz_wrap.sh
+++ b/scripts/xz_wrap.sh
@@ -12,8 +12,8 @@
 BCJ=
 LZMA2OPTS=
 
-case $ARCH in
-        x86|x86_64)     BCJ=--x86 ;;
+case $SRCARCH in
+        x86)            BCJ=--x86 ;;
         powerpc)        BCJ=--powerpc ;;
         ia64)           BCJ=--ia64; LZMA2OPTS=pb=4 ;;
         arm)            BCJ=--arm ;;
diff --git a/security/commoncap.c b/security/commoncap.c
index 0cf4b53480a7..71a166a05975 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -29,6 +29,7 @@
 #include <linux/securebits.h>
 #include <linux/user_namespace.h>
 #include <linux/binfmts.h>
+#include <linux/personality.h>
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -505,6 +506,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
         }
 skip:
 
+        /* if we have fs caps, clear dangerous personality flags */
+        if (!cap_issubset(new->cap_permitted, old->cap_permitted))
+                bprm->per_clear |= PER_CLEAR_ON_SETID;
+
+
         /* Don't let someone trace a set[ug]id/setpcap binary with the revised
          * credentials unless they have the appropriate permit
          */
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 81c03a597112..45c32f074166 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1939,18 +1939,19 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
         char *hostsp;
         struct socket_smack *ssp = sk->sk_security;
         struct smk_audit_info ad;
-        struct lsm_network_audit net;
 
         rcu_read_lock();
         hostsp = smack_host_label(sap);
         if (hostsp != NULL) {
-                sk_lbl = SMACK_UNLABELED_SOCKET;
 #ifdef CONFIG_AUDIT
+                struct lsm_network_audit net;
+
                 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
                 ad.a.u.net->family = sap->sin_family;
                 ad.a.u.net->dport = sap->sin_port;
                 ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr;
 #endif
+                sk_lbl = SMACK_UNLABELED_SOCKET;
                 rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE, &ad);
         } else {
                 sk_lbl = SMACK_CIPSO_SOCKET;
@@ -2809,11 +2810,14 @@ static int smack_unix_stream_connect(struct sock *sock,
         struct socket_smack *osp = other->sk_security;
         struct socket_smack *nsp = newsk->sk_security;
         struct smk_audit_info ad;
-        struct lsm_network_audit net;
         int rc = 0;
 
+#ifdef CONFIG_AUDIT
+        struct lsm_network_audit net;
+
         smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
         smk_ad_setfield_u_net_sk(&ad, other);
+#endif
 
         if (!capable(CAP_MAC_OVERRIDE))
                 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
@@ -2842,11 +2846,14 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other)
         struct socket_smack *ssp = sock->sk->sk_security;
         struct socket_smack *osp = other->sk->sk_security;
         struct smk_audit_info ad;
-        struct lsm_network_audit net;
         int rc = 0;
 
+#ifdef CONFIG_AUDIT
+        struct lsm_network_audit net;
+
         smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
         smk_ad_setfield_u_net_sk(&ad, other->sk);
+#endif
 
         if (!capable(CAP_MAC_OVERRIDE))
                 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
@@ -2993,7 +3000,9 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         char *csp;
         int rc;
         struct smk_audit_info ad;
+#ifdef CONFIG_AUDIT
         struct lsm_network_audit net;
+#endif
         if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
                 return 0;
 
@@ -3156,7 +3165,9 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         char *sp;
         int rc;
         struct smk_audit_info ad;
+#ifdef CONFIG_AUDIT
         struct lsm_network_audit net;
+#endif
 
         /* handle mapped IPv4 packets arriving via IPv6 sockets */
         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
@@ -3629,8 +3640,38 @@ struct security_operations smack_ops = {
 };
 
 
-static __init void init_smack_know_list(void)
+static __init void init_smack_known_list(void)
 {
+        /*
+         * Initialize CIPSO locks
+         */
+        spin_lock_init(&smack_known_huh.smk_cipsolock);
+        spin_lock_init(&smack_known_hat.smk_cipsolock);
+        spin_lock_init(&smack_known_star.smk_cipsolock);
+        spin_lock_init(&smack_known_floor.smk_cipsolock);
+        spin_lock_init(&smack_known_invalid.smk_cipsolock);
+        spin_lock_init(&smack_known_web.smk_cipsolock);
+        /*
+         * Initialize rule list locks
+         */
+        mutex_init(&smack_known_huh.smk_rules_lock);
+        mutex_init(&smack_known_hat.smk_rules_lock);
+        mutex_init(&smack_known_floor.smk_rules_lock);
+        mutex_init(&smack_known_star.smk_rules_lock);
+        mutex_init(&smack_known_invalid.smk_rules_lock);
+        mutex_init(&smack_known_web.smk_rules_lock);
+        /*
+         * Initialize rule lists
+         */
+        INIT_LIST_HEAD(&smack_known_huh.smk_rules);
+        INIT_LIST_HEAD(&smack_known_hat.smk_rules);
+        INIT_LIST_HEAD(&smack_known_star.smk_rules);
+        INIT_LIST_HEAD(&smack_known_floor.smk_rules);
+        INIT_LIST_HEAD(&smack_known_invalid.smk_rules);
+        INIT_LIST_HEAD(&smack_known_web.smk_rules);
+        /*
+         * Create the known labels list
+         */
         list_add(&smack_known_huh.list, &smack_known_list);
         list_add(&smack_known_hat.list, &smack_known_list);
         list_add(&smack_known_star.list, &smack_known_list);
@@ -3665,16 +3706,8 @@ static __init int smack_init(void)
         cred = (struct cred *) current->cred;
         cred->security = tsp;
 
-        /* initialize the smack_know_list */
-        init_smack_know_list();
-        /*
-         * Initialize locks
-         */
-        spin_lock_init(&smack_known_huh.smk_cipsolock);
-        spin_lock_init(&smack_known_hat.smk_cipsolock);
-        spin_lock_init(&smack_known_star.smk_cipsolock);
-        spin_lock_init(&smack_known_floor.smk_cipsolock);
-        spin_lock_init(&smack_known_invalid.smk_cipsolock);
+        /* initialize the smack_known_list */
+        init_smack_known_list();
 
         /*
          * Register with LSM
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 5c32f36ff706..038811cb7e62 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -1614,20 +1614,6 @@ static int __init init_smk_fs(void)
         smk_cipso_doi();
         smk_unlbl_ambient(NULL);
 
-        mutex_init(&smack_known_floor.smk_rules_lock);
-        mutex_init(&smack_known_hat.smk_rules_lock);
-        mutex_init(&smack_known_huh.smk_rules_lock);
-        mutex_init(&smack_known_invalid.smk_rules_lock);
-        mutex_init(&smack_known_star.smk_rules_lock);
-        mutex_init(&smack_known_web.smk_rules_lock);
-
-        INIT_LIST_HEAD(&smack_known_floor.smk_rules);
-        INIT_LIST_HEAD(&smack_known_hat.smk_rules);
-        INIT_LIST_HEAD(&smack_known_huh.smk_rules);
-        INIT_LIST_HEAD(&smack_known_invalid.smk_rules);
-        INIT_LIST_HEAD(&smack_known_star.smk_rules);
-        INIT_LIST_HEAD(&smack_known_web.smk_rules);
-
         return err;
 }
 
diff --git a/sound/core/vmaster.c b/sound/core/vmaster.c
index 14a286a7bf2b..857586135d18 100644
--- a/sound/core/vmaster.c
+++ b/sound/core/vmaster.c
@@ -419,6 +419,7 @@ EXPORT_SYMBOL(snd_ctl_make_virtual_master);
  * snd_ctl_add_vmaster_hook - Add a hook to a vmaster control
  * @kcontrol: vmaster kctl element
  * @hook: the hook function
+ * @private_data: the private_data pointer to be saved
  *
  * Adds the given hook to the vmaster control element so that it's called
  * at each time when the value is changed.
diff --git a/sound/isa/sscape.c b/sound/isa/sscape.c
index b4a6aa960f4b..8490f59709bb 100644
--- a/sound/isa/sscape.c
+++ b/sound/isa/sscape.c
@@ -1019,13 +1019,15 @@ static int __devinit create_sscape(int dev, struct snd_card *card)
         irq_cfg = get_irq_config(sscape->type, irq[dev]);
         if (irq_cfg == INVALID_IRQ) {
                 snd_printk(KERN_ERR "sscape: Invalid IRQ %d\n", irq[dev]);
-                return -ENXIO;
+                err = -ENXIO;
+                goto _release_dma;
         }
 
         mpu_irq_cfg = get_irq_config(sscape->type, mpu_irq[dev]);
         if (mpu_irq_cfg == INVALID_IRQ) {
                 snd_printk(KERN_ERR "sscape: Invalid IRQ %d\n", mpu_irq[dev]);
-                return -ENXIO;
+                err = -ENXIO;
+                goto _release_dma;
         }
 
         /*
diff --git a/sound/last.c b/sound/last.c
index bdd0857b8871..7ffc182e0844 100644
--- a/sound/last.c
+++ b/sound/last.c
@@ -38,4 +38,4 @@ static int __init alsa_sound_last_init(void)
         return 0;
 }
 
-__initcall(alsa_sound_last_init);
+late_initcall_sync(alsa_sound_last_init);
diff --git a/sound/oss/msnd_pinnacle.c b/sound/oss/msnd_pinnacle.c
index 2c79d60a725f..536c4c0514d3 100644
--- a/sound/oss/msnd_pinnacle.c
+++ b/sound/oss/msnd_pinnacle.c
@@ -1294,6 +1294,8 @@ static int __init calibrate_adc(WORD srate)
 
 static int upload_dsp_code(void)
 {
+        int ret = 0;
+
         msnd_outb(HPBLKSEL_0, dev.io + HP_BLKS);
 #ifndef HAVE_DSPCODEH
         INITCODESIZE = mod_firmware_load(INITCODEFILE, &INITCODE);
@@ -1312,7 +1314,8 @@ static int upload_dsp_code(void)
         memcpy_toio(dev.base, PERMCODE, PERMCODESIZE);
         if (msnd_upload_host(&dev, INITCODE, INITCODESIZE) < 0) {
                 printk(KERN_WARNING LOGNAME ": Error uploading to DSP\n");
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out;
         }
 #ifdef HAVE_DSPCODEH
         printk(KERN_INFO LOGNAME ": DSP firmware uploaded (resident)\n");
@@ -1320,12 +1323,13 @@ static int upload_dsp_code(void)
         printk(KERN_INFO LOGNAME ": DSP firmware uploaded\n");
 #endif
 
+out:
 #ifndef HAVE_DSPCODEH
         vfree(INITCODE);
         vfree(PERMCODE);
 #endif
 
-        return 0;
+        return ret;
 }
 
 #ifdef MSND_CLASSIC
diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
index 88168044375f..5ca0939e4223 100644
--- a/sound/pci/Kconfig
+++ b/sound/pci/Kconfig
@@ -2,8 +2,8 @@
 
 config SND_TEA575X
         tristate
-        depends on SND_FM801_TEA575X_BOOL || SND_ES1968_RADIO || RADIO_SF16FMR2
-        default SND_FM801 || SND_ES1968 || RADIO_SF16FMR2
+        depends on SND_FM801_TEA575X_BOOL || SND_ES1968_RADIO || RADIO_SF16FMR2 || RADIO_MAXIRADIO
+        default SND_FM801 || SND_ES1968 || RADIO_SF16FMR2 || RADIO_MAXIRADIO
 
 menuconfig SND_PCI
         bool "PCI sound devices"
diff --git a/sound/pci/asihpi/hpi_internal.h b/sound/pci/asihpi/hpi_internal.h
index 8c63200cf339..bc86cb726d79 100644
--- a/sound/pci/asihpi/hpi_internal.h
+++ b/sound/pci/asihpi/hpi_internal.h
@@ -1,7 +1,7 @@
 /******************************************************************************
 
     AudioScience HPI driver
-    Copyright (C) 1997-2011  AudioScience Inc. <support@audioscience.com>
+    Copyright (C) 1997-2012  AudioScience Inc. <support@audioscience.com>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of version 2 of the GNU General Public License as
@@ -42,7 +42,7 @@ On error *pLockedMemHandle marked invalid, non-zero returned.
 If this function succeeds, then HpiOs_LockedMem_GetVirtAddr() and
 HpiOs_LockedMem_GetPyhsAddr() will always succed on the returned handle.
 */
-int hpios_locked_mem_alloc(struct consistent_dma_area *p_locked_mem_handle,
+u16 hpios_locked_mem_alloc(struct consistent_dma_area *p_locked_mem_handle,
                                                            /**< memory handle */
         u32 size, /**< Size in bytes to allocate */
         struct pci_dev *p_os_reference
diff --git a/sound/pci/asihpi/hpios.c b/sound/pci/asihpi/hpios.c
index 87f4385fe8c7..5ef4fe964366 100644
--- a/sound/pci/asihpi/hpios.c
+++ b/sound/pci/asihpi/hpios.c
@@ -1,7 +1,7 @@
 /******************************************************************************
 
     AudioScience HPI driver
-    Copyright (C) 1997-2011  AudioScience Inc. <support@audioscience.com>
+    Copyright (C) 1997-2012  AudioScience Inc. <support@audioscience.com>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of version 2 of the GNU General Public License as
@@ -39,11 +39,11 @@ void hpios_delay_micro_seconds(u32 num_micro_sec)
 
 }
 
-/** Allocated an area of locked memory for bus master DMA operations.
+/** Allocate an area of locked memory for bus master DMA operations.
 
-On error, return -ENOMEM, and *pMemArea.size = 0
+If allocation fails, return 1, and *pMemArea.size = 0
 */
-int hpios_locked_mem_alloc(struct consistent_dma_area *p_mem_area, u32 size,
+u16 hpios_locked_mem_alloc(struct consistent_dma_area *p_mem_area, u32 size,
         struct pci_dev *pdev)
 {
         /*?? any benefit in using managed dmam_alloc_coherent? */
@@ -62,7 +62,7 @@ int hpios_locked_mem_alloc(struct consistent_dma_area *p_mem_area, u32 size,
                 HPI_DEBUG_LOG(WARNING,
                         "failed to allocate %d bytes locked memory\n", size);
                 p_mem_area->size = 0;
-                return -ENOMEM;
+                return 1;
         }
 }
 
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 9a9f372e1be4..56b4f74c0b13 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -851,6 +851,9 @@ struct hda_codec {
         unsigned int pin_amp_workaround:1; /* pin out-amp takes index
                                             * (e.g. Conexant codecs)
                                             */
+        unsigned int single_adc_amp:1; /* adc in-amp takes no index
+                                        * (e.g. CX20549 codec)
+                                        */
         unsigned int no_sticky_stream:1; /* no sticky-PCM stream assignment */
         unsigned int pins_shutup:1;     /* pins are shut up */
         unsigned int no_trigger_sense:1; /* don't trigger at pin-sensing */
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index b58b4b1687fa..4c054f4486b9 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -418,7 +418,7 @@ static void hdmi_show_short_audio_desc(struct cea_sad *a)
         else
                 buf2[0] = '\0';
 
-        printk(KERN_INFO "HDMI: supports coding type %s:"
+        _snd_printd(SND_PR_VERBOSE, "HDMI: supports coding type %s:"
                         " channels = %d, rates =%s%s\n",
                         cea_audio_coding_type_names[a->format],
                         a->channels,
@@ -442,14 +442,14 @@ void snd_hdmi_show_eld(struct hdmi_eld *e)
 {
         int i;
 
-        printk(KERN_INFO "HDMI: detected monitor %s at connection type %s\n",
+        _snd_printd(SND_PR_VERBOSE, "HDMI: detected monitor %s at connection type %s\n",
                         e->monitor_name,
                         eld_connection_type_names[e->conn_type]);
 
         if (e->spk_alloc) {
                 char buf[SND_PRINT_CHANNEL_ALLOCATION_ADVISED_BUFSIZE];
                 snd_print_channel_allocation(e->spk_alloc, buf, sizeof(buf));
-                printk(KERN_INFO "HDMI: available speakers:%s\n", buf);
+                _snd_printd(SND_PR_VERBOSE, "HDMI: available speakers:%s\n", buf);
         }
 
         for (i = 0; i < e->sad_count; i++)
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index 254ab5204603..e59e2f059b6e 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -651,9 +651,16 @@ static void print_codec_info(struct snd_info_entry *entry,
                         snd_iprintf(buffer, "  Amp-In caps: ");
                         print_amp_caps(buffer, codec, nid, HDA_INPUT);
                         snd_iprintf(buffer, "  Amp-In vals: ");
-                        print_amp_vals(buffer, codec, nid, HDA_INPUT,
-                                       wid_caps & AC_WCAP_STEREO,
-                                       wid_type == AC_WID_PIN ? 1 : conn_len);
+                        if (wid_type == AC_WID_PIN ||
+                            (codec->single_adc_amp &&
+                             wid_type == AC_WID_AUD_IN))
+                                print_amp_vals(buffer, codec, nid, HDA_INPUT,
+                                               wid_caps & AC_WCAP_STEREO,
+                                               1);
+                        else
+                                print_amp_vals(buffer, codec, nid, HDA_INPUT,
+                                               wid_caps & AC_WCAP_STEREO,
+                                               conn_len);
                 }
                 if (wid_caps & AC_WCAP_OUT_AMP) {
                         snd_iprintf(buffer, "  Amp-Out caps: ");
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 8c6523bbc797..d906c5b74cf0 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -141,7 +141,6 @@ struct conexant_spec {
         unsigned int hp_laptop:1;
         unsigned int asus:1;
         unsigned int pin_eapd_ctrls:1;
-        unsigned int single_adc_amp:1;
 
         unsigned int adc_switching:1;
 
@@ -687,27 +686,26 @@ static const struct hda_channel_mode cxt5045_modes[1] = {
 static const struct hda_input_mux cxt5045_capture_source = {
         .num_items = 2,
         .items = {
-                { "IntMic", 0x1 },
-                { "ExtMic", 0x2 },
+                { "Internal Mic", 0x1 },
+                { "Mic",          0x2 },
         }
 };
 
 static const struct hda_input_mux cxt5045_capture_source_benq = {
-        .num_items = 5,
+        .num_items = 4,
         .items = {
-                { "IntMic", 0x1 },
-                { "ExtMic", 0x2 },
-                { "LineIn", 0x3 },
-                { "CD",     0x4 },
-                { "Mixer",  0x0 },
+                { "Internal Mic", 0x1 },
+                { "Mic",          0x2 },
+                { "Line",         0x3 },
+                { "Mixer",        0x0 },
         }
 };
 
 static const struct hda_input_mux cxt5045_capture_source_hp530 = {
         .num_items = 2,
         .items = {
-                { "ExtMic", 0x1 },
-                { "IntMic", 0x2 },
+                { "Mic",          0x1 },
+                { "Internal Mic", 0x2 },
         }
 };
 
@@ -798,10 +796,8 @@ static void cxt5045_hp_unsol_event(struct hda_codec *codec,
 }
 
 static const struct snd_kcontrol_new cxt5045_mixers[] = {
-        HDA_CODEC_VOLUME("Internal Mic Capture Volume", 0x1a, 0x01, HDA_INPUT),
-        HDA_CODEC_MUTE("Internal Mic Capture Switch", 0x1a, 0x01, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mic Capture Volume", 0x1a, 0x02, HDA_INPUT),
-        HDA_CODEC_MUTE("Mic Capture Switch", 0x1a, 0x02, HDA_INPUT),
+        HDA_CODEC_VOLUME("Capture Volume", 0x1a, 0x00, HDA_INPUT),
+        HDA_CODEC_MUTE("Capture Switch", 0x1a, 0x0, HDA_INPUT),
         HDA_CODEC_VOLUME("PCM Playback Volume", 0x17, 0x0, HDA_INPUT),
         HDA_CODEC_MUTE("PCM Playback Switch", 0x17, 0x0, HDA_INPUT),
         HDA_CODEC_VOLUME("Internal Mic Playback Volume", 0x17, 0x1, HDA_INPUT),
@@ -822,27 +818,15 @@ static const struct snd_kcontrol_new cxt5045_mixers[] = {
 };
 
 static const struct snd_kcontrol_new cxt5045_benq_mixers[] = {
-        HDA_CODEC_VOLUME("CD Capture Volume", 0x1a, 0x04, HDA_INPUT),
-        HDA_CODEC_MUTE("CD Capture Switch", 0x1a, 0x04, HDA_INPUT),
-        HDA_CODEC_VOLUME("CD Playback Volume", 0x17, 0x4, HDA_INPUT),
-        HDA_CODEC_MUTE("CD Playback Switch", 0x17, 0x4, HDA_INPUT),
-
-        HDA_CODEC_VOLUME("Line In Capture Volume", 0x1a, 0x03, HDA_INPUT),
-        HDA_CODEC_MUTE("Line In Capture Switch", 0x1a, 0x03, HDA_INPUT),
-        HDA_CODEC_VOLUME("Line In Playback Volume", 0x17, 0x3, HDA_INPUT),
-        HDA_CODEC_MUTE("Line In Playback Switch", 0x17, 0x3, HDA_INPUT),
-
-        HDA_CODEC_VOLUME("Mixer Capture Volume", 0x1a, 0x0, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer Capture Switch", 0x1a, 0x0, HDA_INPUT),
+        HDA_CODEC_VOLUME("Line Playback Volume", 0x17, 0x3, HDA_INPUT),
+        HDA_CODEC_MUTE("Line Playback Switch", 0x17, 0x3, HDA_INPUT),
 
         {}
 };
 
 static const struct snd_kcontrol_new cxt5045_mixers_hp530[] = {
-        HDA_CODEC_VOLUME("Internal Mic Capture Volume", 0x1a, 0x02, HDA_INPUT),
-        HDA_CODEC_MUTE("Internal Mic Capture Switch", 0x1a, 0x02, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mic Capture Volume", 0x1a, 0x01, HDA_INPUT),
-        HDA_CODEC_MUTE("Mic Capture Switch", 0x1a, 0x01, HDA_INPUT),
+        HDA_CODEC_VOLUME("Capture Volume", 0x1a, 0x00, HDA_INPUT),
+        HDA_CODEC_MUTE("Capture Switch", 0x1a, 0x0, HDA_INPUT),
         HDA_CODEC_VOLUME("PCM Playback Volume", 0x17, 0x0, HDA_INPUT),
         HDA_CODEC_MUTE("PCM Playback Switch", 0x17, 0x0, HDA_INPUT),
         HDA_CODEC_VOLUME("Internal Mic Playback Volume", 0x17, 0x2, HDA_INPUT),
@@ -946,10 +930,10 @@ static const struct snd_kcontrol_new cxt5045_test_mixer[] = {
         /* Output controls */
         HDA_CODEC_VOLUME("Speaker Playback Volume", 0x10, 0x0, HDA_OUTPUT),
         HDA_CODEC_MUTE("Speaker Playback Switch", 0x10, 0x0, HDA_OUTPUT),
-        HDA_CODEC_VOLUME("Node 11 Playback Volume", 0x11, 0x0, HDA_OUTPUT),
-        HDA_CODEC_MUTE("Node 11 Playback Switch", 0x11, 0x0, HDA_OUTPUT),
-        HDA_CODEC_VOLUME("Node 12 Playback Volume", 0x12, 0x0, HDA_OUTPUT),
-        HDA_CODEC_MUTE("Node 12 Playback Switch", 0x12, 0x0, HDA_OUTPUT),
+        HDA_CODEC_VOLUME("HP-OUT Playback Volume", 0x11, 0x0, HDA_OUTPUT),
+        HDA_CODEC_MUTE("HP-OUT Playback Switch", 0x11, 0x0, HDA_OUTPUT),
+        HDA_CODEC_VOLUME("LINE1 Playback Volume", 0x12, 0x0, HDA_OUTPUT),
+        HDA_CODEC_MUTE("LINE1 Playback Switch", 0x12, 0x0, HDA_OUTPUT),
         
         /* Modes for retasking pin widgets */
         CXT_PIN_MODE("HP-OUT pin mode", 0x11, CXT_PIN_DIR_INOUT),
@@ -960,16 +944,16 @@ static const struct snd_kcontrol_new cxt5045_test_mixer[] = {
 
         /* Loopback mixer controls */
 
-        HDA_CODEC_VOLUME("Mixer-1 Volume", 0x17, 0x0, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-1 Switch", 0x17, 0x0, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mixer-2 Volume", 0x17, 0x1, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-2 Switch", 0x17, 0x1, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mixer-3 Volume", 0x17, 0x2, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-3 Switch", 0x17, 0x2, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mixer-4 Volume", 0x17, 0x3, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-4 Switch", 0x17, 0x3, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mixer-5 Volume", 0x17, 0x4, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-5 Switch", 0x17, 0x4, HDA_INPUT),
+        HDA_CODEC_VOLUME("PCM Volume", 0x17, 0x0, HDA_INPUT),
+        HDA_CODEC_MUTE("PCM Switch", 0x17, 0x0, HDA_INPUT),
+        HDA_CODEC_VOLUME("MIC1 pin Volume", 0x17, 0x1, HDA_INPUT),
+        HDA_CODEC_MUTE("MIC1 pin Switch", 0x17, 0x1, HDA_INPUT),
+        HDA_CODEC_VOLUME("LINE1 pin Volume", 0x17, 0x2, HDA_INPUT),
+        HDA_CODEC_MUTE("LINE1 pin Switch", 0x17, 0x2, HDA_INPUT),
+        HDA_CODEC_VOLUME("HP-OUT pin Volume", 0x17, 0x3, HDA_INPUT),
+        HDA_CODEC_MUTE("HP-OUT pin Switch", 0x17, 0x3, HDA_INPUT),
+        HDA_CODEC_VOLUME("CD pin Volume", 0x17, 0x4, HDA_INPUT),
+        HDA_CODEC_MUTE("CD pin Switch", 0x17, 0x4, HDA_INPUT),
         {
                 .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
                 .name = "Input Source",
@@ -978,16 +962,8 @@ static const struct snd_kcontrol_new cxt5045_test_mixer[] = {
                 .put = conexant_mux_enum_put,
         },
         /* Audio input controls */
-        HDA_CODEC_VOLUME("Input-1 Volume", 0x1a, 0x0, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-1 Switch", 0x1a, 0x0, HDA_INPUT),
-        HDA_CODEC_VOLUME("Input-2 Volume", 0x1a, 0x1, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-2 Switch", 0x1a, 0x1, HDA_INPUT),
-        HDA_CODEC_VOLUME("Input-3 Volume", 0x1a, 0x2, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-3 Switch", 0x1a, 0x2, HDA_INPUT),
-        HDA_CODEC_VOLUME("Input-4 Volume", 0x1a, 0x3, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-4 Switch", 0x1a, 0x3, HDA_INPUT),
-        HDA_CODEC_VOLUME("Input-5 Volume", 0x1a, 0x4, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-5 Switch", 0x1a, 0x4, HDA_INPUT),
+        HDA_CODEC_VOLUME("Capture Volume", 0x1a, 0x0, HDA_INPUT),
+        HDA_CODEC_MUTE("Capture Switch", 0x1a, 0x0, HDA_INPUT),
         { } /* end */
 };
 
@@ -1009,10 +985,6 @@ static const struct hda_verb cxt5045_test_init_verbs[] = {
         {0x13, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
         {0x18, AC_VERB_SET_DIGI_CONVERT_1, 0},
 
-        /* Start with output sum widgets muted and their output gains at min */
-        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
-        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)},
-
         /* Unmute retasking pin widget output buffers since the default
          * state appears to be output.  As the pin mode is changed by the
          * user the pin mode control will take care of enabling the pin's
@@ -1027,11 +999,11 @@ static const struct hda_verb cxt5045_test_init_verbs[] = {
         /* Set ADC connection select to match default mixer setting (mic1
          * pin)
          */
-        {0x1a, AC_VERB_SET_CONNECT_SEL, 0x00},
-        {0x17, AC_VERB_SET_CONNECT_SEL, 0x00},
+        {0x1a, AC_VERB_SET_CONNECT_SEL, 0x01},
+        {0x17, AC_VERB_SET_CONNECT_SEL, 0x01},
 
         /* Mute all inputs to mixer widget (even unconnected ones) */
-        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)}, /* Mixer pin */
+        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)}, /* Mixer */
         {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)}, /* Mic1 pin */
         {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(2)}, /* Line pin */
         {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(3)}, /* HP pin */
@@ -1110,7 +1082,7 @@ static int patch_cxt5045(struct hda_codec *codec)
         if (!spec)
                 return -ENOMEM;
         codec->spec = spec;
-        codec->pin_amp_workaround = 1;
+        codec->single_adc_amp = 1;
 
         spec->multiout.max_channels = 2;
         spec->multiout.num_dacs = ARRAY_SIZE(cxt5045_dac_nids);
@@ -3999,9 +3971,14 @@ static void cx_auto_init_output(struct hda_codec *codec)
         int i;
 
         mute_outputs(codec, spec->multiout.num_dacs, spec->multiout.dac_nids);
-        for (i = 0; i < cfg->hp_outs; i++)
+        for (i = 0; i < cfg->hp_outs; i++) {
+                unsigned int val = PIN_OUT;
+                if (snd_hda_query_pin_caps(codec, cfg->hp_pins[i]) &
+                    AC_PINCAP_HP_DRV)
+                        val |= AC_PINCTL_HP_EN;
                 snd_hda_codec_write(codec, cfg->hp_pins[i], 0,
-                                    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP);
+                                    AC_VERB_SET_PIN_WIDGET_CONTROL, val);
+        }
         mute_outputs(codec, cfg->hp_outs, cfg->hp_pins);
         mute_outputs(codec, cfg->line_outs, cfg->line_out_pins);
         mute_outputs(codec, cfg->speaker_outs, cfg->speaker_pins);
@@ -4220,7 +4197,7 @@ static int cx_auto_add_capture_volume(struct hda_codec *codec, hda_nid_t nid,
                 int idx = get_input_connection(codec, adc_nid, nid);
                 if (idx < 0)
                         continue;
-                if (spec->single_adc_amp)
+                if (codec->single_adc_amp)
                         idx = 0;
                 return cx_auto_add_volume_idx(codec, label, pfx,
                                               cidx, adc_nid, HDA_INPUT, idx);
@@ -4275,7 +4252,7 @@ static int cx_auto_build_input_controls(struct hda_codec *codec)
                 if (cidx < 0)
                         continue;
                 input_conn[i] = spec->imux_info[i].adc;
-                if (!spec->single_adc_amp)
+                if (!codec->single_adc_amp)
                         input_conn[i] |= cidx << 8;
                 if (i > 0 && input_conn[i] != input_conn[0])
                         multi_connection = 1;
@@ -4419,8 +4396,10 @@ static void apply_pin_fixup(struct hda_codec *codec,
 
 enum {
         CXT_PINCFG_LENOVO_X200,
+        CXT_PINCFG_LENOVO_TP410,
 };
 
+/* ThinkPad X200 & co with cxt5051 */
 static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
         { 0x16, 0x042140ff }, /* HP (seq# overridden) */
         { 0x17, 0x21a11000 }, /* dock-mic */
@@ -4429,15 +4408,33 @@ static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
         {}
 };
 
+/* ThinkPad 410/420/510/520, X201 & co with cxt5066 */
+static const struct cxt_pincfg cxt_pincfg_lenovo_tp410[] = {
+        { 0x19, 0x042110ff }, /* HP (seq# overridden) */
+        { 0x1a, 0x21a190f0 }, /* dock-mic */
+        { 0x1c, 0x212140ff }, /* dock-HP */
+        {}
+};
+
 static const struct cxt_pincfg *cxt_pincfg_tbl[] = {
         [CXT_PINCFG_LENOVO_X200] = cxt_pincfg_lenovo_x200,
+        [CXT_PINCFG_LENOVO_TP410] = cxt_pincfg_lenovo_tp410,
 };
 
-static const struct snd_pci_quirk cxt_fixups[] = {
+static const struct snd_pci_quirk cxt5051_fixups[] = {
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
         {}
 };
 
+static const struct snd_pci_quirk cxt5066_fixups[] = {
+        SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
+        SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
+        SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
+        SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
+        SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
+        {}
+};
+
 /* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches
  * can be created (bko#42825)
  */
@@ -4466,19 +4463,21 @@ static int patch_conexant_auto(struct hda_codec *codec)
         if (!spec)
                 return -ENOMEM;
         codec->spec = spec;
-        codec->pin_amp_workaround = 1;
 
         switch (codec->vendor_id) {
         case 0x14f15045:
-                spec->single_adc_amp = 1;
+                codec->single_adc_amp = 1;
                 break;
         case 0x14f15051:
                 add_cx5051_fake_mutes(codec);
+                codec->pin_amp_workaround = 1;
+                apply_pin_fixup(codec, cxt5051_fixups, cxt_pincfg_tbl);
                 break;
+        default:
+                codec->pin_amp_workaround = 1;
+                apply_pin_fixup(codec, cxt5066_fixups, cxt_pincfg_tbl);
         }
 
-        apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
-
         /* Show mute-led control only on HP laptops
          * This is a sort of white-list: on HP laptops, EAPD corresponds
          * only to the mute-LED without actualy amp function.  Meanwhile,
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 540cd13f7f15..83f345f3c961 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -757,8 +757,6 @@ static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
         struct hdmi_spec *spec = codec->spec;
         int tag = res >> AC_UNSOL_RES_TAG_SHIFT;
         int pin_nid;
-        int pd = !!(res & AC_UNSOL_RES_PD);
-        int eldv = !!(res & AC_UNSOL_RES_ELDV);
         int pin_idx;
         struct hda_jack_tbl *jack;
 
@@ -768,9 +766,10 @@ static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
         pin_nid = jack->nid;
         jack->jack_dirty = 1;
 
-        printk(KERN_INFO
+        _snd_printd(SND_PR_VERBOSE,
                 "HDMI hot plug event: Codec=%d Pin=%d Presence_Detect=%d ELD_Valid=%d\n",
-                codec->addr, pin_nid, pd, eldv);
+                codec->addr, pin_nid,
+                !!(res & AC_UNSOL_RES_PD), !!(res & AC_UNSOL_RES_ELDV));
 
         pin_idx = pin_nid_to_pin_index(spec, pin_nid);
         if (pin_idx < 0)
@@ -992,7 +991,7 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
         if (eld->monitor_present)
                 eld_valid       = !!(present & AC_PINSENSE_ELDV);
 
-        printk(KERN_INFO
+        _snd_printd(SND_PR_VERBOSE,
                 "HDMI status: Codec=%d Pin=%d Presence_Detect=%d ELD_Valid=%d\n",
                 codec->addr, pin_nid, eld->monitor_present, eld_valid);
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 9917e55d6f11..818f90bc7d57 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1445,6 +1445,13 @@ enum {
         ALC_FIXUP_ACT_BUILD,
 };
 
+static void alc_apply_pincfgs(struct hda_codec *codec,
+                              const struct alc_pincfg *cfg)
+{
+        for (; cfg->nid; cfg++)
+                snd_hda_codec_set_pincfg(codec, cfg->nid, cfg->val);
+}
+
 static void alc_apply_fixup(struct hda_codec *codec, int action)
 {
         struct alc_spec *spec = codec->spec;
@@ -1478,9 +1485,7 @@ static void alc_apply_fixup(struct hda_codec *codec, int action)
                         snd_printdd(KERN_INFO "hda_codec: %s: "
                                     "Apply pincfg for %s\n",
                                     codec->chip_name, modelname);
-                        for (; cfg->nid; cfg++)
-                                snd_hda_codec_set_pincfg(codec, cfg->nid,
-                                                         cfg->val);
+                        alc_apply_pincfgs(codec, cfg);
                         break;
                 case ALC_FIXUP_VERBS:
                         if (action != ALC_FIXUP_ACT_PROBE || !fix->v.verbs)
@@ -3398,8 +3403,10 @@ static int alc_auto_fill_dac_nids(struct hda_codec *codec)
         for (;;) {
                 badness = fill_and_eval_dacs(codec, fill_hardwired,
                                              fill_mio_first);
-                if (badness < 0)
+                if (badness < 0) {
+                        kfree(best_cfg);
                         return badness;
+                }
                 debug_badness("==> lo_type=%d, wired=%d, mio=%d, badness=0x%x\n",
                               cfg->line_out_type, fill_hardwired, fill_mio_first,
                               badness);
@@ -3434,7 +3441,7 @@ static int alc_auto_fill_dac_nids(struct hda_codec *codec)
                         cfg->line_out_type = AUTO_PIN_SPEAKER_OUT;
                         fill_hardwired = true;
                         continue;
-                } 
+                }
                 if (cfg->hp_outs > 0 &&
                     cfg->line_out_type == AUTO_PIN_SPEAKER_OUT) {
                         cfg->speaker_outs = cfg->line_outs;
@@ -3448,7 +3455,7 @@ static int alc_auto_fill_dac_nids(struct hda_codec *codec)
                         cfg->line_out_type = AUTO_PIN_HP_OUT;
                         fill_hardwired = true;
                         continue;
-                } 
+                }
                 break;
         }
 
@@ -4423,7 +4430,7 @@ static int alc_parse_auto_config(struct hda_codec *codec,
 static int alc880_parse_auto_config(struct hda_codec *codec)
 {
         static const hda_nid_t alc880_ignore[] = { 0x1d, 0 };
-        static const hda_nid_t alc880_ssids[] = { 0x15, 0x1b, 0x14, 0 }; 
+        static const hda_nid_t alc880_ssids[] = { 0x15, 0x1b, 0x14, 0 };
         return alc_parse_auto_config(codec, alc880_ignore, alc880_ssids);
 }
 
@@ -4859,6 +4866,7 @@ enum {
         ALC260_FIXUP_GPIO1_TOGGLE,
         ALC260_FIXUP_REPLACER,
         ALC260_FIXUP_HP_B1900,
+        ALC260_FIXUP_KN1,
 };
 
 static void alc260_gpio1_automute(struct hda_codec *codec)
@@ -4886,6 +4894,36 @@ static void alc260_fixup_gpio1_toggle(struct hda_codec *codec,
         }
 }
 
+static void alc260_fixup_kn1(struct hda_codec *codec,
+                             const struct alc_fixup *fix, int action)
+{
+        struct alc_spec *spec = codec->spec;
+        static const struct alc_pincfg pincfgs[] = {
+                { 0x0f, 0x02214000 }, /* HP/speaker */
+                { 0x12, 0x90a60160 }, /* int mic */
+                { 0x13, 0x02a19000 }, /* ext mic */
+                { 0x18, 0x01446000 }, /* SPDIF out */
+                /* disable bogus I/O pins */
+                { 0x10, 0x411111f0 },
+                { 0x11, 0x411111f0 },
+                { 0x14, 0x411111f0 },
+                { 0x15, 0x411111f0 },
+                { 0x16, 0x411111f0 },
+                { 0x17, 0x411111f0 },
+                { 0x19, 0x411111f0 },
+                { }
+        };
+
+        switch (action) {
+        case ALC_FIXUP_ACT_PRE_PROBE:
+                alc_apply_pincfgs(codec, pincfgs);
+                break;
+        case ALC_FIXUP_ACT_PROBE:
+                spec->init_amp = ALC_INIT_NONE;
+                break;
+        }
+}
+
 static const struct alc_fixup alc260_fixups[] = {
         [ALC260_FIXUP_HP_DC5750] = {
                 .type = ALC_FIXUP_PINS,
@@ -4936,7 +4974,11 @@ static const struct alc_fixup alc260_fixups[] = {
                 .v.func = alc260_fixup_gpio1_toggle,
                 .chained = true,
                 .chain_id = ALC260_FIXUP_COEF,
-        }
+        },
+        [ALC260_FIXUP_KN1] = {
+                .type = ALC_FIXUP_FUNC,
+                .v.func = alc260_fixup_kn1,
+        },
 };
 
 static const struct snd_pci_quirk alc260_fixup_tbl[] = {
@@ -4946,6 +4988,7 @@ static const struct snd_pci_quirk alc260_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x280a, "HP dc5750", ALC260_FIXUP_HP_DC5750),
         SND_PCI_QUIRK(0x103c, 0x30ba, "HP Presario B1900", ALC260_FIXUP_HP_B1900),
         SND_PCI_QUIRK(0x1509, 0x4540, "Favorit 100XS", ALC260_FIXUP_GPIO1),
+        SND_PCI_QUIRK(0x152d, 0x0729, "Quanta KN1", ALC260_FIXUP_KN1),
         SND_PCI_QUIRK(0x161f, 0x2057, "Replacer 672V", ALC260_FIXUP_REPLACER),
         SND_PCI_QUIRK(0x1631, 0xc017, "PB V7900", ALC260_FIXUP_COEF),
         {}
@@ -5269,7 +5312,9 @@ static const struct alc_fixup alc882_fixups[] = {
                         { 0x16, 0x99130111 }, /* CLFE speaker */
                         { 0x17, 0x99130112 }, /* surround speaker */
                         { }
-                }
+                },
+                .chained = true,
+                .chain_id = ALC882_FIXUP_GPIO1,
         },
         [ALC882_FIXUP_ACER_ASPIRE_8930G] = {
                 .type = ALC_FIXUP_PINS,
@@ -5312,7 +5357,9 @@ static const struct alc_fixup alc882_fixups[] = {
                         { 0x20, AC_VERB_SET_COEF_INDEX, 0x07 },
                         { 0x20, AC_VERB_SET_PROC_COEF, 0x3050 },
                         { }
-                }
+                },
+                .chained = true,
+                .chain_id = ALC882_FIXUP_GPIO1,
         },
         [ALC885_FIXUP_MACPRO_GPIO] = {
                 .type = ALC_FIXUP_FUNC,
@@ -5359,6 +5406,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
                       ALC882_FIXUP_ACER_ASPIRE_4930G),
         SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210),
         SND_PCI_QUIRK(0x1025, 0x0259, "Acer Aspire 5935", ALC889_FIXUP_DAC_ROUTE),
+        SND_PCI_QUIRK(0x1025, 0x026b, "Acer Aspire 8940G", ALC882_FIXUP_ACER_ASPIRE_8930G),
         SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", ALC882_FIXUP_ACER_ASPIRE_7736),
         SND_PCI_QUIRK(0x1043, 0x13c2, "Asus A7M", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x1043, 0x1873, "ASUS W90V", ALC882_FIXUP_ASUS_W90V),
@@ -5384,6 +5432,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC889_FIXUP_IMAC91_VREF),
         SND_PCI_QUIRK(0x106b, 0x4000, "MacbookPro 5,1", ALC889_FIXUP_IMAC91_VREF),
         SND_PCI_QUIRK(0x106b, 0x4100, "Macmini 3,1", ALC889_FIXUP_IMAC91_VREF),
+        SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 5,1", ALC885_FIXUP_MACPRO_GPIO),
         SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
         SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
         SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
@@ -5399,6 +5448,13 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         {}
 };
 
+static const struct alc_model_fixup alc882_fixup_models[] = {
+        {.id = ALC882_FIXUP_ACER_ASPIRE_4930G, .name = "acer-aspire-4930g"},
+        {.id = ALC882_FIXUP_ACER_ASPIRE_8930G, .name = "acer-aspire-8930g"},
+        {.id = ALC883_FIXUP_ACER_EAPD, .name = "acer-aspire"},
+        {}
+};
+
 /*
  * BIOS auto configuration
  */
@@ -5439,7 +5495,8 @@ static int patch_alc882(struct hda_codec *codec)
         if (err < 0)
                 goto error;
 
-        alc_pick_fixup(codec, NULL, alc882_fixup_tbl, alc882_fixups);
+        alc_pick_fixup(codec, alc882_fixup_models, alc882_fixup_tbl,
+                       alc882_fixups);
         alc_apply_fixup(codec, ALC_FIXUP_ACT_PRE_PROBE);
 
         alc_auto_parse_customize_define(codec);
@@ -6052,6 +6109,7 @@ static const struct alc_fixup alc269_fixups[] = {
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_MIC2_MUTE_LED),
+        SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_DMIC),
         SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
         SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
@@ -6079,7 +6137,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
          * Basically the device should work as is without the fixup table.
          * If BIOS doesn't give a proper info, enable the corresponding
          * fixup entry.
-         */ 
+         */
         SND_PCI_QUIRK(0x1043, 0x8330, "ASUS Eeepc P703 P900A",
                       ALC269_FIXUP_AMIC),
         SND_PCI_QUIRK(0x1043, 0x1013, "ASUS N61Da", ALC269_FIXUP_AMIC),
@@ -6296,7 +6354,7 @@ static void alc_fixup_no_jack_detect(struct hda_codec *codec,
 {
         if (action == ALC_FIXUP_ACT_PRE_PROBE)
                 codec->no_jack_detect = 1;
-}       
+}
 
 static const struct alc_fixup alc861_fixups[] = {
         [ALC861_FIXUP_FSC_AMILO_PI1505] = {
@@ -6714,7 +6772,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
          * Basically the device should work as is without the fixup table.
          * If BIOS doesn't give a proper info, enable the corresponding
          * fixup entry.
-         */ 
+         */
         SND_PCI_QUIRK(0x1043, 0x1000, "ASUS N50Vm", ALC662_FIXUP_ASUS_MODE1),
         SND_PCI_QUIRK(0x1043, 0x1092, "ASUS NB", ALC662_FIXUP_ASUS_MODE3),
         SND_PCI_QUIRK(0x1043, 0x1173, "ASUS K73Jn", ALC662_FIXUP_ASUS_MODE1),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 33a9946b492c..4742cac26aa9 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -5063,12 +5063,11 @@ static void stac92xx_update_led_status(struct hda_codec *codec, int enabled)
         if (spec->gpio_led_polarity)
                 muted = !muted;
 
-        /*polarity defines *not* muted state level*/
         if (!spec->vref_mute_led_nid) {
                 if (muted)
-                        spec->gpio_data &= ~spec->gpio_led; /* orange */
+                        spec->gpio_data |= spec->gpio_led;
                 else
-                        spec->gpio_data |= spec->gpio_led; /* white */
+                        spec->gpio_data &= ~spec->gpio_led;
                 stac_gpio_set(codec, spec->gpio_mask,
                                 spec->gpio_dir, spec->gpio_data);
         } else {
diff --git a/sound/soc/blackfin/bf5xx-ssm2602.c b/sound/soc/blackfin/bf5xx-ssm2602.c
index df3ac73f8778..b39ad356b92b 100644
--- a/sound/soc/blackfin/bf5xx-ssm2602.c
+++ b/sound/soc/blackfin/bf5xx-ssm2602.c
@@ -99,6 +99,7 @@ static struct snd_soc_dai_link bf5xx_ssm2602_dai[] = {
                 .platform_name = "bfin-i2s-pcm-audio",
                 .codec_name = "ssm2602.0-001b",
                 .ops = &bf5xx_ssm2602_ops,
+                .dai_fmt = BF5XX_SSM2602_DAIFMT,
         },
         {
                 .name = "ssm2602",
@@ -108,6 +109,7 @@ static struct snd_soc_dai_link bf5xx_ssm2602_dai[] = {
                 .platform_name = "bfin-i2s-pcm-audio",
                 .codec_name = "ssm2602.0-001b",
                 .ops = &bf5xx_ssm2602_ops,
+                .dai_fmt = BF5XX_SSM2602_DAIFMT,
         },
 };
 
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 6508e8b790bb..59d8efaa17e9 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -57,7 +57,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_TPA6130A2 if I2C
         select SND_SOC_TLV320DAC33 if I2C
         select SND_SOC_TWL4030 if TWL4030_CORE
-        select SND_SOC_TWL6040 if TWL4030_CORE
+        select SND_SOC_TWL6040 if TWL6040_CORE
         select SND_SOC_UDA134X
         select SND_SOC_UDA1380 if I2C
         select SND_SOC_WL1273 if MFD_WL1273_CORE
@@ -276,7 +276,6 @@ config SND_SOC_TWL4030
         tristate
 
 config SND_SOC_TWL6040
-        select TWL6040_CORE
         tristate
 
 config SND_SOC_UDA134X
diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
index f8e10ced244a..b3e24f289421 100644
--- a/sound/soc/codecs/ak4642.c
+++ b/sound/soc/codecs/ak4642.c
@@ -140,7 +140,7 @@
  * min : 0xFE : -115.0 dB
  * mute: 0xFF
  */
-static const DECLARE_TLV_DB_SCALE(out_tlv, -11500, 50, 1);
+static const DECLARE_TLV_DB_SCALE(out_tlv, -11550, 50, 1);
 
 static const struct snd_kcontrol_new ak4642_snd_controls[] = {
 
diff --git a/sound/soc/codecs/cs42l73.c b/sound/soc/codecs/cs42l73.c
index 78979b3e0e95..07c44b71f096 100644
--- a/sound/soc/codecs/cs42l73.c
+++ b/sound/soc/codecs/cs42l73.c
@@ -929,6 +929,8 @@ static int cs42l73_set_mclk(struct snd_soc_dai *dai, unsigned int freq)
 
         /* MCLKX -> MCLK */
         mclkx_coeff = cs42l73_get_mclkx_coeff(freq);
+        if (mclkx_coeff < 0)
+                return mclkx_coeff;
 
         mclk = cs42l73_mclkx_coeffs[mclkx_coeff].mclkx /
                 cs42l73_mclkx_coeffs[mclkx_coeff].ratio;
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index d1926266fe00..8e92fb88ed09 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -143,11 +143,11 @@ static int mic_bias_event(struct snd_soc_dapm_widget *w,
 }
 
 /*
- * using codec assist to small pop, hp_powerup or lineout_powerup
- * should stay setting until vag_powerup is fully ramped down,
- * vag fully ramped down require 400ms.
+ * As manual described, ADC/DAC only works when VAG powerup,
+ * So enabled VAG before ADC/DAC up.
+ * In power down case, we need wait 400ms when vag fully ramped down.
  */
-static int small_pop_event(struct snd_soc_dapm_widget *w,
+static int power_vag_event(struct snd_soc_dapm_widget *w,
         struct snd_kcontrol *kcontrol, int event)
 {
         switch (event) {
@@ -156,7 +156,7 @@ static int small_pop_event(struct snd_soc_dapm_widget *w,
                         SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP);
                 break;
 
-        case SND_SOC_DAPM_PRE_PMD:
+        case SND_SOC_DAPM_POST_PMD:
                 snd_soc_update_bits(w->codec, SGTL5000_CHIP_ANA_POWER,
                         SGTL5000_VAG_POWERUP, 0);
                 msleep(400);
@@ -201,12 +201,8 @@ static const struct snd_soc_dapm_widget sgtl5000_dapm_widgets[] = {
                                 mic_bias_event,
                                 SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
 
-        SND_SOC_DAPM_PGA_E("HP", SGTL5000_CHIP_ANA_POWER, 4, 0, NULL, 0,
-                        small_pop_event,
-                        SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
-        SND_SOC_DAPM_PGA_E("LO", SGTL5000_CHIP_ANA_POWER, 0, 0, NULL, 0,
-                        small_pop_event,
-                        SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+        SND_SOC_DAPM_PGA("HP", SGTL5000_CHIP_ANA_POWER, 4, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("LO", SGTL5000_CHIP_ANA_POWER, 0, 0, NULL, 0),
 
         SND_SOC_DAPM_MUX("Capture Mux", SND_SOC_NOPM, 0, 0, &adc_mux),
         SND_SOC_DAPM_MUX("Headphone Mux", SND_SOC_NOPM, 0, 0, &dac_mux),
@@ -221,8 +217,11 @@ static const struct snd_soc_dapm_widget sgtl5000_dapm_widgets[] = {
                                 0, SGTL5000_CHIP_DIG_POWER,
                                 1, 0),
 
-        SND_SOC_DAPM_ADC("ADC", "Capture", SGTL5000_CHIP_ANA_POWER, 1, 0),
+        SND_SOC_DAPM_SUPPLY("VAG_POWER", SGTL5000_CHIP_ANA_POWER, 7, 0,
+                            power_vag_event,
+                            SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
 
+        SND_SOC_DAPM_ADC("ADC", "Capture", SGTL5000_CHIP_ANA_POWER, 1, 0),
         SND_SOC_DAPM_DAC("DAC", "Playback", SGTL5000_CHIP_ANA_POWER, 3, 0),
 };
 
@@ -231,9 +230,11 @@ static const struct snd_soc_dapm_route sgtl5000_dapm_routes[] = {
         {"Capture Mux", "LINE_IN", "LINE_IN"},  /* line_in --> adc_mux */
         {"Capture Mux", "MIC_IN", "MIC_IN"},    /* mic_in --> adc_mux */
 
+        {"ADC", NULL, "VAG_POWER"},
         {"ADC", NULL, "Capture Mux"},           /* adc_mux --> adc */
         {"AIFOUT", NULL, "ADC"},                /* adc --> i2s_out */
 
+        {"DAC", NULL, "VAG_POWER"},
         {"DAC", NULL, "AIFIN"},                 /* i2s-->dac,skip audio mux */
         {"Headphone Mux", "DAC", "DAC"},        /* dac --> hp_mux */
         {"LO", NULL, "DAC"},                    /* dac --> line_out */
diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c
index 16d55f91a653..df1e07ffac32 100644
--- a/sound/soc/codecs/tlv320aic23.c
+++ b/sound/soc/codecs/tlv320aic23.c
@@ -472,7 +472,7 @@ static int tlv320aic23_set_dai_sysclk(struct snd_soc_dai *codec_dai,
 static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec,
                                       enum snd_soc_bias_level level)
 {
-        u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0xff7f;
+        u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0x17f;
 
         switch (level) {
         case SND_SOC_BIAS_ON:
@@ -491,7 +491,7 @@ static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec,
         case SND_SOC_BIAS_OFF:
                 /* everything off, dac mute, inactive */
                 snd_soc_write(codec, TLV320AIC23_ACTIVE, 0x0);
-                snd_soc_write(codec, TLV320AIC23_PWR, 0xffff);
+                snd_soc_write(codec, TLV320AIC23_PWR, 0x1ff);
                 break;
         }
         codec->dapm.bias_level = level;
diff --git a/sound/soc/codecs/twl6040.c b/sound/soc/codecs/twl6040.c
index 2d8c6b825e57..dc7509b9d53a 100644
--- a/sound/soc/codecs/twl6040.c
+++ b/sound/soc/codecs/twl6040.c
@@ -26,7 +26,6 @@
 #include <linux/pm.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
-#include <linux/i2c/twl.h>
 #include <linux/mfd/twl6040.h>
 
 #include <sound/core.h>
@@ -1528,7 +1527,7 @@ static int twl6040_resume(struct snd_soc_codec *codec)
 static int twl6040_probe(struct snd_soc_codec *codec)
 {
         struct twl6040_data *priv;
-        struct twl4030_codec_data *pdata = dev_get_platdata(codec->dev);
+        struct twl6040_codec_data *pdata = dev_get_platdata(codec->dev);
         struct platform_device *pdev = container_of(codec->dev,
                                                    struct platform_device, dev);
         int ret = 0;
diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
index 8c4c9591ec05..aa12c6b6beeb 100644
--- a/sound/soc/codecs/wm8350.c
+++ b/sound/soc/codecs/wm8350.c
@@ -60,7 +60,7 @@ struct wm8350_jack_data {
 };
 
 struct wm8350_data {
-        struct snd_soc_codec codec;
+        struct wm8350 *wm8350;
         struct wm8350_output out1;
         struct wm8350_output out2;
         struct wm8350_jack_data hpl;
@@ -1309,7 +1309,7 @@ static void wm8350_hp_work(struct wm8350_data *priv,
                            struct wm8350_jack_data *jack,
                            u16 mask)
 {
-        struct wm8350 *wm8350 = priv->codec.control_data;
+        struct wm8350 *wm8350 = priv->wm8350;
         u16 reg;
         int report;
 
@@ -1342,7 +1342,7 @@ static void wm8350_hpr_work(struct work_struct *work)
 static irqreturn_t wm8350_hp_jack_handler(int irq, void *data)
 {
         struct wm8350_data *priv = data;
-        struct wm8350 *wm8350 = priv->codec.control_data;
+        struct wm8350 *wm8350 = priv->wm8350;
         struct wm8350_jack_data *jack = NULL;
 
         switch (irq - wm8350->irq_base) {
@@ -1427,7 +1427,7 @@ EXPORT_SYMBOL_GPL(wm8350_hp_jack_detect);
 static irqreturn_t wm8350_mic_handler(int irq, void *data)
 {
         struct wm8350_data *priv = data;
-        struct wm8350 *wm8350 = priv->codec.control_data;
+        struct wm8350 *wm8350 = priv->wm8350;
         u16 reg;
         int report = 0;
 
@@ -1536,6 +1536,8 @@ static  int wm8350_codec_probe(struct snd_soc_codec *codec)
                 return -ENOMEM;
         snd_soc_codec_set_drvdata(codec, priv);
 
+        priv->wm8350 = wm8350;
+
         for (i = 0; i < ARRAY_SIZE(supply_names); i++)
                 priv->supplies[i].supply = supply_names[i];
 
@@ -1544,7 +1546,6 @@ static  int wm8350_codec_probe(struct snd_soc_codec *codec)
         if (ret != 0)
                 return ret;
 
-        wm8350->codec.codec = codec;
         codec->control_data = wm8350;
 
         /* Put the codec into reset if it wasn't already */
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 7c49642af052..6c1fe3afd4b5 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -1000,61 +1000,170 @@ static void wm8994_update_class_w(struct snd_soc_codec *codec)
         }
 }
 
-static int late_enable_ev(struct snd_soc_dapm_widget *w,
-                          struct snd_kcontrol *kcontrol, int event)
+static int aif1clk_ev(struct snd_soc_dapm_widget *w,
+                      struct snd_kcontrol *kcontrol, int event)
 {
         struct snd_soc_codec *codec = w->codec;
-        struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+        struct wm8994 *control = codec->control_data;
+        int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA;
+        int dac;
+        int adc;
+        int val;
+
+        switch (control->type) {
+        case WM8994:
+        case WM8958:
+                mask |= WM8994_AIF1DAC2L_ENA | WM8994_AIF1DAC2R_ENA;
+                break;
+        default:
+                break;
+        }
 
         switch (event) {
         case SND_SOC_DAPM_PRE_PMU:
-                if (wm8994->aif1clk_enable) {
-                        snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
-                                            WM8994_AIF1CLK_ENA_MASK,
-                                            WM8994_AIF1CLK_ENA);
-                        wm8994->aif1clk_enable = 0;
-                }
-                if (wm8994->aif2clk_enable) {
-                        snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
-                                            WM8994_AIF2CLK_ENA_MASK,
-                                            WM8994_AIF2CLK_ENA);
-                        wm8994->aif2clk_enable = 0;
-                }
+                val = snd_soc_read(codec, WM8994_AIF1_CONTROL_1);
+                if ((val & WM8994_AIF1ADCL_SRC) &&
+                    (val & WM8994_AIF1ADCR_SRC))
+                        adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA;
+                else if (!(val & WM8994_AIF1ADCL_SRC) &&
+                         !(val & WM8994_AIF1ADCR_SRC))
+                        adc = WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
+                else
+                        adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA |
+                                WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
+
+                val = snd_soc_read(codec, WM8994_AIF1_CONTROL_2);
+                if ((val & WM8994_AIF1DACL_SRC) &&
+                    (val & WM8994_AIF1DACR_SRC))
+                        dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA;
+                else if (!(val & WM8994_AIF1DACL_SRC) &&
+                         !(val & WM8994_AIF1DACR_SRC))
+                        dac = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
+                else
+                        dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA |
+                                WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
+
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+                                    mask, adc);
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+                                    mask, dac);
+                snd_soc_update_bits(codec, WM8994_CLOCKING_1,
+                                    WM8994_AIF1DSPCLK_ENA |
+                                    WM8994_SYSDSPCLK_ENA,
+                                    WM8994_AIF1DSPCLK_ENA |
+                                    WM8994_SYSDSPCLK_ENA);
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, mask,
+                                    WM8994_AIF1ADC1R_ENA |
+                                    WM8994_AIF1ADC1L_ENA |
+                                    WM8994_AIF1ADC2R_ENA |
+                                    WM8994_AIF1ADC2L_ENA);
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, mask,
+                                    WM8994_AIF1DAC1R_ENA |
+                                    WM8994_AIF1DAC1L_ENA |
+                                    WM8994_AIF1DAC2R_ENA |
+                                    WM8994_AIF1DAC2L_ENA);
                 break;
-        }
 
-        /* We may also have postponed startup of DSP, handle that. */
-        wm8958_aif_ev(w, kcontrol, event);
+        case SND_SOC_DAPM_PRE_PMD:
+        case SND_SOC_DAPM_POST_PMD:
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+                                    mask, 0);
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+                                    mask, 0);
+
+                val = snd_soc_read(codec, WM8994_CLOCKING_1);
+                if (val & WM8994_AIF2DSPCLK_ENA)
+                        val = WM8994_SYSDSPCLK_ENA;
+                else
+                        val = 0;
+                snd_soc_update_bits(codec, WM8994_CLOCKING_1,
+                                    WM8994_SYSDSPCLK_ENA |
+                                    WM8994_AIF1DSPCLK_ENA, val);
+                break;
+        }
 
         return 0;
 }
 
-static int late_disable_ev(struct snd_soc_dapm_widget *w,
-                           struct snd_kcontrol *kcontrol, int event)
+static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+                      struct snd_kcontrol *kcontrol, int event)
 {
         struct snd_soc_codec *codec = w->codec;
-        struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+        int dac;
+        int adc;
+        int val;
 
         switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                val = snd_soc_read(codec, WM8994_AIF2_CONTROL_1);
+                if ((val & WM8994_AIF2ADCL_SRC) &&
+                    (val & WM8994_AIF2ADCR_SRC))
+                        adc = WM8994_AIF2ADCR_ENA;
+                else if (!(val & WM8994_AIF2ADCL_SRC) &&
+                         !(val & WM8994_AIF2ADCR_SRC))
+                        adc = WM8994_AIF2ADCL_ENA;
+                else
+                        adc = WM8994_AIF2ADCL_ENA | WM8994_AIF2ADCR_ENA;
+
+
+                val = snd_soc_read(codec, WM8994_AIF2_CONTROL_2);
+                if ((val & WM8994_AIF2DACL_SRC) &&
+                    (val & WM8994_AIF2DACR_SRC))
+                        dac = WM8994_AIF2DACR_ENA;
+                else if (!(val & WM8994_AIF2DACL_SRC) &&
+                         !(val & WM8994_AIF2DACR_SRC))
+                        dac = WM8994_AIF2DACL_ENA;
+                else
+                        dac = WM8994_AIF2DACL_ENA | WM8994_AIF2DACR_ENA;
+
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+                                    WM8994_AIF2ADCL_ENA |
+                                    WM8994_AIF2ADCR_ENA, adc);
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+                                    WM8994_AIF2DACL_ENA |
+                                    WM8994_AIF2DACR_ENA, dac);
+                snd_soc_update_bits(codec, WM8994_CLOCKING_1,
+                                    WM8994_AIF2DSPCLK_ENA |
+                                    WM8994_SYSDSPCLK_ENA,
+                                    WM8994_AIF2DSPCLK_ENA |
+                                    WM8994_SYSDSPCLK_ENA);
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+                                    WM8994_AIF2ADCL_ENA |
+                                    WM8994_AIF2ADCR_ENA,
+                                    WM8994_AIF2ADCL_ENA |
+                                    WM8994_AIF2ADCR_ENA);
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+                                    WM8994_AIF2DACL_ENA |
+                                    WM8994_AIF2DACR_ENA,
+                                    WM8994_AIF2DACL_ENA |
+                                    WM8994_AIF2DACR_ENA);
+                break;
+
+        case SND_SOC_DAPM_PRE_PMD:
         case SND_SOC_DAPM_POST_PMD:
-                if (wm8994->aif1clk_disable) {
-                        snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
-                                            WM8994_AIF1CLK_ENA_MASK, 0);
-                        wm8994->aif1clk_disable = 0;
-                }
-                if (wm8994->aif2clk_disable) {
-                        snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
-                                            WM8994_AIF2CLK_ENA_MASK, 0);
-                        wm8994->aif2clk_disable = 0;
-                }
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+                                    WM8994_AIF2DACL_ENA |
+                                    WM8994_AIF2DACR_ENA, 0);
+                snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+                                    WM8994_AIF2ADCL_ENA |
+                                    WM8994_AIF2ADCR_ENA, 0);
+
+                val = snd_soc_read(codec, WM8994_CLOCKING_1);
+                if (val & WM8994_AIF1DSPCLK_ENA)
+                        val = WM8994_SYSDSPCLK_ENA;
+                else
+                        val = 0;
+                snd_soc_update_bits(codec, WM8994_CLOCKING_1,
+                                    WM8994_SYSDSPCLK_ENA |
+                                    WM8994_AIF2DSPCLK_ENA, val);
                 break;
         }
 
         return 0;
 }
 
-static int aif1clk_ev(struct snd_soc_dapm_widget *w,
-                      struct snd_kcontrol *kcontrol, int event)
+static int aif1clk_late_ev(struct snd_soc_dapm_widget *w,
+                           struct snd_kcontrol *kcontrol, int event)
 {
         struct snd_soc_codec *codec = w->codec;
         struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
@@ -1071,8 +1180,8 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
-static int aif2clk_ev(struct snd_soc_dapm_widget *w,
-                      struct snd_kcontrol *kcontrol, int event)
+static int aif2clk_late_ev(struct snd_soc_dapm_widget *w,
+                           struct snd_kcontrol *kcontrol, int event)
 {
         struct snd_soc_codec *codec = w->codec;
         struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
@@ -1089,6 +1198,63 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
+static int late_enable_ev(struct snd_soc_dapm_widget *w,
+                          struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = w->codec;
+        struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                if (wm8994->aif1clk_enable) {
+                        aif1clk_ev(w, kcontrol, event);
+                        snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+                                            WM8994_AIF1CLK_ENA_MASK,
+                                            WM8994_AIF1CLK_ENA);
+                        wm8994->aif1clk_enable = 0;
+                }
+                if (wm8994->aif2clk_enable) {
+                        aif2clk_ev(w, kcontrol, event);
+                        snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+                                            WM8994_AIF2CLK_ENA_MASK,
+                                            WM8994_AIF2CLK_ENA);
+                        wm8994->aif2clk_enable = 0;
+                }
+                break;
+        }
+
+        /* We may also have postponed startup of DSP, handle that. */
+        wm8958_aif_ev(w, kcontrol, event);
+
+        return 0;
+}
+
+static int late_disable_ev(struct snd_soc_dapm_widget *w,
+                           struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = w->codec;
+        struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMD:
+                if (wm8994->aif1clk_disable) {
+                        snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+                                            WM8994_AIF1CLK_ENA_MASK, 0);
+                        aif1clk_ev(w, kcontrol, event);
+                        wm8994->aif1clk_disable = 0;
+                }
+                if (wm8994->aif2clk_disable) {
+                        snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+                                            WM8994_AIF2CLK_ENA_MASK, 0);
+                        aif2clk_ev(w, kcontrol, event);
+                        wm8994->aif2clk_disable = 0;
+                }
+                break;
+        }
+
+        return 0;
+}
+
 static int adc_mux_ev(struct snd_soc_dapm_widget *w,
                       struct snd_kcontrol *kcontrol, int event)
 {
@@ -1385,9 +1551,9 @@ static const struct snd_kcontrol_new aif2dacr_src_mux =
         SOC_DAPM_ENUM("AIF2DACR Mux", aif2dacr_src_enum);
 
 static const struct snd_soc_dapm_widget wm8994_lateclk_revd_widgets[] = {
-SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_ev,
+SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_late_ev,
         SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
-SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_ev,
+SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_late_ev,
         SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
 
 SND_SOC_DAPM_PGA_E("Late DAC1L Enable PGA", SND_SOC_NOPM, 0, 0, NULL, 0,
@@ -1416,8 +1582,10 @@ SND_SOC_DAPM_POST("Late Disable PGA", late_disable_ev)
 };
 
 static const struct snd_soc_dapm_widget wm8994_lateclk_widgets[] = {
-SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
-SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
+SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, aif1clk_ev,
+                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, aif2clk_ev,
+                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
 SND_SOC_DAPM_PGA("Direct Voice", SND_SOC_NOPM, 0, 0, NULL, 0),
 SND_SOC_DAPM_MIXER("SPKL", WM8994_POWER_MANAGEMENT_3, 8, 0,
                    left_speaker_mixer, ARRAY_SIZE(left_speaker_mixer)),
@@ -1470,30 +1638,30 @@ SND_SOC_DAPM_SUPPLY("VMID", SND_SOC_NOPM, 0, 0, vmid_event,
 SND_SOC_DAPM_SUPPLY("CLK_SYS", SND_SOC_NOPM, 0, 0, clk_sys_event,
                     SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
 
-SND_SOC_DAPM_SUPPLY("DSP1CLK", WM8994_CLOCKING_1, 3, 0, NULL, 0),
-SND_SOC_DAPM_SUPPLY("DSP2CLK", WM8994_CLOCKING_1, 2, 0, NULL, 0),
-SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_CLOCKING_1, 1, 0, NULL, 0),
+SND_SOC_DAPM_SUPPLY("DSP1CLK", SND_SOC_NOPM, 3, 0, NULL, 0),
+SND_SOC_DAPM_SUPPLY("DSP2CLK", SND_SOC_NOPM, 2, 0, NULL, 0),
+SND_SOC_DAPM_SUPPLY("DSPINTCLK", SND_SOC_NOPM, 1, 0, NULL, 0),
 
 SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
-                     0, WM8994_POWER_MANAGEMENT_4, 9, 0),
+                     0, SND_SOC_NOPM, 9, 0),
 SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
-                     0, WM8994_POWER_MANAGEMENT_4, 8, 0),
+                     0, SND_SOC_NOPM, 8, 0),
 SND_SOC_DAPM_AIF_IN_E("AIF1DAC1L", NULL, 0,
-                      WM8994_POWER_MANAGEMENT_5, 9, 0, wm8958_aif_ev,
+                      SND_SOC_NOPM, 9, 0, wm8958_aif_ev,
                       SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
 SND_SOC_DAPM_AIF_IN_E("AIF1DAC1R", NULL, 0,
-                      WM8994_POWER_MANAGEMENT_5, 8, 0, wm8958_aif_ev,
+                      SND_SOC_NOPM, 8, 0, wm8958_aif_ev,
                       SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
 
 SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
-                     0, WM8994_POWER_MANAGEMENT_4, 11, 0),
+                     0, SND_SOC_NOPM, 11, 0),
 SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
-                     0, WM8994_POWER_MANAGEMENT_4, 10, 0),
+                     0, SND_SOC_NOPM, 10, 0),
 SND_SOC_DAPM_AIF_IN_E("AIF1DAC2L", NULL, 0,
-                      WM8994_POWER_MANAGEMENT_5, 11, 0, wm8958_aif_ev,
+                      SND_SOC_NOPM, 11, 0, wm8958_aif_ev,
                       SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
 SND_SOC_DAPM_AIF_IN_E("AIF1DAC2R", NULL, 0,
-                      WM8994_POWER_MANAGEMENT_5, 10, 0, wm8958_aif_ev,
+                      SND_SOC_NOPM, 10, 0, wm8958_aif_ev,
                       SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
 
 SND_SOC_DAPM_MIXER("AIF1ADC1L Mixer", SND_SOC_NOPM, 0, 0,
@@ -1520,14 +1688,14 @@ SND_SOC_DAPM_MIXER("DAC1R Mixer", SND_SOC_NOPM, 0, 0,
                    dac1r_mix, ARRAY_SIZE(dac1r_mix)),
 
 SND_SOC_DAPM_AIF_OUT("AIF2ADCL", NULL, 0,
-                     WM8994_POWER_MANAGEMENT_4, 13, 0),
+                     SND_SOC_NOPM, 13, 0),
 SND_SOC_DAPM_AIF_OUT("AIF2ADCR", NULL, 0,
-                     WM8994_POWER_MANAGEMENT_4, 12, 0),
+                     SND_SOC_NOPM, 12, 0),
 SND_SOC_DAPM_AIF_IN_E("AIF2DACL", NULL, 0,
-                      WM8994_POWER_MANAGEMENT_5, 13, 0, wm8958_aif_ev,
+                      SND_SOC_NOPM, 13, 0, wm8958_aif_ev,
                       SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
 SND_SOC_DAPM_AIF_IN_E("AIF2DACR", NULL, 0,
-                      WM8994_POWER_MANAGEMENT_5, 12, 0, wm8958_aif_ev,
+                      SND_SOC_NOPM, 12, 0, wm8958_aif_ev,
                       SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
 
 SND_SOC_DAPM_AIF_IN("AIF1DACDAT", NULL, 0, SND_SOC_NOPM, 0, 0),
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index f13f2886339c..6c028c470601 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -1035,7 +1035,7 @@ void wm_hubs_set_bias_level(struct snd_soc_codec *codec,
                             enum snd_soc_bias_level level)
 {
         struct wm_hubs_data *hubs = snd_soc_codec_get_drvdata(codec);
-        int val;
+        int mask, val;
 
         switch (level) {
         case SND_SOC_BIAS_STANDBY:
@@ -1047,6 +1047,13 @@ void wm_hubs_set_bias_level(struct snd_soc_codec *codec,
         case SND_SOC_BIAS_ON:
                 /* Turn off any unneded single ended outputs */
                 val = 0;
+                mask = 0;
+
+                if (hubs->lineout1_se)
+                        mask |= WM8993_LINEOUT1N_ENA | WM8993_LINEOUT1P_ENA;
+
+                if (hubs->lineout2_se)
+                        mask |= WM8993_LINEOUT2N_ENA | WM8993_LINEOUT2P_ENA;
 
                 if (hubs->lineout1_se && hubs->lineout1n_ena)
                         val |= WM8993_LINEOUT1N_ENA;
@@ -1061,11 +1068,7 @@ void wm_hubs_set_bias_level(struct snd_soc_codec *codec,
                         val |= WM8993_LINEOUT2P_ENA;
 
                 snd_soc_update_bits(codec, WM8993_POWER_MANAGEMENT_3,
-                                    WM8993_LINEOUT1N_ENA |
-                                    WM8993_LINEOUT1P_ENA |
-                                    WM8993_LINEOUT2N_ENA |
-                                    WM8993_LINEOUT2P_ENA,
-                                    val);
+                                    mask, val);
 
                 /* Remove the input clamps */
                 snd_soc_update_bits(codec, WM8993_INPUTS_CLAMP_REG,
diff --git a/sound/soc/imx/imx-audmux.c b/sound/soc/imx/imx-audmux.c
index 1765a197acb0..f23700359c67 100644
--- a/sound/soc/imx/imx-audmux.c
+++ b/sound/soc/imx/imx-audmux.c
@@ -73,6 +73,9 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf,
         if (!buf)
                 return -ENOMEM;
 
+        if (!audmux_base)
+                return -ENOSYS;
+
         if (audmux_clk)
                 clk_prepare_enable(audmux_clk);
 
@@ -152,7 +155,7 @@ static void __init audmux_debugfs_init(void)
                 return;
         }
 
-        for (i = 1; i < 8; i++) {
+        for (i = 0; i < MX31_AUDMUX_PORT6_SSI_PINS_6 + 1; i++) {
                 snprintf(buf, sizeof(buf), "ssi%d", i);
                 if (!debugfs_create_file(buf, 0444, audmux_debugfs_root,
                                          (void *)i, &audmux_debugfs_fops))
diff --git a/sound/soc/omap/Kconfig b/sound/soc/omap/Kconfig
index e00dd0b1139c..deafbfaacdbf 100644
--- a/sound/soc/omap/Kconfig
+++ b/sound/soc/omap/Kconfig
@@ -97,7 +97,7 @@ config SND_OMAP_SOC_SDP3430
 
 config SND_OMAP_SOC_OMAP_ABE_TWL6040
         tristate "SoC Audio support for OMAP boards using ABE and twl6040 codec"
-        depends on TWL4030_CORE && SND_OMAP_SOC && ARCH_OMAP4
+        depends on TWL6040_CORE && SND_OMAP_SOC && ARCH_OMAP4
         select SND_OMAP_SOC_DMIC
         select SND_OMAP_SOC_MCPDM
         select SND_SOC_TWL6040
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index a59bd352d342..5a649da9122a 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -401,6 +401,10 @@ static int omap_pcm_new(struct snd_soc_pcm_runtime *rtd)
         }
 
 out:
+        /* free preallocated buffers in case of error */
+        if (ret)
+                omap_pcm_free_dma_buffers(pcm);
+
         return ret;
 }
 
diff --git a/sound/soc/pxa/pxa2xx-i2s.c b/sound/soc/pxa/pxa2xx-i2s.c
index 609abd51e55f..d08583790d23 100644
--- a/sound/soc/pxa/pxa2xx-i2s.c
+++ b/sound/soc/pxa/pxa2xx-i2s.c
@@ -17,6 +17,7 @@
 #include <linux/delay.h>
 #include <linux/clk.h>
 #include <linux/platform_device.h>
+#include <linux/io.h>
 #include <sound/core.h>
 #include <sound/pcm.h>
 #include <sound/initval.h>
diff --git a/sound/soc/samsung/s3c2412-i2s.c b/sound/soc/samsung/s3c2412-i2s.c
index 72185078ddf8..79fbeea99d46 100644
--- a/sound/soc/samsung/s3c2412-i2s.c
+++ b/sound/soc/samsung/s3c2412-i2s.c
@@ -166,7 +166,7 @@ static struct snd_soc_dai_driver s3c2412_i2s_dai = {
 
 static __devinit int s3c2412_iis_dev_probe(struct platform_device *pdev)
 {
-        return snd_soc_register_dai(&pdev->dev, &s3c2412_i2s_dai);
+        return s3c_i2sv2_register_dai(&pdev->dev, -1, &s3c2412_i2s_dai);
 }
 
 static __devexit int s3c2412_iis_dev_remove(struct platform_device *pdev)
diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
index 378cc5b056d7..74ed2dffbffd 100644
--- a/sound/soc/sh/fsi.c
+++ b/sound/soc/sh/fsi.c
@@ -1001,11 +1001,10 @@ static void fsi_dma_do_tasklet(unsigned long data)
         sg_dma_address(&sg) = buf;
         sg_dma_len(&sg) = len;
 
-        desc = chan->device->device_prep_slave_sg(chan, &sg, 1, dir,
-                                                  DMA_PREP_INTERRUPT |
-                                                  DMA_CTRL_ACK);
+        desc = dmaengine_prep_slave_sg(chan, &sg, 1, dir,
+                                       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
         if (!desc) {
-                dev_err(dai->dev, "device_prep_slave_sg() fail\n");
+                dev_err(dai->dev, "dmaengine_prep_slave_sg() fail\n");
                 return;
         }
 
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index e19c24ade414..c88d9741b9e7 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1081,6 +1081,8 @@ static int soc_probe_platform(struct snd_soc_card *card,
                 snd_soc_dapm_new_controls(&platform->dapm,
                         driver->dapm_widgets, driver->num_dapm_widgets);
 
+        platform->dapm.idle_bias_off = 1;
+
         if (driver->probe) {
                 ret = driver->probe(platform);
                 if (ret < 0) {
@@ -3111,6 +3113,7 @@ int snd_soc_register_card(struct snd_soc_card *card)
                                  GFP_KERNEL);
         if (card->rtd == NULL)
                 return -ENOMEM;
+        card->num_rtd = 0;
         card->rtd_aux = &card->rtd[card->num_links];
 
         for (i = 0; i < card->num_links; i++)
@@ -3622,10 +3625,10 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
         int i, ret;
 
         num_routes = of_property_count_strings(np, propname);
-        if (num_routes & 1) {
+        if (num_routes < 0 || num_routes & 1) {
                 dev_err(card->dev,
-                        "Property '%s's length is not even\n",
-                        propname);
+                     "Property '%s' does not exist or its length is not even\n",
+                     propname);
                 return -EINVAL;
         }
         num_routes /= 2;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 5cbd2d7623b8..1bb6d4a63cd8 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -67,6 +67,7 @@ static int dapm_up_seq[] = {
         [snd_soc_dapm_out_drv] = 10,
         [snd_soc_dapm_hp] = 10,
         [snd_soc_dapm_spk] = 10,
+        [snd_soc_dapm_line] = 10,
         [snd_soc_dapm_post] = 11,
 };
 
@@ -75,6 +76,7 @@ static int dapm_down_seq[] = {
         [snd_soc_dapm_adc] = 1,
         [snd_soc_dapm_hp] = 2,
         [snd_soc_dapm_spk] = 2,
+        [snd_soc_dapm_line] = 2,
         [snd_soc_dapm_out_drv] = 2,
         [snd_soc_dapm_pga] = 4,
         [snd_soc_dapm_mixer_named_ctl] = 5,
diff --git a/sound/soc/tegra/tegra_i2s.c b/sound/soc/tegra/tegra_i2s.c
index 33509de52540..e53349912b2e 100644
--- a/sound/soc/tegra/tegra_i2s.c
+++ b/sound/soc/tegra/tegra_i2s.c
@@ -79,11 +79,15 @@ static int tegra_i2s_show(struct seq_file *s, void *unused)
         struct tegra_i2s *i2s = s->private;
         int i;
 
+        clk_enable(i2s->clk_i2s);
+
         for (i = 0; i < ARRAY_SIZE(regs); i++) {
                 u32 val = tegra_i2s_read(i2s, regs[i].offset);
                 seq_printf(s, "%s = %08x\n", regs[i].name, val);
         }
 
+        clk_disable(i2s->clk_i2s);
+
         return 0;
 }
 
@@ -112,7 +116,7 @@ static void tegra_i2s_debug_remove(struct tegra_i2s *i2s)
                 debugfs_remove(i2s->debug);
 }
 #else
-static inline void tegra_i2s_debug_add(struct tegra_i2s *i2s, int id)
+static inline void tegra_i2s_debug_add(struct tegra_i2s *i2s)
 {
 }
 
diff --git a/sound/soc/tegra/tegra_spdif.c b/sound/soc/tegra/tegra_spdif.c
index 475428cf270e..9ff2c601445f 100644
--- a/sound/soc/tegra/tegra_spdif.c
+++ b/sound/soc/tegra/tegra_spdif.c
@@ -79,11 +79,15 @@ static int tegra_spdif_show(struct seq_file *s, void *unused)
         struct tegra_spdif *spdif = s->private;
         int i;
 
+        clk_enable(spdif->clk_spdif_out);
+
         for (i = 0; i < ARRAY_SIZE(regs); i++) {
                 u32 val = tegra_spdif_read(spdif, regs[i].offset);
                 seq_printf(s, "%s = %08x\n", regs[i].name, val);
         }
 
+        clk_disable(spdif->clk_spdif_out);
+
         return 0;
 }
 
diff --git a/tools/perf/.gitignore b/tools/perf/.gitignore
index 416684be0ad3..26b823b61aa1 100644
--- a/tools/perf/.gitignore
+++ b/tools/perf/.gitignore
@@ -19,3 +19,5 @@ TAGS
 cscope*
 config.mak
 config.mak.autogen
+*-bison.*
+*-flex.*
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 820371f10d1b..9bf3fc759344 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -234,24 +234,23 @@ endif
 
 export PERL_PATH
 
-FLEX = $(CROSS_COMPILE)flex
-BISON= $(CROSS_COMPILE)bison
+FLEX = flex
+BISON= bison
 
-event-parser:
-        $(QUIET_BISON)$(BISON) -v util/parse-events.y -d -o $(OUTPUT)util/parse-events-bison.c
+$(OUTPUT)util/parse-events-flex.c: util/parse-events.l
         $(QUIET_FLEX)$(FLEX) --header-file=$(OUTPUT)util/parse-events-flex.h -t util/parse-events.l > $(OUTPUT)util/parse-events-flex.c
 
-$(OUTPUT)util/parse-events-flex.c: event-parser
-$(OUTPUT)util/parse-events-bison.c: event-parser
+$(OUTPUT)util/parse-events-bison.c: util/parse-events.y
+        $(QUIET_BISON)$(BISON) -v util/parse-events.y -d -o $(OUTPUT)util/parse-events-bison.c
 
-pmu-parser:
-        $(QUIET_BISON)$(BISON) -v util/pmu.y -d -o $(OUTPUT)util/pmu-bison.c
+$(OUTPUT)util/pmu-flex.c: util/pmu.l
         $(QUIET_FLEX)$(FLEX) --header-file=$(OUTPUT)util/pmu-flex.h -t util/pmu.l > $(OUTPUT)util/pmu-flex.c
 
-$(OUTPUT)util/pmu-flex.c: pmu-parser
-$(OUTPUT)util/pmu-bison.c: pmu-parser
+$(OUTPUT)util/pmu-bison.c: util/pmu.y
+        $(QUIET_BISON)$(BISON) -v util/pmu.y -d -o $(OUTPUT)util/pmu-bison.c
 
-$(OUTPUT)util/parse-events.o: event-parser pmu-parser
+$(OUTPUT)util/parse-events.o: $(OUTPUT)util/parse-events-flex.c $(OUTPUT)util/parse-events-bison.c
+$(OUTPUT)util/pmu.o: $(OUTPUT)util/pmu-flex.c $(OUTPUT)util/pmu-bison.c
 
 LIB_FILE=$(OUTPUT)libperf.a
 
@@ -527,7 +526,7 @@ else
 endif
 
 ifdef NO_GTK2
-        BASIC_CFLAGS += -DNO_GTK2
+        BASIC_CFLAGS += -DNO_GTK2_SUPPORT
 else
         FLAGS_GTK2=$(ALL_CFLAGS) $(ALL_LDFLAGS) $(EXTLIBS) $(shell pkg-config --libs --cflags gtk+-2.0)
         ifneq ($(call try-cc,$(SOURCE_GTK2),$(FLAGS_GTK2)),y)
@@ -852,8 +851,6 @@ help:
         @echo '  html           - make html documentation'
         @echo '  info           - make GNU info documentation (access with info <foo>)'
         @echo '  pdf            - make pdf documentation'
-        @echo '  event-parser   - make event parser code'
-        @echo '  pmu-parser     - make pmu format parser code'
         @echo '  TAGS           - use etags to make tag information for source browsing'
         @echo '  tags           - use ctags to make tag information for source browsing'
         @echo '  cscope - use cscope to make interactive browsing database'
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 2e317438980b..cdae9b2db1cc 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -374,16 +374,23 @@ static int __cmd_report(struct perf_report *rep)
             (kernel_map->dso->hit &&
              (kernel_kmap->ref_reloc_sym == NULL ||
               kernel_kmap->ref_reloc_sym->addr == 0))) {
-                const struct dso *kdso = kernel_map->dso;
+                const char *desc =
+                    "As no suitable kallsyms nor vmlinux was found, kernel samples\n"
+                    "can't be resolved.";
+
+                if (kernel_map) {
+                        const struct dso *kdso = kernel_map->dso;
+                        if (!RB_EMPTY_ROOT(&kdso->symbols[MAP__FUNCTION])) {
+                                desc = "If some relocation was applied (e.g. "
+                                       "kexec) symbols may be misresolved.";
+                        }
+                }
 
                 ui__warning(
 "Kernel address maps (/proc/{kallsyms,modules}) were restricted.\n\n"
 "Check /proc/sys/kernel/kptr_restrict before running 'perf record'.\n\n%s\n\n"
 "Samples in kernel modules can't be resolved as well.\n\n",
-                            RB_EMPTY_ROOT(&kdso->symbols[MAP__FUNCTION]) ?
-"As no suitable kallsyms nor vmlinux was found, kernel samples\n"
-"can't be resolved." :
-"If some relocation was applied (e.g. kexec) symbols may be misresolved.");
+                desc);
         }
 
         if (dump_trace) {
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index fb8b5f83b4a0..1cad3af4bf4c 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -17,6 +17,7 @@
 #include "util/debug.h"
 
 #include <sys/prctl.h>
+#include <sys/resource.h>
 
 #include <semaphore.h>
 #include <pthread.h>
diff --git a/tools/perf/builtin-test.c b/tools/perf/builtin-test.c
index 1c5b9801ac61..223ffdcc0fd8 100644
--- a/tools/perf/builtin-test.c
+++ b/tools/perf/builtin-test.c
@@ -851,6 +851,28 @@ static int test__checkevent_symbolic_name_modifier(struct perf_evlist *evlist)
         return test__checkevent_symbolic_name(evlist);
 }
 
+static int test__checkevent_exclude_host_modifier(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = list_entry(evlist->entries.next,
+                                              struct perf_evsel, node);
+
+        TEST_ASSERT_VAL("wrong exclude guest", !evsel->attr.exclude_guest);
+        TEST_ASSERT_VAL("wrong exclude host", evsel->attr.exclude_host);
+
+        return test__checkevent_symbolic_name(evlist);
+}
+
+static int test__checkevent_exclude_guest_modifier(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel = list_entry(evlist->entries.next,
+                                              struct perf_evsel, node);
+
+        TEST_ASSERT_VAL("wrong exclude guest", evsel->attr.exclude_guest);
+        TEST_ASSERT_VAL("wrong exclude host", !evsel->attr.exclude_host);
+
+        return test__checkevent_symbolic_name(evlist);
+}
+
 static int test__checkevent_symbolic_alias_modifier(struct perf_evlist *evlist)
 {
         struct perf_evsel *evsel = list_entry(evlist->entries.next,
@@ -1091,6 +1113,14 @@ static struct test__event_st {
                 .name  = "r1,syscalls:sys_enter_open:k,1:1:hp",
                 .check = test__checkevent_list,
         },
+        {
+                .name  = "instructions:G",
+                .check = test__checkevent_exclude_host_modifier,
+        },
+        {
+                .name  = "instructions:H",
+                .check = test__checkevent_exclude_guest_modifier,
+        },
 };
 
 #define TEST__EVENTS_CNT (sizeof(test__events) / sizeof(struct test__event_st))
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index e3c63aef8efc..8ef59f8262bb 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -42,6 +42,7 @@
 #include "util/debug.h"
 
 #include <assert.h>
+#include <elf.h>
 #include <fcntl.h>
 
 #include <stdio.h>
@@ -59,6 +60,7 @@
 #include <sys/prctl.h>
 #include <sys/wait.h>
 #include <sys/uio.h>
+#include <sys/utsname.h>
 #include <sys/mman.h>
 
 #include <linux/unistd.h>
@@ -162,12 +164,40 @@ static void __zero_source_counters(struct hist_entry *he)
         symbol__annotate_zero_histograms(sym);
 }
 
+static void ui__warn_map_erange(struct map *map, struct symbol *sym, u64 ip)
+{
+        struct utsname uts;
+        int err = uname(&uts);
+
+        ui__warning("Out of bounds address found:\n\n"
+                    "Addr:   %" PRIx64 "\n"
+                    "DSO:    %s %c\n"
+                    "Map:    %" PRIx64 "-%" PRIx64 "\n"
+                    "Symbol: %" PRIx64 "-%" PRIx64 " %c %s\n"
+                    "Arch:   %s\n"
+                    "Kernel: %s\n"
+                    "Tools:  %s\n\n"
+                    "Not all samples will be on the annotation output.\n\n"
+                    "Please report to linux-kernel@vger.kernel.org\n",
+                    ip, map->dso->long_name, dso__symtab_origin(map->dso),
+                    map->start, map->end, sym->start, sym->end,
+                    sym->binding == STB_GLOBAL ? 'g' :
+                    sym->binding == STB_LOCAL  ? 'l' : 'w', sym->name,
+                    err ? "[unknown]" : uts.machine,
+                    err ? "[unknown]" : uts.release, perf_version_string);
+        if (use_browser <= 0)
+                sleep(5);
+        
+        map->erange_warned = true;
+}
+
 static void perf_top__record_precise_ip(struct perf_top *top,
                                         struct hist_entry *he,
                                         int counter, u64 ip)
 {
         struct annotation *notes;
         struct symbol *sym;
+        int err;
 
         if (he == NULL || he->ms.sym == NULL ||
             ((top->sym_filter_entry == NULL ||
@@ -189,9 +219,12 @@ static void perf_top__record_precise_ip(struct perf_top *top,
         }
 
         ip = he->ms.map->map_ip(he->ms.map, ip);
-        symbol__inc_addr_samples(sym, he->ms.map, counter, ip);
+        err = symbol__inc_addr_samples(sym, he->ms.map, counter, ip);
 
         pthread_mutex_unlock(&notes->lock);
+
+        if (err == -ERANGE && !he->ms.map->erange_warned)
+                ui__warn_map_erange(he->ms.map, sym, ip);
 }
 
 static void perf_top__show_details(struct perf_top *top)
@@ -615,6 +648,7 @@ process_hotkey:
 
 /* Tag samples to be skipped. */
 static const char *skip_symbols[] = {
+        "intel_idle",
         "default_idle",
         "native_safe_halt",
         "cpu_idle",
diff --git a/tools/perf/perf-archive.sh b/tools/perf/perf-archive.sh
index 677e59d62a8d..95b6f8b6177a 100644
--- a/tools/perf/perf-archive.sh
+++ b/tools/perf/perf-archive.sh
@@ -29,13 +29,14 @@ if [ ! -s $BUILDIDS ] ; then
 fi
 
 MANIFEST=$(mktemp /tmp/perf-archive-manifest.XXXXXX)
+PERF_BUILDID_LINKDIR=$(readlink -f $PERF_BUILDID_DIR)/
 
 cut -d ' ' -f 1 $BUILDIDS | \
 while read build_id ; do
         linkname=$PERF_BUILDID_DIR.build-id/${build_id:0:2}/${build_id:2}
         filename=$(readlink -f $linkname)
         echo ${linkname#$PERF_BUILDID_DIR} >> $MANIFEST
-        echo ${filename#$PERF_BUILDID_DIR} >> $MANIFEST
+        echo ${filename#$PERF_BUILDID_LINKDIR} >> $MANIFEST
 done
 
 tar cfj $PERF_DATA.tar.bz2 -C $PERF_BUILDID_DIR -T $MANIFEST
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 199f69ec656f..08c6d138a655 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -64,8 +64,8 @@ int symbol__inc_addr_samples(struct symbol *sym, struct map *map,
 
         pr_debug3("%s: addr=%#" PRIx64 "\n", __func__, map->unmap_ip(map, addr));
 
-        if (addr > sym->end)
-                return 0;
+        if (addr < sym->start || addr > sym->end)
+                return -ERANGE;
 
         offset = addr - sym->start;
         h = annotation__histogram(notes, evidx);
@@ -561,16 +561,12 @@ void symbol__annotate_decay_histogram(struct symbol *sym, int evidx)
 {
         struct annotation *notes = symbol__annotation(sym);
         struct sym_hist *h = annotation__histogram(notes, evidx);
-        struct objdump_line *pos;
-        int len = sym->end - sym->start;
+        int len = sym->end - sym->start, offset;
 
         h->sum = 0;
-
-        list_for_each_entry(pos, &notes->src->source, node) {
-                if (pos->offset != -1 && pos->offset < len) {
-                        h->addr[pos->offset] = h->addr[pos->offset] * 7 / 8;
-                        h->sum += h->addr[pos->offset];
-                }
+        for (offset = 0; offset < len; ++offset) {
+                h->addr[offset] = h->addr[offset] * 7 / 8;
+                h->sum += h->addr[offset];
         }
 }
 
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 2ec4b60aff6c..9f6d630d5316 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -256,6 +256,18 @@ static struct hist_entry *add_hist_entry(struct hists *hists,
                 if (!cmp) {
                         he->period += period;
                         ++he->nr_events;
+
+                        /* If the map of an existing hist_entry has
+                         * become out-of-date due to an exec() or
+                         * similar, update it.  Otherwise we will
+                         * mis-adjust symbol addresses when computing
+                         * the history counter to increment.
+                         */
+                        if (he->ms.map != entry->ms.map) {
+                                he->ms.map = entry->ms.map;
+                                if (he->ms.map)
+                                        he->ms.map->referenced = true;
+                        }
                         goto out;
                 }
 
diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
index dea6d1c1a954..35ae56864e4f 100644
--- a/tools/perf/util/map.c
+++ b/tools/perf/util/map.c
@@ -38,6 +38,7 @@ void map__init(struct map *self, enum map_type type,
         RB_CLEAR_NODE(&self->rb_node);
         self->groups   = NULL;
         self->referenced = false;
+        self->erange_warned = false;
 }
 
 struct map *map__new(struct list_head *dsos__list, u64 start, u64 len,
diff --git a/tools/perf/util/map.h b/tools/perf/util/map.h
index b100c20b7f94..81371bad4ef0 100644
--- a/tools/perf/util/map.h
+++ b/tools/perf/util/map.h
@@ -33,6 +33,7 @@ struct map {
         u64                     end;
         u8 /* enum map_type */  type;
         bool                    referenced;
+        bool                    erange_warned;
         u32                     priv;
         u64                     pgoff;
 
diff --git a/tools/perf/util/parse-events.l b/tools/perf/util/parse-events.l
index 05d766e3ecb5..1fcf1bbc5458 100644
--- a/tools/perf/util/parse-events.l
+++ b/tools/perf/util/parse-events.l
@@ -54,7 +54,7 @@ num_dec		[0-9]+
 num_hex         0x[a-fA-F0-9]+
 num_raw_hex     [a-fA-F0-9]+
 name            [a-zA-Z_*?][a-zA-Z0-9_*?]*
-modifier_event  [ukhp]{1,5}
+modifier_event  [ukhpGH]{1,8}
 modifier_bp     [rwx]
 
 %%
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 9412e3b05f68..1efd3bee6336 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -826,8 +826,16 @@ static struct machine *
 {
         const u8 cpumode = event->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
 
-        if (cpumode == PERF_RECORD_MISC_GUEST_KERNEL && perf_guest)
-                return perf_session__find_machine(session, event->ip.pid);
+        if (cpumode == PERF_RECORD_MISC_GUEST_KERNEL && perf_guest) {
+                u32 pid;
+
+                if (event->header.type == PERF_RECORD_MMAP)
+                        pid = event->mmap.pid;
+                else
+                        pid = event->ip.pid;
+
+                return perf_session__find_machine(session, pid);
+        }
 
         return perf_session__find_host_machine(session);
 }
@@ -868,11 +876,11 @@ static int perf_session_deliver_event(struct perf_session *session,
                 dump_sample(session, event, sample);
                 if (evsel == NULL) {
                         ++session->hists.stats.nr_unknown_id;
-                        return -1;
+                        return 0;
                 }
                 if (machine == NULL) {
                         ++session->hists.stats.nr_unprocessable_samples;
-                        return -1;
+                        return 0;
                 }
                 return tool->sample(tool, event, sample, evsel, machine);
         case PERF_RECORD_MMAP:
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index c0a028c3ebaf..ab9867b2b433 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -977,8 +977,9 @@ static Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
  * And always look at the original dso, not at debuginfo packages, that
  * have the PLT data stripped out (shdr_rel_plt.sh_type == SHT_NOBITS).
  */
-static int dso__synthesize_plt_symbols(struct  dso *dso, struct map *map,
-                                       symbol_filter_t filter)
+static int
+dso__synthesize_plt_symbols(struct dso *dso, char *name, struct map *map,
+                            symbol_filter_t filter)
 {
         uint32_t nr_rel_entries, idx;
         GElf_Sym sym;
@@ -993,10 +994,7 @@ static int dso__synthesize_plt_symbols(struct  dso *dso, struct map *map,
         char sympltname[1024];
         Elf *elf;
         int nr = 0, symidx, fd, err = 0;
-        char name[PATH_MAX];
 
-        snprintf(name, sizeof(name), "%s%s",
-                 symbol_conf.symfs, dso->long_name);
         fd = open(name, O_RDONLY);
         if (fd < 0)
                 goto out;
@@ -1703,8 +1701,9 @@ restart:
                         continue;
 
                 if (ret > 0) {
-                        int nr_plt = dso__synthesize_plt_symbols(dso, map,
-                                                                 filter);
+                        int nr_plt;
+
+                        nr_plt = dso__synthesize_plt_symbols(dso, name, map, filter);
                         if (nr_plt > 0)
                                 ret += nr_plt;
                         break;
diff --git a/tools/perf/util/ui/browsers/hists.c b/tools/perf/util/ui/browsers/hists.c
index d7a1c4afe28b..2f83e5dc9967 100644
--- a/tools/perf/util/ui/browsers/hists.c
+++ b/tools/perf/util/ui/browsers/hists.c
@@ -125,6 +125,9 @@ static int callchain__count_rows(struct rb_root *chain)
 
 static bool map_symbol__toggle_fold(struct map_symbol *self)
 {
+        if (!self)
+                return false;
+
         if (!self->has_children)
                 return false;
 
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 95d6a6f7c33a..4915408f6a98 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -183,6 +183,9 @@ my %force_config;
 # do not force reboots on config problems
 my $no_reboot = 1;
 
+# reboot on success
+my $reboot_success = 0;
+
 my %option_map = (
     "MACHINE"                   => \$machine,
     "SSH_USER"                  => \$ssh_user,
@@ -2192,7 +2195,7 @@ sub run_bisect {
     }
 
     # Are we looking for where it worked, not failed?
-    if ($reverse_bisect) {
+    if ($reverse_bisect && $ret >= 0) {
         $ret = !$ret;
     }
 
@@ -3469,6 +3472,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 
     # Do not reboot on failing test options
     $no_reboot = 1;
+    $reboot_success = 0;
 
     $iteration = $i;
 
@@ -3554,9 +3558,11 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
             die "failed to checkout $checkout";
     }
 
+    $no_reboot = 0;
+
     # A test may opt to not reboot the box
     if ($reboot_on_success) {
-        $no_reboot = 0;
+        $reboot_success = 1;
     }
 
     if ($test_type eq "bisect") {
@@ -3600,7 +3606,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 
 if ($opt{"POWEROFF_ON_SUCCESS"}) {
     halt;
-} elsif ($opt{"REBOOT_ON_SUCCESS"} && !do_not_reboot) {
+} elsif ($opt{"REBOOT_ON_SUCCESS"} && !do_not_reboot && $reboot_success) {
     reboot_to_good;
 } elsif (defined($switch_to_good)) {
     # still need to get to the good kernel
diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
index a457d2138f49..e9fff9830bf0 100644
--- a/virt/kvm/iommu.c
+++ b/virt/kvm/iommu.c
@@ -240,9 +240,13 @@ int kvm_iommu_map_guest(struct kvm *kvm)
                 return -ENODEV;
         }
 
+        mutex_lock(&kvm->slots_lock);
+
         kvm->arch.iommu_domain = iommu_domain_alloc(&pci_bus_type);
-        if (!kvm->arch.iommu_domain)
-                return -ENOMEM;
+        if (!kvm->arch.iommu_domain) {
+                r = -ENOMEM;
+                goto out_unlock;
+        }
 
         if (!allow_unsafe_assigned_interrupts &&
             !iommu_domain_has_cap(kvm->arch.iommu_domain,
@@ -253,17 +257,16 @@ int kvm_iommu_map_guest(struct kvm *kvm)
                        " module option.\n", __func__);
                 iommu_domain_free(kvm->arch.iommu_domain);
                 kvm->arch.iommu_domain = NULL;
-                return -EPERM;
+                r = -EPERM;
+                goto out_unlock;
         }
 
         r = kvm_iommu_map_memslots(kvm);
         if (r)
-                goto out_unmap;
-
-        return 0;
+                kvm_iommu_unmap_memslots(kvm);
 
-out_unmap:
-        kvm_iommu_unmap_memslots(kvm);
+out_unlock:
+        mutex_unlock(&kvm->slots_lock);
         return r;
 }
 
@@ -310,6 +313,11 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
         }
 }
 
+void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+{
+        kvm_iommu_put_pages(kvm, slot->base_gfn, slot->npages);
+}
+
 static int kvm_iommu_unmap_memslots(struct kvm *kvm)
 {
         int idx;
@@ -320,7 +328,7 @@ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
         slots = kvm_memslots(kvm);
 
         kvm_for_each_memslot(memslot, slots)
-                kvm_iommu_put_pages(kvm, memslot->base_gfn, memslot->npages);
+                kvm_iommu_unmap_pages(kvm, memslot);
 
         srcu_read_unlock(&kvm->srcu, idx);
 
@@ -335,7 +343,11 @@ int kvm_iommu_unmap_guest(struct kvm *kvm)
         if (!domain)
                 return 0;
 
+        mutex_lock(&kvm->slots_lock);
         kvm_iommu_unmap_memslots(kvm);
+        kvm->arch.iommu_domain = NULL;
+        mutex_unlock(&kvm->slots_lock);
+
         iommu_domain_free(domain);
         return 0;
 }
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 42b73930a6de..9739b533ca2e 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -808,12 +808,13 @@ int __kvm_set_memory_region(struct kvm *kvm,
         if (r)
                 goto out_free;
 
-        /* map the pages in iommu page table */
+        /* map/unmap the pages in iommu page table */
         if (npages) {
                 r = kvm_iommu_map_pages(kvm, &new);
                 if (r)
                         goto out_free;
-        }
+        } else
+                kvm_iommu_unmap_pages(kvm, &old);
 
         r = -ENOMEM;
         slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),