Merge 3.7-rc3 into tty-next

This merges the tty changes in 3.7-rc3 into tty-next

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

449 files changed, 5600 insertions, 3850 deletions

diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index f54273e2ac97..ceb1ff735469 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -210,6 +210,8 @@ local_ops.txt
         - semantics and behavior of local atomic operations.
 lockdep-design.txt
         - documentation on the runtime locking correctness validator.
+lockup-watchdogs.txt
+        - info on soft and hard lockup detectors (aka nmi_watchdog).
 logo.gif
         - full colour GIF image of Linux logo (penguin - Tux).
 logo.txt
@@ -240,8 +242,6 @@ netlabel/
         - directory with information on the NetLabel subsystem.
 networking/
         - directory with info on various aspects of networking with Linux.
-nmi_watchdog.txt
-        - info on NMI watchdog for SMP systems.
 nommu-mmap.txt
         - documentation about no-mmu memory mapping support.
 numastat.txt
diff --git a/Documentation/devicetree/bindings/arm/atmel-at91.txt b/Documentation/devicetree/bindings/arm/atmel-at91.txt
index ecc81e368715..d187e9f7cf1c 100644
--- a/Documentation/devicetree/bindings/arm/atmel-at91.txt
+++ b/Documentation/devicetree/bindings/arm/atmel-at91.txt
@@ -8,7 +8,7 @@ PIT Timer required properties:
   shared across all System Controller members.
 
 TC/TCLIB Timer required properties:
-- compatible: Should be "atmel,<chip>-pit".
+- compatible: Should be "atmel,<chip>-tcb".
   <chip> can be "at91rm9200" or "at91sam9x5"
 - reg: Should contain registers location and length
 - interrupts: Should contain all interrupts for the TC block
diff --git a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
index c8e578263ce2..683fde93c4fb 100644
--- a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
+++ b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra20-pinmux.txt
@@ -93,7 +93,7 @@ Valid values for pin and group names are:
 
     With some exceptions, these support nvidia,high-speed-mode,
     nvidia,schmitt, nvidia,low-power-mode, nvidia,pull-down-strength,
-    nvidia,pull-up-strength, nvidia,slew_rate-rising, nvidia,slew_rate-falling.
+    nvidia,pull-up-strength, nvidia,slew-rate-rising, nvidia,slew-rate-falling.
 
     drive_ao1, drive_ao2, drive_at1, drive_at2, drive_cdev1, drive_cdev2,
     drive_csus, drive_dap1, drive_dap2, drive_dap3, drive_dap4, drive_dbg,
diff --git a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt
index c275b70349c1..6f426ed7009e 100644
--- a/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt
+++ b/Documentation/devicetree/bindings/pinctrl/nvidia,tegra30-pinmux.txt
@@ -83,7 +83,7 @@ Valid values for pin and group names are:
   drive groups:
 
     These all support nvidia,pull-down-strength, nvidia,pull-up-strength,
-    nvidia,slew_rate-rising, nvidia,slew_rate-falling. Most but not all
+    nvidia,slew-rate-rising, nvidia,slew-rate-falling. Most but not all
     support nvidia,high-speed-mode, nvidia,schmitt, nvidia,low-power-mode.
 
     ao1, ao2, at1, at2, at3, at4, at5, cdev1, cdev2, cec, crt, csus, dap1,
diff --git a/Documentation/firmware_class/README b/Documentation/firmware_class/README
index 7eceaff63f5f..815b711bcd85 100644
--- a/Documentation/firmware_class/README
+++ b/Documentation/firmware_class/README
@@ -18,32 +18,40 @@
  High level behavior (mixed):
  ============================
 
- kernel(driver): calls request_firmware(&fw_entry, $FIRMWARE, device)
-
- userspace:
+ 1), kernel(driver):
+        - calls request_firmware(&fw_entry, $FIRMWARE, device)
+        - kernel searchs the fimware image with name $FIRMWARE directly
+        in the below search path of root filesystem:
+                "/lib/firmware/updates/" UTS_RELEASE,
+                "/lib/firmware/updates",
+                "/lib/firmware/" UTS_RELEASE,
+                "/lib/firmware"
+        - If found, goto 7), else goto 2)
+
+ 2), userspace:
         - /sys/class/firmware/xxx/{loading,data} appear.
         - hotplug gets called with a firmware identifier in $FIRMWARE
           and the usual hotplug environment.
                 - hotplug: echo 1 > /sys/class/firmware/xxx/loading
 
- kernel: Discard any previous partial load.
+ 3), kernel: Discard any previous partial load.
 
- userspace:
+ 4), userspace:
                 - hotplug: cat appropriate_firmware_image > \
                                         /sys/class/firmware/xxx/data
 
- kernel: grows a buffer in PAGE_SIZE increments to hold the image as it
+ 5), kernel: grows a buffer in PAGE_SIZE increments to hold the image as it
          comes in.
 
- userspace:
+ 6), userspace:
                 - hotplug: echo 0 > /sys/class/firmware/xxx/loading
 
- kernel: request_firmware() returns and the driver has the firmware
+ 7), kernel: request_firmware() returns and the driver has the firmware
          image in fw_entry->{data,size}. If something went wrong
          request_firmware() returns non-zero and fw_entry is set to
          NULL.
 
- kernel(driver): Driver code calls release_firmware(fw_entry) releasing
+ 8), kernel(driver): Driver code calls release_firmware(fw_entry) releasing
                  the firmware image and any related resource.
 
  High level behavior (driver code):
diff --git a/Documentation/zh_CN/IRQ.txt b/Documentation/zh_CN/IRQ.txt
new file mode 100644
index 000000000000..956026d5cf82
--- /dev/null
+++ b/Documentation/zh_CN/IRQ.txt
@@ -0,0 +1,39 @@
+Chinese translated version of Documentation/IRQ.txt
+
+If you have any comment or update to the content, please contact the
+original document maintainer directly.  However, if you have a problem
+communicating in English you can also ask the Chinese maintainer for
+help.  Contact the Chinese maintainer if this translation is outdated
+or if there is a problem with the translation.
+
+Maintainer: Eric W. Biederman <ebiederman@xmission.com>
+Chinese maintainer: Fu Wei <tekkamanninja@gmail.com>
+---------------------------------------------------------------------
+Documentation/IRQ.txt 的中文翻译
+
+如果想评论或更新本文的内容，请直接联系原文档的维护者。如果你使用英文
+交流有困难的话，也可以向中文版维护者求助。如果本翻译更新不及时或者翻
+译存在问题，请联系中文版维护者。
+英文版维护者： Eric W. Biederman <ebiederman@xmission.com>
+中文版维护者： 傅炜 Fu Wei <tekkamanninja@gmail.com>
+中文版翻译者： 傅炜 Fu Wei <tekkamanninja@gmail.com>
+中文版校译者： 傅炜 Fu Wei <tekkamanninja@gmail.com>
+
+
+以下为正文
+---------------------------------------------------------------------
+何为 IRQ?
+
+一个 IRQ 是来自某个设备的一个中断请求。目前，它们可以来自一个硬件引脚，
+或来自一个数据包。多个设备可能连接到同个硬件引脚，从而共享一个 IRQ。
+
+一个 IRQ 编号是用于告知硬件中断源的内核标识。通常情况下，这是一个
+全局 irq_desc 数组的索引，但是除了在 linux/interrupt.h 中的实现，
+具体的细节是体系结构特定的。
+
+一个 IRQ 编号是设备上某个可能的中断源的枚举。通常情况下，枚举的编号是
+该引脚在系统内中断控制器的所有输入引脚中的编号。对于 ISA 总线中的情况，
+枚举的是在两个 i8259 中断控制器中 16 个输入引脚。
+
+架构可以对 IRQ 编号指定额外的含义，在硬件涉及任何手工配置的情况下，
+是被提倡的。ISA 的 IRQ 是一个分配这类额外含义的典型例子。
diff --git a/Documentation/zh_CN/arm64/booting.txt b/Documentation/zh_CN/arm64/booting.txt
new file mode 100644
index 000000000000..28fa325b7461
--- /dev/null
+++ b/Documentation/zh_CN/arm64/booting.txt
@@ -0,0 +1,156 @@
+Chinese translated version of Documentation/arm64/booting.txt
+
+If you have any comment or update to the content, please contact the
+original document maintainer directly.  However, if you have a problem
+communicating in English you can also ask the Chinese maintainer for
+help.  Contact the Chinese maintainer if this translation is outdated
+or if there is a problem with the translation.
+
+Maintainer: Will Deacon <will.deacon@arm.com>
+Chinese maintainer: Fu Wei <tekkamanninja@gmail.com>
+---------------------------------------------------------------------
+Documentation/arm64/booting.txt 的中文翻译
+
+如果想评论或更新本文的内容，请直接联系原文档的维护者。如果你使用英文
+交流有困难的话，也可以向中文版维护者求助。如果本翻译更新不及时或者翻
+译存在问题，请联系中文版维护者。
+
+英文版维护者： Will Deacon <will.deacon@arm.com>
+中文版维护者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
+中文版翻译者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
+中文版校译者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
+
+以下为正文
+---------------------------------------------------------------------
+                        启动 AArch64 Linux
+                        ==================
+
+作者: Will Deacon <will.deacon@arm.com>
+日期: 2012 年 09 月 07 日
+
+本文档基于 Russell King 的 ARM 启动文档，且适用于所有公开发布的
+AArch64 Linux 内核代码。
+
+AArch64 异常模型由多个异常级别（EL0 - EL3）组成，对于 EL0 和 EL1
+异常级有对应的安全和非安全模式。EL2 是系统管理级，且仅存在于
+非安全模式下。EL3 是最高特权级，且仅存在于安全模式下。
+
+基于本文档的目的，我们将简单地使用‘引导装载程序’（‘boot loader’）
+这个术语来定义在将控制权交给 Linux 内核前 CPU 上执行的所有软件。
+这可能包含安全监控和系统管理代码，或者它可能只是一些用于准备最小启动
+环境的指令。
+
+基本上，引导装载程序（至少）应实现以下操作：
+
+1、设置和初始化 RAM
+2、设置设备树数据
+3、解压内核映像
+4、调用内核映像
+
+
+1、设置和初始化 RAM
+-----------------
+
+必要性: 强制
+
+引导装载程序应该找到并初始化系统中所有内核用于保持系统变量数据的 RAM。
+这个操作的执行是设备依赖的。（它可能使用内部算法来自动定位和计算所有
+RAM，或可能使用对这个设备已知的 RAM 信息，还可能使用任何引导装载程序
+设计者想到的匹配方法。）
+
+
+2、设置设备树数据
+---------------
+
+必要性: 强制
+
+设备树数据块（dtb）大小必须不大于 2 MB，且位于从内核映像起始算起第一个
+512MB 内的 2MB 边界上。这使得内核可以通过初始页表中的单个节描述符来
+映射此数据块。
+
+
+3、解压内核映像
+-------------
+
+必要性: 可选
+
+AArch64 内核当前没有提供自解压代码，因此如果使用了压缩内核映像文件
+（比如 Image.gz），则需要通过引导装载程序（使用 gzip 等）来进行解压。
+若引导装载程序没有实现这个需求，就要使用非压缩内核映像文件。
+
+
+4、调用内核映像
+-------------
+
+必要性: 强制
+
+已解压的内核映像包含一个 32 字节的头，内容如下：
+
+  u32 magic     = 0x14000008;   /* 跳转到 stext, 小端 */
+  u32 res0      = 0;            /* 保留 */
+  u64 text_offset;              /* 映像装载偏移 */
+  u64 res1      = 0;            /* 保留 */
+  u64 res2      = 0;            /* 保留 */
+
+映像必须位于系统 RAM 起始处的特定偏移（当前是 0x80000）。系统 RAM
+的起始地址必须是以 2MB 对齐的。
+
+在跳转入内核前，必须符合以下状态：
+
+- 停止所有 DMA 设备，这样内存数据就不会因为虚假网络包或磁盘数据而
+  被破坏。这可能可以节省你许多的调试时间。
+
+- 主 CPU 通用寄存器设置
+  x0 = 系统 RAM 中设备树数据块（dtb）的物理地址。
+  x1 = 0 (保留，将来可能使用)
+  x2 = 0 (保留，将来可能使用)
+  x3 = 0 (保留，将来可能使用)
+
+- CPU 模式
+  所有形式的中断必须在 PSTATE.DAIF 中被屏蔽（Debug、SError、IRQ
+  和 FIQ）。
+  CPU 必须处于 EL2（推荐，可访问虚拟化扩展）或非安全 EL1 模式下。
+
+- 高速缓存、MMU
+  MMU 必须关闭。
+  指令缓存开启或关闭都可以。
+  数据缓存必须关闭且无效。
+  外部高速缓存（如果存在）必须配置并禁用。
+
+- 架构计时器
+  CNTFRQ 必须设定为计时器的频率。
+  如果在 EL1 模式下进入内核，则 CNTHCTL_EL2 中的 EL1PCTEN (bit 0)
+  必须置位。
+
+- 一致性
+  通过内核启动的所有 CPU 在内核入口地址上必须处于相同的一致性域中。
+  这可能要根据具体实现来定义初始化过程，以使能每个CPU上对维护操作的
+  接收。
+
+- 系统寄存器
+  在进入内核映像的异常级中，所有构架中可写的系统寄存器必须通过软件
+  在一个更高的异常级别下初始化，以防止在 未知 状态下运行。
+
+引导装载程序必须在每个 CPU 处于以下状态时跳入内核入口：
+
+- 主 CPU 必须直接跳入内核映像的第一条指令。通过此 CPU 传递的设备树
+  数据块必须在每个 CPU 节点中包含以下内容：
+
+    1、‘enable-method’属性。目前，此字段支持的值仅为字符串“spin-table”。
+
+    2、‘cpu-release-addr’标识一个 64-bit、初始化为零的内存位置。
+
+  引导装载程序必须生成这些设备树属性，并在跳入内核入口之前将其插入
+  数据块。
+
+- 任何辅助 CPU 必须在内存保留区（通过设备树中的 /memreserve/ 域传递
+  给内核）中自旋于内核之外，轮询它们的 cpu-release-addr 位置（必须
+  包含在保留区中）。可通过插入 wfe 指令来降低忙循环开销，而主 CPU 将
+  发出 sev 指令。当对 cpu-release-addr 所指位置的读取操作返回非零值
+  时，CPU 必须直接跳入此值所指向的地址。
+
+- 辅助 CPU 通用寄存器设置
+  x0 = 0 (保留，将来可能使用)
+  x1 = 0 (保留，将来可能使用)
+  x2 = 0 (保留，将来可能使用)
+  x3 = 0 (保留，将来可能使用)
diff --git a/Documentation/zh_CN/arm64/memory.txt b/Documentation/zh_CN/arm64/memory.txt
new file mode 100644
index 000000000000..83b519314706
--- /dev/null
+++ b/Documentation/zh_CN/arm64/memory.txt
@@ -0,0 +1,93 @@
+Chinese translated version of Documentation/arm64/memory.txt
+
+If you have any comment or update to the content, please contact the
+original document maintainer directly.  However, if you have a problem
+communicating in English you can also ask the Chinese maintainer for
+help.  Contact the Chinese maintainer if this translation is outdated
+or if there is a problem with the translation.
+
+Maintainer: Catalin Marinas <catalin.marinas@arm.com>
+Chinese maintainer: Fu Wei <tekkamanninja@gmail.com>
+---------------------------------------------------------------------
+Documentation/arm64/memory.txt 的中文翻译
+
+如果想评论或更新本文的内容，请直接联系原文档的维护者。如果你使用英文
+交流有困难的话，也可以向中文版维护者求助。如果本翻译更新不及时或者翻
+译存在问题，请联系中文版维护者。
+
+英文版维护者： Catalin Marinas <catalin.marinas@arm.com>
+中文版维护者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
+中文版翻译者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
+中文版校译者： 傅炜  Fu Wei <tekkamanninja@gmail.com>
+
+以下为正文
+---------------------------------------------------------------------
+                     Linux 在 AArch64 中的内存布局
+                     ===========================
+
+作者: Catalin Marinas <catalin.marinas@arm.com>
+日期: 2012 年 02 月 20 日
+
+本文档描述 AArch64 Linux 内核所使用的虚拟内存布局。此构架可以实现
+页大小为 4KB 的 4 级转换表和页大小为 64KB 的 3 级转换表。
+
+AArch64 Linux 使用页大小为 4KB 的 3 级转换表配置，对于用户和内核
+都有 39-bit (512GB) 的虚拟地址空间。对于页大小为 64KB的配置，仅
+使用 2 级转换表，但内存布局相同。
+
+用户地址空间的 63:39 位为 0，而内核地址空间的相应位为 1。TTBRx 的
+选择由虚拟地址的 63 位给出。swapper_pg_dir 仅包含内核（全局）映射，
+而用户 pgd 仅包含用户（非全局）映射。swapper_pgd_dir 地址被写入
+TTBR1 中，且从不写入 TTBR0。
+
+
+AArch64 Linux 内存布局：
+
+起始地址                    结束地址                    大小          用途
+-----------------------------------------------------------------------
+0000000000000000        0000007fffffffff         512GB          用户空间
+
+ffffff8000000000        ffffffbbfffcffff        ~240GB          vmalloc
+
+ffffffbbfffd0000        ffffffbcfffdffff          64KB          [防护页]
+
+ffffffbbfffe0000        ffffffbcfffeffff          64KB          PCI I/O 空间
+
+ffffffbbffff0000        ffffffbcffffffff          64KB          [防护页]
+
+ffffffbc00000000        ffffffbdffffffff           8GB          vmemmap
+
+ffffffbe00000000        ffffffbffbffffff          ~8GB          [防护页，未来用于 vmmemap]
+
+ffffffbffc000000        ffffffbfffffffff          64MB          模块
+
+ffffffc000000000        ffffffffffffffff         256GB          内存空间
+
+
+4KB 页大小的转换表查找：
+
++--------+--------+--------+--------+--------+--------+--------+--------+
+|63    56|55    48|47    40|39    32|31    24|23    16|15     8|7      0|
++--------+--------+--------+--------+--------+--------+--------+--------+
+ |                 |         |         |         |         |
+ |                 |         |         |         |         v
+ |                 |         |         |         |   [11:0]  页内偏移
+ |                 |         |         |         +-> [20:12] L3 索引
+ |                 |         |         +-----------> [29:21] L2 索引
+ |                 |         +---------------------> [38:30] L1 索引
+ |                 +-------------------------------> [47:39] L0 索引 (未使用)
+ +-------------------------------------------------> [63] TTBR0/1
+
+
+64KB 页大小的转换表查找：
+
++--------+--------+--------+--------+--------+--------+--------+--------+
+|63    56|55    48|47    40|39    32|31    24|23    16|15     8|7      0|
++--------+--------+--------+--------+--------+--------+--------+--------+
+ |                 |    |               |              |
+ |                 |    |               |              v
+ |                 |    |               |            [15:0]  页内偏移
+ |                 |    |               +----------> [28:16] L3 索引
+ |                 |    +--------------------------> [41:29] L2 索引 (仅使用 38:29 )
+ |                 +-------------------------------> [47:42] L1 索引 (未使用)
+ +-------------------------------------------------> [63] TTBR0/1
diff --git a/MAINTAINERS b/MAINTAINERS
index 027ec2bfa135..1fa907441f8f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -637,6 +637,13 @@ W:	http://www.arm.linux.org.uk/
 S:      Maintained
 F:      arch/arm/
 
+ARM SUB-ARCHITECTURES
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      MAINTAINED
+F:      arch/arm/mach-*/
+F:      arch/arm/plat-*/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc.git
+
 ARM PRIMECELL AACI PL041 DRIVER
 M:      Russell King <linux@arm.linux.org.uk>
 S:      Maintained
@@ -2802,6 +2809,7 @@ F:	sound/usb/misc/ua101.c
 EXTENSIBLE FIRMWARE INTERFACE (EFI)
 M:      Matt Fleming <matt.fleming@intel.com>
 L:      linux-efi@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi.git
 S:      Maintained
 F:      Documentation/x86/efi-stub.txt
 F:      arch/ia64/kernel/efi.c
@@ -5061,7 +5069,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
 S:      Odd Fixes
 F:      drivers/net/
 F:      include/linux/if_*
-F:      include/linux/*device.h
+F:      include/linux/netdevice.h
+F:      include/linux/arcdevice.h
+F:      include/linux/etherdevice.h
+F:      include/linux/fcdevice.h
+F:      include/linux/fddidevice.h
+F:      include/linux/hippidevice.h
+F:      include/linux/inetdevice.h
 
 NETXEN (1/10) GbE SUPPORT
 M:      Sony Chacko <sony.chacko@qlogic.com>
diff --git a/Makefile b/Makefile
index 14c93b39b929..42d0e56818ea 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 7
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Terrified Chipmunk
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/thread_info.h b/arch/alpha/include/asm/thread_info.h
index 4554ecbff7c6..1f8c72959fb6 100644
--- a/arch/alpha/include/asm/thread_info.h
+++ b/arch/alpha/include/asm/thread_info.h
@@ -7,6 +7,7 @@
 #include <asm/processor.h>
 #include <asm/types.h>
 #include <asm/hwrpb.h>
+#include <asm/sysinfo.h>
 #endif
 
 #ifndef __ASSEMBLY__
@@ -21,6 +22,7 @@ struct thread_info {
         mm_segment_t            addr_limit;     /* thread address space */
         unsigned                cpu;            /* current CPU */
         int                     preempt_count; /* 0 => preemptable, <0 => BUG */
+        unsigned int            status;         /* thread-synchronous flags */
 
         int bpt_nsaved;
         unsigned long bpt_addr[2];              /* breakpoint handling  */
@@ -63,8 +65,6 @@ register struct thread_info *__current_thread_info __asm__("$8");
  * - these are process state flags and used from assembly
  * - pending work-to-be-done flags come first and must be assigned to be
  *   within bits 0 to 7 to fit in and immediate operand.
- * - ALPHA_UAC_SHIFT below must be kept consistent with the unaligned
- *   control flags.
  *
  * TIF_SYSCALL_TRACE is known to be 0 via blbs.
  */
@@ -72,18 +72,12 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define TIF_NOTIFY_RESUME       1       /* callback before returning to user */
 #define TIF_SIGPENDING          2       /* signal pending */
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
-#define TIF_POLLING_NRFLAG      8       /* poll_idle is polling NEED_RESCHED */
 #define TIF_DIE_IF_KERNEL       9       /* dik recursion lock */
-#define TIF_UAC_NOPRINT         10      /* ! Preserve sequence of following */
-#define TIF_UAC_NOFIX           11      /* ! flags as they match            */
-#define TIF_UAC_SIGBUS          12      /* ! userspace part of 'osf_sysinfo' */
 #define TIF_MEMDIE              13      /* is terminating due to OOM killer */
-#define TIF_RESTORE_SIGMASK     14      /* restore signal mask in do_signal */
 
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
 #define _TIF_SIGPENDING         (1<<TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
-#define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 #define _TIF_NOTIFY_RESUME      (1<<TIF_NOTIFY_RESUME)
 
 /* Work to do on interrupt/exception return.  */
@@ -94,29 +88,63 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define _TIF_ALLWORK_MASK       (_TIF_WORK_MASK         \
                                  | _TIF_SYSCALL_TRACE)
 
-#define ALPHA_UAC_SHIFT         TIF_UAC_NOPRINT
-#define ALPHA_UAC_MASK          (1 << TIF_UAC_NOPRINT | 1 << TIF_UAC_NOFIX | \
-                                 1 << TIF_UAC_SIGBUS)
+#define TS_UAC_NOPRINT          0x0001  /* ! Preserve the following three */
+#define TS_UAC_NOFIX            0x0002  /* ! flags as they match          */
+#define TS_UAC_SIGBUS           0x0004  /* ! userspace part of 'osf_sysinfo' */
+#define TS_RESTORE_SIGMASK      0x0008  /* restore signal mask in do_signal() */
+#define TS_POLLING              0x0010  /* idle task polling need_resched,
+                                           skip sending interrupt */
 
-#define SET_UNALIGN_CTL(task,value)     ({                                   \
-        task_thread_info(task)->flags = ((task_thread_info(task)->flags &    \
-                ~ALPHA_UAC_MASK)                                             \
-                | (((value) << ALPHA_UAC_SHIFT)       & (1<<TIF_UAC_NOPRINT))\
-                | (((value) << (ALPHA_UAC_SHIFT + 1)) & (1<<TIF_UAC_SIGBUS)) \
-                | (((value) << (ALPHA_UAC_SHIFT - 1)) & (1<<TIF_UAC_NOFIX)));\
+#define tsk_is_polling(t) (task_thread_info(t)->status & TS_POLLING)
+
+#ifndef __ASSEMBLY__
+#define HAVE_SET_RESTORE_SIGMASK        1
+static inline void set_restore_sigmask(void)
+{
+        struct thread_info *ti = current_thread_info();
+        ti->status |= TS_RESTORE_SIGMASK;
+        WARN_ON(!test_bit(TIF_SIGPENDING, (unsigned long *)&ti->flags));
+}
+static inline void clear_restore_sigmask(void)
+{
+        current_thread_info()->status &= ~TS_RESTORE_SIGMASK;
+}
+static inline bool test_restore_sigmask(void)
+{
+        return current_thread_info()->status & TS_RESTORE_SIGMASK;
+}
+static inline bool test_and_clear_restore_sigmask(void)
+{
+        struct thread_info *ti = current_thread_info();
+        if (!(ti->status & TS_RESTORE_SIGMASK))
+                return false;
+        ti->status &= ~TS_RESTORE_SIGMASK;
+        return true;
+}
+#endif
+
+#define SET_UNALIGN_CTL(task,value)     ({                              \
+        __u32 status = task_thread_info(task)->status & ~UAC_BITMASK;   \
+        if (value & PR_UNALIGN_NOPRINT)                                 \
+                status |= TS_UAC_NOPRINT;                               \
+        if (value & PR_UNALIGN_SIGBUS)                                  \
+                status |= TS_UAC_SIGBUS;                                \
+        if (value & 4)  /* alpha-specific */                            \
+                status |= TS_UAC_NOFIX;                                 \
+        task_thread_info(task)->status = status;                        \
         0; })
 
 #define GET_UNALIGN_CTL(task,value)     ({                              \
-        put_user((task_thread_info(task)->flags & (1 << TIF_UAC_NOPRINT))\
-                  >> ALPHA_UAC_SHIFT                                    \
-                 | (task_thread_info(task)->flags & (1 << TIF_UAC_SIGBUS))\
-                 >> (ALPHA_UAC_SHIFT + 1)                               \
-                 | (task_thread_info(task)->flags & (1 << TIF_UAC_NOFIX))\
-                 >> (ALPHA_UAC_SHIFT - 1),                              \
-                 (int __user *)(value));                                \
+        __u32 status = task_thread_info(task)->status & ~UAC_BITMASK;   \
+        __u32 res = 0;                                                  \
+        if (status & TS_UAC_NOPRINT)                                    \
+                res |= PR_UNALIGN_NOPRINT;                              \
+        if (status & TS_UAC_SIGBUS)                                     \
+                res |= PR_UNALIGN_SIGBUS;                               \
+        if (status & TS_UAC_NOFIX)                                      \
+                res |= 4;                                               \
+        put_user(res, (int __user *)(value));                           \
         })
 
-#define tsk_is_polling(t) test_tsk_thread_flag(t, TIF_POLLING_NRFLAG)
-
 #endif /* __KERNEL__ */
 #endif /* _ALPHA_THREAD_INFO_H */
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 9eb090582cf1..1e6956a90608 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -793,8 +793,7 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
         case GSI_UACPROC:
                 if (nbytes < sizeof(unsigned int))
                         return -EINVAL;
-                w = (current_thread_info()->flags >> ALPHA_UAC_SHIFT) &
-                        UAC_BITMASK;
+                w = current_thread_info()->status & UAC_BITMASK;
                 if (put_user(w, (unsigned int __user *)buffer))
                         return -EFAULT;
                 return 1;
@@ -904,24 +903,20 @@ SYSCALL_DEFINE5(osf_setsysinfo, unsigned long, op, void __user *, buffer,
                 break;
 
         case SSI_NVPAIRS: {
-                unsigned long v, w, i;
-                unsigned int old, new;
+                unsigned __user *p = buffer;
+                unsigned i;
                 
-                for (i = 0; i < nbytes; ++i) {
+                for (i = 0, p = buffer; i < nbytes; ++i, p += 2) {
+                        unsigned v, w, status;
 
-                        if (get_user(v, 2*i + (unsigned int __user *)buffer))
-                                return -EFAULT;
-                        if (get_user(w, 2*i + 1 + (unsigned int __user *)buffer))
+                        if (get_user(v, p) || get_user(w, p + 1))
                                 return -EFAULT;
                         switch (v) {
                         case SSIN_UACPROC:
-                        again:
-                                old = current_thread_info()->flags;
-                                new = old & ~(UAC_BITMASK << ALPHA_UAC_SHIFT);
-                                new = new | (w & UAC_BITMASK) << ALPHA_UAC_SHIFT;
-                                if (cmpxchg(&current_thread_info()->flags,
-                                            old, new) != old)
-                                        goto again;
+                                w &= UAC_BITMASK;
+                                status = current_thread_info()->status;
+                                status = (status & ~UAC_BITMASK) | w;
+                                current_thread_info()->status = status;
                                 break;
  
                         default:
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 4054e0ffe2b2..51987dcf79b8 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -49,7 +49,7 @@ EXPORT_SYMBOL(pm_power_off);
 void
 cpu_idle(void)
 {
-        set_thread_flag(TIF_POLLING_NRFLAG);
+        current_thread_info()->status |= TS_POLLING;
 
         while (1) {
                 /* FIXME -- EV6 and LCA45 know how to power down
diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c
index 80d987c0e9aa..272666d006df 100644
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -780,17 +780,17 @@ do_entUnaUser(void __user * va, unsigned long opcode,
         /* Check the UAC bits to decide what the user wants us to do
            with the unaliged access.  */
 
-        if (!test_thread_flag (TIF_UAC_NOPRINT)) {
+        if (!(current_thread_info()->status & TS_UAC_NOPRINT)) {
                 if (__ratelimit(&ratelimit)) {
                         printk("%s(%d): unaligned trap at %016lx: %p %lx %ld\n",
                                current->comm, task_pid_nr(current),
                                regs->pc - 4, va, opcode, reg);
                 }
         }
-        if (test_thread_flag (TIF_UAC_SIGBUS))
+        if ((current_thread_info()->status & TS_UAC_SIGBUS))
                 goto give_sigbus;
         /* Not sure why you'd want to use this, but... */
-        if (test_thread_flag (TIF_UAC_NOFIX))
+        if ((current_thread_info()->status & TS_UAC_NOFIX))
                 return;
 
         /* Don't bother reading ds in the access check since we already
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 73067efd4845..ade7e924bef5 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1603,8 +1603,8 @@ config NR_CPUS
         default "4"
 
 config HOTPLUG_CPU
-        bool "Support for hot-pluggable CPUs (EXPERIMENTAL)"
-        depends on SMP && HOTPLUG && EXPERIMENTAL
+        bool "Support for hot-pluggable CPUs"
+        depends on SMP && HOTPLUG
         help
           Say Y here to experiment with turning CPUs off and on.  CPUs
           can be controlled through /sys/devices/system/cpu.
@@ -1645,8 +1645,8 @@ config HZ
         default 100
 
 config THUMB2_KERNEL
-        bool "Compile the kernel in Thumb-2 mode (EXPERIMENTAL)"
-        depends on CPU_V7 && !CPU_V6 && !CPU_V6K && EXPERIMENTAL
+        bool "Compile the kernel in Thumb-2 mode"
+        depends on CPU_V7 && !CPU_V6 && !CPU_V6K
         select AEABI
         select ARM_ASM_UNIFIED
         select ARM_UNWIND
@@ -1850,6 +1850,7 @@ config XEN_DOM0
 config XEN
         bool "Xen guest support on ARM (EXPERIMENTAL)"
         depends on EXPERIMENTAL && ARM && OF
+        depends on CPU_V7 && !CPU_V6
         help
           Say Y if you want to run Linux in a Virtual Machine on Xen on ARM.
 
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index f023e3acdfbd..5f914fca911b 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -21,8 +21,6 @@ endif
 OBJCOPYFLAGS    :=-O binary -R .comment -S
 GZFLAGS         :=-9
 #KBUILD_CFLAGS  +=-pipe
-# Explicitly specifiy 32-bit ARM ISA since toolchain default can be -mthumb:
-KBUILD_CFLAGS   +=$(call cc-option,-marm,)
 
 # Never generate .eh_frame
 KBUILD_CFLAGS   += $(call cc-option,-fno-dwarf2-cfi-asm)
@@ -105,17 +103,20 @@ endif
 ifeq ($(CONFIG_THUMB2_KERNEL),y)
 AFLAGS_AUTOIT   :=$(call as-option,-Wa$(comma)-mimplicit-it=always,-Wa$(comma)-mauto-it)
 AFLAGS_NOWARN   :=$(call as-option,-Wa$(comma)-mno-warn-deprecated,-Wa$(comma)-W)
-CFLAGS_THUMB2   :=-mthumb $(AFLAGS_AUTOIT) $(AFLAGS_NOWARN)
-AFLAGS_THUMB2   :=$(CFLAGS_THUMB2) -Wa$(comma)-mthumb
+CFLAGS_ISA      :=-mthumb $(AFLAGS_AUTOIT) $(AFLAGS_NOWARN)
+AFLAGS_ISA      :=$(CFLAGS_ISA) -Wa$(comma)-mthumb
 # Work around buggy relocation from gas if requested:
 ifeq ($(CONFIG_THUMB2_AVOID_R_ARM_THM_JUMP11),y)
 CFLAGS_MODULE   +=-fno-optimize-sibling-calls
 endif
+else
+CFLAGS_ISA      :=$(call cc-option,-marm,)
+AFLAGS_ISA      :=$(CFLAGS_ISA)
 endif
 
 # Need -Uarm for gcc < 3.x
-KBUILD_CFLAGS   +=$(CFLAGS_ABI) $(CFLAGS_THUMB2) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm
-KBUILD_AFLAGS   +=$(CFLAGS_ABI) $(AFLAGS_THUMB2) $(arch-y) $(tune-y) -include asm/unified.h -msoft-float
+KBUILD_CFLAGS   +=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm
+KBUILD_AFLAGS   +=$(CFLAGS_ABI) $(AFLAGS_ISA) $(arch-y) $(tune-y) -include asm/unified.h -msoft-float
 
 CHECKFLAGS      += -D__arm__
 
diff --git a/arch/arm/boot/Makefile b/arch/arm/boot/Makefile
index 3fdab016aa5c..f2aa09eb658e 100644
--- a/arch/arm/boot/Makefile
+++ b/arch/arm/boot/Makefile
@@ -33,7 +33,7 @@ ifeq ($(CONFIG_XIP_KERNEL),y)
 
 $(obj)/xipImage: vmlinux FORCE
         $(call if_changed,objcopy)
-        @echo '  Kernel: $@ is ready (physical address: $(CONFIG_XIP_PHYS_ADDR))'
+        $(kecho) '  Kernel: $@ is ready (physical address: $(CONFIG_XIP_PHYS_ADDR))'
 
 $(obj)/Image $(obj)/zImage: FORCE
         @echo 'Kernel configured for XIP (CONFIG_XIP_KERNEL=y)'
@@ -48,14 +48,14 @@ $(obj)/xipImage: FORCE
 
 $(obj)/Image: vmlinux FORCE
         $(call if_changed,objcopy)
-        @echo '  Kernel: $@ is ready'
+        $(kecho) '  Kernel: $@ is ready'
 
 $(obj)/compressed/vmlinux: $(obj)/Image FORCE
         $(Q)$(MAKE) $(build)=$(obj)/compressed $@
 
 $(obj)/zImage:  $(obj)/compressed/vmlinux FORCE
         $(call if_changed,objcopy)
-        @echo '  Kernel: $@ is ready'
+        $(kecho) '  Kernel: $@ is ready'
 
 endif
 
@@ -90,7 +90,7 @@ fi
 $(obj)/uImage:  $(obj)/zImage FORCE
         @$(check_for_multiple_loadaddr)
         $(call if_changed,uimage)
-        @echo '  Image $@ is ready'
+        $(kecho) '  Image $@ is ready'
 
 $(obj)/bootp/bootp: $(obj)/zImage initrd FORCE
         $(Q)$(MAKE) $(build)=$(obj)/bootp $@
@@ -98,7 +98,7 @@ $(obj)/bootp/bootp: $(obj)/zImage initrd FORCE
 
 $(obj)/bootpImage: $(obj)/bootp/bootp FORCE
         $(call if_changed,objcopy)
-        @echo '  Kernel: $@ is ready'
+        $(kecho) '  Kernel: $@ is ready'
 
 PHONY += initrd FORCE
 initrd:
diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
index b06c0db273b1..e6391a4e6649 100644
--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
@@ -126,14 +126,14 @@
                 #size-cells = <0>;
 
                 btn3 {
-                        label = "Buttin 3";
+                        label = "Button 3";
                         gpios = <&pioA 30 1>;
                         linux,code = <0x103>;
                         gpio-key,wakeup;
                 };
 
                 btn4 {
-                        label = "Buttin 4";
+                        label = "Button 4";
                         gpios = <&pioA 31 1>;
                         linux,code = <0x104>;
                         gpio-key,wakeup;
diff --git a/arch/arm/boot/dts/dbx5x0.dtsi b/arch/arm/boot/dts/dbx5x0.dtsi
index 748ba7aa746c..4b0e0ca08f40 100644
--- a/arch/arm/boot/dts/dbx5x0.dtsi
+++ b/arch/arm/boot/dts/dbx5x0.dtsi
@@ -483,6 +483,8 @@
                         compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                         reg = <0x80004000 0x1000>;
                         interrupts = <0 21 0x4>;
+                        arm,primecell-periphid = <0x180024>;
+
                         #address-cells = <1>;
                         #size-cells = <0>;
                         v-i2c-supply = <&db8500_vape_reg>;
@@ -494,6 +496,8 @@
                         compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                         reg = <0x80122000 0x1000>;
                         interrupts = <0 22 0x4>;
+                        arm,primecell-periphid = <0x180024>;
+
                         #address-cells = <1>;
                         #size-cells = <0>;
                         v-i2c-supply = <&db8500_vape_reg>;
@@ -505,6 +509,8 @@
                         compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                         reg = <0x80128000 0x1000>;
                         interrupts = <0 55 0x4>;
+                        arm,primecell-periphid = <0x180024>;
+
                         #address-cells = <1>;
                         #size-cells = <0>;
                         v-i2c-supply = <&db8500_vape_reg>;
@@ -516,6 +522,8 @@
                         compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                         reg = <0x80110000 0x1000>;
                         interrupts = <0 12 0x4>;
+                        arm,primecell-periphid = <0x180024>;
+
                         #address-cells = <1>;
                         #size-cells = <0>;
                         v-i2c-supply = <&db8500_vape_reg>;
@@ -527,6 +535,8 @@
                         compatible = "stericsson,db8500-i2c", "st,nomadik-i2c", "arm,primecell";
                         reg = <0x8012a000 0x1000>;
                         interrupts = <0 51 0x4>;
+                        arm,primecell-periphid = <0x180024>;
+
                         #address-cells = <1>;
                         #size-cells = <0>;
                         v-i2c-supply = <&db8500_vape_reg>;
@@ -573,33 +583,38 @@
                         interrupts = <0 60 0x4>;
                         status = "disabled";
                 };
+
                 sdi@80118000 {
                         compatible = "arm,pl18x", "arm,primecell";
                         reg = <0x80118000 0x1000>;
                         interrupts = <0 50 0x4>;
                         status = "disabled";
                 };
+
                 sdi@80005000 {
                         compatible = "arm,pl18x", "arm,primecell";
                         reg = <0x80005000 0x1000>;
                         interrupts = <0 41 0x4>;
                         status = "disabled";
                 };
+
                 sdi@80119000 {
                         compatible = "arm,pl18x", "arm,primecell";
                         reg = <0x80119000 0x1000>;
                         interrupts = <0 59 0x4>;
                         status = "disabled";
                 };
+
                 sdi@80114000 {
                         compatible = "arm,pl18x", "arm,primecell";
                         reg = <0x80114000 0x1000>;
                         interrupts = <0 99 0x4>;
                         status = "disabled";
                 };
+
                 sdi@80008000 {
                         compatible = "arm,pl18x", "arm,primecell";
-                        reg = <0x80114000 0x1000>;
+                        reg = <0x80008000 0x1000>;
                         interrupts = <0 100 0x4>;
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/exynos4210-trats.dts b/arch/arm/boot/dts/exynos4210-trats.dts
index 73567b843e72..a21511c14071 100644
--- a/arch/arm/boot/dts/exynos4210-trats.dts
+++ b/arch/arm/boot/dts/exynos4210-trats.dts
@@ -20,8 +20,10 @@
         compatible = "samsung,trats", "samsung,exynos4210";
 
         memory {
-                reg =  <0x40000000 0x20000000
-                        0x60000000 0x20000000>;
+                reg =  <0x40000000 0x10000000
+                        0x50000000 0x10000000
+                        0x60000000 0x10000000
+                        0x70000000 0x10000000>;
         };
 
         chosen {
diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
index 9ca4ca70c1bc..6d31aa383460 100644
--- a/arch/arm/boot/dts/imx23.dtsi
+++ b/arch/arm/boot/dts/imx23.dtsi
@@ -69,6 +69,7 @@
                                 interrupts = <13>, <56>;
                                 interrupt-names = "gpmi-dma", "bch";
                                 clocks = <&clks 34>;
+                                clock-names = "gpmi_io";
                                 fsl,gpmi-dma-channel = <4>;
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
index e16d63155480..55c57ea6169e 100644
--- a/arch/arm/boot/dts/imx28.dtsi
+++ b/arch/arm/boot/dts/imx28.dtsi
@@ -85,6 +85,7 @@
                                 interrupts = <88>, <41>;
                                 interrupt-names = "gpmi-dma", "bch";
                                 clocks = <&clks 50>;
+                                clock-names = "gpmi_io";
                                 fsl,gpmi-dma-channel = <4>;
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index f38ea8771b44..696e929d0304 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -257,7 +257,7 @@
                         interrupt-names = "common", "tx", "rx", "sidetone";
                         interrupt-parent = <&intc>;
                         ti,buffer-size = <1280>;
-                        ti,hwmods = "mcbsp2";
+                        ti,hwmods = "mcbsp2", "mcbsp2_sidetone";
                 };
 
                 mcbsp3: mcbsp@49024000 {
@@ -272,7 +272,7 @@
                         interrupt-names = "common", "tx", "rx", "sidetone";
                         interrupt-parent = <&intc>;
                         ti,buffer-size = <128>;
-                        ti,hwmods = "mcbsp3";
+                        ti,hwmods = "mcbsp3", "mcbsp3_sidetone";
                 };
 
                 mcbsp4: mcbsp@49026000 {
diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
index 66aa7a6db884..394ded624e37 100644
--- a/arch/arm/configs/imx_v6_v7_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -139,6 +139,7 @@ CONFIG_I2C_IMX=y
 CONFIG_SPI=y
 CONFIG_SPI_IMX=y
 CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_MC9S08DZ60=y
 # CONFIG_HWMON is not set
 CONFIG_WATCHDOG=y
 CONFIG_IMX2_WDT=y
@@ -155,6 +156,7 @@ CONFIG_SOC_CAMERA=y
 CONFIG_SOC_CAMERA_OV2640=y
 CONFIG_VIDEO_MX3=y
 CONFIG_FB=y
+CONFIG_LCD_PLATFORM=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_LCD_CLASS_DEVICE=y
 CONFIG_LCD_L4F00242T03=y
diff --git a/arch/arm/configs/mvebu_defconfig b/arch/arm/configs/mvebu_defconfig
index 7bcf850eddcd..3458752c4bb2 100644
--- a/arch/arm/configs/mvebu_defconfig
+++ b/arch/arm/configs/mvebu_defconfig
@@ -1,6 +1,6 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
-CONFIG_NO_HZ=y
+CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
@@ -9,10 +9,12 @@ CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_ARCH_MVEBU=y
-CONFIG_MACH_ARMADA_370_XP=y
+CONFIG_MACH_ARMADA_370=y
+CONFIG_MACH_ARMADA_XP=y
+# CONFIG_CACHE_L2X0 is not set
 CONFIG_AEABI=y
 CONFIG_HIGHMEM=y
-CONFIG_USE_OF=y
+# CONFIG_COMPACTION is not set
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
 CONFIG_ARM_APPENDED_DTB=y
@@ -23,6 +25,8 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_GPIOLIB=y
 CONFIG_GPIO_SYSFS=y
+# CONFIG_USB_SUPPORT is not set
+# CONFIG_IOMMU_SUPPORT is not set
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
diff --git a/arch/arm/configs/versatile_defconfig b/arch/arm/configs/versatile_defconfig
index cdd4d2bd3962..2ba9e63d0f17 100644
--- a/arch/arm/configs/versatile_defconfig
+++ b/arch/arm/configs/versatile_defconfig
@@ -1,3 +1,4 @@
+CONFIG_ARCH_VERSATILE=y
 CONFIG_EXPERIMENTAL=y
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
diff --git a/arch/arm/include/asm/flat.h b/arch/arm/include/asm/flat.h
index 59426a4595c9..e847d23351ed 100644
--- a/arch/arm/include/asm/flat.h
+++ b/arch/arm/include/asm/flat.h
@@ -8,7 +8,7 @@
 #define flat_argvp_envp_on_stack()              1
 #define flat_old_ram_flag(flags)                (flags)
 #define flat_reloc_valid(reloc, size)           ((reloc) <= (size))
-#define flat_get_addr_from_rp(rp, relval, flags, persistent) get_unaligned(rp)
+#define flat_get_addr_from_rp(rp, relval, flags, persistent) ((void)persistent,get_unaligned(rp))
 #define flat_put_addr_at_rp(rp, val, relval)    put_unaligned(val,rp)
 #define flat_get_relocate_addr(rel)             (rel)
 #define flat_set_persistent(relval, p)          0
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 77bd79f2ffdb..7e1f76027f66 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -200,8 +200,8 @@ extern int __put_user_8(void *, unsigned long long);
 #define USER_DS                 KERNEL_DS
 
 #define segment_eq(a,b)         (1)
-#define __addr_ok(addr)         (1)
-#define __range_ok(addr,size)   (0)
+#define __addr_ok(addr)         ((void)(addr),1)
+#define __range_ok(addr,size)   ((void)(addr),0)
 #define get_fs()                (KERNEL_DS)
 
 static inline void set_fs(mm_segment_t fs)
diff --git a/arch/arm/include/asm/xen/interface.h b/arch/arm/include/asm/xen/interface.h
index ae05e56dd17d..5000397134b4 100644
--- a/arch/arm/include/asm/xen/interface.h
+++ b/arch/arm/include/asm/xen/interface.h
@@ -29,16 +29,22 @@
 
 #ifndef __ASSEMBLY__
 /* Explicitly size integers that represent pfns in the interface with
- * Xen so that we can have one ABI that works for 32 and 64 bit guests. */
+ * Xen so that we can have one ABI that works for 32 and 64 bit guests.
+ * Note that this means that the xen_pfn_t type may be capable of
+ * representing pfn's which the guest cannot represent in its own pfn
+ * type. However since pfn space is controlled by the guest this is
+ * fine since it simply wouldn't be able to create any sure pfns in
+ * the first place.
+ */
 typedef uint64_t xen_pfn_t;
+#define PRI_xen_pfn "llx"
 typedef uint64_t xen_ulong_t;
+#define PRI_xen_ulong "llx"
 /* Guest handles for primitive C types. */
 __DEFINE_GUEST_HANDLE(uchar, unsigned char);
 __DEFINE_GUEST_HANDLE(uint,  unsigned int);
-__DEFINE_GUEST_HANDLE(ulong, unsigned long);
 DEFINE_GUEST_HANDLE(char);
 DEFINE_GUEST_HANDLE(int);
-DEFINE_GUEST_HANDLE(long);
 DEFINE_GUEST_HANDLE(void);
 DEFINE_GUEST_HANDLE(uint64_t);
 DEFINE_GUEST_HANDLE(uint32_t);
diff --git a/arch/arm/include/asm/xen/page.h b/arch/arm/include/asm/xen/page.h
index 174202318dff..c6b9096cef95 100644
--- a/arch/arm/include/asm/xen/page.h
+++ b/arch/arm/include/asm/xen/page.h
@@ -10,7 +10,7 @@
 #include <xen/interface/grant_table.h>
 
 #define pfn_to_mfn(pfn)                 (pfn)
-#define phys_to_machine_mapping_valid   (1)
+#define phys_to_machine_mapping_valid(pfn) (1)
 #define mfn_to_pfn(mfn)                 (mfn)
 #define mfn_to_virt(m)                  (__va(mfn_to_pfn(m) << PAGE_SHIFT))
 
@@ -30,6 +30,8 @@ typedef struct xpaddr {
 #define XMADDR(x)       ((xmaddr_t) { .maddr = (x) })
 #define XPADDR(x)       ((xpaddr_t) { .paddr = (x) })
 
+#define INVALID_P2M_ENTRY      (~0UL)
+
 static inline xmaddr_t phys_to_machine(xpaddr_t phys)
 {
         unsigned offset = phys.paddr & ~PAGE_MASK;
@@ -74,9 +76,14 @@ static inline int m2p_remove_override(struct page *page, bool clear_pte)
         return 0;
 }
 
+static inline bool __set_phys_to_machine(unsigned long pfn, unsigned long mfn)
+{
+        BUG_ON(pfn != mfn && mfn != INVALID_P2M_ENTRY);
+        return true;
+}
+
 static inline bool set_phys_to_machine(unsigned long pfn, unsigned long mfn)
 {
-        BUG();
-        return false;
+        return __set_phys_to_machine(pfn, mfn);
 }
 #endif /* _ASM_ARM_XEN_PAGE_H */
diff --git a/arch/arm/include/debug/8250_32.S b/arch/arm/include/debug/8250_32.S
new file mode 100644
index 000000000000..8db01eeabbb4
--- /dev/null
+++ b/arch/arm/include/debug/8250_32.S
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2011 Picochip Ltd., Jamie Iles
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Derived from arch/arm/mach-davinci/include/mach/debug-macro.S to use 32-bit
+ * accesses to the 8250.
+ */
+
+#include <linux/serial_reg.h>
+
+                .macro  senduart,rd,rx
+                str     \rd, [\rx, #UART_TX << UART_SHIFT]
+                .endm
+
+                .macro  busyuart,rd,rx
+1002:           ldr     \rd, [\rx, #UART_LSR << UART_SHIFT]
+                and     \rd, \rd, #UART_LSR_TEMT | UART_LSR_THRE
+                teq     \rd, #UART_LSR_TEMT | UART_LSR_THRE
+                bne     1002b
+                .endm
+
+                /* The UART's don't have any flow control IO's wired up. */
+                .macro  waituart,rd,rx
+                .endm
diff --git a/arch/arm/include/debug/picoxcell.S b/arch/arm/include/debug/picoxcell.S
index 7419deb1b948..bc1f07c49cd4 100644
--- a/arch/arm/include/debug/picoxcell.S
+++ b/arch/arm/include/debug/picoxcell.S
@@ -5,10 +5,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  *
- * Derived from arch/arm/mach-davinci/include/mach/debug-macro.S to use 32-bit
- * accesses to the 8250.
  */
-#include <linux/serial_reg.h>
 
 #define UART_SHIFT 2
 #define PICOXCELL_UART1_BASE            0x80230000
@@ -19,17 +16,4 @@
                 ldr     \rp, =PICOXCELL_UART1_BASE
                 .endm
 
-                .macro  senduart,rd,rx
-                str     \rd, [\rx, #UART_TX << UART_SHIFT]
-                .endm
-
-                .macro  busyuart,rd,rx
-1002:           ldr     \rd, [\rx, #UART_LSR << UART_SHIFT]
-                and     \rd, \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                teq     \rd, #UART_LSR_TEMT | UART_LSR_THRE
-                bne     1002b
-                .endm
-
-                /* The UART's don't have any flow control IO's wired up. */
-                .macro  waituart,rd,rx
-                .endm
+#include "8250_32.S"
diff --git a/arch/arm/include/debug/socfpga.S b/arch/arm/include/debug/socfpga.S
index d6f26d23374f..966b2f994946 100644
--- a/arch/arm/include/debug/socfpga.S
+++ b/arch/arm/include/debug/socfpga.S
@@ -7,6 +7,9 @@
  * published by the Free Software Foundation.
  */
 
+#define UART_SHIFT 2
+#define DEBUG_LL_UART_OFFSET    0x00002000
+
                 .macro  addruart, rp, rv, tmp
                 mov     \rp, #DEBUG_LL_UART_OFFSET
                 orr     \rp, \rp, #0x00c00000
@@ -14,3 +17,5 @@
                 orr     \rp, \rp, #0xff000000   @ physical base
                 .endm
 
+#include "8250_32.S"
+
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 16cedb42c0c3..896165096d6a 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -34,6 +34,7 @@
 #include <linux/list.h>
 #include <linux/kallsyms.h>
 #include <linux/proc_fs.h>
+#include <linux/export.h>
 
 #include <asm/exception.h>
 #include <asm/mach/arch.h>
@@ -109,6 +110,7 @@ void set_irq_flags(unsigned int irq, unsigned int iflags)
         /* Order is clear bits in "clr" then set bits in "set" */
         irq_modify_status(irq, clr, set & ~clr);
 }
+EXPORT_SYMBOL_GPL(set_irq_flags);
 
 void __init init_IRQ(void)
 {
diff --git a/arch/arm/kernel/kprobes-test-arm.c b/arch/arm/kernel/kprobes-test-arm.c
index 38c1a3b103a0..839312905067 100644
--- a/arch/arm/kernel/kprobes-test-arm.c
+++ b/arch/arm/kernel/kprobes-test-arm.c
@@ -366,7 +366,9 @@ void kprobe_arm_test_cases(void)
         TEST_UNSUPPORTED(".word 0xe04f0392 @ umaal r0, pc, r2, r3")
         TEST_UNSUPPORTED(".word 0xe0500090 @ undef")
         TEST_UNSUPPORTED(".word 0xe05fff9f @ undef")
+#endif
 
+#if __LINUX_ARM_ARCH__ >= 7
         TEST_RRR(  "mls         r0, r",1, VAL1,", r",2, VAL2,", r",3,  VAL3,"")
         TEST_RRR(  "mlshi       r7, r",8, VAL3,", r",9, VAL1,", r",10, VAL2,"")
         TEST_RR(   "mls         lr, r",1, VAL2,", r",2, VAL3,", r13")
@@ -456,6 +458,8 @@ void kprobe_arm_test_cases(void)
         TEST_UNSUPPORTED(".word 0xe1700090") /* Unallocated space */
 #if __LINUX_ARM_ARCH__ >= 6
         TEST_UNSUPPORTED("ldrex r2, [sp]")
+#endif
+#if (__LINUX_ARM_ARCH__ >= 7) || defined(CONFIG_CPU_32v6K)
         TEST_UNSUPPORTED("strexd        r0, r2, r3, [sp]")
         TEST_UNSUPPORTED("ldrexd        r2, r3, [sp]")
         TEST_UNSUPPORTED("strexb        r0, r2, [sp]")
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index e29c3337ca81..8ef8c9337809 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -45,10 +45,9 @@ int machine_kexec_prepare(struct kimage *image)
         for (i = 0; i < image->nr_segments; i++) {
                 current_segment = &image->segment[i];
 
-                err = memblock_is_region_memory(current_segment->mem,
-                                                current_segment->memsz);
-                if (err)
-                        return - EINVAL;
+                if (!memblock_is_region_memory(current_segment->mem,
+                                               current_segment->memsz))
+                        return -EINVAL;
 
                 err = get_user(header, (__be32*)current_segment->buf);
                 if (err)
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 93971b1a4f0b..53c0304b734a 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -96,6 +96,10 @@ armpmu_event_set_period(struct perf_event *event,
         s64 period = hwc->sample_period;
         int ret = 0;
 
+        /* The period may have been changed by PERF_EVENT_IOC_PERIOD */
+        if (unlikely(period != hwc->last_period))
+                left = period - (hwc->last_period - left);
+
         if (unlikely(left <= -period)) {
                 left = period;
                 local64_set(&hwc->period_left, left);
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 8e20754dd31d..fbc8b2623d82 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -294,18 +294,24 @@ static void percpu_timer_setup(void);
 asmlinkage void __cpuinit secondary_start_kernel(void)
 {
         struct mm_struct *mm = &init_mm;
-        unsigned int cpu = smp_processor_id();
+        unsigned int cpu;
+
+        /*
+         * The identity mapping is uncached (strongly ordered), so
+         * switch away from it before attempting any exclusive accesses.
+         */
+        cpu_switch_mm(mm->pgd, mm);
+        enter_lazy_tlb(mm, current);
+        local_flush_tlb_all();
 
         /*
          * All kernel threads share the same mm context; grab a
          * reference and switch to it.
          */
+        cpu = smp_processor_id();
         atomic_inc(&mm->mm_count);
         current->active_mm = mm;
         cpumask_set_cpu(cpu, mm_cpumask(mm));
-        cpu_switch_mm(mm->pgd, mm);
-        enter_lazy_tlb(mm, current);
-        local_flush_tlb_all();
 
         printk("CPU%u: Booted secondary processor\n", cpu);
 
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index e1f906989bb8..b22d700fea27 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -42,10 +42,10 @@ static void twd_set_mode(enum clock_event_mode mode,
 
         switch (mode) {
         case CLOCK_EVT_MODE_PERIODIC:
-                /* timer load already set up */
                 ctrl = TWD_TIMER_CONTROL_ENABLE | TWD_TIMER_CONTROL_IT_ENABLE
                         | TWD_TIMER_CONTROL_PERIODIC;
-                __raw_writel(twd_timer_rate / HZ, twd_base + TWD_TIMER_LOAD);
+                __raw_writel(DIV_ROUND_CLOSEST(twd_timer_rate, HZ),
+                        twd_base + TWD_TIMER_LOAD);
                 break;
         case CLOCK_EVT_MODE_ONESHOT:
                 /* period set, and timer enabled in 'next_event' hook */
diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
index 9d0a30032d7f..0dc53854a5d8 100644
--- a/arch/arm/lib/delay.c
+++ b/arch/arm/lib/delay.c
@@ -45,6 +45,7 @@ int read_current_timer(unsigned long *timer_val)
         *timer_val = delay_timer->read_current_timer();
         return 0;
 }
+EXPORT_SYMBOL_GPL(read_current_timer);
 
 static void __timer_delay(unsigned long cycles)
 {
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index b14207101938..043624219b55 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -21,19 +21,13 @@ config SOC_AT91SAM9
         bool
         select CPU_ARM926T
         select GENERIC_CLOCKEVENTS
+        select MULTI_IRQ_HANDLER
+        select SPARSE_IRQ
 
 menu "Atmel AT91 System-on-Chip"
 
 comment "Atmel AT91 Processor"
 
-config SOC_AT91SAM9
-        bool
-        select AT91_SAM9_SMC
-        select AT91_SAM9_TIME
-        select CPU_ARM926T
-        select MULTI_IRQ_HANDLER
-        select SPARSE_IRQ
-
 config SOC_AT91RM9200
         bool "AT91RM9200"
         select CPU_ARM920T
diff --git a/arch/arm/mach-at91/at91rm9200.c b/arch/arm/mach-at91/at91rm9200.c
index b4f0565aff63..5269825194a8 100644
--- a/arch/arm/mach-at91/at91rm9200.c
+++ b/arch/arm/mach-at91/at91rm9200.c
@@ -187,7 +187,7 @@ static struct clk_lookup periph_clocks_lookups[] = {
         CLKDEV_CON_DEV_ID("pclk", "ssc.0", &ssc0_clk),
         CLKDEV_CON_DEV_ID("pclk", "ssc.1", &ssc1_clk),
         CLKDEV_CON_DEV_ID("pclk", "ssc.2", &ssc2_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91rm9200", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91rm9200.0", &twi_clk),
         /* fake hclk clock */
         CLKDEV_CON_DEV_ID("hclk", "at91_ohci", &ohci_clk),
         CLKDEV_CON_ID("pioA", &pioA_clk),
diff --git a/arch/arm/mach-at91/at91rm9200_devices.c b/arch/arm/mach-at91/at91rm9200_devices.c
index a563189cdfc3..1e122bcd7845 100644
--- a/arch/arm/mach-at91/at91rm9200_devices.c
+++ b/arch/arm/mach-at91/at91rm9200_devices.c
@@ -479,7 +479,7 @@ static struct i2c_gpio_platform_data pdata = {
 
 static struct platform_device at91rm9200_twi_device = {
         .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
         .dev.platform_data      = &pdata,
 };
 
@@ -512,7 +512,7 @@ static struct resource twi_resources[] = {
 
 static struct platform_device at91rm9200_twi_device = {
         .name           = "i2c-at91rm9200",
-        .id             = -1,
+        .id             = 0,
         .resource       = twi_resources,
         .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91sam9260.c b/arch/arm/mach-at91/at91sam9260.c
index ad29f93f20ca..f8202615f4a8 100644
--- a/arch/arm/mach-at91/at91sam9260.c
+++ b/arch/arm/mach-at91/at91sam9260.c
@@ -211,8 +211,8 @@ static struct clk_lookup periph_clocks_lookups[] = {
         CLKDEV_CON_DEV_ID("t1_clk", "atmel_tcb.1", &tc4_clk),
         CLKDEV_CON_DEV_ID("t2_clk", "atmel_tcb.1", &tc5_clk),
         CLKDEV_CON_DEV_ID("pclk", "ssc.0", &ssc_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9260", &twi_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9g20", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9260.0", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9g20.0", &twi_clk),
         /* more usart lookup table for DT entries */
         CLKDEV_CON_DEV_ID("usart", "fffff200.serial", &mck),
         CLKDEV_CON_DEV_ID("usart", "fffb0000.serial", &usart0_clk),
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index a76b8684f52d..aa1e58729885 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -389,7 +389,7 @@ static struct i2c_gpio_platform_data pdata = {
 
 static struct platform_device at91sam9260_twi_device = {
         .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
         .dev.platform_data      = &pdata,
 };
 
@@ -421,7 +421,7 @@ static struct resource twi_resources[] = {
 };
 
 static struct platform_device at91sam9260_twi_device = {
-        .id             = -1,
+        .id             = 0,
         .resource       = twi_resources,
         .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91sam9261.c b/arch/arm/mach-at91/at91sam9261.c
index 8d999eb1a137..04295c04b3e0 100644
--- a/arch/arm/mach-at91/at91sam9261.c
+++ b/arch/arm/mach-at91/at91sam9261.c
@@ -178,8 +178,8 @@ static struct clk_lookup periph_clocks_lookups[] = {
         CLKDEV_CON_DEV_ID("pclk", "ssc.1", &ssc1_clk),
         CLKDEV_CON_DEV_ID("pclk", "ssc.2", &ssc2_clk),
         CLKDEV_CON_DEV_ID("hclk", "at91_ohci", &hck0),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9261", &twi_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9g10", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9261.0", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9g10.0", &twi_clk),
         CLKDEV_CON_ID("pioA", &pioA_clk),
         CLKDEV_CON_ID("pioB", &pioB_clk),
         CLKDEV_CON_ID("pioC", &pioC_clk),
diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c
index 9752f17efba9..b9487696b7be 100644
--- a/arch/arm/mach-at91/at91sam9261_devices.c
+++ b/arch/arm/mach-at91/at91sam9261_devices.c
@@ -285,7 +285,7 @@ static struct i2c_gpio_platform_data pdata = {
 
 static struct platform_device at91sam9261_twi_device = {
         .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
         .dev.platform_data      = &pdata,
 };
 
@@ -317,7 +317,7 @@ static struct resource twi_resources[] = {
 };
 
 static struct platform_device at91sam9261_twi_device = {
-        .id             = -1,
+        .id             = 0,
         .resource       = twi_resources,
         .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91sam9263.c b/arch/arm/mach-at91/at91sam9263.c
index 6a01d0360dfb..d6f9c23927c4 100644
--- a/arch/arm/mach-at91/at91sam9263.c
+++ b/arch/arm/mach-at91/at91sam9263.c
@@ -193,7 +193,7 @@ static struct clk_lookup periph_clocks_lookups[] = {
         CLKDEV_CON_DEV_ID("spi_clk", "atmel_spi.0", &spi0_clk),
         CLKDEV_CON_DEV_ID("spi_clk", "atmel_spi.1", &spi1_clk),
         CLKDEV_CON_DEV_ID("t0_clk", "atmel_tcb.0", &tcb_clk),
-        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9260", &twi_clk),
+        CLKDEV_CON_DEV_ID(NULL, "i2c-at91sam9260.0", &twi_clk),
         /* fake hclk clock */
         CLKDEV_CON_DEV_ID("hclk", "at91_ohci", &ohci_clk),
         CLKDEV_CON_ID("pioA", &pioA_clk),
diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
index 8dde220b42b6..cb85da2eccea 100644
--- a/arch/arm/mach-at91/at91sam9263_devices.c
+++ b/arch/arm/mach-at91/at91sam9263_devices.c
@@ -567,7 +567,7 @@ static struct i2c_gpio_platform_data pdata = {
 
 static struct platform_device at91sam9263_twi_device = {
         .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
         .dev.platform_data      = &pdata,
 };
 
@@ -600,7 +600,7 @@ static struct resource twi_resources[] = {
 
 static struct platform_device at91sam9263_twi_device = {
         .name           = "i2c-at91sam9260",
-        .id             = -1,
+        .id             = 0,
         .resource       = twi_resources,
         .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91sam9rl_devices.c b/arch/arm/mach-at91/at91sam9rl_devices.c
index d6ca0543ce8d..5047bdc92adf 100644
--- a/arch/arm/mach-at91/at91sam9rl_devices.c
+++ b/arch/arm/mach-at91/at91sam9rl_devices.c
@@ -314,7 +314,7 @@ static struct i2c_gpio_platform_data pdata = {
 
 static struct platform_device at91sam9rl_twi_device = {
         .name                   = "i2c-gpio",
-        .id                     = -1,
+        .id                     = 0,
         .dev.platform_data      = &pdata,
 };
 
@@ -347,7 +347,7 @@ static struct resource twi_resources[] = {
 
 static struct platform_device at91sam9rl_twi_device = {
         .name           = "i2c-at91sam9g20",
-        .id             = -1,
+        .id             = 0,
         .resource       = twi_resources,
         .num_resources  = ARRAY_SIZE(twi_resources),
 };
diff --git a/arch/arm/mach-at91/at91x40.c b/arch/arm/mach-at91/at91x40.c
index 6bd7300a2bc5..bb7f54474b92 100644
--- a/arch/arm/mach-at91/at91x40.c
+++ b/arch/arm/mach-at91/at91x40.c
@@ -88,6 +88,6 @@ void __init at91x40_init_interrupts(unsigned int priority[NR_AIC_IRQS])
         if (!priority)
                 priority = at91x40_default_irq_priority;
 
-        at91_aic_init(priority);
+        at91_aic_init(priority, at91_extern_irq);
 }
 
diff --git a/arch/arm/mach-at91/board-neocore926.c b/arch/arm/mach-at91/board-neocore926.c
index 9cda3fd346ae..6960778af4c2 100644
--- a/arch/arm/mach-at91/board-neocore926.c
+++ b/arch/arm/mach-at91/board-neocore926.c
@@ -129,7 +129,7 @@ static struct spi_board_info neocore926_spi_devices[] = {
                 .max_speed_hz   = 125000 * 16,
                 .bus_num        = 0,
                 .platform_data  = &ads_info,
-                .irq            = AT91SAM9263_ID_IRQ1,
+                .irq            = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1,
         },
 #endif
 };
diff --git a/arch/arm/mach-at91/board-sam9261ek.c b/arch/arm/mach-at91/board-sam9261ek.c
index 27b3af1a3047..a9167dd45f96 100644
--- a/arch/arm/mach-at91/board-sam9261ek.c
+++ b/arch/arm/mach-at91/board-sam9261ek.c
@@ -309,7 +309,7 @@ static struct spi_board_info ek_spi_devices[] = {
                 .max_speed_hz   = 125000 * 26,  /* (max sample rate @ 3V) * (cmd + data + overhead) */
                 .bus_num        = 0,
                 .platform_data  = &ads_info,
-                .irq            = AT91SAM9261_ID_IRQ0,
+                .irq            = NR_IRQS_LEGACY + AT91SAM9261_ID_IRQ0,
                 .controller_data = (void *) AT91_PIN_PA28,      /* CS pin */
         },
 #endif
diff --git a/arch/arm/mach-at91/board-sam9263ek.c b/arch/arm/mach-at91/board-sam9263ek.c
index 073e17403d98..b87dbe2be0d6 100644
--- a/arch/arm/mach-at91/board-sam9263ek.c
+++ b/arch/arm/mach-at91/board-sam9263ek.c
@@ -132,7 +132,7 @@ static struct spi_board_info ek_spi_devices[] = {
                 .max_speed_hz   = 125000 * 26,  /* (max sample rate @ 3V) * (cmd + data + overhead) */
                 .bus_num        = 0,
                 .platform_data  = &ads_info,
-                .irq            = AT91SAM9263_ID_IRQ1,
+                .irq            = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1,
         },
 #endif
 };
diff --git a/arch/arm/mach-at91/generic.h b/arch/arm/mach-at91/generic.h
index f49650677653..b62f560e6c75 100644
--- a/arch/arm/mach-at91/generic.h
+++ b/arch/arm/mach-at91/generic.h
@@ -26,7 +26,8 @@ extern void __init at91_dt_initialize(void);
 extern void __init at91_init_irq_default(void);
 extern void __init at91_init_interrupts(unsigned int priority[]);
 extern void __init at91x40_init_interrupts(unsigned int priority[]);
-extern void __init at91_aic_init(unsigned int priority[]);
+extern void __init at91_aic_init(unsigned int priority[],
+                                 unsigned int ext_irq_mask);
 extern int  __init at91_aic_of_init(struct device_node *node,
                                     struct device_node *parent);
 extern int  __init at91_aic5_of_init(struct device_node *node,
diff --git a/arch/arm/mach-at91/irq.c b/arch/arm/mach-at91/irq.c
index 1e02c0e49dcc..febc2ee901a5 100644
--- a/arch/arm/mach-at91/irq.c
+++ b/arch/arm/mach-at91/irq.c
@@ -502,14 +502,19 @@ int __init at91_aic5_of_init(struct device_node *node,
 /*
  * Initialize the AIC interrupt controller.
  */
-void __init at91_aic_init(unsigned int *priority)
+void __init at91_aic_init(unsigned int *priority, unsigned int ext_irq_mask)
 {
         unsigned int i;
         int irq_base;
 
-        if (at91_aic_pm_init())
+        at91_extern_irq = kzalloc(BITS_TO_LONGS(n_irqs)
+                                  * sizeof(*at91_extern_irq), GFP_KERNEL);
+
+        if (at91_aic_pm_init() || at91_extern_irq == NULL)
                 panic("Unable to allocate bit maps\n");
 
+        *at91_extern_irq = ext_irq_mask;
+
         at91_aic_base = ioremap(AT91_AIC, 512);
         if (!at91_aic_base)
                 panic("Unable to ioremap AIC registers\n");
diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
index da9881b161e1..0b32c81730a5 100644
--- a/arch/arm/mach-at91/setup.c
+++ b/arch/arm/mach-at91/setup.c
@@ -47,7 +47,7 @@ void __init at91_init_irq_default(void)
 void __init at91_init_interrupts(unsigned int *priority)
 {
         /* Initialize the AIC interrupt controller */
-        at91_aic_init(priority);
+        at91_aic_init(priority, at91_extern_irq);
 
         /* Enable GPIO interrupts */
         at91_gpio_irq_setup();
@@ -151,7 +151,7 @@ static void __init soc_detect(u32 dbgu_base)
         }
 
         /* at91sam9g10 */
-        if ((cidr & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) {
+        if ((socid & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) {
                 at91_soc_initdata.type = AT91_SOC_SAM9G10;
                 at91_boot_soc = at91sam9261_soc;
         }
diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c
index 715b690e5009..1947be8e5f5b 100644
--- a/arch/arm/mach-exynos/common.c
+++ b/arch/arm/mach-exynos/common.c
@@ -47,6 +47,7 @@
 #include <plat/fimc-core.h>
 #include <plat/iic-core.h>
 #include <plat/tv-core.h>
+#include <plat/spi-core.h>
 #include <plat/regs-serial.h>
 
 #include "common.h"
@@ -346,6 +347,8 @@ static void __init exynos4_map_io(void)
 
         s5p_fb_setname(0, "exynos4-fb");
         s5p_hdmi_setname("exynos4-hdmi");
+
+        s3c64xx_spi_setname("exynos4210-spi");
 }
 
 static void __init exynos5_map_io(void)
@@ -366,6 +369,8 @@ static void __init exynos5_map_io(void)
         s3c_i2c0_setname("s3c2440-i2c");
         s3c_i2c1_setname("s3c2440-i2c");
         s3c_i2c2_setname("s3c2440-i2c");
+
+        s3c64xx_spi_setname("exynos4210-spi");
 }
 
 static void __init exynos4_init_clocks(int xtal)
diff --git a/arch/arm/mach-exynos/mach-exynos4-dt.c b/arch/arm/mach-exynos/mach-exynos4-dt.c
index e58d786faf78..eadf4b59e7d2 100644
--- a/arch/arm/mach-exynos/mach-exynos4-dt.c
+++ b/arch/arm/mach-exynos/mach-exynos4-dt.c
@@ -99,6 +99,7 @@ static char const *exynos4_dt_compat[] __initdata = {
 
 DT_MACHINE_START(EXYNOS4210_DT, "Samsung Exynos4 (Flattened Device Tree)")
         /* Maintainer: Thomas Abraham <thomas.abraham@linaro.org> */
+        .smp            = smp_ops(exynos_smp_ops),
         .init_irq       = exynos4_init_irq,
         .map_io         = exynos4_dt_map_io,
         .handle_irq     = gic_handle_irq,
diff --git a/arch/arm/mach-imx/clk-busy.c b/arch/arm/mach-imx/clk-busy.c
index 1a7a8dd045a1..1ab91b5209e6 100644
--- a/arch/arm/mach-imx/clk-busy.c
+++ b/arch/arm/mach-imx/clk-busy.c
@@ -108,7 +108,7 @@ struct clk *imx_clk_busy_divider(const char *name, const char *parent_name,
         busy->div.hw.init = &init;
 
         clk = clk_register(NULL, &busy->div.hw);
-        if (!clk)
+        if (IS_ERR(clk))
                 kfree(busy);
 
         return clk;
diff --git a/arch/arm/mach-imx/clk-imx25.c b/arch/arm/mach-imx/clk-imx25.c
index d20d4795f4ea..01e2f843bf2e 100644
--- a/arch/arm/mach-imx/clk-imx25.c
+++ b/arch/arm/mach-imx/clk-imx25.c
@@ -127,8 +127,8 @@ int __init mx25_clocks_init(void)
         clk[esdhc2_ipg_per] = imx_clk_gate("esdhc2_ipg_per", "per4", ccm(CCM_CGCR0),  4);
         clk[gpt_ipg_per] = imx_clk_gate("gpt_ipg_per", "per5", ccm(CCM_CGCR0),  5);
         clk[i2c_ipg_per] = imx_clk_gate("i2c_ipg_per", "per6", ccm(CCM_CGCR0),  6);
-        clk[lcdc_ipg_per] = imx_clk_gate("lcdc_ipg_per", "per8", ccm(CCM_CGCR0),  7);
-        clk[nfc_ipg_per] = imx_clk_gate("nfc_ipg_per", "ipg_per", ccm(CCM_CGCR0),  8);
+        clk[lcdc_ipg_per] = imx_clk_gate("lcdc_ipg_per", "per7", ccm(CCM_CGCR0),  7);
+        clk[nfc_ipg_per] = imx_clk_gate("nfc_ipg_per", "per8", ccm(CCM_CGCR0),  8);
         clk[ssi1_ipg_per] = imx_clk_gate("ssi1_ipg_per", "per13", ccm(CCM_CGCR0), 13);
         clk[ssi2_ipg_per] = imx_clk_gate("ssi2_ipg_per", "per14", ccm(CCM_CGCR0), 14);
         clk[uart_ipg_per] = imx_clk_gate("uart_ipg_per", "per15", ccm(CCM_CGCR0), 15);
diff --git a/arch/arm/mach-imx/clk-imx27.c b/arch/arm/mach-imx/clk-imx27.c
index 3b6b640eed24..366e5d59d886 100644
--- a/arch/arm/mach-imx/clk-imx27.c
+++ b/arch/arm/mach-imx/clk-imx27.c
@@ -109,7 +109,7 @@ int __init mx27_clocks_init(unsigned long fref)
         clk[per3_div] = imx_clk_divider("per3_div", "mpll_main2", CCM_PCDR1, 16, 6);
         clk[per4_div] = imx_clk_divider("per4_div", "mpll_main2", CCM_PCDR1, 24, 6);
         clk[vpu_sel] = imx_clk_mux("vpu_sel", CCM_CSCR, 21, 1, vpu_sel_clks, ARRAY_SIZE(vpu_sel_clks));
-        clk[vpu_div] = imx_clk_divider("vpu_div", "vpu_sel", CCM_PCDR0, 10, 3);
+        clk[vpu_div] = imx_clk_divider("vpu_div", "vpu_sel", CCM_PCDR0, 10, 6);
         clk[usb_div] = imx_clk_divider("usb_div", "spll", CCM_CSCR, 28, 3);
         clk[cpu_sel] = imx_clk_mux("cpu_sel", CCM_CSCR, 15, 1, cpu_sel_clks, ARRAY_SIZE(cpu_sel_clks));
         clk[clko_sel] = imx_clk_mux("clko_sel", CCM_CCSR, 0, 5, clko_sel_clks, ARRAY_SIZE(clko_sel_clks));
@@ -121,7 +121,7 @@ int __init mx27_clocks_init(unsigned long fref)
         clk[ssi1_sel] = imx_clk_mux("ssi1_sel", CCM_CSCR, 22, 1, ssi_sel_clks, ARRAY_SIZE(ssi_sel_clks));
         clk[ssi2_sel] = imx_clk_mux("ssi2_sel", CCM_CSCR, 23, 1, ssi_sel_clks, ARRAY_SIZE(ssi_sel_clks));
         clk[ssi1_div] = imx_clk_divider("ssi1_div", "ssi1_sel", CCM_PCDR0, 16, 6);
-        clk[ssi2_div] = imx_clk_divider("ssi2_div", "ssi2_sel", CCM_PCDR0, 26, 3);
+        clk[ssi2_div] = imx_clk_divider("ssi2_div", "ssi2_sel", CCM_PCDR0, 26, 6);
         clk[clko_en] = imx_clk_gate("clko_en", "clko_div", CCM_PCCR0, 0);
         clk[ssi2_ipg_gate] = imx_clk_gate("ssi2_ipg_gate", "ipg", CCM_PCCR0, 0);
         clk[ssi1_ipg_gate] = imx_clk_gate("ssi1_ipg_gate", "ipg", CCM_PCCR0, 1);
diff --git a/arch/arm/mach-imx/mm-imx3.c b/arch/arm/mach-imx/mm-imx3.c
index 9d2c843bde02..b5deb0554552 100644
--- a/arch/arm/mach-imx/mm-imx3.c
+++ b/arch/arm/mach-imx/mm-imx3.c
@@ -108,9 +108,8 @@ void __init imx3_init_l2x0(void)
         }
 
         l2x0_base = ioremap(MX3x_L2CC_BASE_ADDR, 4096);
-        if (IS_ERR(l2x0_base)) {
-                printk(KERN_ERR "remapping L2 cache area failed with %ld\n",
-                                PTR_ERR(l2x0_base));
+        if (!l2x0_base) {
+                printk(KERN_ERR "remapping L2 cache area failed\n");
                 return;
         }
 
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 2a1a898c7f90..d669e227e00c 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -11,7 +11,6 @@ config ARCH_OMAP2PLUS_TYPICAL
         select I2C_OMAP
         select MENELAUS if ARCH_OMAP2
         select NEON if ARCH_OMAP3 || ARCH_OMAP4 || SOC_OMAP5
-        select PINCTRL
         select PM_RUNTIME
         select REGULATOR
         select SERIAL_OMAP
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index 388c431c745a..d41ab98890ff 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -24,6 +24,7 @@
 #include <linux/input.h>
 #include <linux/gpio_keys.h>
 #include <linux/opp.h>
+#include <linux/cpu.h>
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
@@ -444,27 +445,31 @@ static struct omap_board_mux board_mux[] __initdata = {
 };
 #endif
 
-static void __init beagle_opp_init(void)
+static int __init beagle_opp_init(void)
 {
         int r = 0;
 
-        /* Initialize the omap3 opp table */
-        if (omap3_opp_init()) {
+        if (!machine_is_omap3_beagle())
+                return 0;
+
+        /* Initialize the omap3 opp table if not already created. */
+        r = omap3_opp_init();
+        if (IS_ERR_VALUE(r) && (r != -EEXIST)) {
                 pr_err("%s: opp default init failed\n", __func__);
-                return;
+                return r;
         }
 
         /* Custom OPP enabled for all xM versions */
         if (cpu_is_omap3630()) {
                 struct device *mpu_dev, *iva_dev;
 
-                mpu_dev = omap_device_get_by_hwmod_name("mpu");
+                mpu_dev = get_cpu_device(0);
                 iva_dev = omap_device_get_by_hwmod_name("iva");
 
                 if (IS_ERR(mpu_dev) || IS_ERR(iva_dev)) {
                         pr_err("%s: Aiee.. no mpu/dsp devices? %p %p\n",
                                 __func__, mpu_dev, iva_dev);
-                        return;
+                        return -ENODEV;
                 }
                 /* Enable MPU 1GHz and lower opps */
                 r = opp_enable(mpu_dev, 800000000);
@@ -484,8 +489,9 @@ static void __init beagle_opp_init(void)
                         opp_disable(iva_dev, 660000000);
                 }
         }
-        return;
+        return 0;
 }
+device_initcall(beagle_opp_init);
 
 static void __init omap3_beagle_init(void)
 {
@@ -522,8 +528,6 @@ static void __init omap3_beagle_init(void)
         /* Ensure SDRC pins are mux'd for self-refresh */
         omap_mux_init_signal("sdrc_cke0", OMAP_PIN_OUTPUT);
         omap_mux_init_signal("sdrc_cke1", OMAP_PIN_OUTPUT);
-
-        beagle_opp_init();
 }
 
 MACHINE_START(OMAP3_BEAGLE, "OMAP3 Beagle Board")
diff --git a/arch/arm/mach-omap2/clock33xx_data.c b/arch/arm/mach-omap2/clock33xx_data.c
index 114ab4b8e0e3..1a45d6bd2539 100644
--- a/arch/arm/mach-omap2/clock33xx_data.c
+++ b/arch/arm/mach-omap2/clock33xx_data.c
@@ -1073,6 +1073,8 @@ static struct omap_clk am33xx_clks[] = {
         CLK(NULL,       "gfx_fck_div_ck",       &gfx_fck_div_ck,        CK_AM33XX),
         CLK(NULL,       "sysclkout_pre_ck",     &sysclkout_pre_ck,      CK_AM33XX),
         CLK(NULL,       "clkout2_ck",           &clkout2_ck,    CK_AM33XX),
+        CLK(NULL,       "timer_32k_ck",         &clkdiv32k_ick, CK_AM33XX),
+        CLK(NULL,       "timer_sys_ck",         &sys_clkin_ck,  CK_AM33XX),
 };
 
 int __init am33xx_clk_init(void)
diff --git a/arch/arm/mach-omap2/mux34xx.c b/arch/arm/mach-omap2/mux34xx.c
index 17f80e4ab162..c47140bbbec4 100644
--- a/arch/arm/mach-omap2/mux34xx.c
+++ b/arch/arm/mach-omap2/mux34xx.c
@@ -614,16 +614,16 @@ static struct omap_mux __initdata omap3_muxmodes[] = {
                 "sys_off_mode", NULL, NULL, NULL,
                 "gpio_9", NULL, NULL, "safe_mode"),
         _OMAP3_MUXENTRY(UART1_CTS, 150,
-                "uart1_cts", NULL, NULL, NULL,
+                "uart1_cts", "ssi1_rdy_tx", NULL, NULL,
                 "gpio_150", "hsusb3_tll_clk", NULL, "safe_mode"),
         _OMAP3_MUXENTRY(UART1_RTS, 149,
-                "uart1_rts", NULL, NULL, NULL,
+                "uart1_rts", "ssi1_flag_tx", NULL, NULL,
                 "gpio_149", NULL, NULL, "safe_mode"),
         _OMAP3_MUXENTRY(UART1_RX, 151,
-                "uart1_rx", NULL, "mcbsp1_clkr", "mcspi4_clk",
+                "uart1_rx", "ss1_wake_tx", "mcbsp1_clkr", "mcspi4_clk",
                 "gpio_151", NULL, NULL, "safe_mode"),
         _OMAP3_MUXENTRY(UART1_TX, 148,
-                "uart1_tx", NULL, NULL, NULL,
+                "uart1_tx", "ssi1_dat_tx", NULL, NULL,
                 "gpio_148", NULL, NULL, "safe_mode"),
         _OMAP3_MUXENTRY(UART2_CTS, 144,
                 "uart2_cts", "mcbsp3_dx", "gpt9_pwm_evt", NULL,
diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h
index 686137d164da..67d66131cfa7 100644
--- a/arch/arm/mach-omap2/pm.h
+++ b/arch/arm/mach-omap2/pm.h
@@ -91,6 +91,7 @@ extern void omap3_save_scratchpad_contents(void);
 
 #define PM_RTA_ERRATUM_i608             (1 << 0)
 #define PM_SDRC_WAKEUP_ERRATUM_i583     (1 << 1)
+#define PM_PER_MEMORIES_ERRATUM_i582    (1 << 2)
 
 #if defined(CONFIG_PM) && defined(CONFIG_ARCH_OMAP3)
 extern u16 pm34xx_errata;
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index ba670db1fd37..3a904de4313e 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -652,14 +652,17 @@ static void __init pm_errata_configure(void)
                 /* Enable the l2 cache toggling in sleep logic */
                 enable_omap3630_toggle_l2_on_restore();
                 if (omap_rev() < OMAP3630_REV_ES1_2)
-                        pm34xx_errata |= PM_SDRC_WAKEUP_ERRATUM_i583;
+                        pm34xx_errata |= (PM_SDRC_WAKEUP_ERRATUM_i583 |
+                                          PM_PER_MEMORIES_ERRATUM_i582);
+        } else if (cpu_is_omap34xx()) {
+                pm34xx_errata |= PM_PER_MEMORIES_ERRATUM_i582;
         }
 }
 
 int __init omap3_pm_init(void)
 {
         struct power_state *pwrst, *tmp;
-        struct clockdomain *neon_clkdm, *mpu_clkdm;
+        struct clockdomain *neon_clkdm, *mpu_clkdm, *per_clkdm, *wkup_clkdm;
         int ret;
 
         if (!omap3_has_io_chain_ctrl())
@@ -711,6 +714,8 @@ int __init omap3_pm_init(void)
 
         neon_clkdm = clkdm_lookup("neon_clkdm");
         mpu_clkdm = clkdm_lookup("mpu_clkdm");
+        per_clkdm = clkdm_lookup("per_clkdm");
+        wkup_clkdm = clkdm_lookup("wkup_clkdm");
 
 #ifdef CONFIG_SUSPEND
         omap_pm_suspend = omap3_pm_suspend;
@@ -727,6 +732,27 @@ int __init omap3_pm_init(void)
         if (IS_PM34XX_ERRATUM(PM_RTA_ERRATUM_i608))
                 omap3630_ctrl_disable_rta();
 
+        /*
+         * The UART3/4 FIFO and the sidetone memory in McBSP2/3 are
+         * not correctly reset when the PER powerdomain comes back
+         * from OFF or OSWR when the CORE powerdomain is kept active.
+         * See OMAP36xx Erratum i582 "PER Domain reset issue after
+         * Domain-OFF/OSWR Wakeup".  This wakeup dependency is not a
+         * complete workaround.  The kernel must also prevent the PER
+         * powerdomain from going to OSWR/OFF while the CORE
+         * powerdomain is not going to OSWR/OFF.  And if PER last
+         * power state was off while CORE last power state was ON, the
+         * UART3/4 and McBSP2/3 SIDETONE devices need to run a
+         * self-test using their loopback tests; if that fails, those
+         * devices are unusable until the PER/CORE can complete a transition
+         * from ON to OSWR/OFF and then back to ON.
+         *
+         * XXX Technically this workaround is only needed if off-mode
+         * or OSWR is enabled.
+         */
+        if (IS_PM34XX_ERRATUM(PM_PER_MEMORIES_ERRATUM_i582))
+                clkdm_add_wkdep(per_clkdm, wkup_clkdm);
+
         clkdm_add_wkdep(neon_clkdm, mpu_clkdm);
         if (omap_type() != OMAP2_DEVICE_TYPE_GP) {
                 omap3_secure_ram_storage =
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index 0405c8190803..a507cd6cf4f1 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -329,6 +329,11 @@ void __init omap_serial_init_port(struct omap_board_data *bdata,
 
         oh->mux = omap_hwmod_mux_init(bdata->pads, bdata->pads_cnt);
 
+        if (console_uart_id == bdata->id) {
+                omap_device_enable(pdev);
+                pm_runtime_set_active(&pdev->dev);
+        }
+
         oh->dev_attr = uart;
 
         if (((cpu_is_omap34xx() || cpu_is_omap44xx()) && bdata->pads)
diff --git a/arch/arm/mach-s3c24xx/s3c2416.c b/arch/arm/mach-s3c24xx/s3c2416.c
index ed5a95ece9eb..77ee0b732237 100644
--- a/arch/arm/mach-s3c24xx/s3c2416.c
+++ b/arch/arm/mach-s3c24xx/s3c2416.c
@@ -61,6 +61,7 @@
 #include <plat/nand-core.h>
 #include <plat/adc-core.h>
 #include <plat/rtc-core.h>
+#include <plat/spi-core.h>
 
 static struct map_desc s3c2416_iodesc[] __initdata = {
         IODESC_ENT(WATCHDOG),
@@ -132,6 +133,7 @@ void __init s3c2416_map_io(void)
         /* initialize device information early */
         s3c2416_default_sdhci0();
         s3c2416_default_sdhci1();
+        s3c64xx_spi_setname("s3c2443-spi");
 
         iotable_init(s3c2416_iodesc, ARRAY_SIZE(s3c2416_iodesc));
 }
diff --git a/arch/arm/mach-s3c24xx/s3c2443.c b/arch/arm/mach-s3c24xx/s3c2443.c
index ab648ad8fa50..165b6a6b3daa 100644
--- a/arch/arm/mach-s3c24xx/s3c2443.c
+++ b/arch/arm/mach-s3c24xx/s3c2443.c
@@ -43,6 +43,7 @@
 #include <plat/nand-core.h>
 #include <plat/adc-core.h>
 #include <plat/rtc-core.h>
+#include <plat/spi-core.h>
 
 static struct map_desc s3c2443_iodesc[] __initdata = {
         IODESC_ENT(WATCHDOG),
@@ -100,6 +101,9 @@ void __init s3c2443_map_io(void)
         s3c24xx_gpiocfg_default.set_pull = s3c2443_gpio_setpull;
         s3c24xx_gpiocfg_default.get_pull = s3c2443_gpio_getpull;
 
+        /* initialize device information early */
+        s3c64xx_spi_setname("s3c2443-spi");
+
         iotable_init(s3c2443_iodesc, ARRAY_SIZE(s3c2443_iodesc));
 }
 
diff --git a/arch/arm/mach-s5p64x0/common.c b/arch/arm/mach-s5p64x0/common.c
index 6e6a0a9d6778..111e404a81fd 100644
--- a/arch/arm/mach-s5p64x0/common.c
+++ b/arch/arm/mach-s5p64x0/common.c
@@ -44,6 +44,7 @@
 #include <plat/sdhci.h>
 #include <plat/adc-core.h>
 #include <plat/fb-core.h>
+#include <plat/spi-core.h>
 #include <plat/gpio-cfg.h>
 #include <plat/regs-irqtype.h>
 #include <plat/regs-serial.h>
@@ -179,6 +180,7 @@ void __init s5p6440_map_io(void)
         /* initialize any device information early */
         s3c_adc_setname("s3c64xx-adc");
         s3c_fb_setname("s5p64x0-fb");
+        s3c64xx_spi_setname("s5p64x0-spi");
 
         s5p64x0_default_sdhci0();
         s5p64x0_default_sdhci1();
@@ -193,6 +195,7 @@ void __init s5p6450_map_io(void)
         /* initialize any device information early */
         s3c_adc_setname("s3c64xx-adc");
         s3c_fb_setname("s5p64x0-fb");
+        s3c64xx_spi_setname("s5p64x0-spi");
 
         s5p64x0_default_sdhci0();
         s5p64x0_default_sdhci1();
diff --git a/arch/arm/mach-s5pc100/common.c b/arch/arm/mach-s5pc100/common.c
index 621908658861..cc6e561c9958 100644
--- a/arch/arm/mach-s5pc100/common.c
+++ b/arch/arm/mach-s5pc100/common.c
@@ -45,6 +45,7 @@
 #include <plat/fb-core.h>
 #include <plat/iic-core.h>
 #include <plat/onenand-core.h>
+#include <plat/spi-core.h>
 #include <plat/regs-serial.h>
 #include <plat/watchdog-reset.h>
 
@@ -165,6 +166,8 @@ void __init s5pc100_map_io(void)
         s3c_onenand_setname("s5pc100-onenand");
         s3c_fb_setname("s5pc100-fb");
         s3c_cfcon_setname("s5pc100-pata");
+
+        s3c64xx_spi_setname("s5pc100-spi");
 }
 
 void __init s5pc100_init_clocks(int xtal)
diff --git a/arch/arm/mach-s5pv210/common.c b/arch/arm/mach-s5pv210/common.c
index 4c9e9027df9a..a0c50efe8145 100644
--- a/arch/arm/mach-s5pv210/common.c
+++ b/arch/arm/mach-s5pv210/common.c
@@ -43,6 +43,7 @@
 #include <plat/iic-core.h>
 #include <plat/keypad-core.h>
 #include <plat/tv-core.h>
+#include <plat/spi-core.h>
 #include <plat/regs-serial.h>
 
 #include "common.h"
@@ -196,6 +197,8 @@ void __init s5pv210_map_io(void)
 
         /* setup TV devices */
         s5p_hdmi_setname("s5pv210-hdmi");
+
+        s3c64xx_spi_setname("s5pv210-spi");
 }
 
 void __init s5pv210_init_clocks(int xtal)
diff --git a/arch/arm/mach-shmobile/setup-r8a7779.c b/arch/arm/mach-shmobile/setup-r8a7779.c
index 2917668f0091..ebbffc25f24f 100644
--- a/arch/arm/mach-shmobile/setup-r8a7779.c
+++ b/arch/arm/mach-shmobile/setup-r8a7779.c
@@ -247,7 +247,7 @@ void __init r8a7779_add_standard_devices(void)
 {
 #ifdef CONFIG_CACHE_L2X0
         /* Early BRESP enable, Shared attribute override enable, 64K*16way */
-        l2x0_init((void __iomem __force *)(0xf0100000), 0x40470000, 0x82000fff);
+        l2x0_init(IOMEM(0xf0100000), 0x40470000, 0x82000fff);
 #endif
         r8a7779_pm_init();
 
diff --git a/arch/arm/mach-spear13xx/include/mach/spear1310_misc_regs.h b/arch/arm/mach-spear13xx/include/mach/spear1310_misc_regs.h
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/arch/arm/mach-spear13xx/include/mach/spear1310_misc_regs.h
+++ /dev/null
diff --git a/arch/arm/mach-spear13xx/include/mach/spear1340_misc_regs.h b/arch/arm/mach-spear13xx/include/mach/spear1340_misc_regs.h
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/arch/arm/mach-spear13xx/include/mach/spear1340_misc_regs.h
+++ /dev/null
diff --git a/arch/arm/mach-ux500/cpu.c b/arch/arm/mach-ux500/cpu.c
index 2236cbd03cd7..1f3fbc2bb776 100644
--- a/arch/arm/mach-ux500/cpu.c
+++ b/arch/arm/mach-ux500/cpu.c
@@ -16,6 +16,7 @@
 #include <linux/stat.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
+#include <linux/irq.h>
 #include <linux/platform_data/clk-ux500.h>
 
 #include <asm/hardware/gic.h>
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index b9f60ebe3bc4..023f443784ec 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -856,8 +856,10 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
                 if (thumb2_32b) {
                         offset.un = 0;
                         handler = do_alignment_t32_to_handler(&instr, regs, &offset);
-                } else
+                } else {
+                        offset.un = 0;
                         handler = do_alignment_ldmstm;
+                }
                 break;
 
         default:
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 477a2d23ddf1..58bc3e4d3bd0 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -610,7 +610,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
                          gfp_t gfp, pgprot_t prot, bool is_coherent, const void *caller)
 {
         u64 mask = get_coherent_dma_mask(dev);
-        struct page *page;
+        struct page *page = NULL;
         void *addr;
 
 #ifdef CONFIG_DMA_API_DEBUG
diff --git a/arch/arm/mm/vmregion.h b/arch/arm/mm/vmregion.h
index bf312c354a21..0f5a5f2a2c7b 100644
--- a/arch/arm/mm/vmregion.h
+++ b/arch/arm/mm/vmregion.h
@@ -17,7 +17,6 @@ struct arm_vmregion {
         struct list_head        vm_list;
         unsigned long           vm_start;
         unsigned long           vm_end;
-        void                    *priv;
         int                     vm_active;
         const void              *caller;
 };
diff --git a/arch/arm/plat-mxc/devices/platform-mxc-mmc.c b/arch/arm/plat-mxc/devices/platform-mxc-mmc.c
index 540d3a7d92df..e7b920b58675 100644
--- a/arch/arm/plat-mxc/devices/platform-mxc-mmc.c
+++ b/arch/arm/plat-mxc/devices/platform-mxc-mmc.c
@@ -55,7 +55,7 @@ struct platform_device *__init imx_add_mxc_mmc(
         struct resource res[] = {
                 {
                         .start = data->iobase,
-                        .end = data->iobase + SZ_4K - 1,
+                        .end = data->iobase + data->iosize - 1,
                         .flags = IORESOURCE_MEM,
                 }, {
                         .start = data->irq,
diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig
index 7cd56ed5cd94..82fcb206b5b2 100644
--- a/arch/arm/plat-omap/Kconfig
+++ b/arch/arm/plat-omap/Kconfig
@@ -26,6 +26,7 @@ config ARCH_OMAP2PLUS
         select CLKDEV_LOOKUP
         select GENERIC_IRQ_CHIP
         select OMAP_DM_TIMER
+        select PINCTRL
         select PROC_DEVICETREE if PROC_FS
         select SPARSE_IRQ
         select USE_OF
diff --git a/arch/arm/plat-omap/include/plat/omap-serial.h b/arch/arm/plat-omap/include/plat/omap-serial.h
index f4a4cd014795..1957a8516e93 100644
--- a/arch/arm/plat-omap/include/plat/omap-serial.h
+++ b/arch/arm/plat-omap/include/plat/omap-serial.h
@@ -40,10 +40,10 @@
 #define OMAP_UART_WER_MOD_WKUP  0X7F
 
 /* Enable XON/XOFF flow control on output */
-#define OMAP_UART_SW_TX         0x8
+#define OMAP_UART_SW_TX         0x04
 
 /* Enable XON/XOFF flow control on input */
-#define OMAP_UART_SW_RX         0x2
+#define OMAP_UART_SW_RX         0x04
 
 #define OMAP_UART_SYSC_RESET    0X07
 #define OMAP_UART_TCR_TRIG      0X0F
diff --git a/arch/arm/plat-samsung/include/plat/spi-core.h b/arch/arm/plat-samsung/include/plat/spi-core.h
new file mode 100644
index 000000000000..0b9428ab3fc3
--- /dev/null
+++ b/arch/arm/plat-samsung/include/plat/spi-core.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2012 Heiko Stuebner <heiko@sntech.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __PLAT_S3C_SPI_CORE_H
+#define __PLAT_S3C_SPI_CORE_H
+
+/* These functions are only for use with the core support code, such as
+ * the cpu specific initialisation code
+ */
+
+/* re-define device name depending on support. */
+static inline void s3c64xx_spi_setname(char *name)
+{
+#ifdef CONFIG_S3C64XX_DEV_SPI0
+        s3c64xx_device_spi0.name = name;
+#endif
+#ifdef CONFIG_S3C64XX_DEV_SPI1
+        s3c64xx_device_spi1.name = name;
+#endif
+#ifdef CONFIG_S3C64XX_DEV_SPI2
+        s3c64xx_device_spi2.name = name;
+#endif
+}
+
+#endif /* __PLAT_S3C_SPI_CORE_H */
diff --git a/arch/arm/tools/Makefile b/arch/arm/tools/Makefile
index 635cb1865e4d..cd60a81163e9 100644
--- a/arch/arm/tools/Makefile
+++ b/arch/arm/tools/Makefile
@@ -5,6 +5,6 @@
 #
 
 include/generated/mach-types.h: $(src)/gen-mach-types $(src)/mach-types
-        @echo '  Generating $@'
+        $(kecho) '  Generating $@'
         @mkdir -p $(dir $@)
         $(Q)$(AWK) -f $^ > $@ || { rm -f $@; /bin/false; }
diff --git a/arch/arm/xen/grant-table.c b/arch/arm/xen/grant-table.c
index dbd1330c0196..859a9bb002d5 100644
--- a/arch/arm/xen/grant-table.c
+++ b/arch/arm/xen/grant-table.c
@@ -33,7 +33,7 @@
 #include <xen/page.h>
 #include <xen/grant_table.h>
 
-int arch_gnttab_map_shared(unsigned long *frames, unsigned long nr_gframes,
+int arch_gnttab_map_shared(xen_pfn_t *frames, unsigned long nr_gframes,
                            unsigned long max_nr_gframes,
                            void **__shared)
 {
diff --git a/arch/ia64/include/asm/Kbuild b/arch/ia64/include/asm/Kbuild
index 4a159da23633..dd02f09b6eda 100644
--- a/arch/ia64/include/asm/Kbuild
+++ b/arch/ia64/include/asm/Kbuild
@@ -1,3 +1,4 @@
 
 generic-y += clkdev.h
 generic-y += exec.h
+generic-y += kvm_para.h
diff --git a/arch/ia64/include/asm/kvm_para.h b/arch/ia64/include/asm/kvm_para.h
deleted file mode 100644
index 47c00f910434..000000000000
--- a/arch/ia64/include/asm/kvm_para.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright (C) 2007 Xiantao Zhang <xiantao.zhang@intel.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place - Suite 330, Boston, MA 02111-1307 USA.
- *
- */
-#ifndef __IA64_KVM_PARA_H
-#define __IA64_KVM_PARA_H
-
-#include <uapi/asm/kvm_para.h>
-
-
-static inline unsigned int kvm_arch_para_features(void)
-{
-        return 0;
-}
-
-static inline bool kvm_check_and_clear_guest_paused(void)
-{
-        return false;
-}
-
-#endif
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index ecb540810ab3..88fa3ac86fae 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -1,5 +1,3 @@
-include include/asm-generic/Kbuild.asm
-header-y += cachectl.h
 
 generic-y += bitsperlong.h
 generic-y += clkdev.h
diff --git a/arch/m68k/include/asm/ptrace.h b/arch/m68k/include/asm/ptrace.h
index 5e08b597f012..0f717045bdde 100644
--- a/arch/m68k/include/asm/ptrace.h
+++ b/arch/m68k/include/asm/ptrace.h
@@ -1,82 +1,10 @@
 #ifndef _M68K_PTRACE_H
 #define _M68K_PTRACE_H
 
-#define PT_D1      0
-#define PT_D2      1
-#define PT_D3      2
-#define PT_D4      3
-#define PT_D5      4
-#define PT_D6      5
-#define PT_D7      6
-#define PT_A0      7
-#define PT_A1      8
-#define PT_A2      9
-#define PT_A3      10
-#define PT_A4      11
-#define PT_A5      12
-#define PT_A6      13
-#define PT_D0      14
-#define PT_USP     15
-#define PT_ORIG_D0 16
-#define PT_SR      17
-#define PT_PC      18
+#include <uapi/asm/ptrace.h>
 
 #ifndef __ASSEMBLY__
 
-/* this struct defines the way the registers are stored on the
-   stack during a system call. */
-
-struct pt_regs {
-  long     d1;
-  long     d2;
-  long     d3;
-  long     d4;
-  long     d5;
-  long     a0;
-  long     a1;
-  long     a2;
-  long     d0;
-  long     orig_d0;
-  long     stkadj;
-#ifdef CONFIG_COLDFIRE
-  unsigned format :  4; /* frame format specifier */
-  unsigned vector : 12; /* vector offset */
-  unsigned short sr;
-  unsigned long  pc;
-#else
-  unsigned short sr;
-  unsigned long  pc;
-  unsigned format :  4; /* frame format specifier */
-  unsigned vector : 12; /* vector offset */
-#endif
-};
-
-/*
- * This is the extended stack used by signal handlers and the context
- * switcher: it's pushed after the normal "struct pt_regs".
- */
-struct switch_stack {
-        unsigned long  d6;
-        unsigned long  d7;
-        unsigned long  a3;
-        unsigned long  a4;
-        unsigned long  a5;
-        unsigned long  a6;
-        unsigned long  retpc;
-};
-
-/* Arbitrarily choose the same ptrace numbers as used by the Sparc code. */
-#define PTRACE_GETREGS            12
-#define PTRACE_SETREGS            13
-#define PTRACE_GETFPREGS          14
-#define PTRACE_SETFPREGS          15
-
-#define PTRACE_GET_THREAD_AREA    25
-
-#define PTRACE_SINGLEBLOCK      33      /* resume execution until next branch */
-
-#ifdef __KERNEL__
-
 #ifndef PS_S
 #define PS_S  (0x2000)
 #define PS_M  (0x1000)
@@ -94,6 +22,5 @@ struct switch_stack {
 #define arch_has_block_step()   (1)
 #endif
 
-#endif /* __KERNEL__ */
 #endif /* __ASSEMBLY__ */
 #endif /* _M68K_PTRACE_H */
diff --git a/arch/m68k/include/asm/setup.h b/arch/m68k/include/asm/setup.h
index 00c2c5397d37..65e78a2dad64 100644
--- a/arch/m68k/include/asm/setup.h
+++ b/arch/m68k/include/asm/setup.h
@@ -19,33 +19,12 @@
 **   Redesign of the boot information structure; moved boot information
 **   structure to bootinfo.h
 */
-
 #ifndef _M68K_SETUP_H
 #define _M68K_SETUP_H
 
+#include <uapi/asm/setup.h>
 
 
-    /*
-     *  Linux/m68k Architectures
-     */
-
-#define MACH_AMIGA    1
-#define MACH_ATARI    2
-#define MACH_MAC      3
-#define MACH_APOLLO   4
-#define MACH_SUN3     5
-#define MACH_MVME147  6
-#define MACH_MVME16x  7
-#define MACH_BVME6000 8
-#define MACH_HP300    9
-#define MACH_Q40     10
-#define MACH_SUN3X   11
-#define MACH_M54XX   12
-
-#define COMMAND_LINE_SIZE 256
-
-#ifdef __KERNEL__
-
 #define CL_SIZE COMMAND_LINE_SIZE
 
 #ifndef __ASSEMBLY__
@@ -194,63 +173,6 @@ extern unsigned long m68k_machtype;
 #  define MACH_TYPE (m68k_machtype)
 #endif
 
-#endif /* __KERNEL__ */
-
-
-    /*
-     *  CPU, FPU and MMU types
-     *
-     *  Note: we may rely on the following equalities:
-     *
-     *      CPU_68020 == MMU_68851
-     *      CPU_68030 == MMU_68030
-     *      CPU_68040 == FPU_68040 == MMU_68040
-     *      CPU_68060 == FPU_68060 == MMU_68060
-     */
-
-#define CPUB_68020     0
-#define CPUB_68030     1
-#define CPUB_68040     2
-#define CPUB_68060     3
-#define CPUB_COLDFIRE  4
-
-#define CPU_68020      (1<<CPUB_68020)
-#define CPU_68030      (1<<CPUB_68030)
-#define CPU_68040      (1<<CPUB_68040)
-#define CPU_68060      (1<<CPUB_68060)
-#define CPU_COLDFIRE   (1<<CPUB_COLDFIRE)
-
-#define FPUB_68881     0
-#define FPUB_68882     1
-#define FPUB_68040     2                       /* Internal FPU */
-#define FPUB_68060     3                       /* Internal FPU */
-#define FPUB_SUNFPA    4                       /* Sun-3 FPA */
-#define FPUB_COLDFIRE  5                       /* ColdFire FPU */
-
-#define FPU_68881      (1<<FPUB_68881)
-#define FPU_68882      (1<<FPUB_68882)
-#define FPU_68040      (1<<FPUB_68040)
-#define FPU_68060      (1<<FPUB_68060)
-#define FPU_SUNFPA     (1<<FPUB_SUNFPA)
-#define FPU_COLDFIRE   (1<<FPUB_COLDFIRE)
-
-#define MMUB_68851     0
-#define MMUB_68030     1                       /* Internal MMU */
-#define MMUB_68040     2                       /* Internal MMU */
-#define MMUB_68060     3                       /* Internal MMU */
-#define MMUB_APOLLO    4                       /* Custom Apollo */
-#define MMUB_SUN3      5                       /* Custom Sun-3 */
-#define MMUB_COLDFIRE  6                       /* Internal MMU */
-
-#define MMU_68851      (1<<MMUB_68851)
-#define MMU_68030      (1<<MMUB_68030)
-#define MMU_68040      (1<<MMUB_68040)
-#define MMU_68060      (1<<MMUB_68060)
-#define MMU_SUN3       (1<<MMUB_SUN3)
-#define MMU_APOLLO     (1<<MMUB_APOLLO)
-#define MMU_COLDFIRE   (1<<MMUB_COLDFIRE)
-
-#ifdef __KERNEL__
 
 #ifndef __ASSEMBLY__
 extern unsigned long m68k_cputype;
@@ -385,6 +307,4 @@ extern int m68k_realnum_memory;		/* real # of memory blocks found */
 extern struct mem_info m68k_memory[NUM_MEMINFO];/* memory description */
 #endif
 
-#endif /* __KERNEL__ */
-
 #endif /* _M68K_SETUP_H */
diff --git a/arch/m68k/include/asm/signal.h b/arch/m68k/include/asm/signal.h
index 60e88660169c..67e489d8d1bd 100644
--- a/arch/m68k/include/asm/signal.h
+++ b/arch/m68k/include/asm/signal.h
@@ -1,12 +1,8 @@
 #ifndef _M68K_SIGNAL_H
 #define _M68K_SIGNAL_H
 
-#include <linux/types.h>
+#include <uapi/asm/signal.h>
 
-/* Avoid too many header ordering problems.  */
-struct siginfo;
-
-#ifdef __KERNEL__
 /* Most things should be clean enough to redefine this at will, if care
    is taken to make libc match.  */
 
@@ -20,92 +16,6 @@ typedef struct {
         unsigned long sig[_NSIG_WORDS];
 } sigset_t;
 
-#else
-/* Here we must cater to libcs that poke about in kernel headers.  */
-
-#define NSIG            32
-typedef unsigned long sigset_t;
-
-#endif /* __KERNEL__ */
-
-#define SIGHUP           1
-#define SIGINT           2
-#define SIGQUIT          3
-#define SIGILL           4
-#define SIGTRAP          5
-#define SIGABRT          6
-#define SIGIOT           6
-#define SIGBUS           7
-#define SIGFPE           8
-#define SIGKILL          9
-#define SIGUSR1         10
-#define SIGSEGV         11
-#define SIGUSR2         12
-#define SIGPIPE         13
-#define SIGALRM         14
-#define SIGTERM         15
-#define SIGSTKFLT       16
-#define SIGCHLD         17
-#define SIGCONT         18
-#define SIGSTOP         19
-#define SIGTSTP         20
-#define SIGTTIN         21
-#define SIGTTOU         22
-#define SIGURG          23
-#define SIGXCPU         24
-#define SIGXFSZ         25
-#define SIGVTALRM       26
-#define SIGPROF         27
-#define SIGWINCH        28
-#define SIGIO           29
-#define SIGPOLL         SIGIO
-/*
-#define SIGLOST         29
-*/
-#define SIGPWR          30
-#define SIGSYS          31
-#define SIGUNUSED       31
-
-/* These should not be considered constants from userland.  */
-#define SIGRTMIN        32
-#define SIGRTMAX        _NSIG
-
-/*
- * SA_FLAGS values:
- *
- * SA_ONSTACK indicates that a registered stack_t will be used.
- * SA_RESTART flag to get restarting signals (which were the default long ago)
- * SA_NOCLDSTOP flag to turn off SIGCHLD when children stop.
- * SA_RESETHAND clears the handler when the signal is delivered.
- * SA_NOCLDWAIT flag on SIGCHLD to inhibit zombies.
- * SA_NODEFER prevents the current signal from being masked in the handler.
- *
- * SA_ONESHOT and SA_NOMASK are the historical Linux names for the Single
- * Unix names RESETHAND and NODEFER respectively.
- */
-#define SA_NOCLDSTOP    0x00000001
-#define SA_NOCLDWAIT    0x00000002
-#define SA_SIGINFO      0x00000004
-#define SA_ONSTACK      0x08000000
-#define SA_RESTART      0x10000000
-#define SA_NODEFER      0x40000000
-#define SA_RESETHAND    0x80000000
-
-#define SA_NOMASK       SA_NODEFER
-#define SA_ONESHOT      SA_RESETHAND
-
-/*
- * sigaltstack controls
- */
-#define SS_ONSTACK      1
-#define SS_DISABLE      2
-
-#define MINSIGSTKSZ     2048
-#define SIGSTKSZ        8192
-
-#include <asm-generic/signal-defs.h>
-
-#ifdef __KERNEL__
 struct old_sigaction {
         __sighandler_t sa_handler;
         old_sigset_t sa_mask;
@@ -123,31 +33,6 @@ struct sigaction {
 struct k_sigaction {
         struct sigaction sa;
 };
-#else
-/* Here we must cater to libcs that poke about in kernel headers.  */
-
-struct sigaction {
-        union {
-          __sighandler_t _sa_handler;
-          void (*_sa_sigaction)(int, struct siginfo *, void *);
-        } _u;
-        sigset_t sa_mask;
-        unsigned long sa_flags;
-        void (*sa_restorer)(void);
-};
-
-#define sa_handler      _u._sa_handler
-#define sa_sigaction    _u._sa_sigaction
-
-#endif /* __KERNEL__ */
-
-typedef struct sigaltstack {
-        void __user *ss_sp;
-        int ss_flags;
-        size_t ss_size;
-} stack_t;
-
-#ifdef __KERNEL__
 #include <asm/sigcontext.h>
 
 #ifndef CONFIG_CPU_HAS_NO_BITFIELDS
@@ -208,5 +93,4 @@ struct pt_regs;
 extern void ptrace_signal_deliver(struct pt_regs *regs, void *cookie);
 #endif /* __uClinux__ */
 
-#endif /* __KERNEL__ */
 #endif /* _M68K_SIGNAL_H */
diff --git a/arch/m68k/include/asm/termios.h b/arch/m68k/include/asm/termios.h
index 0823032e4045..ad8efb098663 100644
--- a/arch/m68k/include/asm/termios.h
+++ b/arch/m68k/include/asm/termios.h
@@ -1,27 +1,8 @@
 #ifndef _M68K_TERMIOS_H
 #define _M68K_TERMIOS_H
 
-#include <asm/termbits.h>
-#include <asm/ioctls.h>
+#include <uapi/asm/termios.h>
 
-struct winsize {
-        unsigned short ws_row;
-        unsigned short ws_col;
-        unsigned short ws_xpixel;
-        unsigned short ws_ypixel;
-};
-
-#define NCC 8
-struct termio {
-        unsigned short c_iflag;         /* input mode flags */
-        unsigned short c_oflag;         /* output mode flags */
-        unsigned short c_cflag;         /* control mode flags */
-        unsigned short c_lflag;         /* local mode flags */
-        unsigned char c_line;           /* line discipline */
-        unsigned char c_cc[NCC];        /* control characters */
-};
-
-#ifdef __KERNEL__
 /*      intr=^C         quit=^|         erase=del       kill=^U
         eof=^D          vtime=\0        vmin=\1         sxtc=\0
         start=^Q        stop=^S         susp=^Z         eol=\0
@@ -29,27 +10,6 @@ struct termio {
         eol2=\0
 */
 #define INIT_C_CC "\003\034\177\025\004\0\1\0\021\023\032\0\022\017\027\026\0"
-#endif
-
-/* modem lines */
-#define TIOCM_LE        0x001
-#define TIOCM_DTR       0x002
-#define TIOCM_RTS       0x004
-#define TIOCM_ST        0x008
-#define TIOCM_SR        0x010
-#define TIOCM_CTS       0x020
-#define TIOCM_CAR       0x040
-#define TIOCM_RNG       0x080
-#define TIOCM_DSR       0x100
-#define TIOCM_CD        TIOCM_CAR
-#define TIOCM_RI        TIOCM_RNG
-#define TIOCM_OUT1      0x2000
-#define TIOCM_OUT2      0x4000
-#define TIOCM_LOOP      0x8000
-
-/* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
-
-#ifdef __KERNEL__
 
 /*
  * Translate a "termio" structure into a "termios". Ugh.
@@ -87,6 +47,4 @@ struct termio {
 #define user_termios_to_kernel_termios_1(k, u) copy_from_user(k, u, sizeof(struct termios))
 #define kernel_termios_to_user_termios_1(u, k) copy_to_user(u, k, sizeof(struct termios))
 
-#endif  /* __KERNEL__ */
-
 #endif /* _M68K_TERMIOS_H */
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index c702ad716791..5fc7f7bec1c8 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -1,361 +1,10 @@
 #ifndef _ASM_M68K_UNISTD_H_
 #define _ASM_M68K_UNISTD_H_
 
-/*
- * This file contains the system call numbers.
- */
-
-#define __NR_restart_syscall      0
-#define __NR_exit                 1
-#define __NR_fork                 2
-#define __NR_read                 3
-#define __NR_write                4
-#define __NR_open                 5
-#define __NR_close                6
-#define __NR_waitpid              7
-#define __NR_creat                8
-#define __NR_link                 9
-#define __NR_unlink              10
-#define __NR_execve              11
-#define __NR_chdir               12
-#define __NR_time                13
-#define __NR_mknod               14
-#define __NR_chmod               15
-#define __NR_chown               16
-/*#define __NR_break             17*/
-#define __NR_oldstat             18
-#define __NR_lseek               19
-#define __NR_getpid              20
-#define __NR_mount               21
-#define __NR_umount              22
-#define __NR_setuid              23
-#define __NR_getuid              24
-#define __NR_stime               25
-#define __NR_ptrace              26
-#define __NR_alarm               27
-#define __NR_oldfstat            28
-#define __NR_pause               29
-#define __NR_utime               30
-/*#define __NR_stty              31*/
-/*#define __NR_gtty              32*/
-#define __NR_access              33
-#define __NR_nice                34
-/*#define __NR_ftime             35*/
-#define __NR_sync                36
-#define __NR_kill                37
-#define __NR_rename              38
-#define __NR_mkdir               39
-#define __NR_rmdir               40
-#define __NR_dup                 41
-#define __NR_pipe                42
-#define __NR_times               43
-/*#define __NR_prof              44*/
-#define __NR_brk                 45
-#define __NR_setgid              46
-#define __NR_getgid              47
-#define __NR_signal              48
-#define __NR_geteuid             49
-#define __NR_getegid             50
-#define __NR_acct                51
-#define __NR_umount2             52
-/*#define __NR_lock              53*/
-#define __NR_ioctl               54
-#define __NR_fcntl               55
-/*#define __NR_mpx               56*/
-#define __NR_setpgid             57
-/*#define __NR_ulimit            58*/
-/*#define __NR_oldolduname       59*/
-#define __NR_umask               60
-#define __NR_chroot              61
-#define __NR_ustat               62
-#define __NR_dup2                63
-#define __NR_getppid             64
-#define __NR_getpgrp             65
-#define __NR_setsid              66
-#define __NR_sigaction           67
-#define __NR_sgetmask            68
-#define __NR_ssetmask            69
-#define __NR_setreuid            70
-#define __NR_setregid            71
-#define __NR_sigsuspend          72
-#define __NR_sigpending          73
-#define __NR_sethostname         74
-#define __NR_setrlimit           75
-#define __NR_getrlimit           76
-#define __NR_getrusage           77
-#define __NR_gettimeofday        78
-#define __NR_settimeofday        79
-#define __NR_getgroups           80
-#define __NR_setgroups           81
-#define __NR_select              82
-#define __NR_symlink             83
-#define __NR_oldlstat            84
-#define __NR_readlink            85
-#define __NR_uselib              86
-#define __NR_swapon              87
-#define __NR_reboot              88
-#define __NR_readdir             89
-#define __NR_mmap                90
-#define __NR_munmap              91
-#define __NR_truncate            92
-#define __NR_ftruncate           93
-#define __NR_fchmod              94
-#define __NR_fchown              95
-#define __NR_getpriority         96
-#define __NR_setpriority         97
-/*#define __NR_profil            98*/
-#define __NR_statfs              99
-#define __NR_fstatfs            100
-/*#define __NR_ioperm           101*/
-#define __NR_socketcall         102
-#define __NR_syslog             103
-#define __NR_setitimer          104
-#define __NR_getitimer          105
-#define __NR_stat               106
-#define __NR_lstat              107
-#define __NR_fstat              108
-/*#define __NR_olduname         109*/
-/*#define __NR_iopl             110*/ /* not supported */
-#define __NR_vhangup            111
-/*#define __NR_idle             112*/ /* Obsolete */
-/*#define __NR_vm86             113*/ /* not supported */
-#define __NR_wait4              114
-#define __NR_swapoff            115
-#define __NR_sysinfo            116
-#define __NR_ipc                117
-#define __NR_fsync              118
-#define __NR_sigreturn          119
-#define __NR_clone              120
-#define __NR_setdomainname      121
-#define __NR_uname              122
-#define __NR_cacheflush         123
-#define __NR_adjtimex           124
-#define __NR_mprotect           125
-#define __NR_sigprocmask        126
-#define __NR_create_module      127
-#define __NR_init_module        128
-#define __NR_delete_module      129
-#define __NR_get_kernel_syms    130
-#define __NR_quotactl           131
-#define __NR_getpgid            132
-#define __NR_fchdir             133
-#define __NR_bdflush            134
-#define __NR_sysfs              135
-#define __NR_personality        136
-/*#define __NR_afs_syscall      137*/ /* Syscall for Andrew File System */
-#define __NR_setfsuid           138
-#define __NR_setfsgid           139
-#define __NR__llseek            140
-#define __NR_getdents           141
-#define __NR__newselect         142
-#define __NR_flock              143
-#define __NR_msync              144
-#define __NR_readv              145
-#define __NR_writev             146
-#define __NR_getsid             147
-#define __NR_fdatasync          148
-#define __NR__sysctl            149
-#define __NR_mlock              150
-#define __NR_munlock            151
-#define __NR_mlockall           152
-#define __NR_munlockall         153
-#define __NR_sched_setparam             154
-#define __NR_sched_getparam             155
-#define __NR_sched_setscheduler         156
-#define __NR_sched_getscheduler         157
-#define __NR_sched_yield                158
-#define __NR_sched_get_priority_max     159
-#define __NR_sched_get_priority_min     160
-#define __NR_sched_rr_get_interval      161
-#define __NR_nanosleep          162
-#define __NR_mremap             163
-#define __NR_setresuid          164
-#define __NR_getresuid          165
-#define __NR_getpagesize        166
-#define __NR_query_module       167
-#define __NR_poll               168
-#define __NR_nfsservctl         169
-#define __NR_setresgid          170
-#define __NR_getresgid          171
-#define __NR_prctl              172
-#define __NR_rt_sigreturn       173
-#define __NR_rt_sigaction       174
-#define __NR_rt_sigprocmask     175
-#define __NR_rt_sigpending      176
-#define __NR_rt_sigtimedwait    177
-#define __NR_rt_sigqueueinfo    178
-#define __NR_rt_sigsuspend      179
-#define __NR_pread64            180
-#define __NR_pwrite64           181
-#define __NR_lchown             182
-#define __NR_getcwd             183
-#define __NR_capget             184
-#define __NR_capset             185
-#define __NR_sigaltstack        186
-#define __NR_sendfile           187
-#define __NR_getpmsg            188     /* some people actually want streams */
-#define __NR_putpmsg            189     /* some people actually want streams */
-#define __NR_vfork              190
-#define __NR_ugetrlimit         191
-#define __NR_mmap2              192
-#define __NR_truncate64         193
-#define __NR_ftruncate64        194
-#define __NR_stat64             195
-#define __NR_lstat64            196
-#define __NR_fstat64            197
-#define __NR_chown32            198
-#define __NR_getuid32           199
-#define __NR_getgid32           200
-#define __NR_geteuid32          201
-#define __NR_getegid32          202
-#define __NR_setreuid32         203
-#define __NR_setregid32         204
-#define __NR_getgroups32        205
-#define __NR_setgroups32        206
-#define __NR_fchown32           207
-#define __NR_setresuid32        208
-#define __NR_getresuid32        209
-#define __NR_setresgid32        210
-#define __NR_getresgid32        211
-#define __NR_lchown32           212
-#define __NR_setuid32           213
-#define __NR_setgid32           214
-#define __NR_setfsuid32         215
-#define __NR_setfsgid32         216
-#define __NR_pivot_root         217
-/* 218*/
-/* 219*/
-#define __NR_getdents64         220
-#define __NR_gettid             221
-#define __NR_tkill              222
-#define __NR_setxattr           223
-#define __NR_lsetxattr          224
-#define __NR_fsetxattr          225
-#define __NR_getxattr           226
-#define __NR_lgetxattr          227
-#define __NR_fgetxattr          228
-#define __NR_listxattr          229
-#define __NR_llistxattr         230
-#define __NR_flistxattr         231
-#define __NR_removexattr        232
-#define __NR_lremovexattr       233
-#define __NR_fremovexattr       234
-#define __NR_futex              235
-#define __NR_sendfile64         236
-#define __NR_mincore            237
-#define __NR_madvise            238
-#define __NR_fcntl64            239
-#define __NR_readahead          240
-#define __NR_io_setup           241
-#define __NR_io_destroy         242
-#define __NR_io_getevents       243
-#define __NR_io_submit          244
-#define __NR_io_cancel          245
-#define __NR_fadvise64          246
-#define __NR_exit_group         247
-#define __NR_lookup_dcookie     248
-#define __NR_epoll_create       249
-#define __NR_epoll_ctl          250
-#define __NR_epoll_wait         251
-#define __NR_remap_file_pages   252
-#define __NR_set_tid_address    253
-#define __NR_timer_create       254
-#define __NR_timer_settime      255
-#define __NR_timer_gettime      256
-#define __NR_timer_getoverrun   257
-#define __NR_timer_delete       258
-#define __NR_clock_settime      259
-#define __NR_clock_gettime      260
-#define __NR_clock_getres       261
-#define __NR_clock_nanosleep    262
-#define __NR_statfs64           263
-#define __NR_fstatfs64          264
-#define __NR_tgkill             265
-#define __NR_utimes             266
-#define __NR_fadvise64_64       267
-#define __NR_mbind              268
-#define __NR_get_mempolicy      269
-#define __NR_set_mempolicy      270
-#define __NR_mq_open            271
-#define __NR_mq_unlink          272
-#define __NR_mq_timedsend       273
-#define __NR_mq_timedreceive    274
-#define __NR_mq_notify          275
-#define __NR_mq_getsetattr      276
-#define __NR_waitid             277
-/*#define __NR_vserver          278*/
-#define __NR_add_key            279
-#define __NR_request_key        280
-#define __NR_keyctl             281
-#define __NR_ioprio_set         282
-#define __NR_ioprio_get         283
-#define __NR_inotify_init       284
-#define __NR_inotify_add_watch  285
-#define __NR_inotify_rm_watch   286
-#define __NR_migrate_pages      287
-#define __NR_openat             288
-#define __NR_mkdirat            289
-#define __NR_mknodat            290
-#define __NR_fchownat           291
-#define __NR_futimesat          292
-#define __NR_fstatat64          293
-#define __NR_unlinkat           294
-#define __NR_renameat           295
-#define __NR_linkat             296
-#define __NR_symlinkat          297
-#define __NR_readlinkat         298
-#define __NR_fchmodat           299
-#define __NR_faccessat          300
-#define __NR_pselect6           301
-#define __NR_ppoll              302
-#define __NR_unshare            303
-#define __NR_set_robust_list    304
-#define __NR_get_robust_list    305
-#define __NR_splice             306
-#define __NR_sync_file_range    307
-#define __NR_tee                308
-#define __NR_vmsplice           309
-#define __NR_move_pages         310
-#define __NR_sched_setaffinity  311
-#define __NR_sched_getaffinity  312
-#define __NR_kexec_load         313
-#define __NR_getcpu             314
-#define __NR_epoll_pwait        315
-#define __NR_utimensat          316
-#define __NR_signalfd           317
-#define __NR_timerfd_create     318
-#define __NR_eventfd            319
-#define __NR_fallocate          320
-#define __NR_timerfd_settime    321
-#define __NR_timerfd_gettime    322
-#define __NR_signalfd4          323
-#define __NR_eventfd2           324
-#define __NR_epoll_create1      325
-#define __NR_dup3               326
-#define __NR_pipe2              327
-#define __NR_inotify_init1      328
-#define __NR_preadv             329
-#define __NR_pwritev            330
-#define __NR_rt_tgsigqueueinfo  331
-#define __NR_perf_event_open    332
-#define __NR_get_thread_area    333
-#define __NR_set_thread_area    334
-#define __NR_atomic_cmpxchg_32  335
-#define __NR_atomic_barrier     336
-#define __NR_fanotify_init      337
-#define __NR_fanotify_mark      338
-#define __NR_prlimit64          339
-#define __NR_name_to_handle_at  340
-#define __NR_open_by_handle_at  341
-#define __NR_clock_adjtime      342
-#define __NR_syncfs             343
-#define __NR_setns              344
-#define __NR_process_vm_readv   345
-#define __NR_process_vm_writev  346
+#include <uapi/asm/unistd.h>
 
-#ifdef __KERNEL__
 
-#define NR_syscalls             347
+#define NR_syscalls             348
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
@@ -393,5 +42,4 @@
  */
 #define cond_syscall(x) asm(".weak\t" #x "\n\t.set\t" #x ",sys_ni_syscall")
 
-#endif /* __KERNEL__ */
 #endif /* _ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/include/uapi/asm/Kbuild b/arch/m68k/include/uapi/asm/Kbuild
index baebb3da1d44..972bce120e1e 100644
--- a/arch/m68k/include/uapi/asm/Kbuild
+++ b/arch/m68k/include/uapi/asm/Kbuild
@@ -1,3 +1,26 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+header-y += a.out.h
+header-y += auxvec.h
+header-y += byteorder.h
+header-y += cachectl.h
+header-y += fcntl.h
+header-y += ioctls.h
+header-y += msgbuf.h
+header-y += param.h
+header-y += poll.h
+header-y += posix_types.h
+header-y += ptrace.h
+header-y += sembuf.h
+header-y += setup.h
+header-y += shmbuf.h
+header-y += sigcontext.h
+header-y += signal.h
+header-y += socket.h
+header-y += sockios.h
+header-y += stat.h
+header-y += swab.h
+header-y += termbits.h
+header-y += termios.h
+header-y += unistd.h
diff --git a/arch/m68k/include/asm/a.out.h b/arch/m68k/include/uapi/asm/a.out.h
index 3885fe43432a..3885fe43432a 100644
--- a/arch/m68k/include/asm/a.out.h
+++ b/arch/m68k/include/uapi/asm/a.out.h
diff --git a/arch/m68k/include/asm/auxvec.h b/arch/m68k/include/uapi/asm/auxvec.h
index 844d6d52204b..844d6d52204b 100644
--- a/arch/m68k/include/asm/auxvec.h
+++ b/arch/m68k/include/uapi/asm/auxvec.h
diff --git a/arch/m68k/include/asm/byteorder.h b/arch/m68k/include/uapi/asm/byteorder.h
index 31b260a88803..31b260a88803 100644
--- a/arch/m68k/include/asm/byteorder.h
+++ b/arch/m68k/include/uapi/asm/byteorder.h
diff --git a/arch/m68k/include/asm/cachectl.h b/arch/m68k/include/uapi/asm/cachectl.h
index 525978e959e3..525978e959e3 100644
--- a/arch/m68k/include/asm/cachectl.h
+++ b/arch/m68k/include/uapi/asm/cachectl.h
diff --git a/arch/m68k/include/asm/fcntl.h b/arch/m68k/include/uapi/asm/fcntl.h
index 1c369b20dc45..1c369b20dc45 100644
--- a/arch/m68k/include/asm/fcntl.h
+++ b/arch/m68k/include/uapi/asm/fcntl.h
diff --git a/arch/m68k/include/asm/ioctls.h b/arch/m68k/include/uapi/asm/ioctls.h
index 1332bb4ca5b0..1332bb4ca5b0 100644
--- a/arch/m68k/include/asm/ioctls.h
+++ b/arch/m68k/include/uapi/asm/ioctls.h
diff --git a/arch/m68k/include/asm/msgbuf.h b/arch/m68k/include/uapi/asm/msgbuf.h
index 243cb798de8f..243cb798de8f 100644
--- a/arch/m68k/include/asm/msgbuf.h
+++ b/arch/m68k/include/uapi/asm/msgbuf.h
diff --git a/arch/m68k/include/asm/param.h b/arch/m68k/include/uapi/asm/param.h
index 36265ccf5c7b..36265ccf5c7b 100644
--- a/arch/m68k/include/asm/param.h
+++ b/arch/m68k/include/uapi/asm/param.h
diff --git a/arch/m68k/include/asm/poll.h b/arch/m68k/include/uapi/asm/poll.h
index f080fcdb61bf..f080fcdb61bf 100644
--- a/arch/m68k/include/asm/poll.h
+++ b/arch/m68k/include/uapi/asm/poll.h
diff --git a/arch/m68k/include/asm/posix_types.h b/arch/m68k/include/uapi/asm/posix_types.h
index cf4dbf70fdc7..cf4dbf70fdc7 100644
--- a/arch/m68k/include/asm/posix_types.h
+++ b/arch/m68k/include/uapi/asm/posix_types.h
diff --git a/arch/m68k/include/uapi/asm/ptrace.h b/arch/m68k/include/uapi/asm/ptrace.h
new file mode 100644
index 000000000000..caf92fd34939
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/ptrace.h
@@ -0,0 +1,79 @@
+#ifndef _UAPI_M68K_PTRACE_H
+#define _UAPI_M68K_PTRACE_H
+
+#define PT_D1      0
+#define PT_D2      1
+#define PT_D3      2
+#define PT_D4      3
+#define PT_D5      4
+#define PT_D6      5
+#define PT_D7      6
+#define PT_A0      7
+#define PT_A1      8
+#define PT_A2      9
+#define PT_A3      10
+#define PT_A4      11
+#define PT_A5      12
+#define PT_A6      13
+#define PT_D0      14
+#define PT_USP     15
+#define PT_ORIG_D0 16
+#define PT_SR      17
+#define PT_PC      18
+
+#ifndef __ASSEMBLY__
+
+/* this struct defines the way the registers are stored on the
+   stack during a system call. */
+
+struct pt_regs {
+  long     d1;
+  long     d2;
+  long     d3;
+  long     d4;
+  long     d5;
+  long     a0;
+  long     a1;
+  long     a2;
+  long     d0;
+  long     orig_d0;
+  long     stkadj;
+#ifdef CONFIG_COLDFIRE
+  unsigned format :  4; /* frame format specifier */
+  unsigned vector : 12; /* vector offset */
+  unsigned short sr;
+  unsigned long  pc;
+#else
+  unsigned short sr;
+  unsigned long  pc;
+  unsigned format :  4; /* frame format specifier */
+  unsigned vector : 12; /* vector offset */
+#endif
+};
+
+/*
+ * This is the extended stack used by signal handlers and the context
+ * switcher: it's pushed after the normal "struct pt_regs".
+ */
+struct switch_stack {
+        unsigned long  d6;
+        unsigned long  d7;
+        unsigned long  a3;
+        unsigned long  a4;
+        unsigned long  a5;
+        unsigned long  a6;
+        unsigned long  retpc;
+};
+
+/* Arbitrarily choose the same ptrace numbers as used by the Sparc code. */
+#define PTRACE_GETREGS            12
+#define PTRACE_SETREGS            13
+#define PTRACE_GETFPREGS          14
+#define PTRACE_SETFPREGS          15
+
+#define PTRACE_GET_THREAD_AREA    25
+
+#define PTRACE_SINGLEBLOCK      33      /* resume execution until next branch */
+
+#endif /* __ASSEMBLY__ */
+#endif /* _UAPI_M68K_PTRACE_H */
diff --git a/arch/m68k/include/asm/sembuf.h b/arch/m68k/include/uapi/asm/sembuf.h
index 2308052a8c24..2308052a8c24 100644
--- a/arch/m68k/include/asm/sembuf.h
+++ b/arch/m68k/include/uapi/asm/sembuf.h
diff --git a/arch/m68k/include/uapi/asm/setup.h b/arch/m68k/include/uapi/asm/setup.h
new file mode 100644
index 000000000000..85579bff455c
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/setup.h
@@ -0,0 +1,103 @@
+/*
+** asm/setup.h -- Definition of the Linux/m68k setup information
+**
+** Copyright 1992 by Greg Harp
+**
+** This file is subject to the terms and conditions of the GNU General Public
+** License.  See the file COPYING in the main directory of this archive
+** for more details.
+**
+** Created 09/29/92 by Greg Harp
+**
+** 5/2/94 Roman Hodek:
+**   Added bi_atari part of the machine dependent union bi_un; for now it
+**   contains just a model field to distinguish between TT and Falcon.
+** 26/7/96 Roman Zippel:
+**   Renamed to setup.h; added some useful macros to allow gcc some
+**   optimizations if possible.
+** 5/10/96 Geert Uytterhoeven:
+**   Redesign of the boot information structure; moved boot information
+**   structure to bootinfo.h
+*/
+
+#ifndef _UAPI_M68K_SETUP_H
+#define _UAPI_M68K_SETUP_H
+
+
+
+    /*
+     *  Linux/m68k Architectures
+     */
+
+#define MACH_AMIGA    1
+#define MACH_ATARI    2
+#define MACH_MAC      3
+#define MACH_APOLLO   4
+#define MACH_SUN3     5
+#define MACH_MVME147  6
+#define MACH_MVME16x  7
+#define MACH_BVME6000 8
+#define MACH_HP300    9
+#define MACH_Q40     10
+#define MACH_SUN3X   11
+#define MACH_M54XX   12
+
+#define COMMAND_LINE_SIZE 256
+
+
+
+    /*
+     *  CPU, FPU and MMU types
+     *
+     *  Note: we may rely on the following equalities:
+     *
+     *      CPU_68020 == MMU_68851
+     *      CPU_68030 == MMU_68030
+     *      CPU_68040 == FPU_68040 == MMU_68040
+     *      CPU_68060 == FPU_68060 == MMU_68060
+     */
+
+#define CPUB_68020     0
+#define CPUB_68030     1
+#define CPUB_68040     2
+#define CPUB_68060     3
+#define CPUB_COLDFIRE  4
+
+#define CPU_68020      (1<<CPUB_68020)
+#define CPU_68030      (1<<CPUB_68030)
+#define CPU_68040      (1<<CPUB_68040)
+#define CPU_68060      (1<<CPUB_68060)
+#define CPU_COLDFIRE   (1<<CPUB_COLDFIRE)
+
+#define FPUB_68881     0
+#define FPUB_68882     1
+#define FPUB_68040     2                       /* Internal FPU */
+#define FPUB_68060     3                       /* Internal FPU */
+#define FPUB_SUNFPA    4                       /* Sun-3 FPA */
+#define FPUB_COLDFIRE  5                       /* ColdFire FPU */
+
+#define FPU_68881      (1<<FPUB_68881)
+#define FPU_68882      (1<<FPUB_68882)
+#define FPU_68040      (1<<FPUB_68040)
+#define FPU_68060      (1<<FPUB_68060)
+#define FPU_SUNFPA     (1<<FPUB_SUNFPA)
+#define FPU_COLDFIRE   (1<<FPUB_COLDFIRE)
+
+#define MMUB_68851     0
+#define MMUB_68030     1                       /* Internal MMU */
+#define MMUB_68040     2                       /* Internal MMU */
+#define MMUB_68060     3                       /* Internal MMU */
+#define MMUB_APOLLO    4                       /* Custom Apollo */
+#define MMUB_SUN3      5                       /* Custom Sun-3 */
+#define MMUB_COLDFIRE  6                       /* Internal MMU */
+
+#define MMU_68851      (1<<MMUB_68851)
+#define MMU_68030      (1<<MMUB_68030)
+#define MMU_68040      (1<<MMUB_68040)
+#define MMU_68060      (1<<MMUB_68060)
+#define MMU_SUN3       (1<<MMUB_SUN3)
+#define MMU_APOLLO     (1<<MMUB_APOLLO)
+#define MMU_COLDFIRE   (1<<MMUB_COLDFIRE)
+
+
+#endif /* _UAPI_M68K_SETUP_H */
diff --git a/arch/m68k/include/asm/shmbuf.h b/arch/m68k/include/uapi/asm/shmbuf.h
index f8928d62f1b7..f8928d62f1b7 100644
--- a/arch/m68k/include/asm/shmbuf.h
+++ b/arch/m68k/include/uapi/asm/shmbuf.h
diff --git a/arch/m68k/include/asm/sigcontext.h b/arch/m68k/include/uapi/asm/sigcontext.h
index 523db2a51cf3..523db2a51cf3 100644
--- a/arch/m68k/include/asm/sigcontext.h
+++ b/arch/m68k/include/uapi/asm/sigcontext.h
diff --git a/arch/m68k/include/uapi/asm/signal.h b/arch/m68k/include/uapi/asm/signal.h
new file mode 100644
index 000000000000..2b450f311bd9
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/signal.h
@@ -0,0 +1,118 @@
+#ifndef _UAPI_M68K_SIGNAL_H
+#define _UAPI_M68K_SIGNAL_H
+
+#include <linux/types.h>
+
+/* Avoid too many header ordering problems.  */
+struct siginfo;
+
+#ifndef __KERNEL__
+/* Here we must cater to libcs that poke about in kernel headers.  */
+
+#define NSIG            32
+typedef unsigned long sigset_t;
+
+#endif /* __KERNEL__ */
+
+#define SIGHUP           1
+#define SIGINT           2
+#define SIGQUIT          3
+#define SIGILL           4
+#define SIGTRAP          5
+#define SIGABRT          6
+#define SIGIOT           6
+#define SIGBUS           7
+#define SIGFPE           8
+#define SIGKILL          9
+#define SIGUSR1         10
+#define SIGSEGV         11
+#define SIGUSR2         12
+#define SIGPIPE         13
+#define SIGALRM         14
+#define SIGTERM         15
+#define SIGSTKFLT       16
+#define SIGCHLD         17
+#define SIGCONT         18
+#define SIGSTOP         19
+#define SIGTSTP         20
+#define SIGTTIN         21
+#define SIGTTOU         22
+#define SIGURG          23
+#define SIGXCPU         24
+#define SIGXFSZ         25
+#define SIGVTALRM       26
+#define SIGPROF         27
+#define SIGWINCH        28
+#define SIGIO           29
+#define SIGPOLL         SIGIO
+/*
+#define SIGLOST         29
+*/
+#define SIGPWR          30
+#define SIGSYS          31
+#define SIGUNUSED       31
+
+/* These should not be considered constants from userland.  */
+#define SIGRTMIN        32
+#define SIGRTMAX        _NSIG
+
+/*
+ * SA_FLAGS values:
+ *
+ * SA_ONSTACK indicates that a registered stack_t will be used.
+ * SA_RESTART flag to get restarting signals (which were the default long ago)
+ * SA_NOCLDSTOP flag to turn off SIGCHLD when children stop.
+ * SA_RESETHAND clears the handler when the signal is delivered.
+ * SA_NOCLDWAIT flag on SIGCHLD to inhibit zombies.
+ * SA_NODEFER prevents the current signal from being masked in the handler.
+ *
+ * SA_ONESHOT and SA_NOMASK are the historical Linux names for the Single
+ * Unix names RESETHAND and NODEFER respectively.
+ */
+#define SA_NOCLDSTOP    0x00000001
+#define SA_NOCLDWAIT    0x00000002
+#define SA_SIGINFO      0x00000004
+#define SA_ONSTACK      0x08000000
+#define SA_RESTART      0x10000000
+#define SA_NODEFER      0x40000000
+#define SA_RESETHAND    0x80000000
+
+#define SA_NOMASK       SA_NODEFER
+#define SA_ONESHOT      SA_RESETHAND
+
+/*
+ * sigaltstack controls
+ */
+#define SS_ONSTACK      1
+#define SS_DISABLE      2
+
+#define MINSIGSTKSZ     2048
+#define SIGSTKSZ        8192
+
+#include <asm-generic/signal-defs.h>
+
+#ifndef __KERNEL__
+/* Here we must cater to libcs that poke about in kernel headers.  */
+
+struct sigaction {
+        union {
+          __sighandler_t _sa_handler;
+          void (*_sa_sigaction)(int, struct siginfo *, void *);
+        } _u;
+        sigset_t sa_mask;
+        unsigned long sa_flags;
+        void (*sa_restorer)(void);
+};
+
+#define sa_handler      _u._sa_handler
+#define sa_sigaction    _u._sa_sigaction
+
+#endif /* __KERNEL__ */
+
+typedef struct sigaltstack {
+        void __user *ss_sp;
+        int ss_flags;
+        size_t ss_size;
+} stack_t;
+
+#endif /* _UAPI_M68K_SIGNAL_H */
diff --git a/arch/m68k/include/asm/socket.h b/arch/m68k/include/uapi/asm/socket.h
index d1be684edf97..d1be684edf97 100644
--- a/arch/m68k/include/asm/socket.h
+++ b/arch/m68k/include/uapi/asm/socket.h
diff --git a/arch/m68k/include/asm/sockios.h b/arch/m68k/include/uapi/asm/sockios.h
index c04a23943cb7..c04a23943cb7 100644
--- a/arch/m68k/include/asm/sockios.h
+++ b/arch/m68k/include/uapi/asm/sockios.h
diff --git a/arch/m68k/include/asm/stat.h b/arch/m68k/include/uapi/asm/stat.h
index dd38bc2e9f98..dd38bc2e9f98 100644
--- a/arch/m68k/include/asm/stat.h
+++ b/arch/m68k/include/uapi/asm/stat.h
diff --git a/arch/m68k/include/asm/swab.h b/arch/m68k/include/uapi/asm/swab.h
index b7b37a40defc..b7b37a40defc 100644
--- a/arch/m68k/include/asm/swab.h
+++ b/arch/m68k/include/uapi/asm/swab.h
diff --git a/arch/m68k/include/asm/termbits.h b/arch/m68k/include/uapi/asm/termbits.h
index aea1e37b765a..aea1e37b765a 100644
--- a/arch/m68k/include/asm/termbits.h
+++ b/arch/m68k/include/uapi/asm/termbits.h
diff --git a/arch/m68k/include/uapi/asm/termios.h b/arch/m68k/include/uapi/asm/termios.h
new file mode 100644
index 000000000000..ce2142c9ac1d
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/termios.h
@@ -0,0 +1,44 @@
+#ifndef _UAPI_M68K_TERMIOS_H
+#define _UAPI_M68K_TERMIOS_H
+
+#include <asm/termbits.h>
+#include <asm/ioctls.h>
+
+struct winsize {
+        unsigned short ws_row;
+        unsigned short ws_col;
+        unsigned short ws_xpixel;
+        unsigned short ws_ypixel;
+};
+
+#define NCC 8
+struct termio {
+        unsigned short c_iflag;         /* input mode flags */
+        unsigned short c_oflag;         /* output mode flags */
+        unsigned short c_cflag;         /* control mode flags */
+        unsigned short c_lflag;         /* local mode flags */
+        unsigned char c_line;           /* line discipline */
+        unsigned char c_cc[NCC];        /* control characters */
+};
+
+
+/* modem lines */
+#define TIOCM_LE        0x001
+#define TIOCM_DTR       0x002
+#define TIOCM_RTS       0x004
+#define TIOCM_ST        0x008
+#define TIOCM_SR        0x010
+#define TIOCM_CTS       0x020
+#define TIOCM_CAR       0x040
+#define TIOCM_RNG       0x080
+#define TIOCM_DSR       0x100
+#define TIOCM_CD        TIOCM_CAR
+#define TIOCM_RI        TIOCM_RNG
+#define TIOCM_OUT1      0x2000
+#define TIOCM_OUT2      0x4000
+#define TIOCM_LOOP      0x8000
+
+/* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
+
+
+#endif /* _UAPI_M68K_TERMIOS_H */
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
new file mode 100644
index 000000000000..b94bfbf90705
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -0,0 +1,357 @@
+#ifndef _UAPI_ASM_M68K_UNISTD_H_
+#define _UAPI_ASM_M68K_UNISTD_H_
+
+/*
+ * This file contains the system call numbers.
+ */
+
+#define __NR_restart_syscall      0
+#define __NR_exit                 1
+#define __NR_fork                 2
+#define __NR_read                 3
+#define __NR_write                4
+#define __NR_open                 5
+#define __NR_close                6
+#define __NR_waitpid              7
+#define __NR_creat                8
+#define __NR_link                 9
+#define __NR_unlink              10
+#define __NR_execve              11
+#define __NR_chdir               12
+#define __NR_time                13
+#define __NR_mknod               14
+#define __NR_chmod               15
+#define __NR_chown               16
+/*#define __NR_break             17*/
+#define __NR_oldstat             18
+#define __NR_lseek               19
+#define __NR_getpid              20
+#define __NR_mount               21
+#define __NR_umount              22
+#define __NR_setuid              23
+#define __NR_getuid              24
+#define __NR_stime               25
+#define __NR_ptrace              26
+#define __NR_alarm               27
+#define __NR_oldfstat            28
+#define __NR_pause               29
+#define __NR_utime               30
+/*#define __NR_stty              31*/
+/*#define __NR_gtty              32*/
+#define __NR_access              33
+#define __NR_nice                34
+/*#define __NR_ftime             35*/
+#define __NR_sync                36
+#define __NR_kill                37
+#define __NR_rename              38
+#define __NR_mkdir               39
+#define __NR_rmdir               40
+#define __NR_dup                 41
+#define __NR_pipe                42
+#define __NR_times               43
+/*#define __NR_prof              44*/
+#define __NR_brk                 45
+#define __NR_setgid              46
+#define __NR_getgid              47
+#define __NR_signal              48
+#define __NR_geteuid             49
+#define __NR_getegid             50
+#define __NR_acct                51
+#define __NR_umount2             52
+/*#define __NR_lock              53*/
+#define __NR_ioctl               54
+#define __NR_fcntl               55
+/*#define __NR_mpx               56*/
+#define __NR_setpgid             57
+/*#define __NR_ulimit            58*/
+/*#define __NR_oldolduname       59*/
+#define __NR_umask               60
+#define __NR_chroot              61
+#define __NR_ustat               62
+#define __NR_dup2                63
+#define __NR_getppid             64
+#define __NR_getpgrp             65
+#define __NR_setsid              66
+#define __NR_sigaction           67
+#define __NR_sgetmask            68
+#define __NR_ssetmask            69
+#define __NR_setreuid            70
+#define __NR_setregid            71
+#define __NR_sigsuspend          72
+#define __NR_sigpending          73
+#define __NR_sethostname         74
+#define __NR_setrlimit           75
+#define __NR_getrlimit           76
+#define __NR_getrusage           77
+#define __NR_gettimeofday        78
+#define __NR_settimeofday        79
+#define __NR_getgroups           80
+#define __NR_setgroups           81
+#define __NR_select              82
+#define __NR_symlink             83
+#define __NR_oldlstat            84
+#define __NR_readlink            85
+#define __NR_uselib              86
+#define __NR_swapon              87
+#define __NR_reboot              88
+#define __NR_readdir             89
+#define __NR_mmap                90
+#define __NR_munmap              91
+#define __NR_truncate            92
+#define __NR_ftruncate           93
+#define __NR_fchmod              94
+#define __NR_fchown              95
+#define __NR_getpriority         96
+#define __NR_setpriority         97
+/*#define __NR_profil            98*/
+#define __NR_statfs              99
+#define __NR_fstatfs            100
+/*#define __NR_ioperm           101*/
+#define __NR_socketcall         102
+#define __NR_syslog             103
+#define __NR_setitimer          104
+#define __NR_getitimer          105
+#define __NR_stat               106
+#define __NR_lstat              107
+#define __NR_fstat              108
+/*#define __NR_olduname         109*/
+/*#define __NR_iopl             110*/ /* not supported */
+#define __NR_vhangup            111
+/*#define __NR_idle             112*/ /* Obsolete */
+/*#define __NR_vm86             113*/ /* not supported */
+#define __NR_wait4              114
+#define __NR_swapoff            115
+#define __NR_sysinfo            116
+#define __NR_ipc                117
+#define __NR_fsync              118
+#define __NR_sigreturn          119
+#define __NR_clone              120
+#define __NR_setdomainname      121
+#define __NR_uname              122
+#define __NR_cacheflush         123
+#define __NR_adjtimex           124
+#define __NR_mprotect           125
+#define __NR_sigprocmask        126
+#define __NR_create_module      127
+#define __NR_init_module        128
+#define __NR_delete_module      129
+#define __NR_get_kernel_syms    130
+#define __NR_quotactl           131
+#define __NR_getpgid            132
+#define __NR_fchdir             133
+#define __NR_bdflush            134
+#define __NR_sysfs              135
+#define __NR_personality        136
+/*#define __NR_afs_syscall      137*/ /* Syscall for Andrew File System */
+#define __NR_setfsuid           138
+#define __NR_setfsgid           139
+#define __NR__llseek            140
+#define __NR_getdents           141
+#define __NR__newselect         142
+#define __NR_flock              143
+#define __NR_msync              144
+#define __NR_readv              145
+#define __NR_writev             146
+#define __NR_getsid             147
+#define __NR_fdatasync          148
+#define __NR__sysctl            149
+#define __NR_mlock              150
+#define __NR_munlock            151
+#define __NR_mlockall           152
+#define __NR_munlockall         153
+#define __NR_sched_setparam             154
+#define __NR_sched_getparam             155
+#define __NR_sched_setscheduler         156
+#define __NR_sched_getscheduler         157
+#define __NR_sched_yield                158
+#define __NR_sched_get_priority_max     159
+#define __NR_sched_get_priority_min     160
+#define __NR_sched_rr_get_interval      161
+#define __NR_nanosleep          162
+#define __NR_mremap             163
+#define __NR_setresuid          164
+#define __NR_getresuid          165
+#define __NR_getpagesize        166
+#define __NR_query_module       167
+#define __NR_poll               168
+#define __NR_nfsservctl         169
+#define __NR_setresgid          170
+#define __NR_getresgid          171
+#define __NR_prctl              172
+#define __NR_rt_sigreturn       173
+#define __NR_rt_sigaction       174
+#define __NR_rt_sigprocmask     175
+#define __NR_rt_sigpending      176
+#define __NR_rt_sigtimedwait    177
+#define __NR_rt_sigqueueinfo    178
+#define __NR_rt_sigsuspend      179
+#define __NR_pread64            180
+#define __NR_pwrite64           181
+#define __NR_lchown             182
+#define __NR_getcwd             183
+#define __NR_capget             184
+#define __NR_capset             185
+#define __NR_sigaltstack        186
+#define __NR_sendfile           187
+#define __NR_getpmsg            188     /* some people actually want streams */
+#define __NR_putpmsg            189     /* some people actually want streams */
+#define __NR_vfork              190
+#define __NR_ugetrlimit         191
+#define __NR_mmap2              192
+#define __NR_truncate64         193
+#define __NR_ftruncate64        194
+#define __NR_stat64             195
+#define __NR_lstat64            196
+#define __NR_fstat64            197
+#define __NR_chown32            198
+#define __NR_getuid32           199
+#define __NR_getgid32           200
+#define __NR_geteuid32          201
+#define __NR_getegid32          202
+#define __NR_setreuid32         203
+#define __NR_setregid32         204
+#define __NR_getgroups32        205
+#define __NR_setgroups32        206
+#define __NR_fchown32           207
+#define __NR_setresuid32        208
+#define __NR_getresuid32        209
+#define __NR_setresgid32        210
+#define __NR_getresgid32        211
+#define __NR_lchown32           212
+#define __NR_setuid32           213
+#define __NR_setgid32           214
+#define __NR_setfsuid32         215
+#define __NR_setfsgid32         216
+#define __NR_pivot_root         217
+/* 218*/
+/* 219*/
+#define __NR_getdents64         220
+#define __NR_gettid             221
+#define __NR_tkill              222
+#define __NR_setxattr           223
+#define __NR_lsetxattr          224
+#define __NR_fsetxattr          225
+#define __NR_getxattr           226
+#define __NR_lgetxattr          227
+#define __NR_fgetxattr          228
+#define __NR_listxattr          229
+#define __NR_llistxattr         230
+#define __NR_flistxattr         231
+#define __NR_removexattr        232
+#define __NR_lremovexattr       233
+#define __NR_fremovexattr       234
+#define __NR_futex              235
+#define __NR_sendfile64         236
+#define __NR_mincore            237
+#define __NR_madvise            238
+#define __NR_fcntl64            239
+#define __NR_readahead          240
+#define __NR_io_setup           241
+#define __NR_io_destroy         242
+#define __NR_io_getevents       243
+#define __NR_io_submit          244
+#define __NR_io_cancel          245
+#define __NR_fadvise64          246
+#define __NR_exit_group         247
+#define __NR_lookup_dcookie     248
+#define __NR_epoll_create       249
+#define __NR_epoll_ctl          250
+#define __NR_epoll_wait         251
+#define __NR_remap_file_pages   252
+#define __NR_set_tid_address    253
+#define __NR_timer_create       254
+#define __NR_timer_settime      255
+#define __NR_timer_gettime      256
+#define __NR_timer_getoverrun   257
+#define __NR_timer_delete       258
+#define __NR_clock_settime      259
+#define __NR_clock_gettime      260
+#define __NR_clock_getres       261
+#define __NR_clock_nanosleep    262
+#define __NR_statfs64           263
+#define __NR_fstatfs64          264
+#define __NR_tgkill             265
+#define __NR_utimes             266
+#define __NR_fadvise64_64       267
+#define __NR_mbind              268
+#define __NR_get_mempolicy      269
+#define __NR_set_mempolicy      270
+#define __NR_mq_open            271
+#define __NR_mq_unlink          272
+#define __NR_mq_timedsend       273
+#define __NR_mq_timedreceive    274
+#define __NR_mq_notify          275
+#define __NR_mq_getsetattr      276
+#define __NR_waitid             277
+/*#define __NR_vserver          278*/
+#define __NR_add_key            279
+#define __NR_request_key        280
+#define __NR_keyctl             281
+#define __NR_ioprio_set         282
+#define __NR_ioprio_get         283
+#define __NR_inotify_init       284
+#define __NR_inotify_add_watch  285
+#define __NR_inotify_rm_watch   286
+#define __NR_migrate_pages      287
+#define __NR_openat             288
+#define __NR_mkdirat            289
+#define __NR_mknodat            290
+#define __NR_fchownat           291
+#define __NR_futimesat          292
+#define __NR_fstatat64          293
+#define __NR_unlinkat           294
+#define __NR_renameat           295
+#define __NR_linkat             296
+#define __NR_symlinkat          297
+#define __NR_readlinkat         298
+#define __NR_fchmodat           299
+#define __NR_faccessat          300
+#define __NR_pselect6           301
+#define __NR_ppoll              302
+#define __NR_unshare            303
+#define __NR_set_robust_list    304
+#define __NR_get_robust_list    305
+#define __NR_splice             306
+#define __NR_sync_file_range    307
+#define __NR_tee                308
+#define __NR_vmsplice           309
+#define __NR_move_pages         310
+#define __NR_sched_setaffinity  311
+#define __NR_sched_getaffinity  312
+#define __NR_kexec_load         313
+#define __NR_getcpu             314
+#define __NR_epoll_pwait        315
+#define __NR_utimensat          316
+#define __NR_signalfd           317
+#define __NR_timerfd_create     318
+#define __NR_eventfd            319
+#define __NR_fallocate          320
+#define __NR_timerfd_settime    321
+#define __NR_timerfd_gettime    322
+#define __NR_signalfd4          323
+#define __NR_eventfd2           324
+#define __NR_epoll_create1      325
+#define __NR_dup3               326
+#define __NR_pipe2              327
+#define __NR_inotify_init1      328
+#define __NR_preadv             329
+#define __NR_pwritev            330
+#define __NR_rt_tgsigqueueinfo  331
+#define __NR_perf_event_open    332
+#define __NR_get_thread_area    333
+#define __NR_set_thread_area    334
+#define __NR_atomic_cmpxchg_32  335
+#define __NR_atomic_barrier     336
+#define __NR_fanotify_init      337
+#define __NR_fanotify_mark      338
+#define __NR_prlimit64          339
+#define __NR_name_to_handle_at  340
+#define __NR_open_by_handle_at  341
+#define __NR_clock_adjtime      342
+#define __NR_syncfs             343
+#define __NR_setns              344
+#define __NR_process_vm_readv   345
+#define __NR_process_vm_writev  346
+#define __NR_kcmp               347
+
+#endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index ce827b376110..4fc2e29b771b 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -367,4 +367,5 @@ ENTRY(sys_call_table)
         .long sys_setns
         .long sys_process_vm_readv      /* 345 */
         .long sys_process_vm_writev
+        .long sys_kcmp
 
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 3f3d9ca7a5b6..5dba755a43e6 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -130,6 +130,7 @@ config S390
         select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
         select HAVE_UID16 if 32BIT
         select ARCH_WANT_IPC_PARSE_VERSION
+        select HAVE_ARCH_TRANSPARENT_HUGEPAGE if 64BIT
         select GENERIC_SMP_IDLE_THREAD
         select GENERIC_TIME_VSYSCALL_OLD
         select GENERIC_CLOCKEVENTS
diff --git a/arch/s390/boot/compressed/vmlinux.lds.S b/arch/s390/boot/compressed/vmlinux.lds.S
index d80f79d8dd9c..8e1fb8239287 100644
--- a/arch/s390/boot/compressed/vmlinux.lds.S
+++ b/arch/s390/boot/compressed/vmlinux.lds.S
@@ -5,7 +5,7 @@ OUTPUT_FORMAT("elf64-s390", "elf64-s390", "elf64-s390")
 OUTPUT_ARCH(s390:64-bit)
 #else
 OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390")
-OUTPUT_ARCH(s390)
+OUTPUT_ARCH(s390:31-bit)
 #endif
 
 ENTRY(startup)
diff --git a/arch/s390/include/asm/perf_event.h b/arch/s390/include/asm/perf_event.h
index 7941968e12b4..5f0173a31693 100644
--- a/arch/s390/include/asm/perf_event.h
+++ b/arch/s390/include/asm/perf_event.h
@@ -9,7 +9,7 @@
 #include <asm/cpu_mf.h>
 
 /* CPU-measurement counter facility */
-#define PERF_CPUM_CF_MAX_CTR            160
+#define PERF_CPUM_CF_MAX_CTR            256
 
 /* Per-CPU flags for PMU states */
 #define PMU_F_RESERVED                  0x1000
diff --git a/arch/s390/include/uapi/asm/Kbuild b/arch/s390/include/uapi/asm/Kbuild
index 59b67ed423b4..7bf68fff7c5d 100644
--- a/arch/s390/include/uapi/asm/Kbuild
+++ b/arch/s390/include/uapi/asm/Kbuild
@@ -1,8 +1,6 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
-generic-y += kvm_para.h
-
 header-y += auxvec.h
 header-y += bitsperlong.h
 header-y += byteorder.h
diff --git a/arch/s390/include/uapi/asm/chpid.h b/arch/s390/include/uapi/asm/chpid.h
index 581992dfae27..6b4fb29cc197 100644
--- a/arch/s390/include/uapi/asm/chpid.h
+++ b/arch/s390/include/uapi/asm/chpid.h
@@ -1,5 +1,5 @@
 /*
- *    Copyright IBM Corp. 2007
+ *    Copyright IBM Corp. 2007, 2012
  *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
  */
 
@@ -12,10 +12,10 @@
 #define __MAX_CHPID 255
 
 struct chp_id {
-        u8 reserved1;
-        u8 cssid;
-        u8 reserved2;
-        u8 id;
+        __u8 reserved1;
+        __u8 cssid;
+        __u8 reserved2;
+        __u8 id;
 } __attribute__((packed));
 
 
diff --git a/arch/s390/include/uapi/asm/kvm_para.h b/arch/s390/include/uapi/asm/kvm_para.h
new file mode 100644
index 000000000000..ff1f4e7b3015
--- /dev/null
+++ b/arch/s390/include/uapi/asm/kvm_para.h
@@ -0,0 +1,11 @@
+/*
+ * User API definitions for paravirtual devices on s390
+ *
+ * Copyright IBM Corp. 2008
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ *    Author(s): Christian Borntraeger <borntraeger@de.ibm.com>
+ */
diff --git a/arch/s390/kernel/cache.c b/arch/s390/kernel/cache.c
index 8df8d8a19c98..64b24650e4f8 100644
--- a/arch/s390/kernel/cache.c
+++ b/arch/s390/kernel/cache.c
@@ -59,8 +59,8 @@ enum {
 
 enum {
         CACHE_TI_UNIFIED = 0,
-        CACHE_TI_INSTRUCTION = 0,
-        CACHE_TI_DATA,
+        CACHE_TI_DATA = 0,
+        CACHE_TI_INSTRUCTION,
 };
 
 struct cache_info {
@@ -121,7 +121,10 @@ static int __init cache_add(int level, int private, int type)
         cache = kzalloc(sizeof(*cache), GFP_KERNEL);
         if (!cache)
                 return -ENOMEM;
-        ti = type == CACHE_TYPE_DATA ? CACHE_TI_DATA : CACHE_TI_UNIFIED;
+        if (type == CACHE_TYPE_INSTRUCTION)
+                ti = CACHE_TI_INSTRUCTION;
+        else
+                ti = CACHE_TI_UNIFIED;
         cache->size = ecag(EXTRACT_SIZE, level, ti);
         cache->line_size = ecag(EXTRACT_LINE_SIZE, level, ti);
         cache->associativity = ecag(EXTRACT_ASSOCIATIVITY, level, ti);
diff --git a/arch/s390/kernel/head_kdump.S b/arch/s390/kernel/head_kdump.S
index acaaaf4b7055..085a95eb315f 100644
--- a/arch/s390/kernel/head_kdump.S
+++ b/arch/s390/kernel/head_kdump.S
@@ -85,16 +85,10 @@
 .align 2
 startup_kdump_relocated:
         basr    %r13,0
-0:
-        mvc     0(8,%r0),.Lrestart_psw-0b(%r13) # Setup restart PSW
-        sam31                                   # Switch to 31 bit addr mode
-        sr      %r1,%r1                         # Erase register r1
-        sr      %r2,%r2                         # Erase register r2
-        sigp    %r1,%r2,SIGP_SET_ARCHITECTURE   # Switch to 31 bit arch mode
-        lpsw    0                               # Start new kernel...
+0:      lpswe   .Lrestart_psw-0b(%r13)          # Start new kernel...
 .align  8
 .Lrestart_psw:
-        .long   0x00080000,0x80000000 + startup
+        .quad   0x0000000080000000,0x0000000000000000 + startup
 #else
 .align 2
 .Lep_startup_kdump:
diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index 9871b1971ed7..c4e7269d4a09 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -94,7 +94,7 @@ static int get_counter_set(u64 event)
                 set = CPUMF_CTR_SET_USER;
         else if (event < 128)
                 set = CPUMF_CTR_SET_CRYPTO;
-        else if (event < 160)
+        else if (event < 256)
                 set = CPUMF_CTR_SET_EXT;
 
         return set;
@@ -138,6 +138,10 @@ static int validate_ctr_version(const struct hw_perf_event *hwc)
         case CPUMF_CTR_SET_EXT:
                 if (cpuhw->info.csvn < 1)
                         err = -EOPNOTSUPP;
+                if ((cpuhw->info.csvn == 1 && hwc->config > 159) ||
+                    (cpuhw->info.csvn == 2 && hwc->config > 175) ||
+                    (cpuhw->info.csvn  > 2 && hwc->config > 255))
+                        err = -EOPNOTSUPP;
                 break;
         }
 
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index de8fa9bbd35e..79cb51adc741 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -8,7 +8,7 @@
 
 #ifndef CONFIG_64BIT
 OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390")
-OUTPUT_ARCH(s390)
+OUTPUT_ARCH(s390:31-bit)
 ENTRY(startup)
 jiffies = jiffies_64 + 4;
 #else
diff --git a/arch/tile/Makefile b/arch/tile/Makefile
index 55640cf92597..3d15364c6071 100644
--- a/arch/tile/Makefile
+++ b/arch/tile/Makefile
@@ -26,6 +26,10 @@ $(error Set TILERA_ROOT or CROSS_COMPILE when building $(ARCH) on $(HOST_ARCH))
   endif
 endif
 
+# The tile compiler may emit .eh_frame information for backtracing.
+# In kernel modules, this causes load failures due to unsupported relocations.
+KBUILD_CFLAGS   += -fno-asynchronous-unwind-tables
+
 ifneq ($(CONFIG_DEBUG_EXTRA_FLAGS),"")
 KBUILD_CFLAGS   += $(CONFIG_DEBUG_EXTRA_FLAGS)
 endif
diff --git a/arch/tile/kernel/module.c b/arch/tile/kernel/module.c
index 001cbfa10ac6..243ffebe38d6 100644
--- a/arch/tile/kernel/module.c
+++ b/arch/tile/kernel/module.c
@@ -24,16 +24,6 @@
 #include <asm/homecache.h>
 #include <arch/opcode.h>
 
-#ifdef __tilegx__
-# define Elf_Rela Elf64_Rela
-# define ELF_R_SYM ELF64_R_SYM
-# define ELF_R_TYPE ELF64_R_TYPE
-#else
-# define Elf_Rela Elf32_Rela
-# define ELF_R_SYM ELF32_R_SYM
-# define ELF_R_TYPE ELF32_R_TYPE
-#endif
-
 #ifdef MODULE_DEBUG
 #define DEBUGP printk
 #else
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index c9dcc181d4d1..6e8fdf5ad113 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -35,7 +35,7 @@ extern unsigned long asmlinkage efi_call_phys(void *, ...);
 #define efi_call_virt6(f, a1, a2, a3, a4, a5, a6)       \
         efi_call_virt(f, a1, a2, a3, a4, a5, a6)
 
-#define efi_ioremap(addr, size, type)           ioremap_cache(addr, size)
+#define efi_ioremap(addr, size, type, attr)     ioremap_cache(addr, size)
 
 #else /* !CONFIG_X86_32 */
 
@@ -89,7 +89,7 @@ extern u64 efi_call6(void *fp, u64 arg1, u64 arg2, u64 arg3,
                   (u64)(a3), (u64)(a4), (u64)(a5), (u64)(a6))
 
 extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size,
-                                 u32 type);
+                                 u32 type, u64 attribute);
 
 #endif /* CONFIG_X86_32 */
 
@@ -98,6 +98,8 @@ extern void efi_set_executable(efi_memory_desc_t *md, bool executable);
 extern int efi_memblock_x86_reserve_range(void);
 extern void efi_call_phys_prelog(void);
 extern void efi_call_phys_epilog(void);
+extern void efi_unmap_memmap(void);
+extern void efi_memory_uc(u64 addr, unsigned long size);
 
 #ifndef CONFIG_EFI
 /*
diff --git a/arch/x86/include/asm/xen/interface.h b/arch/x86/include/asm/xen/interface.h
index 6d2f75a82a14..54d52ff1304a 100644
--- a/arch/x86/include/asm/xen/interface.h
+++ b/arch/x86/include/asm/xen/interface.h
@@ -51,14 +51,14 @@
  * with Xen so that on ARM we can have one ABI that works for 32 and 64
  * bit guests. */
 typedef unsigned long xen_pfn_t;
+#define PRI_xen_pfn "lx"
 typedef unsigned long xen_ulong_t;
+#define PRI_xen_ulong "lx"
 /* Guest handles for primitive C types. */
 __DEFINE_GUEST_HANDLE(uchar, unsigned char);
 __DEFINE_GUEST_HANDLE(uint,  unsigned int);
-__DEFINE_GUEST_HANDLE(ulong, unsigned long);
 DEFINE_GUEST_HANDLE(char);
 DEFINE_GUEST_HANDLE(int);
-DEFINE_GUEST_HANDLE(long);
 DEFINE_GUEST_HANDLE(void);
 DEFINE_GUEST_HANDLE(uint64_t);
 DEFINE_GUEST_HANDLE(uint32_t);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index c265593ec2cd..1817fa911024 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2257,6 +2257,9 @@ asmlinkage void smp_irq_move_cleanup_interrupt(void)
                         continue;
 
                 cfg = irq_cfg(irq);
+                if (!cfg)
+                        continue;
+
                 raw_spin_lock(&desc->lock);
 
                 /*
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 3373f84d1397..4a3374e61a93 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -208,12 +208,14 @@ static bool check_hw_exists(void)
         }
 
         /*
-         * Now write a value and read it back to see if it matches,
-         * this is needed to detect certain hardware emulators (qemu/kvm)
-         * that don't trap on the MSR access and always return 0s.
+         * Read the current value, change it and read it back to see if it
+         * matches, this is needed to detect certain hardware emulators
+         * (qemu/kvm) that don't trap on the MSR access and always return 0s.
          */
-        val = 0xabcdUL;
         reg = x86_pmu_event_addr(0);
+        if (rdmsrl_safe(reg, &val))
+                goto msr_fail;
+        val ^= 0xffffUL;
         ret = wrmsrl_safe(reg, val);
         ret |= rdmsrl_safe(reg, &val_new);
         if (ret || val != val_new)
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 99d96a4978b5..3cf3d97cce3a 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -118,22 +118,24 @@ static void snbep_uncore_pci_disable_box(struct intel_uncore_box *box)
 {
         struct pci_dev *pdev = box->pci_dev;
         int box_ctl = uncore_pci_box_ctl(box);
-        u32 config;
+        u32 config = 0;
 
-        pci_read_config_dword(pdev, box_ctl, &config);
-        config |= SNBEP_PMON_BOX_CTL_FRZ;
-        pci_write_config_dword(pdev, box_ctl, config);
+        if (!pci_read_config_dword(pdev, box_ctl, &config)) {
+                config |= SNBEP_PMON_BOX_CTL_FRZ;
+                pci_write_config_dword(pdev, box_ctl, config);
+        }
 }
 
 static void snbep_uncore_pci_enable_box(struct intel_uncore_box *box)
 {
         struct pci_dev *pdev = box->pci_dev;
         int box_ctl = uncore_pci_box_ctl(box);
-        u32 config;
+        u32 config = 0;
 
-        pci_read_config_dword(pdev, box_ctl, &config);
-        config &= ~SNBEP_PMON_BOX_CTL_FRZ;
-        pci_write_config_dword(pdev, box_ctl, config);
+        if (!pci_read_config_dword(pdev, box_ctl, &config)) {
+                config &= ~SNBEP_PMON_BOX_CTL_FRZ;
+                pci_write_config_dword(pdev, box_ctl, config);
+        }
 }
 
 static void snbep_uncore_pci_enable_event(struct intel_uncore_box *box, struct perf_event *event)
@@ -156,7 +158,7 @@ static u64 snbep_uncore_pci_read_counter(struct intel_uncore_box *box, struct pe
 {
         struct pci_dev *pdev = box->pci_dev;
         struct hw_perf_event *hwc = &event->hw;
-        u64 count;
+        u64 count = 0;
 
         pci_read_config_dword(pdev, hwc->event_base, (u32 *)&count);
         pci_read_config_dword(pdev, hwc->event_base + 4, (u32 *)&count + 1);
@@ -603,11 +605,12 @@ static struct pci_driver snbep_uncore_pci_driver = {
 /*
  * build pci bus to socket mapping
  */
-static void snbep_pci2phy_map_init(void)
+static int snbep_pci2phy_map_init(void)
 {
         struct pci_dev *ubox_dev = NULL;
         int i, bus, nodeid;
-        u32 config;
+        int err = 0;
+        u32 config = 0;
 
         while (1) {
                 /* find the UBOX device */
@@ -618,10 +621,14 @@ static void snbep_pci2phy_map_init(void)
                         break;
                 bus = ubox_dev->bus->number;
                 /* get the Node ID of the local register */
-                pci_read_config_dword(ubox_dev, 0x40, &config);
+                err = pci_read_config_dword(ubox_dev, 0x40, &config);
+                if (err)
+                        break;
                 nodeid = config;
                 /* get the Node ID mapping */
-                pci_read_config_dword(ubox_dev, 0x54, &config);
+                err = pci_read_config_dword(ubox_dev, 0x54, &config);
+                if (err)
+                        break;
                 /*
                  * every three bits in the Node ID mapping register maps
                  * to a particular node.
@@ -633,7 +640,11 @@ static void snbep_pci2phy_map_init(void)
                         }
                 }
         };
-        return;
+
+        if (ubox_dev)
+                pci_dev_put(ubox_dev);
+
+        return err ? pcibios_err_to_errno(err) : 0;
 }
 /* end of Sandy Bridge-EP uncore support */
 
@@ -1547,7 +1558,6 @@ void nhmex_rbox_alter_er(struct intel_uncore_box *box, struct perf_event *event)
 {
         struct hw_perf_event *hwc = &event->hw;
         struct hw_perf_event_extra *reg1 = &hwc->extra_reg;
-        int port;
 
         /* adjust the main event selector and extra register index */
         if (reg1->idx % 2) {
@@ -1559,7 +1569,6 @@ void nhmex_rbox_alter_er(struct intel_uncore_box *box, struct perf_event *event)
         }
 
         /* adjust extra register config */
-        port = reg1->idx / 6 + box->pmu->pmu_idx * 4;
         switch (reg1->idx % 6) {
         case 2:
                 /* shift the 8~15 bits to the 0~7 bits */
@@ -2578,9 +2587,11 @@ static int __init uncore_pci_init(void)
 
         switch (boot_cpu_data.x86_model) {
         case 45: /* Sandy Bridge-EP */
+                ret = snbep_pci2phy_map_init();
+                if (ret)
+                        return ret;
                 pci_uncores = snbep_pci_uncores;
                 uncore_pci_driver = &snbep_uncore_pci_driver;
-                snbep_pci2phy_map_init();
                 break;
         default:
                 return 0;
@@ -2926,6 +2937,9 @@ static int __init intel_uncore_init(void)
         if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
                 return -ENODEV;
 
+        if (cpu_has_hypervisor)
+                return -ENODEV;
+
         ret = uncore_pci_init();
         if (ret)
                 goto fail;
diff --git a/arch/x86/kernel/cpu/perf_event_knc.c b/arch/x86/kernel/cpu/perf_event_knc.c
index 7c46bfdbc373..4b7731bf23a8 100644
--- a/arch/x86/kernel/cpu/perf_event_knc.c
+++ b/arch/x86/kernel/cpu/perf_event_knc.c
@@ -3,6 +3,8 @@
 #include <linux/perf_event.h>
 #include <linux/types.h>
 
+#include <asm/hardirq.h>
+
 #include "perf_event.h"
 
 static const u64 knc_perfmon_event_map[] =
@@ -173,30 +175,100 @@ static void knc_pmu_enable_all(int added)
 static inline void
 knc_pmu_disable_event(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
         u64 val;
 
         val = hwc->config;
-        if (cpuc->enabled)
-                val &= ~ARCH_PERFMON_EVENTSEL_ENABLE;
+        val &= ~ARCH_PERFMON_EVENTSEL_ENABLE;
 
         (void)wrmsrl_safe(hwc->config_base + hwc->idx, val);
 }
 
 static void knc_pmu_enable_event(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
         u64 val;
 
         val = hwc->config;
-        if (cpuc->enabled)
-                val |= ARCH_PERFMON_EVENTSEL_ENABLE;
+        val |= ARCH_PERFMON_EVENTSEL_ENABLE;
 
         (void)wrmsrl_safe(hwc->config_base + hwc->idx, val);
 }
 
+static inline u64 knc_pmu_get_status(void)
+{
+        u64 status;
+
+        rdmsrl(MSR_KNC_IA32_PERF_GLOBAL_STATUS, status);
+
+        return status;
+}
+
+static inline void knc_pmu_ack_status(u64 ack)
+{
+        wrmsrl(MSR_KNC_IA32_PERF_GLOBAL_OVF_CONTROL, ack);
+}
+
+static int knc_pmu_handle_irq(struct pt_regs *regs)
+{
+        struct perf_sample_data data;
+        struct cpu_hw_events *cpuc;
+        int handled = 0;
+        int bit, loops;
+        u64 status;
+
+        cpuc = &__get_cpu_var(cpu_hw_events);
+
+        knc_pmu_disable_all();
+
+        status = knc_pmu_get_status();
+        if (!status) {
+                knc_pmu_enable_all(0);
+                return handled;
+        }
+
+        loops = 0;
+again:
+        knc_pmu_ack_status(status);
+        if (++loops > 100) {
+                WARN_ONCE(1, "perf: irq loop stuck!\n");
+                perf_event_print_debug();
+                goto done;
+        }
+
+        inc_irq_stat(apic_perf_irqs);
+
+        for_each_set_bit(bit, (unsigned long *)&status, X86_PMC_IDX_MAX) {
+                struct perf_event *event = cpuc->events[bit];
+
+                handled++;
+
+                if (!test_bit(bit, cpuc->active_mask))
+                        continue;
+
+                if (!intel_pmu_save_and_restart(event))
+                        continue;
+
+                perf_sample_data_init(&data, 0, event->hw.last_period);
+
+                if (perf_event_overflow(event, &data, regs))
+                        x86_pmu_stop(event, 0);
+        }
+
+        /*
+         * Repeat if there is more work to be done:
+         */
+        status = knc_pmu_get_status();
+        if (status)
+                goto again;
+
+done:
+        knc_pmu_enable_all(0);
+
+        return handled;
+}
+
+
 PMU_FORMAT_ATTR(event,  "config:0-7"    );
 PMU_FORMAT_ATTR(umask,  "config:8-15"   );
 PMU_FORMAT_ATTR(edge,   "config:18"     );
@@ -214,7 +286,7 @@ static struct attribute *intel_knc_formats_attr[] = {
 
 static __initconst struct x86_pmu knc_pmu = {
         .name                   = "knc",
-        .handle_irq             = x86_pmu_handle_irq,
+        .handle_irq             = knc_pmu_handle_irq,
         .disable_all            = knc_pmu_disable_all,
         .enable_all             = knc_pmu_enable_all,
         .enable                 = knc_pmu_enable_event,
@@ -226,12 +298,11 @@ static __initconst struct x86_pmu knc_pmu = {
         .event_map              = knc_pmu_event_map,
         .max_events             = ARRAY_SIZE(knc_perfmon_event_map),
         .apic                   = 1,
-        .max_period             = (1ULL << 31) - 1,
+        .max_period             = (1ULL << 39) - 1,
         .version                = 0,
         .num_counters           = 2,
-        /* in theory 40 bits, early silicon is buggy though */
-        .cntval_bits            = 32,
-        .cntval_mask            = (1ULL << 32) - 1,
+        .cntval_bits            = 40,
+        .cntval_mask            = (1ULL << 40) - 1,
         .get_event_constraints  = x86_get_event_constraints,
         .event_constraints      = knc_event_constraints,
         .format_attrs           = intel_knc_formats_attr,
diff --git a/arch/x86/kernel/cpu/perf_event_p6.c b/arch/x86/kernel/cpu/perf_event_p6.c
index e4dd0f7a0453..7d0270bd793e 100644
--- a/arch/x86/kernel/cpu/perf_event_p6.c
+++ b/arch/x86/kernel/cpu/perf_event_p6.c
@@ -8,13 +8,106 @@
  */
 static const u64 p6_perfmon_event_map[] =
 {
-  [PERF_COUNT_HW_CPU_CYCLES]            = 0x0079,
-  [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,
-  [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0f2e,
-  [PERF_COUNT_HW_CACHE_MISSES]          = 0x012e,
-  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c4,
-  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c5,
-  [PERF_COUNT_HW_BUS_CYCLES]            = 0x0062,
+  [PERF_COUNT_HW_CPU_CYCLES]            = 0x0079,       /* CPU_CLK_UNHALTED */
+  [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,       /* INST_RETIRED     */
+  [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0f2e,       /* L2_RQSTS:M:E:S:I */
+  [PERF_COUNT_HW_CACHE_MISSES]          = 0x012e,       /* L2_RQSTS:I       */
+  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c4,       /* BR_INST_RETIRED  */
+  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c5,       /* BR_MISS_PRED_RETIRED */
+  [PERF_COUNT_HW_BUS_CYCLES]            = 0x0062,       /* BUS_DRDY_CLOCKS  */
+  [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x00a2,     /* RESOURCE_STALLS  */
+
+};
+
+static __initconst u64 p6_hw_cache_event_ids
+                                [PERF_COUNT_HW_CACHE_MAX]
+                                [PERF_COUNT_HW_CACHE_OP_MAX]
+                                [PERF_COUNT_HW_CACHE_RESULT_MAX] =
+{
+ [ C(L1D) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x0043,  /* DATA_MEM_REFS       */
+                [ C(RESULT_MISS)   ] = 0x0045,  /* DCU_LINES_IN        */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0x0f29,  /* L2_LD:M:E:S:I       */
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(L1I ) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x0080,  /* IFU_IFETCH         */
+                [ C(RESULT_MISS)   ] = 0x0f28,  /* L2_IFETCH:M:E:S:I  */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(LL  ) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0x0025,  /* L2_M_LINES_INM     */
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(DTLB) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x0043,  /* DATA_MEM_REFS      */
+                [ C(RESULT_MISS)   ] = 0,
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = 0,
+                [ C(RESULT_MISS)   ] = 0,
+        },
+ },
+ [ C(ITLB) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x0080,  /* IFU_IFETCH         */
+                [ C(RESULT_MISS)   ] = 0x0085,  /* ITLB_MISS          */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+ },
+ [ C(BPU ) ] = {
+        [ C(OP_READ) ] = {
+                [ C(RESULT_ACCESS) ] = 0x00c4,  /* BR_INST_RETIRED      */
+                [ C(RESULT_MISS)   ] = 0x00c5,  /* BR_MISS_PRED_RETIRED */
+        },
+        [ C(OP_WRITE) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+        [ C(OP_PREFETCH) ] = {
+                [ C(RESULT_ACCESS) ] = -1,
+                [ C(RESULT_MISS)   ] = -1,
+        },
+ },
 };
 
 static u64 p6_pmu_event_map(int hw_event)
@@ -34,7 +127,7 @@ static struct event_constraint p6_event_constraints[] =
 {
         INTEL_EVENT_CONSTRAINT(0xc1, 0x1),      /* FLOPS */
         INTEL_EVENT_CONSTRAINT(0x10, 0x1),      /* FP_COMP_OPS_EXE */
-        INTEL_EVENT_CONSTRAINT(0x11, 0x1),      /* FP_ASSIST */
+        INTEL_EVENT_CONSTRAINT(0x11, 0x2),      /* FP_ASSIST */
         INTEL_EVENT_CONSTRAINT(0x12, 0x2),      /* MUL */
         INTEL_EVENT_CONSTRAINT(0x13, 0x2),      /* DIV */
         INTEL_EVENT_CONSTRAINT(0x14, 0x1),      /* CYCLES_DIV_BUSY */
@@ -64,25 +157,25 @@ static void p6_pmu_enable_all(int added)
 static inline void
 p6_pmu_disable_event(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
         u64 val = P6_NOP_EVENT;
 
-        if (cpuc->enabled)
-                val |= ARCH_PERFMON_EVENTSEL_ENABLE;
-
         (void)wrmsrl_safe(hwc->config_base, val);
 }
 
 static void p6_pmu_enable_event(struct perf_event *event)
 {
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
         u64 val;
 
         val = hwc->config;
-        if (cpuc->enabled)
-                val |= ARCH_PERFMON_EVENTSEL_ENABLE;
+
+        /*
+         * p6 only has a global event enable, set on PerfEvtSel0
+         * We "disable" events by programming P6_NOP_EVENT
+         * and we rely on p6_pmu_enable_all() being called
+         * to actually enable the events.
+         */
 
         (void)wrmsrl_safe(hwc->config_base, val);
 }
@@ -158,5 +251,9 @@ __init int p6_pmu_init(void)
 
         x86_pmu = p6_pmu;
 
+        memcpy(hw_cache_event_ids, p6_hw_cache_event_ids,
+                sizeof(hw_cache_event_ids));
+
+
         return 0;
 }
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index ed858e9e9a74..df06ade26bef 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -1077,6 +1077,9 @@ void __init memblock_x86_fill(void)
                 memblock_add(ei->addr, ei->size);
         }
 
+        /* throw away partial pages */
+        memblock_trim_memory(PAGE_SIZE);
+
         memblock_dump_all();
 }
 
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index a1193aef6d7d..88b725aa1d52 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -1035,7 +1035,7 @@ ENTRY(xen_sysenter_target)
 
 ENTRY(xen_hypervisor_callback)
         CFI_STARTPROC
-        pushl_cfi $0
+        pushl_cfi $-1 /* orig_ax = -1 => not a system call */
         SAVE_ALL
         TRACE_IRQS_OFF
 
@@ -1077,14 +1077,16 @@ ENTRY(xen_failsafe_callback)
 2:      mov 8(%esp),%es
 3:      mov 12(%esp),%fs
 4:      mov 16(%esp),%gs
+        /* EAX == 0 => Category 1 (Bad segment)
+           EAX != 0 => Category 2 (Bad IRET) */
         testl %eax,%eax
         popl_cfi %eax
         lea 16(%esp),%esp
         CFI_ADJUST_CFA_OFFSET -16
         jz 5f
         addl $16,%esp
-        jmp iret_exc            # EAX != 0 => Category 2 (Bad IRET)
-5:      pushl_cfi $0            # EAX == 0 => Category 1 (Bad segment)
+        jmp iret_exc
+5:      pushl_cfi $-1 /* orig_ax = -1 => not a system call */
         SAVE_ALL
         jmp ret_from_exception
         CFI_ENDPROC
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 0c58952d64e8..b51b2c7ee51f 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1435,7 +1435,7 @@ ENTRY(xen_failsafe_callback)
         CFI_RESTORE r11
         addq $0x30,%rsp
         CFI_ADJUST_CFA_OFFSET -0x30
-        pushq_cfi $0
+        pushq_cfi $-1 /* orig_ax = -1 => not a system call */
         SAVE_ALL
         jmp error_exit
         CFI_ENDPROC
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index b3e5e51bc907..4180a874c764 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -247,7 +247,10 @@ do_async_page_fault(struct pt_regs *regs, unsigned long error_code)
                 break;
         case KVM_PV_REASON_PAGE_NOT_PRESENT:
                 /* page is swapped out by the host. */
+                rcu_irq_enter();
+                exit_idle();
                 kvm_async_pf_task_wait((u32)read_cr2());
+                rcu_irq_exit();
                 break;
         case KVM_PV_REASON_PAGE_READY:
                 rcu_irq_enter();
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 468e98dfd44e..ca45696f30fb 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -921,18 +921,19 @@ void __init setup_arch(char **cmdline_p)
 #ifdef CONFIG_X86_64
         if (max_pfn > max_low_pfn) {
                 int i;
-                for (i = 0; i < e820.nr_map; i++) {
-                        struct e820entry *ei = &e820.map[i];
+                unsigned long start, end;
+                unsigned long start_pfn, end_pfn;
 
-                        if (ei->addr + ei->size <= 1UL << 32)
-                                continue;
+                for_each_mem_pfn_range(i, MAX_NUMNODES, &start_pfn, &end_pfn,
+                                                         NULL) {
 
-                        if (ei->type == E820_RESERVED)
+                        end = PFN_PHYS(end_pfn);
+                        if (end <= (1UL<<32))
                                 continue;
 
+                        start = PFN_PHYS(start_pfn);
                         max_pfn_mapped = init_memory_mapping(
-                                ei->addr < 1UL << 32 ? 1UL << 32 : ei->addr,
-                                ei->addr + ei->size);
+                                                max((1UL<<32), start), end);
                 }
 
                 /* can we preseve max_low_pfn ?*/
@@ -1048,6 +1049,18 @@ void __init setup_arch(char **cmdline_p)
         arch_init_ideal_nops();
 
         register_refined_jiffies(CLOCK_TICK_RATE);
+
+#ifdef CONFIG_EFI
+        /* Once setup is done above, disable efi_enabled on mismatched
+         * firmware/kernel archtectures since there is no support for
+         * runtime services.
+         */
+        if (efi_enabled && IS_ENABLED(CONFIG_X86_64) != efi_64bit) {
+                pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
+                efi_unmap_memmap();
+                efi_enabled = 0;
+        }
+#endif
 }
 
 #ifdef CONFIG_X86_32
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 29ad351804e9..70b27ee6118e 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -824,10 +824,8 @@ do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
                 mce_notify_process();
 #endif /* CONFIG_X86_64 && CONFIG_X86_MCE */
 
-        if (thread_info_flags & _TIF_UPROBE) {
-                clear_thread_flag(TIF_UPROBE);
+        if (thread_info_flags & _TIF_UPROBE)
                 uprobe_notify_resume(regs);
-        }
 
         /* deal with pending signal delivery */
         if (thread_info_flags & _TIF_SIGPENDING)
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 9538f00827a9..aafa5557b396 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -651,31 +651,19 @@ void arch_uprobe_abort_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
 
 /*
  * Skip these instructions as per the currently known x86 ISA.
- * 0x66* { 0x90 | 0x0f 0x1f | 0x0f 0x19 | 0x87 0xc0 }
+ * rep=0x66*; nop=0x90
  */
 static bool __skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
 {
         int i;
 
         for (i = 0; i < MAX_UINSN_BYTES; i++) {
-                if ((auprobe->insn[i] == 0x66))
+                if (auprobe->insn[i] == 0x66)
                         continue;
 
                 if (auprobe->insn[i] == 0x90)
                         return true;
 
-                if (i == (MAX_UINSN_BYTES - 1))
-                        break;
-
-                if ((auprobe->insn[i] == 0x0f) && (auprobe->insn[i+1] == 0x1f))
-                        return true;
-
-                if ((auprobe->insn[i] == 0x0f) && (auprobe->insn[i+1] == 0x19))
-                        return true;
-
-                if ((auprobe->insn[i] == 0x87) && (auprobe->insn[i+1] == 0xc0))
-                        return true;
-
                 break;
         }
         return false;
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index c6e6b721b6ee..43e9fadca5d0 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1311,7 +1311,7 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
         vcpu->arch.apic_base = value;
         if (apic_x2apic_mode(apic)) {
                 u32 id = kvm_apic_id(apic);
-                u32 ldr = ((id & ~0xf) << 16) | (1 << (id & 0xf));
+                u32 ldr = ((id >> 4) << 16) | (1 << (id & 0xf));
                 kvm_apic_set_ldr(apic, ldr);
         }
         apic->base_address = apic->vcpu->arch.apic_base &
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index d289fee1ffb8..6f85fe0bf958 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2497,8 +2497,7 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
                 }
         }
 
-        if (!is_error_pfn(pfn))
-                kvm_release_pfn_clean(pfn);
+        kvm_release_pfn_clean(pfn);
 }
 
 static void nonpaging_new_cr3(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index ab1f6a93b527..d7aea41563b3 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -35,40 +35,44 @@ struct map_range {
         unsigned page_size_mask;
 };
 
-static void __init find_early_table_space(struct map_range *mr, unsigned long end,
-                                          int use_pse, int use_gbpages)
+/*
+ * First calculate space needed for kernel direct mapping page tables to cover
+ * mr[0].start to mr[nr_range - 1].end, while accounting for possible 2M and 1GB
+ * pages. Then find enough contiguous space for those page tables.
+ */
+static void __init find_early_table_space(struct map_range *mr, int nr_range)
 {
-        unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
+        int i;
+        unsigned long puds = 0, pmds = 0, ptes = 0, tables;
+        unsigned long start = 0, good_end;
         phys_addr_t base;
 
-        puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
-        tables = roundup(puds * sizeof(pud_t), PAGE_SIZE);
-
-        if (use_gbpages) {
-                unsigned long extra;
-
-                extra = end - ((end>>PUD_SHIFT) << PUD_SHIFT);
-                pmds = (extra + PMD_SIZE - 1) >> PMD_SHIFT;
-        } else
-                pmds = (end + PMD_SIZE - 1) >> PMD_SHIFT;
+        for (i = 0; i < nr_range; i++) {
+                unsigned long range, extra;
 
-        tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE);
+                range = mr[i].end - mr[i].start;
+                puds += (range + PUD_SIZE - 1) >> PUD_SHIFT;
 
-        if (use_pse) {
-                unsigned long extra;
+                if (mr[i].page_size_mask & (1 << PG_LEVEL_1G)) {
+                        extra = range - ((range >> PUD_SHIFT) << PUD_SHIFT);
+                        pmds += (extra + PMD_SIZE - 1) >> PMD_SHIFT;
+                } else {
+                        pmds += (range + PMD_SIZE - 1) >> PMD_SHIFT;
+                }
 
-                extra = end - ((end>>PMD_SHIFT) << PMD_SHIFT);
+                if (mr[i].page_size_mask & (1 << PG_LEVEL_2M)) {
+                        extra = range - ((range >> PMD_SHIFT) << PMD_SHIFT);
 #ifdef CONFIG_X86_32
-                extra += PMD_SIZE;
+                        extra += PMD_SIZE;
 #endif
-                /* The first 2/4M doesn't use large pages. */
-                if (mr->start < PMD_SIZE)
-                        extra += mr->end - mr->start;
-
-                ptes = (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        } else
-                ptes = (end + PAGE_SIZE - 1) >> PAGE_SHIFT;
+                        ptes += (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
+                } else {
+                        ptes += (range + PAGE_SIZE - 1) >> PAGE_SHIFT;
+                }
+        }
 
+        tables = roundup(puds * sizeof(pud_t), PAGE_SIZE);
+        tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE);
         tables += roundup(ptes * sizeof(pte_t), PAGE_SIZE);
 
 #ifdef CONFIG_X86_32
@@ -86,7 +90,7 @@ static void __init find_early_table_space(struct map_range *mr, unsigned long en
         pgt_buf_top = pgt_buf_start + (tables >> PAGE_SHIFT);
 
         printk(KERN_DEBUG "kernel direct mapping tables up to %#lx @ [mem %#010lx-%#010lx]\n",
-                end - 1, pgt_buf_start << PAGE_SHIFT,
+                mr[nr_range - 1].end - 1, pgt_buf_start << PAGE_SHIFT,
                 (pgt_buf_top << PAGE_SHIFT) - 1);
 }
 
@@ -267,7 +271,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
          * nodes are discovered.
          */
         if (!after_bootmem)
-                find_early_table_space(&mr[0], end, use_pse, use_gbpages);
+                find_early_table_space(mr, nr_range);
 
         for (i = 0; i < nr_range; i++)
                 ret = kernel_physical_mapping_init(mr[i].start, mr[i].end,
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 2b6b4a3c8beb..3baff255adac 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -386,7 +386,8 @@ phys_pte_init(pte_t *pte_page, unsigned long addr, unsigned long end,
                  * these mappings are more intelligent.
                  */
                 if (pte_val(*pte)) {
-                        pages++;
+                        if (!after_bootmem)
+                                pages++;
                         continue;
                 }
 
@@ -451,6 +452,8 @@ phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end,
                          * attributes.
                          */
                         if (page_size_mask & (1 << PG_LEVEL_2M)) {
+                                if (!after_bootmem)
+                                        pages++;
                                 last_map_addr = next;
                                 continue;
                         }
@@ -526,6 +529,8 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
                          * attributes.
                          */
                         if (page_size_mask & (1 << PG_LEVEL_1G)) {
+                                if (!after_bootmem)
+                                        pages++;
                                 last_map_addr = next;
                                 continue;
                         }
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 26b8a8514ee5..48768df2471a 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -55,7 +55,7 @@ u64 op_x86_get_ctrl(struct op_x86_model_spec const *model,
         val |= counter_config->extra;
         event &= model->event_mask ? model->event_mask : 0xFF;
         val |= event & 0xFF;
-        val |= (event & 0x0F00) << 24;
+        val |= (u64)(event & 0x0F00) << 24;
 
         return val;
 }
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index aded2a91162a..ad4439145f85 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -70,11 +70,15 @@ EXPORT_SYMBOL(efi);
 struct efi_memory_map memmap;
 
 bool efi_64bit;
-static bool efi_native;
 
 static struct efi efi_phys __initdata;
 static efi_system_table_t efi_systab __initdata;
 
+static inline bool efi_is_native(void)
+{
+        return IS_ENABLED(CONFIG_X86_64) == efi_64bit;
+}
+
 static int __init setup_noefi(char *arg)
 {
         efi_enabled = 0;
@@ -420,7 +424,7 @@ void __init efi_reserve_boot_services(void)
         }
 }
 
-static void __init efi_unmap_memmap(void)
+void __init efi_unmap_memmap(void)
 {
         if (memmap.map) {
                 early_iounmap(memmap.map, memmap.nr_map * memmap.desc_size);
@@ -432,7 +436,7 @@ void __init efi_free_boot_services(void)
 {
         void *p;
 
-        if (!efi_native)
+        if (!efi_is_native())
                 return;
 
         for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
@@ -684,12 +688,10 @@ void __init efi_init(void)
                 return;
         }
         efi_phys.systab = (efi_system_table_t *)boot_params.efi_info.efi_systab;
-        efi_native = !efi_64bit;
 #else
         efi_phys.systab = (efi_system_table_t *)
                           (boot_params.efi_info.efi_systab |
                           ((__u64)boot_params.efi_info.efi_systab_hi<<32));
-        efi_native = efi_64bit;
 #endif
 
         if (efi_systab_init(efi_phys.systab)) {
@@ -723,7 +725,7 @@ void __init efi_init(void)
          * that doesn't match the kernel 32/64-bit mode.
          */
 
-        if (!efi_native)
+        if (!efi_is_native())
                 pr_info("No EFI runtime due to 32/64-bit mismatch with kernel\n");
         else if (efi_runtime_init()) {
                 efi_enabled = 0;
@@ -735,7 +737,7 @@ void __init efi_init(void)
                 return;
         }
 #ifdef CONFIG_X86_32
-        if (efi_native) {
+        if (efi_is_native()) {
                 x86_platform.get_wallclock = efi_get_time;
                 x86_platform.set_wallclock = efi_set_rtc_mmss;
         }
@@ -810,6 +812,16 @@ void __iomem *efi_lookup_mapped_addr(u64 phys_addr)
         return NULL;
 }
 
+void efi_memory_uc(u64 addr, unsigned long size)
+{
+        unsigned long page_shift = 1UL << EFI_PAGE_SHIFT;
+        u64 npages;
+
+        npages = round_up(size, page_shift) / page_shift;
+        memrange_efi_to_native(&addr, &npages);
+        set_memory_uc(addr, npages);
+}
+
 /*
  * This function will switch the EFI runtime services to virtual mode.
  * Essentially, look through the EFI memmap and map every region that
@@ -823,7 +835,7 @@ void __init efi_enter_virtual_mode(void)
         efi_memory_desc_t *md, *prev_md = NULL;
         efi_status_t status;
         unsigned long size;
-        u64 end, systab, addr, npages, end_pfn;
+        u64 end, systab, end_pfn;
         void *p, *va, *new_memmap = NULL;
         int count = 0;
 
@@ -834,7 +846,7 @@ void __init efi_enter_virtual_mode(void)
          * non-native EFI
          */
 
-        if (!efi_native) {
+        if (!efi_is_native()) {
                 efi_unmap_memmap();
                 return;
         }
@@ -879,10 +891,14 @@ void __init efi_enter_virtual_mode(void)
                 end_pfn = PFN_UP(end);
                 if (end_pfn <= max_low_pfn_mapped
                     || (end_pfn > (1UL << (32 - PAGE_SHIFT))
-                        && end_pfn <= max_pfn_mapped))
+                        && end_pfn <= max_pfn_mapped)) {
                         va = __va(md->phys_addr);
-                else
-                        va = efi_ioremap(md->phys_addr, size, md->type);
+
+                        if (!(md->attribute & EFI_MEMORY_WB))
+                                efi_memory_uc((u64)(unsigned long)va, size);
+                } else
+                        va = efi_ioremap(md->phys_addr, size,
+                                         md->type, md->attribute);
 
                 md->virt_addr = (u64) (unsigned long) va;
 
@@ -892,13 +908,6 @@ void __init efi_enter_virtual_mode(void)
                         continue;
                 }
 
-                if (!(md->attribute & EFI_MEMORY_WB)) {
-                        addr = md->virt_addr;
-                        npages = md->num_pages;
-                        memrange_efi_to_native(&addr, &npages);
-                        set_memory_uc(addr, npages);
-                }
-
                 systab = (u64) (unsigned long) efi_phys.systab;
                 if (md->phys_addr <= systab && systab < end) {
                         systab += md->virt_addr - md->phys_addr;
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index ac3aa54e2654..95fd505dfeb6 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -82,7 +82,7 @@ void __init efi_call_phys_epilog(void)
 }
 
 void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
-                                 u32 type)
+                                 u32 type, u64 attribute)
 {
         unsigned long last_map_pfn;
 
@@ -92,8 +92,11 @@ void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
         last_map_pfn = init_memory_mapping(phys_addr, phys_addr + size);
         if ((last_map_pfn << PAGE_SHIFT) < phys_addr + size) {
                 unsigned long top = last_map_pfn << PAGE_SHIFT;
-                efi_ioremap(top, size - (top - phys_addr), type);
+                efi_ioremap(top, size - (top - phys_addr), type, attribute);
         }
 
+        if (!(attribute & EFI_MEMORY_WB))
+                efi_memory_uc((u64)(unsigned long)__va(phys_addr), size);
+
         return (void __iomem *)__va(phys_addr);
 }
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e3497f240eab..586d83812b67 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -81,8 +81,6 @@
 #include "smp.h"
 #include "multicalls.h"
 
-#include <xen/events.h>
-
 EXPORT_SYMBOL_GPL(hypercall_page);
 
 DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index d1a2d74033e9..08373086cd7e 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -159,6 +159,7 @@ static int acpi_bind_one(struct device *dev, acpi_handle handle)
         if (physical_node->node_id >= ACPI_MAX_PHYSICAL_NODE) {
                 retval = -ENOSPC;
                 mutex_unlock(&acpi_dev->physical_node_lock);
+                kfree(physical_node);
                 goto err;
         }
 
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index e78c2a52ea46..bd4e5dca3ff7 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -409,6 +409,7 @@ static void acpi_processor_notify(struct acpi_device *device, u32 event)
                 acpi_bus_generate_proc_event(device, event, 0);
                 acpi_bus_generate_netlink_event(device->pnp.device_class,
                                                   dev_name(&device->dev), event, 0);
+                break;
         default:
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                   "Unsupported event [0x%x]\n", event));
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 08b4c5209384..b34b5cda5ae1 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -236,7 +236,7 @@ config CMA_SIZE_PERCENTAGE
 
 choice
         prompt "Selected region size"
-        default CMA_SIZE_SEL_ABSOLUTE
+        default CMA_SIZE_SEL_MBYTES
 
 config CMA_SIZE_SEL_MBYTES
         bool "Use mega bytes value only"
diff --git a/drivers/base/dma-coherent.c b/drivers/base/dma-coherent.c
index 560a7173f810..bc256b641027 100644
--- a/drivers/base/dma-coherent.c
+++ b/drivers/base/dma-coherent.c
@@ -191,9 +191,8 @@ EXPORT_SYMBOL(dma_release_from_coherent);
  * This checks whether the memory was allocated from the per-device
  * coherent memory pool and if so, maps that memory to the provided vma.
  *
- * Returns 1 if we correctly mapped the memory, or 0 if
- * dma_release_coherent() should proceed with mapping memory from
- * generic pools.
+ * Returns 1 if we correctly mapped the memory, or 0 if the caller should
+ * proceed with mapping memory from generic pools.
  */
 int dma_mmap_from_coherent(struct device *dev, struct vm_area_struct *vma,
                            void *vaddr, size_t size, int *ret)
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 9a1469474f55..612afcc5a938 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -27,15 +27,12 @@
 #include <linux/mm.h>
 #include <linux/mutex.h>
 #include <linux/page-isolation.h>
+#include <linux/sizes.h>
 #include <linux/slab.h>
 #include <linux/swap.h>
 #include <linux/mm_types.h>
 #include <linux/dma-contiguous.h>
 
-#ifndef SZ_1M
-#define SZ_1M (1 << 20)
-#endif
-
 struct cma {
         unsigned long   base_pfn;
         unsigned long   count;
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 81541452887b..8945f4e489ed 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -36,68 +36,6 @@ MODULE_AUTHOR("Manuel Estrada Sainz");
 MODULE_DESCRIPTION("Multi purpose firmware loading support");
 MODULE_LICENSE("GPL");
 
-static const char *fw_path[] = {
-        "/lib/firmware/updates/" UTS_RELEASE,
-        "/lib/firmware/updates",
-        "/lib/firmware/" UTS_RELEASE,
-        "/lib/firmware"
-};
-
-/* Don't inline this: 'struct kstat' is biggish */
-static noinline long fw_file_size(struct file *file)
-{
-        struct kstat st;
-        if (vfs_getattr(file->f_path.mnt, file->f_path.dentry, &st))
-                return -1;
-        if (!S_ISREG(st.mode))
-                return -1;
-        if (st.size != (long)st.size)
-                return -1;
-        return st.size;
-}
-
-static bool fw_read_file_contents(struct file *file, struct firmware *fw)
-{
-        long size;
-        char *buf;
-
-        size = fw_file_size(file);
-        if (size < 0)
-                return false;
-        buf = vmalloc(size);
-        if (!buf)
-                return false;
-        if (kernel_read(file, 0, buf, size) != size) {
-                vfree(buf);
-                return false;
-        }
-        fw->data = buf;
-        fw->size = size;
-        return true;
-}
-
-static bool fw_get_filesystem_firmware(struct firmware *fw, const char *name)
-{
-        int i;
-        bool success = false;
-        char *path = __getname();
-
-        for (i = 0; i < ARRAY_SIZE(fw_path); i++) {
-                struct file *file;
-                snprintf(path, PATH_MAX, "%s/%s", fw_path[i], name);
-
-                file = filp_open(path, O_RDONLY, 0);
-                if (IS_ERR(file))
-                        continue;
-                success = fw_read_file_contents(file, fw);
-                fput(file);
-                if (success)
-                        break;
-        }
-        __putname(path);
-        return success;
-}
-
 /* Builtin firmware support */
 
 #ifdef CONFIG_FW_LOADER
@@ -150,6 +88,11 @@ enum {
         FW_STATUS_ABORT,
 };
 
+enum fw_buf_fmt {
+        VMALLOC_BUF,    /* used in direct loading */
+        PAGE_BUF,       /* used in loading via userspace */
+};
+
 static int loading_timeout = 60;        /* In seconds */
 
 static inline long firmware_loading_timeout(void)
@@ -173,8 +116,6 @@ struct firmware_cache {
         spinlock_t name_lock;
         struct list_head fw_names;
 
-        wait_queue_head_t wait_queue;
-        int cnt;
         struct delayed_work work;
 
         struct notifier_block   pm_notify;
@@ -187,6 +128,7 @@ struct firmware_buf {
         struct completion completion;
         struct firmware_cache *fwc;
         unsigned long status;
+        enum fw_buf_fmt fmt;
         void *data;
         size_t size;
         struct page **pages;
@@ -240,6 +182,7 @@ static struct firmware_buf *__allocate_fw_buf(const char *fw_name,
         strcpy(buf->fw_id, fw_name);
         buf->fwc = fwc;
         init_completion(&buf->completion);
+        buf->fmt = VMALLOC_BUF;
 
         pr_debug("%s: fw-%s buf=%p\n", __func__, fw_name, buf);
 
@@ -307,10 +250,14 @@ static void __fw_free_buf(struct kref *ref)
         list_del(&buf->list);
         spin_unlock(&fwc->lock);
 
-        vunmap(buf->data);
-        for (i = 0; i < buf->nr_pages; i++)
-                __free_page(buf->pages[i]);
-        kfree(buf->pages);
+
+        if (buf->fmt == PAGE_BUF) {
+                vunmap(buf->data);
+                for (i = 0; i < buf->nr_pages; i++)
+                        __free_page(buf->pages[i]);
+                kfree(buf->pages);
+        } else
+                vfree(buf->data);
         kfree(buf);
 }
 
@@ -319,6 +266,69 @@ static void fw_free_buf(struct firmware_buf *buf)
         kref_put(&buf->ref, __fw_free_buf);
 }
 
+/* direct firmware loading support */
+static const char *fw_path[] = {
+        "/lib/firmware/updates/" UTS_RELEASE,
+        "/lib/firmware/updates",
+        "/lib/firmware/" UTS_RELEASE,
+        "/lib/firmware"
+};
+
+/* Don't inline this: 'struct kstat' is biggish */
+static noinline long fw_file_size(struct file *file)
+{
+        struct kstat st;
+        if (vfs_getattr(file->f_path.mnt, file->f_path.dentry, &st))
+                return -1;
+        if (!S_ISREG(st.mode))
+                return -1;
+        if (st.size != (long)st.size)
+                return -1;
+        return st.size;
+}
+
+static bool fw_read_file_contents(struct file *file, struct firmware_buf *fw_buf)
+{
+        long size;
+        char *buf;
+
+        size = fw_file_size(file);
+        if (size < 0)
+                return false;
+        buf = vmalloc(size);
+        if (!buf)
+                return false;
+        if (kernel_read(file, 0, buf, size) != size) {
+                vfree(buf);
+                return false;
+        }
+        fw_buf->data = buf;
+        fw_buf->size = size;
+        return true;
+}
+
+static bool fw_get_filesystem_firmware(struct firmware_buf *buf)
+{
+        int i;
+        bool success = false;
+        char *path = __getname();
+
+        for (i = 0; i < ARRAY_SIZE(fw_path); i++) {
+                struct file *file;
+                snprintf(path, PATH_MAX, "%s/%s", fw_path[i], buf->fw_id);
+
+                file = filp_open(path, O_RDONLY, 0);
+                if (IS_ERR(file))
+                        continue;
+                success = fw_read_file_contents(file, buf);
+                fput(file);
+                if (success)
+                        break;
+        }
+        __putname(path);
+        return success;
+}
+
 static struct firmware_priv *to_firmware_priv(struct device *dev)
 {
         return container_of(dev, struct firmware_priv, dev);
@@ -423,6 +433,21 @@ static void firmware_free_data(const struct firmware *fw)
 #ifndef PAGE_KERNEL_RO
 #define PAGE_KERNEL_RO PAGE_KERNEL
 #endif
+
+/* one pages buffer should be mapped/unmapped only once */
+static int fw_map_pages_buf(struct firmware_buf *buf)
+{
+        if (buf->fmt != PAGE_BUF)
+                return 0;
+
+        if (buf->data)
+                vunmap(buf->data);
+        buf->data = vmap(buf->pages, buf->nr_pages, 0, PAGE_KERNEL_RO);
+        if (!buf->data)
+                return -ENOMEM;
+        return 0;
+}
+
 /**
  * firmware_loading_store - set value in the 'loading' control file
  * @dev: device pointer
@@ -467,6 +492,14 @@ static ssize_t firmware_loading_store(struct device *dev,
                 if (test_bit(FW_STATUS_LOADING, &fw_buf->status)) {
                         set_bit(FW_STATUS_DONE, &fw_buf->status);
                         clear_bit(FW_STATUS_LOADING, &fw_buf->status);
+
+                        /*
+                         * Several loading requests may be pending on
+                         * one same firmware buf, so let all requests
+                         * see the mapped 'buf->data' once the loading
+                         * is completed.
+                         * */
+                        fw_map_pages_buf(fw_buf);
                         complete_all(&fw_buf->completion);
                         break;
                 }
@@ -670,15 +703,6 @@ exit:
         return fw_priv;
 }
 
-/* one pages buffer is mapped/unmapped only once */
-static int fw_map_pages_buf(struct firmware_buf *buf)
-{
-        buf->data = vmap(buf->pages, buf->nr_pages, 0, PAGE_KERNEL_RO);
-        if (!buf->data)
-                return -ENOMEM;
-        return 0;
-}
-
 /* store the pages buffer info firmware from buf */
 static void fw_set_page_data(struct firmware_buf *buf, struct firmware *fw)
 {
@@ -778,11 +802,6 @@ _request_firmware_prepare(const struct firmware **firmware_p, const char *name,
                 return NULL;
         }
 
-        if (fw_get_filesystem_firmware(firmware, name)) {
-                dev_dbg(device, "firmware: direct-loading firmware %s\n", name);
-                return NULL;
-        }
-
         ret = fw_lookup_and_allocate_buf(name, &fw_cache, &buf);
         if (!ret)
                 fw_priv = fw_create_instance(firmware, name, device,
@@ -832,6 +851,21 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
         struct device *f_dev = &fw_priv->dev;
         struct firmware_buf *buf = fw_priv->buf;
         struct firmware_cache *fwc = &fw_cache;
+        int direct_load = 0;
+
+        /* try direct loading from fs first */
+        if (fw_get_filesystem_firmware(buf)) {
+                dev_dbg(f_dev->parent, "firmware: direct-loading"
+                        " firmware %s\n", buf->fw_id);
+
+                set_bit(FW_STATUS_DONE, &buf->status);
+                complete_all(&buf->completion);
+                direct_load = 1;
+                goto handle_fw;
+        }
+
+        /* fall back on userspace loading */
+        buf->fmt = PAGE_BUF;
 
         dev_set_uevent_suppress(f_dev, true);
 
@@ -870,6 +904,7 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
 
         del_timer_sync(&fw_priv->timeout);
 
+handle_fw:
         mutex_lock(&fw_lock);
         if (!buf->size || test_bit(FW_STATUS_ABORT, &buf->status))
                 retval = -ENOENT;
@@ -884,9 +919,6 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
         if (!retval && f_dev->parent)
                 fw_add_devm_name(f_dev->parent, buf->fw_id);
 
-        if (!retval)
-                retval = fw_map_pages_buf(buf);
-
         /*
          * After caching firmware image is started, let it piggyback
          * on request firmware.
@@ -902,6 +934,9 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
         fw_priv->buf = NULL;
         mutex_unlock(&fw_lock);
 
+        if (direct_load)
+                goto err_put_dev;
+
         device_remove_file(f_dev, &dev_attr_loading);
 err_del_bin_attr:
         device_remove_bin_file(f_dev, &firmware_attr_data);
@@ -1129,6 +1164,8 @@ int uncache_firmware(const char *fw_name)
 }
 
 #ifdef CONFIG_PM_SLEEP
+static ASYNC_DOMAIN_EXCLUSIVE(fw_cache_domain);
+
 static struct fw_cache_entry *alloc_fw_cache_entry(const char *name)
 {
         struct fw_cache_entry *fce;
@@ -1142,17 +1179,27 @@ exit:
         return fce;
 }
 
-static int fw_cache_piggyback_on_request(const char *name)
+static int __fw_entry_found(const char *name)
 {
         struct firmware_cache *fwc = &fw_cache;
         struct fw_cache_entry *fce;
-        int ret = 0;
 
-        spin_lock(&fwc->name_lock);
         list_for_each_entry(fce, &fwc->fw_names, list) {
                 if (!strcmp(fce->name, name))
-                        goto found;
+                        return 1;
         }
+        return 0;
+}
+
+static int fw_cache_piggyback_on_request(const char *name)
+{
+        struct firmware_cache *fwc = &fw_cache;
+        struct fw_cache_entry *fce;
+        int ret = 0;
+
+        spin_lock(&fwc->name_lock);
+        if (__fw_entry_found(name))
+                goto found;
 
         fce = alloc_fw_cache_entry(name);
         if (fce) {
@@ -1185,12 +1232,6 @@ static void __async_dev_cache_fw_image(void *fw_entry,
 
                 free_fw_cache_entry(fce);
         }
-
-        spin_lock(&fwc->name_lock);
-        fwc->cnt--;
-        spin_unlock(&fwc->name_lock);
-
-        wake_up(&fwc->wait_queue);
 }
 
 /* called with dev->devres_lock held */
@@ -1229,11 +1270,19 @@ static void dev_cache_fw_image(struct device *dev, void *data)
                 list_del(&fce->list);
 
                 spin_lock(&fwc->name_lock);
-                fwc->cnt++;
-                list_add(&fce->list, &fwc->fw_names);
+                /* only one cache entry for one firmware */
+                if (!__fw_entry_found(fce->name)) {
+                        list_add(&fce->list, &fwc->fw_names);
+                } else {
+                        free_fw_cache_entry(fce);
+                        fce = NULL;
+                }
                 spin_unlock(&fwc->name_lock);
 
-                async_schedule(__async_dev_cache_fw_image, (void *)fce);
+                if (fce)
+                        async_schedule_domain(__async_dev_cache_fw_image,
+                                              (void *)fce,
+                                              &fw_cache_domain);
         }
 }
 
@@ -1275,6 +1324,9 @@ static void device_cache_fw_images(void)
 
         pr_debug("%s\n", __func__);
 
+        /* cancel uncache work */
+        cancel_delayed_work_sync(&fwc->work);
+
         /*
          * use small loading timeout for caching devices' firmware
          * because all these firmware images have been loaded
@@ -1292,21 +1344,7 @@ static void device_cache_fw_images(void)
         mutex_unlock(&fw_lock);
 
         /* wait for completion of caching firmware for all devices */
-        spin_lock(&fwc->name_lock);
-        for (;;) {
-                prepare_to_wait(&fwc->wait_queue, &wait,
-                                TASK_UNINTERRUPTIBLE);
-                if (!fwc->cnt)
-                        break;
-
-                spin_unlock(&fwc->name_lock);
-
-                schedule();
-
-                spin_lock(&fwc->name_lock);
-        }
-        spin_unlock(&fwc->name_lock);
-        finish_wait(&fwc->wait_queue, &wait);
+        async_synchronize_full_domain(&fw_cache_domain);
 
         loading_timeout = old_timeout;
 }
@@ -1394,9 +1432,7 @@ static void __init fw_cache_init(void)
 #ifdef CONFIG_PM_SLEEP
         spin_lock_init(&fw_cache.name_lock);
         INIT_LIST_HEAD(&fw_cache.fw_names);
-        fw_cache.cnt = 0;
 
-        init_waitqueue_head(&fw_cache.wait_queue);
         INIT_DELAYED_WORK(&fw_cache.work,
                           device_uncache_fw_images_work);
 
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index c22b869245d9..96b71b6536d6 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -1862,7 +1862,7 @@ int pm_genpd_attach_cpuidle(struct generic_pm_domain *genpd, int state)
         cpuidle_drv = cpuidle_driver_ref();
         if (!cpuidle_drv) {
                 ret = -ENODEV;
-                goto out;
+                goto err_drv;
         }
         if (cpuidle_drv->state_count <= state) {
                 ret = -EINVAL;
@@ -1884,6 +1884,9 @@ int pm_genpd_attach_cpuidle(struct generic_pm_domain *genpd, int state)
 
  err:
         cpuidle_driver_unref();
+
+ err_drv:
+        kfree(cpu_data);
         goto out;
 }
 
diff --git a/drivers/base/regmap/Kconfig b/drivers/base/regmap/Kconfig
index 6be390bd8bd1..f0d30543fcce 100644
--- a/drivers/base/regmap/Kconfig
+++ b/drivers/base/regmap/Kconfig
@@ -3,7 +3,7 @@
 # subsystems should select the appropriate symbols.
 
 config REGMAP
-        default y if (REGMAP_I2C || REGMAP_SPI)
+        default y if (REGMAP_I2C || REGMAP_SPI || REGMAP_MMIO || REGMAP_IRQ)
         select LZO_COMPRESS
         select LZO_DECOMPRESS
         select IRQ_DOMAIN if REGMAP_IRQ
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 432aeeedfd5e..d865470bc951 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -158,9 +158,10 @@ static int bcma_register_cores(struct bcma_bus *bus)
 
 static void bcma_unregister_cores(struct bcma_bus *bus)
 {
-        struct bcma_device *core;
+        struct bcma_device *core, *tmp;
 
-        list_for_each_entry(core, &bus->cores, list) {
+        list_for_each_entry_safe(core, tmp, &bus->cores, list) {
+                list_del(&core->list);
                 if (core->dev_registered)
                         device_unregister(&core->dev);
         }
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index 320debbe32fa..9b4f0116ff21 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1456,7 +1456,7 @@ static int __devexit sonypi_remove(struct platform_device *dev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int old_camera_power;
 
 static int sonypi_suspend(struct device *dev)
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index b40ee1403be9..399831690fed 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -328,6 +328,7 @@ static int __cpuinit cpufreq_stat_cpu_callback(struct notifier_block *nfb,
                 cpufreq_update_policy(cpu);
                 break;
         case CPU_DOWN_PREPARE:
+        case CPU_DOWN_PREPARE_FROZEN:
                 cpufreq_stats_free_sysfs(cpu);
                 break;
         case CPU_DEAD:
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index 129e80bfff22..c16a3a593ba4 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -1052,14 +1052,7 @@ static int powernowk8_target(struct cpufreq_policy *pol,
         struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
                                              .relation = relation };
 
-        /*
-         * Must run on @pol->cpu.  cpufreq core is responsible for ensuring
-         * that we're bound to the current CPU and pol->cpu stays online.
-         */
-        if (smp_processor_id() == pol->cpu)
-                return powernowk8_target_fn(&pta);
-        else
-                return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
+        return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
 }
 
 /* Driver entry point to verify the policy and range of frequencies */
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 677cd6e4e1a1..d4c12180c654 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -90,6 +90,17 @@ config DW_DMAC
           Support the Synopsys DesignWare AHB DMA controller.  This
           can be integrated in chips such as the Atmel AT32ap7000.
 
+config DW_DMAC_BIG_ENDIAN_IO
+        bool "Use big endian I/O register access"
+        default y if AVR32
+        depends on DW_DMAC
+        help
+          Say yes here to use big endian I/O access when reading and writing
+          to the DMA controller registers. This is needed on some platforms,
+          like the Atmel AVR32 architecture.
+
+          If unsure, use the default setting.
+
 config AT_HDMAC
         tristate "Atmel AHB DMA support"
         depends on ARCH_AT91
diff --git a/drivers/dma/dw_dmac_regs.h b/drivers/dma/dw_dmac_regs.h
index ff39fa6cd2bc..88965597b7d0 100644
--- a/drivers/dma/dw_dmac_regs.h
+++ b/drivers/dma/dw_dmac_regs.h
@@ -98,9 +98,17 @@ struct dw_dma_regs {
         u32     DW_PARAMS;
 };
 
+#ifdef CONFIG_DW_DMAC_BIG_ENDIAN_IO
+#define dma_readl_native ioread32be
+#define dma_writel_native iowrite32be
+#else
+#define dma_readl_native readl
+#define dma_writel_native writel
+#endif
+
 /* To access the registers in early stage of probe */
 #define dma_read_byaddr(addr, name) \
-        readl((addr) + offsetof(struct dw_dma_regs, name))
+        dma_readl_native((addr) + offsetof(struct dw_dma_regs, name))
 
 /* Bitfields in DW_PARAMS */
 #define DW_PARAMS_NR_CHAN       8               /* number of channels */
@@ -216,9 +224,9 @@ __dwc_regs(struct dw_dma_chan *dwc)
 }
 
 #define channel_readl(dwc, name) \
-        readl(&(__dwc_regs(dwc)->name))
+        dma_readl_native(&(__dwc_regs(dwc)->name))
 #define channel_writel(dwc, name, val) \
-        writel((val), &(__dwc_regs(dwc)->name))
+        dma_writel_native((val), &(__dwc_regs(dwc)->name))
 
 static inline struct dw_dma_chan *to_dw_dma_chan(struct dma_chan *chan)
 {
@@ -246,9 +254,9 @@ static inline struct dw_dma_regs __iomem *__dw_regs(struct dw_dma *dw)
 }
 
 #define dma_readl(dw, name) \
-        readl(&(__dw_regs(dw)->name))
+        dma_readl_native(&(__dw_regs(dw)->name))
 #define dma_writel(dw, name, val) \
-        writel((val), &(__dw_regs(dw)->name))
+        dma_writel_native((val), &(__dw_regs(dw)->name))
 
 #define channel_set_bit(dw, reg, mask) \
         dma_writel(dw, reg, ((mask) << 8) | (mask))
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index f11b5b2b1a1c..7d9554cc4976 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -474,8 +474,10 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
                         slot = i;
                         break;
                 }
-                if (slot < 0)
+                if (slot < 0) {
+                        spin_unlock_irqrestore(&imxdma->lock, flags);
                         return -EBUSY;
+                }
 
                 imxdma->slots_2d[slot].xsr = d->x;
                 imxdma->slots_2d[slot].ysr = d->y;
diff --git a/drivers/dma/sirf-dma.c b/drivers/dma/sirf-dma.c
index 64385cde044b..d451caace806 100644
--- a/drivers/dma/sirf-dma.c
+++ b/drivers/dma/sirf-dma.c
@@ -109,7 +109,7 @@ static void sirfsoc_dma_execute(struct sirfsoc_dma_chan *schan)
         sdesc = list_first_entry(&schan->queued, struct sirfsoc_dma_desc,
                 node);
         /* Move the first queued descriptor to active list */
-        list_move_tail(&schan->queued, &schan->active);
+        list_move_tail(&sdesc->node, &schan->active);
 
         /* Start the DMA transfer */
         writel_relaxed(sdesc->width, sdma->base + SIRFSOC_DMA_WIDTH_0 +
@@ -428,7 +428,7 @@ static struct dma_async_tx_descriptor *sirfsoc_dma_prep_interleaved(
         unsigned long iflags;
         int ret;
 
-        if ((xt->dir != DMA_MEM_TO_DEV) || (xt->dir != DMA_DEV_TO_MEM)) {
+        if ((xt->dir != DMA_MEM_TO_DEV) && (xt->dir != DMA_DEV_TO_MEM)) {
                 ret = -EINVAL;
                 goto err_dir;
         }
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 5a297a26211d..cc8e7c78a23c 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -170,8 +170,11 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
          * memory controller and apply to register. Search for the first
          * bandwidth entry that is greater or equal than the setting requested
          * and program that. If at last entry, turn off DRAM scrubbing.
+         *
+         * If no suitable bandwidth is found, turn off DRAM scrubbing entirely
+         * by falling back to the last element in scrubrates[].
          */
-        for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
+        for (i = 0; i < ARRAY_SIZE(scrubrates) - 1; i++) {
                 /*
                  * skip scrub rates which aren't recommended
                  * (see F10 BKDG, F3x58)
@@ -181,12 +184,6 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
 
                 if (scrubrates[i].bandwidth <= new_bw)
                         break;
-
-                /*
-                 * if no suitable bandwidth found, turn off DRAM scrubbing
-                 * entirely by falling back to the last element in the
-                 * scrubrates array.
-                 */
         }
 
         scrubval = scrubrates[i].scrubval;
diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
index 725eb5aa8d8c..e87196f6d2d2 100644
--- a/drivers/extcon/extcon-adc-jack.c
+++ b/drivers/extcon/extcon-adc-jack.c
@@ -14,6 +14,7 @@
  *
  */
 
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/device.h>
 #include <linux/platform_device.h>
@@ -161,13 +162,12 @@ static int __devinit adc_jack_probe(struct platform_device *pdev)
         err = request_any_context_irq(data->irq, adc_jack_irq_thread,
                         pdata->irq_flags, pdata->name, data);
 
-        if (err) {
+        if (err < 0) {
                 dev_err(&pdev->dev, "error: irq %d\n", data->irq);
-                err = -EINVAL;
                 goto err_irq;
         }
 
-        goto out;
+        return 0;
 
 err_irq:
         extcon_dev_unregister(&data->edev);
@@ -196,3 +196,7 @@ static struct platform_driver adc_jack_driver = {
 };
 
 module_platform_driver(adc_jack_driver);
+
+MODULE_AUTHOR("MyungJoo Ham <myungjoo.ham@samsung.com>");
+MODULE_DESCRIPTION("ADC Jack extcon driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/extcon/extcon-class.c b/drivers/extcon/extcon-class.c
index 946a3188b2b7..d398821097f3 100644
--- a/drivers/extcon/extcon-class.c
+++ b/drivers/extcon/extcon-class.c
@@ -41,7 +41,7 @@
  * every single port-type of the following cable names. Please choose cable
  * names that are actually used in your extcon device.
  */
-const char *extcon_cable_name[] = {
+const char extcon_cable_name[][CABLE_NAME_MAX + 1] = {
         [EXTCON_USB]            = "USB",
         [EXTCON_USB_HOST]       = "USB-Host",
         [EXTCON_TA]             = "TA",
@@ -62,8 +62,6 @@ const char *extcon_cable_name[] = {
         [EXTCON_VIDEO_IN]       = "Video-in",
         [EXTCON_VIDEO_OUT]      = "Video-out",
         [EXTCON_MECHANICAL]     = "Mechanical",
-
-        NULL,
 };
 
 static struct class *extcon_class;
@@ -91,17 +89,13 @@ static int check_mutually_exclusive(struct extcon_dev *edev, u32 new_state)
                 return 0;
 
         for (i = 0; edev->mutually_exclusive[i]; i++) {
-                int count = 0, j;
+                int weight;
                 u32 correspondants = new_state & edev->mutually_exclusive[i];
-                u32 exp = 1;
-
-                for (j = 0; j < 32; j++) {
-                        if (exp & correspondants)
-                                count++;
-                        if (count > 1)
-                                return i + 1;
-                        exp <<= 1;
-                }
+
+                /* calculate the total number of bits set */
+                weight = hweight32(correspondants);
+                if (weight > 1)
+                        return i + 1;
         }
 
         return 0;
@@ -362,7 +356,7 @@ int extcon_get_cable_state(struct extcon_dev *edev, const char *cable_name)
 EXPORT_SYMBOL_GPL(extcon_get_cable_state);
 
 /**
- * extcon_get_cable_state_() - Set the status of a specific cable.
+ * extcon_set_cable_state_() - Set the status of a specific cable.
  * @edev:       the extcon device that has the cable.
  * @index:      cable index that can be retrieved by extcon_find_cable_index().
  * @cable_state:        the new cable status. The default semantics is
@@ -382,7 +376,7 @@ int extcon_set_cable_state_(struct extcon_dev *edev,
 EXPORT_SYMBOL_GPL(extcon_set_cable_state_);
 
 /**
- * extcon_get_cable_state() - Set the status of a specific cable.
+ * extcon_set_cable_state() - Set the status of a specific cable.
  * @edev:       the extcon device that has the cable.
  * @cable_name: cable name.
  * @cable_state:        the new cable status. The default semantics is
@@ -447,6 +441,8 @@ static int _call_per_cable(struct notifier_block *nb, unsigned long val,
  *                            extcon device.
  * @obj:        an empty extcon_specific_cable_nb object to be returned.
  * @extcon_name:        the name of extcon device.
+ *                      if NULL, extcon_register_interest will register
+ *                      every cable with the target cable_name given.
  * @cable_name:         the target cable name.
  * @nb:         the notifier block to get notified.
  *
@@ -466,22 +462,44 @@ int extcon_register_interest(struct extcon_specific_cable_nb *obj,
                              const char *extcon_name, const char *cable_name,
                              struct notifier_block *nb)
 {
-        if (!obj || !extcon_name || !cable_name || !nb)
+        if (!obj || !cable_name || !nb)
                 return -EINVAL;
 
-        obj->edev = extcon_get_extcon_dev(extcon_name);
-        if (!obj->edev)
-                return -ENODEV;
+        if (extcon_name) {
+                obj->edev = extcon_get_extcon_dev(extcon_name);
+                if (!obj->edev)
+                        return -ENODEV;
 
-        obj->cable_index = extcon_find_cable_index(obj->edev, cable_name);
-        if (obj->cable_index < 0)
-                return -ENODEV;
+                obj->cable_index = extcon_find_cable_index(obj->edev, cable_name);
+                if (obj->cable_index < 0)
+                        return -ENODEV;
+
+                obj->user_nb = nb;
 
-        obj->user_nb = nb;
+                obj->internal_nb.notifier_call = _call_per_cable;
 
-        obj->internal_nb.notifier_call = _call_per_cable;
+                return raw_notifier_chain_register(&obj->edev->nh, &obj->internal_nb);
+        } else {
+                struct class_dev_iter iter;
+                struct extcon_dev *extd;
+                struct device *dev;
+
+                if (!extcon_class)
+                        return -ENODEV;
+                class_dev_iter_init(&iter, extcon_class, NULL, NULL);
+                while ((dev = class_dev_iter_next(&iter))) {
+                        extd = (struct extcon_dev *)dev_get_drvdata(dev);
+
+                        if (extcon_find_cable_index(extd, cable_name) < 0)
+                                continue;
+
+                        class_dev_iter_exit(&iter);
+                        return extcon_register_interest(obj, extd->name,
+                                                cable_name, nb);
+                }
 
-        return raw_notifier_chain_register(&obj->edev->nh, &obj->internal_nb);
+                return -ENODEV;
+        }
 }
 
 /**
@@ -551,43 +569,9 @@ static int create_extcon_class(void)
         return 0;
 }
 
-static void extcon_cleanup(struct extcon_dev *edev, bool skip)
-{
-        mutex_lock(&extcon_dev_list_lock);
-        list_del(&edev->entry);
-        mutex_unlock(&extcon_dev_list_lock);
-
-        if (!skip && get_device(edev->dev)) {
-                int index;
-
-                if (edev->mutually_exclusive && edev->max_supported) {
-                        for (index = 0; edev->mutually_exclusive[index];
-                             index++)
-                                kfree(edev->d_attrs_muex[index].attr.name);
-                        kfree(edev->d_attrs_muex);
-                        kfree(edev->attrs_muex);
-                }
-
-                for (index = 0; index < edev->max_supported; index++)
-                        kfree(edev->cables[index].attr_g.name);
-
-                if (edev->max_supported) {
-                        kfree(edev->extcon_dev_type.groups);
-                        kfree(edev->cables);
-                }
-
-                device_unregister(edev->dev);
-                put_device(edev->dev);
-        }
-
-        kfree(edev->dev);
-}
-
 static void extcon_dev_release(struct device *dev)
 {
-        struct extcon_dev *edev = (struct extcon_dev *) dev_get_drvdata(dev);
-
-        extcon_cleanup(edev, true);
+        kfree(dev);
 }
 
 static const char *muex_name = "mutually_exclusive";
@@ -813,7 +797,40 @@ EXPORT_SYMBOL_GPL(extcon_dev_register);
  */
 void extcon_dev_unregister(struct extcon_dev *edev)
 {
-        extcon_cleanup(edev, false);
+        int index;
+
+        mutex_lock(&extcon_dev_list_lock);
+        list_del(&edev->entry);
+        mutex_unlock(&extcon_dev_list_lock);
+
+        if (IS_ERR_OR_NULL(get_device(edev->dev))) {
+                dev_err(edev->dev, "Failed to unregister extcon_dev (%s)\n",
+                                dev_name(edev->dev));
+                return;
+        }
+
+        if (edev->mutually_exclusive && edev->max_supported) {
+                for (index = 0; edev->mutually_exclusive[index];
+                                index++)
+                        kfree(edev->d_attrs_muex[index].attr.name);
+                kfree(edev->d_attrs_muex);
+                kfree(edev->attrs_muex);
+        }
+
+        for (index = 0; index < edev->max_supported; index++)
+                kfree(edev->cables[index].attr_g.name);
+
+        if (edev->max_supported) {
+                kfree(edev->extcon_dev_type.groups);
+                kfree(edev->cables);
+        }
+
+#if defined(CONFIG_ANDROID)
+        if (switch_class)
+                class_compat_remove_link(switch_class, edev->dev, NULL);
+#endif
+        device_unregister(edev->dev);
+        put_device(edev->dev);
 }
 EXPORT_SYMBOL_GPL(extcon_dev_unregister);
 
@@ -825,6 +842,9 @@ module_init(extcon_class_init);
 
 static void __exit extcon_class_exit(void)
 {
+#if defined(CONFIG_ANDROID)
+        class_compat_unregister(switch_class);
+#endif
         class_destroy(extcon_class);
 }
 module_exit(extcon_class_exit);
diff --git a/drivers/extcon/extcon-gpio.c b/drivers/extcon/extcon-gpio.c
index 3cc152e690b0..71d3ab7b3d8d 100644
--- a/drivers/extcon/extcon-gpio.c
+++ b/drivers/extcon/extcon-gpio.c
@@ -26,7 +26,6 @@
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
-#include <linux/extcon.h>
 #include <linux/workqueue.h>
 #include <linux/gpio.h>
 #include <linux/extcon.h>
diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index e21387e2da5c..a17d0d91ada2 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -239,25 +239,19 @@ const char *max77693_extcon_cable[] = {
 static int max77693_muic_set_debounce_time(struct max77693_muic_info *info,
                 enum max77693_muic_adc_debounce_time time)
 {
-        int ret = 0;
-        u8 ctrl3;
+        int ret;
 
         switch (time) {
         case ADC_DEBOUNCE_TIME_5MS:
         case ADC_DEBOUNCE_TIME_10MS:
         case ADC_DEBOUNCE_TIME_25MS:
         case ADC_DEBOUNCE_TIME_38_62MS:
-                ret = max77693_read_reg(info->max77693->regmap_muic,
-                                MAX77693_MUIC_REG_CTRL3, &ctrl3);
-                ctrl3 &= ~CONTROL3_ADCDBSET_MASK;
-                ctrl3 |= (time << CONTROL3_ADCDBSET_SHIFT);
-
-                ret = max77693_write_reg(info->max77693->regmap_muic,
-                                MAX77693_MUIC_REG_CTRL3, ctrl3);
-                if (ret) {
+                ret = max77693_update_reg(info->max77693->regmap_muic,
+                                          MAX77693_MUIC_REG_CTRL3,
+                                          time << CONTROL3_ADCDBSET_SHIFT,
+                                          CONTROL3_ADCDBSET_MASK);
+                if (ret)
                         dev_err(info->dev, "failed to set ADC debounce time\n");
-                        ret = -EINVAL;
-                }
                 break;
         default:
                 dev_err(info->dev, "invalid ADC debounce time\n");
@@ -657,6 +651,8 @@ out:
 static int __devinit max77693_muic_probe(struct platform_device *pdev)
 {
         struct max77693_dev *max77693 = dev_get_drvdata(pdev->dev.parent);
+        struct max77693_platform_data *pdata = dev_get_platdata(max77693->dev);
+        struct max77693_muic_platform_data *muic_pdata = pdata->muic_data;
         struct max77693_muic_info *info;
         int ret, i;
         u8 id;
@@ -727,6 +723,31 @@ static int __devinit max77693_muic_probe(struct platform_device *pdev)
                 goto err_extcon;
         }
 
+        /* Initialize MUIC register by using platform data */
+        for (i = 0 ; i < muic_pdata->num_init_data ; i++) {
+                enum max77693_irq_source irq_src = MAX77693_IRQ_GROUP_NR;
+
+                max77693_write_reg(info->max77693->regmap_muic,
+                                muic_pdata->init_data[i].addr,
+                                muic_pdata->init_data[i].data);
+
+                switch (muic_pdata->init_data[i].addr) {
+                case MAX77693_MUIC_REG_INTMASK1:
+                        irq_src = MUIC_INT1;
+                        break;
+                case MAX77693_MUIC_REG_INTMASK2:
+                        irq_src = MUIC_INT2;
+                        break;
+                case MAX77693_MUIC_REG_INTMASK3:
+                        irq_src = MUIC_INT3;
+                        break;
+                }
+
+                if (irq_src < MAX77693_IRQ_GROUP_NR)
+                        info->max77693->irq_masks_cur[irq_src]
+                                = muic_pdata->init_data[i].data;
+        }
+
         /* Check revision number of MUIC device*/
         ret = max77693_read_reg(info->max77693->regmap_muic,
                         MAX77693_MUIC_REG_ID, &id);
@@ -762,6 +783,7 @@ static int __devexit max77693_muic_remove(struct platform_device *pdev)
                 free_irq(muic_irqs[i].virq, info);
         cancel_work_sync(&info->irq_work);
         extcon_dev_unregister(info->edev);
+        kfree(info->edev);
         kfree(info);
 
         return 0;
diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
index ef9090a4271d..77b66b0cc8f5 100644
--- a/drivers/extcon/extcon-max8997.c
+++ b/drivers/extcon/extcon-max8997.c
@@ -271,8 +271,6 @@ out:
 static int max8997_muic_handle_charger_type_detach(
                                 struct max8997_muic_info *info)
 {
-        int ret = 0;
-
         switch (info->pre_charger_type) {
         case MAX8997_CHARGER_TYPE_USB:
                 extcon_set_cable_state(info->edev, "USB", false);
@@ -290,11 +288,11 @@ static int max8997_muic_handle_charger_type_detach(
                 extcon_set_cable_state(info->edev, "Fast-charger", false);
                 break;
         default:
-                ret = -EINVAL;
+                return -EINVAL;
                 break;
         }
 
-        return ret;
+        return 0;
 }
 
 static int max8997_muic_handle_charger_type(struct max8997_muic_info *info,
diff --git a/drivers/gpu/drm/drm_fb_cma_helper.c b/drivers/gpu/drm/drm_fb_cma_helper.c
index 09e11a5d921a..fd9d0af4d536 100644
--- a/drivers/gpu/drm/drm_fb_cma_helper.c
+++ b/drivers/gpu/drm/drm_fb_cma_helper.c
@@ -206,7 +206,7 @@ static int drm_fbdev_cma_create(struct drm_fb_helper *helper,
         size_t size;
         int ret;
 
-        DRM_DEBUG_KMS("surface width(%d), height(%d) and bpp(%d\n",
+        DRM_DEBUG_KMS("surface width(%d), height(%d) and bpp(%d)\n",
                         sizes->surface_width, sizes->surface_height,
                         sizes->surface_bpp);
 
@@ -220,7 +220,7 @@ static int drm_fbdev_cma_create(struct drm_fb_helper *helper,
 
         size = mode_cmd.pitches[0] * mode_cmd.height;
         obj = drm_gem_cma_create(dev, size);
-        if (!obj)
+        if (IS_ERR(obj))
                 return -ENOMEM;
 
         fbi = framebuffer_alloc(0, dev->dev);
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index 441ebc1bdbef..d4b20ceda3fb 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -205,8 +205,6 @@ static int drm_gem_one_name_info(int id, void *ptr, void *data)
         struct drm_gem_object *obj = ptr;
         struct seq_file *m = data;
 
-        seq_printf(m, "name %d size %zd\n", obj->name, obj->size);
-
         seq_printf(m, "%6d %8zd %7d %8d\n",
                    obj->name, obj->size,
                    atomic_read(&obj->handle_count),
diff --git a/drivers/gpu/drm/drm_platform.c b/drivers/gpu/drm/drm_platform.c
index aaeb6f8d69ce..b8a282ea8751 100644
--- a/drivers/gpu/drm/drm_platform.c
+++ b/drivers/gpu/drm/drm_platform.c
@@ -64,7 +64,6 @@ int drm_get_platform_dev(struct platform_device *platdev,
         }
 
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                dev_set_drvdata(&platdev->dev, dev);
                 ret = drm_get_minor(dev, &dev->control, DRM_MINOR_CONTROL);
                 if (ret)
                         goto err_g1;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index aac4e5e1a5b9..6770ee6084b4 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -118,6 +118,13 @@ module_param_named(i915_enable_ppgtt, i915_enable_ppgtt, int, 0600);
 MODULE_PARM_DESC(i915_enable_ppgtt,
                 "Enable PPGTT (default: true)");
 
+unsigned int i915_preliminary_hw_support __read_mostly = 0;
+module_param_named(preliminary_hw_support, i915_preliminary_hw_support, int, 0600);
+MODULE_PARM_DESC(preliminary_hw_support,
+                "Enable preliminary hardware support. "
+                "Enable Haswell and ValleyView Support. "
+                "(default: false)");
+
 static struct drm_driver driver;
 extern int intel_agp_enabled;
 
@@ -826,6 +833,12 @@ i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct intel_device_info *intel_info =
                 (struct intel_device_info *) ent->driver_data;
 
+        if (intel_info->is_haswell || intel_info->is_valleyview)
+                if(!i915_preliminary_hw_support) {
+                        DRM_ERROR("Preliminary hardware support disabled\n");
+                        return -ENODEV;
+                }
+
         /* Only bind to function 0 of the device. Early generations
          * used function 1 as a placeholder for multi-head. This causes
          * us confusion instead, especially on the systems where both
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index b84f7861e438..f511fa2f4168 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1217,6 +1217,7 @@ extern int i915_enable_rc6 __read_mostly;
 extern int i915_enable_fbc __read_mostly;
 extern bool i915_enable_hangcheck __read_mostly;
 extern int i915_enable_ppgtt __read_mostly;
+extern unsigned int i915_preliminary_hw_support __read_mostly;
 
 extern int i915_suspend(struct drm_device *dev, pm_message_t state);
 extern int i915_resume(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index d33d02d13c96..107f09befe92 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1407,8 +1407,10 @@ out:
                 return VM_FAULT_NOPAGE;
         case -ENOMEM:
                 return VM_FAULT_OOM;
+        case -ENOSPC:
+                return VM_FAULT_SIGBUS;
         default:
-                WARN_ON_ONCE(ret);
+                WARN_ONCE(ret, "unhandled error in i915_gem_fault: %i\n", ret);
                 return VM_FAULT_SIGBUS;
         }
 }
@@ -1822,10 +1824,11 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                 sg_set_page(sg, page, PAGE_SIZE, 0);
         }
 
+        obj->pages = st;
+
         if (i915_gem_object_needs_bit17_swizzle(obj))
                 i915_gem_object_do_bit_17_swizzle(obj);
 
-        obj->pages = st;
         return 0;
 
 err_pages:
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 893f30164b7e..f78061af7045 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -219,20 +219,7 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
                 intel_encoder_to_crt(to_intel_encoder(encoder));
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         struct drm_i915_private *dev_priv = dev->dev_private;
-        int dpll_md_reg;
-        u32 adpa, dpll_md;
-
-        dpll_md_reg = DPLL_MD(intel_crtc->pipe);
-
-        /*
-         * Disable separate mode multiplier used when cloning SDVO to CRT
-         * XXX this needs to be adjusted when we really are cloning
-         */
-        if (INTEL_INFO(dev)->gen >= 4 && !HAS_PCH_SPLIT(dev)) {
-                dpll_md = I915_READ(dpll_md_reg);
-                I915_WRITE(dpll_md_reg,
-                           dpll_md & ~DPLL_MD_UDI_MULTIPLIER_MASK);
-        }
+        u32 adpa;
 
         adpa = ADPA_HOTPLUG_BITS;
         if (adjusted_mode->flags & DRM_MODE_FLAG_PHSYNC)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 682bd3729baf..461a637f1ef7 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7892,6 +7892,34 @@ struct intel_quirk {
         void (*hook)(struct drm_device *dev);
 };
 
+/* For systems that don't have a meaningful PCI subdevice/subvendor ID */
+struct intel_dmi_quirk {
+        void (*hook)(struct drm_device *dev);
+        const struct dmi_system_id (*dmi_id_list)[];
+};
+
+static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
+{
+        DRM_INFO("Backlight polarity reversed on %s\n", id->ident);
+        return 1;
+}
+
+static const struct intel_dmi_quirk intel_dmi_quirks[] = {
+        {
+                .dmi_id_list = &(const struct dmi_system_id[]) {
+                        {
+                                .callback = intel_dmi_reverse_brightness,
+                                .ident = "NCR Corporation",
+                                .matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
+                                            DMI_MATCH(DMI_PRODUCT_NAME, ""),
+                                },
+                        },
+                        { }  /* terminating entry */
+                },
+                .hook = quirk_invert_brightness,
+        },
+};
+
 static struct intel_quirk intel_quirks[] = {
         /* HP Mini needs pipe A force quirk (LP: #322104) */
         { 0x27ae, 0x103c, 0x361a, quirk_pipea_force },
@@ -7931,6 +7959,10 @@ static void intel_init_quirks(struct drm_device *dev)
                      q->subsystem_device == PCI_ANY_ID))
                         q->hook(dev);
         }
+        for (i = 0; i < ARRAY_SIZE(intel_dmi_quirks); i++) {
+                if (dmi_check_system(*intel_dmi_quirks[i].dmi_id_list) != 0)
+                        intel_dmi_quirks[i].hook(dev);
+        }
 }
 
 /* Disable the VGA plane that we never use */
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 1b727a5c9ee5..368ed8ef1600 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1797,7 +1797,8 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
                         if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
                                 break;
                 if (i == intel_dp->lane_count && voltage_tries == 5) {
-                        if (++loop_tries == 5) {
+                        ++loop_tries;
+                        if (loop_tries == 5) {
                                 DRM_DEBUG_KMS("too many full retries, give up\n");
                                 break;
                         }
@@ -1807,11 +1808,15 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
                 }
 
                 /* Check to see if we've tried the same voltage 5 times */
-                if ((intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK) != voltage) {
-                        voltage = intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK;
-                        voltage_tries = 0;
-                } else
+                if ((intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK) == voltage) {
                         ++voltage_tries;
+                        if (voltage_tries == 5) {
+                                DRM_DEBUG_KMS("too many voltage retries, give up\n");
+                                break;
+                        }
+                } else
+                        voltage_tries = 0;
+                voltage = intel_dp->train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK;
 
                 /* Compute new intel_dp->train_set as requested by target */
                 intel_get_adjust_train(intel_dp, link_status);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index e3166df55daa..edba93b3474b 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -777,6 +777,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
                         DMI_MATCH(DMI_BOARD_NAME, "D525TUD"),
                 },
         },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Supermicro X7SPA-H",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Supermicro"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X7SPA-H"),
+                },
+        },
 
         { }     /* terminating entry */
 };
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 0007a4d9bf6e..c01d97db0061 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -139,6 +139,11 @@ struct intel_sdvo {
 
         /* DDC bus used by this SDVO encoder */
         uint8_t ddc_bus;
+
+        /*
+         * the sdvo flag gets lost in round trip: dtd->adjusted_mode->dtd
+         */
+        uint8_t dtd_sdvo_flags;
 };
 
 struct intel_sdvo_connector {
@@ -984,6 +989,7 @@ intel_sdvo_get_preferred_input_mode(struct intel_sdvo *intel_sdvo,
                 return false;
 
         intel_sdvo_get_mode_from_dtd(adjusted_mode, &input_dtd);
+        intel_sdvo->dtd_sdvo_flags = input_dtd.part2.sdvo_flags;
 
         return true;
 }
@@ -1092,6 +1098,8 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
          * adjusted_mode.
          */
         intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode);
+        if (intel_sdvo->is_tv || intel_sdvo->is_lvds)
+                input_dtd.part2.sdvo_flags = intel_sdvo->dtd_sdvo_flags;
         if (!intel_sdvo_set_input_timing(intel_sdvo, &input_dtd))
                 DRM_INFO("Setting input timings on %s failed\n",
                          SDVO_NAME(intel_sdvo));
@@ -2277,10 +2285,8 @@ intel_sdvo_lvds_init(struct intel_sdvo *intel_sdvo, int device)
                 intel_sdvo_connector->output_flag = SDVO_OUTPUT_LVDS1;
         }
 
-        /* SDVO LVDS is cloneable because the SDVO encoder does the upscaling,
-         * as opposed to native LVDS, where we upscale with the panel-fitter
-         * (and hence only the native LVDS resolution could be cloned). */
-        intel_sdvo->base.cloneable = true;
+        /* SDVO LVDS is not cloneable because the input mode gets adjusted by the encoder */
+        intel_sdvo->base.cloneable = false;
 
         intel_sdvo_connector_init(intel_sdvo_connector, intel_sdvo);
         if (!intel_sdvo_create_enhance_property(intel_sdvo, intel_sdvo_connector))
diff --git a/drivers/gpu/drm/nouveau/core/core/gpuobj.c b/drivers/gpu/drm/nouveau/core/core/gpuobj.c
index 1f34549aff18..70586fde69cf 100644
--- a/drivers/gpu/drm/nouveau/core/core/gpuobj.c
+++ b/drivers/gpu/drm/nouveau/core/core/gpuobj.c
@@ -39,6 +39,11 @@ nouveau_gpuobj_destroy(struct nouveau_gpuobj *gpuobj)
                         nv_wo32(gpuobj, i, 0x00000000);
         }
 
+        if (gpuobj->node) {
+                nouveau_mm_free(&nv_gpuobj(gpuobj->parent)->heap,
+                                &gpuobj->node);
+        }
+
         if (gpuobj->heap.block_size)
                 nouveau_mm_fini(&gpuobj->heap);
 
diff --git a/drivers/gpu/drm/nouveau/core/core/mm.c b/drivers/gpu/drm/nouveau/core/core/mm.c
index bfddf87926dd..4d6206448670 100644
--- a/drivers/gpu/drm/nouveau/core/core/mm.c
+++ b/drivers/gpu/drm/nouveau/core/core/mm.c
@@ -236,7 +236,7 @@ nouveau_mm_fini(struct nouveau_mm *mm)
         int nodes = 0;
 
         list_for_each_entry(node, &mm->nodes, nl_entry) {
-                if (nodes++ == mm->heap_nodes)
+                if (WARN_ON(nodes++ == mm->heap_nodes))
                         return -EBUSY;
         }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
index dcb5c2befc92..70ca7d5a1aa1 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/base.c
@@ -72,7 +72,7 @@ nouveau_bios_shadow_of(struct nouveau_bios *bios)
         }
 
         data = of_get_property(dn, "NVDA,BMP", &size);
-        if (data) {
+        if (data && size) {
                 bios->size = size;
                 bios->data = kmalloc(bios->size, GFP_KERNEL);
                 if (bios->data)
@@ -104,6 +104,9 @@ nouveau_bios_shadow_pramin(struct nouveau_bios *bios)
                 goto out;
 
         bios->size = nv_rd08(bios, 0x700002) * 512;
+        if (!bios->size)
+                goto out;
+
         bios->data = kmalloc(bios->size, GFP_KERNEL);
         if (bios->data) {
                 for (i = 0; i < bios->size; i++)
@@ -155,6 +158,9 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
 
         /* read entire bios image to system memory */
         bios->size = nv_rd08(bios, 0x300002) * 512;
+        if (!bios->size)
+                goto out;
+
         bios->data = kmalloc(bios->size, GFP_KERNEL);
         if (bios->data) {
                 for (i = 0; i < bios->size; i++)
@@ -186,14 +192,22 @@ nouveau_bios_shadow_acpi(struct nouveau_bios *bios)
 {
         struct pci_dev *pdev = nv_device(bios)->pdev;
         int ret, cnt, i;
-        u8  data[3];
 
-        if (!nouveau_acpi_rom_supported(pdev))
+        if (!nouveau_acpi_rom_supported(pdev)) {
+                bios->data = NULL;
                 return;
+        }
 
         bios->size = 0;
-        if (nouveau_acpi_get_bios_chunk(data, 0, 3) == 3)
-                bios->size = data[2] * 512;
+        bios->data = kmalloc(4096, GFP_KERNEL);
+        if (bios->data) {
+                if (nouveau_acpi_get_bios_chunk(bios->data, 0, 4096) == 4096)
+                        bios->size = bios->data[2] * 512;
+                kfree(bios->data);
+        }
+
+        if (!bios->size)
+                return;
 
         bios->data = kmalloc(bios->size, GFP_KERNEL);
         for (i = 0; bios->data && i < bios->size; i += cnt) {
@@ -229,12 +243,14 @@ nouveau_bios_shadow_pci(struct nouveau_bios *bios)
 static int
 nouveau_bios_score(struct nouveau_bios *bios, const bool writeable)
 {
-        if (!bios->data || bios->data[0] != 0x55 || bios->data[1] != 0xAA) {
+        if (bios->size < 3 || !bios->data || bios->data[0] != 0x55 ||
+                        bios->data[1] != 0xAA) {
                 nv_info(bios, "... signature not found\n");
                 return 0;
         }
 
-        if (nvbios_checksum(bios->data, bios->data[2] * 512)) {
+        if (nvbios_checksum(bios->data,
+                        min_t(u32, bios->data[2] * 512, bios->size))) {
                 nv_info(bios, "... checksum invalid\n");
                 /* if a ro image is somewhat bad, it's probably all rubbish */
                 return writeable ? 2 : 1;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/pll.c b/drivers/gpu/drm/nouveau/core/subdev/bios/pll.c
index 5e5f4cddae3c..f835501203e5 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/pll.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/pll.c
@@ -157,11 +157,10 @@ pll_map_reg(struct nouveau_bios *bios, u32 reg, u32 *type, u8 *ver, u8 *len)
         while (map->reg) {
                 if (map->reg == reg && *ver >= 0x20) {
                         u16 addr = (data += hdr);
+                        *type = map->type;
                         while (cnt--) {
-                                if (nv_ro32(bios, data) == map->reg) {
-                                        *type = map->type;
+                                if (nv_ro32(bios, data) == map->reg)
                                         return data;
-                                }
                                 data += *len;
                         }
                         return addr;
@@ -200,11 +199,10 @@ pll_map_type(struct nouveau_bios *bios, u8 type, u32 *reg, u8 *ver, u8 *len)
         while (map->reg) {
                 if (map->type == type && *ver >= 0x20) {
                         u16 addr = (data += hdr);
+                        *reg = map->reg;
                         while (cnt--) {
-                                if (nv_ro32(bios, data) == map->reg) {
-                                        *reg = map->reg;
+                                if (nv_ro32(bios, data) == map->reg)
                                         return data;
-                                }
                                 data += *len;
                         }
                         return addr;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
index 42d7539e6525..27fb1af7a779 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
@@ -237,6 +237,7 @@ nv50_fb_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                         return ret;
 
                 priv->base.ram.stolen = (u64)nv_rd32(priv, 0x100e10) << 12;
+                priv->base.ram.type = NV_MEM_TYPE_STOLEN;
                 break;
         default:
                 ret = nouveau_mm_init(&priv->base.vram, rsvd_head, size,
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c b/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
index 0203e1e12caa..49050d991e75 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/nv41.c
@@ -92,7 +92,8 @@ nv41_vmmgr_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nv04_vmmgr_priv *priv;
         int ret;
 
-        if (!nouveau_boolopt(device->cfgopt, "NvPCIE", true)) {
+        if (pci_find_capability(device->pdev, PCI_CAP_ID_AGP) ||
+            !nouveau_boolopt(device->cfgopt, "NvPCIE", true)) {
                 return nouveau_object_ctor(parent, engine, &nv04_vmmgr_oclass,
                                            data, size, pobject);
         }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/vm/nv44.c
index 0ac18d05a146..aa8131436e3d 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/nv44.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/nv44.c
@@ -163,7 +163,8 @@ nv44_vmmgr_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         struct nv04_vmmgr_priv *priv;
         int ret;
 
-        if (!nouveau_boolopt(device->cfgopt, "NvPCIE", true)) {
+        if (pci_find_capability(device->pdev, PCI_CAP_ID_AGP) ||
+            !nouveau_boolopt(device->cfgopt, "NvPCIE", true)) {
                 return nouveau_object_ctor(parent, engine, &nv04_vmmgr_oclass,
                                            data, size, pobject);
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 8f98e5a8c488..d2f8ffeed742 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -530,9 +530,11 @@ nouveau_page_flip_reserve(struct nouveau_bo *old_bo,
         if (ret)
                 goto fail;
 
-        ret = ttm_bo_reserve(&old_bo->bo, false, false, false, 0);
-        if (ret)
-                goto fail_unreserve;
+        if (likely(old_bo != new_bo)) {
+                ret = ttm_bo_reserve(&old_bo->bo, false, false, false, 0);
+                if (ret)
+                        goto fail_unreserve;
+        }
 
         return 0;
 
@@ -551,8 +553,10 @@ nouveau_page_flip_unreserve(struct nouveau_bo *old_bo,
         nouveau_bo_fence(new_bo, fence);
         ttm_bo_unreserve(&new_bo->bo);
 
-        nouveau_bo_fence(old_bo, fence);
-        ttm_bo_unreserve(&old_bo->bo);
+        if (likely(old_bo != new_bo)) {
+                nouveau_bo_fence(old_bo, fence);
+                ttm_bo_unreserve(&old_bo->bo);
+        }
 
         nouveau_bo_unpin(old_bo);
 }
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 49cbb3795a10..ba498f8e47a2 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -184,6 +184,7 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
         struct radeon_backlight_privdata *pdata;
         struct radeon_encoder_atom_dig *dig;
         u8 backlight_level;
+        char bl_name[16];
 
         if (!radeon_encoder->enc_priv)
                 return;
@@ -203,7 +204,9 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
         memset(&props, 0, sizeof(props));
         props.max_brightness = RADEON_MAX_BL_LEVEL;
         props.type = BACKLIGHT_RAW;
-        bd = backlight_device_register("radeon_bl", &drm_connector->kdev,
+        snprintf(bl_name, sizeof(bl_name),
+                 "radeon_bl%d", dev->primary->index);
+        bd = backlight_device_register(bl_name, &drm_connector->kdev,
                                        pdata, &radeon_atom_backlight_ops, &props);
         if (IS_ERR(bd)) {
                 DRM_ERROR("Backlight registration failed\n");
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 573ed1bc6cf7..30271b641913 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -2829,6 +2829,7 @@ static bool evergreen_vm_reg_valid(u32 reg)
         case CAYMAN_SQ_EX_ALLOC_TABLE_SLOTS:
                 return true;
         default:
+                DRM_ERROR("Invalid register 0x%x in CS\n", reg);
                 return false;
         }
 }
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 8c74c729586d..81e6a568c29d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1538,26 +1538,31 @@ void cayman_vm_set_page(struct radeon_device *rdev, uint64_t pe,
 {
         struct radeon_ring *ring = &rdev->ring[rdev->asic->vm.pt_ring_index];
         uint32_t r600_flags = cayman_vm_page_flags(rdev, flags);
-        int i;
 
-        radeon_ring_write(ring, PACKET3(PACKET3_ME_WRITE, 1 + count * 2));
-        radeon_ring_write(ring, pe);
-        radeon_ring_write(ring, upper_32_bits(pe) & 0xff);
-        for (i = 0; i < count; ++i) {
-                uint64_t value = 0;
-                if (flags & RADEON_VM_PAGE_SYSTEM) {
-                        value = radeon_vm_map_gart(rdev, addr);
-                        value &= 0xFFFFFFFFFFFFF000ULL;
-                        addr += incr;
-
-                } else if (flags & RADEON_VM_PAGE_VALID) {
-                        value = addr;
-                        addr += incr;
-                }
+        while (count) {
+                unsigned ndw = 1 + count * 2;
+                if (ndw > 0x3FFF)
+                        ndw = 0x3FFF;
+
+                radeon_ring_write(ring, PACKET3(PACKET3_ME_WRITE, ndw));
+                radeon_ring_write(ring, pe);
+                radeon_ring_write(ring, upper_32_bits(pe) & 0xff);
+                for (; ndw > 1; ndw -= 2, --count, pe += 8) {
+                        uint64_t value = 0;
+                        if (flags & RADEON_VM_PAGE_SYSTEM) {
+                                value = radeon_vm_map_gart(rdev, addr);
+                                value &= 0xFFFFFFFFFFFFF000ULL;
+                                addr += incr;
+
+                        } else if (flags & RADEON_VM_PAGE_VALID) {
+                                value = addr;
+                                addr += incr;
+                        }
 
-                value |= r600_flags;
-                radeon_ring_write(ring, value);
-                radeon_ring_write(ring, upper_32_bits(value));
+                        value |= r600_flags;
+                        radeon_ring_write(ring, value);
+                        radeon_ring_write(ring, upper_32_bits(value));
+                }
         }
 }
 
@@ -1586,4 +1591,8 @@ void cayman_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
         /* bits 0-7 are the VM contexts0-7 */
         radeon_ring_write(ring, PACKET0(VM_INVALIDATE_REQUEST, 0));
         radeon_ring_write(ring, 1 << vm->id);
+
+        /* sync PFP to ME, otherwise we might get invalid PFP reads */
+        radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
+        radeon_ring_write(ring, 0x0);
 }
diff --git a/drivers/gpu/drm/radeon/nid.h b/drivers/gpu/drm/radeon/nid.h
index 2423d1b5d385..cbef6815907a 100644
--- a/drivers/gpu/drm/radeon/nid.h
+++ b/drivers/gpu/drm/radeon/nid.h
@@ -502,6 +502,7 @@
 #define PACKET3_MPEG_INDEX                              0x3A
 #define PACKET3_WAIT_REG_MEM                            0x3C
 #define PACKET3_MEM_WRITE                               0x3D
+#define PACKET3_PFP_SYNC_ME                             0x42
 #define PACKET3_SURFACE_SYNC                            0x43
 #              define PACKET3_CB0_DEST_BASE_ENA    (1 << 6)
 #              define PACKET3_CB1_DEST_BASE_ENA    (1 << 7)
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 1aa3f910b993..37f6a907aea4 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -87,7 +87,7 @@ static union acpi_object *radeon_atpx_call(acpi_handle handle, int function,
                 atpx_arg_elements[1].integer.value = 0;
         }
 
-        status = acpi_evaluate_object(handle, "ATPX", &atpx_arg, &buffer);
+        status = acpi_evaluate_object(handle, NULL, &atpx_arg, &buffer);
 
         /* Fail only if calling the method fails and ATPX is supported */
         if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
@@ -373,11 +373,11 @@ static int radeon_atpx_power_state(enum vga_switcheroo_client_id id,
 }
 
 /**
- * radeon_atpx_pci_probe_handle - look up the ATRM and ATPX handles
+ * radeon_atpx_pci_probe_handle - look up the ATPX handle
  *
  * @pdev: pci device
  *
- * Look up the ATPX and ATRM handles (all asics).
+ * Look up the ATPX handles (all asics).
  * Returns true if the handles are found, false if not.
  */
 static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index bd13ca09eb62..e2f5f888c374 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -355,6 +355,8 @@ int radeon_wb_init(struct radeon_device *rdev)
  */
 void radeon_vram_location(struct radeon_device *rdev, struct radeon_mc *mc, u64 base)
 {
+        uint64_t limit = (uint64_t)radeon_vram_limit << 20;
+
         mc->vram_start = base;
         if (mc->mc_vram_size > (0xFFFFFFFF - base + 1)) {
                 dev_warn(rdev->dev, "limiting VRAM to PCI aperture size\n");
@@ -368,8 +370,8 @@ void radeon_vram_location(struct radeon_device *rdev, struct radeon_mc *mc, u64
                 mc->mc_vram_size = mc->aper_size;
         }
         mc->vram_end = mc->vram_start + mc->mc_vram_size - 1;
-        if (radeon_vram_limit && radeon_vram_limit < mc->real_vram_size)
-                mc->real_vram_size = radeon_vram_limit;
+        if (limit && limit < mc->real_vram_size)
+                mc->real_vram_size = limit;
         dev_info(rdev->dev, "VRAM: %lluM 0x%016llX - 0x%016llX (%lluM used)\n",
                         mc->mc_vram_size >> 20, mc->vram_start,
                         mc->vram_end, mc->real_vram_size >> 20);
@@ -835,6 +837,19 @@ static unsigned int radeon_vga_set_decode(void *cookie, bool state)
 }
 
 /**
+ * radeon_check_pot_argument - check that argument is a power of two
+ *
+ * @arg: value to check
+ *
+ * Validates that a certain argument is a power of two (all asics).
+ * Returns true if argument is valid.
+ */
+static bool radeon_check_pot_argument(int arg)
+{
+        return (arg & (arg - 1)) == 0;
+}
+
+/**
  * radeon_check_arguments - validate module params
  *
  * @rdev: radeon_device pointer
@@ -845,52 +860,25 @@ static unsigned int radeon_vga_set_decode(void *cookie, bool state)
 static void radeon_check_arguments(struct radeon_device *rdev)
 {
         /* vramlimit must be a power of two */
-        switch (radeon_vram_limit) {
-        case 0:
-        case 4:
-        case 8:
-        case 16:
-        case 32:
-        case 64:
-        case 128:
-        case 256:
-        case 512:
-        case 1024:
-        case 2048:
-        case 4096:
-                break;
-        default:
+        if (!radeon_check_pot_argument(radeon_vram_limit)) {
                 dev_warn(rdev->dev, "vram limit (%d) must be a power of 2\n",
                                 radeon_vram_limit);
                 radeon_vram_limit = 0;
-                break;
         }
-        radeon_vram_limit = radeon_vram_limit << 20;
+
         /* gtt size must be power of two and greater or equal to 32M */
-        switch (radeon_gart_size) {
-        case 4:
-        case 8:
-        case 16:
+        if (radeon_gart_size < 32) {
                 dev_warn(rdev->dev, "gart size (%d) too small forcing to 512M\n",
                                 radeon_gart_size);
                 radeon_gart_size = 512;
-                break;
-        case 32:
-        case 64:
-        case 128:
-        case 256:
-        case 512:
-        case 1024:
-        case 2048:
-        case 4096:
-                break;
-        default:
+
+        } else if (!radeon_check_pot_argument(radeon_gart_size)) {
                 dev_warn(rdev->dev, "gart size (%d) must be a power of 2\n",
                                 radeon_gart_size);
                 radeon_gart_size = 512;
-                break;
         }
-        rdev->mc.gtt_size = radeon_gart_size * 1024 * 1024;
+        rdev->mc.gtt_size = (uint64_t)radeon_gart_size << 20;
+
         /* AGP mode can only be -1, 1, 2, 4, 8 */
         switch (radeon_agpmode) {
         case -1:
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index a7677dd1ce98..4debd60e5aa6 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -355,14 +355,13 @@ int radeon_gart_init(struct radeon_device *rdev)
         DRM_INFO("GART: num cpu pages %u, num gpu pages %u\n",
                  rdev->gart.num_cpu_pages, rdev->gart.num_gpu_pages);
         /* Allocate pages table */
-        rdev->gart.pages = kzalloc(sizeof(void *) * rdev->gart.num_cpu_pages,
-                                   GFP_KERNEL);
+        rdev->gart.pages = vzalloc(sizeof(void *) * rdev->gart.num_cpu_pages);
         if (rdev->gart.pages == NULL) {
                 radeon_gart_fini(rdev);
                 return -ENOMEM;
         }
-        rdev->gart.pages_addr = kzalloc(sizeof(dma_addr_t) *
-                                        rdev->gart.num_cpu_pages, GFP_KERNEL);
+        rdev->gart.pages_addr = vzalloc(sizeof(dma_addr_t) *
+                                        rdev->gart.num_cpu_pages);
         if (rdev->gart.pages_addr == NULL) {
                 radeon_gart_fini(rdev);
                 return -ENOMEM;
@@ -388,8 +387,8 @@ void radeon_gart_fini(struct radeon_device *rdev)
                 radeon_gart_unbind(rdev, 0, rdev->gart.num_cpu_pages);
         }
         rdev->gart.ready = false;
-        kfree(rdev->gart.pages);
-        kfree(rdev->gart.pages_addr);
+        vfree(rdev->gart.pages);
+        vfree(rdev->gart.pages_addr);
         rdev->gart.pages = NULL;
         rdev->gart.pages_addr = NULL;
 
@@ -577,7 +576,7 @@ void radeon_vm_manager_fini(struct radeon_device *rdev)
  *
  * Global and local mutex must be locked!
  */
-int radeon_vm_evict(struct radeon_device *rdev, struct radeon_vm *vm)
+static int radeon_vm_evict(struct radeon_device *rdev, struct radeon_vm *vm)
 {
         struct radeon_vm *vm_evict;
 
@@ -1036,8 +1035,7 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
                 pte = radeon_sa_bo_gpu_addr(vm->page_tables[pt_idx]);
                 pte += (addr & mask) * 8;
 
-                if (((last_pte + 8 * count) != pte) ||
-                    ((count + nptes) > 1 << 11)) {
+                if ((last_pte + 8 * count) != pte) {
 
                         if (count) {
                                 radeon_asic_vm_set_page(rdev, last_pte,
@@ -1148,17 +1146,17 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
 
         if (RADEON_VM_BLOCK_SIZE > 11)
                 /* reserve space for one header for every 2k dwords */
-                ndw += (nptes >> 11) * 3;
+                ndw += (nptes >> 11) * 4;
         else
                 /* reserve space for one header for
                     every (1 << BLOCK_SIZE) entries */
-                ndw += (nptes >> RADEON_VM_BLOCK_SIZE) * 3;
+                ndw += (nptes >> RADEON_VM_BLOCK_SIZE) * 4;
 
         /* reserve space for pte addresses */
         ndw += nptes * 2;
 
         /* reserve space for one header for every 2k dwords */
-        ndw += (npdes >> 11) * 3;
+        ndw += (npdes >> 11) * 4;
 
         /* reserve space for pde addresses */
         ndw += npdes * 2;
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index f38fbcc46935..fe5c1f6b7957 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -53,6 +53,7 @@ int radeon_gem_object_create(struct radeon_device *rdev, int size,
                                 struct drm_gem_object **obj)
 {
         struct radeon_bo *robj;
+        unsigned long max_size;
         int r;
 
         *obj = NULL;
@@ -60,11 +61,26 @@ int radeon_gem_object_create(struct radeon_device *rdev, int size,
         if (alignment < PAGE_SIZE) {
                 alignment = PAGE_SIZE;
         }
+
+        /* maximun bo size is the minimun btw visible vram and gtt size */
+        max_size = min(rdev->mc.visible_vram_size, rdev->mc.gtt_size);
+        if (size > max_size) {
+                printk(KERN_WARNING "%s:%d alloc size %dMb bigger than %ldMb limit\n",
+                       __func__, __LINE__, size >> 20, max_size >> 20);
+                return -ENOMEM;
+        }
+
+retry:
         r = radeon_bo_create(rdev, size, alignment, kernel, initial_domain, NULL, &robj);
         if (r) {
-                if (r != -ERESTARTSYS)
+                if (r != -ERESTARTSYS) {
+                        if (initial_domain == RADEON_GEM_DOMAIN_VRAM) {
+                                initial_domain |= RADEON_GEM_DOMAIN_GTT;
+                                goto retry;
+                        }
                         DRM_ERROR("Failed to allocate GEM object (%d, %d, %u, %d)\n",
                                   size, initial_domain, alignment, r);
+                }
                 return r;
         }
         *obj = &robj->gem_base;
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index a13ad9d707cf..0063df9d166d 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -370,6 +370,7 @@ void radeon_legacy_backlight_init(struct radeon_encoder *radeon_encoder,
         struct backlight_properties props;
         struct radeon_backlight_privdata *pdata;
         uint8_t backlight_level;
+        char bl_name[16];
 
         if (!radeon_encoder->enc_priv)
                 return;
@@ -389,7 +390,9 @@ void radeon_legacy_backlight_init(struct radeon_encoder *radeon_encoder,
         memset(&props, 0, sizeof(props));
         props.max_brightness = RADEON_MAX_BL_LEVEL;
         props.type = BACKLIGHT_RAW;
-        bd = backlight_device_register("radeon_bl", &drm_connector->kdev,
+        snprintf(bl_name, sizeof(bl_name),
+                 "radeon_bl%d", dev->primary->index);
+        bd = backlight_device_register(bl_name, &drm_connector->kdev,
                                        pdata, &radeon_backlight_ops, &props);
         if (IS_ERR(bd)) {
                 DRM_ERROR("Backlight registration failed\n");
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 8b27dd6e3144..b91118ccef86 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -105,7 +105,6 @@ int radeon_bo_create(struct radeon_device *rdev,
         struct radeon_bo *bo;
         enum ttm_bo_type type;
         unsigned long page_align = roundup(byte_align, PAGE_SIZE) >> PAGE_SHIFT;
-        unsigned long max_size = 0;
         size_t acc_size;
         int r;
 
@@ -121,18 +120,9 @@ int radeon_bo_create(struct radeon_device *rdev,
         }
         *bo_ptr = NULL;
 
-        /* maximun bo size is the minimun btw visible vram and gtt size */
-        max_size = min(rdev->mc.visible_vram_size, rdev->mc.gtt_size);
-        if ((page_align << PAGE_SHIFT) >= max_size) {
-                printk(KERN_WARNING "%s:%d alloc size %ldM bigger than %ldMb limit\n",
-                        __func__, __LINE__, page_align  >> (20 - PAGE_SHIFT), max_size >> 20);
-                return -ENOMEM;
-        }
-
         acc_size = ttm_bo_dma_acc_size(&rdev->mman.bdev, size,
                                        sizeof(struct radeon_bo));
 
-retry:
         bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
         if (bo == NULL)
                 return -ENOMEM;
@@ -154,15 +144,6 @@ retry:
                         acc_size, sg, &radeon_ttm_bo_destroy);
         up_read(&rdev->pm.mclk_lock);
         if (unlikely(r != 0)) {
-                if (r != -ERESTARTSYS) {
-                        if (domain == RADEON_GEM_DOMAIN_VRAM) {
-                                domain |= RADEON_GEM_DOMAIN_GTT;
-                                goto retry;
-                        }
-                        dev_err(rdev->dev,
-                                "object_init failed for (%lu, 0x%08X)\n",
-                                size, domain);
-                }
                 return r;
         }
         *bo_ptr = bo;
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index df8dd7701643..b0db712060fb 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2808,26 +2808,31 @@ void si_vm_set_page(struct radeon_device *rdev, uint64_t pe,
 {
         struct radeon_ring *ring = &rdev->ring[rdev->asic->vm.pt_ring_index];
         uint32_t r600_flags = cayman_vm_page_flags(rdev, flags);
-        int i;
-        uint64_t value;
 
-        radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 2 + count * 2));
-        radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
-                                 WRITE_DATA_DST_SEL(1)));
-        radeon_ring_write(ring, pe);
-        radeon_ring_write(ring, upper_32_bits(pe));
-        for (i = 0; i < count; ++i) {
-                if (flags & RADEON_VM_PAGE_SYSTEM) {
-                        value = radeon_vm_map_gart(rdev, addr);
-                        value &= 0xFFFFFFFFFFFFF000ULL;
-                } else if (flags & RADEON_VM_PAGE_VALID)
-                        value = addr;
-                else
-                        value = 0;
-                addr += incr;
-                value |= r600_flags;
-                radeon_ring_write(ring, value);
-                radeon_ring_write(ring, upper_32_bits(value));
+        while (count) {
+                unsigned ndw = 2 + count * 2;
+                if (ndw > 0x3FFE)
+                        ndw = 0x3FFE;
+
+                radeon_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, ndw));
+                radeon_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
+                                         WRITE_DATA_DST_SEL(1)));
+                radeon_ring_write(ring, pe);
+                radeon_ring_write(ring, upper_32_bits(pe));
+                for (; ndw > 2; ndw -= 2, --count, pe += 8) {
+                        uint64_t value;
+                        if (flags & RADEON_VM_PAGE_SYSTEM) {
+                                value = radeon_vm_map_gart(rdev, addr);
+                                value &= 0xFFFFFFFFFFFFF000ULL;
+                        } else if (flags & RADEON_VM_PAGE_VALID)
+                                value = addr;
+                        else
+                                value = 0;
+                        addr += incr;
+                        value |= r600_flags;
+                        radeon_ring_write(ring, value);
+                        radeon_ring_write(ring, upper_32_bits(value));
+                }
         }
 }
 
@@ -2868,6 +2873,10 @@ void si_vm_flush(struct radeon_device *rdev, int ridx, struct radeon_vm *vm)
         radeon_ring_write(ring, VM_INVALIDATE_REQUEST >> 2);
         radeon_ring_write(ring, 0);
         radeon_ring_write(ring, 1 << vm->id);
+
+        /* sync PFP to ME, otherwise we might get invalid PFP reads */
+        radeon_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
+        radeon_ring_write(ring, 0x0);
 }
 
 /*
diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
index c71d493fd0c5..1c350fc4e449 100644
--- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
@@ -201,6 +201,8 @@ static int shmob_drm_load(struct drm_device *dev, unsigned long flags)
                 goto done;
         }
 
+        platform_set_drvdata(pdev, sdev);
+
 done:
         if (ret)
                 shmob_drm_unload(dev);
@@ -299,11 +301,9 @@ static struct drm_driver shmob_drm_driver = {
 #if CONFIG_PM_SLEEP
 static int shmob_drm_pm_suspend(struct device *dev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
-        struct drm_device *ddev = platform_get_drvdata(pdev);
-        struct shmob_drm_device *sdev = ddev->dev_private;
+        struct shmob_drm_device *sdev = dev_get_drvdata(dev);
 
-        drm_kms_helper_poll_disable(ddev);
+        drm_kms_helper_poll_disable(sdev->ddev);
         shmob_drm_crtc_suspend(&sdev->crtc);
 
         return 0;
@@ -311,9 +311,7 @@ static int shmob_drm_pm_suspend(struct device *dev)
 
 static int shmob_drm_pm_resume(struct device *dev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
-        struct drm_device *ddev = platform_get_drvdata(pdev);
-        struct shmob_drm_device *sdev = ddev->dev_private;
+        struct shmob_drm_device *sdev = dev_get_drvdata(dev);
 
         mutex_lock(&sdev->ddev->mode_config.mutex);
         shmob_drm_crtc_resume(&sdev->crtc);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 402ab69f9f99..bf6e4b5a73b5 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -580,6 +580,7 @@ retry:
         if (unlikely(ret != 0))
                 return ret;
 
+retry_reserve:
         spin_lock(&glob->lru_lock);
 
         if (unlikely(list_empty(&bo->ddestroy))) {
@@ -587,14 +588,20 @@ retry:
                 return 0;
         }
 
-        ret = ttm_bo_reserve_locked(bo, interruptible,
-                                    no_wait_reserve, false, 0);
+        ret = ttm_bo_reserve_locked(bo, false, true, false, 0);
 
-        if (unlikely(ret != 0)) {
+        if (unlikely(ret == -EBUSY)) {
                 spin_unlock(&glob->lru_lock);
-                return ret;
+                if (likely(!no_wait_reserve))
+                        ret = ttm_bo_wait_unreserved(bo, interruptible);
+                if (unlikely(ret != 0))
+                        return ret;
+
+                goto retry_reserve;
         }
 
+        BUG_ON(ret != 0);
+
         /**
          * We can re-check for sync object without taking
          * the bo::lock since setting the sync object requires
@@ -811,17 +818,14 @@ retry:
                                           no_wait_reserve, no_wait_gpu);
                 kref_put(&bo->list_kref, ttm_bo_release_list);
 
-                if (likely(ret == 0 || ret == -ERESTARTSYS))
-                        return ret;
-
-                goto retry;
+                return ret;
         }
 
-        ret = ttm_bo_reserve_locked(bo, false, no_wait_reserve, false, 0);
+        ret = ttm_bo_reserve_locked(bo, false, true, false, 0);
 
         if (unlikely(ret == -EBUSY)) {
                 spin_unlock(&glob->lru_lock);
-                if (likely(!no_wait_gpu))
+                if (likely(!no_wait_reserve))
                         ret = ttm_bo_wait_unreserved(bo, interruptible);
 
                 kref_put(&bo->list_kref, ttm_bo_release_list);
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 406537420fff..f4c3d28cd1fc 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -146,14 +146,14 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
 
         if (ret != 0) {
                 err = ret;
-                goto errorout;
+                goto error0;
         }
 
         ret = hv_ringbuffer_init(
                 &newchannel->inbound, in, recv_ringbuffer_size);
         if (ret != 0) {
                 err = ret;
-                goto errorout;
+                goto error0;
         }
 
 
@@ -168,7 +168,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
 
         if (ret != 0) {
                 err = ret;
-                goto errorout;
+                goto error0;
         }
 
         /* Create and init the channel open message */
@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
                            GFP_KERNEL);
         if (!open_info) {
                 err = -ENOMEM;
-                goto errorout;
+                goto error0;
         }
 
         init_completion(&open_info->waitevent);
@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
 
         if (userdatalen > MAX_USER_DEFINED_BYTES) {
                 err = -EINVAL;
-                goto errorout;
+                goto error0;
         }
 
         if (userdatalen)
@@ -208,19 +208,18 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
                                sizeof(struct vmbus_channel_open_channel));
 
         if (ret != 0)
-                goto cleanup;
+                goto error1;
 
         t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ);
         if (t == 0) {
                 err = -ETIMEDOUT;
-                goto errorout;
+                goto error1;
         }
 
 
         if (open_info->response.open_result.status)
                 err = open_info->response.open_result.status;
 
-cleanup:
         spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
         list_del(&open_info->msglistentry);
         spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
@@ -228,9 +227,12 @@ cleanup:
         kfree(open_info);
         return err;
 
-errorout:
-        hv_ringbuffer_cleanup(&newchannel->outbound);
-        hv_ringbuffer_cleanup(&newchannel->inbound);
+error1:
+        spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
+        list_del(&open_info->msglistentry);
+        spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+
+error0:
         free_pages((unsigned long)out,
                 get_order(send_ringbuffer_size + recv_ringbuffer_size));
         kfree(open_info);
diff --git a/drivers/iio/Kconfig b/drivers/iio/Kconfig
index 6e3f143fc71d..fc937aca71fb 100644
--- a/drivers/iio/Kconfig
+++ b/drivers/iio/Kconfig
@@ -62,7 +62,6 @@ source "drivers/iio/frequency/Kconfig"
 source "drivers/iio/dac/Kconfig"
 source "drivers/iio/common/Kconfig"
 source "drivers/iio/gyro/Kconfig"
-source "drivers/iio/light/Kconfig"
 source "drivers/iio/magnetometer/Kconfig"
 
 endif # IIO
diff --git a/drivers/iio/Makefile b/drivers/iio/Makefile
index f7fa3c0867b4..761f2b65ac52 100644
--- a/drivers/iio/Makefile
+++ b/drivers/iio/Makefile
@@ -18,5 +18,4 @@ obj-y += frequency/
 obj-y += dac/
 obj-y += common/
 obj-y += gyro/
-obj-y += light/
 obj-y += magnetometer/
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 57e07c61ace2..afd81790ab3c 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -468,7 +468,7 @@ struct ib_mr *c4iw_register_phys_mem(struct ib_pd *pd,
         ret = alloc_pbl(mhp, npages);
         if (ret) {
                 kfree(page_list);
-                goto err_pbl;
+                goto err;
         }
 
         ret = write_pbl(&mhp->rhp->rdev, page_list, mhp->attr.pbl_addr,
diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c
index d2fb38d43571..2f215b93db6b 100644
--- a/drivers/infiniband/hw/mlx4/alias_GUID.c
+++ b/drivers/infiniband/hw/mlx4/alias_GUID.c
@@ -107,7 +107,7 @@ static __be64 get_cached_alias_guid(struct mlx4_ib_dev *dev, int port, int index
 {
         if (index >= NUM_ALIAS_GUID_PER_PORT) {
                 pr_err("%s: ERROR: asked for index:%d\n", __func__, index);
-                return  (__force __be64) ((u64) 0xFFFFFFFFFFFFFFFFUL);
+                return (__force __be64) -1;
         }
         return *(__be64 *)&dev->sriov.demux[port - 1].guid_cache[index];
 }
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 21a794152d15..0a903c129f0a 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -409,38 +409,45 @@ int mlx4_ib_find_real_gid(struct ib_device *ibdev, u8 port, __be64 guid)
 }
 
 
-static int get_pkey_phys_indices(struct mlx4_ib_dev *ibdev, u8 port, u8 ph_pkey_ix,
-                                 u8 *full_pk_ix, u8 *partial_pk_ix,
-                                 int *is_full_member)
+static int find_slave_port_pkey_ix(struct mlx4_ib_dev *dev, int slave,
+                                   u8 port, u16 pkey, u16 *ix)
 {
-        u16 search_pkey;
-        int fm;
-        int err = 0;
-        u16 pk;
+        int i, ret;
+        u8 unassigned_pkey_ix, pkey_ix, partial_ix = 0xFF;
+        u16 slot_pkey;
 
-        err = ib_get_cached_pkey(&ibdev->ib_dev, port, ph_pkey_ix, &search_pkey);
-        if (err)
-                return err;
+        if (slave == mlx4_master_func_num(dev->dev))
+                return ib_find_cached_pkey(&dev->ib_dev, port, pkey, ix);
 
-        fm = (search_pkey & 0x8000) ? 1 : 0;
-        if (fm) {
-                *full_pk_ix = ph_pkey_ix;
-                search_pkey &= 0x7FFF;
-        } else {
-                *partial_pk_ix = ph_pkey_ix;
-                search_pkey |= 0x8000;
-        }
+        unassigned_pkey_ix = dev->dev->phys_caps.pkey_phys_table_len[port] - 1;
 
-        if (ib_find_exact_cached_pkey(&ibdev->ib_dev, port, search_pkey, &pk))
-                pk = 0xFFFF;
+        for (i = 0; i < dev->dev->caps.pkey_table_len[port]; i++) {
+                if (dev->pkeys.virt2phys_pkey[slave][port - 1][i] == unassigned_pkey_ix)
+                        continue;
 
-        if (fm)
-                *partial_pk_ix = (pk & 0xFF);
-        else
-                *full_pk_ix = (pk & 0xFF);
+                pkey_ix = dev->pkeys.virt2phys_pkey[slave][port - 1][i];
 
-        *is_full_member = fm;
-        return err;
+                ret = ib_get_cached_pkey(&dev->ib_dev, port, pkey_ix, &slot_pkey);
+                if (ret)
+                        continue;
+                if ((slot_pkey & 0x7FFF) == (pkey & 0x7FFF)) {
+                        if (slot_pkey & 0x8000) {
+                                *ix = (u16) pkey_ix;
+                                return 0;
+                        } else {
+                                /* take first partial pkey index found */
+                                if (partial_ix == 0xFF)
+                                        partial_ix = pkey_ix;
+                        }
+                }
+        }
+
+        if (partial_ix < 0xFF) {
+                *ix = (u16) partial_ix;
+                return 0;
+        }
+
+        return -EINVAL;
 }
 
 int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port,
@@ -458,10 +465,8 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port,
         unsigned tun_tx_ix = 0;
         int dqpn;
         int ret = 0;
-        int i;
-        int is_full_member = 0;
         u16 tun_pkey_ix;
-        u8 ph_pkey_ix, full_pk_ix = 0, partial_pk_ix = 0;
+        u16 cached_pkey;
 
         if (dest_qpt > IB_QPT_GSI)
                 return -EINVAL;
@@ -481,27 +486,17 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port,
         else
                 tun_qp = &tun_ctx->qp[1];
 
-        /* compute pkey index for slave */
-        /* get physical pkey -- virtualized Dom0 pkey to phys*/
+        /* compute P_Key index to put in tunnel header for slave */
         if (dest_qpt) {
-                ph_pkey_ix =
-                        dev->pkeys.virt2phys_pkey[mlx4_master_func_num(dev->dev)][port - 1][wc->pkey_index];
-
-                /* now, translate this to the slave pkey index */
-                ret = get_pkey_phys_indices(dev, port, ph_pkey_ix, &full_pk_ix,
-                                            &partial_pk_ix, &is_full_member);
+                u16 pkey_ix;
+                ret = ib_get_cached_pkey(&dev->ib_dev, port, wc->pkey_index, &cached_pkey);
                 if (ret)
                         return -EINVAL;
 
-                for (i = 0; i < dev->dev->caps.pkey_table_len[port]; i++) {
-                        if ((dev->pkeys.virt2phys_pkey[slave][port - 1][i] == full_pk_ix) ||
-                            (is_full_member &&
-                             (dev->pkeys.virt2phys_pkey[slave][port - 1][i] == partial_pk_ix)))
-                                break;
-                }
-                if (i == dev->dev->caps.pkey_table_len[port])
+                ret = find_slave_port_pkey_ix(dev, slave, port, cached_pkey, &pkey_ix);
+                if (ret)
                         return -EINVAL;
-                tun_pkey_ix = i;
+                tun_pkey_ix = pkey_ix;
         } else
                 tun_pkey_ix = dev->pkeys.virt2phys_pkey[slave][port - 1][0];
 
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index 3c3b54c3fdd9..25b2cdff00f8 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -233,7 +233,8 @@ static int send_mad_to_slave(int slave, struct mlx4_ib_demux_ctx *ctx,
 
         ib_query_ah(dev->sm_ah[ctx->port - 1], &ah_attr);
 
-        wc.pkey_index = 0;
+        if (ib_find_cached_pkey(&dev->ib_dev, ctx->port, IB_DEFAULT_PKEY_FULL, &wc.pkey_index))
+                return -EINVAL;
         wc.sl = 0;
         wc.dlid_path_bits = 0;
         wc.port_num = ctx->port;
@@ -1074,10 +1075,6 @@ static void _mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy
         unsigned long end;
         int count;
 
-        if (ctx->flushing)
-                return;
-
-        ctx->flushing = 1;
         for (i = 0; i < MAX_VFS; ++i)
                 clean_vf_mcast(ctx, i);
 
@@ -1107,9 +1104,6 @@ static void _mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy
                 force_clean_group(group);
         }
         mutex_unlock(&ctx->mcg_table_lock);
-
-        if (!destroy_wq)
-                ctx->flushing = 0;
 }
 
 struct clean_work {
@@ -1123,6 +1117,7 @@ static void mcg_clean_task(struct work_struct *work)
         struct clean_work *cw = container_of(work, struct clean_work, work);
 
         _mlx4_ib_mcg_port_cleanup(cw->ctx, cw->destroy_wq);
+        cw->ctx->flushing = 0;
         kfree(cw);
 }
 
@@ -1130,13 +1125,20 @@ void mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy_wq)
 {
         struct clean_work *work;
 
+        if (ctx->flushing)
+                return;
+
+        ctx->flushing = 1;
+
         if (destroy_wq) {
                 _mlx4_ib_mcg_port_cleanup(ctx, destroy_wq);
+                ctx->flushing = 0;
                 return;
         }
 
         work = kmalloc(sizeof *work, GFP_KERNEL);
         if (!work) {
+                ctx->flushing = 0;
                 mcg_warn("failed allocating work for cleanup\n");
                 return;
         }
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 6ae2ac47c9c8..f0f8928b3c8a 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -292,7 +292,6 @@ static int evdev_release(struct inode *inode, struct file *file)
         kfree(client);
 
         evdev_close_device(evdev);
-        put_device(&evdev->dev);
 
         return 0;
 }
@@ -331,7 +330,6 @@ static int evdev_open(struct inode *inode, struct file *file)
         file->private_data = client;
         nonseekable_open(inode, file);
 
-        get_device(&evdev->dev);
         return 0;
 
  err_free_client:
@@ -1001,6 +999,7 @@ static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
                 goto err_free_evdev;
 
         cdev_init(&evdev->cdev, &evdev_fops);
+        evdev->cdev.kobj.parent = &evdev->dev.kobj;
         error = cdev_add(&evdev->cdev, evdev->dev.devt, 1);
         if (error)
                 goto err_unregister_handle;
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index b62b5891f399..f362883c94e3 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -243,7 +243,6 @@ static int joydev_release(struct inode *inode, struct file *file)
         kfree(client);
 
         joydev_close_device(joydev);
-        put_device(&joydev->dev);
 
         return 0;
 }
@@ -270,7 +269,6 @@ static int joydev_open(struct inode *inode, struct file *file)
         file->private_data = client;
         nonseekable_open(inode, file);
 
-        get_device(&joydev->dev);
         return 0;
 
  err_free_client:
@@ -858,6 +856,7 @@ static int joydev_connect(struct input_handler *handler, struct input_dev *dev,
                 goto err_free_joydev;
 
         cdev_init(&joydev->cdev, &joydev_fops);
+        joydev->cdev.kobj.parent = &joydev->dev.kobj;
         error = cdev_add(&joydev->cdev, joydev->dev.devt, 1);
         if (error)
                 goto err_unregister_handle;
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index a1b4c37956b2..8f02e3d0e712 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -523,7 +523,6 @@ static int mousedev_release(struct inode *inode, struct file *file)
         kfree(client);
 
         mousedev_close_device(mousedev);
-        put_device(&mousedev->dev);
 
         return 0;
 }
@@ -558,7 +557,6 @@ static int mousedev_open(struct inode *inode, struct file *file)
         file->private_data = client;
         nonseekable_open(inode, file);
 
-        get_device(&mousedev->dev);
         return 0;
 
  err_free_client:
@@ -892,6 +890,7 @@ static struct mousedev *mousedev_create(struct input_dev *dev,
         }
 
         cdev_init(&mousedev->cdev, &mousedev_fops);
+        mousedev->cdev.kobj.parent = &mousedev->dev.kobj;
         error = cdev_add(&mousedev->cdev, mousedev->dev.devt, 1);
         if (error)
                 goto err_unregister_handle;
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 9edf9806cff9..2c1e12bf2ab4 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -391,7 +391,7 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                                         features->pktlen = WACOM_PKGLEN_TPC2FG;
                                                 }
 
-                                                if (features->type == MTSCREEN)
+                                                if (features->type == MTSCREEN || WACOM_24HDT)
                                                         features->pktlen = WACOM_PKGLEN_MTOUCH;
 
                                                 if (features->type == BAMBOO_PT) {
@@ -402,6 +402,14 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                                         features->x_max =
                                                                 get_unaligned_le16(&report[i + 8]);
                                                         i += 15;
+                                                } else if (features->type == WACOM_24HDT) {
+                                                        features->x_max =
+                                                                get_unaligned_le16(&report[i + 3]);
+                                                        features->x_phy =
+                                                                get_unaligned_le16(&report[i + 8]);
+                                                        features->unit = report[i - 1];
+                                                        features->unitExpo = report[i - 3];
+                                                        i += 12;
                                                 } else {
                                                         features->x_max =
                                                                 get_unaligned_le16(&report[i + 3]);
@@ -434,6 +442,12 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                                         features->y_phy =
                                                                 get_unaligned_le16(&report[i + 6]);
                                                         i += 7;
+                                                } else if (type == WACOM_24HDT) {
+                                                        features->y_max =
+                                                                get_unaligned_le16(&report[i + 3]);
+                                                        features->y_phy =
+                                                                get_unaligned_le16(&report[i - 2]);
+                                                        i += 7;
                                                 } else if (type == BAMBOO_PT) {
                                                         features->y_phy =
                                                                 get_unaligned_le16(&report[i + 3]);
@@ -541,6 +555,9 @@ static int wacom_query_tablet_data(struct usb_interface *intf, struct wacom_feat
                         /* MT Tablet PC touch */
                         return wacom_set_device_mode(intf, 3, 4, 4);
                 }
+                else if (features->type == WACOM_24HDT) {
+                        return wacom_set_device_mode(intf, 18, 3, 2);
+                }
         } else if (features->device_type == BTN_TOOL_PEN) {
                 if (features->type <= BAMBOO_PT && features->type != WIRELESS) {
                         return wacom_set_device_mode(intf, 2, 2, 2);
@@ -613,6 +630,30 @@ struct wacom_usbdev_data {
 static LIST_HEAD(wacom_udev_list);
 static DEFINE_MUTEX(wacom_udev_list_lock);
 
+static struct usb_device *wacom_get_sibling(struct usb_device *dev, int vendor, int product)
+{
+        int port1;
+        struct usb_device *sibling;
+
+        if (vendor == 0 && product == 0)
+                return dev;
+
+        if (dev->parent == NULL)
+                return NULL;
+
+        usb_hub_for_each_child(dev->parent, port1, sibling) {
+                struct usb_device_descriptor *d;
+                if (sibling == NULL)
+                        continue;
+
+                d = &sibling->descriptor;
+                if (d->idVendor == vendor && d->idProduct == product)
+                        return sibling;
+        }
+
+        return NULL;
+}
+
 static struct wacom_usbdev_data *wacom_get_usbdev_data(struct usb_device *dev)
 {
         struct wacom_usbdev_data *data;
@@ -1257,13 +1298,19 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
         strlcpy(wacom_wac->name, features->name, sizeof(wacom_wac->name));
 
         if (features->quirks & WACOM_QUIRK_MULTI_INPUT) {
+                struct usb_device *other_dev;
+
                 /* Append the device type to the name */
                 strlcat(wacom_wac->name,
                         features->device_type == BTN_TOOL_PEN ?
                                 " Pen" : " Finger",
                         sizeof(wacom_wac->name));
 
-                error = wacom_add_shared_data(wacom_wac, dev);
+
+                other_dev = wacom_get_sibling(dev, features->oVid, features->oPid);
+                if (other_dev == NULL || wacom_get_usbdev_data(other_dev) == NULL)
+                        other_dev = dev;
+                error = wacom_add_shared_data(wacom_wac, other_dev);
                 if (error)
                         goto fail3;
         }
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index c3468c8dbd89..aa6010131179 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -806,6 +806,70 @@ static int find_slot_from_contactid(struct wacom_wac *wacom, int contactid)
         return -1;
 }
 
+static int int_dist(int x1, int y1, int x2, int y2)
+{
+        int x = x2 - x1;
+        int y = y2 - y1;
+
+        return int_sqrt(x*x + y*y);
+}
+
+static int wacom_24hdt_irq(struct wacom_wac *wacom)
+{
+        struct input_dev *input = wacom->input;
+        char *data = wacom->data;
+        int i;
+        int current_num_contacts = data[61];
+        int contacts_to_send = 0;
+
+        /*
+         * First packet resets the counter since only the first
+         * packet in series will have non-zero current_num_contacts.
+         */
+        if (current_num_contacts)
+                wacom->num_contacts_left = current_num_contacts;
+
+        /* There are at most 4 contacts per packet */
+        contacts_to_send = min(4, wacom->num_contacts_left);
+
+        for (i = 0; i < contacts_to_send; i++) {
+                int offset = (WACOM_BYTES_PER_24HDT_PACKET * i) + 1;
+                bool touch = data[offset] & 0x1 && !wacom->shared->stylus_in_proximity;
+                int id = data[offset + 1];
+                int slot = find_slot_from_contactid(wacom, id);
+
+                if (slot < 0)
+                        continue;
+                input_mt_slot(input, slot);
+                input_mt_report_slot_state(input, MT_TOOL_FINGER, touch);
+
+                if (touch) {
+                        int t_x = le16_to_cpup((__le16 *)&data[offset + 2]);
+                        int c_x = le16_to_cpup((__le16 *)&data[offset + 4]);
+                        int t_y = le16_to_cpup((__le16 *)&data[offset + 6]);
+                        int c_y = le16_to_cpup((__le16 *)&data[offset + 8]);
+                        int w = le16_to_cpup((__le16 *)&data[offset + 10]);
+                        int h = le16_to_cpup((__le16 *)&data[offset + 12]);
+
+                        input_report_abs(input, ABS_MT_POSITION_X, t_x);
+                        input_report_abs(input, ABS_MT_POSITION_Y, t_y);
+                        input_report_abs(input, ABS_MT_TOUCH_MAJOR, min(w,h));
+                        input_report_abs(input, ABS_MT_WIDTH_MAJOR, min(w, h) + int_dist(t_x, t_y, c_x, c_y));
+                        input_report_abs(input, ABS_MT_WIDTH_MINOR, min(w, h));
+                        input_report_abs(input, ABS_MT_ORIENTATION, w > h);
+                }
+                wacom->slots[slot] = touch ? id : -1;
+        }
+
+        input_mt_report_pointer_emulation(input, true);
+
+        wacom->num_contacts_left -= contacts_to_send;
+        if (wacom->num_contacts_left <= 0)
+                wacom->num_contacts_left = 0;
+
+        return 1;
+}
+
 static int wacom_mt_touch(struct wacom_wac *wacom)
 {
         struct input_dev *input = wacom->input;
@@ -1255,6 +1319,10 @@ void wacom_wac_irq(struct wacom_wac *wacom_wac, size_t len)
                 sync = wacom_intuos_irq(wacom_wac);
                 break;
 
+        case WACOM_24HDT:
+                sync = wacom_24hdt_irq(wacom_wac);
+                break;
+
         case INTUOS5S:
         case INTUOS5:
         case INTUOS5L:
@@ -1340,7 +1408,8 @@ void wacom_setup_device_quirks(struct wacom_features *features)
 
         /* these device have multiple inputs */
         if (features->type >= WIRELESS ||
-            (features->type >= INTUOS5S && features->type <= INTUOS5L))
+            (features->type >= INTUOS5S && features->type <= INTUOS5L) ||
+            (features->oVid && features->oPid))
                 features->quirks |= WACOM_QUIRK_MULTI_INPUT;
 
         /* quirk for bamboo touch with 2 low res touches */
@@ -1575,6 +1644,15 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
                 __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
                 break;
 
+        case WACOM_24HDT:
+                if (features->device_type == BTN_TOOL_FINGER) {
+                        input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR, 0, features->x_max, 0, 0);
+                        input_set_abs_params(input_dev, ABS_MT_WIDTH_MAJOR, 0, features->x_max, 0, 0);
+                        input_set_abs_params(input_dev, ABS_MT_WIDTH_MINOR, 0, features->y_max, 0, 0);
+                        input_set_abs_params(input_dev, ABS_MT_ORIENTATION, 0, 1, 0, 0);
+                }
+                /* fall through */
+
         case MTSCREEN:
                 if (features->device_type == BTN_TOOL_FINGER) {
                         wacom_wac->slots = kmalloc(features->touch_max *
@@ -1869,8 +1947,11 @@ static const struct wacom_features wacom_features_0xF4 =
         { "Wacom Cintiq 24HD",       WACOM_PKGLEN_INTUOS,   104480, 65600, 2047,
           63, WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
 static const struct wacom_features wacom_features_0xF8 =
-        { "Wacom Cintiq 24HD touch", WACOM_PKGLEN_INTUOS,   104480, 65600, 2047,
-          63, WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
+        { "Wacom Cintiq 24HD touch", WACOM_PKGLEN_INTUOS,   104480, 65600, 2047, /* Pen */
+          63, WACOM_24HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, .oVid = USB_VENDOR_ID_WACOM, .oPid = 0xf6 };
+static const struct wacom_features wacom_features_0xF6 =
+        { "Wacom Cintiq 24HD touch", .type = WACOM_24HDT, /* Touch */
+          .oVid = USB_VENDOR_ID_WACOM, .oPid = 0xf8, .touch_max = 10 };
 static const struct wacom_features wacom_features_0x3F =
         { "Wacom Cintiq 21UX",    WACOM_PKGLEN_INTUOS,    87200, 65600, 1023,
           63, CINTIQ, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
@@ -2113,6 +2194,7 @@ const struct usb_device_id wacom_ids[] = {
         { USB_DEVICE_WACOM(0x47) },
         { USB_DEVICE_WACOM(0xF4) },
         { USB_DEVICE_WACOM(0xF8) },
+        { USB_DEVICE_WACOM(0xF6) },
         { USB_DEVICE_WACOM(0xFA) },
         { USB_DEVICE_LENOVO(0x6004) },
         { }
diff --git a/drivers/input/tablet/wacom_wac.h b/drivers/input/tablet/wacom_wac.h
index 96c185cc301e..345f1e76975e 100644
--- a/drivers/input/tablet/wacom_wac.h
+++ b/drivers/input/tablet/wacom_wac.h
@@ -29,6 +29,7 @@
 
 /* wacom data size per MT contact */
 #define WACOM_BYTES_PER_MT_PACKET       11
+#define WACOM_BYTES_PER_24HDT_PACKET    14
 
 /* device IDs */
 #define STYLUS_DEVICE_ID        0x02
@@ -49,6 +50,7 @@
 #define WACOM_REPORT_TPCHID             15
 #define WACOM_REPORT_TPCST              16
 #define WACOM_REPORT_TPC1FGE            18
+#define WACOM_REPORT_24HDT              1
 
 /* device quirks */
 #define WACOM_QUIRK_MULTI_INPUT         0x0001
@@ -81,6 +83,7 @@ enum {
         WACOM_MO,
         WIRELESS,
         BAMBOO_PT,
+        WACOM_24HDT,
         TABLETPC,   /* add new TPC below */
         TABLETPCE,
         TABLETPC2FG,
@@ -109,6 +112,8 @@ struct wacom_features {
         int distance_fuzz;
         unsigned quirks;
         unsigned touch_max;
+        int oVid;
+        int oPid;
 };
 
 struct wacom_shared {
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 18b0d99bd4d6..81837b0710a9 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1599,21 +1599,46 @@ static void __init free_on_init_error(void)
 #endif
 }
 
+/* SB IOAPIC is always on this device in AMD systems */
+#define IOAPIC_SB_DEVID         ((0x00 << 8) | PCI_DEVFN(0x14, 0))
+
 static bool __init check_ioapic_information(void)
 {
+        bool ret, has_sb_ioapic;
         int idx;
 
-        for (idx = 0; idx < nr_ioapics; idx++) {
-                int id = mpc_ioapic_id(idx);
+        has_sb_ioapic = false;
+        ret           = false;
 
-                if (get_ioapic_devid(id) < 0) {
-                        pr_err(FW_BUG "AMD-Vi: IO-APIC[%d] not in IVRS table\n", id);
-                        pr_err("AMD-Vi: Disabling interrupt remapping due to BIOS Bug\n");
-                        return false;
+        for (idx = 0; idx < nr_ioapics; idx++) {
+                int devid, id = mpc_ioapic_id(idx);
+
+                devid = get_ioapic_devid(id);
+                if (devid < 0) {
+                        pr_err(FW_BUG "AMD-Vi: IOAPIC[%d] not in IVRS table\n", id);
+                        ret = false;
+                } else if (devid == IOAPIC_SB_DEVID) {
+                        has_sb_ioapic = true;
+                        ret           = true;
                 }
         }
 
-        return true;
+        if (!has_sb_ioapic) {
+                /*
+                 * We expect the SB IOAPIC to be listed in the IVRS
+                 * table. The system timer is connected to the SB IOAPIC
+                 * and if we don't have it in the list the system will
+                 * panic at boot time.  This situation usually happens
+                 * when the BIOS is buggy and provides us the wrong
+                 * device id for the IOAPIC in the system.
+                 */
+                pr_err(FW_BUG "AMD-Vi: No southbridge IOAPIC found in IVRS table\n");
+        }
+
+        if (!ret)
+                pr_err("AMD-Vi: Disabling interrupt remapping due to BIOS Bug(s)\n");
+
+        return ret;
 }
 
 static void __init free_dma_resources(void)
diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
index 0b4d62e0c645..a649f146d17b 100644
--- a/drivers/iommu/tegra-smmu.c
+++ b/drivers/iommu/tegra-smmu.c
@@ -200,7 +200,7 @@ enum {
 
 #define SMMU_ADDR_TO_PFN(addr)  ((addr) >> 12)
 #define SMMU_ADDR_TO_PDN(addr)  ((addr) >> 22)
-#define SMMU_PDN_TO_ADDR(addr)  ((pdn) << 22)
+#define SMMU_PDN_TO_ADDR(pdn)   ((pdn) << 22)
 
 #define _READABLE       (1 << SMMU_PTB_DATA_ASID_READABLE_SHIFT)
 #define _WRITABLE       (1 << SMMU_PTB_DATA_ASID_WRITABLE_SHIFT)
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 527588708948..c44950d3eb7b 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -617,7 +617,13 @@ static void int_in_work(struct work_struct *work)
         if (rc == 0)
                 /* success, resubmit interrupt read URB */
                 rc = usb_submit_urb(urb, GFP_ATOMIC);
-        if (rc != 0 && rc != -ENODEV) {
+
+        switch (rc) {
+        case 0:         /* success */
+        case -ENODEV:   /* device gone */
+        case -EINVAL:   /* URB already resubmitted, or terminal badness */
+                break;
+        default:        /* failure: try to recover by resetting the device */
                 dev_err(cs->dev, "clear halt failed: %s\n", get_usb_rcmsg(rc));
                 rc = usb_lock_device_for_reset(ucs->udev, ucs->interface);
                 if (rc == 0) {
@@ -2442,7 +2448,9 @@ static void gigaset_disconnect(struct usb_interface *interface)
 }
 
 /* gigaset_suspend
- * This function is called before the USB connection is suspended.
+ * This function is called before the USB connection is suspended
+ * or before the USB device is reset.
+ * In the latter case, message == PMSG_ON.
  */
 static int gigaset_suspend(struct usb_interface *intf, pm_message_t message)
 {
@@ -2498,7 +2506,12 @@ static int gigaset_suspend(struct usb_interface *intf, pm_message_t message)
         del_timer_sync(&ucs->timer_atrdy);
         del_timer_sync(&ucs->timer_cmd_in);
         del_timer_sync(&ucs->timer_int_in);
-        cancel_work_sync(&ucs->int_in_wq);
+
+        /* don't try to cancel int_in_wq from within reset as it
+         * might be the one requesting the reset
+         */
+        if (message.event != PM_EVENT_ON)
+                cancel_work_sync(&ucs->int_in_wq);
 
         gig_dbg(DEBUG_SUSPEND, "suspend complete");
         return 0;
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index c78ecfca1e45..a412bf6d73ef 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -144,9 +144,22 @@
 
 #define FLEXCAN_MB_CODE_MASK            (0xf0ffffff)
 
-/* FLEXCAN hardware feature flags */
+/*
+ * FLEXCAN hardware feature flags
+ *
+ * Below is some version info we got:
+ *    SOC   Version   IP-Version  Glitch-  [TR]WRN_INT
+ *                                Filter?   connected?
+ *   MX25  FlexCAN2  03.00.00.00     no         no
+ *   MX28  FlexCAN2  03.00.04.00    yes        yes
+ *   MX35  FlexCAN2  03.00.00.00     no         no
+ *   MX53  FlexCAN2  03.00.00.00    yes         no
+ *   MX6s  FlexCAN3  10.00.12.00    yes        yes
+ *
+ * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected.
+ */
 #define FLEXCAN_HAS_V10_FEATURES        BIT(1) /* For core version >= 10 */
-#define FLEXCAN_HAS_BROKEN_ERR_STATE    BIT(2) /* Broken error state handling */
+#define FLEXCAN_HAS_BROKEN_ERR_STATE    BIT(2) /* [TR]WRN_INT not connected */
 
 /* Structure of the message buffer */
 struct flexcan_mb {
@@ -205,7 +218,7 @@ static struct flexcan_devtype_data fsl_p1010_devtype_data = {
 };
 static struct flexcan_devtype_data fsl_imx28_devtype_data;
 static struct flexcan_devtype_data fsl_imx6q_devtype_data = {
-        .features = FLEXCAN_HAS_V10_FEATURES | FLEXCAN_HAS_BROKEN_ERR_STATE,
+        .features = FLEXCAN_HAS_V10_FEATURES,
 };
 
 static const struct can_bittiming_const flexcan_bittiming_const = {
diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index f5b82aeb2540..6525dbcca4e3 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -30,9 +30,10 @@
 
 #include "sja1000.h"
 
-MODULE_AUTHOR("Wolfgang Grandegger <wg@grandegger.com>");
+MODULE_AUTHOR("Stephane Grosjean <s.grosjean@peak-system.com>");
 MODULE_DESCRIPTION("Socket-CAN driver for PEAK PCAN PCI family cards");
 MODULE_SUPPORTED_DEVICE("PEAK PCAN PCI/PCIe/PCIeC miniPCI CAN cards");
+MODULE_SUPPORTED_DEVICE("PEAK PCAN miniPCIe/cPCI PC/104+ PCI/104e CAN Cards");
 MODULE_LICENSE("GPL v2");
 
 #define DRV_NAME  "peak_pci"
@@ -64,7 +65,11 @@ struct peak_pci_chan {
 #define PEAK_PCI_DEVICE_ID      0x0001  /* for PCI/PCIe slot cards */
 #define PEAK_PCIEC_DEVICE_ID    0x0002  /* for ExpressCard slot cards */
 #define PEAK_PCIE_DEVICE_ID     0x0003  /* for nextgen PCIe slot cards */
-#define PEAK_MPCI_DEVICE_ID     0x0008  /* The miniPCI slot cards */
+#define PEAK_CPCI_DEVICE_ID     0x0004  /* for nextgen cPCI slot cards */
+#define PEAK_MPCI_DEVICE_ID     0x0005  /* for nextgen miniPCI slot cards */
+#define PEAK_PC_104P_DEVICE_ID  0x0006  /* PCAN-PC/104+ cards */
+#define PEAK_PCI_104E_DEVICE_ID 0x0007  /* PCAN-PCI/104 Express cards */
+#define PEAK_MPCIE_DEVICE_ID    0x0008  /* The miniPCIe slot cards */
 
 #define PEAK_PCI_CHAN_MAX       4
 
@@ -76,6 +81,10 @@ static DEFINE_PCI_DEVICE_TABLE(peak_pci_tbl) = {
         {PEAK_PCI_VENDOR_ID, PEAK_PCI_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
         {PEAK_PCI_VENDOR_ID, PEAK_PCIE_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
         {PEAK_PCI_VENDOR_ID, PEAK_MPCI_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
+        {PEAK_PCI_VENDOR_ID, PEAK_MPCIE_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
+        {PEAK_PCI_VENDOR_ID, PEAK_PC_104P_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
+        {PEAK_PCI_VENDOR_ID, PEAK_PCI_104E_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
+        {PEAK_PCI_VENDOR_ID, PEAK_CPCI_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
 #ifdef CONFIG_CAN_PEAK_PCIEC
         {PEAK_PCI_VENDOR_ID, PEAK_PCIEC_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,},
 #endif
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index a4da893ac1e1..378988b5709a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -251,6 +251,8 @@ struct adapter_params {
         unsigned char rev;                /* chip revision */
         unsigned char offload;
 
+        unsigned char bypass;
+
         unsigned int ofldq_wr_cred;
 };
 
@@ -642,6 +644,23 @@ extern int dbfifo_int_thresh;
 #define for_each_port(adapter, iter) \
         for (iter = 0; iter < (adapter)->params.nports; ++iter)
 
+static inline int is_bypass(struct adapter *adap)
+{
+        return adap->params.bypass;
+}
+
+static inline int is_bypass_device(int device)
+{
+        /* this should be set based upon device capabilities */
+        switch (device) {
+        case 0x440b:
+        case 0x440c:
+                return 1;
+        default:
+                return 0;
+        }
+}
+
 static inline unsigned int core_ticks_per_usec(const struct adapter *adap)
 {
         return adap->params.vpd.cclk / 1000;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 604f4f87f550..c1cde11b0c6d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -3513,18 +3513,6 @@ static int adap_init0_no_config(struct adapter *adapter, int reset)
         if (ret < 0)
                 goto bye;
 
-#ifndef CONFIG_CHELSIO_T4_OFFLOAD
-        /*
-         * If we're a pure NIC driver then disable all offloading facilities.
-         * This will allow the firmware to optimize aspects of the hardware
-         * configuration which will result in improved performance.
-         */
-        caps_cmd.ofldcaps = 0;
-        caps_cmd.iscsicaps = 0;
-        caps_cmd.rdmacaps = 0;
-        caps_cmd.fcoecaps = 0;
-#endif
-
         if (caps_cmd.niccaps & htons(FW_CAPS_CONFIG_NIC_VM)) {
                 if (!vf_acls)
                         caps_cmd.niccaps ^= htons(FW_CAPS_CONFIG_NIC_VM);
@@ -3745,6 +3733,7 @@ static int adap_init0(struct adapter *adap)
         u32 v, port_vec;
         enum dev_state state;
         u32 params[7], val[7];
+        struct fw_caps_config_cmd caps_cmd;
         int reset = 1, j;
 
         /*
@@ -3898,6 +3887,9 @@ static int adap_init0(struct adapter *adap)
                         goto bye;
         }
 
+        if (is_bypass_device(adap->pdev->device))
+                adap->params.bypass = 1;
+
         /*
          * Grab some of our basic fundamental operating parameters.
          */
@@ -3940,13 +3932,12 @@ static int adap_init0(struct adapter *adap)
                 adap->tids.aftid_end = val[1];
         }
 
-#ifdef CONFIG_CHELSIO_T4_OFFLOAD
         /*
          * Get device capabilities so we can determine what resources we need
          * to manage.
          */
         memset(&caps_cmd, 0, sizeof(caps_cmd));
-        caps_cmd.op_to_write = htonl(V_FW_CMD_OP(FW_CAPS_CONFIG_CMD) |
+        caps_cmd.op_to_write = htonl(FW_CMD_OP(FW_CAPS_CONFIG_CMD) |
                                      FW_CMD_REQUEST | FW_CMD_READ);
         caps_cmd.retval_len16 = htonl(FW_LEN16(caps_cmd));
         ret = t4_wr_mbox(adap, adap->mbox, &caps_cmd, sizeof(caps_cmd),
@@ -3991,15 +3982,6 @@ static int adap_init0(struct adapter *adap)
                 adap->vres.ddp.size = val[4] - val[3] + 1;
                 adap->params.ofldq_wr_cred = val[5];
 
-                params[0] = FW_PARAM_PFVF(ETHOFLD_START);
-                params[1] = FW_PARAM_PFVF(ETHOFLD_END);
-                ret = t4_query_params(adap, adap->mbox, adap->fn, 0, 2,
-                                      params, val);
-                if ((val[0] != val[1]) && (ret >= 0)) {
-                        adap->tids.uotid_base = val[0];
-                        adap->tids.nuotids = val[1] - val[0] + 1;
-                }
-
                 adap->params.offload = 1;
         }
         if (caps_cmd.rdmacaps) {
@@ -4048,7 +4030,6 @@ static int adap_init0(struct adapter *adap)
         }
 #undef FW_PARAM_PFVF
 #undef FW_PARAM_DEV
-#endif /* CONFIG_CHELSIO_T4_OFFLOAD */
 
         /*
          * These are finalized by FW initialization, load their values now.
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
index 1b899fea1a91..39bec73ff87c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
@@ -102,6 +102,9 @@ struct tid_info {
         unsigned int ftid_base;
         unsigned int aftid_base;
         unsigned int aftid_end;
+        /* Server filter region */
+        unsigned int sftid_base;
+        unsigned int nsftids;
 
         spinlock_t atid_lock ____cacheline_aligned_in_smp;
         union aopen_entry *afree;
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index b9db0e040563..2e5daee0438a 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -478,7 +478,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
                 pr_err("no resource\n");
                 goto no_resource;
         }
-        if (request_resource(&ioport_resource, etsects->rsrc)) {
+        if (request_resource(&iomem_resource, etsects->rsrc)) {
                 pr_err("resource busy\n");
                 goto no_resource;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index c10e3a6de09f..b35094c590ba 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -143,7 +143,6 @@ void mlx4_en_destroy_tx_ring(struct mlx4_en_priv *priv,
                 mlx4_bf_free(mdev->dev, &ring->bf);
         mlx4_qp_remove(mdev->dev, &ring->qp);
         mlx4_qp_free(mdev->dev, &ring->qp);
-        mlx4_qp_release_range(mdev->dev, ring->qpn, 1);
         mlx4_en_unmap_buffer(&ring->wqres.buf);
         mlx4_free_hwq_res(mdev->dev, &ring->wqres, ring->buf_size);
         kfree(ring->bounce_buf);
@@ -712,7 +711,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         if (bounce)
                 tx_desc = mlx4_en_bounce_to_desc(priv, ring, index, desc_size);
 
-        if (ring->bf_enabled && desc_size <= MAX_BF && !bounce && !vlan_tag) {
+        if (ring->bf_enabled && desc_size <= MAX_BF && !bounce && !vlan_tx_tag_present(skb)) {
                 *(__be32 *) (&tx_desc->ctrl.vlan_tag) |= cpu_to_be32(ring->doorbell_qpn);
                 op_own |= htonl((bf_index & 0xffff) << 8);
                 /* Ensure new descirptor hits memory
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 51c764901ad2..b84a88bc44dc 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -329,9 +329,6 @@ int set_and_calc_slave_port_state(struct mlx4_dev *dev, int slave,
         ctx = &priv->mfunc.master.slave_state[slave];
         spin_lock_irqsave(&ctx->lock, flags);
 
-        mlx4_dbg(dev, "%s: slave: %d, current state: %d new event :%d\n",
-                 __func__, slave, cur_state, event);
-
         switch (cur_state) {
         case SLAVE_PORT_DOWN:
                 if (MLX4_PORT_STATE_DEV_EVENT_PORT_UP == event)
@@ -366,9 +363,6 @@ int set_and_calc_slave_port_state(struct mlx4_dev *dev, int slave,
                         goto out;
         }
         ret = mlx4_get_slave_port_state(dev, slave, port);
-        mlx4_dbg(dev, "%s: slave: %d, current state: %d new event"
-                 " :%d gen_event: %d\n",
-                 __func__, slave, cur_state, event, *gen_event);
 
 out:
         spin_unlock_irqrestore(&ctx->lock, flags);
@@ -843,6 +837,18 @@ static void __iomem *mlx4_get_eq_uar(struct mlx4_dev *dev, struct mlx4_eq *eq)
         return priv->eq_table.uar_map[index] + 0x800 + 8 * (eq->eqn % 4);
 }
 
+static void mlx4_unmap_uar(struct mlx4_dev *dev)
+{
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        int i;
+
+        for (i = 0; i < mlx4_num_eq_uar(dev); ++i)
+                if (priv->eq_table.uar_map[i]) {
+                        iounmap(priv->eq_table.uar_map[i]);
+                        priv->eq_table.uar_map[i] = NULL;
+                }
+}
+
 static int mlx4_create_eq(struct mlx4_dev *dev, int nent,
                           u8 intr, struct mlx4_eq *eq)
 {
@@ -1207,6 +1213,7 @@ err_out_unmap:
         mlx4_free_irqs(dev);
 
 err_out_bitmap:
+        mlx4_unmap_uar(dev);
         mlx4_bitmap_cleanup(&priv->eq_table.bitmap);
 
 err_out_free:
@@ -1231,10 +1238,7 @@ void mlx4_cleanup_eq_table(struct mlx4_dev *dev)
         if (!mlx4_is_slave(dev))
                 mlx4_unmap_clr_int(dev);
 
-        for (i = 0; i < mlx4_num_eq_uar(dev); ++i)
-                if (priv->eq_table.uar_map[i])
-                        iounmap(priv->eq_table.uar_map[i]);
-
+        mlx4_unmap_uar(dev);
         mlx4_bitmap_cleanup(&priv->eq_table.bitmap);
 
         kfree(priv->eq_table.uar_map);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 80df2ab0177c..2aa80afd98d2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1405,7 +1405,10 @@ unmap_bf:
         unmap_bf_area(dev);
 
 err_close:
-        mlx4_close_hca(dev);
+        if (mlx4_is_slave(dev))
+                mlx4_slave_exit(dev);
+        else
+                mlx4_CLOSE_HCA(dev, 0);
 
 err_free_icm:
         if (!mlx4_is_slave(dev))
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 926c911c0ac4..b05705f50f0f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -330,9 +330,6 @@ static void update_pkey_index(struct mlx4_dev *dev, int slave,
 
         new_index = priv->virt2phys_pkey[slave][port - 1][orig_index];
         *(u8 *)(inbox->buf + 35) = new_index;
-
-        mlx4_dbg(dev, "port = %d, orig pkey index = %d, "
-                 "new pkey index = %d\n", port, orig_index, new_index);
 }
 
 static void update_gid(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *inbox,
@@ -351,9 +348,6 @@ static void update_gid(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *inbox,
                 if (optpar & MLX4_QP_OPTPAR_ALT_ADDR_PATH)
                         qp_ctx->alt_path.mgid_index = slave & 0x7F;
         }
-
-        mlx4_dbg(dev, "slave %d, new gid index: 0x%x ",
-                slave, qp_ctx->pri_path.mgid_index);
 }
 
 static int mpt_mask(struct mlx4_dev *dev)
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index b2a94d02a521..4c4fe5b1a29a 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -339,26 +339,6 @@ static void pch_gbe_wait_clr_bit(void *reg, u32 bit)
 }
 
 /**
- * pch_gbe_wait_clr_bit_irq - Wait to clear a bit for interrupt context
- * @reg:        Pointer of register
- * @busy:       Busy bit
- */
-static int pch_gbe_wait_clr_bit_irq(void *reg, u32 bit)
-{
-        u32 tmp;
-        int ret = -1;
-        /* wait busy */
-        tmp = 20;
-        while ((ioread32(reg) & bit) && --tmp)
-                udelay(5);
-        if (!tmp)
-                pr_err("Error: busy bit is not cleared\n");
-        else
-                ret = 0;
-        return ret;
-}
-
-/**
  * pch_gbe_mac_mar_set - Set MAC address register
  * @hw:     Pointer to the HW structure
  * @addr:   Pointer to the MAC address
@@ -409,15 +389,20 @@ static void pch_gbe_mac_reset_hw(struct pch_gbe_hw *hw)
         return;
 }
 
-static void pch_gbe_mac_reset_rx(struct pch_gbe_hw *hw)
+static void pch_gbe_disable_mac_rx(struct pch_gbe_hw *hw)
 {
-        /* Read the MAC addresses. and store to the private data */
-        pch_gbe_mac_read_mac_addr(hw);
-        iowrite32(PCH_GBE_RX_RST, &hw->reg->RESET);
-        pch_gbe_wait_clr_bit_irq(&hw->reg->RESET, PCH_GBE_RX_RST);
-        /* Setup the MAC addresses */
-        pch_gbe_mac_mar_set(hw, hw->mac.addr, 0);
-        return;
+        u32 rctl;
+        /* Disables Receive MAC */
+        rctl = ioread32(&hw->reg->MAC_RX_EN);
+        iowrite32((rctl & ~PCH_GBE_MRE_MAC_RX_EN), &hw->reg->MAC_RX_EN);
+}
+
+static void pch_gbe_enable_mac_rx(struct pch_gbe_hw *hw)
+{
+        u32 rctl;
+        /* Enables Receive MAC */
+        rctl = ioread32(&hw->reg->MAC_RX_EN);
+        iowrite32((rctl | PCH_GBE_MRE_MAC_RX_EN), &hw->reg->MAC_RX_EN);
 }
 
 /**
@@ -913,7 +898,7 @@ static void pch_gbe_setup_rctl(struct pch_gbe_adapter *adapter)
 static void pch_gbe_configure_rx(struct pch_gbe_adapter *adapter)
 {
         struct pch_gbe_hw *hw = &adapter->hw;
-        u32 rdba, rdlen, rctl, rxdma;
+        u32 rdba, rdlen, rxdma;
 
         pr_debug("dma adr = 0x%08llx  size = 0x%08x\n",
                  (unsigned long long)adapter->rx_ring->dma,
@@ -921,9 +906,7 @@ static void pch_gbe_configure_rx(struct pch_gbe_adapter *adapter)
 
         pch_gbe_mac_force_mac_fc(hw);
 
-        /* Disables Receive MAC */
-        rctl = ioread32(&hw->reg->MAC_RX_EN);
-        iowrite32((rctl & ~PCH_GBE_MRE_MAC_RX_EN), &hw->reg->MAC_RX_EN);
+        pch_gbe_disable_mac_rx(hw);
 
         /* Disables Receive DMA */
         rxdma = ioread32(&hw->reg->DMA_CTRL);
@@ -1316,38 +1299,17 @@ void pch_gbe_update_stats(struct pch_gbe_adapter *adapter)
         spin_unlock_irqrestore(&adapter->stats_lock, flags);
 }
 
-static void pch_gbe_stop_receive(struct pch_gbe_adapter *adapter)
+static void pch_gbe_disable_dma_rx(struct pch_gbe_hw *hw)
 {
-        struct pch_gbe_hw *hw = &adapter->hw;
         u32 rxdma;
-        u16 value;
-        int ret;
 
         /* Disable Receive DMA */
         rxdma = ioread32(&hw->reg->DMA_CTRL);
         rxdma &= ~PCH_GBE_RX_DMA_EN;
         iowrite32(rxdma, &hw->reg->DMA_CTRL);
-        /* Wait Rx DMA BUS is IDLE */
-        ret = pch_gbe_wait_clr_bit_irq(&hw->reg->RX_DMA_ST, PCH_GBE_IDLE_CHECK);
-        if (ret) {
-                /* Disable Bus master */
-                pci_read_config_word(adapter->pdev, PCI_COMMAND, &value);
-                value &= ~PCI_COMMAND_MASTER;
-                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
-                /* Stop Receive */
-                pch_gbe_mac_reset_rx(hw);
-                /* Enable Bus master */
-                value |= PCI_COMMAND_MASTER;
-                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
-        } else {
-                /* Stop Receive */
-                pch_gbe_mac_reset_rx(hw);
-        }
-        /* reprogram multicast address register after reset */
-        pch_gbe_set_multi(adapter->netdev);
 }
 
-static void pch_gbe_start_receive(struct pch_gbe_hw *hw)
+static void pch_gbe_enable_dma_rx(struct pch_gbe_hw *hw)
 {
         u32 rxdma;
 
@@ -1355,9 +1317,6 @@ static void pch_gbe_start_receive(struct pch_gbe_hw *hw)
         rxdma = ioread32(&hw->reg->DMA_CTRL);
         rxdma |= PCH_GBE_RX_DMA_EN;
         iowrite32(rxdma, &hw->reg->DMA_CTRL);
-        /* Enables Receive */
-        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
-        return;
 }
 
 /**
@@ -1393,7 +1352,7 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
                         int_en = ioread32(&hw->reg->INT_EN);
                         iowrite32((int_en & ~PCH_GBE_INT_RX_FIFO_ERR),
                                   &hw->reg->INT_EN);
-                        pch_gbe_stop_receive(adapter);
+                        pch_gbe_disable_dma_rx(&adapter->hw);
                         int_st |= ioread32(&hw->reg->INT_ST);
                         int_st = int_st & ioread32(&hw->reg->INT_EN);
                 }
@@ -1971,12 +1930,12 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
         struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
         struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
-        int err;
+        int err = -EINVAL;
 
         /* Ensure we have a valid MAC */
         if (!is_valid_ether_addr(adapter->hw.mac.addr)) {
                 pr_err("Error: Invalid MAC address\n");
-                return -EINVAL;
+                goto out;
         }
 
         /* hardware has been reset, we need to reload some things */
@@ -1989,18 +1948,19 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
 
         err = pch_gbe_request_irq(adapter);
         if (err) {
-                pr_err("Error: can't bring device up\n");
-                return err;
+                pr_err("Error: can't bring device up - irq request failed\n");
+                goto out;
         }
         err = pch_gbe_alloc_rx_buffers_pool(adapter, rx_ring, rx_ring->count);
         if (err) {
-                pr_err("Error: can't bring device up\n");
-                return err;
+                pr_err("Error: can't bring device up - alloc rx buffers pool failed\n");
+                goto freeirq;
         }
         pch_gbe_alloc_tx_buffers(adapter, tx_ring);
         pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);
         adapter->tx_queue_len = netdev->tx_queue_len;
-        pch_gbe_start_receive(&adapter->hw);
+        pch_gbe_enable_dma_rx(&adapter->hw);
+        pch_gbe_enable_mac_rx(&adapter->hw);
 
         mod_timer(&adapter->watchdog_timer, jiffies);
 
@@ -2009,6 +1969,11 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
         netif_start_queue(adapter->netdev);
 
         return 0;
+
+freeirq:
+        pch_gbe_free_irq(adapter);
+out:
+        return err;
 }
 
 /**
@@ -2405,7 +2370,6 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
         int work_done = 0;
         bool poll_end_flag = false;
         bool cleaned = false;
-        u32 int_en;
 
         pr_debug("budget : %d\n", budget);
 
@@ -2422,19 +2386,13 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
 
         if (poll_end_flag) {
                 napi_complete(napi);
-                if (adapter->rx_stop_flag) {
-                        adapter->rx_stop_flag = false;
-                        pch_gbe_start_receive(&adapter->hw);
-                }
                 pch_gbe_irq_enable(adapter);
-        } else
-                if (adapter->rx_stop_flag) {
-                        adapter->rx_stop_flag = false;
-                        pch_gbe_start_receive(&adapter->hw);
-                        int_en = ioread32(&adapter->hw.reg->INT_EN);
-                        iowrite32((int_en | PCH_GBE_INT_RX_FIFO_ERR),
-                                &adapter->hw.reg->INT_EN);
-                }
+        }
+
+        if (adapter->rx_stop_flag) {
+                adapter->rx_stop_flag = false;
+                pch_gbe_enable_dma_rx(&adapter->hw);
+        }
 
         pr_debug("poll_end_flag : %d  work_done : %d  budget : %d\n",
                  poll_end_flag, work_done, budget);
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index df09b1cb742f..6407d0d77e81 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -2525,6 +2525,13 @@ static int ql_alloc_net_req_rsp_queues(struct ql3_adapter *qdev)
         qdev->req_q_size =
             (u32) (NUM_REQ_Q_ENTRIES * sizeof(struct ob_mac_iocb_req));
 
+        qdev->rsp_q_size = NUM_RSP_Q_ENTRIES * sizeof(struct net_rsp_iocb);
+
+        /* The barrier is required to ensure request and response queue
+         * addr writes to the registers.
+         */
+        wmb();
+
         qdev->req_q_virt_addr =
             pci_alloc_consistent(qdev->pdev,
                                  (size_t) qdev->req_q_size,
@@ -2536,8 +2543,6 @@ static int ql_alloc_net_req_rsp_queues(struct ql3_adapter *qdev)
                 return -ENOMEM;
         }
 
-        qdev->rsp_q_size = NUM_RSP_Q_ENTRIES * sizeof(struct net_rsp_iocb);
-
         qdev->rsp_q_virt_addr =
             pci_alloc_consistent(qdev->pdev,
                                  (size_t) qdev->rsp_q_size,
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index b26cbda5efa9..2c41894d5472 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -5,7 +5,7 @@
 config NET_VENDOR_TI
         bool "Texas Instruments (TI) devices"
         default y
-        depends on PCI || EISA || AR7 || (ARM && (ARCH_DAVINCI || ARCH_OMAP3))
+        depends on PCI || EISA || AR7 || (ARM && (ARCH_DAVINCI || ARCH_OMAP3 || SOC_AM33XX))
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
           and read the Ethernet-HOWTO, available from
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 4e2a1628484d..4e9810013850 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -1334,11 +1334,11 @@ static int tso_count_edescs(struct sk_buff *skb)
 {
         struct skb_shared_info *sh = skb_shinfo(skb);
         unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
-        unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
+        unsigned int data_len = skb->len - sh_len;
         unsigned int p_len = sh->gso_size;
         long f_id = -1;    /* id of the current fragment */
-        long f_size = skb->hdr_len;  /* size of the current fragment */
-        long f_used = sh_len;  /* bytes used from the current fragment */
+        long f_size = skb_headlen(skb) - sh_len;  /* current fragment size */
+        long f_used = 0;  /* bytes used from the current fragment */
         long n;            /* size of the current piece of payload */
         int num_edescs = 0;
         int segment;
@@ -1353,7 +1353,7 @@ static int tso_count_edescs(struct sk_buff *skb)
                         /* Advance as needed. */
                         while (f_used >= f_size) {
                                 f_id++;
-                                f_size = sh->frags[f_id].size;
+                                f_size = skb_frag_size(&sh->frags[f_id]);
                                 f_used = 0;
                         }
 
@@ -1384,13 +1384,13 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
         struct iphdr *ih;
         struct tcphdr *th;
         unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
-        unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
+        unsigned int data_len = skb->len - sh_len;
         unsigned char *data = skb->data;
         unsigned int ih_off, th_off, p_len;
         unsigned int isum_seed, tsum_seed, id, seq;
         long f_id = -1;    /* id of the current fragment */
-        long f_size = skb->hdr_len;  /* size of the current fragment */
-        long f_used = sh_len;  /* bytes used from the current fragment */
+        long f_size = skb_headlen(skb) - sh_len;  /* current fragment size */
+        long f_used = 0;  /* bytes used from the current fragment */
         long n;            /* size of the current piece of payload */
         int segment;
 
@@ -1405,7 +1405,7 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
         isum_seed = ((0xFFFF - ih->check) +
                      (0xFFFF - ih->tot_len) +
                      (0xFFFF - ih->id));
-        tsum_seed = th->check + (0xFFFF ^ htons(sh_len + data_len));
+        tsum_seed = th->check + (0xFFFF ^ htons(skb->len));
         id = ntohs(ih->id);
         seq = ntohl(th->seq);
 
@@ -1444,7 +1444,7 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
                         /* Advance as needed. */
                         while (f_used >= f_size) {
                                 f_id++;
-                                f_size = sh->frags[f_id].size;
+                                f_size = skb_frag_size(&sh->frags[f_id]);
                                 f_used = 0;
                         }
 
@@ -1478,14 +1478,14 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
         struct tile_net_priv *priv = netdev_priv(dev);
         struct skb_shared_info *sh = skb_shinfo(skb);
         unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
-        unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
+        unsigned int data_len = skb->len - sh_len;
         unsigned int p_len = sh->gso_size;
         gxio_mpipe_edesc_t edesc_head = { { 0 } };
         gxio_mpipe_edesc_t edesc_body = { { 0 } };
         long f_id = -1;    /* id of the current fragment */
-        long f_size = skb->hdr_len;  /* size of the current fragment */
-        long f_used = sh_len;  /* bytes used from the current fragment */
-        void *f_data = skb->data;
+        long f_size = skb_headlen(skb) - sh_len;  /* current fragment size */
+        long f_used = 0;  /* bytes used from the current fragment */
+        void *f_data = skb->data + sh_len;
         long n;            /* size of the current piece of payload */
         unsigned long tx_packets = 0, tx_bytes = 0;
         unsigned int csum_start;
@@ -1516,15 +1516,18 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
 
                 /* Egress the payload. */
                 while (p_used < p_len) {
+                        void *va;
 
                         /* Advance as needed. */
                         while (f_used >= f_size) {
                                 f_id++;
-                                f_size = sh->frags[f_id].size;
-                                f_used = 0;
+                                f_size = skb_frag_size(&sh->frags[f_id]);
                                 f_data = tile_net_frag_buf(&sh->frags[f_id]);
+                                f_used = 0;
                         }
 
+                        va = f_data + f_used;
+
                         /* Use bytes from the current fragment. */
                         n = p_len - p_used;
                         if (n > f_size - f_used)
@@ -1533,7 +1536,7 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
                         p_used += n;
 
                         /* Egress a piece of the payload. */
-                        edesc_body.va = va_to_tile_io_addr(f_data) + f_used;
+                        edesc_body.va = va_to_tile_io_addr(va);
                         edesc_body.xfer_size = n;
                         edesc_body.bound = !(p_used < p_len);
                         gxio_mpipe_equeue_put_at(equeue, edesc_body, slot);
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 983bbf4d5ef6..961f0b293913 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -15,6 +15,11 @@ if PHYLIB
 
 comment "MII PHY device drivers"
 
+config AT803X_PHY
+        tristate "Drivers for Atheros AT803X PHYs"
+        ---help---
+          Currently supports the AT8030 and AT8035 model
+
 config AMD_PHY
         tristate "Drivers for the AMD PHYs"
         ---help---
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 426674debae4..9645e389a58d 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -25,6 +25,7 @@ obj-$(CONFIG_STE10XP)		+= ste10Xp.o
 obj-$(CONFIG_MICREL_PHY)        += micrel.o
 obj-$(CONFIG_MDIO_OCTEON)       += mdio-octeon.o
 obj-$(CONFIG_MICREL_KS8995MA)   += spi_ks8995.o
+obj-$(CONFIG_AT803X_PHY)        += at803x.o
 obj-$(CONFIG_AMD_PHY)           += amd.o
 obj-$(CONFIG_MDIO_BUS_MUX)      += mdio-mux.o
 obj-$(CONFIG_MDIO_BUS_MUX_GPIO) += mdio-mux-gpio.o
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
new file mode 100644
index 000000000000..45cbc10de01c
--- /dev/null
+++ b/drivers/net/phy/at803x.c
@@ -0,0 +1,176 @@
+/*
+ * drivers/net/phy/at803x.c
+ *
+ * Driver for Atheros 803x PHY
+ *
+ * Author: Matus Ujhelyi <ujhelyi.m@gmail.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/phy.h>
+#include <linux/module.h>
+#include <linux/string.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+
+#define AT803X_INTR_ENABLE                      0x12
+#define AT803X_INTR_STATUS                      0x13
+#define AT803X_WOL_ENABLE                       0x01
+#define AT803X_DEVICE_ADDR                      0x03
+#define AT803X_LOC_MAC_ADDR_0_15_OFFSET         0x804C
+#define AT803X_LOC_MAC_ADDR_16_31_OFFSET        0x804B
+#define AT803X_LOC_MAC_ADDR_32_47_OFFSET        0x804A
+#define AT803X_MMD_ACCESS_CONTROL               0x0D
+#define AT803X_MMD_ACCESS_CONTROL_DATA          0x0E
+#define AT803X_FUNC_DATA                        0x4003
+
+MODULE_DESCRIPTION("Atheros 803x PHY driver");
+MODULE_AUTHOR("Matus Ujhelyi");
+MODULE_LICENSE("GPL");
+
+static void at803x_set_wol_mac_addr(struct phy_device *phydev)
+{
+        struct net_device *ndev = phydev->attached_dev;
+        const u8 *mac;
+        unsigned int i, offsets[] = {
+                AT803X_LOC_MAC_ADDR_32_47_OFFSET,
+                AT803X_LOC_MAC_ADDR_16_31_OFFSET,
+                AT803X_LOC_MAC_ADDR_0_15_OFFSET,
+        };
+
+        if (!ndev)
+                return;
+
+        mac = (const u8 *) ndev->dev_addr;
+
+        if (!is_valid_ether_addr(mac))
+                return;
+
+        for (i = 0; i < 3; i++) {
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL,
+                                  AT803X_DEVICE_ADDR);
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL_DATA,
+                                  offsets[i]);
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL,
+                                  AT803X_FUNC_DATA);
+                phy_write(phydev, AT803X_MMD_ACCESS_CONTROL_DATA,
+                                  mac[(i * 2) + 1] | (mac[(i * 2)] << 8));
+        }
+}
+
+static int at803x_config_init(struct phy_device *phydev)
+{
+        int val;
+        u32 features;
+        int status;
+
+        features = SUPPORTED_TP | SUPPORTED_MII | SUPPORTED_AUI |
+                   SUPPORTED_FIBRE | SUPPORTED_BNC;
+
+        val = phy_read(phydev, MII_BMSR);
+        if (val < 0)
+                return val;
+
+        if (val & BMSR_ANEGCAPABLE)
+                features |= SUPPORTED_Autoneg;
+        if (val & BMSR_100FULL)
+                features |= SUPPORTED_100baseT_Full;
+        if (val & BMSR_100HALF)
+                features |= SUPPORTED_100baseT_Half;
+        if (val & BMSR_10FULL)
+                features |= SUPPORTED_10baseT_Full;
+        if (val & BMSR_10HALF)
+                features |= SUPPORTED_10baseT_Half;
+
+        if (val & BMSR_ESTATEN) {
+                val = phy_read(phydev, MII_ESTATUS);
+                if (val < 0)
+                        return val;
+
+                if (val & ESTATUS_1000_TFULL)
+                        features |= SUPPORTED_1000baseT_Full;
+                if (val & ESTATUS_1000_THALF)
+                        features |= SUPPORTED_1000baseT_Half;
+        }
+
+        phydev->supported = features;
+        phydev->advertising = features;
+
+        /* enable WOL */
+        at803x_set_wol_mac_addr(phydev);
+        status = phy_write(phydev, AT803X_INTR_ENABLE, AT803X_WOL_ENABLE);
+        status = phy_read(phydev, AT803X_INTR_STATUS);
+
+        return 0;
+}
+
+/* ATHEROS 8035 */
+static struct phy_driver at8035_driver = {
+        .phy_id         = 0x004dd072,
+        .name           = "Atheros 8035 ethernet",
+        .phy_id_mask    = 0xffffffef,
+        .config_init    = at803x_config_init,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .driver         = {
+                .owner = THIS_MODULE,
+        },
+};
+
+/* ATHEROS 8030 */
+static struct phy_driver at8030_driver = {
+        .phy_id         = 0x004dd076,
+        .name           = "Atheros 8030 ethernet",
+        .phy_id_mask    = 0xffffffef,
+        .config_init    = at803x_config_init,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .driver         = {
+                .owner = THIS_MODULE,
+        },
+};
+
+static int __init atheros_init(void)
+{
+        int ret;
+
+        ret = phy_driver_register(&at8035_driver);
+        if (ret)
+                goto err1;
+
+        ret = phy_driver_register(&at8030_driver);
+        if (ret)
+                goto err2;
+
+        return 0;
+
+err2:
+        phy_driver_unregister(&at8035_driver);
+err1:
+        return ret;
+}
+
+static void __exit atheros_exit(void)
+{
+        phy_driver_unregister(&at8035_driver);
+        phy_driver_unregister(&at8030_driver);
+}
+
+module_init(atheros_init);
+module_exit(atheros_exit);
+
+static struct mdio_device_id __maybe_unused atheros_tbl[] = {
+        { 0x004dd076, 0xffffffef },
+        { 0x004dd072, 0xffffffef },
+        { }
+};
+
+MODULE_DEVICE_TABLE(mdio, atheros_tbl);
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index a03de7197049..d0129827602b 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -592,6 +592,32 @@ static const struct usb_device_id	products [] = {
         .driver_info            = 0,
 },
 
+/* Novatel USB551L and MC551 - handled by qmi_wwan */
+{
+        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+                 | USB_DEVICE_ID_MATCH_PRODUCT
+                 | USB_DEVICE_ID_MATCH_INT_INFO,
+        .idVendor               = NOVATEL_VENDOR_ID,
+        .idProduct              = 0xB001,
+        .bInterfaceClass        = USB_CLASS_COMM,
+        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
+        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        .driver_info = 0,
+},
+
+/* Novatel E362 - handled by qmi_wwan */
+{
+        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+                 | USB_DEVICE_ID_MATCH_PRODUCT
+                 | USB_DEVICE_ID_MATCH_INT_INFO,
+        .idVendor               = NOVATEL_VENDOR_ID,
+        .idProduct              = 0x9010,
+        .bInterfaceClass        = USB_CLASS_COMM,
+        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
+        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
+        .driver_info = 0,
+},
+
 /*
  * WHITELIST!!!
  *
@@ -604,21 +630,6 @@ static const struct usb_device_id	products [] = {
  * because of bugs/quirks in a given product (like Zaurus, above).
  */
 {
-        /* Novatel USB551L */
-        /* This match must come *before* the generic CDC-ETHER match so that
-         * we get FLAG_WWAN set on the device, since it's descriptors are
-         * generic CDC-ETHER.
-         */
-        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
-                 | USB_DEVICE_ID_MATCH_PRODUCT
-                 | USB_DEVICE_ID_MATCH_INT_INFO,
-        .idVendor               = NOVATEL_VENDOR_ID,
-        .idProduct              = 0xB001,
-        .bInterfaceClass        = USB_CLASS_COMM,
-        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol     = USB_CDC_PROTO_NONE,
-        .driver_info = (unsigned long)&wwan_info,
-}, {
         /* ZTE (Vodafone) K3805-Z */
         .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
                  | USB_DEVICE_ID_MATCH_PRODUCT
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index a28a983d465e..534d8becbbdc 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -62,6 +62,7 @@
 #define USB_PRODUCT_IPAD 0x129a
 #define USB_PRODUCT_IPHONE_4_VZW 0x129c
 #define USB_PRODUCT_IPHONE_4S   0x12a0
+#define USB_PRODUCT_IPHONE_5    0x12a8
 
 #define IPHETH_USBINTF_CLASS    255
 #define IPHETH_USBINTF_SUBCLASS 253
@@ -113,6 +114,10 @@ static struct usb_device_id ipheth_table[] = {
                 USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4S,
                 IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                 IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_5,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
         { }
 };
 MODULE_DEVICE_TABLE(usb, ipheth_table);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 6883c371c59f..3b566fa0f8e6 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -369,18 +369,73 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf1, 0xff),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* Novatel USB551L and MC551 */
+                USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0xb001,
+                                              USB_CLASS_COMM,
+                                              USB_CDC_SUBCLASS_ETHERNET,
+                                              USB_CDC_PROTO_NONE),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
+        {       /* Novatel E362 */
+                USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0x9010,
+                                              USB_CLASS_COMM,
+                                              USB_CDC_SUBCLASS_ETHERNET,
+                                              USB_CDC_PROTO_NONE),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
 
         /* 3. Combined interface devices matching on interface number */
+        {QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0021, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0025, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0031, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0042, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0049, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0052, 4)},
         {QMI_FIXED_INTF(0x19d2, 0x0055, 1)},    /* ZTE (Vodafone) K3520-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0058, 4)},
         {QMI_FIXED_INTF(0x19d2, 0x0063, 4)},    /* ZTE (Vodafone) K3565-Z */
         {QMI_FIXED_INTF(0x19d2, 0x0104, 4)},    /* ZTE (Vodafone) K4505-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0113, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0118, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0121, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0123, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0124, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0125, 6)},
+        {QMI_FIXED_INTF(0x19d2, 0x0126, 5)},
+        {QMI_FIXED_INTF(0x19d2, 0x0130, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0133, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0141, 5)},
         {QMI_FIXED_INTF(0x19d2, 0x0157, 5)},    /* ZTE MF683 */
+        {QMI_FIXED_INTF(0x19d2, 0x0158, 3)},
         {QMI_FIXED_INTF(0x19d2, 0x0167, 4)},    /* ZTE MF820D */
+        {QMI_FIXED_INTF(0x19d2, 0x0168, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x0176, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0178, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x0191, 4)},    /* ZTE EuFi890 */
+        {QMI_FIXED_INTF(0x19d2, 0x0199, 1)},    /* ZTE MF820S */
+        {QMI_FIXED_INTF(0x19d2, 0x0200, 1)},
+        {QMI_FIXED_INTF(0x19d2, 0x0257, 3)},    /* ZTE MF821 */
         {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
         {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
         {QMI_FIXED_INTF(0x19d2, 0x1010, 4)},    /* ZTE (Vodafone) K3571-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x1012, 4)},
         {QMI_FIXED_INTF(0x19d2, 0x1018, 3)},    /* ZTE (Vodafone) K5006-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x1021, 2)},
+        {QMI_FIXED_INTF(0x19d2, 0x1245, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1247, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1252, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1254, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1255, 3)},
+        {QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
         {QMI_FIXED_INTF(0x19d2, 0x1402, 2)},    /* ZTE MF60 */
+        {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
+        {QMI_FIXED_INTF(0x19d2, 0x1425, 2)},
+        {QMI_FIXED_INTF(0x19d2, 0x1426, 2)},    /* ZTE MF91 */
         {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
         {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index f9819d10b1f9..cb04f900cc46 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1158,6 +1158,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                 usb_anchor_urb(urb, &dev->deferred);
                 /* no use to process more packets */
                 netif_stop_queue(net);
+                usb_put_urb(urb);
                 spin_unlock_irqrestore(&dev->txq.lock, flags);
                 netdev_dbg(dev->net, "Delaying transmission for resumption\n");
                 goto deferred;
@@ -1310,6 +1311,8 @@ void usbnet_disconnect (struct usb_interface *intf)
 
         cancel_work_sync(&dev->kevent);
 
+        usb_scuttle_anchored_urbs(&dev->deferred);
+
         if (dev->driver_info->unbind)
                 dev->driver_info->unbind (dev, intf);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 89bf94d4d8a1..6f7cf49eff4d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -534,107 +534,107 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
 
 static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
-        {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
-        {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
         {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
         {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
         {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400},
-        {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402},
-        {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404},
-        {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603},
-        {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02},
-        {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04},
-        {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20},
-        {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20},
-        {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22},
-        {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24},
-        {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640},
-        {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660},
-        {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861},
-        {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81},
-        {0x0000a54c, 0x5a08442e, 0x5a08442e, 0x47001a83, 0x47001a83},
-        {0x0000a550, 0x5e0a4431, 0x5e0a4431, 0x4a001c84, 0x4a001c84},
-        {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3},
-        {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5},
-        {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9},
-        {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb},
-        {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
-        {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
-        {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
-        {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
-        {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
-        {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
-        {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
+        {0x0000a518, 0x21002220, 0x21002220, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x52022470, 0x52022470, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x55022490, 0x55022490, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x59022492, 0x59022492, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x5d022692, 0x5d022692, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x61022892, 0x61022892, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x65024890, 0x65024890, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x69024892, 0x69024892, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x6e024c92, 0x6e024c92, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
         {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
         {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
         {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
         {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
-        {0x0000a590, 0x15800028, 0x15800028, 0x0f800202, 0x0f800202},
-        {0x0000a594, 0x1b80002b, 0x1b80002b, 0x12800400, 0x12800400},
-        {0x0000a598, 0x1f820028, 0x1f820028, 0x16800402, 0x16800402},
-        {0x0000a59c, 0x2582002b, 0x2582002b, 0x19800404, 0x19800404},
-        {0x0000a5a0, 0x2a84002a, 0x2a84002a, 0x1c800603, 0x1c800603},
-        {0x0000a5a4, 0x2e86002a, 0x2e86002a, 0x21800a02, 0x21800a02},
-        {0x0000a5a8, 0x3382202d, 0x3382202d, 0x25800a04, 0x25800a04},
-        {0x0000a5ac, 0x3884202c, 0x3884202c, 0x28800a20, 0x28800a20},
-        {0x0000a5b0, 0x3c86202c, 0x3c86202c, 0x2c800e20, 0x2c800e20},
-        {0x0000a5b4, 0x4188202d, 0x4188202d, 0x30800e22, 0x30800e22},
-        {0x0000a5b8, 0x4586402d, 0x4586402d, 0x34800e24, 0x34800e24},
-        {0x0000a5bc, 0x4986222d, 0x4986222d, 0x38801640, 0x38801640},
-        {0x0000a5c0, 0x4d862231, 0x4d862231, 0x3c801660, 0x3c801660},
-        {0x0000a5c4, 0x50882231, 0x50882231, 0x3f801861, 0x3f801861},
-        {0x0000a5c8, 0x5688422e, 0x5688422e, 0x43801a81, 0x43801a81},
-        {0x0000a5cc, 0x5a88442e, 0x5a88442e, 0x47801a83, 0x47801a83},
-        {0x0000a5d0, 0x5e8a4431, 0x5e8a4431, 0x4a801c84, 0x4a801c84},
-        {0x0000a5d4, 0x648a4432, 0x648a4432, 0x4e801ce3, 0x4e801ce3},
-        {0x0000a5d8, 0x688a4434, 0x688a4434, 0x52801ce5, 0x52801ce5},
-        {0x0000a5dc, 0x6c8a6434, 0x6c8a6434, 0x56801ce9, 0x56801ce9},
-        {0x0000a5e0, 0x6f8a6633, 0x6f8a6633, 0x5a801ceb, 0x5a801ceb},
-        {0x0000a5e4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
-        {0x0000a5e8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
-        {0x0000a5ec, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f0, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
-        {0x0000a5fc, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
+        {0x0000a598, 0x21802220, 0x21802220, 0x16800402, 0x16800402},
+        {0x0000a59c, 0x27802223, 0x27802223, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
+        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
+        {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
+        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
+        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
+        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
+        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
+        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
+        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
+        {0x0000a5c4, 0x52822470, 0x52822470, 0x3f801861, 0x3f801861},
+        {0x0000a5c8, 0x55822490, 0x55822490, 0x43801a81, 0x43801a81},
+        {0x0000a5cc, 0x59822492, 0x59822492, 0x47801a83, 0x47801a83},
+        {0x0000a5d0, 0x5d822692, 0x5d822692, 0x4a801c84, 0x4a801c84},
+        {0x0000a5d4, 0x61822892, 0x61822892, 0x4e801ce3, 0x4e801ce3},
+        {0x0000a5d8, 0x65824890, 0x65824890, 0x52801ce5, 0x52801ce5},
+        {0x0000a5dc, 0x69824892, 0x69824892, 0x56801ce9, 0x56801ce9},
+        {0x0000a5e0, 0x6e824c92, 0x6e824c92, 0x5a801ceb, 0x5a801ceb},
+        {0x0000a5e4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5ec, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f0, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5fc, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
         {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
-        {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
-        {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
-        {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000},
-        {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501},
-        {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501},
-        {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03},
-        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
-        {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04},
-        {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
-        {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
-        {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
-        {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
-        {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
-        {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
-        {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x02004000, 0x02004000, 0x01404000, 0x01404000},
+        {0x0000a618, 0x02004801, 0x02004801, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02808a02, 0x02808a02, 0x02008501, 0x02008501},
+        {0x0000a620, 0x0380ce03, 0x0380ce03, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04411104, 0x04411104, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04411104, 0x04411104, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
         {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
-        {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
-        {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
         {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016048, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
+        {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
         {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016448, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
+        {0x00016448, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
         {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
         {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016848, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
+        {0x00016848, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
         {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 924c4616c3d9..f5dda84176c3 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -38,6 +38,7 @@ static struct usb_device_id ath9k_hif_usb_ids[] = {
         { USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */
         { USB_DEVICE(0x040D, 0x3801) }, /* VIA */
         { USB_DEVICE(0x0cf3, 0xb003) }, /* Ubiquiti WifiStation Ext */
+        { USB_DEVICE(0x0cf3, 0xb002) }, /* Ubiquiti WifiStation */
         { USB_DEVICE(0x057c, 0x8403) }, /* AVM FRITZ!WLAN 11N v2 USB */
 
         { USB_DEVICE(0x0cf3, 0x7015),
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 73730e94e0ac..c5a99c8c8168 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5404,6 +5404,8 @@ static void b43_bcma_remove(struct bcma_device *core)
         cancel_work_sync(&wldev->restart_work);
 
         B43_WARN_ON(!wl);
+        if (!wldev->fw.ucode.data)
+                return;                 /* NULL if firmware never loaded */
         if (wl->current_dev == wldev && wl->hw_registred) {
                 b43_leds_stop(wldev);
                 ieee80211_unregister_hw(wl->hw);
@@ -5478,6 +5480,8 @@ static void b43_ssb_remove(struct ssb_device *sdev)
         cancel_work_sync(&wldev->restart_work);
 
         B43_WARN_ON(!wl);
+        if (!wldev->fw.ucode.data)
+                return;                 /* NULL if firmware never loaded */
         if (wl->current_dev == wldev && wl->hw_registred) {
                 b43_leds_stop(wldev);
                 ieee80211_unregister_hw(wl->hw);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index a2b4b1e71017..7a6dfdc67b6c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1339,7 +1339,7 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo,
         }
 
         ret = brcmf_bus_start(dev);
-        if (ret == -ENOLINK) {
+        if (ret) {
                 brcmf_dbg(ERROR, "dongle is not responding\n");
                 brcmf_detach(dev);
                 goto fail;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index c1abaa6db59e..a6f1e8166008 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -3569,7 +3569,7 @@ brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
 
         if (!request || !request->n_ssids || !request->n_match_sets) {
                 WL_ERR("Invalid sched scan req!! n_ssids:%d\n",
-                       request->n_ssids);
+                       request ? request->n_ssids : 0);
                 return -EINVAL;
         }
 
@@ -3972,7 +3972,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg,
         u8  *iovar_ie_buf;
         u8  *curr_ie_buf;
         u8  *mgmt_ie_buf = NULL;
-        u32 mgmt_ie_buf_len = 0;
+        int mgmt_ie_buf_len;
         u32 *mgmt_ie_len = 0;
         u32 del_add_ie_buf_len = 0;
         u32 total_ie_buf_len = 0;
@@ -3982,7 +3982,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg,
         struct parsed_vndr_ie_info *vndrie_info;
         s32 i;
         u8 *ptr;
-        u32 remained_buf_len;
+        int remained_buf_len;
 
         WL_TRACE("bssidx %d, pktflag : 0x%02X\n", bssidx, pktflag);
         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
@@ -4606,12 +4606,13 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
         struct brcmf_cfg80211_profile *profile = cfg->profile;
         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
         struct wiphy *wiphy = cfg_to_wiphy(cfg);
-        struct brcmf_channel_info_le channel_le;
-        struct ieee80211_channel *notify_channel;
+        struct ieee80211_channel *notify_channel = NULL;
         struct ieee80211_supported_band *band;
+        struct brcmf_bss_info_le *bi;
         u32 freq;
         s32 err = 0;
         u32 target_channel;
+        u8 *buf;
 
         WL_TRACE("Enter\n");
 
@@ -4619,11 +4620,22 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
         memcpy(profile->bssid, e->addr, ETH_ALEN);
         brcmf_update_bss_info(cfg);
 
-        brcmf_exec_dcmd(ndev, BRCMF_C_GET_CHANNEL, &channel_le,
-                        sizeof(channel_le));
+        buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
+        if (buf == NULL) {
+                err = -ENOMEM;
+                goto done;
+        }
+
+        /* data sent to dongle has to be little endian */
+        *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
+        err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_BSS_INFO, buf, WL_BSS_INFO_MAX);
+
+        if (err)
+                goto done;
 
-        target_channel = le32_to_cpu(channel_le.target_channel);
-        WL_CONN("Roamed to channel %d\n", target_channel);
+        bi = (struct brcmf_bss_info_le *)(buf + 4);
+        target_channel = bi->ctl_ch ? bi->ctl_ch :
+                                      CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
 
         if (target_channel <= CH_MAX_2G_CHANNEL)
                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
@@ -4633,6 +4645,8 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
         freq = ieee80211_channel_to_frequency(target_channel, band->band);
         notify_channel = ieee80211_get_channel(wiphy, freq);
 
+done:
+        kfree(buf);
         cfg80211_roamed(ndev, notify_channel, (u8 *)profile->bssid,
                         conn_info->req_ie, conn_info->req_ie_len,
                         conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
@@ -5186,41 +5200,6 @@ brcmf_cfg80211_event(struct net_device *ndev,
                 schedule_work(&cfg->event_work);
 }
 
-static s32 brcmf_dongle_mode(struct net_device *ndev, s32 iftype)
-{
-        s32 infra = 0;
-        s32 err = 0;
-
-        switch (iftype) {
-        case NL80211_IFTYPE_MONITOR:
-        case NL80211_IFTYPE_WDS:
-                WL_ERR("type (%d) : currently we do not support this mode\n",
-                       iftype);
-                err = -EINVAL;
-                return err;
-        case NL80211_IFTYPE_ADHOC:
-                infra = 0;
-                break;
-        case NL80211_IFTYPE_STATION:
-                infra = 1;
-                break;
-        case NL80211_IFTYPE_AP:
-                infra = 1;
-                break;
-        default:
-                err = -EINVAL;
-                WL_ERR("invalid type (%d)\n", iftype);
-                return err;
-        }
-        err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_INFRA, &infra);
-        if (err) {
-                WL_ERR("WLC_SET_INFRA error (%d)\n", err);
-                return err;
-        }
-
-        return 0;
-}
-
 static s32 brcmf_dongle_eventmsg(struct net_device *ndev)
 {
         /* Room for "event_msgs" + '\0' + bitvec */
@@ -5439,7 +5418,8 @@ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
                                 WL_BEACON_TIMEOUT);
         if (err)
                 goto default_conf_out;
-        err = brcmf_dongle_mode(ndev, wdev->iftype);
+        err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
+                                          NULL, NULL);
         if (err && err != -EINPROGRESS)
                 goto default_conf_out;
         err = brcmf_dongle_probecap(cfg);
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 935120fc8c93..768bf612533e 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -10472,7 +10472,7 @@ static void ipw_handle_promiscuous_tx(struct ipw_priv *priv,
                 } else
                         len = src->len;
 
-                dst = alloc_skb(len + sizeof(*rt_hdr), GFP_ATOMIC);
+                dst = alloc_skb(len + sizeof(*rt_hdr) + sizeof(u16)*2, GFP_ATOMIC);
                 if (!dst)
                         continue;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c
index 349c205d5f62..da5862064195 100644
--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
@@ -518,7 +518,7 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
          * See iwlagn_mac_channel_switch.
          */
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
-        struct iwl6000_channel_switch_cmd cmd;
+        struct iwl6000_channel_switch_cmd *cmd;
         u32 switch_time_in_usec, ucode_switch_time;
         u16 ch;
         u32 tsf_low;
@@ -527,18 +527,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
         struct ieee80211_vif *vif = ctx->vif;
         struct iwl_host_cmd hcmd = {
                 .id = REPLY_CHANNEL_SWITCH,
-                .len = { sizeof(cmd), },
+                .len = { sizeof(*cmd), },
                 .flags = CMD_SYNC,
-                .data = { &cmd, },
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
         };
+        int err;
 
-        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        hcmd.data[0] = cmd;
+
+        cmd->band = priv->band == IEEE80211_BAND_2GHZ;
         ch = ch_switch->channel->hw_value;
         IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
                       ctx->active.channel, ch);
-        cmd.channel = cpu_to_le16(ch);
-        cmd.rxon_flags = ctx->staging.flags;
-        cmd.rxon_filter_flags = ctx->staging.filter_flags;
+        cmd->channel = cpu_to_le16(ch);
+        cmd->rxon_flags = ctx->staging.flags;
+        cmd->rxon_filter_flags = ctx->staging.filter_flags;
         switch_count = ch_switch->count;
         tsf_low = ch_switch->timestamp & 0x0ffffffff;
         /*
@@ -554,23 +561,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
                         switch_count = 0;
         }
         if (switch_count <= 1)
-                cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+                cmd->switch_time = cpu_to_le32(priv->ucode_beacon_time);
         else {
                 switch_time_in_usec =
                         vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
                 ucode_switch_time = iwl_usecs_to_beacons(priv,
                                                          switch_time_in_usec,
                                                          beacon_interval);
-                cmd.switch_time = iwl_add_beacon_time(priv,
-                                                      priv->ucode_beacon_time,
-                                                      ucode_switch_time,
-                                                      beacon_interval);
+                cmd->switch_time = iwl_add_beacon_time(priv,
+                                                       priv->ucode_beacon_time,
+                                                       ucode_switch_time,
+                                                       beacon_interval);
         }
         IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
-                      cmd.switch_time);
-        cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
+                      cmd->switch_time);
+        cmd->expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
 
-        return iwl_dvm_send_cmd(priv, &hcmd);
+        err = iwl_dvm_send_cmd(priv, &hcmd);
+        kfree(cmd);
+        return err;
 }
 
 struct iwl_lib_ops iwl6000_lib = {
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 0679458a1bac..780d3e168297 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1825,8 +1825,6 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
                 return -EBUSY;
         }
 
-        priv->scan_request = request;
-
         priv->user_scan_cfg = kzalloc(sizeof(struct mwifiex_user_scan_cfg),
                                       GFP_KERNEL);
         if (!priv->user_scan_cfg) {
@@ -1834,6 +1832,8 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
                 return -ENOMEM;
         }
 
+        priv->scan_request = request;
+
         priv->user_scan_cfg->num_ssids = request->n_ssids;
         priv->user_scan_cfg->ssid_list = request->ssids;
 
@@ -1870,6 +1870,9 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
         ret = mwifiex_scan_networks(priv, priv->user_scan_cfg);
         if (ret) {
                 dev_err(priv->adapter->dev, "scan failed: %d\n", ret);
+                priv->scan_request = NULL;
+                kfree(priv->user_scan_cfg);
+                priv->user_scan_cfg = NULL;
                 return ret;
         }
 
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 00b658d3b6ec..9171aaedbccd 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1843,21 +1843,18 @@ static int mwifiex_scan_specific_ssid(struct mwifiex_private *priv,
                                       struct cfg80211_ssid *req_ssid)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
-        int ret = 0;
+        int ret;
         struct mwifiex_user_scan_cfg *scan_cfg;
 
-        if (!req_ssid)
-                return -1;
-
         if (adapter->scan_processing) {
-                dev_dbg(adapter->dev, "cmd: Scan already in process...\n");
-                return ret;
+                dev_err(adapter->dev, "cmd: Scan already in process...\n");
+                return -EBUSY;
         }
 
         if (priv->scan_block) {
-                dev_dbg(adapter->dev,
+                dev_err(adapter->dev,
                         "cmd: Scan is blocked during association...\n");
-                return ret;
+                return -EBUSY;
         }
 
         scan_cfg = kzalloc(sizeof(struct mwifiex_user_scan_cfg), GFP_KERNEL);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index a12e84f892be..6b2e1e431dd2 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1988,6 +1988,7 @@ static struct usb_driver rt2500usb_driver = {
         .disconnect     = rt2x00usb_disconnect,
         .suspend        = rt2x00usb_suspend,
         .resume         = rt2x00usb_resume,
+        .reset_resume   = rt2x00usb_resume,
         .disable_hub_initiated_lpm = 1,
 };
 
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index c9e9370eb789..3b8fb5a603f2 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1282,6 +1282,7 @@ static struct usb_driver rt2800usb_driver = {
         .disconnect     = rt2x00usb_disconnect,
         .suspend        = rt2x00usb_suspend,
         .resume         = rt2x00usb_resume,
+        .reset_resume   = rt2x00usb_resume,
         .disable_hub_initiated_lpm = 1,
 };
 
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index e5eb43b3eee7..24eec66e9fd2 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2535,6 +2535,7 @@ static struct usb_driver rt73usb_driver = {
         .disconnect     = rt2x00usb_disconnect,
         .suspend        = rt2x00usb_suspend,
         .resume         = rt2x00usb_resume,
+        .reset_resume   = rt2x00usb_resume,
         .disable_hub_initiated_lpm = 1,
 };
 
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 030beb45d8b0..e3ea4b346889 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -673,7 +673,7 @@ static int rtl_usb_start(struct ieee80211_hw *hw)
                 set_hal_start(rtlhal);
 
                 /* Start bulk IN */
-                _rtl_usb_receive(hw);
+                err = _rtl_usb_receive(hw);
         }
 
         return err;
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 0f1ec9e8ff14..2e39c04fc16b 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1061,8 +1061,10 @@ static int pinctrl_groups_show(struct seq_file *s, void *what)
                         seq_printf(s, "group: %s\n", gname);
                         for (i = 0; i < num_pins; i++) {
                                 pname = pin_get_name(pctldev, pins[i]);
-                                if (WARN_ON(!pname))
+                                if (WARN_ON(!pname)) {
+                                        mutex_unlock(&pinctrl_mutex);
                                         return -EINVAL;
+                                }
                                 seq_printf(s, "pin %d (%s)\n", pins[i], pname);
                         }
                         seq_puts(s, "\n");
diff --git a/drivers/pinctrl/pinconf.c b/drivers/pinctrl/pinconf.c
index 43f474cdc110..baee2cc46a17 100644
--- a/drivers/pinctrl/pinconf.c
+++ b/drivers/pinctrl/pinconf.c
@@ -537,8 +537,6 @@ static int pinconf_groups_show(struct seq_file *s, void *what)
         seq_puts(s, "Pin config settings per pin group\n");
         seq_puts(s, "Format: group (name): configs\n");
 
-        mutex_lock(&pinctrl_mutex);
-
         while (selector < ngroups) {
                 const char *gname = pctlops->get_group_name(pctldev, selector);
 
@@ -549,8 +547,6 @@ static int pinconf_groups_show(struct seq_file *s, void *what)
                 selector++;
         }
 
-        mutex_unlock(&pinctrl_mutex);
-
         return 0;
 }
 
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index 01aea1c3b5fa..cf82d9ce4dee 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -1056,7 +1056,7 @@ static int nmk_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
         struct nmk_gpio_chip *nmk_chip =
                 container_of(chip, struct nmk_gpio_chip, chip);
 
-        return irq_find_mapping(nmk_chip->domain, offset);
+        return irq_create_mapping(nmk_chip->domain, offset);
 }
 
 #ifdef CONFIG_DEBUG_FS
@@ -1281,7 +1281,7 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
         struct clk *clk;
         int secondary_irq;
         void __iomem *base;
-        int irq_start = -1;
+        int irq_start = 0;
         int irq;
         int ret;
 
@@ -1387,7 +1387,7 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
 
         if (!np)
                 irq_start = NOMADIK_GPIO_TO_IRQ(pdata->first_gpio);
-        nmk_chip->domain = irq_domain_add_simple(NULL,
+        nmk_chip->domain = irq_domain_add_simple(np,
                                 NMK_GPIO_PER_CHIP, irq_start,
                                 &nmk_gpio_irq_simple_ops, nmk_chip);
         if (!nmk_chip->domain) {
diff --git a/drivers/pinctrl/pinctrl-tegra.c b/drivers/pinctrl/pinctrl-tegra.c
index 729b686c3ad2..7da0b371fd65 100644
--- a/drivers/pinctrl/pinctrl-tegra.c
+++ b/drivers/pinctrl/pinctrl-tegra.c
@@ -464,7 +464,7 @@ static int tegra_pinconf_reg(struct tegra_pmx *pmx,
                 *bank = g->drv_bank;
                 *reg = g->drv_reg;
                 *bit = g->lpmd_bit;
-                *width = 1;
+                *width = 2;
                 break;
         case TEGRA_PINCONF_PARAM_DRIVE_DOWN_STRENGTH:
                 *bank = g->drv_bank;
diff --git a/drivers/pinctrl/pinctrl-tegra30.c b/drivers/pinctrl/pinctrl-tegra30.c
index 0386fdf0da16..7894f14c7059 100644
--- a/drivers/pinctrl/pinctrl-tegra30.c
+++ b/drivers/pinctrl/pinctrl-tegra30.c
@@ -3345,10 +3345,10 @@ static const struct tegra_function tegra30_functions[] = {
         FUNCTION(vi_alt3),
 };
 
-#define MUXCTL_REG_A    0x3000
-#define PINGROUP_REG_A  0x868
+#define DRV_PINGROUP_REG_A      0x868   /* bank 0 */
+#define PINGROUP_REG_A          0x3000  /* bank 1 */
 
-#define PINGROUP_REG_Y(r) ((r) - MUXCTL_REG_A)
+#define PINGROUP_REG_Y(r) ((r) - PINGROUP_REG_A)
 #define PINGROUP_REG_N(r) -1
 
 #define PINGROUP(pg_name, f0, f1, f2, f3, f_safe, r, od, ior)   \
@@ -3364,25 +3364,25 @@ static const struct tegra_function tegra30_functions[] = {
                 },                                              \
                 .func_safe = TEGRA_MUX_ ## f_safe,              \
                 .mux_reg = PINGROUP_REG_Y(r),                   \
-                .mux_bank = 0,                                  \
+                .mux_bank = 1,                                  \
                 .mux_bit = 0,                                   \
                 .pupd_reg = PINGROUP_REG_Y(r),                  \
-                .pupd_bank = 0,                                 \
+                .pupd_bank = 1,                                 \
                 .pupd_bit = 2,                                  \
                 .tri_reg = PINGROUP_REG_Y(r),                   \
-                .tri_bank = 0,                                  \
+                .tri_bank = 1,                                  \
                 .tri_bit = 4,                                   \
                 .einput_reg = PINGROUP_REG_Y(r),                \
-                .einput_bank = 0,                               \
+                .einput_bank = 1,                               \
                 .einput_bit = 5,                                \
                 .odrain_reg = PINGROUP_REG_##od(r),             \
-                .odrain_bank = 0,                               \
+                .odrain_bank = 1,                               \
                 .odrain_bit = 6,                                \
                 .lock_reg = PINGROUP_REG_Y(r),                  \
-                .lock_bank = 0,                                 \
+                .lock_bank = 1,                                 \
                 .lock_bit = 7,                                  \
                 .ioreset_reg = PINGROUP_REG_##ior(r),           \
-                .ioreset_bank = 0,                              \
+                .ioreset_bank = 1,                              \
                 .ioreset_bit = 8,                               \
                 .drv_reg = -1,                                  \
         }
@@ -3401,8 +3401,8 @@ static const struct tegra_function tegra30_functions[] = {
                 .odrain_reg = -1,                               \
                 .lock_reg = -1,                                 \
                 .ioreset_reg = -1,                              \
-                .drv_reg = ((r) - PINGROUP_REG_A),              \
-                .drv_bank = 1,                                  \
+                .drv_reg = ((r) - DRV_PINGROUP_REG_A),          \
+                .drv_bank = 0,                                  \
                 .hsm_bit = hsm_b,                               \
                 .schmitt_bit = schmitt_b,                       \
                 .lpmd_bit = lpmd_b,                             \
diff --git a/drivers/rtc/rtc-imxdi.c b/drivers/rtc/rtc-imxdi.c
index 891cd6c61d0a..4eed51044c5d 100644
--- a/drivers/rtc/rtc-imxdi.c
+++ b/drivers/rtc/rtc-imxdi.c
@@ -392,6 +392,8 @@ static int dryice_rtc_probe(struct platform_device *pdev)
         if (imxdi->ioaddr == NULL)
                 return -ENOMEM;
 
+        spin_lock_init(&imxdi->irq_lock);
+
         imxdi->irq = platform_get_irq(pdev, 0);
         if (imxdi->irq < 0)
                 return imxdi->irq;
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index b4d572f65f07..fd00afd8b850 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -377,7 +377,11 @@ static int css_evaluate_new_subchannel(struct subchannel_id schid, int slow)
                 /* Will be done on the slow path. */
                 return -EAGAIN;
         }
-        if (stsch_err(schid, &schib) || !css_sch_is_valid(&schib)) {
+        if (stsch_err(schid, &schib)) {
+                /* Subchannel is not provided. */
+                return -ENXIO;
+        }
+        if (!css_sch_is_valid(&schib)) {
                 /* Unusable - ignore. */
                 return 0;
         }
@@ -536,6 +540,7 @@ static int slow_eval_unknown_fn(struct subchannel_id schid, void *data)
                 case -ENOMEM:
                 case -EIO:
                         /* These should abort looping */
+                        idset_sch_del_subseq(slow_subchannel_set, schid);
                         break;
                 default:
                         rc = 0;
diff --git a/drivers/s390/cio/idset.c b/drivers/s390/cio/idset.c
index e6d5f8c49524..199bc6791177 100644
--- a/drivers/s390/cio/idset.c
+++ b/drivers/s390/cio/idset.c
@@ -1,9 +1,10 @@
 /*
- *    Copyright IBM Corp. 2007
+ *    Copyright IBM Corp. 2007, 2012
  *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
  */
 
 #include <linux/vmalloc.h>
+#include <linux/bitmap.h>
 #include <linux/bitops.h>
 #include "idset.h"
 #include "css.h"
@@ -89,6 +90,14 @@ void idset_sch_del(struct idset *set, struct subchannel_id schid)
         idset_del(set, schid.ssid, schid.sch_no);
 }
 
+/* Clear ids starting from @schid up to end of subchannel set. */
+void idset_sch_del_subseq(struct idset *set, struct subchannel_id schid)
+{
+        int pos = schid.ssid * set->num_id + schid.sch_no;
+
+        bitmap_clear(set->bitmap, pos, set->num_id - schid.sch_no);
+}
+
 int idset_sch_contains(struct idset *set, struct subchannel_id schid)
 {
         return idset_contains(set, schid.ssid, schid.sch_no);
@@ -111,20 +120,13 @@ int idset_sch_get_first(struct idset *set, struct subchannel_id *schid)
 
 int idset_is_empty(struct idset *set)
 {
-        int bitnum;
-
-        bitnum = find_first_bit(set->bitmap, set->num_ssid * set->num_id);
-        if (bitnum >= set->num_ssid * set->num_id)
-                return 1;
-        return 0;
+        return bitmap_empty(set->bitmap, set->num_ssid * set->num_id);
 }
 
 void idset_add_set(struct idset *to, struct idset *from)
 {
-        unsigned long i, len;
+        int len = min(__BITOPS_WORDS(to->num_ssid * to->num_id),
+                      __BITOPS_WORDS(from->num_ssid * from->num_id));
 
-        len = min(__BITOPS_WORDS(to->num_ssid * to->num_id),
-                  __BITOPS_WORDS(from->num_ssid * from->num_id));
-        for (i = 0; i < len ; i++)
-                to->bitmap[i] |= from->bitmap[i];
+        bitmap_or(to->bitmap, to->bitmap, from->bitmap, len);
 }
diff --git a/drivers/s390/cio/idset.h b/drivers/s390/cio/idset.h
index 3d943f03591e..06d3bc01bb09 100644
--- a/drivers/s390/cio/idset.h
+++ b/drivers/s390/cio/idset.h
@@ -1,5 +1,5 @@
 /*
- *    Copyright IBM Corp. 2007
+ *    Copyright IBM Corp. 2007, 2012
  *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
  */
 
@@ -17,6 +17,7 @@ void idset_fill(struct idset *set);
 struct idset *idset_sch_new(void);
 void idset_sch_add(struct idset *set, struct subchannel_id id);
 void idset_sch_del(struct idset *set, struct subchannel_id id);
+void idset_sch_del_subseq(struct idset *set, struct subchannel_id schid);
 int idset_sch_contains(struct idset *set, struct subchannel_id id);
 int idset_sch_get_first(struct idset *set, struct subchannel_id *id);
 int idset_is_empty(struct idset *set);
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index edf1360ab09e..86dd04d6bc87 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -323,6 +323,7 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
         if (!ret) {
                 dev_err(ssp->dev, "DMA transfer timeout\n");
                 ret = -ETIMEDOUT;
+                dmaengine_terminate_all(ssp->dmach);
                 goto err_vmalloc;
         }
 
@@ -480,7 +481,7 @@ static int mxs_spi_transfer_one(struct spi_master *master,
                 first = last = 0;
         }
 
-        m->status = 0;
+        m->status = status;
         spi_finalize_current_message(master);
 
         return status;
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 919464102d33..a1db91a99b89 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -2186,8 +2186,6 @@ pl022_probe(struct amba_device *adev, const struct amba_id *id)
         printk(KERN_INFO "pl022: mapped registers from 0x%08x to %p\n",
                adev->res.start, pl022->virtbase);
 
-        pm_runtime_resume(dev);
-
         pl022->clk = devm_clk_get(&adev->dev, NULL);
         if (IS_ERR(pl022->clk)) {
                 status = PTR_ERR(pl022->clk);
@@ -2292,7 +2290,6 @@ pl022_remove(struct amba_device *adev)
 
         clk_disable(pl022->clk);
         clk_unprepare(pl022->clk);
-        pm_runtime_disable(&adev->dev);
         amba_release_regions(adev);
         tasklet_disable(&pl022->pump_transfers);
         spi_unregister_master(pl022->master);
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 4894bde4bbff..30faf6d4ab91 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -147,8 +147,6 @@ struct rspi_data {
         unsigned char spsr;
 
         /* for dmaengine */
-        struct sh_dmae_slave dma_tx;
-        struct sh_dmae_slave dma_rx;
         struct dma_chan *chan_tx;
         struct dma_chan *chan_rx;
         int irq;
@@ -663,20 +661,16 @@ static irqreturn_t rspi_irq(int irq, void *_sr)
         return ret;
 }
 
-static bool rspi_filter(struct dma_chan *chan, void *filter_param)
-{
-        chan->private = filter_param;
-        return true;
-}
-
-static void __devinit rspi_request_dma(struct rspi_data *rspi,
-                                       struct platform_device *pdev)
+static int __devinit rspi_request_dma(struct rspi_data *rspi,
+                                      struct platform_device *pdev)
 {
         struct rspi_plat_data *rspi_pd = pdev->dev.platform_data;
         dma_cap_mask_t mask;
+        struct dma_slave_config cfg;
+        int ret;
 
         if (!rspi_pd)
-                return;
+                return 0;       /* The driver assumes no error. */
 
         rspi->dma_width_16bit = rspi_pd->dma_width_16bit;
 
@@ -684,21 +678,35 @@ static void __devinit rspi_request_dma(struct rspi_data *rspi,
         if (rspi_pd->dma_rx_id && rspi_pd->dma_tx_id) {
                 dma_cap_zero(mask);
                 dma_cap_set(DMA_SLAVE, mask);
-                rspi->dma_rx.slave_id = rspi_pd->dma_rx_id;
-                rspi->chan_rx = dma_request_channel(mask, rspi_filter,
-                                                    &rspi->dma_rx);
-                if (rspi->chan_rx)
-                        dev_info(&pdev->dev, "Use DMA when rx.\n");
+                rspi->chan_rx = dma_request_channel(mask, shdma_chan_filter,
+                                                    (void *)rspi_pd->dma_rx_id);
+                if (rspi->chan_rx) {
+                        cfg.slave_id = rspi_pd->dma_rx_id;
+                        cfg.direction = DMA_DEV_TO_MEM;
+                        ret = dmaengine_slave_config(rspi->chan_rx, &cfg);
+                        if (!ret)
+                                dev_info(&pdev->dev, "Use DMA when rx.\n");
+                        else
+                                return ret;
+                }
         }
         if (rspi_pd->dma_tx_id) {
                 dma_cap_zero(mask);
                 dma_cap_set(DMA_SLAVE, mask);
-                rspi->dma_tx.slave_id = rspi_pd->dma_tx_id;
-                rspi->chan_tx = dma_request_channel(mask, rspi_filter,
-                                                    &rspi->dma_tx);
-                if (rspi->chan_tx)
-                        dev_info(&pdev->dev, "Use DMA when tx\n");
+                rspi->chan_tx = dma_request_channel(mask, shdma_chan_filter,
+                                                    (void *)rspi_pd->dma_tx_id);
+                if (rspi->chan_tx) {
+                        cfg.slave_id = rspi_pd->dma_tx_id;
+                        cfg.direction = DMA_MEM_TO_DEV;
+                        ret = dmaengine_slave_config(rspi->chan_tx, &cfg);
+                        if (!ret)
+                                dev_info(&pdev->dev, "Use DMA when tx\n");
+                        else
+                                return ret;
+                }
         }
+
+        return 0;
 }
 
 static void __devexit rspi_release_dma(struct rspi_data *rspi)
@@ -788,7 +796,11 @@ static int __devinit rspi_probe(struct platform_device *pdev)
         }
 
         rspi->irq = irq;
-        rspi_request_dma(rspi, pdev);
+        ret = rspi_request_dma(rspi, pdev);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "rspi_request_dma failed.\n");
+                goto error4;
+        }
 
         ret = spi_register_master(master);
         if (ret < 0) {
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 7b0ba92e7e46..5d4610babd8a 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -567,7 +567,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
                 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE];
 
                 BUG_ON(*page);
-                *page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+                *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
                 if (*page == NULL) {
                         pr_err("binder: %d: binder_alloc_buf failed "
                                "for page at %p\n", proc->pid, page_addr);
@@ -2419,14 +2419,38 @@ static void binder_release_work(struct list_head *list)
                         struct binder_transaction *t;
 
                         t = container_of(w, struct binder_transaction, work);
-                        if (t->buffer->target_node && !(t->flags & TF_ONE_WAY))
+                        if (t->buffer->target_node &&
+                            !(t->flags & TF_ONE_WAY)) {
                                 binder_send_failed_reply(t, BR_DEAD_REPLY);
+                        } else {
+                                binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
+                                        "binder: undelivered transaction %d\n",
+                                        t->debug_id);
+                                t->buffer->transaction = NULL;
+                                kfree(t);
+                                binder_stats_deleted(BINDER_STAT_TRANSACTION);
+                        }
                 } break;
                 case BINDER_WORK_TRANSACTION_COMPLETE: {
+                        binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
+                                "binder: undelivered TRANSACTION_COMPLETE\n");
                         kfree(w);
                         binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
                 } break;
+                case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
+                case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
+                        struct binder_ref_death *death;
+
+                        death = container_of(w, struct binder_ref_death, work);
+                        binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
+                                "binder: undelivered death notification, %p\n",
+                                death->cookie);
+                        kfree(death);
+                        binder_stats_deleted(BINDER_STAT_DEATH);
+                } break;
                 default:
+                        pr_err("binder: unexpected work type, %d, not freed\n",
+                               w->type);
                         break;
                 }
         }
@@ -2899,6 +2923,7 @@ static void binder_deferred_release(struct binder_proc *proc)
                 nodes++;
                 rb_erase(&node->rb_node, &proc->nodes);
                 list_del_init(&node->work.entry);
+                binder_release_work(&node->async_todo);
                 if (hlist_empty(&node->refs)) {
                         kfree(node);
                         binder_stats_deleted(BINDER_STAT_NODE);
@@ -2937,6 +2962,7 @@ static void binder_deferred_release(struct binder_proc *proc)
                 binder_delete_ref(ref);
         }
         binder_release_work(&proc->todo);
+        binder_release_work(&proc->delivered_death);
         buffers = 0;
 
         while ((n = rb_first(&proc->allocated_buffers))) {
diff --git a/drivers/staging/comedi/drivers/8255_pci.c b/drivers/staging/comedi/drivers/8255_pci.c
index 7dff3c01dc29..d00aff6671df 100644
--- a/drivers/staging/comedi/drivers/8255_pci.c
+++ b/drivers/staging/comedi/drivers/8255_pci.c
@@ -289,6 +289,8 @@ static void pci_8255_detach(struct comedi_device *dev)
         struct comedi_subdevice *s;
         int i;
 
+        if (!board || !devpriv)
+                return;
         if (dev->subdevices) {
                 for (i = 0; i < board->n_8255; i++) {
                         s = &dev->subdevices[i];
diff --git a/drivers/staging/comedi/drivers/amplc_dio200.c b/drivers/staging/comedi/drivers/amplc_dio200.c
index 08f305210a69..29eb52d11d2f 100644
--- a/drivers/staging/comedi/drivers/amplc_dio200.c
+++ b/drivers/staging/comedi/drivers/amplc_dio200.c
@@ -1410,6 +1410,8 @@ static void dio200_detach(struct comedi_device *dev)
         const struct dio200_layout_struct *layout;
         unsigned n;
 
+        if (!thisboard)
+                return;
         if (dev->irq)
                 free_irq(dev->irq, dev);
         if (dev->subdevices) {
diff --git a/drivers/staging/comedi/drivers/amplc_pc236.c b/drivers/staging/comedi/drivers/amplc_pc236.c
index eacb5e4735d7..4e4f3c15df87 100644
--- a/drivers/staging/comedi/drivers/amplc_pc236.c
+++ b/drivers/staging/comedi/drivers/amplc_pc236.c
@@ -573,9 +573,10 @@ static int __devinit pc236_attach_pci(struct comedi_device *dev,
 static void pc236_detach(struct comedi_device *dev)
 {
         const struct pc236_board *thisboard = comedi_board(dev);
-        struct pc236_private *devpriv = dev->private;
 
-        if (devpriv)
+        if (!thisboard)
+                return;
+        if (dev->iobase)
                 pc236_intr_disable(dev);
         if (dev->irq)
                 free_irq(dev->irq, dev);
diff --git a/drivers/staging/comedi/drivers/amplc_pc263.c b/drivers/staging/comedi/drivers/amplc_pc263.c
index 60830ccfb903..d0a4c441228b 100644
--- a/drivers/staging/comedi/drivers/amplc_pc263.c
+++ b/drivers/staging/comedi/drivers/amplc_pc263.c
@@ -323,6 +323,8 @@ static void pc263_detach(struct comedi_device *dev)
 {
         const struct pc263_board *thisboard = comedi_board(dev);
 
+        if (!thisboard)
+                return;
         if (is_isa_board(thisboard)) {
                 if (dev->iobase)
                         release_region(dev->iobase, PC263_IO_SIZE);
diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c
index 5fd21fa6c1c7..c304528cfb13 100644
--- a/drivers/staging/comedi/drivers/das08.c
+++ b/drivers/staging/comedi/drivers/das08.c
@@ -846,6 +846,8 @@ static void __maybe_unused das08_detach(struct comedi_device *dev)
 {
         const struct das08_board_struct *thisboard = comedi_board(dev);
 
+        if (!thisboard)
+                return;
         das08_common_detach(dev);
         if (is_isa_board(thisboard)) {
                 if (dev->iobase)
diff --git a/drivers/staging/comedi/drivers/ni_daq_700.c b/drivers/staging/comedi/drivers/ni_daq_700.c
index 2ba0ade45c64..68d7c6a5db7d 100644
--- a/drivers/staging/comedi/drivers/ni_daq_700.c
+++ b/drivers/staging/comedi/drivers/ni_daq_700.c
@@ -95,7 +95,7 @@ static int daq700_dio_insn_bits(struct comedi_device *dev,
         }
 
         data[1] = s->state & 0xff;
-        data[1] |= inb(dev->iobase + DIO_R);
+        data[1] |= inb(dev->iobase + DIO_R) << 8;
 
         return insn->n;
 }
diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c
index 28b91a6c3789..b5a19a0863fb 100644
--- a/drivers/staging/comedi/drivers/ni_labpc.c
+++ b/drivers/staging/comedi/drivers/ni_labpc.c
@@ -772,6 +772,8 @@ void labpc_common_detach(struct comedi_device *dev)
 {
         struct comedi_subdevice *s;
 
+        if (!thisboard)
+                return;
         if (dev->subdevices) {
                 s = &dev->subdevices[2];
                 subdev_8255_cleanup(dev, s);
diff --git a/drivers/staging/iio/accel/adis16201_core.c b/drivers/staging/iio/accel/adis16201_core.c
index 8e37d6e04277..b12ca68cd9e4 100644
--- a/drivers/staging/iio/accel/adis16201_core.c
+++ b/drivers/staging/iio/accel/adis16201_core.c
@@ -310,30 +310,32 @@ static int adis16201_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_SCALE:
                 switch (chan->type) {
                 case IIO_VOLTAGE:
-                        *val = 0;
-                        if (chan->channel == 0)
-                                *val2 = 1220;
-                        else
-                                *val2 = 610;
+                        if (chan->channel == 0) {
+                                *val = 1;
+                                *val2 = 220000; /* 1.22 mV */
+                        } else {
+                                *val = 0;
+                                *val2 = 610000; /* 0.610 mV */
+                        }
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_TEMP:
-                        *val = 0;
-                        *val2 = -470000;
+                        *val = -470; /* 0.47 C */
+                        *val2 = 0;
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_ACCEL:
                         *val = 0;
-                        *val2 = 462500;
-                        return IIO_VAL_INT_PLUS_MICRO;
+                        *val2 = IIO_G_TO_M_S_2(462400); /* 0.4624 mg */
+                        return IIO_VAL_INT_PLUS_NANO;
                 case IIO_INCLI:
                         *val = 0;
-                        *val2 = 100000;
+                        *val2 = 100000; /* 0.1 degree */
                         return IIO_VAL_INT_PLUS_MICRO;
                 default:
                         return -EINVAL;
                 }
                 break;
         case IIO_CHAN_INFO_OFFSET:
-                *val = 25;
+                *val = 25000 / -470 - 1278; /* 25 C = 1278 */
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_CALIBBIAS:
                 switch (chan->type) {
diff --git a/drivers/staging/iio/accel/adis16203_core.c b/drivers/staging/iio/accel/adis16203_core.c
index 002fa9dfc375..e7b3441115ae 100644
--- a/drivers/staging/iio/accel/adis16203_core.c
+++ b/drivers/staging/iio/accel/adis16203_core.c
@@ -316,25 +316,27 @@ static int adis16203_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_SCALE:
                 switch (chan->type) {
                 case IIO_VOLTAGE:
-                        *val = 0;
-                        if (chan->channel == 0)
-                                *val2 = 1220;
-                        else
-                                *val2 = 610;
+                        if (chan->channel == 0) {
+                                *val = 1;
+                                *val2 = 220000; /* 1.22 mV */
+                        } else {
+                                *val = 0;
+                                *val2 = 610000; /* 0.61 mV */
+                        }
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_TEMP:
-                        *val = 0;
-                        *val2 = -470000;
+                        *val = -470; /* -0.47 C */
+                        *val2 = 0;
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_INCLI:
                         *val = 0;
-                        *val2 = 25000;
+                        *val2 = 25000; /* 0.025 degree */
                         return IIO_VAL_INT_PLUS_MICRO;
                 default:
                         return -EINVAL;
                 }
         case IIO_CHAN_INFO_OFFSET:
-                *val = 25;
+                *val = 25000 / -470 - 1278; /* 25 C = 1278 */
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_CALIBBIAS:
                 bits = 14;
diff --git a/drivers/staging/iio/accel/adis16204_core.c b/drivers/staging/iio/accel/adis16204_core.c
index 05bdb7c2c8e3..c6234c2f46aa 100644
--- a/drivers/staging/iio/accel/adis16204_core.c
+++ b/drivers/staging/iio/accel/adis16204_core.c
@@ -317,26 +317,28 @@ static int adis16204_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_SCALE:
                 switch (chan->type) {
                 case IIO_VOLTAGE:
-                        *val = 0;
-                        if (chan->channel == 0)
-                                *val2 = 1220;
-                        else
-                                *val2 = 610;
+                        if (chan->channel == 0) {
+                                *val = 1;
+                                *val2 = 220000; /* 1.22 mV */
+                        } else {
+                                *val = 0;
+                                *val2 = 610000; /* 0.61 mV */
+                        }
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_TEMP:
-                        *val = 0;
-                        *val2 = -470000;
+                        *val = -470; /* 0.47 C */
+                        *val2 = 0;
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_ACCEL:
                         *val = 0;
                         switch (chan->channel2) {
                         case IIO_MOD_X:
                         case IIO_MOD_ROOT_SUM_SQUARED_X_Y:
-                                *val2 = 17125;
+                                *val2 = IIO_G_TO_M_S_2(17125); /* 17.125 mg */
                                 break;
                         case IIO_MOD_Y:
                         case IIO_MOD_Z:
-                                *val2 = 8407;
+                                *val2 = IIO_G_TO_M_S_2(8407); /* 8.407 mg */
                                 break;
                         }
                         return IIO_VAL_INT_PLUS_MICRO;
@@ -345,7 +347,7 @@ static int adis16204_read_raw(struct iio_dev *indio_dev,
                 }
                 break;
         case IIO_CHAN_INFO_OFFSET:
-                *val = 25;
+                *val = 25000 / -470 - 1278; /* 25 C = 1278 */
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_CALIBBIAS:
         case IIO_CHAN_INFO_PEAK:
diff --git a/drivers/staging/iio/accel/adis16209_core.c b/drivers/staging/iio/accel/adis16209_core.c
index b7333bfe0b2f..7ee974b45d7d 100644
--- a/drivers/staging/iio/accel/adis16209_core.c
+++ b/drivers/staging/iio/accel/adis16209_core.c
@@ -343,28 +343,29 @@ static int adis16209_read_raw(struct iio_dev *indio_dev,
                 case IIO_VOLTAGE:
                         *val = 0;
                         if (chan->channel == 0)
-                                *val2 = 305180;
+                                *val2 = 305180; /* 0.30518 mV */
                         else
-                                *val2 = 610500;
+                                *val2 = 610500; /* 0.6105 mV */
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_TEMP:
-                        *val = 0;
-                        *val2 = -470000;
+                        *val = -470; /* -0.47 C */
+                        *val2 = 0;
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_ACCEL:
                         *val = 0;
-                        *val2 = 2394;
-                        return IIO_VAL_INT_PLUS_MICRO;
+                        *val2 = IIO_G_TO_M_S_2(244140); /* 0.244140 mg */
+                        return IIO_VAL_INT_PLUS_NANO;
                 case IIO_INCLI:
+                case IIO_ROT:
                         *val = 0;
-                        *val2 = 436;
+                        *val2 = 25000; /* 0.025 degree */
                         return IIO_VAL_INT_PLUS_MICRO;
                 default:
                         return -EINVAL;
                 }
                 break;
         case IIO_CHAN_INFO_OFFSET:
-                *val = 25;
+                *val = 25000 / -470 - 0x4FE; /* 25 C = 0x4FE */
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_CALIBBIAS:
                 switch (chan->type) {
@@ -491,6 +492,7 @@ static const struct iio_chan_spec adis16209_channels[] = {
                 .modified = 1,
                 .channel2 = IIO_MOD_X,
                 .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT,
+                IIO_CHAN_INFO_SCALE_SHARED_BIT,
                 .address = rot,
                 .scan_index = ADIS16209_SCAN_ROT,
                 .scan_type = {
diff --git a/drivers/staging/iio/accel/adis16220_core.c b/drivers/staging/iio/accel/adis16220_core.c
index c755089c7117..eaadd9df3f78 100644
--- a/drivers/staging/iio/accel/adis16220_core.c
+++ b/drivers/staging/iio/accel/adis16220_core.c
@@ -486,7 +486,7 @@ static int adis16220_read_raw(struct iio_dev *indio_dev,
                 break;
         case IIO_CHAN_INFO_OFFSET:
                 if (chan->type == IIO_TEMP) {
-                        *val = 25;
+                        *val = 25000 / -470 - 1278; /* 25 C = 1278 */
                         return IIO_VAL_INT;
                 }
                 addrind = 1;
@@ -495,19 +495,22 @@ static int adis16220_read_raw(struct iio_dev *indio_dev,
                 addrind = 2;
                 break;
         case IIO_CHAN_INFO_SCALE:
-                *val = 0;
                 switch (chan->type) {
                 case IIO_TEMP:
-                        *val2 = -470000;
+                        *val = -470; /* -0.47 C */
+                        *val2 = 0;
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_ACCEL:
-                        *val2 = 1887042;
+                        *val2 = IIO_G_TO_M_S_2(19073); /* 19.073 g */
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_VOLTAGE:
-                        if (chan->channel == 0)
-                                *val2 = 0012221;
-                        else /* Should really be dependent on VDD */
-                                *val2 = 305;
+                        if (chan->channel == 0) {
+                                *val = 1;
+                                *val2 = 220700; /* 1.2207 mV */
+                        } else {
+                                /* Should really be dependent on VDD */
+                                *val2 = 305180; /* 305.18 uV */
+                        }
                         return IIO_VAL_INT_PLUS_MICRO;
                 default:
                         return -EINVAL;
diff --git a/drivers/staging/iio/accel/adis16240_core.c b/drivers/staging/iio/accel/adis16240_core.c
index 0fc26a49d681..35e093973d5c 100644
--- a/drivers/staging/iio/accel/adis16240_core.c
+++ b/drivers/staging/iio/accel/adis16240_core.c
@@ -373,30 +373,31 @@ static int adis16240_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_SCALE:
                 switch (chan->type) {
                 case IIO_VOLTAGE:
-                        *val = 0;
-                        if (chan->channel == 0)
-                                *val2 = 4880;
-                        else
+                        if (chan->channel == 0) {
+                                *val = 4;
+                                *val2 = 880000; /* 4.88 mV */
+                                return IIO_VAL_INT_PLUS_MICRO;
+                        } else {
                                 return -EINVAL;
-                        return IIO_VAL_INT_PLUS_MICRO;
+                        }
                 case IIO_TEMP:
-                        *val = 0;
-                        *val2 = 244000;
+                        *val = 244; /* 0.244 C */
+                        *val2 = 0;
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_ACCEL:
                         *val = 0;
-                        *val2 = 504062;
+                        *val2 = IIO_G_TO_M_S_2(51400); /* 51.4 mg */
                         return IIO_VAL_INT_PLUS_MICRO;
                 default:
                         return -EINVAL;
                 }
                 break;
         case IIO_CHAN_INFO_PEAK_SCALE:
-                *val = 6;
-                *val2 = 629295;
+                *val = 0;
+                *val2 = IIO_G_TO_M_S_2(51400); /* 51.4 mg */
                 return IIO_VAL_INT_PLUS_MICRO;
         case IIO_CHAN_INFO_OFFSET:
-                *val = 25;
+                *val = 25000 / 244 - 0x133; /* 25 C = 0x133 */
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_CALIBBIAS:
                 bits = 10;
diff --git a/drivers/staging/iio/gyro/adis16260_core.c b/drivers/staging/iio/gyro/adis16260_core.c
index 9571c03aa4cc..aa964a2d8290 100644
--- a/drivers/staging/iio/gyro/adis16260_core.c
+++ b/drivers/staging/iio/gyro/adis16260_core.c
@@ -498,28 +498,33 @@ static int adis16260_read_raw(struct iio_dev *indio_dev,
                 switch (chan->type) {
                 case IIO_ANGL_VEL:
                         *val = 0;
-                        if (spi_get_device_id(st->us)->driver_data)
-                                *val2 = 320;
-                        else
-                                *val2 = 1278;
+                        if (spi_get_device_id(st->us)->driver_data) {
+                                /* 0.01832 degree / sec */
+                                *val2 = IIO_DEGREE_TO_RAD(18320);
+                        } else {
+                                /* 0.07326 degree / sec */
+                                *val2 = IIO_DEGREE_TO_RAD(73260);
+                        }
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_VOLTAGE:
-                        *val = 0;
-                        if (chan->channel == 0)
-                                *val2 = 18315;
-                        else
-                                *val2 = 610500;
+                        if (chan->channel == 0) {
+                                *val = 1;
+                                *val2 = 831500; /* 1.8315 mV */
+                        } else {
+                                *val = 0;
+                                *val2 = 610500; /* 610.5 uV */
+                        }
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_TEMP:
-                        *val = 0;
-                        *val2 = 145300;
+                        *val = 145;
+                        *val2 = 300000; /* 0.1453 C */
                         return IIO_VAL_INT_PLUS_MICRO;
                 default:
                         return -EINVAL;
                 }
                 break;
         case IIO_CHAN_INFO_OFFSET:
-                *val = 25;
+                *val = 250000 / 1453; /* 25 C = 0x00 */
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_CALIBBIAS:
                 switch (chan->type) {
diff --git a/drivers/staging/iio/imu/adis16400.h b/drivers/staging/iio/imu/adis16400.h
index d59d7ac856a9..77c601da1846 100644
--- a/drivers/staging/iio/imu/adis16400.h
+++ b/drivers/staging/iio/imu/adis16400.h
@@ -139,6 +139,8 @@ struct adis16400_chip_info {
         const long flags;
         unsigned int gyro_scale_micro;
         unsigned int accel_scale_micro;
+        int temp_scale_nano;
+        int temp_offset;
         unsigned long default_scan_mask;
 };
 
diff --git a/drivers/staging/iio/imu/adis16400_core.c b/drivers/staging/iio/imu/adis16400_core.c
index b302c9ba2712..3144a7b1e1c4 100644
--- a/drivers/staging/iio/imu/adis16400_core.c
+++ b/drivers/staging/iio/imu/adis16400_core.c
@@ -553,10 +553,13 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_VOLTAGE:
                         *val = 0;
-                        if (chan->channel == 0)
-                                *val2 = 2418;
-                        else
-                                *val2 = 806;
+                        if (chan->channel == 0) {
+                                *val = 2;
+                                *val2 = 418000; /* 2.418 mV */
+                        } else {
+                                *val = 0;
+                                *val2 = 805800; /* 805.8 uV */
+                        }
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_ACCEL:
                         *val = 0;
@@ -564,11 +567,11 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_MAGN:
                         *val = 0;
-                        *val2 = 500;
+                        *val2 = 500; /* 0.5 mgauss */
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_TEMP:
-                        *val = 0;
-                        *val2 = 140000;
+                        *val = st->variant->temp_scale_nano / 1000000;
+                        *val2 = (st->variant->temp_scale_nano % 1000000);
                         return IIO_VAL_INT_PLUS_MICRO;
                 default:
                         return -EINVAL;
@@ -586,9 +589,8 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_OFFSET:
                 /* currently only temperature */
-                *val = 198;
-                *val2 = 160000;
-                return IIO_VAL_INT_PLUS_MICRO;
+                *val = st->variant->temp_offset;
+                return IIO_VAL_INT;
         case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY:
                 mutex_lock(&indio_dev->mlock);
                 /* Need both the number of taps and the sampling frequency */
@@ -1035,7 +1037,7 @@ static const struct iio_chan_spec adis16334_channels[] = {
                 .indexed = 1,
                 .channel = 0,
                 .info_mask = IIO_CHAN_INFO_RAW_SEPARATE_BIT |
-                IIO_CHAN_INFO_CALIBBIAS_SEPARATE_BIT |
+                IIO_CHAN_INFO_OFFSET_SEPARATE_BIT |
                 IIO_CHAN_INFO_SCALE_SHARED_BIT,
                 .address = temp0,
                 .scan_index = ADIS16400_SCAN_TEMP,
@@ -1058,8 +1060,10 @@ static struct adis16400_chip_info adis16400_chips[] = {
         [ADIS16300] = {
                 .channels = adis16300_channels,
                 .num_channels = ARRAY_SIZE(adis16300_channels),
-                .gyro_scale_micro = 873,
+                .gyro_scale_micro = IIO_DEGREE_TO_RAD(50000), /* 0.05 deg/s */
                 .accel_scale_micro = 5884,
+                .temp_scale_nano = 140000000, /* 0.14 C */
+                .temp_offset = 25000000 / 140000, /* 25 C = 0x00 */
                 .default_scan_mask = (1 << ADIS16400_SCAN_SUPPLY) |
                 (1 << ADIS16400_SCAN_GYRO_X) | (1 << ADIS16400_SCAN_ACC_X) |
                 (1 << ADIS16400_SCAN_ACC_Y) | (1 << ADIS16400_SCAN_ACC_Z) |
@@ -1070,8 +1074,10 @@ static struct adis16400_chip_info adis16400_chips[] = {
         [ADIS16334] = {
                 .channels = adis16334_channels,
                 .num_channels = ARRAY_SIZE(adis16334_channels),
-                .gyro_scale_micro = 873,
-                .accel_scale_micro = 981,
+                .gyro_scale_micro = IIO_DEGREE_TO_RAD(50000), /* 0.05 deg/s */
+                .accel_scale_micro = IIO_G_TO_M_S_2(1000), /* 1 mg */
+                .temp_scale_nano = 67850000, /* 0.06785 C */
+                .temp_offset = 25000000 / 67850, /* 25 C = 0x00 */
                 .default_scan_mask = (1 << ADIS16400_SCAN_GYRO_X) |
                 (1 << ADIS16400_SCAN_GYRO_Y) | (1 << ADIS16400_SCAN_GYRO_Z) |
                 (1 << ADIS16400_SCAN_ACC_X) | (1 << ADIS16400_SCAN_ACC_Y) |
@@ -1080,8 +1086,10 @@ static struct adis16400_chip_info adis16400_chips[] = {
         [ADIS16350] = {
                 .channels = adis16350_channels,
                 .num_channels = ARRAY_SIZE(adis16350_channels),
-                .gyro_scale_micro = 872664,
-                .accel_scale_micro = 24732,
+                .gyro_scale_micro = IIO_DEGREE_TO_RAD(73260), /* 0.07326 deg/s */
+                .accel_scale_micro = IIO_G_TO_M_S_2(2522), /* 0.002522 g */
+                .temp_scale_nano = 145300000, /* 0.1453 C */
+                .temp_offset = 25000000 / 145300, /* 25 C = 0x00 */
                 .default_scan_mask = 0x7FF,
                 .flags = ADIS16400_NO_BURST,
         },
@@ -1090,8 +1098,10 @@ static struct adis16400_chip_info adis16400_chips[] = {
                 .num_channels = ARRAY_SIZE(adis16350_channels),
                 .flags = ADIS16400_HAS_PROD_ID,
                 .product_id = 0x3FE8,
-                .gyro_scale_micro = 1279,
-                .accel_scale_micro = 24732,
+                .gyro_scale_micro = IIO_DEGREE_TO_RAD(50000), /* 0.05 deg/s */
+                .accel_scale_micro = IIO_G_TO_M_S_2(3333), /* 3.333 mg */
+                .temp_scale_nano = 136000000, /* 0.136 C */
+                .temp_offset = 25000000 / 136000, /* 25 C = 0x00 */
                 .default_scan_mask = 0x7FF,
         },
         [ADIS16362] = {
@@ -1099,8 +1109,10 @@ static struct adis16400_chip_info adis16400_chips[] = {
                 .num_channels = ARRAY_SIZE(adis16350_channels),
                 .flags = ADIS16400_HAS_PROD_ID,
                 .product_id = 0x3FEA,
-                .gyro_scale_micro = 1279,
-                .accel_scale_micro = 24732,
+                .gyro_scale_micro = IIO_DEGREE_TO_RAD(50000), /* 0.05 deg/s */
+                .accel_scale_micro = IIO_G_TO_M_S_2(333), /* 0.333 mg */
+                .temp_scale_nano = 136000000, /* 0.136 C */
+                .temp_offset = 25000000 / 136000, /* 25 C = 0x00 */
                 .default_scan_mask = 0x7FF,
         },
         [ADIS16364] = {
@@ -1108,8 +1120,10 @@ static struct adis16400_chip_info adis16400_chips[] = {
                 .num_channels = ARRAY_SIZE(adis16350_channels),
                 .flags = ADIS16400_HAS_PROD_ID,
                 .product_id = 0x3FEC,
-                .gyro_scale_micro = 1279,
-                .accel_scale_micro = 24732,
+                .gyro_scale_micro = IIO_DEGREE_TO_RAD(50000), /* 0.05 deg/s */
+                .accel_scale_micro = IIO_G_TO_M_S_2(1000), /* 1 mg */
+                .temp_scale_nano = 136000000, /* 0.136 C */
+                .temp_offset = 25000000 / 136000, /* 25 C = 0x00 */
                 .default_scan_mask = 0x7FF,
         },
         [ADIS16365] = {
@@ -1117,8 +1131,10 @@ static struct adis16400_chip_info adis16400_chips[] = {
                 .num_channels = ARRAY_SIZE(adis16350_channels),
                 .flags = ADIS16400_HAS_PROD_ID,
                 .product_id = 0x3FED,
-                .gyro_scale_micro = 1279,
-                .accel_scale_micro = 24732,
+                .gyro_scale_micro = IIO_DEGREE_TO_RAD(50000), /* 0.05 deg/s */
+                .accel_scale_micro = IIO_G_TO_M_S_2(1000), /* 1 mg */
+                .temp_scale_nano = 136000000, /* 0.136 C */
+                .temp_offset = 25000000 / 136000, /* 25 C = 0x00 */
                 .default_scan_mask = 0x7FF,
         },
         [ADIS16400] = {
@@ -1126,9 +1142,11 @@ static struct adis16400_chip_info adis16400_chips[] = {
                 .num_channels = ARRAY_SIZE(adis16400_channels),
                 .flags = ADIS16400_HAS_PROD_ID,
                 .product_id = 0x4015,
-                .gyro_scale_micro = 873,
-                .accel_scale_micro = 32656,
+                .gyro_scale_micro = IIO_DEGREE_TO_RAD(50000), /* 0.05 deg/s */
+                .accel_scale_micro = IIO_G_TO_M_S_2(3333), /* 3.333 mg */
                 .default_scan_mask = 0xFFF,
+                .temp_scale_nano = 140000000, /* 0.14 C */
+                .temp_offset = 25000000 / 140000, /* 25 C = 0x00 */
         }
 };
 
diff --git a/drivers/staging/ipack/bridges/tpci200.c b/drivers/staging/ipack/bridges/tpci200.c
index bb8aa70281cd..46d6657280b8 100644
--- a/drivers/staging/ipack/bridges/tpci200.c
+++ b/drivers/staging/ipack/bridges/tpci200.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include "tpci200.h"
 
 static u16 tpci200_status_timeout[] = {
diff --git a/drivers/staging/omapdrm/omap_gem.c b/drivers/staging/omapdrm/omap_gem.c
index 3434e6ec0142..66e2c2f8a239 100644
--- a/drivers/staging/omapdrm/omap_gem.c
+++ b/drivers/staging/omapdrm/omap_gem.c
@@ -246,7 +246,7 @@ static int omap_gem_attach_pages(struct drm_gem_object *obj)
          * DSS, GPU, etc. are not cache coherent:
          */
         if (omap_obj->flags & (OMAP_BO_WC|OMAP_BO_UNCACHED)) {
-                addrs = kmalloc(npages * sizeof(addrs), GFP_KERNEL);
+                addrs = kmalloc(npages * sizeof(*addrs), GFP_KERNEL);
                 if (!addrs) {
                         ret = -ENOMEM;
                         goto free_pages;
@@ -257,7 +257,7 @@ static int omap_gem_attach_pages(struct drm_gem_object *obj)
                                         0, PAGE_SIZE, DMA_BIDIRECTIONAL);
                 }
         } else {
-                addrs = kzalloc(npages * sizeof(addrs), GFP_KERNEL);
+                addrs = kzalloc(npages * sizeof(*addrs), GFP_KERNEL);
                 if (!addrs) {
                         ret = -ENOMEM;
                         goto free_pages;
diff --git a/drivers/staging/ramster/Kconfig b/drivers/staging/ramster/Kconfig
index 843c54101438..3abf6619dace 100644
--- a/drivers/staging/ramster/Kconfig
+++ b/drivers/staging/ramster/Kconfig
@@ -18,6 +18,7 @@ config ZCACHE2
 config RAMSTER
         bool "Cross-machine RAM capacity sharing, aka peer-to-peer tmem"
         depends on CONFIGFS_FS=y && SYSFS=y && !HIGHMEM && ZCACHE2=y
+        depends on NET
         # must ensure struct page is 8-byte aligned
         select HAVE_ALIGNED_STRUCT_PAGE if !64_BIT
         default n
diff --git a/drivers/staging/tidspbridge/core/tiomap3430.c b/drivers/staging/tidspbridge/core/tiomap3430.c
index 066a3ceec65e..f619fb3c56d2 100644
--- a/drivers/staging/tidspbridge/core/tiomap3430.c
+++ b/drivers/staging/tidspbridge/core/tiomap3430.c
@@ -126,7 +126,8 @@ static int mem_map_vmalloc(struct bridge_dev_context *dev_context,
                                   u32 ul_num_bytes,
                                   struct hw_mmu_map_attrs_t *hw_attrs);
 
-bool wait_for_start(struct bridge_dev_context *dev_context, u32 dw_sync_addr);
+bool wait_for_start(struct bridge_dev_context *dev_context,
+                        void __iomem *sync_addr);
 
 /*  ----------------------------------- Globals */
 
@@ -363,10 +364,11 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
 {
         int status = 0;
         struct bridge_dev_context *dev_context = dev_ctxt;
-        u32 dw_sync_addr = 0;
+        void __iomem *sync_addr;
         u32 ul_shm_base;        /* Gpp Phys SM base addr(byte) */
         u32 ul_shm_base_virt;   /* Dsp Virt SM base addr */
         u32 ul_tlb_base_virt;   /* Base of MMU TLB entry */
+        u32 shm_sync_pa;
         /* Offset of shm_base_virt from tlb_base_virt */
         u32 ul_shm_offset_virt;
         s32 entry_ndx;
@@ -397,15 +399,22 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
         /* Kernel logical address */
         ul_shm_base = dev_context->atlb_entry[0].gpp_va + ul_shm_offset_virt;
 
+        /* SHM physical sync address */
+        shm_sync_pa = dev_context->atlb_entry[0].gpp_pa + ul_shm_offset_virt +
+                        SHMSYNCOFFSET;
+
         /* 2nd wd is used as sync field */
-        dw_sync_addr = ul_shm_base + SHMSYNCOFFSET;
+        sync_addr = ioremap(shm_sync_pa, SZ_32);
+        if (!sync_addr)
+                return -ENOMEM;
+
         /* Write a signature into the shm base + offset; this will
          * get cleared when the DSP program starts. */
         if ((ul_shm_base_virt == 0) || (ul_shm_base == 0)) {
                 pr_err("%s: Illegal SM base\n", __func__);
                 status = -EPERM;
         } else
-                __raw_writel(0xffffffff, dw_sync_addr);
+                __raw_writel(0xffffffff, sync_addr);
 
         if (!status) {
                 resources = dev_context->resources;
@@ -419,8 +428,10 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
                          * function is made available.
                          */
                         void __iomem *ctrl = ioremap(0x48002000, SZ_4K);
-                        if (!ctrl)
+                        if (!ctrl) {
+                                iounmap(sync_addr);
                                 return -ENOMEM;
+                        }
 
                         (*pdata->dsp_prm_rmw_bits)(OMAP3430_RST1_IVA2_MASK,
                                         OMAP3430_RST1_IVA2_MASK, OMAP3430_IVA2_MOD,
@@ -588,15 +599,15 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
                 (*pdata->dsp_prm_rmw_bits)(OMAP3430_RST1_IVA2_MASK, 0,
                                         OMAP3430_IVA2_MOD, OMAP2_RM_RSTCTRL);
 
-                dev_dbg(bridge, "Waiting for Sync @ 0x%x\n", dw_sync_addr);
+                dev_dbg(bridge, "Waiting for Sync @ 0x%x\n", *(u32 *)sync_addr);
                 dev_dbg(bridge, "DSP c_int00 Address =  0x%x\n", dsp_addr);
                 if (dsp_debug)
-                        while (__raw_readw(dw_sync_addr))
+                        while (__raw_readw(sync_addr))
                                 ;
 
                 /* Wait for DSP to clear word in shared memory */
                 /* Read the Location */
-                if (!wait_for_start(dev_context, dw_sync_addr))
+                if (!wait_for_start(dev_context, sync_addr))
                         status = -ETIMEDOUT;
 
                 dev_get_symbol(dev_context->dev_obj, "_WDT_enable", &wdt_en);
@@ -612,7 +623,7 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
                         /* Write the synchronization bit to indicate the
                          * completion of OPP table update to DSP
                          */
-                        __raw_writel(0XCAFECAFE, dw_sync_addr);
+                        __raw_writel(0XCAFECAFE, sync_addr);
 
                         /* update board state */
                         dev_context->brd_state = BRD_RUNNING;
@@ -621,6 +632,9 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
                         dev_context->brd_state = BRD_UNKNOWN;
                 }
         }
+
+        iounmap(sync_addr);
+
         return status;
 }
 
@@ -1796,12 +1810,13 @@ static int mem_map_vmalloc(struct bridge_dev_context *dev_context,
  *  ======== wait_for_start ========
  *      Wait for the singal from DSP that it has started, or time out.
  */
-bool wait_for_start(struct bridge_dev_context *dev_context, u32 dw_sync_addr)
+bool wait_for_start(struct bridge_dev_context *dev_context,
+                        void __iomem *sync_addr)
 {
         u16 timeout = TIHELEN_ACKTIMEOUT;
 
         /*  Wait for response from board */
-        while (__raw_readw(dw_sync_addr) && --timeout)
+        while (__raw_readw(sync_addr) && --timeout)
                 udelay(10);
 
         /*  If timed out: return false */
diff --git a/drivers/staging/tidspbridge/hw/hw_mmu.c b/drivers/staging/tidspbridge/hw/hw_mmu.c
index 71cb82293649..50244a474178 100644
--- a/drivers/staging/tidspbridge/hw/hw_mmu.c
+++ b/drivers/staging/tidspbridge/hw/hw_mmu.c
@@ -48,37 +48,12 @@ enum hw_mmu_page_size_t {
 };
 
 /*
- * FUNCTION           : mmu_flush_entry
- *
- * INPUTS:
- *
- *       Identifier      : base_address
- *       Type           : const u32
- *       Description     : Base Address of instance of MMU module
- *
- * RETURNS:
- *
- *       Type           : hw_status
- *       Description     : 0             -- No errors occurred
- *                       RET_BAD_NULL_PARAM     -- A Pointer
- *                                              Parameter was set to NULL
- *
- * PURPOSE:           : Flush the TLB entry pointed by the
- *                      lock counter register
- *                      even if this entry is set protected
- *
- * METHOD:             : Check the Input parameter and Flush a
- *                       single entry in the TLB.
- */
-static hw_status mmu_flush_entry(const void __iomem *base_address);
-
-/*
  * FUNCTION           : mmu_set_cam_entry
  *
  * INPUTS:
  *
  *       Identifier      : base_address
- *       TypE           : const u32
+ *       Type            : void __iomem *
  *       Description     : Base Address of instance of MMU module
  *
  *       Identifier      : page_sz
@@ -112,7 +87,7 @@ static hw_status mmu_flush_entry(const void __iomem *base_address);
  *
  * METHOD:              : Check the Input parameters and set the CAM entry.
  */
-static hw_status mmu_set_cam_entry(const void __iomem *base_address,
+static hw_status mmu_set_cam_entry(void __iomem *base_address,
                                    const u32 page_sz,
                                    const u32 preserved_bit,
                                    const u32 valid_bit,
@@ -124,7 +99,7 @@ static hw_status mmu_set_cam_entry(const void __iomem *base_address,
  * INPUTS:
  *
  *       Identifier      : base_address
- *       Type           : const u32
+ *       Type            : void __iomem *
  *       Description     : Base Address of instance of MMU module
  *
  *       Identifier      : physical_addr
@@ -157,7 +132,7 @@ static hw_status mmu_set_cam_entry(const void __iomem *base_address,
  *
  * METHOD:             : Check the Input parameters and set the RAM entry.
  */
-static hw_status mmu_set_ram_entry(const void __iomem *base_address,
+static hw_status mmu_set_ram_entry(void __iomem *base_address,
                                    const u32 physical_addr,
                                    enum hw_endianism_t endianism,
                                    enum hw_element_size_t element_size,
@@ -165,7 +140,7 @@ static hw_status mmu_set_ram_entry(const void __iomem *base_address,
 
 /* HW FUNCTIONS */
 
-hw_status hw_mmu_enable(const void __iomem *base_address)
+hw_status hw_mmu_enable(void __iomem *base_address)
 {
         hw_status status = 0;
 
@@ -174,7 +149,7 @@ hw_status hw_mmu_enable(const void __iomem *base_address)
         return status;
 }
 
-hw_status hw_mmu_disable(const void __iomem *base_address)
+hw_status hw_mmu_disable(void __iomem *base_address)
 {
         hw_status status = 0;
 
@@ -183,7 +158,7 @@ hw_status hw_mmu_disable(const void __iomem *base_address)
         return status;
 }
 
-hw_status hw_mmu_num_locked_set(const void __iomem *base_address,
+hw_status hw_mmu_num_locked_set(void __iomem *base_address,
                                 u32 num_locked_entries)
 {
         hw_status status = 0;
@@ -193,7 +168,7 @@ hw_status hw_mmu_num_locked_set(const void __iomem *base_address,
         return status;
 }
 
-hw_status hw_mmu_victim_num_set(const void __iomem *base_address,
+hw_status hw_mmu_victim_num_set(void __iomem *base_address,
                                 u32 victim_entry_num)
 {
         hw_status status = 0;
@@ -203,7 +178,7 @@ hw_status hw_mmu_victim_num_set(const void __iomem *base_address,
         return status;
 }
 
-hw_status hw_mmu_event_ack(const void __iomem *base_address, u32 irq_mask)
+hw_status hw_mmu_event_ack(void __iomem *base_address, u32 irq_mask)
 {
         hw_status status = 0;
 
@@ -212,7 +187,7 @@ hw_status hw_mmu_event_ack(const void __iomem *base_address, u32 irq_mask)
         return status;
 }
 
-hw_status hw_mmu_event_disable(const void __iomem *base_address, u32 irq_mask)
+hw_status hw_mmu_event_disable(void __iomem *base_address, u32 irq_mask)
 {
         hw_status status = 0;
         u32 irq_reg;
@@ -224,7 +199,7 @@ hw_status hw_mmu_event_disable(const void __iomem *base_address, u32 irq_mask)
         return status;
 }
 
-hw_status hw_mmu_event_enable(const void __iomem *base_address, u32 irq_mask)
+hw_status hw_mmu_event_enable(void __iomem *base_address, u32 irq_mask)
 {
         hw_status status = 0;
         u32 irq_reg;
@@ -236,7 +211,7 @@ hw_status hw_mmu_event_enable(const void __iomem *base_address, u32 irq_mask)
         return status;
 }
 
-hw_status hw_mmu_event_status(const void __iomem *base_address, u32 *irq_mask)
+hw_status hw_mmu_event_status(void __iomem *base_address, u32 *irq_mask)
 {
         hw_status status = 0;
 
@@ -245,7 +220,7 @@ hw_status hw_mmu_event_status(const void __iomem *base_address, u32 *irq_mask)
         return status;
 }
 
-hw_status hw_mmu_fault_addr_read(const void __iomem *base_address, u32 *addr)
+hw_status hw_mmu_fault_addr_read(void __iomem *base_address, u32 *addr)
 {
         hw_status status = 0;
 
@@ -255,7 +230,7 @@ hw_status hw_mmu_fault_addr_read(const void __iomem *base_address, u32 *addr)
         return status;
 }
 
-hw_status hw_mmu_ttb_set(const void __iomem *base_address, u32 ttb_phys_addr)
+hw_status hw_mmu_ttb_set(void __iomem *base_address, u32 ttb_phys_addr)
 {
         hw_status status = 0;
         u32 load_ttb;
@@ -267,7 +242,7 @@ hw_status hw_mmu_ttb_set(const void __iomem *base_address, u32 ttb_phys_addr)
         return status;
 }
 
-hw_status hw_mmu_twl_enable(const void __iomem *base_address)
+hw_status hw_mmu_twl_enable(void __iomem *base_address)
 {
         hw_status status = 0;
 
@@ -276,7 +251,7 @@ hw_status hw_mmu_twl_enable(const void __iomem *base_address)
         return status;
 }
 
-hw_status hw_mmu_twl_disable(const void __iomem *base_address)
+hw_status hw_mmu_twl_disable(void __iomem *base_address)
 {
         hw_status status = 0;
 
@@ -285,45 +260,7 @@ hw_status hw_mmu_twl_disable(const void __iomem *base_address)
         return status;
 }
 
-hw_status hw_mmu_tlb_flush(const void __iomem *base_address, u32 virtual_addr,
-                           u32 page_sz)
-{
-        hw_status status = 0;
-        u32 virtual_addr_tag;
-        enum hw_mmu_page_size_t pg_size_bits;
-
-        switch (page_sz) {
-        case HW_PAGE_SIZE4KB:
-                pg_size_bits = HW_MMU_SMALL_PAGE;
-                break;
-
-        case HW_PAGE_SIZE64KB:
-                pg_size_bits = HW_MMU_LARGE_PAGE;
-                break;
-
-        case HW_PAGE_SIZE1MB:
-                pg_size_bits = HW_MMU_SECTION;
-                break;
-
-        case HW_PAGE_SIZE16MB:
-                pg_size_bits = HW_MMU_SUPERSECTION;
-                break;
-
-        default:
-                return -EINVAL;
-        }
-
-        /* Generate the 20-bit tag from virtual address */
-        virtual_addr_tag = ((virtual_addr & MMU_ADDR_MASK) >> 12);
-
-        mmu_set_cam_entry(base_address, pg_size_bits, 0, 0, virtual_addr_tag);
-
-        mmu_flush_entry(base_address);
-
-        return status;
-}
-
-hw_status hw_mmu_tlb_add(const void __iomem *base_address,
+hw_status hw_mmu_tlb_add(void __iomem *base_address,
                          u32 physical_addr,
                          u32 virtual_addr,
                          u32 page_sz,
@@ -503,20 +440,8 @@ hw_status hw_mmu_pte_clear(const u32 pg_tbl_va, u32 virtual_addr, u32 page_size)
         return status;
 }
 
-/* mmu_flush_entry */
-static hw_status mmu_flush_entry(const void __iomem *base_address)
-{
-        hw_status status = 0;
-        u32 flush_entry_data = 0x1;
-
-        /* write values to register */
-        MMUMMU_FLUSH_ENTRY_WRITE_REGISTER32(base_address, flush_entry_data);
-
-        return status;
-}
-
 /* mmu_set_cam_entry */
-static hw_status mmu_set_cam_entry(const void __iomem *base_address,
+static hw_status mmu_set_cam_entry(void __iomem *base_address,
                                    const u32 page_sz,
                                    const u32 preserved_bit,
                                    const u32 valid_bit,
@@ -536,7 +461,7 @@ static hw_status mmu_set_cam_entry(const void __iomem *base_address,
 }
 
 /* mmu_set_ram_entry */
-static hw_status mmu_set_ram_entry(const void __iomem *base_address,
+static hw_status mmu_set_ram_entry(void __iomem *base_address,
                                    const u32 physical_addr,
                                    enum hw_endianism_t endianism,
                                    enum hw_element_size_t element_size,
@@ -556,7 +481,7 @@ static hw_status mmu_set_ram_entry(const void __iomem *base_address,
 
 }
 
-void hw_mmu_tlb_flush_all(const void __iomem *base)
+void hw_mmu_tlb_flush_all(void __iomem *base)
 {
         __raw_writel(1, base + MMU_GFLUSH);
 }
diff --git a/drivers/staging/tidspbridge/hw/hw_mmu.h b/drivers/staging/tidspbridge/hw/hw_mmu.h
index 1458a2c6027b..1c50bb36edfe 100644
--- a/drivers/staging/tidspbridge/hw/hw_mmu.h
+++ b/drivers/staging/tidspbridge/hw/hw_mmu.h
@@ -42,44 +42,41 @@ struct hw_mmu_map_attrs_t {
         bool donotlockmpupage;
 };
 
-extern hw_status hw_mmu_enable(const void __iomem *base_address);
+extern hw_status hw_mmu_enable(void __iomem *base_address);
 
-extern hw_status hw_mmu_disable(const void __iomem *base_address);
+extern hw_status hw_mmu_disable(void __iomem *base_address);
 
-extern hw_status hw_mmu_num_locked_set(const void __iomem *base_address,
+extern hw_status hw_mmu_num_locked_set(void __iomem *base_address,
                                        u32 num_locked_entries);
 
-extern hw_status hw_mmu_victim_num_set(const void __iomem *base_address,
+extern hw_status hw_mmu_victim_num_set(void __iomem *base_address,
                                        u32 victim_entry_num);
 
 /* For MMU faults */
-extern hw_status hw_mmu_event_ack(const void __iomem *base_address,
+extern hw_status hw_mmu_event_ack(void __iomem *base_address,
                                   u32 irq_mask);
 
-extern hw_status hw_mmu_event_disable(const void __iomem *base_address,
+extern hw_status hw_mmu_event_disable(void __iomem *base_address,
                                       u32 irq_mask);
 
-extern hw_status hw_mmu_event_enable(const void __iomem *base_address,
+extern hw_status hw_mmu_event_enable(void __iomem *base_address,
                                      u32 irq_mask);
 
-extern hw_status hw_mmu_event_status(const void __iomem *base_address,
+extern hw_status hw_mmu_event_status(void __iomem *base_address,
                                      u32 *irq_mask);
 
-extern hw_status hw_mmu_fault_addr_read(const void __iomem *base_address,
+extern hw_status hw_mmu_fault_addr_read(void __iomem *base_address,
                                         u32 *addr);
 
 /* Set the TT base address */
-extern hw_status hw_mmu_ttb_set(const void __iomem *base_address,
+extern hw_status hw_mmu_ttb_set(void __iomem *base_address,
                                 u32 ttb_phys_addr);
 
-extern hw_status hw_mmu_twl_enable(const void __iomem *base_address);
+extern hw_status hw_mmu_twl_enable(void __iomem *base_address);
 
-extern hw_status hw_mmu_twl_disable(const void __iomem *base_address);
+extern hw_status hw_mmu_twl_disable(void __iomem *base_address);
 
-extern hw_status hw_mmu_tlb_flush(const void __iomem *base_address,
-                                  u32 virtual_addr, u32 page_sz);
-
-extern hw_status hw_mmu_tlb_add(const void __iomem *base_address,
+extern hw_status hw_mmu_tlb_add(void __iomem *base_address,
                                 u32 physical_addr,
                                 u32 virtual_addr,
                                 u32 page_sz,
@@ -97,7 +94,7 @@ extern hw_status hw_mmu_pte_set(const u32 pg_tbl_va,
 extern hw_status hw_mmu_pte_clear(const u32 pg_tbl_va,
                                   u32 virtual_addr, u32 page_size);
 
-void hw_mmu_tlb_flush_all(const void __iomem *base);
+void hw_mmu_tlb_flush_all(void __iomem *base);
 
 static inline u32 hw_mmu_pte_addr_l1(u32 l1_base, u32 va)
 {
diff --git a/drivers/staging/tidspbridge/include/dspbridge/cfgdefs.h b/drivers/staging/tidspbridge/include/dspbridge/cfgdefs.h
index 60a278136bdf..b32c75673ab4 100644
--- a/drivers/staging/tidspbridge/include/dspbridge/cfgdefs.h
+++ b/drivers/staging/tidspbridge/include/dspbridge/cfgdefs.h
@@ -53,8 +53,8 @@ struct cfg_hostres {
         u32 chnl_buf_size;
         u32 num_chnls;
         void __iomem *per_base;
-        u32 per_pm_base;
-        u32 core_pm_base;
+        void __iomem *per_pm_base;
+        void __iomem *core_pm_base;
         void __iomem *dmmu_base;
 };
 
diff --git a/drivers/staging/tidspbridge/include/dspbridge/host_os.h b/drivers/staging/tidspbridge/include/dspbridge/host_os.h
index ed00d3da3205..5e2f4d82d925 100644
--- a/drivers/staging/tidspbridge/include/dspbridge/host_os.h
+++ b/drivers/staging/tidspbridge/include/dspbridge/host_os.h
@@ -47,8 +47,8 @@
 #include <asm/cacheflush.h>
 #include <linux/dma-mapping.h>
 
-/* TODO -- Remove, once BP defines them */
-#define INT_DSP_MMU_IRQ        28
+/* TODO -- Remove, once omap-iommu is used */
+#define INT_DSP_MMU_IRQ        (28 + NR_IRQS)
 
 #define PRCM_VDD1 1
 
diff --git a/drivers/staging/tidspbridge/rmgr/drv.c b/drivers/staging/tidspbridge/rmgr/drv.c
index 6795205b0155..db1da28cecba 100644
--- a/drivers/staging/tidspbridge/rmgr/drv.c
+++ b/drivers/staging/tidspbridge/rmgr/drv.c
@@ -667,10 +667,10 @@ int drv_request_bridge_res_dsp(void **phost_resources)
                                                          OMAP_DSP_MEM3_SIZE);
                 host_res->per_base = ioremap(OMAP_PER_CM_BASE,
                                                 OMAP_PER_CM_SIZE);
-                host_res->per_pm_base = (u32) ioremap(OMAP_PER_PRM_BASE,
-                                                         OMAP_PER_PRM_SIZE);
-                host_res->core_pm_base = (u32) ioremap(OMAP_CORE_PRM_BASE,
-                                                          OMAP_CORE_PRM_SIZE);
+                host_res->per_pm_base = ioremap(OMAP_PER_PRM_BASE,
+                                                OMAP_PER_PRM_SIZE);
+                host_res->core_pm_base = ioremap(OMAP_CORE_PRM_BASE,
+                                                        OMAP_CORE_PRM_SIZE);
                 host_res->dmmu_base = ioremap(OMAP_DMMU_BASE,
                                                  OMAP_DMMU_SIZE);
 
diff --git a/drivers/staging/tidspbridge/rmgr/node.c b/drivers/staging/tidspbridge/rmgr/node.c
index c2fc6137c770..294e9b40f516 100644
--- a/drivers/staging/tidspbridge/rmgr/node.c
+++ b/drivers/staging/tidspbridge/rmgr/node.c
@@ -304,8 +304,7 @@ int node_allocate(struct proc_object *hprocessor,
         u32 pul_value;
         u32 dynext_base;
         u32 off_set = 0;
-        u32 ul_stack_seg_addr, ul_stack_seg_val;
-        u32 ul_gpp_mem_base;
+        u32 ul_stack_seg_val;
         struct cfg_hostres *host_res;
         struct bridge_dev_context *pbridge_context;
         u32 mapped_addr = 0;
@@ -581,6 +580,9 @@ func_cont:
                 if (strcmp((char *)
                            pnode->dcd_props.obj_data.node_obj.ndb_props.
                            stack_seg_name, STACKSEGLABEL) == 0) {
+                        void __iomem *stack_seg;
+                        u32 stack_seg_pa;
+
                         status =
                             hnode_mgr->nldr_fxns.
                             get_fxn_addr(pnode->nldr_node_obj, "DYNEXT_BEG",
@@ -608,14 +610,21 @@ func_cont:
                                 goto func_end;
                         }
 
-                        ul_gpp_mem_base = (u32) host_res->mem_base[1];
                         off_set = pul_value - dynext_base;
-                        ul_stack_seg_addr = ul_gpp_mem_base + off_set;
-                        ul_stack_seg_val = readl(ul_stack_seg_addr);
+                        stack_seg_pa = host_res->mem_phys[1] + off_set;
+                        stack_seg = ioremap(stack_seg_pa, SZ_32);
+                        if (!stack_seg) {
+                                status = -ENOMEM;
+                                goto func_end;
+                        }
+
+                        ul_stack_seg_val = readl(stack_seg);
+
+                        iounmap(stack_seg);
 
                         dev_dbg(bridge, "%s: StackSegVal = 0x%x, StackSegAddr ="
                                 " 0x%x\n", __func__, ul_stack_seg_val,
-                                ul_stack_seg_addr);
+                                host_res->mem_base[1] + off_set);
 
                         pnode->create_args.asa.task_arg_obj.stack_seg =
                             ul_stack_seg_val;
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index 653b074035f7..6edefde23722 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -223,8 +223,13 @@ static int zram_bvec_read(struct zram *zram, struct bio_vec *bvec,
         cmem = zs_map_object(zram->mem_pool, zram->table[index].handle,
                                 ZS_MM_RO);
 
-        ret = lzo1x_decompress_safe(cmem, zram->table[index].size,
+        if (zram->table[index].size == PAGE_SIZE) {
+                memcpy(uncmem, cmem, PAGE_SIZE);
+                ret = LZO_E_OK;
+        } else {
+                ret = lzo1x_decompress_safe(cmem, zram->table[index].size,
                                     uncmem, &clen);
+        }
 
         if (is_partial_io(bvec)) {
                 memcpy(user_mem + bvec->bv_offset, uncmem + offset,
@@ -342,8 +347,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
                 goto out;
         }
 
-        if (unlikely(clen > max_zpage_size))
+        if (unlikely(clen > max_zpage_size)) {
                 zram_stat_inc(&zram->stats.bad_compress);
+                src = uncmem;
+                clen = PAGE_SIZE;
+        }
 
         handle = zs_malloc(zram->mem_pool, clen);
         if (!handle) {
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index 478383d3d9c9..c34735cf6276 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -671,19 +671,19 @@ serial_omap_configure_xonxoff
 
         /*
          * IXON Flag:
-         * Flow control for OMAP.TX
-         * OMAP.RX should listen for XON/XOFF
+         * Enable XON/XOFF flow control on output.
+         * Transmit XON1, XOFF1
          */
         if (termios->c_iflag & IXON)
-                up->efr |= OMAP_UART_SW_RX;
+                up->efr |= OMAP_UART_SW_TX;
 
         /*
          * IXOFF Flag:
-         * Flow control for OMAP.RX
-         * OMAP.TX should send XON/XOFF
+         * Enable XON/XOFF flow control on input.
+         * Receiver compares XON1, XOFF1.
          */
         if (termios->c_iflag & IXOFF)
-                up->efr |= OMAP_UART_SW_TX;
+                up->efr |= OMAP_UART_SW_RX;
 
         serial_out(up, UART_EFR, up->efr | UART_EFR_ECB);
         serial_out(up, UART_LCR, UART_LCR_CONF_MODE_A);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 64854d76f529..1af04bdeaf0c 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -739,13 +739,16 @@ static void hub_tt_work(struct work_struct *work)
         int                     limit = 100;
 
         spin_lock_irqsave (&hub->tt.lock, flags);
-        while (--limit && !list_empty (&hub->tt.clear_list)) {
+        while (!list_empty(&hub->tt.clear_list)) {
                 struct list_head        *next;
                 struct usb_tt_clear     *clear;
                 struct usb_device       *hdev = hub->hdev;
                 const struct hc_driver  *drv;
                 int                     status;
 
+                if (!hub->quiescing && --limit < 0)
+                        break;
+
                 next = hub->tt.clear_list.next;
                 clear = list_entry (next, struct usb_tt_clear, clear_list);
                 list_del (&clear->clear_list);
@@ -1210,7 +1213,7 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
         if (hub->has_indicators)
                 cancel_delayed_work_sync(&hub->leds);
         if (hub->tt.hub)
-                cancel_work_sync(&hub->tt.clear_work);
+                flush_work(&hub->tt.clear_work);
 }
 
 /* caller has locked the hub device */
diff --git a/drivers/usb/gadget/net2272.c b/drivers/usb/gadget/net2272.c
index 43ac7482fa91..c009263a47e3 100644
--- a/drivers/usb/gadget/net2272.c
+++ b/drivers/usb/gadget/net2272.c
@@ -2069,8 +2069,10 @@ static irqreturn_t net2272_irq(int irq, void *_dev)
 #if defined(PLX_PCI_RDK2)
         /* see if PCI int for us by checking irqstat */
         intcsr = readl(dev->rdk2.fpga_base_addr + RDK2_IRQSTAT);
-        if (!intcsr & (1 << NET2272_PCI_IRQ))
+        if (!intcsr & (1 << NET2272_PCI_IRQ)) {
+                spin_unlock(&dev->lock);
                 return IRQ_NONE;
+        }
         /* check dma interrupts */
 #endif
         /* Platform/devcice interrupt handler */
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 966d1484ee79..39f9e4a9a2d3 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -545,7 +545,14 @@ static const struct dmi_system_id __devinitconst ehci_dmi_nohandoff_table[] = {
                 /*  Pegatron Lucid (Ordissimo AIRIS) */
                 .matches = {
                         DMI_MATCH(DMI_BOARD_NAME, "M11JB"),
-                        DMI_MATCH(DMI_BIOS_VERSION, "Lucid-GE-133"),
+                        DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"),
+                },
+        },
+        {
+                /*  Pegatron Lucid (Ordissimo) */
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_NAME, "Ordissimo"),
+                        DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"),
                 },
         },
         { }
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index 4b436f5a4171..5f3a7c74aa8d 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -544,7 +544,6 @@ void xhci_dbg_ctx(struct xhci_hcd *xhci,
         int i;
         /* Fields are 32 bits wide, DMA addresses are in bytes */
         int field_size = 32 / 8;
-        struct xhci_slot_ctx *slot_ctx;
         dma_addr_t dma = ctx->dma;
         int csz = HCC_64BYTE_CONTEXT(xhci->hcc_params);
 
@@ -570,7 +569,6 @@ void xhci_dbg_ctx(struct xhci_hcd *xhci,
                         dbg_rsvd64(xhci, (u64 *)ctrl_ctx, dma);
         }
 
-        slot_ctx = xhci_get_slot_ctx(xhci, ctx);
         xhci_dbg_slot_ctx(xhci, ctx);
         xhci_dbg_ep_ctx(xhci, ctx, last_ep);
 }
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index aa90ad4d4fd5..a686cf4905bb 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -151,9 +151,8 @@ static void xhci_usb3_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci,
                 if (portsc & PORT_DEV_REMOVE)
                         port_removable |= 1 << (i + 1);
         }
-        memset(&desc->u.ss.DeviceRemovable,
-                        (__force __u16) cpu_to_le16(port_removable),
-                        sizeof(__u16));
+
+        desc->u.ss.DeviceRemovable = cpu_to_le16(port_removable);
 }
 
 static void xhci_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci,
@@ -809,11 +808,13 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                         temp = xhci_readl(xhci, port_array[wIndex]);
                         xhci_dbg(xhci, "set port power, actual port %d status  = 0x%x\n", wIndex, temp);
 
+                        spin_unlock_irqrestore(&xhci->lock, flags);
                         temp = usb_acpi_power_manageable(hcd->self.root_hub,
                                         wIndex);
                         if (temp)
                                 usb_acpi_set_power_state(hcd->self.root_hub,
                                                 wIndex, true);
+                        spin_lock_irqsave(&xhci->lock, flags);
                         break;
                 case USB_PORT_FEAT_RESET:
                         temp = (temp | PORT_RESET);
@@ -917,11 +918,13 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                         xhci_writel(xhci, temp & ~PORT_POWER,
                                 port_array[wIndex]);
 
+                        spin_unlock_irqrestore(&xhci->lock, flags);
                         temp = usb_acpi_power_manageable(hcd->self.root_hub,
                                         wIndex);
                         if (temp)
                                 usb_acpi_set_power_state(hcd->self.root_hub,
                                                 wIndex, false);
+                        spin_lock_irqsave(&xhci->lock, flags);
                         break;
                 default:
                         goto error;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index c6ebb176dc4f..4e1a8946b8d1 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1228,6 +1228,17 @@ static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd)
         cur_seg = find_trb_seg(xhci->cmd_ring->first_seg,
                         xhci->cmd_ring->dequeue, &cycle_state);
 
+        if (!cur_seg) {
+                xhci_warn(xhci, "Command ring mismatch, dequeue = %p %llx (dma)\n",
+                                xhci->cmd_ring->dequeue,
+                                (unsigned long long)
+                                xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
+                                        xhci->cmd_ring->dequeue));
+                xhci_debug_ring(xhci, xhci->cmd_ring);
+                xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring);
+                return;
+        }
+
         /* find the command trb matched by cd from command ring */
         for (cmd_trb = xhci->cmd_ring->dequeue;
                         cmd_trb != xhci->cmd_ring->enqueue;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 7d462bf20092..c9e419f29b74 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1627,7 +1627,6 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
         struct xhci_hcd *xhci;
         struct xhci_container_ctx *in_ctx, *out_ctx;
         unsigned int ep_index;
-        struct xhci_ep_ctx *ep_ctx;
         struct xhci_slot_ctx *slot_ctx;
         struct xhci_input_control_ctx *ctrl_ctx;
         u32 added_ctxs;
@@ -1663,7 +1662,6 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
         out_ctx = virt_dev->out_ctx;
         ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
         ep_index = xhci_get_endpoint_index(&ep->desc);
-        ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
 
         /* If this endpoint is already in use, and the upper layers are trying
          * to add it again without dropping it, reject the addition.
@@ -1817,6 +1815,8 @@ static int xhci_evaluate_context_result(struct xhci_hcd *xhci,
         case COMP_EBADSLT:
                 dev_warn(&udev->dev, "WARN: slot not enabled for"
                                 "evaluate context command.\n");
+                ret = -EINVAL;
+                break;
         case COMP_CTX_STATE:
                 dev_warn(&udev->dev, "WARN: invalid context state for "
                                 "evaluate context command.\n");
@@ -4021,7 +4021,7 @@ int xhci_update_device(struct usb_hcd *hcd, struct usb_device *udev)
 static unsigned long long xhci_service_interval_to_ns(
                 struct usb_endpoint_descriptor *desc)
 {
-        return (1 << (desc->bInterval - 1)) * 125 * 1000;
+        return (1ULL << (desc->bInterval - 1)) * 125 * 1000;
 }
 
 static u16 xhci_get_timeout_no_hub_lpm(struct usb_device *udev,
@@ -4142,7 +4142,7 @@ static u16 xhci_calculate_intel_u2_timeout(struct usb_device *udev,
                         (xhci_service_interval_to_ns(desc) > timeout_ns))
                 timeout_ns = xhci_service_interval_to_ns(desc);
 
-        u2_del_ns = udev->bos->ss_cap->bU2DevExitLat * 1000;
+        u2_del_ns = le16_to_cpu(udev->bos->ss_cap->bU2DevExitLat) * 1000ULL;
         if (u2_del_ns > timeout_ns)
                 timeout_ns = u2_del_ns;
 
diff --git a/drivers/usb/misc/ezusb.c b/drivers/usb/misc/ezusb.c
index 4223d761223d..6589268a6515 100644
--- a/drivers/usb/misc/ezusb.c
+++ b/drivers/usb/misc/ezusb.c
@@ -158,3 +158,4 @@ int ezusb_fx2_ihex_firmware_download(struct usb_device *dev,
 }
 EXPORT_SYMBOL_GPL(ezusb_fx2_ihex_firmware_download);
 
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 444346e1e10d..ff5f112053d2 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -458,11 +458,11 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id)
         struct platform_device  *musb;
         struct resource *res;
         struct resource resources[2];
-        char res_name[10];
+        char res_name[11];
         int ret, musbid;
 
         /* get memory resource */
-        sprintf(res_name, "musb%d", id);
+        snprintf(res_name, sizeof(res_name), "musb%d", id);
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM, res_name);
         if (!res) {
                 dev_err(dev, "%s get mem resource failed\n", res_name);
@@ -473,7 +473,7 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id)
         resources[0] = *res;
 
         /* get irq resource */
-        sprintf(res_name, "musb%d-irq", id);
+        snprintf(res_name, sizeof(res_name), "musb%d-irq", id);
         res = platform_get_resource_byname(pdev, IORESOURCE_IRQ, res_name);
         if (!res) {
                 dev_err(dev, "%s get irq resource failed\n", res_name);
@@ -530,7 +530,7 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id)
 
                 of_property_read_u32(np, "num-eps", (u32 *)&config->num_eps);
                 of_property_read_u32(np, "ram-bits", (u32 *)&config->ram_bits);
-                sprintf(res_name, "port%d-mode", id);
+                snprintf(res_name, sizeof(res_name), "port%d-mode", id);
                 of_property_read_u32(np, res_name, (u32 *)&pdata->mode);
                 of_property_read_u32(np, "power", (u32 *)&pdata->power);
                 config->multipoint = of_property_read_bool(np, "multipoint");
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 143c4e9e1be4..c021b202c0f3 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -795,6 +795,7 @@ static void xfer_work(struct work_struct *work)
         dev_dbg(dev, "  %s %d (%d/ %d)\n",
                 fifo->name, usbhs_pipe_number(pipe), pkt->length, pkt->zero);
 
+        usbhs_pipe_enable(pipe);
         usbhsf_dma_start(pipe, fifo);
         dma_async_issue_pending(chan);
 }
diff --git a/drivers/usb/renesas_usbhs/mod_host.c b/drivers/usb/renesas_usbhs/mod_host.c
index 9b69a1323294..069cd765400c 100644
--- a/drivers/usb/renesas_usbhs/mod_host.c
+++ b/drivers/usb/renesas_usbhs/mod_host.c
@@ -334,6 +334,11 @@ static void usbhsh_pipe_detach(struct usbhsh_hpriv *hpriv,
         struct device *dev = usbhs_priv_to_dev(priv);
         unsigned long flags;
 
+        if (unlikely(!uep)) {
+                dev_err(dev, "no uep\n");
+                return;
+        }
+
         /********************  spin lock ********************/
         usbhs_lock(priv, flags);
 
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index e9c7046ae355..d255f66e708e 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -242,13 +242,11 @@ out:	kfree(buffer);
         return r;
 }
 
-/* allocate private data */
-static int ch341_attach(struct usb_serial *serial)
+static int ch341_port_probe(struct usb_serial_port *port)
 {
         struct ch341_private *priv;
         int r;
 
-        /* private data */
         priv = kzalloc(sizeof(struct ch341_private), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
@@ -258,17 +256,27 @@ static int ch341_attach(struct usb_serial *serial)
         priv->baud_rate = DEFAULT_BAUD_RATE;
         priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR;
 
-        r = ch341_configure(serial->dev, priv);
+        r = ch341_configure(port->serial->dev, priv);
         if (r < 0)
                 goto error;
 
-        usb_set_serial_port_data(serial->port[0], priv);
+        usb_set_serial_port_data(port, priv);
         return 0;
 
 error:  kfree(priv);
         return r;
 }
 
+static int ch341_port_remove(struct usb_serial_port *port)
+{
+        struct ch341_private *priv;
+
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
+}
+
 static int ch341_carrier_raised(struct usb_serial_port *port)
 {
         struct ch341_private *priv = usb_get_serial_port_data(port);
@@ -304,7 +312,7 @@ static void ch341_close(struct usb_serial_port *port)
 static int ch341_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
-        struct ch341_private *priv = usb_get_serial_port_data(serial->port[0]);
+        struct ch341_private *priv = usb_get_serial_port_data(port);
         int r;
 
         priv->baud_rate = DEFAULT_BAUD_RATE;
@@ -608,7 +616,8 @@ static struct usb_serial_driver ch341_device = {
         .tiocmget          = ch341_tiocmget,
         .tiocmset          = ch341_tiocmset,
         .read_int_callback = ch341_read_int_callback,
-        .attach            = ch341_attach,
+        .port_probe        = ch341_port_probe,
+        .port_remove       = ch341_port_remove,
         .reset_resume      = ch341_reset_resume,
 };
 
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index c86f68c6b078..b50fa1c6d885 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -244,6 +244,8 @@ static int digi_startup_device(struct usb_serial *serial);
 static int digi_startup(struct usb_serial *serial);
 static void digi_disconnect(struct usb_serial *serial);
 static void digi_release(struct usb_serial *serial);
+static int digi_port_probe(struct usb_serial_port *port);
+static int digi_port_remove(struct usb_serial_port *port);
 static void digi_read_bulk_callback(struct urb *urb);
 static int digi_read_inb_callback(struct urb *urb);
 static int digi_read_oob_callback(struct urb *urb);
@@ -294,6 +296,8 @@ static struct usb_serial_driver digi_acceleport_2_device = {
         .attach =                       digi_startup,
         .disconnect =                   digi_disconnect,
         .release =                      digi_release,
+        .port_probe =                   digi_port_probe,
+        .port_remove =                  digi_port_remove,
 };
 
 static struct usb_serial_driver digi_acceleport_4_device = {
@@ -320,6 +324,8 @@ static struct usb_serial_driver digi_acceleport_4_device = {
         .attach =                       digi_startup,
         .disconnect =                   digi_disconnect,
         .release =                      digi_release,
+        .port_probe =                   digi_port_probe,
+        .port_remove =                  digi_port_remove,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
@@ -1240,59 +1246,50 @@ static int digi_startup_device(struct usb_serial *serial)
         return ret;
 }
 
-
-static int digi_startup(struct usb_serial *serial)
+static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
 {
-
-        int i;
         struct digi_port *priv;
-        struct digi_serial *serial_priv;
 
-        /* allocate the private data structures for all ports */
-        /* number of regular ports + 1 for the out-of-band port */
-        for (i = 0; i < serial->type->num_ports + 1; i++) {
-                /* allocate port private structure */
-                priv = kmalloc(sizeof(struct digi_port), GFP_KERNEL);
-                if (priv == NULL) {
-                        while (--i >= 0)
-                                kfree(usb_get_serial_port_data(serial->port[i]));
-                        return 1;                       /* error */
-                }
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
 
-                /* initialize port private structure */
-                spin_lock_init(&priv->dp_port_lock);
-                priv->dp_port_num = i;
-                priv->dp_out_buf_len = 0;
-                priv->dp_write_urb_in_use = 0;
-                priv->dp_modem_signals = 0;
-                init_waitqueue_head(&priv->dp_modem_change_wait);
-                priv->dp_transmit_idle = 0;
-                init_waitqueue_head(&priv->dp_transmit_idle_wait);
-                priv->dp_throttled = 0;
-                priv->dp_throttle_restart = 0;
-                init_waitqueue_head(&priv->dp_flush_wait);
-                init_waitqueue_head(&priv->dp_close_wait);
-                INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock);
-                priv->dp_port = serial->port[i];
-                /* initialize write wait queue for this port */
-                init_waitqueue_head(&serial->port[i]->write_wait);
-
-                usb_set_serial_port_data(serial->port[i], priv);
-        }
+        spin_lock_init(&priv->dp_port_lock);
+        priv->dp_port_num = port_num;
+        init_waitqueue_head(&priv->dp_modem_change_wait);
+        init_waitqueue_head(&priv->dp_transmit_idle_wait);
+        init_waitqueue_head(&priv->dp_flush_wait);
+        init_waitqueue_head(&priv->dp_close_wait);
+        INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock);
+        priv->dp_port = port;
 
-        /* allocate serial private structure */
-        serial_priv = kmalloc(sizeof(struct digi_serial), GFP_KERNEL);
-        if (serial_priv == NULL) {
-                for (i = 0; i < serial->type->num_ports + 1; i++)
-                        kfree(usb_get_serial_port_data(serial->port[i]));
-                return 1;                       /* error */
-        }
+        init_waitqueue_head(&port->write_wait);
+
+        usb_set_serial_port_data(port, priv);
+
+        return 0;
+}
+
+static int digi_startup(struct usb_serial *serial)
+{
+        struct digi_serial *serial_priv;
+        int ret;
+
+        serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
+        if (!serial_priv)
+                return -ENOMEM;
 
-        /* initialize serial private structure */
         spin_lock_init(&serial_priv->ds_serial_lock);
         serial_priv->ds_oob_port_num = serial->type->num_ports;
         serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
-        serial_priv->ds_device_started = 0;
+
+        ret = digi_port_init(serial_priv->ds_oob_port,
+                                                serial_priv->ds_oob_port_num);
+        if (ret) {
+                kfree(serial_priv);
+                return ret;
+        }
+
         usb_set_serial_data(serial, serial_priv);
 
         return 0;
@@ -1313,15 +1310,35 @@ static void digi_disconnect(struct usb_serial *serial)
 
 static void digi_release(struct usb_serial *serial)
 {
-        int i;
+        struct digi_serial *serial_priv;
+        struct digi_port *priv;
+
+        serial_priv = usb_get_serial_data(serial);
+
+        priv = usb_get_serial_port_data(serial_priv->ds_oob_port);
+        kfree(priv);
 
-        /* free the private data structures for all ports */
-        /* number of regular ports + 1 for the out-of-band port */
-        for (i = 0; i < serial->type->num_ports + 1; i++)
-                kfree(usb_get_serial_port_data(serial->port[i]));
-        kfree(usb_get_serial_data(serial));
+        kfree(serial_priv);
 }
 
+static int digi_port_probe(struct usb_serial_port *port)
+{
+        unsigned port_num;
+
+        port_num = port->number - port->serial->minor;
+
+        return digi_port_init(port, port_num);
+}
+
+static int digi_port_remove(struct usb_serial_port *port)
+{
+        struct digi_port *priv;
+
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
+}
 
 static void digi_read_bulk_callback(struct urb *urb)
 {
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index 20a132ec39e2..4264821a3b34 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -203,8 +203,7 @@ static int ipw_open(struct tty_struct *tty, struct usb_serial_port *port)
         return 0;
 }
 
-/* fake probe - only to allocate data structures */
-static int ipw_probe(struct usb_serial *serial, const struct usb_device_id *id)
+static int ipw_attach(struct usb_serial *serial)
 {
         struct usb_wwan_intf_private *data;
 
@@ -303,9 +302,9 @@ static struct usb_serial_driver ipw_device = {
         .num_ports =            1,
         .open =                 ipw_open,
         .close =                ipw_close,
-        .probe =                ipw_probe,
-        .attach =               usb_wwan_startup,
+        .attach =               ipw_attach,
         .release =              ipw_release,
+        .port_probe =           usb_wwan_port_probe,
         .port_remove =          usb_wwan_port_remove,
         .dtr_rts =              ipw_dtr_rts,
         .write =                usb_wwan_write,
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 29c943d737d0..7179b0c5f814 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -1374,13 +1374,9 @@ static struct callbacks {
            data in device_details */
 static void keyspan_setup_urbs(struct usb_serial *serial)
 {
-        int                             i, j;
         struct keyspan_serial_private   *s_priv;
         const struct keyspan_device_details     *d_details;
-        struct usb_serial_port          *port;
-        struct keyspan_port_private     *p_priv;
         struct callbacks                *cback;
-        int                             endp;
 
         s_priv = usb_get_serial_data(serial);
         d_details = s_priv->device_details;
@@ -1404,45 +1400,6 @@ static void keyspan_setup_urbs(struct usb_serial *serial)
                 (serial, d_details->glocont_endpoint, USB_DIR_OUT,
                  serial, s_priv->glocont_buf, GLOCONT_BUFLEN,
                  cback->glocont_callback);
-
-        /* Setup endpoints for each port specific thing */
-        for (i = 0; i < d_details->num_ports; i++) {
-                port = serial->port[i];
-                p_priv = usb_get_serial_port_data(port);
-
-                /* Do indat endpoints first, once for each flip */
-                endp = d_details->indat_endpoints[i];
-                for (j = 0; j <= d_details->indat_endp_flip; ++j, ++endp) {
-                        p_priv->in_urbs[j] = keyspan_setup_urb
-                                (serial, endp, USB_DIR_IN, port,
-                                 p_priv->in_buffer[j], 64,
-                                 cback->indat_callback);
-                }
-                for (; j < 2; ++j)
-                        p_priv->in_urbs[j] = NULL;
-
-                /* outdat endpoints also have flip */
-                endp = d_details->outdat_endpoints[i];
-                for (j = 0; j <= d_details->outdat_endp_flip; ++j, ++endp) {
-                        p_priv->out_urbs[j] = keyspan_setup_urb
-                                (serial, endp, USB_DIR_OUT, port,
-                                 p_priv->out_buffer[j], 64,
-                                 cback->outdat_callback);
-                }
-                for (; j < 2; ++j)
-                        p_priv->out_urbs[j] = NULL;
-
-                /* inack endpoint */
-                p_priv->inack_urb = keyspan_setup_urb
-                        (serial, d_details->inack_endpoints[i], USB_DIR_IN,
-                         port, p_priv->inack_buffer, 1, cback->inack_callback);
-
-                /* outcont endpoint */
-                p_priv->outcont_urb = keyspan_setup_urb
-                        (serial, d_details->outcont_endpoints[i], USB_DIR_OUT,
-                         port, p_priv->outcont_buffer, 64,
-                         cback->outcont_callback);
-        }
 }
 
 /* usa19 function doesn't require prescaler */
@@ -2407,9 +2364,7 @@ static void keyspan_send_setup(struct usb_serial_port *port, int reset_port)
 static int keyspan_startup(struct usb_serial *serial)
 {
         int                             i, err;
-        struct usb_serial_port          *port;
         struct keyspan_serial_private   *s_priv;
-        struct keyspan_port_private     *p_priv;
         const struct keyspan_device_details     *d_details;
 
         for (i = 0; (d_details = keyspan_devices[i]) != NULL; ++i)
@@ -2432,19 +2387,6 @@ static int keyspan_startup(struct usb_serial *serial)
         s_priv->device_details = d_details;
         usb_set_serial_data(serial, s_priv);
 
-        /* Now setup per port private data */
-        for (i = 0; i < serial->num_ports; i++) {
-                port = serial->port[i];
-                p_priv = kzalloc(sizeof(struct keyspan_port_private),
-                                                                GFP_KERNEL);
-                if (!p_priv) {
-                        dev_dbg(&port->dev, "%s - kmalloc for keyspan_port_private (%d) failed!.\n", __func__, i);
-                        return 1;
-                }
-                p_priv->device_details = d_details;
-                usb_set_serial_port_data(port, p_priv);
-        }
-
         keyspan_setup_urbs(serial);
 
         if (s_priv->instat_urb != NULL) {
@@ -2463,59 +2405,112 @@ static int keyspan_startup(struct usb_serial *serial)
 
 static void keyspan_disconnect(struct usb_serial *serial)
 {
-        int                             i, j;
-        struct usb_serial_port          *port;
-        struct keyspan_serial_private   *s_priv;
-        struct keyspan_port_private     *p_priv;
+        struct keyspan_serial_private *s_priv;
 
         s_priv = usb_get_serial_data(serial);
 
-        /* Stop reading/writing urbs */
         stop_urb(s_priv->instat_urb);
         stop_urb(s_priv->glocont_urb);
         stop_urb(s_priv->indat_urb);
-        for (i = 0; i < serial->num_ports; ++i) {
-                port = serial->port[i];
-                p_priv = usb_get_serial_port_data(port);
-                stop_urb(p_priv->inack_urb);
-                stop_urb(p_priv->outcont_urb);
-                for (j = 0; j < 2; j++) {
-                        stop_urb(p_priv->in_urbs[j]);
-                        stop_urb(p_priv->out_urbs[j]);
-                }
-        }
+}
+
+static void keyspan_release(struct usb_serial *serial)
+{
+        struct keyspan_serial_private *s_priv;
+
+        s_priv = usb_get_serial_data(serial);
 
-        /* Now free them */
         usb_free_urb(s_priv->instat_urb);
         usb_free_urb(s_priv->indat_urb);
         usb_free_urb(s_priv->glocont_urb);
-        for (i = 0; i < serial->num_ports; ++i) {
-                port = serial->port[i];
-                p_priv = usb_get_serial_port_data(port);
-                usb_free_urb(p_priv->inack_urb);
-                usb_free_urb(p_priv->outcont_urb);
-                for (j = 0; j < 2; j++) {
-                        usb_free_urb(p_priv->in_urbs[j]);
-                        usb_free_urb(p_priv->out_urbs[j]);
-                }
-        }
+
+        kfree(s_priv);
 }
 
-static void keyspan_release(struct usb_serial *serial)
+static int keyspan_port_probe(struct usb_serial_port *port)
 {
-        int                             i;
-        struct usb_serial_port          *port;
-        struct keyspan_serial_private   *s_priv;
+        struct usb_serial *serial = port->serial;
+        struct keyspan_port_private *s_priv;
+        struct keyspan_port_private *p_priv;
+        const struct keyspan_device_details *d_details;
+        struct callbacks *cback;
+        int endp;
+        int port_num;
+        int i;
 
         s_priv = usb_get_serial_data(serial);
+        d_details = s_priv->device_details;
 
-        kfree(s_priv);
+        p_priv = kzalloc(sizeof(*p_priv), GFP_KERNEL);
+        if (!p_priv)
+                return -ENOMEM;
 
-        /* Now free per port private data */
-        for (i = 0; i < serial->num_ports; i++) {
-                port = serial->port[i];
-                kfree(usb_get_serial_port_data(port));
+        s_priv = usb_get_serial_data(port->serial);
+        p_priv->device_details = d_details;
+
+        /* Setup values for the various callback routines */
+        cback = &keyspan_callbacks[d_details->msg_format];
+
+        port_num = port->number - port->serial->minor;
+
+        /* Do indat endpoints first, once for each flip */
+        endp = d_details->indat_endpoints[port_num];
+        for (i = 0; i <= d_details->indat_endp_flip; ++i, ++endp) {
+                p_priv->in_urbs[i] = keyspan_setup_urb(serial, endp,
+                                                USB_DIR_IN, port,
+                                                p_priv->in_buffer[i], 64,
+                                                cback->indat_callback);
+        }
+        /* outdat endpoints also have flip */
+        endp = d_details->outdat_endpoints[port_num];
+        for (i = 0; i <= d_details->outdat_endp_flip; ++i, ++endp) {
+                p_priv->out_urbs[i] = keyspan_setup_urb(serial, endp,
+                                                USB_DIR_OUT, port,
+                                                p_priv->out_buffer[i], 64,
+                                                cback->outdat_callback);
+        }
+        /* inack endpoint */
+        p_priv->inack_urb = keyspan_setup_urb(serial,
+                                        d_details->inack_endpoints[port_num],
+                                        USB_DIR_IN, port,
+                                        p_priv->inack_buffer, 1,
+                                        cback->inack_callback);
+        /* outcont endpoint */
+        p_priv->outcont_urb = keyspan_setup_urb(serial,
+                                        d_details->outcont_endpoints[port_num],
+                                        USB_DIR_OUT, port,
+                                        p_priv->outcont_buffer, 64,
+                                         cback->outcont_callback);
+
+        usb_set_serial_port_data(port, p_priv);
+
+        return 0;
+}
+
+static int keyspan_port_remove(struct usb_serial_port *port)
+{
+        struct keyspan_port_private *p_priv;
+        int i;
+
+        p_priv = usb_get_serial_port_data(port);
+
+        stop_urb(p_priv->inack_urb);
+        stop_urb(p_priv->outcont_urb);
+        for (i = 0; i < 2; i++) {
+                stop_urb(p_priv->in_urbs[i]);
+                stop_urb(p_priv->out_urbs[i]);
+        }
+
+        usb_free_urb(p_priv->inack_urb);
+        usb_free_urb(p_priv->outcont_urb);
+        for (i = 0; i < 2; i++) {
+                usb_free_urb(p_priv->in_urbs[i]);
+                usb_free_urb(p_priv->out_urbs[i]);
         }
+
+        kfree(p_priv);
+
+        return 0;
 }
 
 MODULE_AUTHOR(DRIVER_AUTHOR);
diff --git a/drivers/usb/serial/keyspan.h b/drivers/usb/serial/keyspan.h
index 0a8a40b5711e..0273dda303a4 100644
--- a/drivers/usb/serial/keyspan.h
+++ b/drivers/usb/serial/keyspan.h
@@ -42,6 +42,8 @@ static void keyspan_dtr_rts		(struct usb_serial_port *port, int on);
 static int  keyspan_startup             (struct usb_serial *serial);
 static void keyspan_disconnect          (struct usb_serial *serial);
 static void keyspan_release             (struct usb_serial *serial);
+static int keyspan_port_probe(struct usb_serial_port *port);
+static int keyspan_port_remove(struct usb_serial_port *port);
 static int  keyspan_write_room          (struct tty_struct *tty);
 
 static int  keyspan_write               (struct tty_struct *tty,
@@ -567,6 +569,8 @@ static struct usb_serial_driver keyspan_1port_device = {
         .attach                 = keyspan_startup,
         .disconnect             = keyspan_disconnect,
         .release                = keyspan_release,
+        .port_probe             = keyspan_port_probe,
+        .port_remove            = keyspan_port_remove,
 };
 
 static struct usb_serial_driver keyspan_2port_device = {
@@ -589,6 +593,8 @@ static struct usb_serial_driver keyspan_2port_device = {
         .attach                 = keyspan_startup,
         .disconnect             = keyspan_disconnect,
         .release                = keyspan_release,
+        .port_probe             = keyspan_port_probe,
+        .port_remove            = keyspan_port_remove,
 };
 
 static struct usb_serial_driver keyspan_4port_device = {
@@ -611,6 +617,8 @@ static struct usb_serial_driver keyspan_4port_device = {
         .attach                 = keyspan_startup,
         .disconnect             = keyspan_disconnect,
         .release                = keyspan_release,
+        .port_probe             = keyspan_port_probe,
+        .port_remove            = keyspan_port_remove,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index f3947712e137..8a2081004107 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -49,7 +49,8 @@
  * Function prototypes
  */
 static int  mct_u232_startup(struct usb_serial *serial);
-static void mct_u232_release(struct usb_serial *serial);
+static int  mct_u232_port_probe(struct usb_serial_port *port);
+static int  mct_u232_port_remove(struct usb_serial_port *remove);
 static int  mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void mct_u232_close(struct usb_serial_port *port);
 static void mct_u232_dtr_rts(struct usb_serial_port *port, int on);
@@ -99,7 +100,8 @@ static struct usb_serial_driver mct_u232_device = {
         .tiocmget =          mct_u232_tiocmget,
         .tiocmset =          mct_u232_tiocmset,
         .attach =            mct_u232_startup,
-        .release =           mct_u232_release,
+        .port_probe =        mct_u232_port_probe,
+        .port_remove =       mct_u232_port_remove,
         .ioctl =             mct_u232_ioctl,
         .get_icount =        mct_u232_get_icount,
 };
@@ -388,18 +390,8 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port,
 
 static int mct_u232_startup(struct usb_serial *serial)
 {
-        struct mct_u232_private *priv;
         struct usb_serial_port *port, *rport;
 
-        priv = kzalloc(sizeof(struct mct_u232_private), GFP_KERNEL);
-        if (!priv)
-                return -ENOMEM;
-        spin_lock_init(&priv->lock);
-        init_waitqueue_head(&priv->msr_wait);
-        usb_set_serial_port_data(serial->port[0], priv);
-
-        init_waitqueue_head(&serial->port[0]->write_wait);
-
         /* Puh, that's dirty */
         port = serial->port[0];
         rport = serial->port[1];
@@ -412,18 +404,31 @@ static int mct_u232_startup(struct usb_serial *serial)
         return 0;
 } /* mct_u232_startup */
 
+static int mct_u232_port_probe(struct usb_serial_port *port)
+{
+        struct mct_u232_private *priv;
+
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        spin_lock_init(&priv->lock);
+        init_waitqueue_head(&priv->msr_wait);
+
+        usb_set_serial_port_data(port, priv);
 
-static void mct_u232_release(struct usb_serial *serial)
+        return 0;
+}
+
+static int mct_u232_port_remove(struct usb_serial_port *port)
 {
         struct mct_u232_private *priv;
-        int i;
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                /* My special items, the standard routines free my urbs */
-                priv = usb_get_serial_port_data(serial->port[i]);
-                kfree(priv);
-        }
-} /* mct_u232_release */
+        priv = usb_get_serial_port_data(port);
+        kfree(priv);
+
+        return 0;
+}
 
 static int  mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
@@ -515,12 +520,14 @@ static void mct_u232_dtr_rts(struct usb_serial_port *port, int on)
 
 static void mct_u232_close(struct usb_serial_port *port)
 {
-        if (port->serial->dev) {
-                /* shutdown our urbs */
-                usb_kill_urb(port->write_urb);
-                usb_kill_urb(port->read_urb);
-                usb_kill_urb(port->interrupt_in_urb);
-        }
+        /*
+         * Must kill the read urb as it is actually an interrupt urb, which
+         * generic close thus fails to kill.
+         */
+        usb_kill_urb(port->read_urb);
+        usb_kill_urb(port->interrupt_in_urb);
+
+        usb_serial_generic_close(port);
 } /* mct_u232_close */
 
 
diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
index 0b257ddffbdb..6f29c74eb769 100644
--- a/drivers/usb/serial/metro-usb.c
+++ b/drivers/usb/serial/metro-usb.c
@@ -179,16 +179,13 @@ static void metrousb_cleanup(struct usb_serial_port *port)
 {
         dev_dbg(&port->dev, "%s\n", __func__);
 
-        if (port->serial->dev) {
-                /* Shutdown any interrupt in urbs. */
-                if (port->interrupt_in_urb) {
-                        usb_unlink_urb(port->interrupt_in_urb);
-                        usb_kill_urb(port->interrupt_in_urb);
-                }
-
-                /* Send deactivate cmd to device */
+        usb_unlink_urb(port->interrupt_in_urb);
+        usb_kill_urb(port->interrupt_in_urb);
+
+        mutex_lock(&port->serial->disc_mutex);
+        if (!port->serial->disconnected)
                 metrousb_send_unidirectional_cmd(UNI_CMD_CLOSE, port);
-        }
+        mutex_unlock(&port->serial->disc_mutex);
 }
 
 static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port)
@@ -271,51 +268,27 @@ static int metrousb_set_modem_ctrl(struct usb_serial *serial, unsigned int contr
         return retval;
 }
 
-static void metrousb_shutdown(struct usb_serial *serial)
+static int metrousb_port_probe(struct usb_serial_port *port)
 {
-        int i = 0;
+        struct metrousb_private *metro_priv;
 
-        dev_dbg(&serial->dev->dev, "%s\n", __func__);
+        metro_priv = kzalloc(sizeof(*metro_priv), GFP_KERNEL);
+        if (!metro_priv)
+                return -ENOMEM;
 
-        /* Stop reading and writing on all ports. */
-        for (i = 0; i < serial->num_ports; ++i) {
-                /* Close any open urbs. */
-                metrousb_cleanup(serial->port[i]);
+        spin_lock_init(&metro_priv->lock);
 
-                /* Free memory. */
-                kfree(usb_get_serial_port_data(serial->port[i]));
-                usb_set_serial_port_data(serial->port[i], NULL);
+        usb_set_serial_port_data(port, metro_priv);
 
-                dev_dbg(&serial->dev->dev, "%s - freed port number=%d\n",
-                        __func__, serial->port[i]->number);
-        }
+        return 0;
 }
 
-static int metrousb_startup(struct usb_serial *serial)
+static int metrousb_port_remove(struct usb_serial_port *port)
 {
         struct metrousb_private *metro_priv;
-        struct usb_serial_port *port;
-        int i = 0;
 
-        dev_dbg(&serial->dev->dev, "%s\n", __func__);
-
-        /* Loop through the serial ports setting up the private structures.
-         * Currently we only use one port. */
-        for (i = 0; i < serial->num_ports; ++i) {
-                port = serial->port[i];
-
-                /* Declare memory. */
-                metro_priv = kzalloc(sizeof(struct metrousb_private), GFP_KERNEL);
-                if (!metro_priv)
-                        return -ENOMEM;
-
-                /* Initialize memory. */
-                spin_lock_init(&metro_priv->lock);
-                usb_set_serial_port_data(port, metro_priv);
-
-                dev_dbg(&serial->dev->dev, "%s - port number=%d\n ",
-                        __func__, port->number);
-        }
+        metro_priv = usb_get_serial_port_data(port);
+        kfree(metro_priv);
 
         return 0;
 }
@@ -414,8 +387,8 @@ static struct usb_serial_driver metrousb_device = {
         .close                  = metrousb_cleanup,
         .read_int_callback      = metrousb_read_int_callback,
         .write_int_callback     = metrousb_write_int_callback,
-        .attach                 = metrousb_startup,
-        .release                = metrousb_shutdown,
+        .port_probe             = metrousb_port_probe,
+        .port_remove            = metrousb_port_remove,
         .throttle               = metrousb_throttle,
         .unthrottle             = metrousb_unthrottle,
         .tiocmget               = metrousb_tiocmget,
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 1bf1ad066666..75267421aad8 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1966,9 +1966,7 @@ static int mos7720_ioctl(struct tty_struct *tty,
 
 static int mos7720_startup(struct usb_serial *serial)
 {
-        struct moschip_port *mos7720_port;
         struct usb_device *dev;
-        int i;
         char data;
         u16 product;
         int ret_val;
@@ -1999,29 +1997,6 @@ static int mos7720_startup(struct usb_serial *serial)
                 serial->port[1]->interrupt_in_buffer = NULL;
         }
 
-
-        /* set up serial port private structures */
-        for (i = 0; i < serial->num_ports; ++i) {
-                mos7720_port = kzalloc(sizeof(struct moschip_port), GFP_KERNEL);
-                if (mos7720_port == NULL) {
-                        dev_err(&dev->dev, "%s - Out of memory\n", __func__);
-                        return -ENOMEM;
-                }
-
-                /* Initialize all port interrupt end point to port 0 int
-                 * endpoint.  Our device has only one interrupt endpoint
-                 * common to all ports */
-                serial->port[i]->interrupt_in_endpointAddress =
-                                serial->port[0]->interrupt_in_endpointAddress;
-
-                mos7720_port->port = serial->port[i];
-                usb_set_serial_port_data(serial->port[i], mos7720_port);
-
-                dev_dbg(&dev->dev, "port number is %d\n", serial->port[i]->number);
-                dev_dbg(&dev->dev, "serial number is %d\n", serial->minor);
-        }
-
-
         /* setting configuration feature to one */
         usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
                         (__u8)0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5*HZ);
@@ -2049,8 +2024,6 @@ static int mos7720_startup(struct usb_serial *serial)
 
 static void mos7720_release(struct usb_serial *serial)
 {
-        int i;
-
 #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
         /* close the parallel port */
 
@@ -2089,9 +2062,36 @@ static void mos7720_release(struct usb_serial *serial)
                 kref_put(&mos_parport->ref_count, destroy_mos_parport);
         }
 #endif
-        /* free private structure allocated for serial port */
-        for (i = 0; i < serial->num_ports; ++i)
-                kfree(usb_get_serial_port_data(serial->port[i]));
+}
+
+static int mos7720_port_probe(struct usb_serial_port *port)
+{
+        struct moschip_port *mos7720_port;
+
+        mos7720_port = kzalloc(sizeof(*mos7720_port), GFP_KERNEL);
+        if (!mos7720_port)
+                return -ENOMEM;
+
+        /* Initialize all port interrupt end point to port 0 int endpoint.
+         * Our device has only one interrupt endpoint common to all ports.
+         */
+        port->interrupt_in_endpointAddress =
+                port->serial->port[0]->interrupt_in_endpointAddress;
+        mos7720_port->port = port;
+
+        usb_set_serial_port_data(port, mos7720_port);
+
+        return 0;
+}
+
+static int mos7720_port_remove(struct usb_serial_port *port)
+{
+        struct moschip_port *mos7720_port;
+
+        mos7720_port = usb_get_serial_port_data(port);
+        kfree(mos7720_port);
+
+        return 0;
 }
 
 static struct usb_serial_driver moschip7720_2port_driver = {
@@ -2109,6 +2109,8 @@ static struct usb_serial_driver moschip7720_2port_driver = {
         .probe                  = mos77xx_probe,
         .attach                 = mos7720_startup,
         .release                = mos7720_release,
+        .port_probe             = mos7720_port_probe,
+        .port_remove            = mos7720_port_remove,
         .ioctl                  = mos7720_ioctl,
         .tiocmget               = mos7720_tiocmget,
         .tiocmset               = mos7720_tiocmset,
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index d6d4eeca8c68..1cf3375ec1af 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -218,12 +218,10 @@ struct moschip_port {
         int port_num;           /*Actual port number in the device(1,2,etc) */
         struct urb *write_urb;  /* write URB for this port */
         struct urb *read_urb;   /* read URB for this port */
-        struct urb *int_urb;
         __u8 shadowLCR;         /* last LCR value received */
         __u8 shadowMCR;         /* last MCR value received */
         char open;
         char open_ports;
-        char zombie;
         wait_queue_head_t wait_chase;   /* for handling sleeping while waiting for chase to finish */
         wait_queue_head_t delta_msr_wait;       /* for handling sleeping while waiting for msr change to happen */
         int delta_msr_cond;
@@ -478,7 +476,6 @@ static void mos7840_control_callback(struct urb *urb)
         struct moschip_port *mos7840_port;
         struct device *dev = &urb->dev->dev;
         __u8 regval = 0x0;
-        int result = 0;
         int status = urb->status;
 
         mos7840_port = urb->context;
@@ -495,7 +492,7 @@ static void mos7840_control_callback(struct urb *urb)
                 return;
         default:
                 dev_dbg(dev, "%s - nonzero urb status received: %d\n", __func__, status);
-                goto exit;
+                return;
         }
 
         dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
@@ -508,16 +505,6 @@ static void mos7840_control_callback(struct urb *urb)
                 mos7840_handle_new_msr(mos7840_port, regval);
         else if (mos7840_port->MsrLsr == 1)
                 mos7840_handle_new_lsr(mos7840_port, regval);
-
-exit:
-        spin_lock(&mos7840_port->pool_lock);
-        if (!mos7840_port->zombie)
-                result = usb_submit_urb(mos7840_port->int_urb, GFP_ATOMIC);
-        spin_unlock(&mos7840_port->pool_lock);
-        if (result) {
-                dev_err(dev, "%s - Error %d submitting interrupt urb\n",
-                        __func__, result);
-        }
 }
 
 static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
@@ -686,14 +673,7 @@ static void mos7840_interrupt_callback(struct urb *urb)
                                         wreg = MODEM_STATUS_REGISTER;
                                         break;
                                 }
-                                spin_lock(&mos7840_port->pool_lock);
-                                if (!mos7840_port->zombie) {
-                                        rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data);
-                                } else {
-                                        spin_unlock(&mos7840_port->pool_lock);
-                                        return;
-                                }
-                                spin_unlock(&mos7840_port->pool_lock);
+                                rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data);
                         }
                 }
         }
@@ -2347,309 +2327,249 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)
         return mos7840_num_ports;
 }
 
-/****************************************************************************
- * mos7840_startup
- ****************************************************************************/
-
-static int mos7840_startup(struct usb_serial *serial)
+static int mos7840_port_probe(struct usb_serial_port *port)
 {
+        struct usb_serial *serial = port->serial;
         struct moschip_port *mos7840_port;
-        struct usb_device *dev;
-        int i, status;
+        int status;
+        int pnum;
         __u16 Data;
 
-        dev = serial->dev;
-
         /* we set up the pointers to the endpoints in the mos7840_open *
          * function, as the structures aren't created yet.             */
 
-        /* set up port private structures */
-        for (i = 0; i < serial->num_ports; ++i) {
-                dev_dbg(&dev->dev, "mos7840_startup: configuring port %d............\n", i);
-                mos7840_port = kzalloc(sizeof(struct moschip_port), GFP_KERNEL);
-                if (mos7840_port == NULL) {
-                        dev_err(&dev->dev, "%s - Out of memory\n", __func__);
-                        status = -ENOMEM;
-                        i--; /* don't follow NULL pointer cleaning up */
-                        goto error;
-                }
-
-                /* Initialize all port interrupt end point to port 0 int
-                 * endpoint. Our device has only one interrupt end point
-                 * common to all port */
-
-                mos7840_port->port = serial->port[i];
-                mos7840_set_port_private(serial->port[i], mos7840_port);
-                spin_lock_init(&mos7840_port->pool_lock);
-
-                /* minor is not initialised until later by
-                 * usb-serial.c:get_free_serial() and cannot therefore be used
-                 * to index device instances */
-                mos7840_port->port_num = i + 1;
-                dev_dbg(&dev->dev, "serial->port[i]->number = %d\n", serial->port[i]->number);
-                dev_dbg(&dev->dev, "serial->port[i]->serial->minor = %d\n", serial->port[i]->serial->minor);
-                dev_dbg(&dev->dev, "mos7840_port->port_num = %d\n", mos7840_port->port_num);
-                dev_dbg(&dev->dev, "serial->minor = %d\n", serial->minor);
-
-                if (mos7840_port->port_num == 1) {
-                        mos7840_port->SpRegOffset = 0x0;
-                        mos7840_port->ControlRegOffset = 0x1;
-                        mos7840_port->DcrRegOffset = 0x4;
-                } else if ((mos7840_port->port_num == 2)
-                           && (serial->num_ports == 4)) {
-                        mos7840_port->SpRegOffset = 0x8;
-                        mos7840_port->ControlRegOffset = 0x9;
-                        mos7840_port->DcrRegOffset = 0x16;
-                } else if ((mos7840_port->port_num == 2)
-                           && (serial->num_ports == 2)) {
-                        mos7840_port->SpRegOffset = 0xa;
-                        mos7840_port->ControlRegOffset = 0xb;
-                        mos7840_port->DcrRegOffset = 0x19;
-                } else if ((mos7840_port->port_num == 3)
-                           && (serial->num_ports == 4)) {
-                        mos7840_port->SpRegOffset = 0xa;
-                        mos7840_port->ControlRegOffset = 0xb;
-                        mos7840_port->DcrRegOffset = 0x19;
-                } else if ((mos7840_port->port_num == 4)
-                           && (serial->num_ports == 4)) {
-                        mos7840_port->SpRegOffset = 0xc;
-                        mos7840_port->ControlRegOffset = 0xd;
-                        mos7840_port->DcrRegOffset = 0x1c;
-                }
-                mos7840_dump_serial_port(serial->port[i], mos7840_port);
-                mos7840_set_port_private(serial->port[i], mos7840_port);
+        pnum = port->number - serial->minor;
 
-                /* enable rx_disable bit in control register */
-                status = mos7840_get_reg_sync(serial->port[i],
-                                 mos7840_port->ControlRegOffset, &Data);
-                if (status < 0) {
-                        dev_dbg(&dev->dev, "Reading ControlReg failed status-0x%x\n", status);
-                        break;
-                } else
-                        dev_dbg(&dev->dev, "ControlReg Reading success val is %x, status%d\n", Data, status);
-                Data |= 0x08;   /* setting driver done bit */
-                Data |= 0x04;   /* sp1_bit to have cts change reflect in
-                                   modem status reg */
-
-                /* Data |= 0x20; //rx_disable bit */
-                status = mos7840_set_reg_sync(serial->port[i],
-                                         mos7840_port->ControlRegOffset, Data);
-                if (status < 0) {
-                        dev_dbg(&dev->dev, "Writing ControlReg failed(rx_disable) status-0x%x\n", status);
-                        break;
-                } else
-                        dev_dbg(&dev->dev, "ControlReg Writing success(rx_disable) status%d\n", status);
+        dev_dbg(&port->dev, "mos7840_startup: configuring port %d\n", pnum);
+        mos7840_port = kzalloc(sizeof(struct moschip_port), GFP_KERNEL);
+        if (mos7840_port == NULL) {
+                dev_err(&port->dev, "%s - Out of memory\n", __func__);
+                return -ENOMEM;
+        }
 
-                /* Write default values in DCR (i.e 0x01 in DCR0, 0x05 in DCR2
-                   and 0x24 in DCR3 */
-                Data = 0x01;
-                status = mos7840_set_reg_sync(serial->port[i],
-                         (__u16) (mos7840_port->DcrRegOffset + 0), Data);
-                if (status < 0) {
-                        dev_dbg(&dev->dev, "Writing DCR0 failed status-0x%x\n", status);
-                        break;
-                } else
-                        dev_dbg(&dev->dev, "DCR0 Writing success status%d\n", status);
+        /* Initialize all port interrupt end point to port 0 int
+         * endpoint. Our device has only one interrupt end point
+         * common to all port */
+
+        mos7840_port->port = port;
+        mos7840_set_port_private(port, mos7840_port);
+        spin_lock_init(&mos7840_port->pool_lock);
+
+        /* minor is not initialised until later by
+         * usb-serial.c:get_free_serial() and cannot therefore be used
+         * to index device instances */
+        mos7840_port->port_num = pnum + 1;
+        dev_dbg(&port->dev, "port->number = %d\n", port->number);
+        dev_dbg(&port->dev, "port->serial->minor = %d\n", port->serial->minor);
+        dev_dbg(&port->dev, "mos7840_port->port_num = %d\n", mos7840_port->port_num);
+        dev_dbg(&port->dev, "serial->minor = %d\n", serial->minor);
+
+        if (mos7840_port->port_num == 1) {
+                mos7840_port->SpRegOffset = 0x0;
+                mos7840_port->ControlRegOffset = 0x1;
+                mos7840_port->DcrRegOffset = 0x4;
+        } else if ((mos7840_port->port_num == 2) && (serial->num_ports == 4)) {
+                mos7840_port->SpRegOffset = 0x8;
+                mos7840_port->ControlRegOffset = 0x9;
+                mos7840_port->DcrRegOffset = 0x16;
+        } else if ((mos7840_port->port_num == 2) && (serial->num_ports == 2)) {
+                mos7840_port->SpRegOffset = 0xa;
+                mos7840_port->ControlRegOffset = 0xb;
+                mos7840_port->DcrRegOffset = 0x19;
+        } else if ((mos7840_port->port_num == 3) && (serial->num_ports == 4)) {
+                mos7840_port->SpRegOffset = 0xa;
+                mos7840_port->ControlRegOffset = 0xb;
+                mos7840_port->DcrRegOffset = 0x19;
+        } else if ((mos7840_port->port_num == 4) && (serial->num_ports == 4)) {
+                mos7840_port->SpRegOffset = 0xc;
+                mos7840_port->ControlRegOffset = 0xd;
+                mos7840_port->DcrRegOffset = 0x1c;
+        }
+        mos7840_dump_serial_port(port, mos7840_port);
+        mos7840_set_port_private(port, mos7840_port);
+
+        /* enable rx_disable bit in control register */
+        status = mos7840_get_reg_sync(port,
+                        mos7840_port->ControlRegOffset, &Data);
+        if (status < 0) {
+                dev_dbg(&port->dev, "Reading ControlReg failed status-0x%x\n", status);
+                goto out;
+        } else
+                dev_dbg(&port->dev, "ControlReg Reading success val is %x, status%d\n", Data, status);
+        Data |= 0x08;   /* setting driver done bit */
+        Data |= 0x04;   /* sp1_bit to have cts change reflect in
+                           modem status reg */
 
-                Data = 0x05;
-                status = mos7840_set_reg_sync(serial->port[i],
-                         (__u16) (mos7840_port->DcrRegOffset + 1), Data);
-                if (status < 0) {
-                        dev_dbg(&dev->dev, "Writing DCR1 failed status-0x%x\n", status);
-                        break;
-                } else
-                        dev_dbg(&dev->dev, "DCR1 Writing success status%d\n", status);
+        /* Data |= 0x20; //rx_disable bit */
+        status = mos7840_set_reg_sync(port,
+                        mos7840_port->ControlRegOffset, Data);
+        if (status < 0) {
+                dev_dbg(&port->dev, "Writing ControlReg failed(rx_disable) status-0x%x\n", status);
+                goto out;
+        } else
+                dev_dbg(&port->dev, "ControlReg Writing success(rx_disable) status%d\n", status);
 
-                Data = 0x24;
-                status = mos7840_set_reg_sync(serial->port[i],
-                         (__u16) (mos7840_port->DcrRegOffset + 2), Data);
-                if (status < 0) {
-                        dev_dbg(&dev->dev, "Writing DCR2 failed status-0x%x\n", status);
-                        break;
-                } else
-                        dev_dbg(&dev->dev, "DCR2 Writing success status%d\n", status);
+        /* Write default values in DCR (i.e 0x01 in DCR0, 0x05 in DCR2
+           and 0x24 in DCR3 */
+        Data = 0x01;
+        status = mos7840_set_reg_sync(port,
+                        (__u16) (mos7840_port->DcrRegOffset + 0), Data);
+        if (status < 0) {
+                dev_dbg(&port->dev, "Writing DCR0 failed status-0x%x\n", status);
+                goto out;
+        } else
+                dev_dbg(&port->dev, "DCR0 Writing success status%d\n", status);
 
-                /* write values in clkstart0x0 and clkmulti 0x20 */
-                Data = 0x0;
-                status = mos7840_set_reg_sync(serial->port[i],
-                                         CLK_START_VALUE_REGISTER, Data);
-                if (status < 0) {
-                        dev_dbg(&dev->dev, "Writing CLK_START_VALUE_REGISTER failed status-0x%x\n", status);
-                        break;
-                } else
-                        dev_dbg(&dev->dev, "CLK_START_VALUE_REGISTER Writing success status%d\n", status);
+        Data = 0x05;
+        status = mos7840_set_reg_sync(port,
+                        (__u16) (mos7840_port->DcrRegOffset + 1), Data);
+        if (status < 0) {
+                dev_dbg(&port->dev, "Writing DCR1 failed status-0x%x\n", status);
+                goto out;
+        } else
+                dev_dbg(&port->dev, "DCR1 Writing success status%d\n", status);
 
-                Data = 0x20;
-                status = mos7840_set_reg_sync(serial->port[i],
-                                        CLK_MULTI_REGISTER, Data);
-                if (status < 0) {
-                        dev_dbg(&dev->dev, "Writing CLK_MULTI_REGISTER failed status-0x%x\n", status);
-                        goto error;
-                } else
-                        dev_dbg(&dev->dev, "CLK_MULTI_REGISTER Writing success status%d\n", status);
+        Data = 0x24;
+        status = mos7840_set_reg_sync(port,
+                        (__u16) (mos7840_port->DcrRegOffset + 2), Data);
+        if (status < 0) {
+                dev_dbg(&port->dev, "Writing DCR2 failed status-0x%x\n", status);
+                goto out;
+        } else
+                dev_dbg(&port->dev, "DCR2 Writing success status%d\n", status);
 
-                /* write value 0x0 to scratchpad register */
-                Data = 0x00;
-                status = mos7840_set_uart_reg(serial->port[i],
-                                                SCRATCH_PAD_REGISTER, Data);
-                if (status < 0) {
-                        dev_dbg(&dev->dev, "Writing SCRATCH_PAD_REGISTER failed status-0x%x\n", status);
-                        break;
-                } else
-                        dev_dbg(&dev->dev, "SCRATCH_PAD_REGISTER Writing success status%d\n", status);
+        /* write values in clkstart0x0 and clkmulti 0x20 */
+        Data = 0x0;
+        status = mos7840_set_reg_sync(port, CLK_START_VALUE_REGISTER, Data);
+        if (status < 0) {
+                dev_dbg(&port->dev, "Writing CLK_START_VALUE_REGISTER failed status-0x%x\n", status);
+                goto out;
+        } else
+                dev_dbg(&port->dev, "CLK_START_VALUE_REGISTER Writing success status%d\n", status);
 
-                /* Zero Length flag register */
-                if ((mos7840_port->port_num != 1)
-                    && (serial->num_ports == 2)) {
+        Data = 0x20;
+        status = mos7840_set_reg_sync(port, CLK_MULTI_REGISTER, Data);
+        if (status < 0) {
+                dev_dbg(&port->dev, "Writing CLK_MULTI_REGISTER failed status-0x%x\n", status);
+                goto error;
+        } else
+                dev_dbg(&port->dev, "CLK_MULTI_REGISTER Writing success status%d\n", status);
 
-                        Data = 0xff;
-                        status = mos7840_set_reg_sync(serial->port[i],
-                                      (__u16) (ZLP_REG1 +
-                                      ((__u16)mos7840_port->port_num)), Data);
-                        dev_dbg(&dev->dev, "ZLIP offset %x\n",
+        /* write value 0x0 to scratchpad register */
+        Data = 0x00;
+        status = mos7840_set_uart_reg(port, SCRATCH_PAD_REGISTER, Data);
+        if (status < 0) {
+                dev_dbg(&port->dev, "Writing SCRATCH_PAD_REGISTER failed status-0x%x\n", status);
+                goto out;
+        } else
+                dev_dbg(&port->dev, "SCRATCH_PAD_REGISTER Writing success status%d\n", status);
+
+        /* Zero Length flag register */
+        if ((mos7840_port->port_num != 1) && (serial->num_ports == 2)) {
+                Data = 0xff;
+                status = mos7840_set_reg_sync(port,
+                                (__u16) (ZLP_REG1 +
+                                        ((__u16)mos7840_port->port_num)), Data);
+                dev_dbg(&port->dev, "ZLIP offset %x\n",
                                 (__u16)(ZLP_REG1 + ((__u16) mos7840_port->port_num)));
-                        if (status < 0) {
-                                dev_dbg(&dev->dev, "Writing ZLP_REG%d failed status-0x%x\n", i + 2, status);
-                                break;
-                        } else
-                                dev_dbg(&dev->dev, "ZLP_REG%d Writing success status%d\n", i + 2, status);
-                } else {
-                        Data = 0xff;
-                        status = mos7840_set_reg_sync(serial->port[i],
-                              (__u16) (ZLP_REG1 +
-                              ((__u16)mos7840_port->port_num) - 0x1), Data);
-                        dev_dbg(&dev->dev, "ZLIP offset %x\n",
+                if (status < 0) {
+                        dev_dbg(&port->dev, "Writing ZLP_REG%d failed status-0x%x\n", pnum + 2, status);
+                        goto out;
+                } else
+                        dev_dbg(&port->dev, "ZLP_REG%d Writing success status%d\n", pnum + 2, status);
+        } else {
+                Data = 0xff;
+                status = mos7840_set_reg_sync(port,
+                                (__u16) (ZLP_REG1 +
+                                        ((__u16)mos7840_port->port_num) - 0x1), Data);
+                dev_dbg(&port->dev, "ZLIP offset %x\n",
                                 (__u16)(ZLP_REG1 + ((__u16) mos7840_port->port_num) - 0x1));
-                        if (status < 0) {
-                                dev_dbg(&dev->dev, "Writing ZLP_REG%d failed status-0x%x\n", i + 1, status);
-                                break;
-                        } else
-                                dev_dbg(&dev->dev, "ZLP_REG%d Writing success status%d\n", i + 1, status);
+                if (status < 0) {
+                        dev_dbg(&port->dev, "Writing ZLP_REG%d failed status-0x%x\n", pnum + 1, status);
+                        goto out;
+                } else
+                        dev_dbg(&port->dev, "ZLP_REG%d Writing success status%d\n", pnum + 1, status);
 
-                }
-                mos7840_port->control_urb = usb_alloc_urb(0, GFP_KERNEL);
-                mos7840_port->ctrl_buf = kmalloc(16, GFP_KERNEL);
-                mos7840_port->dr = kmalloc(sizeof(struct usb_ctrlrequest),
-                                                                GFP_KERNEL);
-                if (!mos7840_port->control_urb || !mos7840_port->ctrl_buf ||
-                                                        !mos7840_port->dr) {
-                        status = -ENOMEM;
-                        goto error;
-                }
+        }
+        mos7840_port->control_urb = usb_alloc_urb(0, GFP_KERNEL);
+        mos7840_port->ctrl_buf = kmalloc(16, GFP_KERNEL);
+        mos7840_port->dr = kmalloc(sizeof(struct usb_ctrlrequest),
+                        GFP_KERNEL);
+        if (!mos7840_port->control_urb || !mos7840_port->ctrl_buf ||
+                        !mos7840_port->dr) {
+                status = -ENOMEM;
+                goto error;
+        }
 
-                mos7840_port->has_led = false;
+        mos7840_port->has_led = false;
 
-                /* Initialize LED timers */
-                if (device_type == MOSCHIP_DEVICE_ID_7810) {
-                        mos7840_port->has_led = true;
+        /* Initialize LED timers */
+        if (device_type == MOSCHIP_DEVICE_ID_7810) {
+                mos7840_port->has_led = true;
 
-                        init_timer(&mos7840_port->led_timer1);
-                        mos7840_port->led_timer1.function = mos7840_led_off;
-                        mos7840_port->led_timer1.expires =
-                                        jiffies + msecs_to_jiffies(LED_ON_MS);
-                        mos7840_port->led_timer1.data =
-                                                (unsigned long)mos7840_port;
+                init_timer(&mos7840_port->led_timer1);
+                mos7840_port->led_timer1.function = mos7840_led_off;
+                mos7840_port->led_timer1.expires =
+                        jiffies + msecs_to_jiffies(LED_ON_MS);
+                mos7840_port->led_timer1.data = (unsigned long)mos7840_port;
 
-                        init_timer(&mos7840_port->led_timer2);
-                        mos7840_port->led_timer2.function =
-                                                mos7840_led_flag_off;
-                        mos7840_port->led_timer2.expires =
-                                        jiffies + msecs_to_jiffies(LED_OFF_MS);
-                        mos7840_port->led_timer2.data =
-                                                (unsigned long)mos7840_port;
+                init_timer(&mos7840_port->led_timer2);
+                mos7840_port->led_timer2.function = mos7840_led_flag_off;
+                mos7840_port->led_timer2.expires =
+                        jiffies + msecs_to_jiffies(LED_OFF_MS);
+                mos7840_port->led_timer2.data = (unsigned long)mos7840_port;
 
-                        mos7840_port->led_flag = false;
+                mos7840_port->led_flag = false;
 
-                        /* Turn off LED */
-                        mos7840_set_led_sync(serial->port[i],
-                                                MODEM_CONTROL_REGISTER, 0x0300);
-                }
+                /* Turn off LED */
+                mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
         }
+out:
+        if (pnum == serial->num_ports - 1) {
+                /* Zero Length flag enable */
+                Data = 0x0f;
+                status = mos7840_set_reg_sync(serial->port[0], ZLP_REG5, Data);
+                if (status < 0) {
+                        dev_dbg(&port->dev, "Writing ZLP_REG5 failed status-0x%x\n", status);
+                        goto error;
+                } else
+                        dev_dbg(&port->dev, "ZLP_REG5 Writing success status%d\n", status);
 
-        /* Zero Length flag enable */
-        Data = 0x0f;
-        status = mos7840_set_reg_sync(serial->port[0], ZLP_REG5, Data);
-        if (status < 0) {
-                dev_dbg(&dev->dev, "Writing ZLP_REG5 failed status-0x%x\n", status);
-                goto error;
-        } else
-                dev_dbg(&dev->dev, "ZLP_REG5 Writing success status%d\n", status);
-
-        /* setting configuration feature to one */
-        usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
-                        (__u8) 0x03, 0x00, 0x01, 0x00, NULL, 0x00, MOS_WDR_TIMEOUT);
+                /* setting configuration feature to one */
+                usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+                                0x03, 0x00, 0x01, 0x00, NULL, 0x00,
+                                MOS_WDR_TIMEOUT);
+        }
         return 0;
 error:
-        for (/* nothing */; i >= 0; i--) {
-                mos7840_port = mos7840_get_port_private(serial->port[i]);
+        kfree(mos7840_port->dr);
+        kfree(mos7840_port->ctrl_buf);
+        usb_free_urb(mos7840_port->control_urb);
+        kfree(mos7840_port);
 
-                kfree(mos7840_port->dr);
-                kfree(mos7840_port->ctrl_buf);
-                usb_free_urb(mos7840_port->control_urb);
-                kfree(mos7840_port);
-                serial->port[i] = NULL;
-        }
         return status;
 }
 
-/****************************************************************************
- * mos7840_disconnect
- *      This function is called whenever the device is removed from the usb bus.
- ****************************************************************************/
-
-static void mos7840_disconnect(struct usb_serial *serial)
+static int mos7840_port_remove(struct usb_serial_port *port)
 {
-        int i;
-        unsigned long flags;
         struct moschip_port *mos7840_port;
 
-        /* check for the ports to be closed,close the ports and disconnect */
+        mos7840_port = mos7840_get_port_private(port);
 
-        /* free private structure allocated for serial port  *
-         * stop reads and writes on all ports                */
+        if (mos7840_port->has_led) {
+                /* Turn off LED */
+                mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                mos7840_port = mos7840_get_port_private(serial->port[i]);
-                if (mos7840_port) {
-                        spin_lock_irqsave(&mos7840_port->pool_lock, flags);
-                        mos7840_port->zombie = 1;
-                        spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
-                        usb_kill_urb(mos7840_port->control_urb);
-                }
+                del_timer_sync(&mos7840_port->led_timer1);
+                del_timer_sync(&mos7840_port->led_timer2);
         }
-}
-
-/****************************************************************************
- * mos7840_release
- *      This function is called when the usb_serial structure is freed.
- ****************************************************************************/
-
-static void mos7840_release(struct usb_serial *serial)
-{
-        int i;
-        struct moschip_port *mos7840_port;
-
-        /* check for the ports to be closed,close the ports and disconnect */
+        usb_kill_urb(mos7840_port->control_urb);
+        usb_free_urb(mos7840_port->control_urb);
+        kfree(mos7840_port->ctrl_buf);
+        kfree(mos7840_port->dr);
+        kfree(mos7840_port);
 
-        /* free private structure allocated for serial port  *
-         * stop reads and writes on all ports                */
-
-        for (i = 0; i < serial->num_ports; ++i) {
-                mos7840_port = mos7840_get_port_private(serial->port[i]);
-                if (mos7840_port) {
-                        if (mos7840_port->has_led) {
-                                /* Turn off LED */
-                                mos7840_set_led_sync(mos7840_port->port,
-                                                MODEM_CONTROL_REGISTER, 0x0300);
-
-                                del_timer_sync(&mos7840_port->led_timer1);
-                                del_timer_sync(&mos7840_port->led_timer2);
-                        }
-                        kfree(mos7840_port->ctrl_buf);
-                        kfree(mos7840_port->dr);
-                        kfree(mos7840_port);
-                }
-        }
+        return 0;
 }
 
 static struct usb_serial_driver moschip7840_4port_device = {
@@ -2677,9 +2597,8 @@ static struct usb_serial_driver moschip7840_4port_device = {
         .tiocmget = mos7840_tiocmget,
         .tiocmset = mos7840_tiocmset,
         .get_icount = mos7840_get_icount,
-        .attach = mos7840_startup,
-        .disconnect = mos7840_disconnect,
-        .release = mos7840_release,
+        .port_probe = mos7840_port_probe,
+        .port_remove = mos7840_port_remove,
         .read_bulk_callback = mos7840_bulk_in_callback,
         .read_int_callback = mos7840_interrupt_callback,
 };
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index 6def58b79382..9ab73d295774 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -44,8 +44,8 @@ static int  omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
                                 const unsigned char *buf, int count);
 static int  omninet_write_room(struct tty_struct *tty);
 static void omninet_disconnect(struct usb_serial *serial);
-static void omninet_release(struct usb_serial *serial);
-static int omninet_attach(struct usb_serial *serial);
+static int omninet_port_probe(struct usb_serial_port *port);
+static int omninet_port_remove(struct usb_serial_port *port);
 
 static const struct usb_device_id id_table[] = {
         { USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNINET_ID) },
@@ -62,7 +62,8 @@ static struct usb_serial_driver zyxel_omninet_device = {
         .description =          "ZyXEL - omni.net lcd plus usb",
         .id_table =             id_table,
         .num_ports =            1,
-        .attach =               omninet_attach,
+        .port_probe =           omninet_port_probe,
+        .port_remove =          omninet_port_remove,
         .open =                 omninet_open,
         .close =                omninet_close,
         .write =                omninet_write,
@@ -70,7 +71,6 @@ static struct usb_serial_driver zyxel_omninet_device = {
         .read_bulk_callback =   omninet_read_bulk_callback,
         .write_bulk_callback =  omninet_write_bulk_callback,
         .disconnect =           omninet_disconnect,
-        .release =              omninet_release,
 };
 
 static struct usb_serial_driver * const serial_drivers[] = {
@@ -112,18 +112,26 @@ struct omninet_data {
         __u8    od_outseq;      /* Sequence number for bulk_out URBs */
 };
 
-static int omninet_attach(struct usb_serial *serial)
+static int omninet_port_probe(struct usb_serial_port *port)
 {
         struct omninet_data *od;
-        struct usb_serial_port *port = serial->port[0];
 
         od = kmalloc(sizeof(struct omninet_data), GFP_KERNEL);
-        if (!od) {
-                dev_err(&port->dev, "%s- kmalloc(%Zd) failed.\n",
-                        __func__, sizeof(struct omninet_data));
+        if (!od)
                 return -ENOMEM;
-        }
+
         usb_set_serial_port_data(port, od);
+
+        return 0;
+}
+
+static int omninet_port_remove(struct usb_serial_port *port)
+{
+        struct omninet_data *od;
+
+        od = usb_get_serial_port_data(port);
+        kfree(od);
+
         return 0;
 }
 
@@ -279,14 +287,6 @@ static void omninet_disconnect(struct usb_serial *serial)
         usb_kill_urb(wport->write_urb);
 }
 
-
-static void omninet_release(struct usb_serial *serial)
-{
-        struct usb_serial_port *port = serial->port[0];
-
-        kfree(usb_get_serial_port_data(port));
-}
-
 module_usb_serial_driver(serial_drivers, id_table);
 
 MODULE_AUTHOR(DRIVER_AUTHOR);
diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index 41b1647306eb..6aba731d4864 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -155,7 +155,11 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype,
 {
         struct usb_serial *serial = port->serial;
         int retval;
-        u8 buffer[2];
+        u8 *buffer;
+
+        buffer = kzalloc(1, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
 
         buffer[0] = val;
         /* Send the message to the vendor control endpoint
@@ -164,6 +168,7 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype,
                                 requesttype,
                                 USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
                                 0, 0, buffer, 1, 0);
+        kfree(buffer);
 
         return retval;
 }
@@ -281,7 +286,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
         if (!dr) {
                 dev_err(&port->dev, "out of memory\n");
                 count = -ENOMEM;
-                goto error;
+                goto error_no_dr;
         }
 
         dr->bRequestType = USB_TYPE_VENDOR | USB_RECIP_INTERFACE | USB_DIR_OUT;
@@ -311,6 +316,8 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
 
         return count;
 error:
+        kfree(dr);
+error_no_dr:
         usb_free_urb(urb);
 error_no_urb:
         kfree(buffer);
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 54d4148d01d1..5dee7d61241e 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -47,6 +47,7 @@
 /* Function prototypes */
 static int  option_probe(struct usb_serial *serial,
                         const struct usb_device_id *id);
+static int option_attach(struct usb_serial *serial);
 static void option_release(struct usb_serial *serial);
 static int option_send_setup(struct usb_serial_port *port);
 static void option_instat_callback(struct urb *urb);
@@ -1288,8 +1289,9 @@ static struct usb_serial_driver option_1port_device = {
         .tiocmget          = usb_wwan_tiocmget,
         .tiocmset          = usb_wwan_tiocmset,
         .ioctl             = usb_wwan_ioctl,
-        .attach            = usb_wwan_startup,
+        .attach            = option_attach,
         .release           = option_release,
+        .port_probe        = usb_wwan_port_probe,
         .port_remove       = usb_wwan_port_remove,
         .read_int_callback = option_instat_callback,
 #ifdef CONFIG_PM
@@ -1335,8 +1337,6 @@ static bool is_blacklisted(const u8 ifnum, enum option_blacklist_reason reason,
 static int option_probe(struct usb_serial *serial,
                         const struct usb_device_id *id)
 {
-        struct usb_wwan_intf_private *data;
-        struct option_private *priv;
         struct usb_interface_descriptor *iface_desc =
                                 &serial->interface->cur_altsetting->desc;
         struct usb_device_descriptor *dev_desc = &serial->dev->descriptor;
@@ -1374,6 +1374,19 @@ static int option_probe(struct usb_serial *serial,
                 iface_desc->bInterfaceClass != USB_CLASS_CDC_DATA)
                 return -ENODEV;
 
+        /* Store device id so we can use it during attach. */
+        usb_set_serial_data(serial, (void *)id);
+
+        return 0;
+}
+
+static int option_attach(struct usb_serial *serial)
+{
+        struct usb_interface_descriptor *iface_desc;
+        const struct usb_device_id *id;
+        struct usb_wwan_intf_private *data;
+        struct option_private *priv;
+
         data = kzalloc(sizeof(struct usb_wwan_intf_private), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
@@ -1384,6 +1397,10 @@ static int option_probe(struct usb_serial *serial,
                 return -ENOMEM;
         }
 
+        /* Retrieve device id stored at probe. */
+        id = usb_get_serial_data(serial);
+        iface_desc = &serial->interface->cur_altsetting->desc;
+
         priv->bInterfaceNumber = iface_desc->bInterfaceNumber;
         data->private = priv;
 
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index c3ddb65c05f2..aa148c21ea40 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -138,7 +138,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
 
 static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
 {
-        struct usb_wwan_intf_private *data;
         struct usb_host_interface *intf = serial->interface->cur_altsetting;
         struct device *dev = &serial->dev->dev;
         int retval = -ENODEV;
@@ -154,13 +153,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
         ifnum = intf->desc.bInterfaceNumber;
         dev_dbg(dev, "This Interface = %d\n", ifnum);
 
-        data = kzalloc(sizeof(struct usb_wwan_intf_private),
-                                         GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-
-        spin_lock_init(&data->susp_lock);
-
         if (nintf == 1) {
                 /* QDL mode */
                 /* Gobi 2000 has a single altsetting, older ones have two */
@@ -253,20 +245,28 @@ done:
                 }
         }
 
-        /* Set serial->private if not returning error */
-        if (retval == 0)
-                usb_set_serial_data(serial, data);
-        else
-                kfree(data);
-
         return retval;
 }
 
+static int qc_attach(struct usb_serial *serial)
+{
+        struct usb_wwan_intf_private *data;
+
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        spin_lock_init(&data->susp_lock);
+
+        usb_set_serial_data(serial, data);
+
+        return 0;
+}
+
 static void qc_release(struct usb_serial *serial)
 {
         struct usb_wwan_intf_private *priv = usb_get_serial_data(serial);
 
-        /* Free the private data allocated in qcprobe */
         usb_set_serial_data(serial, NULL);
         kfree(priv);
 }
@@ -285,8 +285,9 @@ static struct usb_serial_driver qcdevice = {
         .write               = usb_wwan_write,
         .write_room          = usb_wwan_write_room,
         .chars_in_buffer     = usb_wwan_chars_in_buffer,
-        .attach              = usb_wwan_startup,
+        .attach              = qc_attach,
         .release             = qc_release,
+        .port_probe          = usb_wwan_port_probe,
         .port_remove         = usb_wwan_port_remove,
 #ifdef CONFIG_PM
         .suspend             = usb_wwan_suspend,
diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
index 2cdfdcc90b37..ffcfc962ab10 100644
--- a/drivers/usb/serial/quatech2.c
+++ b/drivers/usb/serial/quatech2.c
@@ -143,12 +143,12 @@ static void qt2_read_bulk_callback(struct urb *urb);
 
 static void qt2_release(struct usb_serial *serial)
 {
-        int i;
+        struct qt2_serial_private *serial_priv;
 
-        kfree(usb_get_serial_data(serial));
+        serial_priv = usb_get_serial_data(serial);
 
-        for (i = 0; i < serial->num_ports; i++)
-                kfree(usb_get_serial_port_data(serial->port[i]));
+        usb_free_urb(serial_priv->read_urb);
+        kfree(serial_priv);
 }
 
 static inline int calc_baud_divisor(int baudrate)
@@ -423,11 +423,16 @@ static void qt2_close(struct usb_serial_port *port)
         port_priv->is_open = false;
 
         spin_lock_irqsave(&port_priv->urb_lock, flags);
-        if (port_priv->write_urb->status == -EINPROGRESS)
-                usb_kill_urb(port_priv->write_urb);
+        usb_kill_urb(port_priv->write_urb);
         port_priv->urb_in_use = false;
         spin_unlock_irqrestore(&port_priv->urb_lock, flags);
 
+        mutex_lock(&port->serial->disc_mutex);
+        if (port->serial->disconnected) {
+                mutex_unlock(&port->serial->disc_mutex);
+                return;
+        }
+
         /* flush the port transmit buffer */
         i = usb_control_msg(serial->dev,
                             usb_rcvctrlpipe(serial->dev, 0),
@@ -459,26 +464,14 @@ static void qt2_close(struct usb_serial_port *port)
                 dev_err(&port->dev, "%s - close port failed %i\n",
                         __func__, i);
 
+        mutex_unlock(&port->serial->disc_mutex);
 }
 
 static void qt2_disconnect(struct usb_serial *serial)
 {
         struct qt2_serial_private *serial_priv = usb_get_serial_data(serial);
-        struct qt2_port_private *port_priv;
-        int i;
-
-        if (serial_priv->read_urb->status == -EINPROGRESS)
-                usb_kill_urb(serial_priv->read_urb);
-
-        usb_free_urb(serial_priv->read_urb);
 
-        for (i = 0; i < serial->num_ports; i++) {
-                port_priv = usb_get_serial_port_data(serial->port[i]);
-
-                if (port_priv->write_urb->status == -EINPROGRESS)
-                        usb_kill_urb(port_priv->write_urb);
-                usb_free_urb(port_priv->write_urb);
-        }
+        usb_kill_urb(serial_priv->read_urb);
 }
 
 static int get_serial_info(struct usb_serial_port *port,
@@ -773,11 +766,9 @@ static void qt2_read_bulk_callback(struct urb *urb)
 
 static int qt2_setup_urbs(struct usb_serial *serial)
 {
-        struct usb_serial_port *port;
         struct usb_serial_port *port0;
         struct qt2_serial_private *serial_priv;
-        struct qt2_port_private *port_priv;
-        int pcount, status;
+        int status;
 
         port0 = serial->port[0];
 
@@ -795,46 +786,21 @@ static int qt2_setup_urbs(struct usb_serial *serial)
                           sizeof(serial_priv->read_buffer),
                           qt2_read_bulk_callback, serial);
 
-        /* setup write_urb for each port */
-        for (pcount = 0; pcount < serial->num_ports; pcount++) {
-
-                port = serial->port[pcount];
-                port_priv = usb_get_serial_port_data(port);
-
-                port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL);
-                if (!port_priv->write_urb) {
-                        dev_err(&serial->dev->dev,
-                                "failed to alloc write_urb for port %i\n",
-                                pcount);
-                        return -ENOMEM;
-                }
-
-                usb_fill_bulk_urb(port_priv->write_urb,
-                                  serial->dev,
-                                  usb_sndbulkpipe(serial->dev,
-                                                  port0->
-                                                  bulk_out_endpointAddress),
-                                  port_priv->write_buffer,
-                                  sizeof(port_priv->write_buffer),
-                                  qt2_write_bulk_callback, port);
-        }
-
         status = usb_submit_urb(serial_priv->read_urb, GFP_KERNEL);
         if (status != 0) {
                 dev_err(&serial->dev->dev,
                         "%s - submit read urb failed %i\n", __func__, status);
+                usb_free_urb(serial_priv->read_urb);
                 return status;
         }
 
         return 0;
-
 }
 
 static int qt2_attach(struct usb_serial *serial)
 {
         struct qt2_serial_private *serial_priv;
-        struct qt2_port_private *port_priv;
-        int status, pcount;
+        int status;
 
         /* power on unit */
         status = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
@@ -854,26 +820,6 @@ static int qt2_attach(struct usb_serial *serial)
 
         usb_set_serial_data(serial, serial_priv);
 
-        for (pcount = 0; pcount < serial->num_ports; pcount++) {
-                port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL);
-                if (!port_priv) {
-                        dev_err(&serial->dev->dev,
-                                "%s- kmalloc(%Zd) failed.\n", __func__,
-                                sizeof(*port_priv));
-                        pcount--;
-                        status = -ENOMEM;
-                        goto attach_failed;
-                }
-
-                spin_lock_init(&port_priv->lock);
-                spin_lock_init(&port_priv->urb_lock);
-                init_waitqueue_head(&port_priv->delta_msr_wait);
-
-                port_priv->port = serial->port[pcount];
-
-                usb_set_serial_port_data(serial->port[pcount], port_priv);
-        }
-
         status = qt2_setup_urbs(serial);
         if (status != 0)
                 goto attach_failed;
@@ -881,14 +827,53 @@ static int qt2_attach(struct usb_serial *serial)
         return 0;
 
 attach_failed:
-        for (/* empty */; pcount >= 0; pcount--) {
-                port_priv = usb_get_serial_port_data(serial->port[pcount]);
-                kfree(port_priv);
-        }
         kfree(serial_priv);
         return status;
 }
 
+static int qt2_port_probe(struct usb_serial_port *port)
+{
+        struct usb_serial *serial = port->serial;
+        struct qt2_port_private *port_priv;
+        u8 bEndpointAddress;
+
+        port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL);
+        if (!port_priv)
+                return -ENOMEM;
+
+        spin_lock_init(&port_priv->lock);
+        spin_lock_init(&port_priv->urb_lock);
+        init_waitqueue_head(&port_priv->delta_msr_wait);
+        port_priv->port = port;
+
+        port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (!port_priv->write_urb) {
+                kfree(port_priv);
+                return -ENOMEM;
+        }
+        bEndpointAddress = serial->port[0]->bulk_out_endpointAddress;
+        usb_fill_bulk_urb(port_priv->write_urb, serial->dev,
+                                usb_sndbulkpipe(serial->dev, bEndpointAddress),
+                                port_priv->write_buffer,
+                                sizeof(port_priv->write_buffer),
+                                qt2_write_bulk_callback, port);
+
+        usb_set_serial_port_data(port, port_priv);
+
+        return 0;
+}
+
+static int qt2_port_remove(struct usb_serial_port *port)
+{
+        struct qt2_port_private *port_priv;
+
+        port_priv = usb_get_serial_port_data(port);
+        usb_free_urb(port_priv->write_urb);
+        kfree(port_priv);
+
+        return 0;
+}
+
 static int qt2_tiocmget(struct tty_struct *tty)
 {
         struct usb_serial_port *port = tty->driver_data;
@@ -1127,6 +1112,8 @@ static struct usb_serial_driver qt2_device = {
         .attach              = qt2_attach,
         .release             = qt2_release,
         .disconnect          = qt2_disconnect,
+        .port_probe          = qt2_port_probe,
+        .port_remove         = qt2_port_remove,
         .dtr_rts             = qt2_dtr_rts,
         .break_ctl           = qt2_break_ctl,
         .tiocmget            = qt2_tiocmget,
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 01d882cf3775..270860f6bb2a 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -161,7 +161,6 @@ static int sierra_probe(struct usb_serial *serial,
 {
         int result = 0;
         struct usb_device *udev;
-        struct sierra_intf_private *data;
         u8 ifnum;
 
         udev = serial->dev;
@@ -188,11 +187,6 @@ static int sierra_probe(struct usb_serial *serial,
                 return -ENODEV;
         }
 
-        data = serial->private = kzalloc(sizeof(struct sierra_intf_private), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-        spin_lock_init(&data->susp_lock);
-
         return result;
 }
 
@@ -884,11 +878,15 @@ static void sierra_dtr_rts(struct usb_serial_port *port, int on)
 
 static int sierra_startup(struct usb_serial *serial)
 {
-        struct usb_serial_port *port;
-        struct sierra_port_private *portdata;
-        struct sierra_iface_info *himemoryp = NULL;
-        int i;
-        u8 ifnum;
+        struct sierra_intf_private *intfdata;
+
+        intfdata = kzalloc(sizeof(*intfdata), GFP_KERNEL);
+        if (!intfdata)
+                return -ENOMEM;
+
+        spin_lock_init(&intfdata->susp_lock);
+
+        usb_set_serial_data(serial, intfdata);
 
         /* Set Device mode to D0 */
         sierra_set_power_state(serial->dev, 0x0000);
@@ -897,68 +895,71 @@ static int sierra_startup(struct usb_serial *serial)
         if (nmea)
                 sierra_vsc_set_nmea(serial->dev, 1);
 
-        /* Now setup per port private data */
-        for (i = 0; i < serial->num_ports; i++) {
-                port = serial->port[i];
-                portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
-                if (!portdata) {
-                        dev_dbg(&port->dev, "%s: kmalloc for "
-                                "sierra_port_private (%d) failed!\n",
-                                __func__, i);
-                        return -ENOMEM;
-                }
-                spin_lock_init(&portdata->lock);
-                init_usb_anchor(&portdata->active);
-                init_usb_anchor(&portdata->delayed);
-                ifnum = i;
-                /* Assume low memory requirements */
-                portdata->num_out_urbs = N_OUT_URB;
-                portdata->num_in_urbs  = N_IN_URB;
-
-                /* Determine actual memory requirements */
-                if (serial->num_ports == 1) {
-                        /* Get interface number for composite device */
-                        ifnum = sierra_calc_interface(serial);
-                        himemoryp =
-                            (struct sierra_iface_info *)&typeB_interface_list;
-                        if (is_himemory(ifnum, himemoryp)) {
-                                portdata->num_out_urbs = N_OUT_URB_HM;
-                                portdata->num_in_urbs  = N_IN_URB_HM;
-                        }
-                }
-                else {
-                        himemoryp =
-                            (struct sierra_iface_info *)&typeA_interface_list;
-                        if (is_himemory(i, himemoryp)) {
-                                portdata->num_out_urbs = N_OUT_URB_HM;
-                                portdata->num_in_urbs  = N_IN_URB_HM;
-                        }
-                }
-                dev_dbg(&serial->dev->dev,
-                        "Memory usage (urbs) interface #%d, in=%d, out=%d\n",
-                        ifnum,portdata->num_in_urbs, portdata->num_out_urbs );
-                /* Set the port private data pointer */
-                usb_set_serial_port_data(port, portdata);
-        }
-
         return 0;
 }
 
 static void sierra_release(struct usb_serial *serial)
 {
-        int i;
-        struct usb_serial_port *port;
+        struct sierra_intf_private *intfdata;
+
+        intfdata = usb_get_serial_data(serial);
+        kfree(intfdata);
+}
+
+static int sierra_port_probe(struct usb_serial_port *port)
+{
+        struct usb_serial *serial = port->serial;
         struct sierra_port_private *portdata;
+        const struct sierra_iface_info *himemoryp;
+        u8 ifnum;
 
-        for (i = 0; i < serial->num_ports; ++i) {
-                port = serial->port[i];
-                if (!port)
-                        continue;
-                portdata = usb_get_serial_port_data(port);
-                if (!portdata)
-                        continue;
-                kfree(portdata);
+        portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
+        if (!portdata)
+                return -ENOMEM;
+
+        spin_lock_init(&portdata->lock);
+        init_usb_anchor(&portdata->active);
+        init_usb_anchor(&portdata->delayed);
+
+        /* Assume low memory requirements */
+        portdata->num_out_urbs = N_OUT_URB;
+        portdata->num_in_urbs  = N_IN_URB;
+
+        /* Determine actual memory requirements */
+        if (serial->num_ports == 1) {
+                /* Get interface number for composite device */
+                ifnum = sierra_calc_interface(serial);
+                himemoryp = &typeB_interface_list;
+        } else {
+                /* This is really the usb-serial port number of the interface
+                 * rather than the interface number.
+                 */
+                ifnum = port->number - serial->minor;
+                himemoryp = &typeA_interface_list;
         }
+
+        if (is_himemory(ifnum, himemoryp)) {
+                portdata->num_out_urbs = N_OUT_URB_HM;
+                portdata->num_in_urbs  = N_IN_URB_HM;
+        }
+
+        dev_dbg(&port->dev,
+                        "Memory usage (urbs) interface #%d, in=%d, out=%d\n",
+                        ifnum, portdata->num_in_urbs, portdata->num_out_urbs);
+
+        usb_set_serial_port_data(port, portdata);
+
+        return 0;
+}
+
+static int sierra_port_remove(struct usb_serial_port *port)
+{
+        struct sierra_port_private *portdata;
+
+        portdata = usb_get_serial_port_data(port);
+        kfree(portdata);
+
+        return 0;
 }
 
 #ifdef CONFIG_PM
@@ -1062,6 +1063,8 @@ static struct usb_serial_driver sierra_device = {
         .tiocmset          = sierra_tiocmset,
         .attach            = sierra_startup,
         .release           = sierra_release,
+        .port_probe        = sierra_port_probe,
+        .port_remove       = sierra_port_remove,
         .suspend           = sierra_suspend,
         .resume            = sierra_resume,
         .read_int_callback = sierra_instat_callback,
diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h
index 1f034d2397c6..684739b8efd0 100644
--- a/drivers/usb/serial/usb-wwan.h
+++ b/drivers/usb/serial/usb-wwan.h
@@ -8,7 +8,7 @@
 extern void usb_wwan_dtr_rts(struct usb_serial_port *port, int on);
 extern int usb_wwan_open(struct tty_struct *tty, struct usb_serial_port *port);
 extern void usb_wwan_close(struct usb_serial_port *port);
-extern int usb_wwan_startup(struct usb_serial *serial);
+extern int usb_wwan_port_probe(struct usb_serial_port *port);
 extern int usb_wwan_port_remove(struct usb_serial_port *port);
 extern int usb_wwan_write_room(struct tty_struct *tty);
 extern void usb_wwan_set_termios(struct tty_struct *tty,
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index e42aa398ed37..61a73ad1a187 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -447,10 +447,12 @@ void usb_wwan_close(struct usb_serial_port *port)
 EXPORT_SYMBOL(usb_wwan_close);
 
 /* Helper functions used by usb_wwan_setup_urbs */
-static struct urb *usb_wwan_setup_urb(struct usb_serial *serial, int endpoint,
+static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port,
+                                      int endpoint,
                                       int dir, void *ctx, char *buf, int len,
                                       void (*callback) (struct urb *))
 {
+        struct usb_serial *serial = port->serial;
         struct urb *urb;
 
         if (endpoint == -1)
@@ -472,101 +474,75 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial *serial, int endpoint,
         return urb;
 }
 
-/* Setup urbs */
-static void usb_wwan_setup_urbs(struct usb_serial *serial)
+int usb_wwan_port_probe(struct usb_serial_port *port)
 {
-        int i, j;
-        struct usb_serial_port *port;
         struct usb_wwan_port_private *portdata;
+        struct urb *urb;
+        u8 *buffer;
+        int err;
+        int i;
 
-        for (i = 0; i < serial->num_ports; i++) {
-                port = serial->port[i];
-                portdata = usb_get_serial_port_data(port);
+        portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
+        if (!portdata)
+                return -ENOMEM;
 
-                /* Do indat endpoints first */
-                for (j = 0; j < N_IN_URB; ++j) {
-                        portdata->in_urbs[j] = usb_wwan_setup_urb(serial,
-                                                                  port->
-                                                                  bulk_in_endpointAddress,
-                                                                  USB_DIR_IN,
-                                                                  port,
-                                                                  portdata->
-                                                                  in_buffer[j],
-                                                                  IN_BUFLEN,
-                                                                  usb_wwan_indat_callback);
-                }
+        init_usb_anchor(&portdata->delayed);
 
-                /* outdat endpoints */
-                for (j = 0; j < N_OUT_URB; ++j) {
-                        portdata->out_urbs[j] = usb_wwan_setup_urb(serial,
-                                                                   port->
-                                                                   bulk_out_endpointAddress,
-                                                                   USB_DIR_OUT,
-                                                                   port,
-                                                                   portdata->
-                                                                   out_buffer
-                                                                   [j],
-                                                                   OUT_BUFLEN,
-                                                                   usb_wwan_outdat_callback);
-                }
+        for (i = 0; i < N_IN_URB; i++) {
+                buffer = (u8 *)__get_free_page(GFP_KERNEL);
+                if (!buffer)
+                        goto bail_out_error;
+                portdata->in_buffer[i] = buffer;
+
+                urb = usb_wwan_setup_urb(port, port->bulk_in_endpointAddress,
+                                                USB_DIR_IN, port,
+                                                buffer, IN_BUFLEN,
+                                                usb_wwan_indat_callback);
+                portdata->in_urbs[i] = urb;
         }
-}
-
-int usb_wwan_startup(struct usb_serial *serial)
-{
-        int i, j, err;
-        struct usb_serial_port *port;
-        struct usb_wwan_port_private *portdata;
-        u8 *buffer;
 
-        /* Now setup per port private data */
-        for (i = 0; i < serial->num_ports; i++) {
-                port = serial->port[i];
-                portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
-                if (!portdata) {
-                        dev_dbg(&port->dev, "%s: kmalloc for usb_wwan_port_private (%d) failed!.\n",
-                                __func__, i);
-                        return 1;
-                }
-                init_usb_anchor(&portdata->delayed);
+        for (i = 0; i < N_OUT_URB; i++) {
+                if (port->bulk_out_endpointAddress == -1)
+                        continue;
 
-                for (j = 0; j < N_IN_URB; j++) {
-                        buffer = (u8 *) __get_free_page(GFP_KERNEL);
-                        if (!buffer)
-                                goto bail_out_error;
-                        portdata->in_buffer[j] = buffer;
-                }
+                buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
+                if (!buffer)
+                        goto bail_out_error2;
+                portdata->out_buffer[i] = buffer;
 
-                for (j = 0; j < N_OUT_URB; j++) {
-                        buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
-                        if (!buffer)
-                                goto bail_out_error2;
-                        portdata->out_buffer[j] = buffer;
-                }
+                urb = usb_wwan_setup_urb(port, port->bulk_out_endpointAddress,
+                                                USB_DIR_OUT, port,
+                                                buffer, OUT_BUFLEN,
+                                                usb_wwan_outdat_callback);
+                portdata->out_urbs[i] = urb;
+        }
 
-                usb_set_serial_port_data(port, portdata);
+        usb_set_serial_port_data(port, portdata);
 
-                if (!port->interrupt_in_urb)
-                        continue;
+        if (port->interrupt_in_urb) {
                 err = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
                 if (err)
                         dev_dbg(&port->dev, "%s: submit irq_in urb failed %d\n",
                                 __func__, err);
         }
-        usb_wwan_setup_urbs(serial);
+
         return 0;
 
 bail_out_error2:
-        for (j = 0; j < N_OUT_URB; j++)
-                kfree(portdata->out_buffer[j]);
+        for (i = 0; i < N_OUT_URB; i++) {
+                usb_free_urb(portdata->out_urbs[i]);
+                kfree(portdata->out_buffer[i]);
+        }
 bail_out_error:
-        for (j = 0; j < N_IN_URB; j++)
-                if (portdata->in_buffer[j])
-                        free_page((unsigned long)portdata->in_buffer[j]);
+        for (i = 0; i < N_IN_URB; i++) {
+                usb_free_urb(portdata->in_urbs[i]);
+                free_page((unsigned long)portdata->in_buffer[i]);
+        }
         kfree(portdata);
-        return 1;
+
+        return -ENOMEM;
 }
-EXPORT_SYMBOL(usb_wwan_startup);
+EXPORT_SYMBOL_GPL(usb_wwan_port_probe);
 
 int usb_wwan_port_remove(struct usb_serial_port *port)
 {
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 346c7efc20b0..b9fca3586d74 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -83,6 +83,8 @@ static int  whiteheat_firmware_attach(struct usb_serial *serial);
 /* function prototypes for the Connect Tech WhiteHEAT serial converter */
 static int  whiteheat_attach(struct usb_serial *serial);
 static void whiteheat_release(struct usb_serial *serial);
+static int  whiteheat_port_probe(struct usb_serial_port *port);
+static int  whiteheat_port_remove(struct usb_serial_port *port);
 static int  whiteheat_open(struct tty_struct *tty,
                         struct usb_serial_port *port);
 static void whiteheat_close(struct usb_serial_port *port);
@@ -117,6 +119,8 @@ static struct usb_serial_driver whiteheat_device = {
         .num_ports =            4,
         .attach =               whiteheat_attach,
         .release =              whiteheat_release,
+        .port_probe =           whiteheat_port_probe,
+        .port_remove =          whiteheat_port_remove,
         .open =                 whiteheat_open,
         .close =                whiteheat_close,
         .ioctl =                whiteheat_ioctl,
@@ -218,15 +222,12 @@ static int whiteheat_attach(struct usb_serial *serial)
 {
         struct usb_serial_port *command_port;
         struct whiteheat_command_private *command_info;
-        struct usb_serial_port *port;
-        struct whiteheat_private *info;
         struct whiteheat_hw_info *hw_info;
         int pipe;
         int ret;
         int alen;
         __u8 *command;
         __u8 *result;
-        int i;
 
         command_port = serial->port[COMMAND_PORT];
 
@@ -285,22 +286,6 @@ static int whiteheat_attach(struct usb_serial *serial)
                  serial->type->description,
                  hw_info->sw_major_rev, hw_info->sw_minor_rev);
 
-        for (i = 0; i < serial->num_ports; i++) {
-                port = serial->port[i];
-
-                info = kmalloc(sizeof(struct whiteheat_private), GFP_KERNEL);
-                if (info == NULL) {
-                        dev_err(&port->dev,
-                                "%s: Out of memory for port structures\n",
-                                serial->type->description);
-                        goto no_private;
-                }
-
-                info->mcr = 0;
-
-                usb_set_serial_port_data(port, info);
-        }
-
         command_info = kmalloc(sizeof(struct whiteheat_command_private),
                                                                 GFP_KERNEL);
         if (command_info == NULL) {
@@ -333,16 +318,10 @@ no_firmware:
                 "%s: please contact support@connecttech.com\n",
                 serial->type->description);
         kfree(result);
+        kfree(command);
         return -ENODEV;
 
 no_command_private:
-        for (i = serial->num_ports - 1; i >= 0; i--) {
-                port = serial->port[i];
-                info = usb_get_serial_port_data(port);
-                kfree(info);
-no_private:
-                ;
-        }
         kfree(result);
 no_result_buffer:
         kfree(command);
@@ -350,21 +329,36 @@ no_command_buffer:
         return -ENOMEM;
 }
 
-
 static void whiteheat_release(struct usb_serial *serial)
 {
         struct usb_serial_port *command_port;
-        struct whiteheat_private *info;
-        int i;
 
         /* free up our private data for our command port */
         command_port = serial->port[COMMAND_PORT];
         kfree(usb_get_serial_port_data(command_port));
+}
 
-        for (i = 0; i < serial->num_ports; i++) {
-                info = usb_get_serial_port_data(serial->port[i]);
-                kfree(info);
-        }
+static int whiteheat_port_probe(struct usb_serial_port *port)
+{
+        struct whiteheat_private *info;
+
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
+        usb_set_serial_port_data(port, info);
+
+        return 0;
+}
+
+static int whiteheat_port_remove(struct usb_serial_port *port)
+{
+        struct whiteheat_private *info;
+
+        info = usb_get_serial_port_data(port);
+        kfree(info);
+
+        return 0;
 }
 
 static int whiteheat_open(struct tty_struct *tty, struct usb_serial_port *port)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 779cd954abcb..d305a5aa3a5d 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1004,6 +1004,12 @@ UNUSUAL_DEV( 0x07cf, 0x1001, 0x1000, 0x9999,
                 USB_SC_8070, USB_PR_CB, NULL,
                 US_FL_NEED_OVERRIDE | US_FL_FIX_INQUIRY ),
 
+/* Submitted by Oleksandr Chumachenko <ledest@gmail.com> */
+UNUSUAL_DEV( 0x07cf, 0x1167, 0x0100, 0x0100,
+                "Casio",
+                "EX-N1 DigitalCamera",
+                USB_SC_8070, USB_PR_DEVICE, NULL, 0),
+
 /* Submitted by Hartmut Wahl <hwahl@hwahl.de>*/
 UNUSUAL_DEV( 0x0839, 0x000a, 0x0001, 0x0001,
                 "Samsung",
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 072cbbadbc36..7f93f34b7f91 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -379,7 +379,8 @@ static void handle_rx(struct vhost_net *net)
                 .hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE
         };
         size_t total_len = 0;
-        int err, headcount, mergeable;
+        int err, mergeable;
+        s16 headcount;
         size_t vhost_hlen, sock_hlen;
         size_t vhost_len, sock_len;
         /* TODO: check that we are running from vhost_worker? */
diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index c101697a4ba7..765a945f8ea1 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -60,7 +60,8 @@ config LCD_LTV350QV
           The LTV350QV panel is present on all ATSTK1000 boards.
 
 config LCD_ILI9320
-        tristate
+        tristate "ILI Technology ILI9320 controller support"
+        depends on SPI
         help
           If you have a panel based on the ILI9320 controller chip
           then say y to include a power driver for it.
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index d4dffcd52873..126d8ce591ce 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -3,6 +3,7 @@ menu "Xen driver support"
 
 config XEN_BALLOON
         bool "Xen memory balloon driver"
+        depends on !ARM
         default y
         help
           The balloon driver allows the Xen domain to request more memory from
@@ -145,6 +146,7 @@ config SWIOTLB_XEN
 
 config XEN_TMEM
         bool
+        depends on !ARM
         default y if (CLEANCACHE || FRONTSWAP)
         help
           Shim to interface in-kernel Transcendent Memory hooks
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 31ab82fda38a..d6886d90ccfd 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -55,7 +55,6 @@
 #include <asm/pgalloc.h>
 #include <asm/pgtable.h>
 #include <asm/tlb.h>
-#include <asm/e820.h>
 
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
@@ -88,7 +87,7 @@ struct balloon_stats balloon_stats;
 EXPORT_SYMBOL_GPL(balloon_stats);
 
 /* We increase/decrease in batches which fit in a page */
-static unsigned long frame_list[PAGE_SIZE / sizeof(unsigned long)];
+static xen_pfn_t frame_list[PAGE_SIZE / sizeof(unsigned long)];
 
 #ifdef CONFIG_HIGHMEM
 #define inc_totalhigh_pages() (totalhigh_pages++)
diff --git a/drivers/xen/dbgp.c b/drivers/xen/dbgp.c
index 42569c77ccc8..f3ccc80a455f 100644
--- a/drivers/xen/dbgp.c
+++ b/drivers/xen/dbgp.c
@@ -8,7 +8,9 @@
 
 static int xen_dbgp_op(struct usb_hcd *hcd, int op)
 {
+#ifdef CONFIG_PCI
         const struct device *ctrlr = hcd_to_bus(hcd)->controller;
+#endif
         struct physdev_dbgp_op dbgp;
 
         if (!xen_initial_domain())
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 59e10a1286d5..912ac81b6dbf 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -115,7 +115,9 @@ struct irq_info {
 #define PIRQ_SHAREABLE  (1 << 1)
 
 static int *evtchn_to_irq;
+#ifdef CONFIG_X86
 static unsigned long *pirq_eoi_map;
+#endif
 static bool (*pirq_needs_eoi)(unsigned irq);
 
 static DEFINE_PER_CPU(unsigned long [NR_EVENT_CHANNELS/BITS_PER_LONG],
@@ -277,10 +279,12 @@ static unsigned int cpu_from_evtchn(unsigned int evtchn)
         return ret;
 }
 
+#ifdef CONFIG_X86
 static bool pirq_check_eoi_map(unsigned irq)
 {
         return test_bit(pirq_from_irq(irq), pirq_eoi_map);
 }
+#endif
 
 static bool pirq_needs_eoi_flag(unsigned irq)
 {
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index b2b0a375b348..b91f14e83164 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -84,7 +84,7 @@ struct gnttab_ops {
          * nr_gframes is the number of frames to map grant table. Returning
          * GNTST_okay means success and negative value means failure.
          */
-        int (*map_frames)(unsigned long *frames, unsigned int nr_gframes);
+        int (*map_frames)(xen_pfn_t *frames, unsigned int nr_gframes);
         /*
          * Release a list of frames which are mapped in map_frames for grant
          * entry status.
@@ -960,7 +960,7 @@ static unsigned nr_status_frames(unsigned nr_grant_frames)
         return (nr_grant_frames * GREFS_PER_GRANT_FRAME + SPP - 1) / SPP;
 }
 
-static int gnttab_map_frames_v1(unsigned long *frames, unsigned int nr_gframes)
+static int gnttab_map_frames_v1(xen_pfn_t *frames, unsigned int nr_gframes)
 {
         int rc;
 
@@ -977,7 +977,7 @@ static void gnttab_unmap_frames_v1(void)
         arch_gnttab_unmap(gnttab_shared.addr, nr_grant_frames);
 }
 
-static int gnttab_map_frames_v2(unsigned long *frames, unsigned int nr_gframes)
+static int gnttab_map_frames_v2(xen_pfn_t *frames, unsigned int nr_gframes)
 {
         uint64_t *sframes;
         unsigned int nr_sframes;
@@ -1029,7 +1029,7 @@ static void gnttab_unmap_frames_v2(void)
 static int gnttab_map(unsigned int start_idx, unsigned int end_idx)
 {
         struct gnttab_setup_table setup;
-        unsigned long *frames;
+        xen_pfn_t *frames;
         unsigned int nr_gframes = end_idx + 1;
         int rc;
 
diff --git a/drivers/xen/sys-hypervisor.c b/drivers/xen/sys-hypervisor.c
index 5e5ad7e28858..96453f8a85c5 100644
--- a/drivers/xen/sys-hypervisor.c
+++ b/drivers/xen/sys-hypervisor.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/kobject.h>
+#include <linux/err.h>
 
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
@@ -284,7 +285,8 @@ static ssize_t virtual_start_show(struct hyp_sysfs_attr *attr, char *buffer)
                 ret = HYPERVISOR_xen_version(XENVER_platform_parameters,
                                              parms);
                 if (!ret)
-                        ret = sprintf(buffer, "%lx\n", parms->virt_start);
+                        ret = sprintf(buffer, "%"PRI_xen_ulong"\n",
+                                      parms->virt_start);
                 kfree(parms);
         }
 
diff --git a/drivers/xen/xen-pciback/vpci.c b/drivers/xen/xen-pciback/vpci.c
index 46d140baebd8..0f478ac483cd 100644
--- a/drivers/xen/xen-pciback/vpci.c
+++ b/drivers/xen/xen-pciback/vpci.c
@@ -89,9 +89,15 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
 
         mutex_lock(&vpci_dev->lock);
 
-        /* Keep multi-function devices together on the virtual PCI bus */
-        for (slot = 0; slot < PCI_SLOT_MAX; slot++) {
-                if (!list_empty(&vpci_dev->dev_list[slot])) {
+        /*
+         * Keep multi-function devices together on the virtual PCI bus, except
+         * virtual functions.
+         */
+        if (!dev->is_virtfn) {
+                for (slot = 0; slot < PCI_SLOT_MAX; slot++) {
+                        if (list_empty(&vpci_dev->dev_list[slot]))
+                                continue;
+
                         t = list_entry(list_first(&vpci_dev->dev_list[slot]),
                                        struct pci_dev_entry, list);
 
@@ -116,7 +122,7 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
                                pci_name(dev), slot);
                         list_add_tail(&dev_entry->list,
                                       &vpci_dev->dev_list[slot]);
-                        func = PCI_FUNC(dev->devfn);
+                        func = dev->is_virtfn ? 0 : PCI_FUNC(dev->devfn);
                         goto unlock;
                 }
         }
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index f5dda83ad7a5..acedeabe589c 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -627,6 +627,7 @@ static struct xenbus_watch *find_watch(const char *token)
  */
 static bool xen_strict_xenbus_quirk(void)
 {
+#ifdef CONFIG_X86
         uint32_t eax, ebx, ecx, edx, base;
 
         base = xen_cpuid_base();
@@ -634,6 +635,7 @@ static bool xen_strict_xenbus_quirk(void)
 
         if ((eax >> 16) < 4)
                 return true;
+#endif
         return false;
 
 }
diff --git a/fs/block_dev.c b/fs/block_dev.c
index b3c1d3dae77d..1a1e5e3b1eaf 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1661,6 +1661,39 @@ static int blkdev_mmap(struct file *file, struct vm_area_struct *vma)
         return ret;
 }
 
+static ssize_t blkdev_splice_read(struct file *file, loff_t *ppos,
+                                  struct pipe_inode_info *pipe, size_t len,
+                                  unsigned int flags)
+{
+        ssize_t ret;
+        struct block_device *bdev = I_BDEV(file->f_mapping->host);
+
+        percpu_down_read(&bdev->bd_block_size_semaphore);
+
+        ret = generic_file_splice_read(file, ppos, pipe, len, flags);
+
+        percpu_up_read(&bdev->bd_block_size_semaphore);
+
+        return ret;
+}
+
+static ssize_t blkdev_splice_write(struct pipe_inode_info *pipe,
+                                   struct file *file, loff_t *ppos, size_t len,
+                                   unsigned int flags)
+{
+        ssize_t ret;
+        struct block_device *bdev = I_BDEV(file->f_mapping->host);
+
+        percpu_down_read(&bdev->bd_block_size_semaphore);
+
+        ret = generic_file_splice_write(pipe, file, ppos, len, flags);
+
+        percpu_up_read(&bdev->bd_block_size_semaphore);
+
+        return ret;
+}
+
+
 /*
  * Try to release a page associated with block device when the system
  * is under memory pressure.
@@ -1699,8 +1732,8 @@ const struct file_operations def_blk_fops = {
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = compat_blkdev_ioctl,
 #endif
-        .splice_read    = generic_file_splice_read,
-        .splice_write   = generic_file_splice_write,
+        .splice_read    = blkdev_splice_read,
+        .splice_write   = blkdev_splice_write,
 };
 
 int ioctl_by_bdev(struct block_device *bdev, unsigned cmd, unsigned long arg)
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index f3187938e081..208d8aa5b07e 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -283,9 +283,7 @@ static int __resolve_indirect_ref(struct btrfs_fs_info *fs_info,
                 goto out;
         }
 
-        rcu_read_lock();
-        root_level = btrfs_header_level(root->node);
-        rcu_read_unlock();
+        root_level = btrfs_old_root_level(root, time_seq);
 
         if (root_level + 1 == level)
                 goto out;
@@ -1177,16 +1175,15 @@ int btrfs_find_one_extref(struct btrfs_root *root, u64 inode_objectid,
         return ret;
 }
 
-static char *ref_to_path(struct btrfs_root *fs_root,
-                         struct btrfs_path *path,
-                         u32 name_len, unsigned long name_off,
-                         struct extent_buffer *eb_in, u64 parent,
-                         char *dest, u32 size)
+char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
+                        u32 name_len, unsigned long name_off,
+                        struct extent_buffer *eb_in, u64 parent,
+                        char *dest, u32 size)
 {
         int slot;
         u64 next_inum;
         int ret;
-        s64 bytes_left = size - 1;
+        s64 bytes_left = ((s64)size) - 1;
         struct extent_buffer *eb = eb_in;
         struct btrfs_key found_key;
         int leave_spinning = path->leave_spinning;
@@ -1266,10 +1263,10 @@ char *btrfs_iref_to_path(struct btrfs_root *fs_root,
                          struct extent_buffer *eb_in, u64 parent,
                          char *dest, u32 size)
 {
-        return ref_to_path(fs_root, path,
-                           btrfs_inode_ref_name_len(eb_in, iref),
-                           (unsigned long)(iref + 1),
-                           eb_in, parent, dest, size);
+        return btrfs_ref_to_path(fs_root, path,
+                                 btrfs_inode_ref_name_len(eb_in, iref),
+                                 (unsigned long)(iref + 1),
+                                 eb_in, parent, dest, size);
 }
 
 /*
@@ -1715,9 +1712,8 @@ static int inode_to_path(u64 inum, u32 name_len, unsigned long name_off,
                                         ipath->fspath->bytes_left - s_ptr : 0;
 
         fspath_min = (char *)ipath->fspath->val + (i + 1) * s_ptr;
-        fspath = ref_to_path(ipath->fs_root, ipath->btrfs_path, name_len,
-                             name_off, eb, inum, fspath_min,
-                             bytes_left);
+        fspath = btrfs_ref_to_path(ipath->fs_root, ipath->btrfs_path, name_len,
+                                   name_off, eb, inum, fspath_min, bytes_left);
         if (IS_ERR(fspath))
                 return PTR_ERR(fspath);
 
diff --git a/fs/btrfs/backref.h b/fs/btrfs/backref.h
index e75533043a5f..d61feca79455 100644
--- a/fs/btrfs/backref.h
+++ b/fs/btrfs/backref.h
@@ -62,6 +62,10 @@ int btrfs_find_all_roots(struct btrfs_trans_handle *trans,
 char *btrfs_iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                          struct btrfs_inode_ref *iref, struct extent_buffer *eb,
                          u64 parent, char *dest, u32 size);
+char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
+                        u32 name_len, unsigned long name_off,
+                        struct extent_buffer *eb_in, u64 parent,
+                        char *dest, u32 size);
 
 struct btrfs_data_container *init_data_container(u32 total_bytes);
 struct inode_fs_paths *init_ipath(s32 total_bytes, struct btrfs_root *fs_root,
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index b33436211000..cdfb4c49a806 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -596,6 +596,11 @@ tree_mod_log_insert_move(struct btrfs_fs_info *fs_info,
         if (tree_mod_dont_log(fs_info, eb))
                 return 0;
 
+        /*
+         * When we override something during the move, we log these removals.
+         * This can only happen when we move towards the beginning of the
+         * buffer, i.e. dst_slot < src_slot.
+         */
         for (i = 0; i + dst_slot < src_slot && i < nr_items; i++) {
                 ret = tree_mod_log_insert_key_locked(fs_info, eb, i + dst_slot,
                                               MOD_LOG_KEY_REMOVE_WHILE_MOVING);
@@ -647,8 +652,6 @@ tree_mod_log_insert_root(struct btrfs_fs_info *fs_info,
         if (tree_mod_dont_log(fs_info, NULL))
                 return 0;
 
-        __tree_mod_log_free_eb(fs_info, old_root);
-
         ret = tree_mod_alloc(fs_info, flags, &tm);
         if (ret < 0)
                 goto out;
@@ -926,12 +929,7 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                         ret = btrfs_dec_ref(trans, root, buf, 1, 1);
                         BUG_ON(ret); /* -ENOMEM */
                 }
-                /*
-                 * don't log freeing in case we're freeing the root node, this
-                 * is done by tree_mod_log_set_root_pointer later
-                 */
-                if (buf != root->node && btrfs_header_level(buf) != 0)
-                        tree_mod_log_free_eb(root->fs_info, buf);
+                tree_mod_log_free_eb(root->fs_info, buf);
                 clean_tree_block(trans, root, buf);
                 *last_ref = 1;
         }
@@ -1225,6 +1223,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
         free_extent_buffer(eb);
 
         __tree_mod_log_rewind(eb_rewin, time_seq, tm);
+        WARN_ON(btrfs_header_nritems(eb_rewin) >
+                BTRFS_NODEPTRS_PER_BLOCK(fs_info->fs_root));
 
         return eb_rewin;
 }
@@ -1241,9 +1241,11 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
 {
         struct tree_mod_elem *tm;
         struct extent_buffer *eb;
+        struct extent_buffer *old;
         struct tree_mod_root *old_root = NULL;
         u64 old_generation = 0;
         u64 logical;
+        u32 blocksize;
 
         eb = btrfs_read_lock_root_node(root);
         tm = __tree_mod_log_oldest_root(root->fs_info, root, time_seq);
@@ -1259,14 +1261,32 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
         }
 
         tm = tree_mod_log_search(root->fs_info, logical, time_seq);
-        if (old_root)
+        if (old_root && tm && tm->op != MOD_LOG_KEY_REMOVE_WHILE_FREEING) {
+                btrfs_tree_read_unlock(root->node);
+                free_extent_buffer(root->node);
+                blocksize = btrfs_level_size(root, old_root->level);
+                old = read_tree_block(root, logical, blocksize, 0);
+                if (!old) {
+                        pr_warn("btrfs: failed to read tree block %llu from get_old_root\n",
+                                logical);
+                        WARN_ON(1);
+                } else {
+                        eb = btrfs_clone_extent_buffer(old);
+                        free_extent_buffer(old);
+                }
+        } else if (old_root) {
+                btrfs_tree_read_unlock(root->node);
+                free_extent_buffer(root->node);
                 eb = alloc_dummy_extent_buffer(logical, root->nodesize);
-        else
+        } else {
                 eb = btrfs_clone_extent_buffer(root->node);
-        btrfs_tree_read_unlock(root->node);
-        free_extent_buffer(root->node);
+                btrfs_tree_read_unlock(root->node);
+                free_extent_buffer(root->node);
+        }
+
         if (!eb)
                 return NULL;
+        extent_buffer_get(eb);
         btrfs_tree_read_lock(eb);
         if (old_root) {
                 btrfs_set_header_bytenr(eb, eb->start);
@@ -1279,11 +1299,28 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
                 __tree_mod_log_rewind(eb, time_seq, tm);
         else
                 WARN_ON(btrfs_header_level(eb) != 0);
-        extent_buffer_get(eb);
+        WARN_ON(btrfs_header_nritems(eb) > BTRFS_NODEPTRS_PER_BLOCK(root));
 
         return eb;
 }
 
+int btrfs_old_root_level(struct btrfs_root *root, u64 time_seq)
+{
+        struct tree_mod_elem *tm;
+        int level;
+
+        tm = __tree_mod_log_oldest_root(root->fs_info, root, time_seq);
+        if (tm && tm->op == MOD_LOG_ROOT_REPLACE) {
+                level = tm->old_root.level;
+        } else {
+                rcu_read_lock();
+                level = btrfs_header_level(root->node);
+                rcu_read_unlock();
+        }
+
+        return level;
+}
+
 static inline int should_cow_block(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root,
                                    struct extent_buffer *buf)
@@ -1725,6 +1762,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                         goto enospc;
                 }
 
+                tree_mod_log_free_eb(root->fs_info, root->node);
                 tree_mod_log_set_root_pointer(root, child);
                 rcu_assign_pointer(root->node, child);
 
@@ -2970,8 +3008,10 @@ static int push_node_left(struct btrfs_trans_handle *trans,
                            push_items * sizeof(struct btrfs_key_ptr));
 
         if (push_items < src_nritems) {
-                tree_mod_log_eb_move(root->fs_info, src, 0, push_items,
-                                     src_nritems - push_items);
+                /*
+                 * don't call tree_mod_log_eb_move here, key removal was already
+                 * fully logged by tree_mod_log_eb_copy above.
+                 */
                 memmove_extent_buffer(src, btrfs_node_key_ptr_offset(0),
                                       btrfs_node_key_ptr_offset(push_items),
                                       (src_nritems - push_items) *
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 926c9ffc66d9..c72ead869507 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3120,6 +3120,7 @@ static inline u64 btrfs_inc_tree_mod_seq(struct btrfs_fs_info *fs_info)
 {
         return atomic_inc_return(&fs_info->tree_mod_seq);
 }
+int btrfs_old_root_level(struct btrfs_root *root, u64 time_seq);
 
 /* root-item.c */
 int btrfs_find_root_ref(struct btrfs_root *tree_root,
@@ -3338,6 +3339,8 @@ struct extent_map *btrfs_get_extent(struct inode *inode, struct page *page,
 int btrfs_update_inode(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root,
                               struct inode *inode);
+int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
+                                struct btrfs_root *root, struct inode *inode);
 int btrfs_orphan_add(struct btrfs_trans_handle *trans, struct inode *inode);
 int btrfs_orphan_del(struct btrfs_trans_handle *trans, struct inode *inode);
 int btrfs_orphan_cleanup(struct btrfs_root *root);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 8036d3a84853..472873a94d96 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4110,8 +4110,8 @@ struct extent_buffer *alloc_dummy_extent_buffer(u64 start, unsigned long len)
 
         return eb;
 err:
-        for (i--; i >= 0; i--)
-                __free_page(eb->pages[i]);
+        for (; i > 0; i--)
+                __free_page(eb->pages[i - 1]);
         __free_extent_buffer(eb);
         return NULL;
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 85a1e5053fe6..95542a1b3dfc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -94,8 +94,6 @@ static noinline int cow_file_range(struct inode *inode,
                                    struct page *locked_page,
                                    u64 start, u64 end, int *page_started,
                                    unsigned long *nr_written, int unlock);
-static noinline int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
-                                struct btrfs_root *root, struct inode *inode);
 
 static int btrfs_init_inode_security(struct btrfs_trans_handle *trans,
                                      struct inode *inode,  struct inode *dir,
@@ -2746,8 +2744,9 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans,
         return btrfs_update_inode_item(trans, root, inode);
 }
 
-static noinline int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
-                                struct btrfs_root *root, struct inode *inode)
+noinline int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
+                                         struct btrfs_root *root,
+                                         struct inode *inode)
 {
         int ret;
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 61168805f175..8fcf9a59c28d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -343,7 +343,8 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
                 return -EOPNOTSUPP;
         if (copy_from_user(&range, arg, sizeof(range)))
                 return -EFAULT;
-        if (range.start > total_bytes)
+        if (range.start > total_bytes ||
+            range.len < fs_info->sb->s_blocksize)
                 return -EINVAL;
 
         range.len = min(range.len, total_bytes - range.start);
@@ -570,7 +571,8 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
                 ret = btrfs_commit_transaction(trans,
                                                root->fs_info->extent_root);
         }
-        BUG_ON(ret);
+        if (ret)
+                goto fail;
 
         ret = pending_snapshot->error;
         if (ret)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 5039686df6ae..fe9d02c45f8e 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -790,8 +790,10 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
         }
 
         path = btrfs_alloc_path();
-        if (!path)
-                return -ENOMEM;
+        if (!path) {
+                ret = -ENOMEM;
+                goto out_free_root;
+        }
 
         key.objectid = 0;
         key.type = BTRFS_QGROUP_STATUS_KEY;
@@ -800,7 +802,7 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
         ret = btrfs_insert_empty_item(trans, quota_root, path, &key,
                                       sizeof(*ptr));
         if (ret)
-                goto out;
+                goto out_free_path;
 
         leaf = path->nodes[0];
         ptr = btrfs_item_ptr(leaf, path->slots[0],
@@ -818,8 +820,15 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
         fs_info->quota_root = quota_root;
         fs_info->pending_quota_state = 1;
         spin_unlock(&fs_info->qgroup_lock);
-out:
+out_free_path:
         btrfs_free_path(path);
+out_free_root:
+        if (ret) {
+                free_extent_buffer(quota_root->node);
+                free_extent_buffer(quota_root->commit_root);
+                kfree(quota_root);
+        }
+out:
         return ret;
 }
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index c7beb543a4a8..e78b297b0b00 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -745,31 +745,36 @@ typedef int (*iterate_inode_ref_t)(int num, u64 dir, int index,
                                    void *ctx);
 
 /*
- * Helper function to iterate the entries in ONE btrfs_inode_ref.
+ * Helper function to iterate the entries in ONE btrfs_inode_ref or
+ * btrfs_inode_extref.
  * The iterate callback may return a non zero value to stop iteration. This can
  * be a negative value for error codes or 1 to simply stop it.
  *
- * path must point to the INODE_REF when called.
+ * path must point to the INODE_REF or INODE_EXTREF when called.
  */
 static int iterate_inode_ref(struct send_ctx *sctx,
                              struct btrfs_root *root, struct btrfs_path *path,
                              struct btrfs_key *found_key, int resolve,
                              iterate_inode_ref_t iterate, void *ctx)
 {
-        struct extent_buffer *eb;
+        struct extent_buffer *eb = path->nodes[0];
         struct btrfs_item *item;
         struct btrfs_inode_ref *iref;
+        struct btrfs_inode_extref *extref;
         struct btrfs_path *tmp_path;
         struct fs_path *p;
-        u32 cur;
-        u32 len;
+        u32 cur = 0;
         u32 total;
-        int slot;
+        int slot = path->slots[0];
         u32 name_len;
         char *start;
         int ret = 0;
-        int num;
+        int num = 0;
         int index;
+        u64 dir;
+        unsigned long name_off;
+        unsigned long elem_size;
+        unsigned long ptr;
 
         p = fs_path_alloc_reversed(sctx);
         if (!p)
@@ -781,24 +786,40 @@ static int iterate_inode_ref(struct send_ctx *sctx,
                 return -ENOMEM;
         }
 
-        eb = path->nodes[0];
-        slot = path->slots[0];
-        item = btrfs_item_nr(eb, slot);
-        iref = btrfs_item_ptr(eb, slot, struct btrfs_inode_ref);
-        cur = 0;
-        len = 0;
-        total = btrfs_item_size(eb, item);
 
-        num = 0;
+        if (found_key->type == BTRFS_INODE_REF_KEY) {
+                ptr = (unsigned long)btrfs_item_ptr(eb, slot,
+                                                    struct btrfs_inode_ref);
+                item = btrfs_item_nr(eb, slot);
+                total = btrfs_item_size(eb, item);
+                elem_size = sizeof(*iref);
+        } else {
+                ptr = btrfs_item_ptr_offset(eb, slot);
+                total = btrfs_item_size_nr(eb, slot);
+                elem_size = sizeof(*extref);
+        }
+
         while (cur < total) {
                 fs_path_reset(p);
 
-                name_len = btrfs_inode_ref_name_len(eb, iref);
-                index = btrfs_inode_ref_index(eb, iref);
+                if (found_key->type == BTRFS_INODE_REF_KEY) {
+                        iref = (struct btrfs_inode_ref *)(ptr + cur);
+                        name_len = btrfs_inode_ref_name_len(eb, iref);
+                        name_off = (unsigned long)(iref + 1);
+                        index = btrfs_inode_ref_index(eb, iref);
+                        dir = found_key->offset;
+                } else {
+                        extref = (struct btrfs_inode_extref *)(ptr + cur);
+                        name_len = btrfs_inode_extref_name_len(eb, extref);
+                        name_off = (unsigned long)&extref->name;
+                        index = btrfs_inode_extref_index(eb, extref);
+                        dir = btrfs_inode_extref_parent(eb, extref);
+                }
+
                 if (resolve) {
-                        start = btrfs_iref_to_path(root, tmp_path, iref, eb,
-                                                found_key->offset, p->buf,
-                                                p->buf_len);
+                        start = btrfs_ref_to_path(root, tmp_path, name_len,
+                                                  name_off, eb, dir,
+                                                  p->buf, p->buf_len);
                         if (IS_ERR(start)) {
                                 ret = PTR_ERR(start);
                                 goto out;
@@ -809,9 +830,10 @@ static int iterate_inode_ref(struct send_ctx *sctx,
                                                 p->buf_len + p->buf - start);
                                 if (ret < 0)
                                         goto out;
-                                start = btrfs_iref_to_path(root, tmp_path, iref,
-                                                eb, found_key->offset, p->buf,
-                                                p->buf_len);
+                                start = btrfs_ref_to_path(root, tmp_path,
+                                                          name_len, name_off,
+                                                          eb, dir,
+                                                          p->buf, p->buf_len);
                                 if (IS_ERR(start)) {
                                         ret = PTR_ERR(start);
                                         goto out;
@@ -820,21 +842,16 @@ static int iterate_inode_ref(struct send_ctx *sctx,
                         }
                         p->start = start;
                 } else {
-                        ret = fs_path_add_from_extent_buffer(p, eb,
-                                        (unsigned long)(iref + 1), name_len);
+                        ret = fs_path_add_from_extent_buffer(p, eb, name_off,
+                                                             name_len);
                         if (ret < 0)
                                 goto out;
                 }
 
-
-                len = sizeof(*iref) + name_len;
-                iref = (struct btrfs_inode_ref *)((char *)iref + len);
-                cur += len;
-
-                ret = iterate(num, found_key->offset, index, p, ctx);
+                cur += elem_size + name_len;
+                ret = iterate(num, dir, index, p, ctx);
                 if (ret)
                         goto out;
-
                 num++;
         }
 
@@ -998,7 +1015,8 @@ static int get_inode_path(struct send_ctx *sctx, struct btrfs_root *root,
         }
         btrfs_item_key_to_cpu(p->nodes[0], &found_key, p->slots[0]);
         if (found_key.objectid != ino ||
-                found_key.type != BTRFS_INODE_REF_KEY) {
+            (found_key.type != BTRFS_INODE_REF_KEY &&
+             found_key.type != BTRFS_INODE_EXTREF_KEY)) {
                 ret = -ENOENT;
                 goto out;
         }
@@ -1551,8 +1569,8 @@ static int get_first_ref(struct send_ctx *sctx,
         struct btrfs_key key;
         struct btrfs_key found_key;
         struct btrfs_path *path;
-        struct btrfs_inode_ref *iref;
         int len;
+        u64 parent_dir;
 
         path = alloc_path_for_send();
         if (!path)
@@ -1568,27 +1586,41 @@ static int get_first_ref(struct send_ctx *sctx,
         if (!ret)
                 btrfs_item_key_to_cpu(path->nodes[0], &found_key,
                                 path->slots[0]);
-        if (ret || found_key.objectid != key.objectid ||
-            found_key.type != key.type) {
+        if (ret || found_key.objectid != ino ||
+            (found_key.type != BTRFS_INODE_REF_KEY &&
+             found_key.type != BTRFS_INODE_EXTREF_KEY)) {
                 ret = -ENOENT;
                 goto out;
         }
 
-        iref = btrfs_item_ptr(path->nodes[0], path->slots[0],
-                        struct btrfs_inode_ref);
-        len = btrfs_inode_ref_name_len(path->nodes[0], iref);
-        ret = fs_path_add_from_extent_buffer(name, path->nodes[0],
-                        (unsigned long)(iref + 1), len);
+        if (key.type == BTRFS_INODE_REF_KEY) {
+                struct btrfs_inode_ref *iref;
+                iref = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                      struct btrfs_inode_ref);
+                len = btrfs_inode_ref_name_len(path->nodes[0], iref);
+                ret = fs_path_add_from_extent_buffer(name, path->nodes[0],
+                                                     (unsigned long)(iref + 1),
+                                                     len);
+                parent_dir = found_key.offset;
+        } else {
+                struct btrfs_inode_extref *extref;
+                extref = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                        struct btrfs_inode_extref);
+                len = btrfs_inode_extref_name_len(path->nodes[0], extref);
+                ret = fs_path_add_from_extent_buffer(name, path->nodes[0],
+                                        (unsigned long)&extref->name, len);
+                parent_dir = btrfs_inode_extref_parent(path->nodes[0], extref);
+        }
         if (ret < 0)
                 goto out;
         btrfs_release_path(path);
 
-        ret = get_inode_info(root, found_key.offset, NULL, dir_gen, NULL, NULL,
+        ret = get_inode_info(root, parent_dir, NULL, dir_gen, NULL, NULL,
                         NULL, NULL);
         if (ret < 0)
                 goto out;
 
-        *dir = found_key.offset;
+        *dir = parent_dir;
 
 out:
         btrfs_free_path(path);
@@ -2430,7 +2462,8 @@ verbose_printk("btrfs: send_create_inode %llu\n", ino);
                 TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH_LINK, p);
         } else if (S_ISCHR(mode) || S_ISBLK(mode) ||
                    S_ISFIFO(mode) || S_ISSOCK(mode)) {
-                TLV_PUT_U64(sctx, BTRFS_SEND_A_RDEV, rdev);
+                TLV_PUT_U64(sctx, BTRFS_SEND_A_RDEV, new_encode_dev(rdev));
+                TLV_PUT_U64(sctx, BTRFS_SEND_A_MODE, mode);
         }
 
         ret = send_cmd(sctx);
@@ -3226,7 +3259,8 @@ static int process_all_refs(struct send_ctx *sctx,
                 btrfs_item_key_to_cpu(eb, &found_key, slot);
 
                 if (found_key.objectid != key.objectid ||
-                    found_key.type != key.type)
+                    (found_key.type != BTRFS_INODE_REF_KEY &&
+                     found_key.type != BTRFS_INODE_EXTREF_KEY))
                         break;
 
                 ret = iterate_inode_ref(sctx, root, path, &found_key, 0, cb,
@@ -3987,7 +4021,7 @@ static int process_recorded_refs_if_needed(struct send_ctx *sctx, int at_end)
         if (sctx->cur_ino == 0)
                 goto out;
         if (!at_end && sctx->cur_ino == sctx->cmp_key->objectid &&
-            sctx->cmp_key->type <= BTRFS_INODE_REF_KEY)
+            sctx->cmp_key->type <= BTRFS_INODE_EXTREF_KEY)
                 goto out;
         if (list_empty(&sctx->new_refs) && list_empty(&sctx->deleted_refs))
                 goto out;
@@ -4033,22 +4067,21 @@ static int finish_inode_if_needed(struct send_ctx *sctx, int at_end)
         if (ret < 0)
                 goto out;
 
-        if (!S_ISLNK(sctx->cur_inode_mode)) {
-                if (!sctx->parent_root || sctx->cur_inode_new) {
+        if (!sctx->parent_root || sctx->cur_inode_new) {
+                need_chown = 1;
+                if (!S_ISLNK(sctx->cur_inode_mode))
                         need_chmod = 1;
-                        need_chown = 1;
-                } else {
-                        ret = get_inode_info(sctx->parent_root, sctx->cur_ino,
-                                        NULL, NULL, &right_mode, &right_uid,
-                                        &right_gid, NULL);
-                        if (ret < 0)
-                                goto out;
+        } else {
+                ret = get_inode_info(sctx->parent_root, sctx->cur_ino,
+                                NULL, NULL, &right_mode, &right_uid,
+                                &right_gid, NULL);
+                if (ret < 0)
+                        goto out;
 
-                        if (left_uid != right_uid || left_gid != right_gid)
-                                need_chown = 1;
-                        if (left_mode != right_mode)
-                                need_chmod = 1;
-                }
+                if (left_uid != right_uid || left_gid != right_gid)
+                        need_chown = 1;
+                if (!S_ISLNK(sctx->cur_inode_mode) && left_mode != right_mode)
+                        need_chmod = 1;
         }
 
         if (S_ISREG(sctx->cur_inode_mode)) {
@@ -4335,7 +4368,8 @@ static int changed_cb(struct btrfs_root *left_root,
 
         if (key->type == BTRFS_INODE_ITEM_KEY)
                 ret = changed_inode(sctx, result);
-        else if (key->type == BTRFS_INODE_REF_KEY)
+        else if (key->type == BTRFS_INODE_REF_KEY ||
+                 key->type == BTRFS_INODE_EXTREF_KEY)
                 ret = changed_ref(sctx, result);
         else if (key->type == BTRFS_XATTR_ITEM_KEY)
                 ret = changed_xattr(sctx, result);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 77db875b5116..04bbfb1052eb 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1200,7 +1200,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
         btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                          dentry->d_name.len * 2);
         parent_inode->i_mtime = parent_inode->i_ctime = CURRENT_TIME;
-        ret = btrfs_update_inode(trans, parent_root, parent_inode);
+        ret = btrfs_update_inode_fallback(trans, parent_root, parent_inode);
         if (ret)
                 btrfs_abort_transaction(trans, root, ret);
 fail:
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 029b903a4ae3..0f5ebb72a5ea 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1819,6 +1819,13 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                                     "Failed to relocate sys chunks after "
                                     "device initialization. This can be fixed "
                                     "using the \"btrfs balance\" command.");
+                trans = btrfs_attach_transaction(root);
+                if (IS_ERR(trans)) {
+                        if (PTR_ERR(trans) == -ENOENT)
+                                return 0;
+                        return PTR_ERR(trans);
+                }
+                ret = btrfs_commit_transaction(trans, root);
         }
 
         return ret;
diff --git a/fs/char_dev.c b/fs/char_dev.c
index 3f152b92a94a..afc2bb691780 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -471,9 +471,19 @@ static int exact_lock(dev_t dev, void *data)
  */
 int cdev_add(struct cdev *p, dev_t dev, unsigned count)
 {
+        int error;
+
         p->dev = dev;
         p->count = count;
-        return kobj_map(cdev_map, dev, count, NULL, exact_match, exact_lock, p);
+
+        error = kobj_map(cdev_map, dev, count, NULL,
+                         exact_match, exact_lock, p);
+        if (error)
+                return error;
+
+        kobject_get(p->kobj.parent);
+
+        return 0;
 }
 
 static void cdev_unmap(dev_t dev, unsigned count)
@@ -498,14 +508,20 @@ void cdev_del(struct cdev *p)
 static void cdev_default_release(struct kobject *kobj)
 {
         struct cdev *p = container_of(kobj, struct cdev, kobj);
+        struct kobject *parent = kobj->parent;
+
         cdev_purge(p);
+        kobject_put(parent);
 }
 
 static void cdev_dynamic_release(struct kobject *kobj)
 {
         struct cdev *p = container_of(kobj, struct cdev, kobj);
+        struct kobject *parent = kobj->parent;
+
         cdev_purge(p);
         kfree(p);
+        kobject_put(parent);
 }
 
 static struct kobj_type ktype_cdev_default = {
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 89cf6014a967..e2f57a007029 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
 
         err  = get_user(palp, &up->palette);
         err |= get_user(length, &up->length);
+        if (err)
+                return -EFAULT;
 
         up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
         err  = put_user(compat_ptr(palp), &up_native->palette);
diff --git a/fs/exec.c b/fs/exec.c
index 8b9011b67041..0039055b1fc6 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1083,7 +1083,8 @@ int flush_old_exec(struct linux_binprm * bprm)
         bprm->mm = NULL;                /* We're using it now */
 
         set_fs(USER_DS);
-        current->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD);
+        current->flags &=
+                ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD | PF_NOFREEZE);
         flush_thread();
         current->personality &= ~bprm->per_clear;
 
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 1b5089067d01..cf1821784a16 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -174,8 +174,7 @@ void ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
                 ext4_free_inodes_set(sb, gdp, 0);
                 ext4_itable_unused_set(sb, gdp, 0);
                 memset(bh->b_data, 0xff, sb->s_blocksize);
-                ext4_block_bitmap_csum_set(sb, block_group, gdp, bh,
-                                           EXT4_BLOCKS_PER_GROUP(sb) / 8);
+                ext4_block_bitmap_csum_set(sb, block_group, gdp, bh);
                 return;
         }
         memset(bh->b_data, 0, sb->s_blocksize);
@@ -212,8 +211,7 @@ void ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
          */
         ext4_mark_bitmap_end(num_clusters_in_group(sb, block_group),
                              sb->s_blocksize * 8, bh->b_data);
-        ext4_block_bitmap_csum_set(sb, block_group, gdp, bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, block_group, gdp, bh);
         ext4_group_desc_csum_set(sb, block_group, gdp);
 }
 
@@ -350,7 +348,7 @@ void ext4_validate_block_bitmap(struct super_block *sb,
                 return;
         }
         if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
-                        desc, bh, EXT4_BLOCKS_PER_GROUP(sb) / 8))) {
+                        desc, bh))) {
                 ext4_unlock_group(sb, block_group);
                 ext4_error(sb, "bg %u: bad block bitmap checksum", block_group);
                 return;
diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c
index 5c2d1813ebe9..3285aa5a706a 100644
--- a/fs/ext4/bitmap.c
+++ b/fs/ext4/bitmap.c
@@ -58,11 +58,12 @@ void ext4_inode_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
 
 int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
                                   struct ext4_group_desc *gdp,
-                                  struct buffer_head *bh, int sz)
+                                  struct buffer_head *bh)
 {
         __u32 hi;
         __u32 provided, calculated;
         struct ext4_sb_info *sbi = EXT4_SB(sb);
+        int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8;
 
         if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                         EXT4_FEATURE_RO_COMPAT_METADATA_CSUM))
@@ -84,8 +85,9 @@ int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
 
 void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
                                 struct ext4_group_desc *gdp,
-                                struct buffer_head *bh, int sz)
+                                struct buffer_head *bh)
 {
+        int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8;
         __u32 csum;
         struct ext4_sb_info *sbi = EXT4_SB(sb);
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 3ab2539b7b2e..3c20de1d59d0 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1882,10 +1882,10 @@ int ext4_inode_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
                                   struct buffer_head *bh, int sz);
 void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
                                 struct ext4_group_desc *gdp,
-                                struct buffer_head *bh, int sz);
+                                struct buffer_head *bh);
 int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
                                   struct ext4_group_desc *gdp,
-                                  struct buffer_head *bh, int sz);
+                                  struct buffer_head *bh);
 
 /* balloc.c */
 extern void ext4_validate_block_bitmap(struct super_block *sb,
@@ -2063,8 +2063,7 @@ extern int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count);
 extern int ext4_calculate_overhead(struct super_block *sb);
 extern int ext4_superblock_csum_verify(struct super_block *sb,
                                        struct ext4_super_block *es);
-extern void ext4_superblock_csum_set(struct super_block *sb,
-                                     struct ext4_super_block *es);
+extern void ext4_superblock_csum_set(struct super_block *sb);
 extern void *ext4_kvmalloc(size_t size, gfp_t flags);
 extern void *ext4_kvzalloc(size_t size, gfp_t flags);
 extern void ext4_kvfree(void *ptr);
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index bfa65b49d424..b4323ba846b5 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -143,17 +143,13 @@ int __ext4_handle_dirty_super(const char *where, unsigned int line,
         struct buffer_head *bh = EXT4_SB(sb)->s_sbh;
         int err = 0;
 
+        ext4_superblock_csum_set(sb);
         if (ext4_handle_valid(handle)) {
-                ext4_superblock_csum_set(sb,
-                                (struct ext4_super_block *)bh->b_data);
                 err = jbd2_journal_dirty_metadata(handle, bh);
                 if (err)
                         ext4_journal_abort_handle(where, line, __func__,
                                                   bh, handle, err);
-        } else {
-                ext4_superblock_csum_set(sb,
-                                (struct ext4_super_block *)bh->b_data);
+        } else
                 mark_buffer_dirty(bh);
-        }
         return err;
 }
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 1c94cca35ed1..7011ac967208 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -52,6 +52,9 @@
 #define EXT4_EXT_MARK_UNINIT1   0x2  /* mark first half uninitialized */
 #define EXT4_EXT_MARK_UNINIT2   0x4  /* mark second half uninitialized */
 
+#define EXT4_EXT_DATA_VALID1    0x8  /* first half contains valid data */
+#define EXT4_EXT_DATA_VALID2    0x10 /* second half contains valid data */
+
 static __le32 ext4_extent_block_csum(struct inode *inode,
                                      struct ext4_extent_header *eh)
 {
@@ -2914,6 +2917,9 @@ static int ext4_split_extent_at(handle_t *handle,
         unsigned int ee_len, depth;
         int err = 0;
 
+        BUG_ON((split_flag & (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2)) ==
+               (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2));
+
         ext_debug("ext4_split_extents_at: inode %lu, logical"
                 "block %llu\n", inode->i_ino, (unsigned long long)split);
 
@@ -2972,7 +2978,14 @@ static int ext4_split_extent_at(handle_t *handle,
 
         err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
         if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) {
-                err = ext4_ext_zeroout(inode, &orig_ex);
+                if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) {
+                        if (split_flag & EXT4_EXT_DATA_VALID1)
+                                err = ext4_ext_zeroout(inode, ex2);
+                        else
+                                err = ext4_ext_zeroout(inode, ex);
+                } else
+                        err = ext4_ext_zeroout(inode, &orig_ex);
+
                 if (err)
                         goto fix_extent_len;
                 /* update the extent length and mark as initialized */
@@ -3025,12 +3038,13 @@ static int ext4_split_extent(handle_t *handle,
         uninitialized = ext4_ext_is_uninitialized(ex);
 
         if (map->m_lblk + map->m_len < ee_block + ee_len) {
-                split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
-                              EXT4_EXT_MAY_ZEROOUT : 0;
+                split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT;
                 flags1 = flags | EXT4_GET_BLOCKS_PRE_IO;
                 if (uninitialized)
                         split_flag1 |= EXT4_EXT_MARK_UNINIT1 |
                                        EXT4_EXT_MARK_UNINIT2;
+                if (split_flag & EXT4_EXT_DATA_VALID2)
+                        split_flag1 |= EXT4_EXT_DATA_VALID1;
                 err = ext4_split_extent_at(handle, inode, path,
                                 map->m_lblk + map->m_len, split_flag1, flags1);
                 if (err)
@@ -3043,8 +3057,8 @@ static int ext4_split_extent(handle_t *handle,
                 return PTR_ERR(path);
 
         if (map->m_lblk >= ee_block) {
-                split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
-                              EXT4_EXT_MAY_ZEROOUT : 0;
+                split_flag1 = split_flag & (EXT4_EXT_MAY_ZEROOUT |
+                                            EXT4_EXT_DATA_VALID2);
                 if (uninitialized)
                         split_flag1 |= EXT4_EXT_MARK_UNINIT1;
                 if (split_flag & EXT4_EXT_MARK_UNINIT2)
@@ -3323,26 +3337,47 @@ static int ext4_split_unwritten_extents(handle_t *handle,
 
         split_flag |= ee_block + ee_len <= eof_block ? EXT4_EXT_MAY_ZEROOUT : 0;
         split_flag |= EXT4_EXT_MARK_UNINIT2;
-
+        if (flags & EXT4_GET_BLOCKS_CONVERT)
+                split_flag |= EXT4_EXT_DATA_VALID2;
         flags |= EXT4_GET_BLOCKS_PRE_IO;
         return ext4_split_extent(handle, inode, path, map, split_flag, flags);
 }
 
 static int ext4_convert_unwritten_extents_endio(handle_t *handle,
-                                              struct inode *inode,
-                                              struct ext4_ext_path *path)
+                                                struct inode *inode,
+                                                struct ext4_map_blocks *map,
+                                                struct ext4_ext_path *path)
 {
         struct ext4_extent *ex;
+        ext4_lblk_t ee_block;
+        unsigned int ee_len;
         int depth;
         int err = 0;
 
         depth = ext_depth(inode);
         ex = path[depth].p_ext;
+        ee_block = le32_to_cpu(ex->ee_block);
+        ee_len = ext4_ext_get_actual_len(ex);
 
         ext_debug("ext4_convert_unwritten_extents_endio: inode %lu, logical"
                 "block %llu, max_blocks %u\n", inode->i_ino,
-                (unsigned long long)le32_to_cpu(ex->ee_block),
-                ext4_ext_get_actual_len(ex));
+                  (unsigned long long)ee_block, ee_len);
+
+        /* If extent is larger than requested then split is required */
+        if (ee_block != map->m_lblk || ee_len > map->m_len) {
+                err = ext4_split_unwritten_extents(handle, inode, map, path,
+                                                   EXT4_GET_BLOCKS_CONVERT);
+                if (err < 0)
+                        goto out;
+                ext4_ext_drop_refs(path);
+                path = ext4_ext_find_extent(inode, map->m_lblk, path);
+                if (IS_ERR(path)) {
+                        err = PTR_ERR(path);
+                        goto out;
+                }
+                depth = ext_depth(inode);
+                ex = path[depth].p_ext;
+        }
 
         err = ext4_ext_get_access(handle, inode, path + depth);
         if (err)
@@ -3652,7 +3687,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
         }
         /* IO end_io complete, convert the filled extent to written */
         if ((flags & EXT4_GET_BLOCKS_CONVERT)) {
-                ret = ext4_convert_unwritten_extents_endio(handle, inode,
+                ret = ext4_convert_unwritten_extents_endio(handle, inode, map,
                                                         path);
                 if (ret >= 0) {
                         ext4_update_inode_fsync_trans(handle, inode, 1);
@@ -4428,6 +4463,9 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
          */
         if (len <= EXT_UNINIT_MAX_LEN << blkbits)
                 flags |= EXT4_GET_BLOCKS_NO_NORMALIZE;
+
+        /* Prevent race condition between unwritten */
+        ext4_flush_unwritten_io(inode);
 retry:
         while (ret >= 0 && ret < max_blocks) {
                 map.m_lblk = map.m_lblk + ret;
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index fa36372f3fdf..4facdd29a350 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -762,9 +762,7 @@ got:
                         ext4_free_group_clusters_set(sb, gdp,
                                 ext4_free_clusters_after_init(sb, group, gdp));
                         ext4_block_bitmap_csum_set(sb, group, gdp,
-                                                   block_bitmap_bh,
-                                                   EXT4_BLOCKS_PER_GROUP(sb) /
-                                                   8);
+                                                   block_bitmap_bh);
                         ext4_group_desc_csum_set(sb, group, gdp);
                 }
                 ext4_unlock_group(sb, group);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index f8b27bf80aca..526e55358606 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2805,8 +2805,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
         }
         len = ext4_free_group_clusters(sb, gdp) - ac->ac_b_ex.fe_len;
         ext4_free_group_clusters_set(sb, gdp, len);
-        ext4_block_bitmap_csum_set(sb, ac->ac_b_ex.fe_group, gdp, bitmap_bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, ac->ac_b_ex.fe_group, gdp, bitmap_bh);
         ext4_group_desc_csum_set(sb, ac->ac_b_ex.fe_group, gdp);
 
         ext4_unlock_group(sb, ac->ac_b_ex.fe_group);
@@ -4666,8 +4665,7 @@ do_more:
 
         ret = ext4_free_group_clusters(sb, gdp) + count_clusters;
         ext4_free_group_clusters_set(sb, gdp, ret);
-        ext4_block_bitmap_csum_set(sb, block_group, gdp, bitmap_bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, block_group, gdp, bitmap_bh);
         ext4_group_desc_csum_set(sb, block_group, gdp);
         ext4_unlock_group(sb, block_group);
         percpu_counter_add(&sbi->s_freeclusters_counter, count_clusters);
@@ -4811,8 +4809,7 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
         mb_free_blocks(NULL, &e4b, bit, count);
         blk_free_count = blocks_freed + ext4_free_group_clusters(sb, desc);
         ext4_free_group_clusters_set(sb, desc, blk_free_count);
-        ext4_block_bitmap_csum_set(sb, block_group, desc, bitmap_bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, block_group, desc, bitmap_bh);
         ext4_group_desc_csum_set(sb, block_group, desc);
         ext4_unlock_group(sb, block_group);
         percpu_counter_add(&sbi->s_freeclusters_counter,
@@ -4993,8 +4990,9 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)
         minlen = EXT4_NUM_B2C(EXT4_SB(sb),
                               range->minlen >> sb->s_blocksize_bits);
 
-        if (unlikely(minlen > EXT4_CLUSTERS_PER_GROUP(sb)) ||
-            unlikely(start >= max_blks))
+        if (minlen > EXT4_CLUSTERS_PER_GROUP(sb) ||
+            start >= max_blks ||
+            range->len < sb->s_blocksize)
                 return -EINVAL;
         if (end >= max_blks)
                 end = max_blks - 1;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 7a75e1086961..47bf06a2765d 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1212,8 +1212,7 @@ static int ext4_set_bitmap_checksums(struct super_block *sb,
         bh = ext4_get_bitmap(sb, group_data->block_bitmap);
         if (!bh)
                 return -EIO;
-        ext4_block_bitmap_csum_set(sb, group, gdp, bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, group, gdp, bh);
         brelse(bh);
 
         return 0;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 7265a0367476..80928f716850 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -143,9 +143,10 @@ int ext4_superblock_csum_verify(struct super_block *sb,
         return es->s_checksum == ext4_superblock_csum(sb, es);
 }
 
-void ext4_superblock_csum_set(struct super_block *sb,
-                              struct ext4_super_block *es)
+void ext4_superblock_csum_set(struct super_block *sb)
 {
+        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+
         if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
                 EXT4_FEATURE_RO_COMPAT_METADATA_CSUM))
                 return;
@@ -1963,7 +1964,7 @@ static int ext4_fill_flex_info(struct super_block *sb)
                 sbi->s_log_groups_per_flex = 0;
                 return 1;
         }
-        groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+        groups_per_flex = 1U << sbi->s_log_groups_per_flex;
 
         err = ext4_alloc_flex_bg_array(sb, sbi->s_groups_count);
         if (err)
@@ -4381,7 +4382,7 @@ static int ext4_commit_super(struct super_block *sb, int sync)
                 cpu_to_le32(percpu_counter_sum_positive(
                                 &EXT4_SB(sb)->s_freeinodes_counter));
         BUFFER_TRACE(sbh, "marking dirty");
-        ext4_superblock_csum_set(sb, es);
+        ext4_superblock_csum_set(sb);
         mark_buffer_dirty(sbh);
         if (sync) {
                 error = sync_dirty_buffer(sbh);
diff --git a/fs/jfs/jfs_discard.c b/fs/jfs/jfs_discard.c
index 9947563e4175..dfcd50304559 100644
--- a/fs/jfs/jfs_discard.c
+++ b/fs/jfs/jfs_discard.c
@@ -83,7 +83,7 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
         struct bmap *bmp = JFS_SBI(ip->i_sb)->bmap;
         struct super_block *sb = ipbmap->i_sb;
         int agno, agno_end;
-        s64 start, end, minlen;
+        u64 start, end, minlen;
         u64 trimmed = 0;
 
         /**
@@ -93,15 +93,19 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
          * minlen:      minimum extent length in Bytes
          */
         start = range->start >> sb->s_blocksize_bits;
-        if (start < 0)
-                start = 0;
         end = start + (range->len >> sb->s_blocksize_bits) - 1;
-        if (end >= bmp->db_mapsize)
-                end = bmp->db_mapsize - 1;
         minlen = range->minlen >> sb->s_blocksize_bits;
-        if (minlen <= 0)
+        if (minlen == 0)
                 minlen = 1;
 
+        if (minlen > bmp->db_agsize ||
+            start >= bmp->db_mapsize ||
+            range->len < sb->s_blocksize)
+                return -EINVAL;
+
+        if (end >= bmp->db_mapsize)
+                end = bmp->db_mapsize - 1;
+
         /**
          * we trim all ag's within the range
          */
diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
index e4fb3ba5a58a..3d7e09bcc0e9 100644
--- a/fs/lockd/mon.c
+++ b/fs/lockd/mon.c
@@ -85,29 +85,38 @@ static struct rpc_clnt *nsm_create(struct net *net)
         return rpc_create(&args);
 }
 
+static struct rpc_clnt *nsm_client_set(struct lockd_net *ln,
+                struct rpc_clnt *clnt)
+{
+        spin_lock(&ln->nsm_clnt_lock);
+        if (ln->nsm_users == 0) {
+                if (clnt == NULL)
+                        goto out;
+                ln->nsm_clnt = clnt;
+        }
+        clnt = ln->nsm_clnt;
+        ln->nsm_users++;
+out:
+        spin_unlock(&ln->nsm_clnt_lock);
+        return clnt;
+}
+
 static struct rpc_clnt *nsm_client_get(struct net *net)
 {
-        static DEFINE_MUTEX(nsm_create_mutex);
-        struct rpc_clnt *clnt;
+        struct rpc_clnt *clnt, *new;
         struct lockd_net *ln = net_generic(net, lockd_net_id);
 
-        spin_lock(&ln->nsm_clnt_lock);
-        if (ln->nsm_users) {
-                ln->nsm_users++;
-                clnt = ln->nsm_clnt;
-                spin_unlock(&ln->nsm_clnt_lock);
+        clnt = nsm_client_set(ln, NULL);
+        if (clnt != NULL)
                 goto out;
-        }
-        spin_unlock(&ln->nsm_clnt_lock);
 
-        mutex_lock(&nsm_create_mutex);
-        clnt = nsm_create(net);
-        if (!IS_ERR(clnt)) {
-                ln->nsm_clnt = clnt;
-                smp_wmb();
-                ln->nsm_users = 1;
-        }
-        mutex_unlock(&nsm_create_mutex);
+        clnt = new = nsm_create(net);
+        if (IS_ERR(clnt))
+                goto out;
+
+        clnt = nsm_client_set(ln, new);
+        if (clnt != new)
+                rpc_shutdown_client(new);
 out:
         return clnt;
 }
@@ -115,18 +124,16 @@ out:
 static void nsm_client_put(struct net *net)
 {
         struct lockd_net *ln = net_generic(net, lockd_net_id);
-        struct rpc_clnt *clnt = ln->nsm_clnt;
-        int shutdown = 0;
+        struct rpc_clnt *clnt = NULL;
 
         spin_lock(&ln->nsm_clnt_lock);
-        if (ln->nsm_users) {
-                if (--ln->nsm_users)
-                        ln->nsm_clnt = NULL;
-                shutdown = !ln->nsm_users;
+        ln->nsm_users--;
+        if (ln->nsm_users == 0) {
+                clnt = ln->nsm_clnt;
+                ln->nsm_clnt = NULL;
         }
         spin_unlock(&ln->nsm_clnt_lock);
-
-        if (shutdown)
+        if (clnt != NULL)
                 rpc_shutdown_client(clnt);
 }
 
diff --git a/fs/namei.c b/fs/namei.c
index d1895f308156..937f9d50c84b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -705,8 +705,8 @@ static inline void put_link(struct nameidata *nd, struct path *link, void *cooki
         path_put(link);
 }
 
-int sysctl_protected_symlinks __read_mostly = 1;
-int sysctl_protected_hardlinks __read_mostly = 1;
+int sysctl_protected_symlinks __read_mostly = 0;
+int sysctl_protected_hardlinks __read_mostly = 0;
 
 /**
  * may_follow_link - Check symlink following for unsafe situations
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 9a521fb39869..5088b57b078a 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -241,7 +241,7 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt,
                 svc_exit_thread(cb_info->rqst);
                 cb_info->rqst = NULL;
                 cb_info->task = NULL;
-                return PTR_ERR(cb_info->task);
+                return ret;
         }
         dprintk("nfs_callback_up: service started\n");
         return 0;
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 52d847212066..2e45fd9c02a3 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -122,12 +122,21 @@ static void filelayout_reset_read(struct nfs_read_data *data)
         }
 }
 
+static void filelayout_fenceme(struct inode *inode, struct pnfs_layout_hdr *lo)
+{
+        if (!test_and_clear_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+                return;
+        clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(inode)->flags);
+        pnfs_return_layout(inode);
+}
+
 static int filelayout_async_handle_error(struct rpc_task *task,
                                          struct nfs4_state *state,
                                          struct nfs_client *clp,
                                          struct pnfs_layout_segment *lseg)
 {
-        struct inode *inode = lseg->pls_layout->plh_inode;
+        struct pnfs_layout_hdr *lo = lseg->pls_layout;
+        struct inode *inode = lo->plh_inode;
         struct nfs_server *mds_server = NFS_SERVER(inode);
         struct nfs4_deviceid_node *devid = FILELAYOUT_DEVID_NODE(lseg);
         struct nfs_client *mds_client = mds_server->nfs_client;
@@ -204,10 +213,8 @@ static int filelayout_async_handle_error(struct rpc_task *task,
                 dprintk("%s DS connection error %d\n", __func__,
                         task->tk_status);
                 nfs4_mark_deviceid_unavailable(devid);
-                clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(inode)->flags);
-                _pnfs_return_layout(inode);
+                set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
                 rpc_wake_up(&tbl->slot_tbl_waitq);
-                nfs4_ds_disconnect(clp);
                 /* fall through */
         default:
 reset:
@@ -331,7 +338,9 @@ static void filelayout_read_count_stats(struct rpc_task *task, void *data)
 static void filelayout_read_release(void *data)
 {
         struct nfs_read_data *rdata = data;
+        struct pnfs_layout_hdr *lo = rdata->header->lseg->pls_layout;
 
+        filelayout_fenceme(lo->plh_inode, lo);
         nfs_put_client(rdata->ds_clp);
         rdata->header->mds_ops->rpc_release(data);
 }
@@ -429,7 +438,9 @@ static void filelayout_write_count_stats(struct rpc_task *task, void *data)
 static void filelayout_write_release(void *data)
 {
         struct nfs_write_data *wdata = data;
+        struct pnfs_layout_hdr *lo = wdata->header->lseg->pls_layout;
 
+        filelayout_fenceme(lo->plh_inode, lo);
         nfs_put_client(wdata->ds_clp);
         wdata->header->mds_ops->rpc_release(data);
 }
@@ -739,7 +750,7 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
                 goto out_err;
 
         if (fl->num_fh > 0) {
-                fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
+                fl->fh_array = kcalloc(fl->num_fh, sizeof(fl->fh_array[0]),
                                        gfp_flags);
                 if (!fl->fh_array)
                         goto out_err;
diff --git a/fs/nfs/nfs4filelayout.h b/fs/nfs/nfs4filelayout.h
index dca47d786710..8c07241fe52b 100644
--- a/fs/nfs/nfs4filelayout.h
+++ b/fs/nfs/nfs4filelayout.h
@@ -149,6 +149,5 @@ extern void nfs4_fl_put_deviceid(struct nfs4_file_layout_dsaddr *dsaddr);
 extern void nfs4_fl_free_deviceid(struct nfs4_file_layout_dsaddr *dsaddr);
 struct nfs4_file_layout_dsaddr *
 filelayout_get_device_info(struct inode *inode, struct nfs4_deviceid *dev_id, gfp_t gfp_flags);
-void nfs4_ds_disconnect(struct nfs_client *clp);
 
 #endif /* FS_NFS_NFS4FILELAYOUT_H */
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index 3336d5eaf879..a8eaa9b7bb0f 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -149,28 +149,6 @@ _data_server_lookup_locked(const struct list_head *dsaddrs)
 }
 
 /*
- * Lookup DS by nfs_client pointer. Zero data server client pointer
- */
-void nfs4_ds_disconnect(struct nfs_client *clp)
-{
-        struct nfs4_pnfs_ds *ds;
-        struct nfs_client *found = NULL;
-
-        dprintk("%s clp %p\n", __func__, clp);
-        spin_lock(&nfs4_ds_cache_lock);
-        list_for_each_entry(ds, &nfs4_data_server_cache, ds_node)
-                if (ds->ds_clp && ds->ds_clp == clp) {
-                        found = ds->ds_clp;
-                        ds->ds_clp = NULL;
-                }
-        spin_unlock(&nfs4_ds_cache_lock);
-        if (found) {
-                set_bit(NFS_CS_STOP_RENEW, &clp->cl_res_state);
-                nfs_put_client(clp);
-        }
-}
-
-/*
  * Create an rpc connection to the nfs4_pnfs_ds data server
  * Currently only supports IPv4 and IPv6 addresses
  */
diff --git a/fs/nfs/nfs4getroot.c b/fs/nfs/nfs4getroot.c
index 6a83780e0ce6..549462e5b9b0 100644
--- a/fs/nfs/nfs4getroot.c
+++ b/fs/nfs/nfs4getroot.c
@@ -5,6 +5,7 @@
 
 #include <linux/nfs_fs.h>
 #include "nfs4_fs.h"
+#include "internal.h"
 
 #define NFSDBG_FACILITY         NFSDBG_CLIENT
 
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index be731e6b7b9c..c6f990656f89 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -369,7 +369,7 @@ void objio_free_result(struct objlayout_io_res *oir)
         kfree(objios);
 }
 
-enum pnfs_osd_errno osd_pri_2_pnfs_err(enum osd_err_priority oep)
+static enum pnfs_osd_errno osd_pri_2_pnfs_err(enum osd_err_priority oep)
 {
         switch (oep) {
         case OSD_ERR_PRI_NO_ERROR:
@@ -574,7 +574,7 @@ static bool objio_pg_test(struct nfs_pageio_descriptor *pgio,
                         (unsigned long)pgio->pg_layout_private;
 }
 
-void objio_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+static void objio_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
 {
         pnfs_generic_pg_init_read(pgio, req);
         if (unlikely(pgio->pg_lseg == NULL))
@@ -604,7 +604,7 @@ static bool aligned_on_raid_stripe(u64 offset, struct ore_layout *layout,
         return false;
 }
 
-void objio_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+static void objio_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
 {
         unsigned long stripe_end = 0;
         u64 wb_size;
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 2d722dba1111..dbf7bba52da0 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -62,6 +62,7 @@ enum {
         NFS_LAYOUT_RW_FAILED,           /* get rw layout failed stop trying */
         NFS_LAYOUT_BULK_RECALL,         /* bulk recall affecting layout */
         NFS_LAYOUT_ROC,                 /* some lseg had roc bit set */
+        NFS_LAYOUT_RETURN,              /* Return this layout ASAP */
 };
 
 enum layoutdriver_policy_flags {
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 64c3b3172367..e296572c73ed 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -45,10 +45,13 @@ static cputime64_t get_iowait_time(int cpu)
 
 static u64 get_idle_time(int cpu)
 {
-        u64 idle, idle_time = get_cpu_idle_time_us(cpu, NULL);
+        u64 idle, idle_time = -1ULL;
+
+        if (cpu_online(cpu))
+                idle_time = get_cpu_idle_time_us(cpu, NULL);
 
         if (idle_time == -1ULL)
-                /* !NO_HZ so we can rely on cpustat.idle */
+                /* !NO_HZ or cpu offline so we can rely on cpustat.idle */
                 idle = kcpustat_cpu(cpu).cpustat[CPUTIME_IDLE];
         else
                 idle = usecs_to_cputime64(idle_time);
@@ -58,10 +61,13 @@ static u64 get_idle_time(int cpu)
 
 static u64 get_iowait_time(int cpu)
 {
-        u64 iowait, iowait_time = get_cpu_iowait_time_us(cpu, NULL);
+        u64 iowait, iowait_time = -1ULL;
+
+        if (cpu_online(cpu))
+                iowait_time = get_cpu_iowait_time_us(cpu, NULL);
 
         if (iowait_time == -1ULL)
-                /* !NO_HZ so we can rely on cpustat.iowait */
+                /* !NO_HZ or cpu offline so we can rely on cpustat.iowait */
                 iowait = kcpustat_cpu(cpu).cpustat[CPUTIME_IOWAIT];
         else
                 iowait = usecs_to_cputime64(iowait_time);
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 6b0bb00d4d2b..2fbdff6be25c 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -485,20 +485,18 @@ int __sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
 /**
  *      sysfs_pathname - return full path to sysfs dirent
  *      @sd: sysfs_dirent whose path we want
- *      @path: caller allocated buffer
+ *      @path: caller allocated buffer of size PATH_MAX
  *
  *      Gives the name "/" to the sysfs_root entry; any path returned
  *      is relative to wherever sysfs is mounted.
- *
- *      XXX: does no error checking on @path size
  */
 static char *sysfs_pathname(struct sysfs_dirent *sd, char *path)
 {
         if (sd->s_parent) {
                 sysfs_pathname(sd->s_parent, path);
-                strcat(path, "/");
+                strlcat(path, "/", PATH_MAX);
         }
-        strcat(path, sd->s_name);
+        strlcat(path, sd->s_name, PATH_MAX);
         return path;
 }
 
@@ -531,9 +529,11 @@ int sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
                 char *path = kzalloc(PATH_MAX, GFP_KERNEL);
                 WARN(1, KERN_WARNING
                      "sysfs: cannot create duplicate filename '%s'\n",
-                     (path == NULL) ? sd->s_name :
-                     strcat(strcat(sysfs_pathname(acxt->parent_sd, path), "/"),
-                            sd->s_name));
+                     (path == NULL) ? sd->s_name
+                                    : (sysfs_pathname(acxt->parent_sd, path),
+                                       strlcat(path, "/", PATH_MAX),
+                                       strlcat(path, sd->s_name, PATH_MAX),
+                                       path));
                 kfree(path);
         }
 
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index c78bb997e2c6..af1cbaf535ed 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -205,6 +205,8 @@
         {0x1002, 0x6788, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x678A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6790, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6791, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6792, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6798, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6799, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x679A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
@@ -217,6 +219,7 @@
         {0x1002, 0x6808, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6809, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6810, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6811, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6816, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6817, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6818, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/dynamic_debug.h b/include/linux/dynamic_debug.h
index c18257b0fa72..6dd4787a798a 100644
--- a/include/linux/dynamic_debug.h
+++ b/include/linux/dynamic_debug.h
@@ -61,7 +61,7 @@ int __dynamic_netdev_dbg(struct _ddebug *descriptor,
                          const char *fmt, ...);
 
 #define DEFINE_DYNAMIC_DEBUG_METADATA(name, fmt)                \
-        static struct _ddebug __used __aligned(8)               \
+        static struct _ddebug  __aligned(8)                     \
         __attribute__((section("__verbose"))) name = {          \
                 .modname = KBUILD_MODNAME,                      \
                 .function = __func__,                           \
diff --git a/include/linux/extcon.h b/include/linux/extcon.h
index 7443a560c9d0..2c26c14cd710 100644
--- a/include/linux/extcon.h
+++ b/include/linux/extcon.h
@@ -68,7 +68,7 @@ enum extcon_cable_name {
         EXTCON_VIDEO_OUT,
         EXTCON_MECHANICAL,
 };
-extern const char *extcon_cable_name[];
+extern const char extcon_cable_name[][CABLE_NAME_MAX + 1];
 
 struct extcon_cable;
 
diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h
index c0ae76ac4e0b..7806c24e5bc8 100644
--- a/include/linux/iio/iio.h
+++ b/include/linux/iio/iio.h
@@ -618,4 +618,20 @@ static inline struct dentry *iio_get_debugfs_dentry(struct iio_dev *indio_dev)
 };
 #endif
 
+/**
+ * IIO_DEGREE_TO_RAD() - Convert degree to rad
+ * @deg: A value in degree
+ *
+ * Returns the given value converted from degree to rad
+ */
+#define IIO_DEGREE_TO_RAD(deg) (((deg) * 314159ULL + 9000000ULL) / 18000000ULL)
+
+/**
+ * IIO_G_TO_M_S_2() - Convert g to meter / second**2
+ * @g: A value in g
+ *
+ * Returns the given value converted from g to meter / second**2
+ */
+#define IIO_G_TO_M_S_2(g) ((g) * 980665ULL / 100000ULL)
+
 #endif /* _INDUSTRIAL_IO_H_ */
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 569d67d4243e..d452ee191066 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -57,6 +57,7 @@ int memblock_add(phys_addr_t base, phys_addr_t size);
 int memblock_remove(phys_addr_t base, phys_addr_t size);
 int memblock_free(phys_addr_t base, phys_addr_t size);
 int memblock_reserve(phys_addr_t base, phys_addr_t size);
+void memblock_trim_memory(phys_addr_t align);
 
 #ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
 void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn,
diff --git a/include/linux/mfd/max77693.h b/include/linux/mfd/max77693.h
index 1d28ae90384e..fe03b2d35d4f 100644
--- a/include/linux/mfd/max77693.h
+++ b/include/linux/mfd/max77693.h
@@ -30,7 +30,20 @@
 #ifndef __LINUX_MFD_MAX77693_H
 #define __LINUX_MFD_MAX77693_H
 
+struct max77693_reg_data {
+        u8 addr;
+        u8 data;
+};
+
+struct max77693_muic_platform_data {
+        struct max77693_reg_data *init_data;
+        int num_init_data;
+};
+
 struct max77693_platform_data {
         int wakeup;
+
+        /* muic data */
+        struct max77693_muic_platform_data *muic_data;
 };
 #endif  /* __LINUX_MFD_MAX77693_H */
diff --git a/include/linux/percpu-rwsem.h b/include/linux/percpu-rwsem.h
index cf80f7e5277f..250a4acddb2b 100644
--- a/include/linux/percpu-rwsem.h
+++ b/include/linux/percpu-rwsem.h
@@ -12,34 +12,27 @@ struct percpu_rw_semaphore {
         struct mutex mtx;
 };
 
+#define light_mb()      barrier()
+#define heavy_mb()      synchronize_sched()
+
 static inline void percpu_down_read(struct percpu_rw_semaphore *p)
 {
-        rcu_read_lock();
+        rcu_read_lock_sched();
         if (unlikely(p->locked)) {
-                rcu_read_unlock();
+                rcu_read_unlock_sched();
                 mutex_lock(&p->mtx);
                 this_cpu_inc(*p->counters);
                 mutex_unlock(&p->mtx);
                 return;
         }
         this_cpu_inc(*p->counters);
-        rcu_read_unlock();
+        rcu_read_unlock_sched();
+        light_mb(); /* A, between read of p->locked and read of data, paired with D */
 }
 
 static inline void percpu_up_read(struct percpu_rw_semaphore *p)
 {
-        /*
-         * On X86, write operation in this_cpu_dec serves as a memory unlock
-         * barrier (i.e. memory accesses may be moved before the write, but
-         * no memory accesses are moved past the write).
-         * On other architectures this may not be the case, so we need smp_mb()
-         * there.
-         */
-#if defined(CONFIG_X86) && (!defined(CONFIG_X86_PPRO_FENCE) && !defined(CONFIG_X86_OOSTORE))
-        barrier();
-#else
-        smp_mb();
-#endif
+        light_mb(); /* B, between read of the data and write to p->counter, paired with C */
         this_cpu_dec(*p->counters);
 }
 
@@ -58,14 +51,15 @@ static inline void percpu_down_write(struct percpu_rw_semaphore *p)
 {
         mutex_lock(&p->mtx);
         p->locked = true;
-        synchronize_rcu();
+        synchronize_sched(); /* make sure that all readers exit the rcu_read_lock_sched region */
         while (__percpu_count(p->counters))
                 msleep(1);
-        smp_rmb(); /* paired with smp_mb() in percpu_sem_up_read() */
+        heavy_mb(); /* C, between read of p->counter and write to data, paired with B */
 }
 
 static inline void percpu_up_write(struct percpu_rw_semaphore *p)
 {
+        heavy_mb(); /* D, between write to data and write to p->locked, paired with A */
         p->locked = false;
         mutex_unlock(&p->mtx);
 }
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 2e902359aee5..6bfb2faa0b19 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -803,12 +803,16 @@ static inline void perf_event_task_tick(void)				{ }
 do {                                                                    \
         static struct notifier_block fn##_nb __cpuinitdata =            \
                 { .notifier_call = fn, .priority = CPU_PRI_PERF };      \
+        unsigned long cpu = smp_processor_id();                         \
+        unsigned long flags;                                            \
         fn(&fn##_nb, (unsigned long)CPU_UP_PREPARE,                     \
-                (void *)(unsigned long)smp_processor_id());             \
+                (void *)(unsigned long)cpu);                            \
+        local_irq_save(flags);                                          \
         fn(&fn##_nb, (unsigned long)CPU_STARTING,                       \
-                (void *)(unsigned long)smp_processor_id());             \
+                (void *)(unsigned long)cpu);                            \
+        local_irq_restore(flags);                                       \
         fn(&fn##_nb, (unsigned long)CPU_ONLINE,                         \
-                (void *)(unsigned long)smp_processor_id());             \
+                (void *)(unsigned long)cpu);                            \
         register_cpu_notifier(&fn##_nb);                                \
 } while (0)
 
diff --git a/include/linux/rbtree_augmented.h b/include/linux/rbtree_augmented.h
index 214caa33433b..2ac60c9cf644 100644
--- a/include/linux/rbtree_augmented.h
+++ b/include/linux/rbtree_augmented.h
@@ -24,6 +24,7 @@
 #ifndef _LINUX_RBTREE_AUGMENTED_H
 #define _LINUX_RBTREE_AUGMENTED_H
 
+#include <linux/compiler.h>
 #include <linux/rbtree.h>
 
 /*
diff --git a/include/linux/spi/tsc2005.h b/include/linux/spi/tsc2005.h
index d9b0c84220c7..8f721e465e05 100644
--- a/include/linux/spi/tsc2005.h
+++ b/include/linux/spi/tsc2005.h
@@ -3,8 +3,6 @@
  *
  * Copyright (C) 2009-2010 Nokia Corporation
  *
- * Contact: Aaro Koskinen <aaro.koskinen@nokia.com>
- *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 8a7fc4be2d75..60b7aac15e0e 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -191,7 +191,8 @@ struct tcp_sock {
         u8      do_early_retrans:1,/* Enable RFC5827 early-retransmit  */
                 early_retrans_delayed:1, /* Delayed ER timer installed */
                 syn_data:1,     /* SYN includes data */
-                syn_fastopen:1; /* SYN includes Fast Open option */
+                syn_fastopen:1, /* SYN includes Fast Open option */
+                syn_data_acked:1;/* data in SYN is acked by SYN-ACK */
 
 /* RTT measurement */
         u32     srtt;           /* smoothed round trip time << 3        */
diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h
index e6f0331e3d45..24594571c5a3 100644
--- a/include/linux/uprobes.h
+++ b/include/linux/uprobes.h
@@ -35,16 +35,6 @@ struct inode;
 # include <asm/uprobes.h>
 #endif
 
-/* flags that denote/change uprobes behaviour */
-
-/* Have a copy of original instruction */
-#define UPROBE_COPY_INSN        0x1
-
-/* Dont run handlers when first register/ last unregister in progress*/
-#define UPROBE_RUN_HANDLER      0x2
-/* Can skip singlestep */
-#define UPROBE_SKIP_SSTEP       0x4
-
 struct uprobe_consumer {
         int (*handler)(struct uprobe_consumer *self, struct pt_regs *regs);
         /*
@@ -59,7 +49,6 @@ struct uprobe_consumer {
 #ifdef CONFIG_UPROBES
 enum uprobe_task_state {
         UTASK_RUNNING,
-        UTASK_BP_HIT,
         UTASK_SSTEP,
         UTASK_SSTEP_ACK,
         UTASK_SSTEP_TRAPPED,
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 1b4989082244..f8cd4cf3fad8 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1218,6 +1218,7 @@ struct cfg80211_deauth_request {
         const u8 *ie;
         size_t ie_len;
         u16 reason_code;
+        bool local_state_change;
 };
 
 /**
diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
index c4b89a5cb7df..e962faa5ab0d 100644
--- a/include/uapi/linux/tcp.h
+++ b/include/uapi/linux/tcp.h
@@ -130,6 +130,7 @@ enum {
 #define TCPI_OPT_WSCALE         4
 #define TCPI_OPT_ECN            8 /* ECN was negociated at TCP session init */
 #define TCPI_OPT_ECN_SEEN       16 /* we received at least one packet with ECT */
+#define TCPI_OPT_SYN_DATA       32 /* SYN-ACK acked data in SYN sent or rcvd */
 
 enum tcp_ca_state {
         TCP_CA_Open = 0,
diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
index aecee9d112cb..694dcaf266e6 100644
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -170,7 +170,7 @@ gnttab_set_unmap_op(struct gnttab_unmap_grant_ref *unmap, phys_addr_t addr,
         unmap->dev_bus_addr = 0;
 }
 
-int arch_gnttab_map_shared(unsigned long *frames, unsigned long nr_gframes,
+int arch_gnttab_map_shared(xen_pfn_t *frames, unsigned long nr_gframes,
                            unsigned long max_nr_gframes,
                            void **__shared);
 int arch_gnttab_map_status(uint64_t *frames, unsigned long nr_gframes,
diff --git a/include/xen/interface/grant_table.h b/include/xen/interface/grant_table.h
index f9f8b975ae74..e40fae9bf11a 100644
--- a/include/xen/interface/grant_table.h
+++ b/include/xen/interface/grant_table.h
@@ -310,7 +310,7 @@ struct gnttab_setup_table {
     uint32_t nr_frames;
     /* OUT parameters. */
     int16_t  status;              /* GNTST_* */
-    GUEST_HANDLE(ulong) frame_list;
+    GUEST_HANDLE(xen_pfn_t) frame_list;
 };
 DEFINE_GUEST_HANDLE_STRUCT(gnttab_setup_table);
 
diff --git a/include/xen/interface/memory.h b/include/xen/interface/memory.h
index b66d04ce6957..90712e2072d5 100644
--- a/include/xen/interface/memory.h
+++ b/include/xen/interface/memory.h
@@ -179,28 +179,8 @@ struct xen_add_to_physmap {
 };
 DEFINE_GUEST_HANDLE_STRUCT(xen_add_to_physmap);
 
-/*
- * Translates a list of domain-specific GPFNs into MFNs. Returns a -ve error
- * code on failure. This call only works for auto-translated guests.
- */
-#define XENMEM_translate_gpfn_list  8
-struct xen_translate_gpfn_list {
-    /* Which domain to translate for? */
-    domid_t domid;
-
-    /* Length of list. */
-    xen_ulong_t nr_gpfns;
-
-    /* List of GPFNs to translate. */
-    GUEST_HANDLE(ulong) gpfn_list;
-
-    /*
-     * Output list to contain MFN translations. May be the same as the input
-     * list (in which case each input GPFN is overwritten with the output MFN).
-     */
-    GUEST_HANDLE(ulong) mfn_list;
-};
-DEFINE_GUEST_HANDLE_STRUCT(xen_translate_gpfn_list);
+/*** REMOVED ***/
+/*#define XENMEM_translate_gpfn_list  8*/
 
 /*
  * Returns the pseudo-physical memory map as it was when the domain
diff --git a/kernel/Makefile b/kernel/Makefile
index 0dfeca4324ee..86e3285ae7e5 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -174,10 +174,8 @@ signing_key.priv signing_key.x509: x509.genkey
         @echo "###"
         @echo "### If this takes a long time, you might wish to run rngd in the"
         @echo "### background to keep the supply of entropy topped up.  It"
-        @echo "### needs to be run as root, and should use a hardware random"
-        @echo "### number generator if one is available, eg:"
-        @echo "###"
-        @echo "###     rngd -r /dev/hwrandom"
+        @echo "### needs to be run as root, and uses a hardware random"
+        @echo "### number generator if one is available."
         @echo "###"
         openssl req -new -nodes -utf8 $(sign_key_with_hash) -days 36500 -batch \
                 -x509 -config x509.genkey \
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 13774b3b39aa..f24f724620dd 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1962,9 +1962,8 @@ static void cgroup_task_migrate(struct cgroup *cgrp, struct cgroup *oldcgrp,
          * trading it for newcg is protected by cgroup_mutex, we're safe to drop
          * it here; it will be freed under RCU.
          */
-        put_css_set(oldcg);
-
         set_bit(CGRP_RELEASABLE, &oldcgrp->flags);
+        put_css_set(oldcg);
 }
 
 /**
@@ -4815,31 +4814,20 @@ static const struct file_operations proc_cgroupstats_operations = {
  *
  * A pointer to the shared css_set was automatically copied in
  * fork.c by dup_task_struct().  However, we ignore that copy, since
- * it was not made under the protection of RCU, cgroup_mutex or
- * threadgroup_change_begin(), so it might no longer be a valid
- * cgroup pointer.  cgroup_attach_task() might have already changed
- * current->cgroups, allowing the previously referenced cgroup
- * group to be removed and freed.
- *
- * Outside the pointer validity we also need to process the css_set
- * inheritance between threadgoup_change_begin() and
- * threadgoup_change_end(), this way there is no leak in any process
- * wide migration performed by cgroup_attach_proc() that could otherwise
- * miss a thread because it is too early or too late in the fork stage.
+ * it was not made under the protection of RCU or cgroup_mutex, so
+ * might no longer be a valid cgroup pointer.  cgroup_attach_task() might
+ * have already changed current->cgroups, allowing the previously
+ * referenced cgroup group to be removed and freed.
  *
  * At the point that cgroup_fork() is called, 'current' is the parent
  * task, and the passed argument 'child' points to the child task.
  */
 void cgroup_fork(struct task_struct *child)
 {
-        /*
-         * We don't need to task_lock() current because current->cgroups
-         * can't be changed concurrently here. The parent obviously hasn't
-         * exited and called cgroup_exit(), and we are synchronized against
-         * cgroup migration through threadgroup_change_begin().
-         */
+        task_lock(current);
         child->cgroups = current->cgroups;
         get_css_set(child->cgroups);
+        task_unlock(current);
         INIT_LIST_HEAD(&child->cg_list);
 }
 
@@ -4895,19 +4883,10 @@ void cgroup_post_fork(struct task_struct *child)
          */
         if (use_task_css_set_links) {
                 write_lock(&css_set_lock);
-                if (list_empty(&child->cg_list)) {
-                        /*
-                         * It's safe to use child->cgroups without task_lock()
-                         * here because we are protected through
-                         * threadgroup_change_begin() against concurrent
-                         * css_set change in cgroup_task_migrate(). Also
-                         * the task can't exit at that point until
-                         * wake_up_new_task() is called, so we are protected
-                         * against cgroup_exit() setting child->cgroup to
-                         * init_css_set.
-                         */
+                task_lock(child);
+                if (list_empty(&child->cg_list))
                         list_add(&child->cg_list, &child->cgroups->tasks);
-                }
+                task_unlock(child);
                 write_unlock(&css_set_lock);
         }
 }
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 98256bc71ee1..5cc4e7e42e68 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -78,15 +78,23 @@ static struct mutex uprobes_mmap_mutex[UPROBES_HASH_SZ];
  */
 static atomic_t uprobe_events = ATOMIC_INIT(0);
 
+/* Have a copy of original instruction */
+#define UPROBE_COPY_INSN        0
+/* Dont run handlers when first register/ last unregister in progress*/
+#define UPROBE_RUN_HANDLER      1
+/* Can skip singlestep */
+#define UPROBE_SKIP_SSTEP       2
+
 struct uprobe {
         struct rb_node          rb_node;        /* node in the rb tree */
         atomic_t                ref;
         struct rw_semaphore     consumer_rwsem;
+        struct mutex            copy_mutex;     /* TODO: kill me and UPROBE_COPY_INSN */
         struct list_head        pending_list;
         struct uprobe_consumer  *consumers;
         struct inode            *inode;         /* Also hold a ref to inode */
         loff_t                  offset;
-        int                     flags;
+        unsigned long           flags;
         struct arch_uprobe      arch;
 };
 
@@ -100,17 +108,12 @@ struct uprobe {
  */
 static bool valid_vma(struct vm_area_struct *vma, bool is_register)
 {
-        if (!vma->vm_file)
-                return false;
-
-        if (!is_register)
-                return true;
+        vm_flags_t flags = VM_HUGETLB | VM_MAYEXEC | VM_SHARED;
 
-        if ((vma->vm_flags & (VM_HUGETLB|VM_READ|VM_WRITE|VM_EXEC|VM_SHARED))
-                                == (VM_READ|VM_EXEC))
-                return true;
+        if (is_register)
+                flags |= VM_WRITE;
 
-        return false;
+        return vma->vm_file && (vma->vm_flags & flags) == VM_MAYEXEC;
 }
 
 static unsigned long offset_to_vaddr(struct vm_area_struct *vma, loff_t offset)
@@ -193,19 +196,44 @@ bool __weak is_swbp_insn(uprobe_opcode_t *insn)
         return *insn == UPROBE_SWBP_INSN;
 }
 
+static void copy_opcode(struct page *page, unsigned long vaddr, uprobe_opcode_t *opcode)
+{
+        void *kaddr = kmap_atomic(page);
+        memcpy(opcode, kaddr + (vaddr & ~PAGE_MASK), UPROBE_SWBP_INSN_SIZE);
+        kunmap_atomic(kaddr);
+}
+
+static int verify_opcode(struct page *page, unsigned long vaddr, uprobe_opcode_t *new_opcode)
+{
+        uprobe_opcode_t old_opcode;
+        bool is_swbp;
+
+        copy_opcode(page, vaddr, &old_opcode);
+        is_swbp = is_swbp_insn(&old_opcode);
+
+        if (is_swbp_insn(new_opcode)) {
+                if (is_swbp)            /* register: already installed? */
+                        return 0;
+        } else {
+                if (!is_swbp)           /* unregister: was it changed by us? */
+                        return 0;
+        }
+
+        return 1;
+}
+
 /*
  * NOTE:
  * Expect the breakpoint instruction to be the smallest size instruction for
  * the architecture. If an arch has variable length instruction and the
  * breakpoint instruction is not of the smallest length instruction
- * supported by that architecture then we need to modify read_opcode /
+ * supported by that architecture then we need to modify is_swbp_at_addr and
  * write_opcode accordingly. This would never be a problem for archs that
  * have fixed length instructions.
  */
 
 /*
  * write_opcode - write the opcode at a given virtual address.
- * @auprobe: arch breakpointing information.
  * @mm: the probed process address space.
  * @vaddr: the virtual address to store the opcode.
  * @opcode: opcode to be written at @vaddr.
@@ -216,8 +244,8 @@ bool __weak is_swbp_insn(uprobe_opcode_t *insn)
  * For mm @mm, write the opcode at @vaddr.
  * Return 0 (success) or a negative errno.
  */
-static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
-                        unsigned long vaddr, uprobe_opcode_t opcode)
+static int write_opcode(struct mm_struct *mm, unsigned long vaddr,
+                        uprobe_opcode_t opcode)
 {
         struct page *old_page, *new_page;
         void *vaddr_old, *vaddr_new;
@@ -226,10 +254,14 @@ static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
 
 retry:
         /* Read the page with vaddr into memory */
-        ret = get_user_pages(NULL, mm, vaddr, 1, 0, 0, &old_page, &vma);
+        ret = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &old_page, &vma);
         if (ret <= 0)
                 return ret;
 
+        ret = verify_opcode(old_page, vaddr, &opcode);
+        if (ret <= 0)
+                goto put_old;
+
         ret = -ENOMEM;
         new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, vaddr);
         if (!new_page)
@@ -264,63 +296,6 @@ put_old:
 }
 
 /**
- * read_opcode - read the opcode at a given virtual address.
- * @mm: the probed process address space.
- * @vaddr: the virtual address to read the opcode.
- * @opcode: location to store the read opcode.
- *
- * Called with mm->mmap_sem held (for read and with a reference to
- * mm.
- *
- * For mm @mm, read the opcode at @vaddr and store it in @opcode.
- * Return 0 (success) or a negative errno.
- */
-static int read_opcode(struct mm_struct *mm, unsigned long vaddr, uprobe_opcode_t *opcode)
-{
-        struct page *page;
-        void *vaddr_new;
-        int ret;
-
-        ret = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &page, NULL);
-        if (ret <= 0)
-                return ret;
-
-        vaddr_new = kmap_atomic(page);
-        vaddr &= ~PAGE_MASK;
-        memcpy(opcode, vaddr_new + vaddr, UPROBE_SWBP_INSN_SIZE);
-        kunmap_atomic(vaddr_new);
-
-        put_page(page);
-
-        return 0;
-}
-
-static int is_swbp_at_addr(struct mm_struct *mm, unsigned long vaddr)
-{
-        uprobe_opcode_t opcode;
-        int result;
-
-        if (current->mm == mm) {
-                pagefault_disable();
-                result = __copy_from_user_inatomic(&opcode, (void __user*)vaddr,
-                                                                sizeof(opcode));
-                pagefault_enable();
-
-                if (likely(result == 0))
-                        goto out;
-        }
-
-        result = read_opcode(mm, vaddr, &opcode);
-        if (result)
-                return result;
-out:
-        if (is_swbp_insn(&opcode))
-                return 1;
-
-        return 0;
-}
-
-/**
  * set_swbp - store breakpoint at a given address.
  * @auprobe: arch specific probepoint information.
  * @mm: the probed process address space.
@@ -331,18 +306,7 @@ out:
  */
 int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned long vaddr)
 {
-        int result;
-        /*
-         * See the comment near uprobes_hash().
-         */
-        result = is_swbp_at_addr(mm, vaddr);
-        if (result == 1)
-                return 0;
-
-        if (result)
-                return result;
-
-        return write_opcode(auprobe, mm, vaddr, UPROBE_SWBP_INSN);
+        return write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
 }
 
 /**
@@ -357,16 +321,7 @@ int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned
 int __weak
 set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned long vaddr)
 {
-        int result;
-
-        result = is_swbp_at_addr(mm, vaddr);
-        if (!result)
-                return -EINVAL;
-
-        if (result != 1)
-                return result;
-
-        return write_opcode(auprobe, mm, vaddr, *(uprobe_opcode_t *)auprobe->insn);
+        return write_opcode(mm, vaddr, *(uprobe_opcode_t *)auprobe->insn);
 }
 
 static int match_uprobe(struct uprobe *l, struct uprobe *r)
@@ -473,7 +428,7 @@ static struct uprobe *insert_uprobe(struct uprobe *uprobe)
         spin_unlock(&uprobes_treelock);
 
         /* For now assume that the instruction need not be single-stepped */
-        uprobe->flags |= UPROBE_SKIP_SSTEP;
+        __set_bit(UPROBE_SKIP_SSTEP, &uprobe->flags);
 
         return u;
 }
@@ -495,6 +450,7 @@ static struct uprobe *alloc_uprobe(struct inode *inode, loff_t offset)
         uprobe->inode = igrab(inode);
         uprobe->offset = offset;
         init_rwsem(&uprobe->consumer_rwsem);
+        mutex_init(&uprobe->copy_mutex);
 
         /* add to uprobes_tree, sorted on inode:offset */
         cur_uprobe = insert_uprobe(uprobe);
@@ -515,7 +471,7 @@ static void handler_chain(struct uprobe *uprobe, struct pt_regs *regs)
 {
         struct uprobe_consumer *uc;
 
-        if (!(uprobe->flags & UPROBE_RUN_HANDLER))
+        if (!test_bit(UPROBE_RUN_HANDLER, &uprobe->flags))
                 return;
 
         down_read(&uprobe->consumer_rwsem);
@@ -621,29 +577,43 @@ static int copy_insn(struct uprobe *uprobe, struct file *filp)
         return __copy_insn(mapping, filp, uprobe->arch.insn, bytes, uprobe->offset);
 }
 
-/*
- * How mm->uprobes_state.count gets updated
- * uprobe_mmap() increments the count if
- *      - it successfully adds a breakpoint.
- *      - it cannot add a breakpoint, but sees that there is a underlying
- *        breakpoint (via a is_swbp_at_addr()).
- *
- * uprobe_munmap() decrements the count if
- *      - it sees a underlying breakpoint, (via is_swbp_at_addr)
- *        (Subsequent uprobe_unregister wouldnt find the breakpoint
- *        unless a uprobe_mmap kicks in, since the old vma would be
- *        dropped just after uprobe_munmap.)
- *
- * uprobe_register increments the count if:
- *      - it successfully adds a breakpoint.
- *
- * uprobe_unregister decrements the count if:
- *      - it sees a underlying breakpoint and removes successfully.
- *        (via is_swbp_at_addr)
- *        (Subsequent uprobe_munmap wouldnt find the breakpoint
- *        since there is no underlying breakpoint after the
- *        breakpoint removal.)
- */
+static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
+                                struct mm_struct *mm, unsigned long vaddr)
+{
+        int ret = 0;
+
+        if (test_bit(UPROBE_COPY_INSN, &uprobe->flags))
+                return ret;
+
+        mutex_lock(&uprobe->copy_mutex);
+        if (test_bit(UPROBE_COPY_INSN, &uprobe->flags))
+                goto out;
+
+        ret = copy_insn(uprobe, file);
+        if (ret)
+                goto out;
+
+        ret = -ENOTSUPP;
+        if (is_swbp_insn((uprobe_opcode_t *)uprobe->arch.insn))
+                goto out;
+
+        ret = arch_uprobe_analyze_insn(&uprobe->arch, mm, vaddr);
+        if (ret)
+                goto out;
+
+        /* write_opcode() assumes we don't cross page boundary */
+        BUG_ON((uprobe->offset & ~PAGE_MASK) +
+                        UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
+
+        smp_wmb(); /* pairs with rmb() in find_active_uprobe() */
+        set_bit(UPROBE_COPY_INSN, &uprobe->flags);
+
+ out:
+        mutex_unlock(&uprobe->copy_mutex);
+
+        return ret;
+}
+
 static int
 install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
                         struct vm_area_struct *vma, unsigned long vaddr)
@@ -661,24 +631,9 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
         if (!uprobe->consumers)
                 return 0;
 
-        if (!(uprobe->flags & UPROBE_COPY_INSN)) {
-                ret = copy_insn(uprobe, vma->vm_file);
-                if (ret)
-                        return ret;
-
-                if (is_swbp_insn((uprobe_opcode_t *)uprobe->arch.insn))
-                        return -ENOTSUPP;
-
-                ret = arch_uprobe_analyze_insn(&uprobe->arch, mm, vaddr);
-                if (ret)
-                        return ret;
-
-                /* write_opcode() assumes we don't cross page boundary */
-                BUG_ON((uprobe->offset & ~PAGE_MASK) +
-                                UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
-
-                uprobe->flags |= UPROBE_COPY_INSN;
-        }
+        ret = prepare_uprobe(uprobe, vma->vm_file, mm, vaddr);
+        if (ret)
+                return ret;
 
         /*
          * set MMF_HAS_UPROBES in advance for uprobe_pre_sstep_notifier(),
@@ -697,15 +652,15 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
         return ret;
 }
 
-static void
+static int
 remove_breakpoint(struct uprobe *uprobe, struct mm_struct *mm, unsigned long vaddr)
 {
         /* can happen if uprobe_register() fails */
         if (!test_bit(MMF_HAS_UPROBES, &mm->flags))
-                return;
+                return 0;
 
         set_bit(MMF_RECALC_UPROBES, &mm->flags);
-        set_orig_insn(&uprobe->arch, mm, vaddr);
+        return set_orig_insn(&uprobe->arch, mm, vaddr);
 }
 
 /*
@@ -820,7 +775,7 @@ static int register_for_each_vma(struct uprobe *uprobe, bool is_register)
                 struct mm_struct *mm = info->mm;
                 struct vm_area_struct *vma;
 
-                if (err)
+                if (err && is_register)
                         goto free;
 
                 down_write(&mm->mmap_sem);
@@ -836,7 +791,7 @@ static int register_for_each_vma(struct uprobe *uprobe, bool is_register)
                 if (is_register)
                         err = install_breakpoint(uprobe, mm, vma, info->vaddr);
                 else
-                        remove_breakpoint(uprobe, mm, info->vaddr);
+                        err |= remove_breakpoint(uprobe, mm, info->vaddr);
 
  unlock:
                 up_write(&mm->mmap_sem);
@@ -893,13 +848,15 @@ int uprobe_register(struct inode *inode, loff_t offset, struct uprobe_consumer *
         mutex_lock(uprobes_hash(inode));
         uprobe = alloc_uprobe(inode, offset);
 
-        if (uprobe && !consumer_add(uprobe, uc)) {
+        if (!uprobe) {
+                ret = -ENOMEM;
+        } else if (!consumer_add(uprobe, uc)) {
                 ret = __uprobe_register(uprobe);
                 if (ret) {
                         uprobe->consumers = NULL;
                         __uprobe_unregister(uprobe);
                 } else {
-                        uprobe->flags |= UPROBE_RUN_HANDLER;
+                        set_bit(UPROBE_RUN_HANDLER, &uprobe->flags);
                 }
         }
 
@@ -932,7 +889,7 @@ void uprobe_unregister(struct inode *inode, loff_t offset, struct uprobe_consume
         if (consumer_del(uprobe, uc)) {
                 if (!uprobe->consumers) {
                         __uprobe_unregister(uprobe);
-                        uprobe->flags &= ~UPROBE_RUN_HANDLER;
+                        clear_bit(UPROBE_RUN_HANDLER, &uprobe->flags);
                 }
         }
 
@@ -1393,10 +1350,11 @@ bool uprobe_deny_signal(void)
  */
 static bool can_skip_sstep(struct uprobe *uprobe, struct pt_regs *regs)
 {
-        if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
-                return true;
-
-        uprobe->flags &= ~UPROBE_SKIP_SSTEP;
+        if (test_bit(UPROBE_SKIP_SSTEP, &uprobe->flags)) {
+                if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
+                        return true;
+                clear_bit(UPROBE_SKIP_SSTEP, &uprobe->flags);
+        }
         return false;
 }
 
@@ -1419,6 +1377,30 @@ static void mmf_recalc_uprobes(struct mm_struct *mm)
         clear_bit(MMF_HAS_UPROBES, &mm->flags);
 }
 
+static int is_swbp_at_addr(struct mm_struct *mm, unsigned long vaddr)
+{
+        struct page *page;
+        uprobe_opcode_t opcode;
+        int result;
+
+        pagefault_disable();
+        result = __copy_from_user_inatomic(&opcode, (void __user*)vaddr,
+                                                        sizeof(opcode));
+        pagefault_enable();
+
+        if (likely(result == 0))
+                goto out;
+
+        result = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &page, NULL);
+        if (result < 0)
+                return result;
+
+        copy_opcode(page, vaddr, &opcode);
+        put_page(page);
+ out:
+        return is_swbp_insn(&opcode);
+}
+
 static struct uprobe *find_active_uprobe(unsigned long bp_vaddr, int *is_swbp)
 {
         struct mm_struct *mm = current->mm;
@@ -1489,38 +1471,41 @@ static void handle_swbp(struct pt_regs *regs)
                 }
                 return;
         }
+        /*
+         * TODO: move copy_insn/etc into _register and remove this hack.
+         * After we hit the bp, _unregister + _register can install the
+         * new and not-yet-analyzed uprobe at the same address, restart.
+         */
+        smp_rmb(); /* pairs with wmb() in install_breakpoint() */
+        if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags)))
+                goto restart;
 
         utask = current->utask;
         if (!utask) {
                 utask = add_utask();
                 /* Cannot allocate; re-execute the instruction. */
                 if (!utask)
-                        goto cleanup_ret;
+                        goto restart;
         }
-        utask->active_uprobe = uprobe;
+
         handler_chain(uprobe, regs);
-        if (uprobe->flags & UPROBE_SKIP_SSTEP && can_skip_sstep(uprobe, regs))
-                goto cleanup_ret;
+        if (can_skip_sstep(uprobe, regs))
+                goto out;
 
-        utask->state = UTASK_SSTEP;
         if (!pre_ssout(uprobe, regs, bp_vaddr)) {
                 arch_uprobe_enable_step(&uprobe->arch);
+                utask->active_uprobe = uprobe;
+                utask->state = UTASK_SSTEP;
                 return;
         }
 
-cleanup_ret:
-        if (utask) {
-                utask->active_uprobe = NULL;
-                utask->state = UTASK_RUNNING;
-        }
-        if (!(uprobe->flags & UPROBE_SKIP_SSTEP))
-
-                /*
-                 * cannot singlestep; cannot skip instruction;
-                 * re-execute the instruction.
-                 */
-                instruction_pointer_set(regs, bp_vaddr);
-
+restart:
+        /*
+         * cannot singlestep; cannot skip instruction;
+         * re-execute the instruction.
+         */
+        instruction_pointer_set(regs, bp_vaddr);
+out:
         put_uprobe(uprobe);
 }
 
@@ -1552,13 +1537,12 @@ static void handle_singlestep(struct uprobe_task *utask, struct pt_regs *regs)
 }
 
 /*
- * On breakpoint hit, breakpoint notifier sets the TIF_UPROBE flag.  (and on
- * subsequent probe hits on the thread sets the state to UTASK_BP_HIT) and
- * allows the thread to return from interrupt.
+ * On breakpoint hit, breakpoint notifier sets the TIF_UPROBE flag and
+ * allows the thread to return from interrupt. After that handle_swbp()
+ * sets utask->active_uprobe.
  *
- * On singlestep exception, singlestep notifier sets the TIF_UPROBE flag and
- * also sets the state to UTASK_SSTEP_ACK and allows the thread to return from
- * interrupt.
+ * On singlestep exception, singlestep notifier sets the TIF_UPROBE flag
+ * and allows the thread to return from interrupt.
  *
  * While returning to userspace, thread notices the TIF_UPROBE flag and calls
  * uprobe_notify_resume().
@@ -1567,11 +1551,13 @@ void uprobe_notify_resume(struct pt_regs *regs)
 {
         struct uprobe_task *utask;
 
+        clear_thread_flag(TIF_UPROBE);
+
         utask = current->utask;
-        if (!utask || utask->state == UTASK_BP_HIT)
-                handle_swbp(regs);
-        else
+        if (utask && utask->active_uprobe)
                 handle_singlestep(utask, regs);
+        else
+                handle_swbp(regs);
 }
 
 /*
@@ -1580,17 +1566,10 @@ void uprobe_notify_resume(struct pt_regs *regs)
  */
 int uprobe_pre_sstep_notifier(struct pt_regs *regs)
 {
-        struct uprobe_task *utask;
-
         if (!current->mm || !test_bit(MMF_HAS_UPROBES, &current->mm->flags))
                 return 0;
 
-        utask = current->utask;
-        if (utask)
-                utask->state = UTASK_BP_HIT;
-
         set_thread_flag(TIF_UPROBE);
-
         return 1;
 }
 
diff --git a/kernel/module_signing.c b/kernel/module_signing.c
index d492a23df99c..ea1b1df5dbb0 100644
--- a/kernel/module_signing.c
+++ b/kernel/module_signing.c
@@ -192,7 +192,7 @@ int mod_verify_sig(const void *mod, unsigned long *_modlen)
         size_t modlen = *_modlen, sig_len;
         int ret;
 
-        pr_devel("==>%s(,%lu)\n", __func__, modlen);
+        pr_devel("==>%s(,%zu)\n", __func__, modlen);
 
         if (modlen <= sizeof(ms))
                 return -EBADMSG;
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index eb00be205811..7b07cc0dfb75 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -71,12 +71,22 @@ err_alloc:
         return NULL;
 }
 
+/* MAX_PID_NS_LEVEL is needed for limiting size of 'struct pid' */
+#define MAX_PID_NS_LEVEL 32
+
 static struct pid_namespace *create_pid_namespace(struct pid_namespace *parent_pid_ns)
 {
         struct pid_namespace *ns;
         unsigned int level = parent_pid_ns->level + 1;
-        int i, err = -ENOMEM;
+        int i;
+        int err;
+
+        if (level > MAX_PID_NS_LEVEL) {
+                err = -EINVAL;
+                goto out;
+        }
 
+        err = -ENOMEM;
         ns = kmem_cache_zalloc(pid_ns_cachep, GFP_KERNEL);
         if (ns == NULL)
                 goto out;
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index b32ed0e385a5..b979426d16c6 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1567,6 +1567,10 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
 
                 put_online_cpus();
         } else {
+                /* Make sure this CPU has been intitialized */
+                if (!cpumask_test_cpu(cpu_id, buffer->cpumask))
+                        goto out;
+
                 cpu_buffer = buffer->buffers[cpu_id];
 
                 if (nr_pages == cpu_buffer->nr_pages)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index d951daa0ca9a..042d221d33cc 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2982,7 +2982,7 @@ bool cancel_delayed_work(struct delayed_work *dwork)
 
         set_work_cpu_and_clear_pending(&dwork->work, work_cpu(&dwork->work));
         local_irq_restore(flags);
-        return true;
+        return ret;
 }
 EXPORT_SYMBOL(cancel_delayed_work);
 
diff --git a/lib/genalloc.c b/lib/genalloc.c
index ca208a92628c..54920433705a 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -178,7 +178,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
         struct gen_pool_chunk *chunk;
         int nbits = size >> pool->min_alloc_order;
         int nbytes = sizeof(struct gen_pool_chunk) +
-                                (nbits + BITS_PER_BYTE - 1) / BITS_PER_BYTE;
+                                BITS_TO_LONGS(nbits) * sizeof(long);
 
         chunk = kmalloc_node(nbytes, GFP_KERNEL | __GFP_ZERO, nid);
         if (unlikely(chunk == NULL))
diff --git a/mm/memblock.c b/mm/memblock.c
index 931eef145af5..625905523c2a 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -930,6 +930,30 @@ int __init_memblock memblock_is_region_reserved(phys_addr_t base, phys_addr_t si
         return memblock_overlaps_region(&memblock.reserved, base, size) >= 0;
 }
 
+void __init_memblock memblock_trim_memory(phys_addr_t align)
+{
+        int i;
+        phys_addr_t start, end, orig_start, orig_end;
+        struct memblock_type *mem = &memblock.memory;
+
+        for (i = 0; i < mem->cnt; i++) {
+                orig_start = mem->regions[i].base;
+                orig_end = mem->regions[i].base + mem->regions[i].size;
+                start = round_up(orig_start, align);
+                end = round_down(orig_end, align);
+
+                if (start == orig_start && end == orig_end)
+                        continue;
+
+                if (start < end) {
+                        mem->regions[i].base = start;
+                        mem->regions[i].size = end - start;
+                } else {
+                        memblock_remove_region(mem, i);
+                        i--;
+                }
+        }
+}
 
 void __init_memblock memblock_set_current_limit(phys_addr_t limit)
 {
diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
index 479a1e751a73..8a5ac8c686b0 100644
--- a/mm/mmu_notifier.c
+++ b/mm/mmu_notifier.c
@@ -196,28 +196,28 @@ static int do_mmu_notifier_register(struct mmu_notifier *mn,
         BUG_ON(atomic_read(&mm->mm_users) <= 0);
 
         /*
-        * Verify that mmu_notifier_init() already run and the global srcu is
-        * initialized.
-        */
+         * Verify that mmu_notifier_init() already run and the global srcu is
+         * initialized.
+         */
         BUG_ON(!srcu.per_cpu_ref);
 
+        ret = -ENOMEM;
+        mmu_notifier_mm = kmalloc(sizeof(struct mmu_notifier_mm), GFP_KERNEL);
+        if (unlikely(!mmu_notifier_mm))
+                goto out;
+
         if (take_mmap_sem)
                 down_write(&mm->mmap_sem);
         ret = mm_take_all_locks(mm);
         if (unlikely(ret))
-                goto out;
+                goto out_clean;
 
         if (!mm_has_notifiers(mm)) {
-                mmu_notifier_mm = kmalloc(sizeof(struct mmu_notifier_mm),
-                                        GFP_KERNEL);
-                if (unlikely(!mmu_notifier_mm)) {
-                        ret = -ENOMEM;
-                        goto out_of_mem;
-                }
                 INIT_HLIST_HEAD(&mmu_notifier_mm->list);
                 spin_lock_init(&mmu_notifier_mm->lock);
 
                 mm->mmu_notifier_mm = mmu_notifier_mm;
+                mmu_notifier_mm = NULL;
         }
         atomic_inc(&mm->mm_count);
 
@@ -233,12 +233,12 @@ static int do_mmu_notifier_register(struct mmu_notifier *mn,
         hlist_add_head(&mn->hlist, &mm->mmu_notifier_mm->list);
         spin_unlock(&mm->mmu_notifier_mm->lock);
 
-out_of_mem:
         mm_drop_all_locks(mm);
-out:
+out_clean:
         if (take_mmap_sem)
                 up_write(&mm->mmap_sem);
-
+        kfree(mmu_notifier_mm);
+out:
         BUG_ON(atomic_read(&mm->mm_users) <= 0);
         return ret;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index bb90971182bd..5b74de6702e0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1809,10 +1809,10 @@ static void __paginginit init_zone_allows_reclaim(int nid)
         int i;
 
         for_each_online_node(i)
-                if (node_distance(nid, i) <= RECLAIM_DISTANCE) {
+                if (node_distance(nid, i) <= RECLAIM_DISTANCE)
                         node_set(i, NODE_DATA(nid)->reclaim_nodes);
+                else
                         zone_reclaim_mode = 1;
-                }
 }
 
 #else   /* CONFIG_NUMA */
@@ -5825,7 +5825,7 @@ int alloc_contig_range(unsigned long start, unsigned long end,
         ret = start_isolate_page_range(pfn_max_align_down(start),
                                        pfn_max_align_up(end), migratetype);
         if (ret)
-                goto done;
+                return ret;
 
         ret = __alloc_contig_migrate_range(&cc, start, end);
         if (ret)
diff --git a/mm/rmap.c b/mm/rmap.c
index 7df7984d476c..2ee1ef0f317b 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -56,6 +56,7 @@
 #include <linux/mmu_notifier.h>
 #include <linux/migrate.h>
 #include <linux/hugetlb.h>
+#include <linux/backing-dev.h>
 
 #include <asm/tlbflush.h>
 
@@ -926,11 +927,8 @@ int page_mkclean(struct page *page)
 
         if (page_mapped(page)) {
                 struct address_space *mapping = page_mapping(page);
-                if (mapping) {
+                if (mapping)
                         ret = page_mkclean_file(mapping, page);
-                        if (page_test_and_clear_dirty(page_to_pfn(page), 1))
-                                ret = 1;
-                }
         }
 
         return ret;
@@ -1116,6 +1114,7 @@ void page_add_file_rmap(struct page *page)
  */
 void page_remove_rmap(struct page *page)
 {
+        struct address_space *mapping = page_mapping(page);
         bool anon = PageAnon(page);
         bool locked;
         unsigned long flags;
@@ -1138,8 +1137,19 @@ void page_remove_rmap(struct page *page)
          * this if the page is anon, so about to be freed; but perhaps
          * not if it's in swapcache - there might be another pte slot
          * containing the swap entry, but page not yet written to swap.
+         *
+         * And we can skip it on file pages, so long as the filesystem
+         * participates in dirty tracking; but need to catch shm and tmpfs
+         * and ramfs pages which have been modified since creation by read
+         * fault.
+         *
+         * Note that mapping must be decided above, before decrementing
+         * mapcount (which luckily provides a barrier): once page is unmapped,
+         * it could be truncated and page->mapping reset to NULL at any moment.
+         * Note also that we are relying on page_mapping(page) to set mapping
+         * to &swapper_space when PageSwapCache(page).
          */
-        if ((!anon || PageSwapCache(page)) &&
+        if (mapping && !mapping_cap_account_dirty(mapping) &&
             page_test_and_clear_dirty(page_to_pfn(page), 1))
                 set_page_dirty(page);
         /*
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 9096bcb08132..ee070722a3a3 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -463,7 +463,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
 
         case NETDEV_PRE_TYPE_CHANGE:
                 /* Forbid underlaying device to change its type. */
-                return NOTIFY_BAD;
+                if (vlan_uses_dev(dev))
+                        return NOTIFY_BAD;
+                break;
 
         case NETDEV_NOTIFY_PEERS:
         case NETDEV_BONDING_FAILOVER:
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 0a9084ad19a6..fd8d5afec0dd 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1167,6 +1167,8 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
         uint16_t crc;
         unsigned long entrytime;
 
+        spin_lock_init(&bat_priv->bla.bcast_duplist_lock);
+
         batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla hash registering\n");
 
         /* setting claim destination address */
@@ -1210,8 +1212,8 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
 /**
  * batadv_bla_check_bcast_duplist
  * @bat_priv: the bat priv with all the soft interface information
- * @bcast_packet: originator mac address
- * @hdr_size: maximum length of the frame
+ * @bcast_packet: encapsulated broadcast frame plus batman header
+ * @bcast_packet_len: length of encapsulated broadcast frame plus batman header
  *
  * check if it is on our broadcast list. Another gateway might
  * have sent the same packet because it is connected to the same backbone,
@@ -1224,20 +1226,22 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
  */
 int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
                                    struct batadv_bcast_packet *bcast_packet,
-                                   int hdr_size)
+                                   int bcast_packet_len)
 {
-        int i, length, curr;
+        int i, length, curr, ret = 0;
         uint8_t *content;
         uint16_t crc;
         struct batadv_bcast_duplist_entry *entry;
 
-        length = hdr_size - sizeof(*bcast_packet);
+        length = bcast_packet_len - sizeof(*bcast_packet);
         content = (uint8_t *)bcast_packet;
         content += sizeof(*bcast_packet);
 
         /* calculate the crc ... */
         crc = crc16(0, content, length);
 
+        spin_lock_bh(&bat_priv->bla.bcast_duplist_lock);
+
         for (i = 0; i < BATADV_DUPLIST_SIZE; i++) {
                 curr = (bat_priv->bla.bcast_duplist_curr + i);
                 curr %= BATADV_DUPLIST_SIZE;
@@ -1259,9 +1263,12 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
                 /* this entry seems to match: same crc, not too old,
                  * and from another gw. therefore return 1 to forbid it.
                  */
-                return 1;
+                ret = 1;
+                goto out;
         }
-        /* not found, add a new entry (overwrite the oldest entry) */
+        /* not found, add a new entry (overwrite the oldest entry)
+         * and allow it, its the first occurence.
+         */
         curr = (bat_priv->bla.bcast_duplist_curr + BATADV_DUPLIST_SIZE - 1);
         curr %= BATADV_DUPLIST_SIZE;
         entry = &bat_priv->bla.bcast_duplist[curr];
@@ -1270,8 +1277,10 @@ int batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
         memcpy(entry->orig, bcast_packet->orig, ETH_ALEN);
         bat_priv->bla.bcast_duplist_curr = curr;
 
-        /* allow it, its the first occurence. */
-        return 0;
+out:
+        spin_unlock_bh(&bat_priv->bla.bcast_duplist_lock);
+
+        return ret;
 }
 
 
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 939fc01371df..376b4cc6ca82 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1124,8 +1124,14 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
 
         spin_unlock_bh(&orig_node->bcast_seqno_lock);
 
+        /* keep skb linear for crc calculation */
+        if (skb_linearize(skb) < 0)
+                goto out;
+
+        bcast_packet = (struct batadv_bcast_packet *)skb->data;
+
         /* check whether this has been sent by another originator before */
-        if (batadv_bla_check_bcast_duplist(bat_priv, bcast_packet, hdr_size))
+        if (batadv_bla_check_bcast_duplist(bat_priv, bcast_packet, skb->len))
                 goto out;
 
         /* rebroadcast packet */
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 2ed82caacdca..ac1e07a80454 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -205,6 +205,8 @@ struct batadv_priv_bla {
         struct batadv_hashtable *backbone_hash;
         struct batadv_bcast_duplist_entry bcast_duplist[BATADV_DUPLIST_SIZE];
         int bcast_duplist_curr;
+        /* protects bcast_duplist and bcast_duplist_curr */
+        spinlock_t bcast_duplist_lock;
         struct batadv_bla_claim_dst claim_dest;
         struct delayed_work work;
 };
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 8c225ef349cd..2ac8d50861e0 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -32,6 +32,8 @@
 
 #define SMP_TIMEOUT     msecs_to_jiffies(30000)
 
+#define AUTH_REQ_MASK   0x07
+
 static inline void swap128(u8 src[16], u8 dst[16])
 {
         int i;
@@ -230,7 +232,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
                 req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
                 req->init_key_dist = 0;
                 req->resp_key_dist = dist_keys;
-                req->auth_req = authreq;
+                req->auth_req = (authreq & AUTH_REQ_MASK);
                 return;
         }
 
@@ -239,7 +241,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
         rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
         rsp->init_key_dist = 0;
         rsp->resp_key_dist = req->resp_key_dist & dist_keys;
-        rsp->auth_req = authreq;
+        rsp->auth_req = (authreq & AUTH_REQ_MASK);
 }
 
 static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6e04b1fa11f2..4007c1437fda 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3379,10 +3379,12 @@ EXPORT_SYMBOL(__skb_warn_lro_forwarding);
 
 void kfree_skb_partial(struct sk_buff *skb, bool head_stolen)
 {
-        if (head_stolen)
+        if (head_stolen) {
+                skb_release_head_state(skb);
                 kmem_cache_free(skbuff_head_cache, skb);
-        else
+        } else {
                 __kfree_skb(skb);
+        }
 }
 EXPORT_SYMBOL(kfree_skb_partial);
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 432f4bb77238..a8c651216fa6 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1163,8 +1163,12 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
         spin_lock_bh(&fnhe_lock);
 
         if (daddr == fnhe->fnhe_daddr) {
-                struct rtable *orig;
-
+                struct rtable *orig = rcu_dereference(fnhe->fnhe_rth);
+                if (orig && rt_is_expired(orig)) {
+                        fnhe->fnhe_gw = 0;
+                        fnhe->fnhe_pmtu = 0;
+                        fnhe->fnhe_expires = 0;
+                }
                 if (fnhe->fnhe_pmtu) {
                         unsigned long expires = fnhe->fnhe_expires;
                         unsigned long diff = expires - jiffies;
@@ -1181,7 +1185,6 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
                 } else if (!rt->rt_gateway)
                         rt->rt_gateway = daddr;
 
-                orig = rcu_dereference(fnhe->fnhe_rth);
                 rcu_assign_pointer(fnhe->fnhe_rth, rt);
                 if (orig)
                         rt_free(orig);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f32c02e2a543..197c0008503c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -549,14 +549,12 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
                          !tp->urg_data ||
                          before(tp->urg_seq, tp->copied_seq) ||
                          !before(tp->urg_seq, tp->rcv_nxt)) {
-                        struct sk_buff *skb;
 
                         answ = tp->rcv_nxt - tp->copied_seq;
 
-                        /* Subtract 1, if FIN is in queue. */
-                        skb = skb_peek_tail(&sk->sk_receive_queue);
-                        if (answ && skb)
-                                answ -= tcp_hdr(skb)->fin;
+                        /* Subtract 1, if FIN was received */
+                        if (answ && sock_flag(sk, SOCK_DONE))
+                                answ--;
                 } else
                         answ = tp->urg_seq - tp->copied_seq;
                 release_sock(sk);
@@ -2766,6 +2764,8 @@ void tcp_get_info(const struct sock *sk, struct tcp_info *info)
                 info->tcpi_options |= TCPI_OPT_ECN;
         if (tp->ecn_flags & TCP_ECN_SEEN)
                 info->tcpi_options |= TCPI_OPT_ECN_SEEN;
+        if (tp->syn_data_acked)
+                info->tcpi_options |= TCPI_OPT_SYN_DATA;
 
         info->tcpi_rto = jiffies_to_usecs(icsk->icsk_rto);
         info->tcpi_ato = jiffies_to_usecs(icsk->icsk_ack.ato);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 432c36649db3..1db663983587 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5646,6 +5646,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
                 tcp_rearm_rto(sk);
                 return true;
         }
+        tp->syn_data_acked = tp->syn_data;
         return false;
 }
 
@@ -5963,7 +5964,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
         req = tp->fastopen_rsk;
         if (req != NULL) {
-                BUG_ON(sk->sk_state != TCP_SYN_RECV &&
+                WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV &&
                     sk->sk_state != TCP_FIN_WAIT1);
 
                 if (tcp_check_req(sk, skb, req, NULL, true) == NULL)
@@ -6052,7 +6053,15 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                          * ACK we have received, this would have acknowledged
                          * our SYNACK so stop the SYNACK timer.
                          */
-                        if (acceptable && req != NULL) {
+                        if (req != NULL) {
+                                /* Return RST if ack_seq is invalid.
+                                 * Note that RFC793 only says to generate a
+                                 * DUPACK for it but for TCP Fast Open it seems
+                                 * better to treat this case like TCP_SYN_RECV
+                                 * above.
+                                 */
+                                if (!acceptable)
+                                        return 1;
                                 /* We no longer need the request sock. */
                                 reqsk_fastopen_remove(sk, req, false);
                                 tcp_rearm_rto(sk);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index ef998b008a57..0c4a64355603 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1461,6 +1461,7 @@ static int tcp_v4_conn_req_fastopen(struct sock *sk,
                 skb_set_owner_r(skb, child);
                 __skb_queue_tail(&child->sk_receive_queue, skb);
                 tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+                tp->syn_data_acked = 1;
         }
         sk->sk_data_ready(sk, 0);
         bh_unlock_sock(child);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 27536ba16c9d..a7302d974f32 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -510,6 +510,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 newtp->rx_opt.mss_clamp = req->mss;
                 TCP_ECN_openreq_child(newtp, req);
                 newtp->fastopen_rsk = NULL;
+                newtp->syn_data_acked = 0;
 
                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_PASSIVEOPENS);
         }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index fc04711e80c8..d47c1b4421a3 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -347,8 +347,8 @@ void tcp_retransmit_timer(struct sock *sk)
                 return;
         }
         if (tp->fastopen_rsk) {
-                BUG_ON(sk->sk_state != TCP_SYN_RECV &&
-                    sk->sk_state != TCP_FIN_WAIT1);
+                WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV &&
+                             sk->sk_state != TCP_FIN_WAIT1);
                 tcp_fastopen_synack_timer(sk);
                 /* Before we receive ACK to our SYN-ACK don't retransmit
                  * anything else (e.g., data or FIN segments).
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7c7e963260e1..b1e6cf0b95fd 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -219,7 +219,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
 };
 
 static const u32 ip6_template_metrics[RTAX_MAX] = {
-        [RTAX_HOPLIMIT - 1] = 255,
+        [RTAX_HOPLIMIT - 1] = 0,
 };
 
 static const struct rt6_info ip6_null_entry_template = {
@@ -1232,7 +1232,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         rt->rt6i_dst.addr = fl6->daddr;
         rt->rt6i_dst.plen = 128;
         rt->rt6i_idev     = idev;
-        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 255);
+        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 0);
 
         spin_lock_bh(&icmp6_dst_lock);
         rt->dst.next = icmp6_dst_gc_list;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 6f8a73c64fb3..7de7717ad67d 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -853,7 +853,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                         if (info->control.vif == &sdata->vif) {
                                 __skb_unlink(skb, &local->pending[i]);
-                                dev_kfree_skb_irq(skb);
+                                ieee80211_free_txskb(&local->hw, skb);
                         }
                 }
         }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e714ed8bb198..1b7eed252fe9 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3099,22 +3099,32 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
                                    ht_cfreq, ht_oper->primary_chan,
                                    cbss->channel->band);
                         ht_oper = NULL;
+                } else {
+                        channel_type = NL80211_CHAN_HT20;
                 }
         }
 
-        if (ht_oper) {
-                channel_type = NL80211_CHAN_HT20;
+        if (ht_oper && sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                /*
+                 * cfg80211 already verified that the channel itself can
+                 * be used, but it didn't check that we can do the right
+                 * HT type, so do that here as well. If HT40 isn't allowed
+                 * on this channel, disable 40 MHz operation.
+                 */
 
-                if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
-                        switch (ht_oper->ht_param &
-                                        IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                        if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                                ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
+                        else
                                 channel_type = NL80211_CHAN_HT40PLUS;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                        break;
+                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                        if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                                ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
+                        else
                                 channel_type = NL80211_CHAN_HT40MINUS;
-                                break;
-                        }
+                        break;
                 }
         }
 
@@ -3549,6 +3559,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+        bool tx = !req->local_state_change;
 
         mutex_lock(&ifmgd->mtx);
 
@@ -3565,12 +3576,12 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         if (ifmgd->associated &&
             ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
-                                       req->reason_code, true, frame_buf);
+                                       req->reason_code, tx, frame_buf);
         } else {
                 drv_mgd_prepare_tx(sdata->local, sdata);
                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
                                                IEEE80211_STYPE_DEAUTH,
-                                               req->reason_code, true,
+                                               req->reason_code, tx,
                                                frame_buf);
         }
 
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 797dd36a220d..0a4e4c04db89 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -650,7 +650,7 @@ static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
                  */
                 if (!skb)
                         break;
-                dev_kfree_skb(skb);
+                ieee80211_free_txskb(&local->hw, skb);
         }
 
         /*
@@ -679,7 +679,7 @@ static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
                 local->total_ps_buffered--;
                 ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
                        sta->sta.addr);
-                dev_kfree_skb(skb);
+                ieee80211_free_txskb(&local->hw, skb);
         }
 
         /*
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 22ca35054dd0..94e586873979 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -406,7 +406,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         int queue = info->hw_queue;
 
         if (WARN_ON(!info->control.vif)) {
-                kfree_skb(skb);
+                ieee80211_free_txskb(&local->hw, skb);
                 return;
         }
 
@@ -431,7 +431,7 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local,
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (WARN_ON(!info->control.vif)) {
-                        kfree_skb(skb);
+                        ieee80211_free_txskb(&local->hw, skb);
                         continue;
                 }
 
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index bdb53aba888e..8bd2f5c6a56e 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -106,7 +106,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
                 if (status->flag & RX_FLAG_MMIC_ERROR)
                         goto mic_fail;
 
-                if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
+                if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
+                    rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
                         goto update_iv;
 
                 return RX_CONTINUE;
@@ -545,14 +546,19 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
 static void bip_aad(struct sk_buff *skb, u8 *aad)
 {
+        __le16 mask_fc;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
         /* BIP AAD: FC(masked) || A1 || A2 || A3 */
 
         /* FC type/subtype */
-        aad[0] = skb->data[0];
         /* Mask FC Retry, PwrMgt, MoreData flags to zero */
-        aad[1] = skb->data[1] & ~(BIT(4) | BIT(5) | BIT(6));
+        mask_fc = hdr->frame_control;
+        mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | IEEE80211_FCTL_PM |
+                                IEEE80211_FCTL_MOREDATA);
+        put_unaligned(mask_fc, (__le16 *) &aad[0]);
         /* A1 || A2 || A3 */
-        memcpy(aad + 2, skb->data + 4, 3 * ETH_ALEN);
+        memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN);
 }
 
 
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 7e7198b51c06..c4ee43710aab 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2589,6 +2589,8 @@ __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
         struct ip_vs_proto_data *pd;
 #endif
 
+        memset(u, 0, sizeof (*u));
+
 #ifdef CONFIG_IP_VS_PROTO_TCP
         pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
         u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
@@ -2766,7 +2768,6 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         {
                 struct ip_vs_timeout_user t;
 
-                memset(&t, 0, sizeof(t));
                 __ip_vs_get_timeouts(net, &t);
                 if (copy_to_user(user, &t, sizeof(t)) != 0)
                         ret = -EFAULT;
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 16c712563860..ae7f5daeee43 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -180,9 +180,9 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
         struct ctnl_timeout *timeout;
         struct nf_conn_timeout *timeout_ext;
-        const struct ipt_entry *e = par->entryinfo;
         struct nf_conntrack_l4proto *l4proto;
         int ret = 0;
+        u8 proto;
 
         rcu_read_lock();
         timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
@@ -192,9 +192,11 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
                 goto out;
         }
 
-        if (e->ip.invflags & IPT_INV_PROTO) {
+        proto = xt_ct_find_proto(par);
+        if (!proto) {
                 ret = -EINVAL;
-                pr_info("You cannot use inversion on L4 protocol\n");
+                pr_info("You must specify a L4 protocol, and not use "
+                        "inversions on it.\n");
                 goto out;
         }
 
@@ -214,7 +216,7 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         /* Make sure the timeout policy matches any existing protocol tracker,
          * otherwise default to generic.
          */
-        l4proto = __nf_ct_l4proto_find(par->family, e->ip.proto);
+        l4proto = __nf_ct_l4proto_find(par->family, proto);
         if (timeout->l4proto->l4proto != l4proto->l4proto) {
                 ret = -EINVAL;
                 pr_info("Timeout policy `%s' can only be used by L4 protocol "
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index ee2e5bc5a8c7..bd93e51d30ac 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -70,6 +70,7 @@ tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
         fl4.daddr = info->gw.ip;
         fl4.flowi4_tos = RT_TOS(iph->tos);
         fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
+        fl4.flowi4_flags = FLOWI_FLAG_KNOWN_NH;
         rt = ip_route_output_key(net, &fl4);
         if (IS_ERR(rt))
                 return false;
diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
index 81aafa8e4fef..bea7464cc43f 100644
--- a/net/netfilter/xt_nat.c
+++ b/net/netfilter/xt_nat.c
@@ -111,7 +111,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                 .family         = NFPROTO_IPV4,
                 .table          = "nat",
                 .hooks          = (1 << NF_INET_POST_ROUTING) |
-                                  (1 << NF_INET_LOCAL_OUT),
+                                  (1 << NF_INET_LOCAL_IN),
                 .me             = THIS_MODULE,
         },
         {
@@ -123,7 +123,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                 .family         = NFPROTO_IPV4,
                 .table          = "nat",
                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN),
+                                  (1 << NF_INET_LOCAL_OUT),
                 .me             = THIS_MODULE,
         },
         {
@@ -133,7 +133,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                 .targetsize     = sizeof(struct nf_nat_range),
                 .table          = "nat",
                 .hooks          = (1 << NF_INET_POST_ROUTING) |
-                                  (1 << NF_INET_LOCAL_OUT),
+                                  (1 << NF_INET_LOCAL_IN),
                 .me             = THIS_MODULE,
         },
         {
@@ -143,7 +143,7 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                 .targetsize     = sizeof(struct nf_nat_range),
                 .table          = "nat",
                 .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_IN),
+                                  (1 << NF_INET_LOCAL_OUT),
                 .me             = THIS_MODULE,
         },
 };
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 01e944a017a4..4da797fa5ec5 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -138,6 +138,8 @@ static int netlink_dump(struct sock *sk);
 static DEFINE_RWLOCK(nl_table_lock);
 static atomic_t nl_table_users = ATOMIC_INIT(0);
 
+#define nl_deref_protected(X) rcu_dereference_protected(X, lockdep_is_held(&nl_table_lock));
+
 static ATOMIC_NOTIFIER_HEAD(netlink_chain);
 
 static inline u32 netlink_group_mask(u32 group)
@@ -345,6 +347,11 @@ netlink_update_listeners(struct sock *sk)
         struct hlist_node *node;
         unsigned long mask;
         unsigned int i;
+        struct listeners *listeners;
+
+        listeners = nl_deref_protected(tbl->listeners);
+        if (!listeners)
+                return;
 
         for (i = 0; i < NLGRPLONGS(tbl->groups); i++) {
                 mask = 0;
@@ -352,7 +359,7 @@ netlink_update_listeners(struct sock *sk)
                         if (i < NLGRPLONGS(nlk_sk(sk)->ngroups))
                                 mask |= nlk_sk(sk)->groups[i];
                 }
-                tbl->listeners->masks[i] = mask;
+                listeners->masks[i] = mask;
         }
         /* this function is only called with the netlink table "grabbed", which
          * makes sure updates are visible before bind or setsockopt return. */
@@ -536,7 +543,11 @@ static int netlink_release(struct socket *sock)
         if (netlink_is_kernel(sk)) {
                 BUG_ON(nl_table[sk->sk_protocol].registered == 0);
                 if (--nl_table[sk->sk_protocol].registered == 0) {
-                        kfree(nl_table[sk->sk_protocol].listeners);
+                        struct listeners *old;
+
+                        old = nl_deref_protected(nl_table[sk->sk_protocol].listeners);
+                        RCU_INIT_POINTER(nl_table[sk->sk_protocol].listeners, NULL);
+                        kfree_rcu(old, rcu);
                         nl_table[sk->sk_protocol].module = NULL;
                         nl_table[sk->sk_protocol].bind = NULL;
                         nl_table[sk->sk_protocol].flags = 0;
@@ -982,7 +993,7 @@ int netlink_has_listeners(struct sock *sk, unsigned int group)
         rcu_read_lock();
         listeners = rcu_dereference(nl_table[sk->sk_protocol].listeners);
 
-        if (group - 1 < nl_table[sk->sk_protocol].groups)
+        if (listeners && group - 1 < nl_table[sk->sk_protocol].groups)
                 res = test_bit(group - 1, listeners->masks);
 
         rcu_read_unlock();
@@ -1625,7 +1636,7 @@ int __netlink_change_ngroups(struct sock *sk, unsigned int groups)
                 new = kzalloc(sizeof(*new) + NLGRPSZ(groups), GFP_ATOMIC);
                 if (!new)
                         return -ENOMEM;
-                old = rcu_dereference_protected(tbl->listeners, 1);
+                old = nl_deref_protected(tbl->listeners);
                 memcpy(new->masks, old->masks, NLGRPSZ(tbl->groups));
                 rcu_assign_pointer(tbl->listeners, new);
 
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index aaaadfbe36e9..75853cabf4c9 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -254,7 +254,6 @@ struct sock_xprt {
         void                    (*old_data_ready)(struct sock *, int);
         void                    (*old_state_change)(struct sock *);
         void                    (*old_write_space)(struct sock *);
-        void                    (*old_error_report)(struct sock *);
 };
 
 /*
@@ -737,10 +736,10 @@ static int xs_tcp_send_request(struct rpc_task *task)
                 dprintk("RPC:       sendmsg returned unrecognized error %d\n",
                         -status);
         case -ECONNRESET:
-        case -EPIPE:
                 xs_tcp_shutdown(xprt);
         case -ECONNREFUSED:
         case -ENOTCONN:
+        case -EPIPE:
                 clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
         }
 
@@ -781,7 +780,6 @@ static void xs_save_old_callbacks(struct sock_xprt *transport, struct sock *sk)
         transport->old_data_ready = sk->sk_data_ready;
         transport->old_state_change = sk->sk_state_change;
         transport->old_write_space = sk->sk_write_space;
-        transport->old_error_report = sk->sk_error_report;
 }
 
 static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *sk)
@@ -789,7 +787,6 @@ static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *s
         sk->sk_data_ready = transport->old_data_ready;
         sk->sk_state_change = transport->old_state_change;
         sk->sk_write_space = transport->old_write_space;
-        sk->sk_error_report = transport->old_error_report;
 }
 
 static void xs_reset_transport(struct sock_xprt *transport)
@@ -1453,7 +1450,7 @@ static void xs_tcp_cancel_linger_timeout(struct rpc_xprt *xprt)
         xprt_clear_connecting(xprt);
 }
 
-static void xs_sock_mark_closed(struct rpc_xprt *xprt)
+static void xs_sock_reset_connection_flags(struct rpc_xprt *xprt)
 {
         smp_mb__before_clear_bit();
         clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
@@ -1461,6 +1458,11 @@ static void xs_sock_mark_closed(struct rpc_xprt *xprt)
         clear_bit(XPRT_CLOSE_WAIT, &xprt->state);
         clear_bit(XPRT_CLOSING, &xprt->state);
         smp_mb__after_clear_bit();
+}
+
+static void xs_sock_mark_closed(struct rpc_xprt *xprt)
+{
+        xs_sock_reset_connection_flags(xprt);
         /* Mark transport as closed and wake up all pending tasks */
         xprt_disconnect_done(xprt);
 }
@@ -1516,6 +1518,7 @@ static void xs_tcp_state_change(struct sock *sk)
         case TCP_CLOSE_WAIT:
                 /* The server initiated a shutdown of the socket */
                 xprt->connect_cookie++;
+                clear_bit(XPRT_CONNECTED, &xprt->state);
                 xs_tcp_force_close(xprt);
         case TCP_CLOSING:
                 /*
@@ -1540,25 +1543,6 @@ static void xs_tcp_state_change(struct sock *sk)
         read_unlock_bh(&sk->sk_callback_lock);
 }
 
-/**
- * xs_error_report - callback mainly for catching socket errors
- * @sk: socket
- */
-static void xs_error_report(struct sock *sk)
-{
-        struct rpc_xprt *xprt;
-
-        read_lock_bh(&sk->sk_callback_lock);
-        if (!(xprt = xprt_from_sock(sk)))
-                goto out;
-        dprintk("RPC:       %s client %p...\n"
-                        "RPC:       error %d\n",
-                        __func__, xprt, sk->sk_err);
-        xprt_wake_pending_tasks(xprt, -EAGAIN);
-out:
-        read_unlock_bh(&sk->sk_callback_lock);
-}
-
 static void xs_write_space(struct sock *sk)
 {
         struct socket *sock;
@@ -1858,7 +1842,6 @@ static int xs_local_finish_connecting(struct rpc_xprt *xprt,
                 sk->sk_user_data = xprt;
                 sk->sk_data_ready = xs_local_data_ready;
                 sk->sk_write_space = xs_udp_write_space;
-                sk->sk_error_report = xs_error_report;
                 sk->sk_allocation = GFP_ATOMIC;
 
                 xprt_clear_connected(xprt);
@@ -1983,7 +1966,6 @@ static void xs_udp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                 sk->sk_user_data = xprt;
                 sk->sk_data_ready = xs_udp_data_ready;
                 sk->sk_write_space = xs_udp_write_space;
-                sk->sk_error_report = xs_error_report;
                 sk->sk_no_check = UDP_CSUM_NORCV;
                 sk->sk_allocation = GFP_ATOMIC;
 
@@ -2050,10 +2032,8 @@ static void xs_abort_connection(struct sock_xprt *transport)
         any.sa_family = AF_UNSPEC;
         result = kernel_connect(transport->sock, &any, sizeof(any), 0);
         if (!result)
-                xs_sock_mark_closed(&transport->xprt);
-        else
-                dprintk("RPC:       AF_UNSPEC connect return code %d\n",
-                                result);
+                xs_sock_reset_connection_flags(&transport->xprt);
+        dprintk("RPC:       AF_UNSPEC connect return code %d\n", result);
 }
 
 static void xs_tcp_reuse_connection(struct sock_xprt *transport)
@@ -2098,7 +2078,6 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                 sk->sk_data_ready = xs_tcp_data_ready;
                 sk->sk_state_change = xs_tcp_state_change;
                 sk->sk_write_space = xs_tcp_write_space;
-                sk->sk_error_report = xs_error_report;
                 sk->sk_allocation = GFP_ATOMIC;
 
                 /* socket options */
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 8016fee0752b..904a7f368325 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -457,20 +457,14 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                 .reason_code = reason,
                 .ie = ie,
                 .ie_len = ie_len,
+                .local_state_change = local_state_change,
         };
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (local_state_change) {
-                if (wdev->current_bss &&
-                    ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
-                        cfg80211_unhold_bss(wdev->current_bss);
-                        cfg80211_put_bss(&wdev->current_bss->pub);
-                        wdev->current_bss = NULL;
-                }
-
+        if (local_state_change && (!wdev->current_bss ||
+            !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
                 return 0;
-        }
 
         return rdev->ops->deauth(&rdev->wiphy, dev, &req);
 }
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index cf5fd220309b..813200384d97 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -724,6 +724,8 @@ fail:
  */
 static void free_profile(struct aa_profile *profile)
 {
+        struct aa_profile *p;
+
         AA_DEBUG("%s(%p)\n", __func__, profile);
 
         if (!profile)
@@ -751,7 +753,27 @@ static void free_profile(struct aa_profile *profile)
         aa_put_dfa(profile->xmatch);
         aa_put_dfa(profile->policy.dfa);
 
-        aa_put_profile(profile->replacedby);
+        /* put the profile reference for replacedby, but not via
+         * put_profile(kref_put).
+         * replacedby can form a long chain that can result in cascading
+         * frees that blows the stack because kref_put makes a nested fn
+         * call (it looks like recursion, with free_profile calling
+         * free_profile) for each profile in the chain lp#1056078.
+         */
+        for (p = profile->replacedby; p; ) {
+                if (atomic_dec_and_test(&p->base.count.refcount)) {
+                        /* no more refs on p, grab its replacedby */
+                        struct aa_profile *next = p->replacedby;
+                        /* break the chain */
+                        p->replacedby = NULL;
+                        /* now free p, chain is broken */
+                        free_profile(p);
+
+                        /* follow up with next profile in the chain */
+                        p = next;
+                } else
+                        break;
+        }
 
         kzfree(profile);
 }
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 44dfc415a379..842c254396db 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -42,7 +42,10 @@ struct dev_exception_item {
 struct dev_cgroup {
         struct cgroup_subsys_state css;
         struct list_head exceptions;
-        bool deny_all;
+        enum {
+                DEVCG_DEFAULT_ALLOW,
+                DEVCG_DEFAULT_DENY,
+        } behavior;
 };
 
 static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s)
@@ -182,13 +185,13 @@ static struct cgroup_subsys_state *devcgroup_create(struct cgroup *cgroup)
         parent_cgroup = cgroup->parent;
 
         if (parent_cgroup == NULL)
-                dev_cgroup->deny_all = false;
+                dev_cgroup->behavior = DEVCG_DEFAULT_ALLOW;
         else {
                 parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);
                 mutex_lock(&devcgroup_mutex);
                 ret = dev_exceptions_copy(&dev_cgroup->exceptions,
                                           &parent_dev_cgroup->exceptions);
-                dev_cgroup->deny_all = parent_dev_cgroup->deny_all;
+                dev_cgroup->behavior = parent_dev_cgroup->behavior;
                 mutex_unlock(&devcgroup_mutex);
                 if (ret) {
                         kfree(dev_cgroup);
@@ -260,7 +263,7 @@ static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft,
          * - List the exceptions in case the default policy is to deny
          * This way, the file remains as a "whitelist of devices"
          */
-        if (devcgroup->deny_all == false) {
+        if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
                 set_access(acc, ACC_MASK);
                 set_majmin(maj, ~0);
                 set_majmin(min, ~0);
@@ -314,12 +317,12 @@ static int may_access(struct dev_cgroup *dev_cgroup,
          * In two cases we'll consider this new exception valid:
          * - the dev cgroup has its default policy to allow + exception list:
          *   the new exception should *not* match any of the exceptions
-         *   (!deny_all, !match)
+         *   (behavior == DEVCG_DEFAULT_ALLOW, !match)
          * - the dev cgroup has its default policy to deny + exception list:
          *   the new exception *should* match the exceptions
-         *   (deny_all, match)
+         *   (behavior == DEVCG_DEFAULT_DENY, match)
          */
-        if (dev_cgroup->deny_all == match)
+        if ((dev_cgroup->behavior == DEVCG_DEFAULT_DENY) == match)
                 return 1;
         return 0;
 }
@@ -341,6 +344,17 @@ static int parent_has_perm(struct dev_cgroup *childcg,
         return may_access(parent, ex);
 }
 
+/**
+ * may_allow_all - checks if it's possible to change the behavior to
+ *                 allow based on parent's rules.
+ * @parent: device cgroup's parent
+ * returns: != 0 in case it's allowed, 0 otherwise
+ */
+static inline int may_allow_all(struct dev_cgroup *parent)
+{
+        return parent->behavior == DEVCG_DEFAULT_ALLOW;
+}
+
 /*
  * Modify the exception list using allow/deny rules.
  * CAP_SYS_ADMIN is needed for this.  It's at least separate from CAP_MKNOD
@@ -358,9 +372,11 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                                    int filetype, const char *buffer)
 {
         const char *b;
-        char *endp;
-        int count;
+        char temp[12];          /* 11 + 1 characters needed for a u32 */
+        int count, rc;
         struct dev_exception_item ex;
+        struct cgroup *p = devcgroup->css.cgroup;
+        struct dev_cgroup *parent = cgroup_to_devcgroup(p->parent);
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
@@ -372,14 +388,18 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
         case 'a':
                 switch (filetype) {
                 case DEVCG_ALLOW:
-                        if (!parent_has_perm(devcgroup, &ex))
+                        if (!may_allow_all(parent))
                                 return -EPERM;
                         dev_exception_clean(devcgroup);
-                        devcgroup->deny_all = false;
+                        rc = dev_exceptions_copy(&devcgroup->exceptions,
+                                                 &parent->exceptions);
+                        if (rc)
+                                return rc;
+                        devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
                         break;
                 case DEVCG_DENY:
                         dev_exception_clean(devcgroup);
-                        devcgroup->deny_all = true;
+                        devcgroup->behavior = DEVCG_DEFAULT_DENY;
                         break;
                 default:
                         return -EINVAL;
@@ -402,8 +422,16 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                 ex.major = ~0;
                 b++;
         } else if (isdigit(*b)) {
-                ex.major = simple_strtoul(b, &endp, 10);
-                b = endp;
+                memset(temp, 0, sizeof(temp));
+                for (count = 0; count < sizeof(temp) - 1; count++) {
+                        temp[count] = *b;
+                        b++;
+                        if (!isdigit(*b))
+                                break;
+                }
+                rc = kstrtou32(temp, 10, &ex.major);
+                if (rc)
+                        return -EINVAL;
         } else {
                 return -EINVAL;
         }
@@ -416,8 +444,16 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                 ex.minor = ~0;
                 b++;
         } else if (isdigit(*b)) {
-                ex.minor = simple_strtoul(b, &endp, 10);
-                b = endp;
+                memset(temp, 0, sizeof(temp));
+                for (count = 0; count < sizeof(temp) - 1; count++) {
+                        temp[count] = *b;
+                        b++;
+                        if (!isdigit(*b))
+                                break;
+                }
+                rc = kstrtou32(temp, 10, &ex.minor);
+                if (rc)
+                        return -EINVAL;
         } else {
                 return -EINVAL;
         }
@@ -452,7 +488,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                  * an matching exception instead. And be silent about it: we
                  * don't want to break compatibility
                  */
-                if (devcgroup->deny_all == false) {
+                if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
                         dev_exception_rm(devcgroup, &ex);
                         return 0;
                 }
@@ -463,7 +499,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                  * an matching exception instead. And be silent about it: we
                  * don't want to break compatibility
                  */
-                if (devcgroup->deny_all == true) {
+                if (devcgroup->behavior == DEVCG_DEFAULT_DENY) {
                         dev_exception_rm(devcgroup, &ex);
                         return 0;
                 }
@@ -533,10 +569,10 @@ struct cgroup_subsys devices_subsys = {
  *
  * returns 0 on success, -EPERM case the operation is not permitted
  */
-static int __devcgroup_check_permission(struct dev_cgroup *dev_cgroup,
-                                        short type, u32 major, u32 minor,
+static int __devcgroup_check_permission(short type, u32 major, u32 minor,
                                         short access)
 {
+        struct dev_cgroup *dev_cgroup;
         struct dev_exception_item ex;
         int rc;
 
@@ -547,6 +583,7 @@ static int __devcgroup_check_permission(struct dev_cgroup *dev_cgroup,
         ex.access = access;
 
         rcu_read_lock();
+        dev_cgroup = task_devcgroup(current);
         rc = may_access(dev_cgroup, &ex);
         rcu_read_unlock();
 
@@ -558,7 +595,6 @@ static int __devcgroup_check_permission(struct dev_cgroup *dev_cgroup,
 
 int __devcgroup_inode_permission(struct inode *inode, int mask)
 {
-        struct dev_cgroup *dev_cgroup = task_devcgroup(current);
         short type, access = 0;
 
         if (S_ISBLK(inode->i_mode))
@@ -570,13 +606,12 @@ int __devcgroup_inode_permission(struct inode *inode, int mask)
         if (mask & MAY_READ)
                 access |= ACC_READ;
 
-        return __devcgroup_check_permission(dev_cgroup, type, imajor(inode),
-                                            iminor(inode), access);
+        return __devcgroup_check_permission(type, imajor(inode), iminor(inode),
+                        access);
 }
 
 int devcgroup_inode_mknod(int mode, dev_t dev)
 {
-        struct dev_cgroup *dev_cgroup = task_devcgroup(current);
         short type;
 
         if (!S_ISBLK(mode) && !S_ISCHR(mode))
@@ -587,7 +622,7 @@ int devcgroup_inode_mknod(int mode, dev_t dev)
         else
                 type = DEV_CHAR;
 
-        return __devcgroup_check_permission(dev_cgroup, type, MAJOR(dev),
-                                            MINOR(dev), ACC_MKNOD);
+        return __devcgroup_check_permission(type, MAJOR(dev), MINOR(dev),
+                        ACC_MKNOD);
 
 }
diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c
index 3d1afb612b35..4a7ff4e8985b 100644
--- a/sound/isa/opti9xx/miro.c
+++ b/sound/isa/opti9xx/miro.c
@@ -1286,7 +1286,6 @@ static int __devinit snd_miro_probe(struct snd_card *card)
 
         error = snd_card_miro_aci_detect(card, miro);
         if (error < 0) {
-                snd_card_free(card);
                 snd_printk(KERN_ERR "unable to detect aci chip\n");
                 return -ENODEV;
         }
diff --git a/sound/pci/als300.c b/sound/pci/als300.c
index 00f157a2cf64..5af3cb6b0c18 100644
--- a/sound/pci/als300.c
+++ b/sound/pci/als300.c
@@ -394,6 +394,8 @@ static int snd_als300_playback_open(struct snd_pcm_substream *substream)
         struct snd_als300_substream_data *data = kzalloc(sizeof(*data),
                                                                 GFP_KERNEL);
 
+        if (!data)
+                return -ENOMEM;
         snd_als300_dbgcallenter();
         chip->playback_substream = substream;
         runtime->hw = snd_als300_playback_hw;
@@ -425,6 +427,8 @@ static int snd_als300_capture_open(struct snd_pcm_substream *substream)
         struct snd_als300_substream_data *data = kzalloc(sizeof(*data),
                                                                 GFP_KERNEL);
 
+        if (!data)
+                return -ENOMEM;
         snd_als300_dbgcallenter();
         chip->capture_substream = substream;
         runtime->hw = snd_als300_capture_hw;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 48d9d609f89b..f7397ad02a0d 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5677,6 +5677,7 @@ static const struct hda_verb alc268_beep_init_verbs[] = {
 
 enum {
         ALC268_FIXUP_INV_DMIC,
+        ALC268_FIXUP_HP_EAPD,
 };
 
 static const struct alc_fixup alc268_fixups[] = {
@@ -5684,10 +5685,26 @@ static const struct alc_fixup alc268_fixups[] = {
                 .type = ALC_FIXUP_FUNC,
                 .v.func = alc_fixup_inv_dmic_0x12,
         },
+        [ALC268_FIXUP_HP_EAPD] = {
+                .type = ALC_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        {0x15, AC_VERB_SET_EAPD_BTLENABLE, 0},
+                        {}
+                }
+        },
 };
 
 static const struct alc_model_fixup alc268_fixup_models[] = {
         {.id = ALC268_FIXUP_INV_DMIC, .name = "inv-dmic"},
+        {.id = ALC268_FIXUP_HP_EAPD, .name = "hp-eapd"},
+        {}
+};
+
+static const struct snd_pci_quirk alc268_fixup_tbl[] = {
+        /* below is codec SSID since multiple Toshiba laptops have the
+         * same PCI SSID 1179:ff00
+         */
+        SND_PCI_QUIRK(0x1179, 0xff06, "Toshiba P200", ALC268_FIXUP_HP_EAPD),
         {}
 };
 
@@ -5722,7 +5739,7 @@ static int patch_alc268(struct hda_codec *codec)
 
         spec = codec->spec;
 
-        alc_pick_fixup(codec, alc268_fixup_models, NULL, alc268_fixups);
+        alc_pick_fixup(codec, alc268_fixup_models, alc268_fixup_tbl, alc268_fixups);
         alc_apply_fixup(codec, ALC_FIXUP_ACT_PRE_PROBE);
 
         /* automatic parse from the BIOS config */
@@ -6188,6 +6205,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index b12308b5ba2a..f1cd1e387801 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -971,6 +971,7 @@ static inline void snd_hdspm_initialize_midi_flush(struct hdspm *hdspm);
 static int hdspm_update_simple_mixer_controls(struct hdspm *hdspm);
 static int hdspm_autosync_ref(struct hdspm *hdspm);
 static int snd_hdspm_set_defaults(struct hdspm *hdspm);
+static int hdspm_system_clock_mode(struct hdspm *hdspm);
 static void hdspm_set_sgbuf(struct hdspm *hdspm,
                             struct snd_pcm_substream *substream,
                              unsigned int reg, int channels);
@@ -1989,10 +1990,14 @@ static int hdspm_get_system_sample_rate(struct hdspm *hdspm)
         rate = hdspm_calc_dds_value(hdspm, period);
 
         if (rate > 207000) {
-                /* Unreasonable high sample rate as seen on PCI MADI cards.
-                 * Use the cached value instead.
-                 */
-                rate = hdspm->system_sample_rate;
+                /* Unreasonable high sample rate as seen on PCI MADI cards. */
+                if (0 == hdspm_system_clock_mode(hdspm)) {
+                        /* master mode, return internal sample rate */
+                        rate = hdspm->system_sample_rate;
+                } else {
+                        /* slave mode, return external sample rate */
+                        rate = hdspm_external_sample_rate(hdspm);
+                }
         }
 
         return rate;
@@ -2000,12 +2005,14 @@ static int hdspm_get_system_sample_rate(struct hdspm *hdspm)
 
 
 #define HDSPM_SYSTEM_SAMPLE_RATE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .access = SNDRV_CTL_ELEM_ACCESS_READ, \
-  .info = snd_hdspm_info_system_sample_rate, \
-  .get = snd_hdspm_get_system_sample_rate \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .access = SNDRV_CTL_ELEM_ACCESS_READWRITE |\
+                SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
+        .info = snd_hdspm_info_system_sample_rate, \
+        .put = snd_hdspm_put_system_sample_rate, \
+        .get = snd_hdspm_get_system_sample_rate \
 }
 
 static int snd_hdspm_info_system_sample_rate(struct snd_kcontrol *kcontrol,
@@ -2030,6 +2037,16 @@ static int snd_hdspm_get_system_sample_rate(struct snd_kcontrol *kcontrol,
         return 0;
 }
 
+static int snd_hdspm_put_system_sample_rate(struct snd_kcontrol *kcontrol,
+                                            struct snd_ctl_elem_value *
+                                            ucontrol)
+{
+        struct hdspm *hdspm = snd_kcontrol_chip(kcontrol);
+
+        hdspm_set_dds_value(hdspm, ucontrol->value.enumerated.item[0]);
+        return 0;
+}
+
 
 /**
  * Returns the WordClock sample rate class for the given card.
@@ -2163,6 +2180,7 @@ static int snd_hdspm_get_autosync_sample_rate(struct snd_kcontrol *kcontrol,
                                 hdspm_get_s1_sample_rate(hdspm,
                                                 kcontrol->private_value-1);
                 }
+                break;
 
         case AIO:
                 switch (kcontrol->private_value) {
@@ -2183,6 +2201,7 @@ static int snd_hdspm_get_autosync_sample_rate(struct snd_kcontrol *kcontrol,
                                 hdspm_get_s1_sample_rate(hdspm,
                                                 ucontrol->id.index-1);
                 }
+                break;
 
         case AES32:
 
@@ -2204,8 +2223,23 @@ static int snd_hdspm_get_autosync_sample_rate(struct snd_kcontrol *kcontrol,
                                 hdspm_get_s1_sample_rate(hdspm,
                                                 kcontrol->private_value-1);
                         break;
+                }
+                break;
 
+        case MADI:
+        case MADIface:
+                {
+                        int rate = hdspm_external_sample_rate(hdspm);
+                        int i, selected_rate = 0;
+                        for (i = 1; i < 10; i++)
+                                if (HDSPM_bit2freq(i) == rate) {
+                                        selected_rate = i;
+                                        break;
+                                }
+                        ucontrol->value.enumerated.item[0] = selected_rate;
                 }
+                break;
+
         default:
                 break;
         }
@@ -2430,7 +2464,7 @@ static int snd_hdspm_put_clock_source(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_PREF_SYNC_REF(xname, xindex) \
-{.iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
         .name = xname, \
         .index = xindex, \
         .access = SNDRV_CTL_ELEM_ACCESS_READWRITE |\
@@ -2766,12 +2800,12 @@ static int snd_hdspm_put_pref_sync_ref(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_AUTOSYNC_REF(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .access = SNDRV_CTL_ELEM_ACCESS_READ, \
-  .info = snd_hdspm_info_autosync_ref, \
-  .get = snd_hdspm_get_autosync_ref, \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .access = SNDRV_CTL_ELEM_ACCESS_READ, \
+        .info = snd_hdspm_info_autosync_ref, \
+        .get = snd_hdspm_get_autosync_ref, \
 }
 
 static int hdspm_autosync_ref(struct hdspm *hdspm)
@@ -2855,12 +2889,12 @@ static int snd_hdspm_get_autosync_ref(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_LINE_OUT(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_line_out, \
-  .get = snd_hdspm_get_line_out, \
-  .put = snd_hdspm_put_line_out \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_line_out, \
+        .get = snd_hdspm_get_line_out, \
+        .put = snd_hdspm_put_line_out \
 }
 
 static int hdspm_line_out(struct hdspm * hdspm)
@@ -2912,12 +2946,12 @@ static int snd_hdspm_put_line_out(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_TX_64(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_tx_64, \
-  .get = snd_hdspm_get_tx_64, \
-  .put = snd_hdspm_put_tx_64 \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_tx_64, \
+        .get = snd_hdspm_get_tx_64, \
+        .put = snd_hdspm_put_tx_64 \
 }
 
 static int hdspm_tx_64(struct hdspm * hdspm)
@@ -2968,12 +3002,12 @@ static int snd_hdspm_put_tx_64(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_C_TMS(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_c_tms, \
-  .get = snd_hdspm_get_c_tms, \
-  .put = snd_hdspm_put_c_tms \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_c_tms, \
+        .get = snd_hdspm_get_c_tms, \
+        .put = snd_hdspm_put_c_tms \
 }
 
 static int hdspm_c_tms(struct hdspm * hdspm)
@@ -3024,12 +3058,12 @@ static int snd_hdspm_put_c_tms(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_SAFE_MODE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_safe_mode, \
-  .get = snd_hdspm_get_safe_mode, \
-  .put = snd_hdspm_put_safe_mode \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_safe_mode, \
+        .get = snd_hdspm_get_safe_mode, \
+        .put = snd_hdspm_put_safe_mode \
 }
 
 static int hdspm_safe_mode(struct hdspm * hdspm)
@@ -3080,12 +3114,12 @@ static int snd_hdspm_put_safe_mode(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_EMPHASIS(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_emphasis, \
-  .get = snd_hdspm_get_emphasis, \
-  .put = snd_hdspm_put_emphasis \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_emphasis, \
+        .get = snd_hdspm_get_emphasis, \
+        .put = snd_hdspm_put_emphasis \
 }
 
 static int hdspm_emphasis(struct hdspm * hdspm)
@@ -3136,12 +3170,12 @@ static int snd_hdspm_put_emphasis(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_DOLBY(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_dolby, \
-  .get = snd_hdspm_get_dolby, \
-  .put = snd_hdspm_put_dolby \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_dolby, \
+        .get = snd_hdspm_get_dolby, \
+        .put = snd_hdspm_put_dolby \
 }
 
 static int hdspm_dolby(struct hdspm * hdspm)
@@ -3192,12 +3226,12 @@ static int snd_hdspm_put_dolby(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_PROFESSIONAL(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_professional, \
-  .get = snd_hdspm_get_professional, \
-  .put = snd_hdspm_put_professional \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_professional, \
+        .get = snd_hdspm_get_professional, \
+        .put = snd_hdspm_put_professional \
 }
 
 static int hdspm_professional(struct hdspm * hdspm)
@@ -3247,12 +3281,12 @@ static int snd_hdspm_put_professional(struct snd_kcontrol *kcontrol,
 }
 
 #define HDSPM_INPUT_SELECT(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_input_select, \
-  .get = snd_hdspm_get_input_select, \
-  .put = snd_hdspm_put_input_select \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_input_select, \
+        .get = snd_hdspm_get_input_select, \
+        .put = snd_hdspm_put_input_select \
 }
 
 static int hdspm_input_select(struct hdspm * hdspm)
@@ -3319,12 +3353,12 @@ static int snd_hdspm_put_input_select(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_DS_WIRE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_ds_wire, \
-  .get = snd_hdspm_get_ds_wire, \
-  .put = snd_hdspm_put_ds_wire \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_ds_wire, \
+        .get = snd_hdspm_get_ds_wire, \
+        .put = snd_hdspm_put_ds_wire \
 }
 
 static int hdspm_ds_wire(struct hdspm * hdspm)
@@ -3391,12 +3425,12 @@ static int snd_hdspm_put_ds_wire(struct snd_kcontrol *kcontrol,
 
 
 #define HDSPM_QS_WIRE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .name = xname, \
-  .index = xindex, \
-  .info = snd_hdspm_info_qs_wire, \
-  .get = snd_hdspm_get_qs_wire, \
-  .put = snd_hdspm_put_qs_wire \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .name = xname, \
+        .index = xindex, \
+        .info = snd_hdspm_info_qs_wire, \
+        .get = snd_hdspm_get_qs_wire, \
+        .put = snd_hdspm_put_qs_wire \
 }
 
 static int hdspm_qs_wire(struct hdspm * hdspm)
@@ -3563,15 +3597,15 @@ static int snd_hdspm_put_madi_speedmode(struct snd_kcontrol *kcontrol,
 }
 
 #define HDSPM_MIXER(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
-  .name = xname, \
-  .index = xindex, \
-  .device = 0, \
-  .access = SNDRV_CTL_ELEM_ACCESS_READWRITE | \
-                 SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
-  .info = snd_hdspm_info_mixer, \
-  .get = snd_hdspm_get_mixer, \
-  .put = snd_hdspm_put_mixer \
+{       .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
+        .name = xname, \
+        .index = xindex, \
+        .device = 0, \
+        .access = SNDRV_CTL_ELEM_ACCESS_READWRITE | \
+                SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
+        .info = snd_hdspm_info_mixer, \
+        .get = snd_hdspm_get_mixer, \
+        .put = snd_hdspm_put_mixer \
 }
 
 static int snd_hdspm_info_mixer(struct snd_kcontrol *kcontrol,
@@ -3670,12 +3704,12 @@ static int snd_hdspm_put_mixer(struct snd_kcontrol *kcontrol,
 */
 
 #define HDSPM_PLAYBACK_MIXER \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-  .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_WRITE | \
-                 SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
-  .info = snd_hdspm_info_playback_mixer, \
-  .get = snd_hdspm_get_playback_mixer, \
-  .put = snd_hdspm_put_playback_mixer \
+{       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+        .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_WRITE | \
+                SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
+        .info = snd_hdspm_info_playback_mixer, \
+        .get = snd_hdspm_get_playback_mixer, \
+        .put = snd_hdspm_put_playback_mixer \
 }
 
 static int snd_hdspm_info_playback_mixer(struct snd_kcontrol *kcontrol,
@@ -3851,12 +3885,17 @@ static int hdspm_sync_in_sync_check(struct hdspm *hdspm)
                 break;
 
         case MADI:
-        case AES32:
-                status = hdspm_read(hdspm, HDSPM_statusRegister2);
+                status = hdspm_read(hdspm, HDSPM_statusRegister);
                 lock = (status & HDSPM_syncInLock) ? 1 : 0;
                 sync = (status & HDSPM_syncInSync) ? 1 : 0;
                 break;
 
+        case AES32:
+                status = hdspm_read(hdspm, HDSPM_statusRegister2);
+                lock = (status & 0x100000) ? 1 : 0;
+                sync = (status & 0x200000) ? 1 : 0;
+                break;
+
         case MADIface:
                 break;
         }
@@ -3942,6 +3981,7 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                 default:
                         val = hdspm_s1_sync_check(hdspm, ucontrol->id.index-1);
                 }
+                break;
 
         case AIO:
                 switch (kcontrol->private_value) {
@@ -3954,6 +3994,7 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                 default:
                         val = hdspm_s1_sync_check(hdspm, ucontrol->id.index-1);
                 }
+                break;
 
         case MADI:
                 switch (kcontrol->private_value) {
@@ -3966,6 +4007,7 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                 case 3: /* SYNC_IN */
                         val = hdspm_sync_in_sync_check(hdspm); break;
                 }
+                break;
 
         case MADIface:
                 val = hdspm_madi_sync_check(hdspm); /* MADI */
@@ -3983,6 +4025,7 @@ static int snd_hdspm_get_sync_check(struct snd_kcontrol *kcontrol,
                          val = hdspm_aes_sync_check(hdspm,
                                          kcontrol->private_value-1);
                 }
+                break;
 
         }
 
@@ -4427,9 +4470,10 @@ static struct snd_kcontrol_new snd_hdspm_controls_madi[] = {
         HDSPM_PREF_SYNC_REF("Preferred Sync Reference", 0),
         HDSPM_AUTOSYNC_REF("AutoSync Reference", 0),
         HDSPM_SYSTEM_SAMPLE_RATE("System Sample Rate", 0),
+        HDSPM_AUTOSYNC_SAMPLE_RATE("External Rate", 0),
         HDSPM_SYNC_CHECK("WC SyncCheck", 0),
         HDSPM_SYNC_CHECK("MADI SyncCheck", 1),
-        HDSPM_SYNC_CHECK("TCO SyncCHeck", 2),
+        HDSPM_SYNC_CHECK("TCO SyncCheck", 2),
         HDSPM_SYNC_CHECK("SYNC IN SyncCheck", 3),
         HDSPM_LINE_OUT("Line Out", 0),
         HDSPM_TX_64("TX 64 channels mode", 0),
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 2b2dadc54dac..3fddc7ad1127 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -1045,6 +1045,7 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
                       struct snd_kcontrol *kcontrol, int event)
 {
         struct snd_soc_codec *codec = w->codec;
+        struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
         struct wm8994 *control = codec->control_data;
         int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA;
         int i;
@@ -1063,6 +1064,10 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
 
         switch (event) {
         case SND_SOC_DAPM_PRE_PMU:
+                /* Don't enable timeslot 2 if not in use */
+                if (wm8994->channels[0] <= 2)
+                        mask &= ~(WM8994_AIF1DAC2L_ENA | WM8994_AIF1DAC2R_ENA);
+
                 val = snd_soc_read(codec, WM8994_AIF1_CONTROL_1);
                 if ((val & WM8994_AIF1ADCL_SRC) &&
                     (val & WM8994_AIF1ADCR_SRC))
@@ -2687,7 +2692,7 @@ static int wm8994_hw_params(struct snd_pcm_substream *substream,
                 return -EINVAL;
         }
 
-        bclk_rate = params_rate(params) * 4;
+        bclk_rate = params_rate(params);
         switch (params_format(params)) {
         case SNDRV_PCM_FORMAT_S16_LE:
                 bclk_rate *= 16;
@@ -2708,6 +2713,17 @@ static int wm8994_hw_params(struct snd_pcm_substream *substream,
                 return -EINVAL;
         }
 
+        wm8994->channels[id] = params_channels(params);
+        switch (params_channels(params)) {
+        case 1:
+        case 2:
+                bclk_rate *= 2;
+                break;
+        default:
+                bclk_rate *= 4;
+                break;
+        }
+
         /* Try to find an appropriate sample rate; look for an exact match. */
         for (i = 0; i < ARRAY_SIZE(srs); i++)
                 if (srs[i].rate == params_rate(params))
diff --git a/sound/soc/codecs/wm8994.h b/sound/soc/codecs/wm8994.h
index f142ec198db3..ccbce5791e95 100644
--- a/sound/soc/codecs/wm8994.h
+++ b/sound/soc/codecs/wm8994.h
@@ -77,6 +77,7 @@ struct wm8994_priv {
         int sysclk_rate[2];
         int mclk[2];
         int aifclk[2];
+        int channels[2];
         struct wm8994_fll_config fll[2], fll_suspend[2];
         struct completion fll_locked[2];
         bool fll_locked_irq;
diff --git a/sound/soc/ux500/mop500.c b/sound/soc/ux500/mop500.c
index 356611d9654d..54f7e25b6f7d 100644
--- a/sound/soc/ux500/mop500.c
+++ b/sound/soc/ux500/mop500.c
@@ -57,6 +57,20 @@ static struct snd_soc_card mop500_card = {
         .num_links = ARRAY_SIZE(mop500_dai_links),
 };
 
+static void mop500_of_node_put(void)
+{
+        int i;
+
+        for (i = 0; i < 2; i++) {
+                if (mop500_dai_links[i].cpu_of_node)
+                        of_node_put((struct device_node *)
+                                mop500_dai_links[i].cpu_of_node);
+                if (mop500_dai_links[i].codec_of_node)
+                        of_node_put((struct device_node *)
+                                mop500_dai_links[i].codec_of_node);
+        }
+}
+
 static int __devinit mop500_of_probe(struct platform_device *pdev,
                                 struct device_node *np)
 {
@@ -69,6 +83,7 @@ static int __devinit mop500_of_probe(struct platform_device *pdev,
 
         if (!(msp_np[0] && msp_np[1] && codec_np)) {
                 dev_err(&pdev->dev, "Phandle missing or invalid\n");
+                mop500_of_node_put();
                 return -EINVAL;
         }
 
@@ -83,6 +98,7 @@ static int __devinit mop500_of_probe(struct platform_device *pdev,
 
         return 0;
 }
+
 static int __devinit mop500_probe(struct platform_device *pdev)
 {
         struct device_node *np = pdev->dev.of_node;
@@ -128,6 +144,7 @@ static int __devexit mop500_remove(struct platform_device *pdev)
 
         snd_soc_unregister_card(mop500_card);
         mop500_ab8500_remove(mop500_card);
+        mop500_of_node_put();
 
         return 0;
 }
diff --git a/sound/soc/ux500/ux500_msp_i2s.c b/sound/soc/ux500/ux500_msp_i2s.c
index b7c996e77570..a26c6bf0a29b 100644
--- a/sound/soc/ux500/ux500_msp_i2s.c
+++ b/sound/soc/ux500/ux500_msp_i2s.c
@@ -18,6 +18,7 @@
 #include <linux/pinctrl/consumer.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
+#include <linux/io.h>
 #include <linux/of.h>
 
 #include <mach/hardware.h>
@@ -697,14 +698,11 @@ int ux500_msp_i2s_init_msp(struct platform_device *pdev,
                         platform_data = devm_kzalloc(&pdev->dev,
                                 sizeof(struct msp_i2s_platform_data), GFP_KERNEL);
                         if (!platform_data)
-                                ret = -ENOMEM;
+                                return -ENOMEM;
                 }
         } else
                 if (!platform_data)
-                        ret = -EINVAL;
-
-        if (ret)
-                goto err_res;
+                        return -EINVAL;
 
         dev_dbg(&pdev->dev, "%s: Enter (name: %s, id: %d).\n", __func__,
                 pdev->name, platform_data->id);
diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c
index 411ee5664e98..178b88ae3d2f 100644
--- a/tools/perf/builtin-help.c
+++ b/tools/perf/builtin-help.c
@@ -414,7 +414,7 @@ static int show_html_page(const char *perf_cmd)
 int cmd_help(int argc, const char **argv, const char *prefix __maybe_unused)
 {
         bool show_all = false;
-        enum help_format help_format = HELP_FORMAT_NONE;
+        enum help_format help_format = HELP_FORMAT_MAN;
         struct option builtin_help_options[] = {
         OPT_BOOLEAN('a', "all", &show_all, "print all available commands"),
         OPT_SET_UINT('m', "man", &help_format, "show man page", HELP_FORMAT_MAN),
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index dec8ced61fb0..7aaee39f6774 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -56,6 +56,10 @@ static int trace__read_syscall_info(struct trace *trace, int id)
 {
         char tp_name[128];
         struct syscall *sc;
+        const char *name = audit_syscall_to_name(id, trace->audit_machine);
+
+        if (name == NULL)
+                return -1;
 
         if (id > trace->syscalls.max) {
                 struct syscall *nsyscalls = realloc(trace->syscalls.table, (id + 1) * sizeof(*sc));
@@ -75,11 +79,8 @@ static int trace__read_syscall_info(struct trace *trace, int id)
         }
 
         sc = trace->syscalls.table + id;
-        sc->name = audit_syscall_to_name(id, trace->audit_machine);
-        if (sc->name == NULL)
-                return -1;
-
-        sc->fmt = syscall_fmt__find(sc->name);
+        sc->name = name;
+        sc->fmt  = syscall_fmt__find(sc->name);
 
         snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name);
         sc->tp_format = event_format__new("syscalls", tp_name);
@@ -267,6 +268,13 @@ again:
                         if (evlist->threads->map[0] == -1 || evlist->threads->nr > 1)
                                 printf("%d ", sample.tid);
 
+                        if (sample.raw_data == NULL) {
+                                printf("%s sample with no payload for tid: %d, cpu %d, raw_size=%d, skipping...\n",
+                                       perf_evsel__name(evsel), sample.tid,
+                                       sample.cpu, sample.raw_size);
+                                continue;
+                        }
+
                         handler = evsel->handler.func;
                         handler(trace, evsel, &sample);
                 }
diff --git a/tools/perf/util/parse-events-test.c b/tools/perf/util/parse-events-test.c
index 28c18d1d52c3..516ecd9ddd6e 100644
--- a/tools/perf/util/parse-events-test.c
+++ b/tools/perf/util/parse-events-test.c
@@ -513,7 +513,8 @@ static int test__group1(struct perf_evlist *evlist)
         TEST_ASSERT_VAL("wrong exclude_user", !evsel->attr.exclude_user);
         TEST_ASSERT_VAL("wrong exclude_kernel", evsel->attr.exclude_kernel);
         TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
-        TEST_ASSERT_VAL("wrong exclude guest", !evsel->attr.exclude_guest);
+        /* use of precise requires exclude_guest */
+        TEST_ASSERT_VAL("wrong exclude guest", evsel->attr.exclude_guest);
         TEST_ASSERT_VAL("wrong exclude host", !evsel->attr.exclude_host);
         TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip == 2);
         TEST_ASSERT_VAL("wrong leader", evsel->leader == leader);
@@ -599,7 +600,8 @@ static int test__group3(struct perf_evlist *evlist __maybe_unused)
         TEST_ASSERT_VAL("wrong exclude_user", evsel->attr.exclude_user);
         TEST_ASSERT_VAL("wrong exclude_kernel", !evsel->attr.exclude_kernel);
         TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
-        TEST_ASSERT_VAL("wrong exclude guest", !evsel->attr.exclude_guest);
+        /* use of precise requires exclude_guest */
+        TEST_ASSERT_VAL("wrong exclude guest", evsel->attr.exclude_guest);
         TEST_ASSERT_VAL("wrong exclude host", !evsel->attr.exclude_host);
         TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip == 3);
         TEST_ASSERT_VAL("wrong leader", evsel->leader == leader);
@@ -662,7 +664,8 @@ static int test__group4(struct perf_evlist *evlist __maybe_unused)
         TEST_ASSERT_VAL("wrong exclude_user", !evsel->attr.exclude_user);
         TEST_ASSERT_VAL("wrong exclude_kernel", evsel->attr.exclude_kernel);
         TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
-        TEST_ASSERT_VAL("wrong exclude guest", !evsel->attr.exclude_guest);
+        /* use of precise requires exclude_guest */
+        TEST_ASSERT_VAL("wrong exclude guest", evsel->attr.exclude_guest);
         TEST_ASSERT_VAL("wrong exclude host", !evsel->attr.exclude_host);
         TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip == 1);
         TEST_ASSERT_VAL("wrong group name", !evsel->group_name);
@@ -676,7 +679,8 @@ static int test__group4(struct perf_evlist *evlist __maybe_unused)
         TEST_ASSERT_VAL("wrong exclude_user", evsel->attr.exclude_user);
         TEST_ASSERT_VAL("wrong exclude_kernel", !evsel->attr.exclude_kernel);
         TEST_ASSERT_VAL("wrong exclude_hv", evsel->attr.exclude_hv);
-        TEST_ASSERT_VAL("wrong exclude guest", !evsel->attr.exclude_guest);
+        /* use of precise requires exclude_guest */
+        TEST_ASSERT_VAL("wrong exclude guest", evsel->attr.exclude_guest);
         TEST_ASSERT_VAL("wrong exclude host", !evsel->attr.exclude_host);
         TEST_ASSERT_VAL("wrong precise_ip", evsel->attr.precise_ip == 2);
         TEST_ASSERT_VAL("wrong leader", evsel->leader == leader);
diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index fb4b7ea6752f..8b3e5939afb6 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -39,7 +39,6 @@ int thread__set_comm(struct thread *self, const char *comm)
         err = self->comm == NULL ? -ENOMEM : 0;
         if (!err) {
                 self->comm_set = true;
-                map_groups__flush(&self->mg);
         }
         return err;
 }
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index b51d787176d3..c7ba7614061b 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -1740,8 +1740,10 @@ sub install {
     open(IN, "$output_config") or dodie("Can't read config file");
     while (<IN>) {
         if (/CONFIG_MODULES(=y)?/) {
-            $install_mods = 1 if (defined($1));
-            last;
+            if (defined($1)) {
+                $install_mods = 1;
+                last;
+            }
         }
     }
     close(IN);
diff --git a/tools/testing/selftests/epoll/test_epoll.c b/tools/testing/selftests/epoll/test_epoll.c
index e0fcff1e8331..f7525392ce84 100644
--- a/tools/testing/selftests/epoll/test_epoll.c
+++ b/tools/testing/selftests/epoll/test_epoll.c
@@ -162,14 +162,14 @@ void *write_thread_function(void *function_data)
         int index;
         struct write_thread_data *thread_data =
                 (struct write_thread_data *)function_data;
-        while (!write_thread_data->stop)
+        while (!thread_data->stop)
                 for (index = 0;
                      !thread_data->stop && (index < thread_data->n_fds);
                      ++index)
                         if ((write(thread_data->fds[index], &data, 1) < 1) &&
                                 (errno != EAGAIN) &&
                                 (errno != EWOULDBLOCK)) {
-                                write_thread_data->status = errno;
+                                thread_data->status = errno;
                                 return;
                         }
 }
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index cd1b03e80899..b76edf2f8333 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -35,7 +35,7 @@
 #include <sys/mount.h>
 #include <sys/statfs.h>
 #include "../../include/uapi/linux/magic.h"
-#include "../../include/linux/kernel-page-flags.h"
+#include "../../include/uapi/linux/kernel-page-flags.h"
 
 
 #ifndef MAX_PATH
diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
index af0f22fb1ef7..aca6edcbbc6f 100644
--- a/usr/gen_init_cpio.c
+++ b/usr/gen_init_cpio.c
@@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location,
         int retval;
         int rc = -1;
         int namesize;
-        int i;
+        unsigned int i;
 
         mode |= S_IFREG;
 
@@ -381,25 +381,28 @@ error:
 
 static char *cpio_replace_env(char *new_location)
 {
-       char expanded[PATH_MAX + 1];
-       char env_var[PATH_MAX + 1];
-       char *start;
-       char *end;
-
-       for (start = NULL; (start = strstr(new_location, "${")); ) {
-               end = strchr(start, '}');
-               if (start < end) {
-                       *env_var = *expanded = '\0';
-                       strncat(env_var, start + 2, end - start - 2);
-                       strncat(expanded, new_location, start - new_location);
-                       strncat(expanded, getenv(env_var), PATH_MAX);
-                       strncat(expanded, end + 1, PATH_MAX);
-                       strncpy(new_location, expanded, PATH_MAX);
-               } else
-                       break;
-       }
-
-       return new_location;
+        char expanded[PATH_MAX + 1];
+        char env_var[PATH_MAX + 1];
+        char *start;
+        char *end;
+
+        for (start = NULL; (start = strstr(new_location, "${")); ) {
+                end = strchr(start, '}');
+                if (start < end) {
+                        *env_var = *expanded = '\0';
+                        strncat(env_var, start + 2, end - start - 2);
+                        strncat(expanded, new_location, start - new_location);
+                        strncat(expanded, getenv(env_var),
+                                PATH_MAX - strlen(expanded));
+                        strncat(expanded, end + 1,
+                                PATH_MAX - strlen(expanded));
+                        strncpy(new_location, expanded, PATH_MAX);
+                        new_location[PATH_MAX] = 0;
+                } else
+                        break;
+        }
+
+        return new_location;
 }
 
 
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index e59bb63cb089..be70035fd42a 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1322,9 +1322,7 @@ EXPORT_SYMBOL_GPL(kvm_release_page_clean);
 
 void kvm_release_pfn_clean(pfn_t pfn)
 {
-        WARN_ON(is_error_pfn(pfn));
-
-        if (!kvm_is_mmio_pfn(pfn))
+        if (!is_error_pfn(pfn) && !kvm_is_mmio_pfn(pfn))
                 put_page(pfn_to_page(pfn));
 }
 EXPORT_SYMBOL_GPL(kvm_release_pfn_clean);