608 files changed, 7357 insertions, 4792 deletions

diff --git a/Documentation/DocBook/media-entities.tmpl b/Documentation/DocBook/media-entities.tmpl
index 5d259c632cdf..fea63b45471a 100644
--- a/Documentation/DocBook/media-entities.tmpl
+++ b/Documentation/DocBook/media-entities.tmpl
@@ -294,6 +294,7 @@
 <!ENTITY sub-srggb10 SYSTEM "v4l/pixfmt-srggb10.xml">
 <!ENTITY sub-srggb8 SYSTEM "v4l/pixfmt-srggb8.xml">
 <!ENTITY sub-y10 SYSTEM "v4l/pixfmt-y10.xml">
+<!ENTITY sub-y12 SYSTEM "v4l/pixfmt-y12.xml">
 <!ENTITY sub-pixfmt SYSTEM "v4l/pixfmt.xml">
 <!ENTITY sub-cropcap SYSTEM "v4l/vidioc-cropcap.xml">
 <!ENTITY sub-dbg-g-register SYSTEM "v4l/vidioc-dbg-g-register.xml">
diff --git a/Documentation/DocBook/v4l/media-ioc-setup-link.xml b/Documentation/DocBook/v4l/media-ioc-setup-link.xml
index 2331e76ded17..cec97af4dab4 100644
--- a/Documentation/DocBook/v4l/media-ioc-setup-link.xml
+++ b/Documentation/DocBook/v4l/media-ioc-setup-link.xml
@@ -34,7 +34,7 @@
       <varlistentry>
         <term><parameter>request</parameter></term>
         <listitem>
-          <para>MEDIA_IOC_ENUM_LINKS</para>
+          <para>MEDIA_IOC_SETUP_LINK</para>
         </listitem>
       </varlistentry>
       <varlistentry>
diff --git a/Documentation/DocBook/v4l/pixfmt-y12.xml b/Documentation/DocBook/v4l/pixfmt-y12.xml
new file mode 100644
index 000000000000..ff417b858cc9
--- /dev/null
+++ b/Documentation/DocBook/v4l/pixfmt-y12.xml
@@ -0,0 +1,79 @@
+<refentry id="V4L2-PIX-FMT-Y12">
+  <refmeta>
+    <refentrytitle>V4L2_PIX_FMT_Y12 ('Y12 ')</refentrytitle>
+    &manvol;
+  </refmeta>
+  <refnamediv>
+    <refname><constant>V4L2_PIX_FMT_Y12</constant></refname>
+    <refpurpose>Grey-scale image</refpurpose>
+  </refnamediv>
+  <refsect1>
+    <title>Description</title>
+
+    <para>This is a grey-scale image with a depth of 12 bits per pixel. Pixels
+are stored in 16-bit words with unused high bits padded with 0. The least
+significant byte is stored at lower memory addresses (little-endian).</para>
+
+    <example>
+      <title><constant>V4L2_PIX_FMT_Y12</constant> 4 &times; 4
+pixel image</title>
+
+      <formalpara>
+        <title>Byte Order.</title>
+        <para>Each cell is one byte.
+          <informaltable frame="none">
+            <tgroup cols="9" align="center">
+              <colspec align="left" colwidth="2*" />
+              <tbody valign="top">
+                <row>
+                  <entry>start&nbsp;+&nbsp;0:</entry>
+                  <entry>Y'<subscript>00low</subscript></entry>
+                  <entry>Y'<subscript>00high</subscript></entry>
+                  <entry>Y'<subscript>01low</subscript></entry>
+                  <entry>Y'<subscript>01high</subscript></entry>
+                  <entry>Y'<subscript>02low</subscript></entry>
+                  <entry>Y'<subscript>02high</subscript></entry>
+                  <entry>Y'<subscript>03low</subscript></entry>
+                  <entry>Y'<subscript>03high</subscript></entry>
+                </row>
+                <row>
+                  <entry>start&nbsp;+&nbsp;8:</entry>
+                  <entry>Y'<subscript>10low</subscript></entry>
+                  <entry>Y'<subscript>10high</subscript></entry>
+                  <entry>Y'<subscript>11low</subscript></entry>
+                  <entry>Y'<subscript>11high</subscript></entry>
+                  <entry>Y'<subscript>12low</subscript></entry>
+                  <entry>Y'<subscript>12high</subscript></entry>
+                  <entry>Y'<subscript>13low</subscript></entry>
+                  <entry>Y'<subscript>13high</subscript></entry>
+                </row>
+                <row>
+                  <entry>start&nbsp;+&nbsp;16:</entry>
+                  <entry>Y'<subscript>20low</subscript></entry>
+                  <entry>Y'<subscript>20high</subscript></entry>
+                  <entry>Y'<subscript>21low</subscript></entry>
+                  <entry>Y'<subscript>21high</subscript></entry>
+                  <entry>Y'<subscript>22low</subscript></entry>
+                  <entry>Y'<subscript>22high</subscript></entry>
+                  <entry>Y'<subscript>23low</subscript></entry>
+                  <entry>Y'<subscript>23high</subscript></entry>
+                </row>
+                <row>
+                  <entry>start&nbsp;+&nbsp;24:</entry>
+                  <entry>Y'<subscript>30low</subscript></entry>
+                  <entry>Y'<subscript>30high</subscript></entry>
+                  <entry>Y'<subscript>31low</subscript></entry>
+                  <entry>Y'<subscript>31high</subscript></entry>
+                  <entry>Y'<subscript>32low</subscript></entry>
+                  <entry>Y'<subscript>32high</subscript></entry>
+                  <entry>Y'<subscript>33low</subscript></entry>
+                  <entry>Y'<subscript>33high</subscript></entry>
+                </row>
+              </tbody>
+            </tgroup>
+          </informaltable>
+        </para>
+      </formalpara>
+    </example>
+  </refsect1>
+</refentry>
diff --git a/Documentation/DocBook/v4l/pixfmt.xml b/Documentation/DocBook/v4l/pixfmt.xml
index c6fdcbbd1b41..40af4beb48b9 100644
--- a/Documentation/DocBook/v4l/pixfmt.xml
+++ b/Documentation/DocBook/v4l/pixfmt.xml
@@ -696,6 +696,7 @@ information.</para>
     &sub-packed-yuv;
     &sub-grey;
     &sub-y10;
+    &sub-y12;
     &sub-y16;
     &sub-yuyv;
     &sub-uyvy;
diff --git a/Documentation/DocBook/v4l/subdev-formats.xml b/Documentation/DocBook/v4l/subdev-formats.xml
index 7041127d6dfc..d7ccd25edcc1 100644
--- a/Documentation/DocBook/v4l/subdev-formats.xml
+++ b/Documentation/DocBook/v4l/subdev-formats.xml
@@ -456,6 +456,23 @@
               <entry>b<subscript>1</subscript></entry>
               <entry>b<subscript>0</subscript></entry>
             </row>
+            <row id="V4L2-MBUS-FMT-SGBRG8-1X8">
+              <entry>V4L2_MBUS_FMT_SGBRG8_1X8</entry>
+              <entry>0x3013</entry>
+              <entry></entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>g<subscript>7</subscript></entry>
+              <entry>g<subscript>6</subscript></entry>
+              <entry>g<subscript>5</subscript></entry>
+              <entry>g<subscript>4</subscript></entry>
+              <entry>g<subscript>3</subscript></entry>
+              <entry>g<subscript>2</subscript></entry>
+              <entry>g<subscript>1</subscript></entry>
+              <entry>g<subscript>0</subscript></entry>
+            </row>
             <row id="V4L2-MBUS-FMT-SGRBG8-1X8">
               <entry>V4L2_MBUS_FMT_SGRBG8_1X8</entry>
               <entry>0x3002</entry>
@@ -473,6 +490,23 @@
               <entry>g<subscript>1</subscript></entry>
               <entry>g<subscript>0</subscript></entry>
             </row>
+            <row id="V4L2-MBUS-FMT-SRGGB8-1X8">
+              <entry>V4L2_MBUS_FMT_SRGGB8_1X8</entry>
+              <entry>0x3014</entry>
+              <entry></entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>r<subscript>7</subscript></entry>
+              <entry>r<subscript>6</subscript></entry>
+              <entry>r<subscript>5</subscript></entry>
+              <entry>r<subscript>4</subscript></entry>
+              <entry>r<subscript>3</subscript></entry>
+              <entry>r<subscript>2</subscript></entry>
+              <entry>r<subscript>1</subscript></entry>
+              <entry>r<subscript>0</subscript></entry>
+            </row>
             <row id="V4L2-MBUS-FMT-SBGGR10-DPCM8-1X8">
               <entry>V4L2_MBUS_FMT_SBGGR10_DPCM8_1X8</entry>
               <entry>0x300b</entry>
@@ -2159,6 +2193,31 @@
               <entry>u<subscript>1</subscript></entry>
               <entry>u<subscript>0</subscript></entry>
             </row>
+            <row id="V4L2-MBUS-FMT-Y12-1X12">
+              <entry>V4L2_MBUS_FMT_Y12_1X12</entry>
+              <entry>0x2013</entry>
+              <entry></entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>y<subscript>11</subscript></entry>
+              <entry>y<subscript>10</subscript></entry>
+              <entry>y<subscript>9</subscript></entry>
+              <entry>y<subscript>8</subscript></entry>
+              <entry>y<subscript>7</subscript></entry>
+              <entry>y<subscript>6</subscript></entry>
+              <entry>y<subscript>5</subscript></entry>
+              <entry>y<subscript>4</subscript></entry>
+              <entry>y<subscript>3</subscript></entry>
+              <entry>y<subscript>2</subscript></entry>
+              <entry>y<subscript>1</subscript></entry>
+              <entry>y<subscript>0</subscript></entry>
+            </row>
             <row id="V4L2-MBUS-FMT-UYVY8-1X16">
               <entry>V4L2_MBUS_FMT_UYVY8_1X16</entry>
               <entry>0x200f</entry>
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index b6ed61c95856..7c163477fcd8 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -52,8 +52,10 @@ Brief summary of control files.
  tasks                           # attach a task(thread) and show list of threads
  cgroup.procs                    # show list of processes
  cgroup.event_control            # an interface for event_fd()
- memory.usage_in_bytes           # show current memory(RSS+Cache) usage.
- memory.memsw.usage_in_bytes     # show current memory+Swap usage
+ memory.usage_in_bytes           # show current res_counter usage for memory
+                                 (See 5.5 for details)
+ memory.memsw.usage_in_bytes     # show current res_counter usage for memory+Swap
+                                 (See 5.5 for details)
  memory.limit_in_bytes           # set/show limit of memory usage
  memory.memsw.limit_in_bytes     # set/show limit of memory+Swap usage
  memory.failcnt                  # show the number of memory usage hits limits
@@ -453,6 +455,15 @@ memory under it will be reclaimed.
 You can reset failcnt by writing 0 to failcnt file.
 # echo 0 > .../memory.failcnt
 
+5.5 usage_in_bytes
+
+For efficiency, as other kernel components, memory cgroup uses some optimization
+to avoid unnecessary cacheline false sharing. usage_in_bytes is affected by the
+method and doesn't show 'exact' value of memory(and swap) usage, it's an fuzz
+value for efficient access. (Of course, when necessary, it's synchronized.)
+If you want to know more exact memory usage, you should use RSS+CACHE(+SWAP)
+value in memory.stat(see 5.2).
+
 6. Hierarchy support
 
 The memory controller supports a deep hierarchy and hierarchical accounting.
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 274b32d12532..492e81df2968 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -387,26 +387,6 @@ Who:	Tejun Heo <tj@kernel.org>
 
 ----------------------------
 
-What:   Support for lcd_switch and display_get in asus-laptop driver
-When:   March 2010
-Why:    These two features use non-standard interfaces. There are the
-        only features that really need multiple path to guess what's
-        the right method name on a specific laptop.
-
-        Removing them will allow to remove a lot of code an significantly
-        clean the drivers.
-
-        This will affect the backlight code which won't be able to know
-        if the backlight is on or off. The platform display file will also be
-        write only (like the one in eeepc-laptop).
-
-        This should'nt affect a lot of user because they usually know
-        when their display is on or off.
-
-Who:    Corentin Chary <corentin.chary@gmail.com>
-
-----------------------------
-
 What:   sysfs-class-rfkill state file
 When:   Feb 2014
 Files:  net/rfkill/core.c
diff --git a/Documentation/hwmon/adm1021 b/Documentation/hwmon/adm1021
index 03d02bfb3df1..02ad96cf9b2b 100644
--- a/Documentation/hwmon/adm1021
+++ b/Documentation/hwmon/adm1021
@@ -14,10 +14,6 @@ Supported chips:
     Prefix: 'gl523sm'
     Addresses scanned: I2C 0x18 - 0x1a, 0x29 - 0x2b, 0x4c - 0x4e
     Datasheet:
-  * Intel Xeon Processor
-    Prefix: - any other - may require 'force_adm1021' parameter
-    Addresses scanned: none
-    Datasheet: Publicly available at Intel website
   * Maxim MAX1617
     Prefix: 'max1617'
     Addresses scanned: I2C 0x18 - 0x1a, 0x29 - 0x2b, 0x4c - 0x4e
@@ -91,21 +87,27 @@ will do no harm, but will return 'old' values. It is possible to make
 ADM1021-clones do faster measurements, but there is really no good reason
 for that.
 
-Xeon support
-------------
 
-Some Xeon processors have real max1617, adm1021, or compatible chips
-within them, with two temperature sensors.
+Netburst-based Xeon support
+---------------------------
 
-Other Xeons have chips with only one sensor.
+Some Xeon processors based on the Netburst (early Pentium 4, from 2001 to
+2003) microarchitecture had real MAX1617, ADM1021, or compatible chips
+within them, with two temperature sensors. Other Xeon processors of this
+era (with 400 MHz FSB) had chips with only one temperature sensor.
 
-If you have a Xeon, and the adm1021 module loads, and both temperatures
-appear valid, then things are good.
+If you have such an old Xeon, and you get two valid temperatures when
+loading the adm1021 module, then things are good.
 
-If the adm1021 module doesn't load, you should try this:
-        modprobe adm1021 force_adm1021=BUS,ADDRESS
-        ADDRESS can only be 0x18, 0x1a, 0x29, 0x2b, 0x4c, or 0x4e.
+If nothing happens when loading the adm1021 module, and you are certain
+that your specific Xeon processor model includes compatible sensors, you
+will have to explicitly instantiate the sensor chips from user-space. See
+method 4 in Documentation/i2c/instantiating-devices. Possible slave
+addresses are 0x18, 0x1a, 0x29, 0x2b, 0x4c, or 0x4e. It is likely that
+only temp2 will be correct and temp1 will have to be ignored.
 
-If you have dual Xeons you may have appear to have two separate
-adm1021-compatible chips, or two single-temperature sensors, at distinct
-addresses.
+Previous generations of the Xeon processor (based on Pentium II/III)
+didn't have these sensors. Next generations of Xeon processors (533 MHz
+FSB and faster) lost them, until the Core-based generation which
+introduced integrated digital thermal sensors. These are supported by
+the coretemp driver.
diff --git a/Documentation/hwmon/lm90 b/Documentation/hwmon/lm90
index fa475c0a48a3..f3efd18e87f4 100644
--- a/Documentation/hwmon/lm90
+++ b/Documentation/hwmon/lm90
@@ -32,6 +32,16 @@ Supported chips:
     Addresses scanned: I2C 0x4c and 0x4d
     Datasheet: Publicly available at the ON Semiconductor website
                http://www.onsemi.com/PowerSolutions/product.do?id=ADT7461
+  * Analog Devices ADT7461A
+    Prefix: 'adt7461a'
+    Addresses scanned: I2C 0x4c and 0x4d
+    Datasheet: Publicly available at the ON Semiconductor website
+               http://www.onsemi.com/PowerSolutions/product.do?id=ADT7461A
+  * ON Semiconductor NCT1008
+    Prefix: 'nct1008'
+    Addresses scanned: I2C 0x4c and 0x4d
+    Datasheet: Publicly available at the ON Semiconductor website
+               http://www.onsemi.com/PowerSolutions/product.do?id=NCT1008
   * Maxim MAX6646
     Prefix: 'max6646'
     Addresses scanned: I2C 0x4d
@@ -149,7 +159,7 @@ ADM1032:
   * ALERT is triggered by open remote sensor.
   * SMBus PEC support for Write Byte and Receive Byte transactions.
 
-ADT7461:
+ADT7461, ADT7461A, NCT1008:
   * Extended temperature range (breaks compatibility)
   * Lower resolution for remote temperature
 
@@ -195,9 +205,9 @@ are exported, one for each channel, but these values are of course linked.
 Only the local hysteresis can be set from user-space, and the same delta
 applies to the remote hysteresis.
 
-The lm90 driver will not update its values more frequently than every
-other second; reading them more often will do no harm, but will return
-'old' values.
+The lm90 driver will not update its values more frequently than configured with
+the update_interval attribute; reading them more often will do no harm, but will
+return 'old' values.
 
 SMBus Alert Support
 -------------------
@@ -205,11 +215,12 @@ SMBus Alert Support
 This driver has basic support for SMBus alert. When an alert is received,
 the status register is read and the faulty temperature channel is logged.
 
-The Analog Devices chips (ADM1032 and ADT7461) do not implement the SMBus
-alert protocol properly so additional care is needed: the ALERT output is
-disabled when an alert is received, and is re-enabled only when the alarm
-is gone. Otherwise the chip would block alerts from other chips in the bus
-as long as the alarm is active.
+The Analog Devices chips (ADM1032, ADT7461 and ADT7461A) and ON
+Semiconductor chips (NCT1008) do not implement the SMBus alert protocol
+properly so additional care is needed: the ALERT output is disabled when
+an alert is received, and is re-enabled only when the alarm is gone.
+Otherwise the chip would block alerts from other chips in the bus as long
+as the alarm is active.
 
 PEC Support
 -----------
diff --git a/Documentation/hwmon/max16064 b/Documentation/hwmon/max16064
new file mode 100644
index 000000000000..41728999e142
--- /dev/null
+++ b/Documentation/hwmon/max16064
@@ -0,0 +1,62 @@
+Kernel driver max16064
+======================
+
+Supported chips:
+  * Maxim MAX16064
+    Prefix: 'max16064'
+    Addresses scanned: -
+    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX16064.pdf
+
+Author: Guenter Roeck <guenter.roeck@ericsson.com>
+
+
+Description
+-----------
+
+This driver supports hardware montoring for Maxim MAX16064 Quad Power-Supply
+Controller with Active-Voltage Output Control and PMBus Interface.
+
+The driver is a client driver to the core PMBus driver.
+Please see Documentation/hwmon/pmbus for details on PMBus client drivers.
+
+
+Usage Notes
+-----------
+
+This driver does not auto-detect devices. You will have to instantiate the
+devices explicitly. Please see Documentation/i2c/instantiating-devices for
+details.
+
+
+Platform data support
+---------------------
+
+The driver supports standard PMBus driver platform data.
+
+
+Sysfs entries
+-------------
+
+The following attributes are supported. Limits are read-write; all other
+attributes are read-only.
+
+in[1-4]_label           "vout[1-4]"
+in[1-4]_input           Measured voltage. From READ_VOUT register.
+in[1-4]_min             Minumum Voltage. From VOUT_UV_WARN_LIMIT register.
+in[1-4]_max             Maximum voltage. From VOUT_OV_WARN_LIMIT register.
+in[1-4]_lcrit           Critical minumum Voltage. VOUT_UV_FAULT_LIMIT register.
+in[1-4]_crit            Critical maximum voltage. From VOUT_OV_FAULT_LIMIT register.
+in[1-4]_min_alarm       Voltage low alarm. From VOLTAGE_UV_WARNING status.
+in[1-4]_max_alarm       Voltage high alarm. From VOLTAGE_OV_WARNING status.
+in[1-4]_lcrit_alarm     Voltage critical low alarm. From VOLTAGE_UV_FAULT status.
+in[1-4]_crit_alarm      Voltage critical high alarm. From VOLTAGE_OV_FAULT status.
+
+temp1_input             Measured temperature. From READ_TEMPERATURE_1 register.
+temp1_max               Maximum temperature. From OT_WARN_LIMIT register.
+temp1_crit              Critical high temperature. From OT_FAULT_LIMIT register.
+temp1_max_alarm         Chip temperature high alarm. Set by comparing
+                        READ_TEMPERATURE_1 with OT_WARN_LIMIT if TEMP_OT_WARNING
+                        status is set.
+temp1_crit_alarm        Chip temperature critical high alarm. Set by comparing
+                        READ_TEMPERATURE_1 with OT_FAULT_LIMIT if TEMP_OT_FAULT
+                        status is set.
diff --git a/Documentation/hwmon/max34440 b/Documentation/hwmon/max34440
new file mode 100644
index 000000000000..6c525dd07d59
--- /dev/null
+++ b/Documentation/hwmon/max34440
@@ -0,0 +1,79 @@
+Kernel driver max34440
+======================
+
+Supported chips:
+  * Maxim MAX34440
+    Prefixes: 'max34440'
+    Addresses scanned: -
+    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX34440.pdf
+  * Maxim MAX34441
+    PMBus 5-Channel Power-Supply Manager and Intelligent Fan Controller
+    Prefixes: 'max34441'
+    Addresses scanned: -
+    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX34441.pdf
+
+Author: Guenter Roeck <guenter.roeck@ericsson.com>
+
+
+Description
+-----------
+
+This driver supports hardware montoring for Maxim MAX34440 PMBus 6-Channel
+Power-Supply Manager and MAX34441 PMBus 5-Channel Power-Supply Manager
+and Intelligent Fan Controller.
+
+The driver is a client driver to the core PMBus driver. Please see
+Documentation/hwmon/pmbus for details on PMBus client drivers.
+
+
+Usage Notes
+-----------
+
+This driver does not auto-detect devices. You will have to instantiate the
+devices explicitly. Please see Documentation/i2c/instantiating-devices for
+details.
+
+
+Platform data support
+---------------------
+
+The driver supports standard PMBus driver platform data.
+
+
+Sysfs entries
+-------------
+
+The following attributes are supported. Limits are read-write; all other
+attributes are read-only.
+
+in[1-6]_label           "vout[1-6]".
+in[1-6]_input           Measured voltage. From READ_VOUT register.
+in[1-6]_min             Minumum Voltage. From VOUT_UV_WARN_LIMIT register.
+in[1-6]_max             Maximum voltage. From VOUT_OV_WARN_LIMIT register.
+in[1-6]_lcrit           Critical minumum Voltage. VOUT_UV_FAULT_LIMIT register.
+in[1-6]_crit            Critical maximum voltage. From VOUT_OV_FAULT_LIMIT register.
+in[1-6]_min_alarm       Voltage low alarm. From VOLTAGE_UV_WARNING status.
+in[1-6]_max_alarm       Voltage high alarm. From VOLTAGE_OV_WARNING status.
+in[1-6]_lcrit_alarm     Voltage critical low alarm. From VOLTAGE_UV_FAULT status.
+in[1-6]_crit_alarm      Voltage critical high alarm. From VOLTAGE_OV_FAULT status.
+
+curr[1-6]_label         "iout[1-6]".
+curr[1-6]_input         Measured current. From READ_IOUT register.
+curr[1-6]_max           Maximum current. From IOUT_OC_WARN_LIMIT register.
+curr[1-6]_crit          Critical maximum current. From IOUT_OC_FAULT_LIMIT register.
+curr[1-6]_max_alarm     Current high alarm. From IOUT_OC_WARNING status.
+curr[1-6]_crit_alarm    Current critical high alarm. From IOUT_OC_FAULT status.
+
+                        in6 and curr6 attributes only exist for MAX34440.
+
+temp[1-8]_input         Measured temperatures. From READ_TEMPERATURE_1 register.
+                        temp1 is the chip's internal temperature. temp2..temp5
+                        are remote I2C temperature sensors. For MAX34441, temp6
+                        is a remote thermal-diode sensor. For MAX34440, temp6..8
+                        are remote I2C temperature sensors.
+temp[1-8]_max           Maximum temperature. From OT_WARN_LIMIT register.
+temp[1-8]_crit          Critical high temperature. From OT_FAULT_LIMIT register.
+temp[1-8]_max_alarm     Temperature high alarm.
+temp[1-8]_crit_alarm    Temperature critical high alarm.
+
+                        temp7 and temp8 attributes only exist for MAX34440.
diff --git a/Documentation/hwmon/max8688 b/Documentation/hwmon/max8688
new file mode 100644
index 000000000000..0ddd3a412030
--- /dev/null
+++ b/Documentation/hwmon/max8688
@@ -0,0 +1,69 @@
+Kernel driver max8688
+=====================
+
+Supported chips:
+  * Maxim MAX8688
+    Prefix: 'max8688'
+    Addresses scanned: -
+    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX8688.pdf
+
+Author: Guenter Roeck <guenter.roeck@ericsson.com>
+
+
+Description
+-----------
+
+This driver supports hardware montoring for Maxim MAX8688 Digital Power-Supply
+Controller/Monitor with PMBus Interface.
+
+The driver is a client driver to the core PMBus driver. Please see
+Documentation/hwmon/pmbus for details on PMBus client drivers.
+
+
+Usage Notes
+-----------
+
+This driver does not auto-detect devices. You will have to instantiate the
+devices explicitly. Please see Documentation/i2c/instantiating-devices for
+details.
+
+
+Platform data support
+---------------------
+
+The driver supports standard PMBus driver platform data.
+
+
+Sysfs entries
+-------------
+
+The following attributes are supported. Limits are read-write; all other
+attributes are read-only.
+
+in1_label               "vout1"
+in1_input               Measured voltage. From READ_VOUT register.
+in1_min                 Minumum Voltage. From VOUT_UV_WARN_LIMIT register.
+in1_max                 Maximum voltage. From VOUT_OV_WARN_LIMIT register.
+in1_lcrit               Critical minumum Voltage. VOUT_UV_FAULT_LIMIT register.
+in1_crit                Critical maximum voltage. From VOUT_OV_FAULT_LIMIT register.
+in1_min_alarm           Voltage low alarm. From VOLTAGE_UV_WARNING status.
+in1_max_alarm           Voltage high alarm. From VOLTAGE_OV_WARNING status.
+in1_lcrit_alarm         Voltage critical low alarm. From VOLTAGE_UV_FAULT status.
+in1_crit_alarm          Voltage critical high alarm. From VOLTAGE_OV_FAULT status.
+
+curr1_label             "iout1"
+curr1_input             Measured current. From READ_IOUT register.
+curr1_max               Maximum current. From IOUT_OC_WARN_LIMIT register.
+curr1_crit              Critical maximum current. From IOUT_OC_FAULT_LIMIT register.
+curr1_max_alarm         Current high alarm. From IOUT_OC_WARN_LIMIT register.
+curr1_crit_alarm        Current critical high alarm. From IOUT_OC_FAULT status.
+
+temp1_input             Measured temperature. From READ_TEMPERATURE_1 register.
+temp1_max               Maximum temperature. From OT_WARN_LIMIT register.
+temp1_crit              Critical high temperature. From OT_FAULT_LIMIT register.
+temp1_max_alarm         Chip temperature high alarm. Set by comparing
+                        READ_TEMPERATURE_1 with OT_WARN_LIMIT if TEMP_OT_WARNING
+                        status is set.
+temp1_crit_alarm        Chip temperature critical high alarm. Set by comparing
+                        READ_TEMPERATURE_1 with OT_FAULT_LIMIT if TEMP_OT_FAULT
+                        status is set.
diff --git a/Documentation/hwmon/pmbus b/Documentation/hwmon/pmbus
index dc4933e96344..5e462fc7f99b 100644
--- a/Documentation/hwmon/pmbus
+++ b/Documentation/hwmon/pmbus
@@ -13,26 +13,6 @@ Supported chips:
     Prefix: 'ltc2978'
     Addresses scanned: -
     Datasheet: http://cds.linear.com/docs/Datasheet/2978fa.pdf
-  * Maxim MAX16064
-    Quad Power-Supply Controller
-    Prefix: 'max16064'
-    Addresses scanned: -
-    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX16064.pdf
-  * Maxim MAX34440
-    PMBus 6-Channel Power-Supply Manager
-    Prefixes: 'max34440'
-    Addresses scanned: -
-    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX34440.pdf
-  * Maxim MAX34441
-    PMBus 5-Channel Power-Supply Manager and Intelligent Fan Controller
-    Prefixes: 'max34441'
-    Addresses scanned: -
-    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX34441.pdf
-  * Maxim MAX8688
-    Digital Power-Supply Controller/Monitor
-    Prefix: 'max8688'
-    Addresses scanned: -
-    Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX8688.pdf
   * Generic PMBus devices
     Prefix: 'pmbus'
     Addresses scanned: -
@@ -175,11 +155,13 @@ currX_crit		Critical maximum current.
                         From IIN_OC_FAULT_LIMIT or IOUT_OC_FAULT_LIMIT register.
 currX_alarm             Current high alarm.
                         From IIN_OC_WARNING or IOUT_OC_WARNING status.
+currX_max_alarm         Current high alarm.
+                        From IIN_OC_WARN_LIMIT or IOUT_OC_WARN_LIMIT status.
 currX_lcrit_alarm       Output current critical low alarm.
                         From IOUT_UC_FAULT status.
 currX_crit_alarm        Current critical high alarm.
                         From IIN_OC_FAULT or IOUT_OC_FAULT status.
-currX_label             "iin" or "vinY"
+currX_label             "iin" or "ioutY"
 
 powerX_input            Measured power. From READ_PIN or READ_POUT register.
 powerX_cap              Output power cap. From POUT_MAX register.
@@ -193,13 +175,13 @@ powerX_crit_alarm	Output power critical high alarm.
                         From POUT_OP_FAULT status.
 powerX_label            "pin" or "poutY"
 
-tempX_input             Measured tempererature.
+tempX_input             Measured temperature.
                         From READ_TEMPERATURE_X register.
-tempX_min               Mimimum tempererature. From UT_WARN_LIMIT register.
-tempX_max               Maximum tempererature. From OT_WARN_LIMIT register.
-tempX_lcrit             Critical low tempererature.
+tempX_min               Mimimum temperature. From UT_WARN_LIMIT register.
+tempX_max               Maximum temperature. From OT_WARN_LIMIT register.
+tempX_lcrit             Critical low temperature.
                         From UT_FAULT_LIMIT register.
-tempX_crit              Critical high tempererature.
+tempX_crit              Critical high temperature.
                         From OT_FAULT_LIMIT register.
 tempX_min_alarm         Chip temperature low alarm. Set by comparing
                         READ_TEMPERATURE_X with UT_WARN_LIMIT if
diff --git a/Documentation/hwmon/smm665 b/Documentation/hwmon/smm665
index 3820fc9ca52d..59e316140542 100644
--- a/Documentation/hwmon/smm665
+++ b/Documentation/hwmon/smm665
@@ -150,8 +150,8 @@ in8_crit_alarm		Channel F critical alarm
 in9_crit_alarm          AIN1 critical alarm
 in10_crit_alarm         AIN2 critical alarm
 
-temp1_input             Chip tempererature
-temp1_min               Mimimum chip tempererature
-temp1_max               Maximum chip tempererature
-temp1_crit              Critical chip tempererature
+temp1_input             Chip temperature
+temp1_min               Mimimum chip temperature
+temp1_max               Maximum chip temperature
+temp1_crit              Critical chip temperature
 temp1_crit_alarm        Temperature critical alarm
diff --git a/Documentation/hwmon/submitting-patches b/Documentation/hwmon/submitting-patches
new file mode 100644
index 000000000000..86f42e8e9e49
--- /dev/null
+++ b/Documentation/hwmon/submitting-patches
@@ -0,0 +1,109 @@
+        How to Get Your Patch Accepted Into the Hwmon Subsystem
+        -------------------------------------------------------
+
+This text is is a collection of suggestions for people writing patches or
+drivers for the hwmon subsystem. Following these suggestions will greatly
+increase the chances of your change being accepted.
+
+
+1. General
+----------
+
+* It should be unnecessary to mention, but please read and follow
+    Documentation/SubmitChecklist
+    Documentation/SubmittingDrivers
+    Documentation/SubmittingPatches
+    Documentation/CodingStyle
+
+* If your patch generates checkpatch warnings, please refrain from explanations
+  such as "I don't like that coding style". Keep in mind that each unnecessary
+  warning helps hiding a real problem. If you don't like the kernel coding
+  style, don't write kernel drivers.
+
+* Please test your patch thoroughly. We are not your test group.
+  Sometimes a patch can not or not completely be tested because of missing
+  hardware. In such cases, you should test-build the code on at least one
+  architecture. If run-time testing was not achieved, it should be written
+  explicitly below the patch header.
+
+* If your patch (or the driver) is affected by configuration options such as
+  CONFIG_SMP or CONFIG_HOTPLUG, make sure it compiles for all configuration
+  variants.
+
+
+2. Adding functionality to existing drivers
+-------------------------------------------
+
+* Make sure the documentation in Documentation/hwmon/<driver_name> is up to
+  date.
+
+* Make sure the information in Kconfig is up to date.
+
+* If the added functionality requires some cleanup or structural changes, split
+  your patch into a cleanup part and the actual addition. This makes it easier
+  to review your changes, and to bisect any resulting problems.
+
+* Never mix bug fixes, cleanup, and functional enhancements in a single patch.
+
+
+3. New drivers
+--------------
+
+* Running your patch or driver file(s) through checkpatch does not mean its
+  formatting is clean. If unsure about formatting in your new driver, run it
+  through Lindent. Lindent is not perfect, and you may have to do some minor
+  cleanup, but it is a good start.
+
+* Consider adding yourself to MAINTAINERS.
+
+* Document the driver in Documentation/hwmon/<driver_name>.
+
+* Add the driver to Kconfig and Makefile in alphabetical order.
+
+* Make sure that all dependencies are listed in Kconfig. For new drivers, it
+  is most likely prudent to add a dependency on EXPERIMENTAL.
+
+* Avoid forward declarations if you can. Rearrange the code if necessary.
+
+* Avoid calculations in macros and macro-generated functions. While such macros
+  may save a line or so in the source, it obfuscates the code and makes code
+  review more difficult. It may also result in code which is more complicated
+  than necessary. Use inline functions or just regular functions instead.
+
+* If the driver has a detect function, make sure it is silent. Debug messages
+  and messages printed after a successful detection are acceptable, but it
+  must not print messages such as "Chip XXX not found/supported".
+
+  Keep in mind that the detect function will run for all drivers supporting an
+  address if a chip is detected on that address. Unnecessary messages will just
+  pollute the kernel log and not provide any value.
+
+* Provide a detect function if and only if a chip can be detected reliably.
+
+* Avoid writing to chip registers in the detect function. If you have to write,
+  only do it after you have already gathered enough data to be certain that the
+  detection is going to be successful.
+
+  Keep in mind that the chip might not be what your driver believes it is, and
+  writing to it might cause a bad misconfiguration.
+
+* Make sure there are no race conditions in the probe function. Specifically,
+  completely initialize your chip first, then create sysfs entries and register
+  with the hwmon subsystem.
+
+* Do not provide support for deprecated sysfs attributes.
+
+* Do not create non-standard attributes unless really needed. If you have to use
+  non-standard attributes, or you believe you do, discuss it on the mailing list
+  first. Either case, provide a detailed explanation why you need the
+  non-standard attribute(s).
+  Standard attributes are specified in Documentation/hwmon/sysfs-interface.
+
+* When deciding which sysfs attributes to support, look at the chip's
+  capabilities. While we do not expect your driver to support everything the
+  chip may offer, it should at least support all limits and alarms.
+
+* Last but not least, please check if a driver for your chip already exists
+  before starting to write a new driver. Especially for temperature sensors,
+  new chips are often variants of previously released chips. In some cases,
+  a presumably new chip may simply have been relabeled.
diff --git a/Documentation/input/event-codes.txt b/Documentation/input/event-codes.txt
new file mode 100644
index 000000000000..23fcb05175be
--- /dev/null
+++ b/Documentation/input/event-codes.txt
@@ -0,0 +1,262 @@
+The input protocol uses a map of types and codes to express input device values
+to userspace. This document describes the types and codes and how and when they
+may be used.
+
+A single hardware event generates multiple input events. Each input event
+contains the new value of a single data item. A special event type, EV_SYN, is
+used to separate input events into packets of input data changes occurring at
+the same moment in time. In the following, the term "event" refers to a single
+input event encompassing a type, code, and value.
+
+The input protocol is a stateful protocol. Events are emitted only when values
+of event codes have changed. However, the state is maintained within the Linux
+input subsystem; drivers do not need to maintain the state and may attempt to
+emit unchanged values without harm. Userspace may obtain the current state of
+event code values using the EVIOCG* ioctls defined in linux/input.h. The event
+reports supported by a device are also provided by sysfs in
+class/input/event*/device/capabilities/, and the properties of a device are
+provided in class/input/event*/device/properties.
+
+Types:
+==========
+Types are groupings of codes under a logical input construct. Each type has a
+set of applicable codes to be used in generating events. See the Codes section
+for details on valid codes for each type.
+
+* EV_SYN:
+  - Used as markers to separate events. Events may be separated in time or in
+    space, such as with the multitouch protocol.
+
+* EV_KEY:
+  - Used to describe state changes of keyboards, buttons, or other key-like
+    devices.
+
+* EV_REL:
+  - Used to describe relative axis value changes, e.g. moving the mouse 5 units
+    to the left.
+
+* EV_ABS:
+  - Used to describe absolute axis value changes, e.g. describing the
+    coordinates of a touch on a touchscreen.
+
+* EV_MSC:
+  - Used to describe miscellaneous input data that do not fit into other types.
+
+* EV_SW:
+  - Used to describe binary state input switches.
+
+* EV_LED:
+  - Used to turn LEDs on devices on and off.
+
+* EV_SND:
+  - Used to output sound to devices.
+
+* EV_REP:
+  - Used for autorepeating devices.
+
+* EV_FF:
+  - Used to send force feedback commands to an input device.
+
+* EV_PWR:
+  - A special type for power button and switch input.
+
+* EV_FF_STATUS:
+  - Used to receive force feedback device status.
+
+Codes:
+==========
+Codes define the precise type of event.
+
+EV_SYN:
+----------
+EV_SYN event values are undefined. Their usage is defined only by when they are
+sent in the evdev event stream.
+
+* SYN_REPORT:
+  - Used to synchronize and separate events into packets of input data changes
+    occurring at the same moment in time. For example, motion of a mouse may set
+    the REL_X and REL_Y values for one motion, then emit a SYN_REPORT. The next
+    motion will emit more REL_X and REL_Y values and send another SYN_REPORT.
+
+* SYN_CONFIG:
+  - TBD
+
+* SYN_MT_REPORT:
+  - Used to synchronize and separate touch events. See the
+    multi-touch-protocol.txt document for more information.
+
+* SYN_DROPPED:
+  - Used to indicate buffer overrun in the evdev client's event queue.
+    Client should ignore all events up to and including next SYN_REPORT
+    event and query the device (using EVIOCG* ioctls) to obtain its
+    current state.
+
+EV_KEY:
+----------
+EV_KEY events take the form KEY_<name> or BTN_<name>. For example, KEY_A is used
+to represent the 'A' key on a keyboard. When a key is depressed, an event with
+the key's code is emitted with value 1. When the key is released, an event is
+emitted with value 0. Some hardware send events when a key is repeated. These
+events have a value of 2. In general, KEY_<name> is used for keyboard keys, and
+BTN_<name> is used for other types of momentary switch events.
+
+A few EV_KEY codes have special meanings:
+
+* BTN_TOOL_<name>:
+  - These codes are used in conjunction with input trackpads, tablets, and
+    touchscreens. These devices may be used with fingers, pens, or other tools.
+    When an event occurs and a tool is used, the corresponding BTN_TOOL_<name>
+    code should be set to a value of 1. When the tool is no longer interacting
+    with the input device, the BTN_TOOL_<name> code should be reset to 0. All
+    trackpads, tablets, and touchscreens should use at least one BTN_TOOL_<name>
+    code when events are generated.
+
+* BTN_TOUCH:
+    BTN_TOUCH is used for touch contact. While an input tool is determined to be
+    within meaningful physical contact, the value of this property must be set
+    to 1. Meaningful physical contact may mean any contact, or it may mean
+    contact conditioned by an implementation defined property. For example, a
+    touchpad may set the value to 1 only when the touch pressure rises above a
+    certain value. BTN_TOUCH may be combined with BTN_TOOL_<name> codes. For
+    example, a pen tablet may set BTN_TOOL_PEN to 1 and BTN_TOUCH to 0 while the
+    pen is hovering over but not touching the tablet surface.
+
+Note: For appropriate function of the legacy mousedev emulation driver,
+BTN_TOUCH must be the first evdev code emitted in a synchronization frame.
+
+Note: Historically a touch device with BTN_TOOL_FINGER and BTN_TOUCH was
+interpreted as a touchpad by userspace, while a similar device without
+BTN_TOOL_FINGER was interpreted as a touchscreen. For backwards compatibility
+with current userspace it is recommended to follow this distinction. In the
+future, this distinction will be deprecated and the device properties ioctl
+EVIOCGPROP, defined in linux/input.h, will be used to convey the device type.
+
+* BTN_TOOL_FINGER, BTN_TOOL_DOUBLETAP, BTN_TOOL_TRIPLETAP, BTN_TOOL_QUADTAP:
+  - These codes denote one, two, three, and four finger interaction on a
+    trackpad or touchscreen. For example, if the user uses two fingers and moves
+    them on the touchpad in an effort to scroll content on screen,
+    BTN_TOOL_DOUBLETAP should be set to value 1 for the duration of the motion.
+    Note that all BTN_TOOL_<name> codes and the BTN_TOUCH code are orthogonal in
+    purpose. A trackpad event generated by finger touches should generate events
+    for one code from each group. At most only one of these BTN_TOOL_<name>
+    codes should have a value of 1 during any synchronization frame.
+
+Note: Historically some drivers emitted multiple of the finger count codes with
+a value of 1 in the same synchronization frame. This usage is deprecated.
+
+Note: In multitouch drivers, the input_mt_report_finger_count() function should
+be used to emit these codes. Please see multi-touch-protocol.txt for details.
+
+EV_REL:
+----------
+EV_REL events describe relative changes in a property. For example, a mouse may
+move to the left by a certain number of units, but its absolute position in
+space is unknown. If the absolute position is known, EV_ABS codes should be used
+instead of EV_REL codes.
+
+A few EV_REL codes have special meanings:
+
+* REL_WHEEL, REL_HWHEEL:
+  - These codes are used for vertical and horizontal scroll wheels,
+    respectively.
+
+EV_ABS:
+----------
+EV_ABS events describe absolute changes in a property. For example, a touchpad
+may emit coordinates for a touch location.
+
+A few EV_ABS codes have special meanings:
+
+* ABS_DISTANCE:
+  - Used to describe the distance of a tool from an interaction surface. This
+    event should only be emitted while the tool is hovering, meaning in close
+    proximity of the device and while the value of the BTN_TOUCH code is 0. If
+    the input device may be used freely in three dimensions, consider ABS_Z
+    instead.
+
+* ABS_MT_<name>:
+  - Used to describe multitouch input events. Please see
+    multi-touch-protocol.txt for details.
+
+EV_SW:
+----------
+EV_SW events describe stateful binary switches. For example, the SW_LID code is
+used to denote when a laptop lid is closed.
+
+Upon binding to a device or resuming from suspend, a driver must report
+the current switch state. This ensures that the device, kernel, and userspace
+state is in sync.
+
+Upon resume, if the switch state is the same as before suspend, then the input
+subsystem will filter out the duplicate switch state reports. The driver does
+not need to keep the state of the switch at any time.
+
+EV_MSC:
+----------
+EV_MSC events are used for input and output events that do not fall under other
+categories.
+
+EV_LED:
+----------
+EV_LED events are used for input and output to set and query the state of
+various LEDs on devices.
+
+EV_REP:
+----------
+EV_REP events are used for specifying autorepeating events.
+
+EV_SND:
+----------
+EV_SND events are used for sending sound commands to simple sound output
+devices.
+
+EV_FF:
+----------
+EV_FF events are used to initialize a force feedback capable device and to cause
+such device to feedback.
+
+EV_PWR:
+----------
+EV_PWR events are a special type of event used specifically for power
+mangement. Its usage is not well defined. To be addressed later.
+
+Guidelines:
+==========
+The guidelines below ensure proper single-touch and multi-finger functionality.
+For multi-touch functionality, see the multi-touch-protocol.txt document for
+more information.
+
+Mice:
+----------
+REL_{X,Y} must be reported when the mouse moves. BTN_LEFT must be used to report
+the primary button press. BTN_{MIDDLE,RIGHT,4,5,etc.} should be used to report
+further buttons of the device. REL_WHEEL and REL_HWHEEL should be used to report
+scroll wheel events where available.
+
+Touchscreens:
+----------
+ABS_{X,Y} must be reported with the location of the touch. BTN_TOUCH must be
+used to report when a touch is active on the screen.
+BTN_{MOUSE,LEFT,MIDDLE,RIGHT} must not be reported as the result of touch
+contact. BTN_TOOL_<name> events should be reported where possible.
+
+Trackpads:
+----------
+Legacy trackpads that only provide relative position information must report
+events like mice described above.
+
+Trackpads that provide absolute touch position must report ABS_{X,Y} for the
+location of the touch. BTN_TOUCH should be used to report when a touch is active
+on the trackpad. Where multi-finger support is available, BTN_TOOL_<name> should
+be used to report the number of touches active on the trackpad.
+
+Tablets:
+----------
+BTN_TOOL_<name> events must be reported when a stylus or other tool is active on
+the tablet. ABS_{X,Y} must be reported with the location of the tool. BTN_TOUCH
+should be used to report when the tool is in contact with the tablet.
+BTN_{STYLUS,STYLUS2} should be used to report buttons on the tool itself. Any
+button may be used for buttons on the tablet except BTN_{MOUSE,LEFT}.
+BTN_{0,1,2,etc} are good generic codes for unlabeled buttons. Do not use
+meaningful buttons, like BTN_FORWARD, unless the button is labeled for that
+purpose on the device.
diff --git a/Documentation/md.txt b/Documentation/md.txt
index a81c7b4790f2..2366b1c8cf19 100644
--- a/Documentation/md.txt
+++ b/Documentation/md.txt
@@ -552,6 +552,16 @@ also have
      within the array where IO will be blocked.  This is currently
      only supported for raid4/5/6.
 
+   sync_min
+   sync_max
+     The two values, given as numbers of sectors, indicate a range
+     withing the array where 'check'/'repair' will operate. Must be
+     a multiple of chunk_size. When it reaches "sync_max" it will
+     pause, rather than complete.
+     You can use 'select' or 'poll' on "sync_completed" to wait for
+     that number to reach sync_max.  Then you can either increase
+     "sync_max", or can write 'idle' to "sync_action".
+
 
 Each active md device may also have attributes specific to the
 personality module that manages it.
diff --git a/Documentation/sound/alsa/SB-Live-mixer.txt b/Documentation/sound/alsa/SB-Live-mixer.txt
index f5639d40521d..f4b5988f450c 100644
--- a/Documentation/sound/alsa/SB-Live-mixer.txt
+++ b/Documentation/sound/alsa/SB-Live-mixer.txt
@@ -87,14 +87,14 @@ accumulator. ALSA uses accumulators 0 and 1 for left and right PCM.
 The result is forwarded to the ADC capture FIFO (thus to the standard capture
 PCM device).
 
-name='Music Playback Volume',index=0
+name='Synth Playback Volume',index=0
 
 This control is used to attenuate samples for left and right MIDI FX-bus
 accumulators. ALSA uses accumulators 4 and 5 for left and right MIDI samples.
 The result samples are forwarded to the front DAC PCM slots of the AC97 codec.
 
-name='Music Capture Volume',index=0
-name='Music Capture Switch',index=0
+name='Synth Capture Volume',index=0
+name='Synth Capture Switch',index=0
 
 These controls are used to attenuate samples for left and right MIDI FX-bus
 accumulator. ALSA uses accumulators 4 and 5 for left and right PCM.
diff --git a/Documentation/video4linux/sh_mobile_ceu_camera.txt b/Documentation/video4linux/sh_mobile_ceu_camera.txt
index cb47e723af74..1e96ce6e2d2f 100644
--- a/Documentation/video4linux/sh_mobile_ceu_camera.txt
+++ b/Documentation/video4linux/sh_mobile_ceu_camera.txt
@@ -37,7 +37,7 @@ Generic scaling / cropping scheme
 -1'-
 
 In the above chart minuses and slashes represent "real" data amounts, points and
-accents represent "useful" data, basically, CEU scaled amd cropped output,
+accents represent "useful" data, basically, CEU scaled and cropped output,
 mapped back onto the client's source plane.
 
 Such a configuration can be produced by user requests:
@@ -65,7 +65,7 @@ Do not touch input rectangle - it is already optimal.
 
 1. Calculate current sensor scales:
 
-        scale_s = ((3') - (3)) / ((2') - (2))
+        scale_s = ((2') - (2)) / ((3') - (3))
 
 2. Calculate "effective" input crop (sensor subwindow) - CEU crop scaled back at
 current sensor scales onto input window - this is user S_CROP:
@@ -80,7 +80,7 @@ window:
 4. Calculate sensor output window by applying combined scales to real input
 window:
 
-        width_s_out = ((2') - (2)) / scale_comb
+        width_s_out = ((7') - (7)) = ((2') - (2)) / scale_comb
 
 5. Apply iterative sensor S_FMT for sensor output window.
 
diff --git a/Documentation/workqueue.txt b/Documentation/workqueue.txt
index 01c513fac40e..a0b577de918f 100644
--- a/Documentation/workqueue.txt
+++ b/Documentation/workqueue.txt
@@ -12,6 +12,7 @@ CONTENTS
 4. Application Programming Interface (API)
 5. Example Execution Scenarios
 6. Guidelines
+7. Debugging
 
 
 1. Introduction
@@ -379,3 +380,42 @@ If q1 has WQ_CPU_INTENSIVE set,
 * Unless work items are expected to consume a huge amount of CPU
   cycles, using a bound wq is usually beneficial due to the increased
   level of locality in wq operations and work item execution.
+
+
+7. Debugging
+
+Because the work functions are executed by generic worker threads
+there are a few tricks needed to shed some light on misbehaving
+workqueue users.
+
+Worker threads show up in the process list as:
+
+root      5671  0.0  0.0      0     0 ?        S    12:07   0:00 [kworker/0:1]
+root      5672  0.0  0.0      0     0 ?        S    12:07   0:00 [kworker/1:2]
+root      5673  0.0  0.0      0     0 ?        S    12:12   0:00 [kworker/0:0]
+root      5674  0.0  0.0      0     0 ?        S    12:13   0:00 [kworker/1:0]
+
+If kworkers are going crazy (using too much cpu), there are two types
+of possible problems:
+
+        1. Something beeing scheduled in rapid succession
+        2. A single work item that consumes lots of cpu cycles
+
+The first one can be tracked using tracing:
+
+        $ echo workqueue:workqueue_queue_work > /sys/kernel/debug/tracing/set_event
+        $ cat /sys/kernel/debug/tracing/trace_pipe > out.txt
+        (wait a few secs)
+        ^C
+
+If something is busy looping on work queueing, it would be dominating
+the output and the offender can be determined with the work item
+function.
+
+For the second type of problems it should be possible to just check
+the stack trace of the offending worker thread.
+
+        $ cat /proc/THE_OFFENDING_KWORKER/stack
+
+The work item's function should be trivially visible in the stack
+trace.
diff --git a/MAINTAINERS b/MAINTAINERS
index eb4f996d39b7..16a5c5f2c6a6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -185,10 +185,9 @@ F:	Documentation/filesystems/9p.txt
 F:      fs/9p/
 
 A2232 SERIAL BOARD DRIVER
-M:      Enver Haase <A2232@gmx.net>
 L:      linux-m68k@lists.linux-m68k.org
-S:      Maintained
-F:      drivers/char/ser_a2232*
+S:      Orphan
+F:      drivers/staging/generic_serial/ser_a2232*
 
 AACRAID SCSI RAID DRIVER
 M:      Adaptec OEM Raid Solutions <aacraid@adaptec.com>
@@ -878,6 +877,13 @@ F:	arch/arm/mach-mv78xx0/
 F:      arch/arm/mach-orion5x/
 F:      arch/arm/plat-orion/
 
+ARM/Orion SoC/Technologic Systems TS-78xx platform support
+M:      Alexander Clouter <alex@digriz.org.uk>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+W:      http://www.digriz.org.uk/ts78xx/kernel
+S:      Maintained
+F:      arch/arm/mach-orion5x/ts78xx-*
+
 ARM/MIOA701 MACHINE SUPPORT
 M:      Robert Jarzmik <robert.jarzmik@free.fr>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1026,12 +1032,13 @@ W:	http://www.fluff.org/ben/linux/
 S:      Maintained
 F:      arch/arm/mach-s3c64xx/
 
-ARM/S5P ARM ARCHITECTURES
+ARM/S5P EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene.kim@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-s5p*/
+F:      arch/arm/mach-exynos*/
 
 ARM/SAMSUNG MOBILE MACHINE SUPPORT
 M:      Kyungmin Park <kyungmin.park@samsung.com>
@@ -1064,7 +1071,7 @@ F:	arch/arm/mach-shmobile/
 F:      drivers/sh/
 
 ARM/TELECHIPS ARM ARCHITECTURE
-M:      "Hans J. Koch" <hjk@linutronix.de>
+M:      "Hans J. Koch" <hjk@hansjkoch.de>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/plat-tcc/
@@ -1824,11 +1831,10 @@ S:	Maintained
 F:      drivers/platform/x86/compal-laptop.c
 
 COMPUTONE INTELLIPORT MULTIPORT CARD
-M:      "Michael H. Warfield" <mhw@wittsend.com>
 W:      http://www.wittsend.com/computone.html
-S:      Maintained
+S:      Orphan
 F:      Documentation/serial/computone.txt
-F:      drivers/char/ip2/
+F:      drivers/staging/tty/ip2/
 
 CONEXANT ACCESSRUNNER USB DRIVER
 M:      Simon Arlott <cxacru@fire.lp0.eu>
@@ -2011,7 +2017,7 @@ F:	drivers/net/wan/cycx*
 CYCLADES ASYNC MUX DRIVER
 W:      http://www.cyclades.com/
 S:      Orphan
-F:      drivers/char/cyclades.c
+F:      drivers/tty/cyclades.c
 F:      include/linux/cyclades.h
 
 CYCLADES PC300 DRIVER
@@ -2125,8 +2131,8 @@ L:	Eng.Linux@digi.com
 W:      http://www.digi.com
 S:      Orphan
 F:      Documentation/serial/digiepca.txt
-F:      drivers/char/epca*
-F:      drivers/char/digi*
+F:      drivers/staging/tty/epca*
+F:      drivers/staging/tty/digi*
 
 DIOLAN U2C-12 I2C DRIVER
 M:      Guenter Roeck <guenter.roeck@ericsson.com>
@@ -2803,7 +2809,7 @@ GPIO SUBSYSTEM
 M:      Grant Likely <grant.likely@secretlab.ca>
 S:      Maintained
 T:      git git://git.secretlab.ca/git/linux-2.6.git
-F:      Documentation/gpio/gpio.txt
+F:      Documentation/gpio.txt
 F:      drivers/gpio/
 F:      include/linux/gpio*
 
@@ -4078,7 +4084,7 @@ F:	drivers/video/matrox/matroxfb_*
 F:      include/linux/matroxfb.h
 
 MAX6650 HARDWARE MONITOR AND FAN CONTROLLER DRIVER
-M:      "Hans J. Koch" <hjk@linutronix.de>
+M:      "Hans J. Koch" <hjk@hansjkoch.de>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/max6650
@@ -4193,7 +4199,7 @@ MOXA SMARTIO/INDUSTIO/INTELLIO SERIAL CARD
 M:      Jiri Slaby <jirislaby@gmail.com>
 S:      Maintained
 F:      Documentation/serial/moxa-smartio
-F:      drivers/char/mxser.*
+F:      drivers/tty/mxser.*
 
 MSI LAPTOP SUPPORT
 M:      "Lee, Chun-Yi" <jlee@novell.com>
@@ -4235,7 +4241,7 @@ F:	sound/oss/msnd*
 
 MULTITECH MULTIPORT CARD (ISICOM)
 S:      Orphan
-F:      drivers/char/isicom.c
+F:      drivers/tty/isicom.c
 F:      include/linux/isicom.h
 
 MUSB MULTIPOINT HIGH SPEED DUAL-ROLE CONTROLLER
@@ -5274,14 +5280,14 @@ F:	drivers/memstick/host/r592.*
 RISCOM8 DRIVER
 S:      Orphan
 F:      Documentation/serial/riscom8.txt
-F:      drivers/char/riscom8*
+F:      drivers/staging/tty/riscom8*
 
 ROCKETPORT DRIVER
 P:      Comtrol Corp.
 W:      http://www.comtrol.com
 S:      Maintained
 F:      Documentation/serial/rocket.txt
-F:      drivers/char/rocket*
+F:      drivers/tty/rocket*
 
 ROSE NETWORK LAYER
 M:      Ralf Baechle <ralf@linux-mips.org>
@@ -5391,7 +5397,7 @@ F:	drivers/media/video/*7146*
 F:      include/media/*7146*
 
 SAMSUNG AUDIO (ASoC) DRIVERS
-M:      Jassi Brar <jassi.brar@samsung.com>
+M:      Jassi Brar <jassisinghbrar@gmail.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Supported
 F:      sound/soc/samsung
@@ -5917,10 +5923,9 @@ F:	arch/arm/mach-spear6xx/spear600.c
 F:      arch/arm/mach-spear6xx/spear600_evb.c
 
 SPECIALIX IO8+ MULTIPORT SERIAL CARD DRIVER
-M:      Roger Wolff <R.E.Wolff@BitWizard.nl>
-S:      Supported
+S:      Orphan
 F:      Documentation/serial/specialix.txt
-F:      drivers/char/specialix*
+F:      drivers/staging/tty/specialix*
 
 SPI SUBSYSTEM
 M:      David Brownell <dbrownell@users.sourceforge.net>
@@ -5965,7 +5970,6 @@ F:	arch/alpha/kernel/srm_env.c
 
 STABLE BRANCH
 M:      Greg Kroah-Hartman <greg@kroah.com>
-M:      Chris Wright <chrisw@sous-sol.org>
 L:      stable@kernel.org
 S:      Maintained
 
@@ -6249,7 +6253,8 @@ M:	Greg Ungerer <gerg@uclinux.org>
 W:      http://www.uclinux.org/
 L:      uclinux-dev@uclinux.org  (subscribers-only)
 S:      Maintained
-F:      arch/m68knommu/
+F:      arch/m68k/*/*_no.*
+F:      arch/m68k/include/asm/*_no.*
 
 UCLINUX FOR RENESAS H8/300 (H8300)
 M:      Yoshinori Sato <ysato@users.sourceforge.jp>
@@ -6619,7 +6624,7 @@ F:	fs/hostfs/
 F:      fs/hppfs/
 
 USERSPACE I/O (UIO)
-M:      "Hans J. Koch" <hjk@linutronix.de>
+M:      "Hans J. Koch" <hjk@hansjkoch.de>
 M:      Greg Kroah-Hartman <gregkh@suse.de>
 S:      Maintained
 F:      Documentation/DocBook/uio-howto.tmpl
@@ -6917,6 +6922,18 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86.
 S:      Maintained
 F:      drivers/platform/x86
 
+XEN HYPERVISOR INTERFACE
+M:      Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
+L:      virtualization@lists.linux-foundation.org
+S:      Supported
+F:      arch/x86/xen/
+F:      drivers/*/xen-*front.c
+F:      drivers/xen/
+F:      arch/x86/include/asm/xen/
+F:      include/xen/
+
 XEN NETWORK BACKEND DRIVER
 M:      Ian Campbell <ian.campbell@citrix.com>
 L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
@@ -6938,18 +6955,6 @@ S:	Supported
 F:      arch/x86/xen/*swiotlb*
 F:      drivers/xen/*swiotlb*
 
-XEN HYPERVISOR INTERFACE
-M:      Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
-M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
-L:      virtualization@lists.linux-foundation.org
-S:      Supported
-F:      arch/x86/xen/
-F:      drivers/*/xen-*front.c
-F:      drivers/xen/
-F:      arch/x86/include/asm/xen/
-F:      include/xen/
-
 XFS FILESYSTEM
 P:      Silicon Graphics Inc
 M:      Alex Elder <aelder@sgi.com>
diff --git a/Makefile b/Makefile
index 8392b64079df..5a7a2e4f5c0b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 39
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc5
 NAME = Flesh-Eating Bats with Fangs
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/Makefile b/arch/alpha/kernel/Makefile
index 9bb7b858ed23..7a6d908bb865 100644
--- a/arch/alpha/kernel/Makefile
+++ b/arch/alpha/kernel/Makefile
@@ -4,7 +4,7 @@
 
 extra-y         := head.o vmlinux.lds
 asflags-y       := $(KBUILD_CFLAGS)
-ccflags-y       := -Werror -Wno-sign-compare
+ccflags-y       := -Wno-sign-compare
 
 obj-y    := entry.o traps.o process.o init_task.o osf_sys.o irq.o \
             irq_alpha.o signal.o setup.o ptrace.o time.o \
diff --git a/arch/alpha/kernel/core_mcpcia.c b/arch/alpha/kernel/core_mcpcia.c
index 381fec0af52e..da7bcc372f16 100644
--- a/arch/alpha/kernel/core_mcpcia.c
+++ b/arch/alpha/kernel/core_mcpcia.c
@@ -88,7 +88,7 @@ conf_read(unsigned long addr, unsigned char type1,
 {
         unsigned long flags;
         unsigned long mid = MCPCIA_HOSE2MID(hose->index);
-        unsigned int stat0, value, temp, cpu;
+        unsigned int stat0, value, cpu;
 
         cpu = smp_processor_id();
 
@@ -101,7 +101,7 @@ conf_read(unsigned long addr, unsigned char type1,
         stat0 = *(vuip)MCPCIA_CAP_ERR(mid);
         *(vuip)MCPCIA_CAP_ERR(mid) = stat0;
         mb();
-        temp = *(vuip)MCPCIA_CAP_ERR(mid);
+        *(vuip)MCPCIA_CAP_ERR(mid);
         DBG_CFG(("conf_read: MCPCIA_CAP_ERR(%d) was 0x%x\n", mid, stat0));
 
         mb();
@@ -136,7 +136,7 @@ conf_write(unsigned long addr, unsigned int value, unsigned char type1,
 {
         unsigned long flags;
         unsigned long mid = MCPCIA_HOSE2MID(hose->index);
-        unsigned int stat0, temp, cpu;
+        unsigned int stat0, cpu;
 
         cpu = smp_processor_id();
 
@@ -145,7 +145,7 @@ conf_write(unsigned long addr, unsigned int value, unsigned char type1,
         /* Reset status register to avoid losing errors.  */
         stat0 = *(vuip)MCPCIA_CAP_ERR(mid);
         *(vuip)MCPCIA_CAP_ERR(mid) = stat0; mb();
-        temp = *(vuip)MCPCIA_CAP_ERR(mid);
+        *(vuip)MCPCIA_CAP_ERR(mid);
         DBG_CFG(("conf_write: MCPCIA CAP_ERR(%d) was 0x%x\n", mid, stat0));
 
         draina();
@@ -157,7 +157,7 @@ conf_write(unsigned long addr, unsigned int value, unsigned char type1,
         *((vuip)addr) = value;
         mb();
         mb();  /* magic */
-        temp = *(vuip)MCPCIA_CAP_ERR(mid); /* read to force the write */
+        *(vuip)MCPCIA_CAP_ERR(mid); /* read to force the write */
         mcheck_expected(cpu) = 0;
         mb();
 
@@ -572,12 +572,10 @@ mcpcia_print_system_area(unsigned long la_ptr)
 void
 mcpcia_machine_check(unsigned long vector, unsigned long la_ptr)
 {
-        struct el_common *mchk_header;
         struct el_MCPCIA_uncorrected_frame_mcheck *mchk_logout;
         unsigned int cpu = smp_processor_id();
         int expected;
 
-        mchk_header = (struct el_common *)la_ptr;
         mchk_logout = (struct el_MCPCIA_uncorrected_frame_mcheck *)la_ptr;
         expected = mcheck_expected(cpu);
 
diff --git a/arch/alpha/kernel/err_titan.c b/arch/alpha/kernel/err_titan.c
index c3b3781a03de..14b26c466c89 100644
--- a/arch/alpha/kernel/err_titan.c
+++ b/arch/alpha/kernel/err_titan.c
@@ -533,8 +533,6 @@ static struct el_subpacket_annotation el_titan_annotations[] = {
 static struct el_subpacket *
 el_process_regatta_subpacket(struct el_subpacket *header)
 {
-        int status;
-
         if (header->class != EL_CLASS__REGATTA_FAMILY) {
                 printk("%s  ** Unexpected header CLASS %d TYPE %d, aborting\n",
                        err_print_prefix,
@@ -551,7 +549,7 @@ el_process_regatta_subpacket(struct el_subpacket *header)
                 printk("%s  ** Occurred on CPU %d:\n", 
                        err_print_prefix,
                        (int)header->by_type.regatta_frame.cpuid);
-                status = privateer_process_logout_frame((struct el_common *)
+                privateer_process_logout_frame((struct el_common *)
                         header->by_type.regatta_frame.data_start, 1);
                 break;
         default:
diff --git a/arch/alpha/kernel/irq_alpha.c b/arch/alpha/kernel/irq_alpha.c
index 1479dc6ebd97..51b7fbd9e4c1 100644
--- a/arch/alpha/kernel/irq_alpha.c
+++ b/arch/alpha/kernel/irq_alpha.c
@@ -228,7 +228,7 @@ struct irqaction timer_irqaction = {
 void __init
 init_rtc_irq(void)
 {
-        irq_set_chip_and_handler_name(RTC_IRQ, &no_irq_chip,
+        irq_set_chip_and_handler_name(RTC_IRQ, &dummy_irq_chip,
                                       handle_simple_irq, "RTC");
         setup_irq(RTC_IRQ, &timer_irqaction);
 }
diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
index d2634e4476b4..edbddcbd5bc6 100644
--- a/arch/alpha/kernel/setup.c
+++ b/arch/alpha/kernel/setup.c
@@ -1404,8 +1404,6 @@ determine_cpu_caches (unsigned int cpu_type)
         case PCA56_CPU:
         case PCA57_CPU:
           {
-                unsigned long cbox_config, size;
-
                 if (cpu_type == PCA56_CPU) {
                         L1I = CSHAPE(16*1024, 6, 1);
                         L1D = CSHAPE(8*1024, 5, 1);
@@ -1415,10 +1413,12 @@ determine_cpu_caches (unsigned int cpu_type)
                 }
                 L3 = -1;
 
+#if 0
+                unsigned long cbox_config, size;
+
                 cbox_config = *(vulp) phys_to_virt (0xfffff00008UL);
                 size = 512*1024 * (1 << ((cbox_config >> 12) & 3));
 
-#if 0
                 L2 = ((cbox_config >> 31) & 1 ? CSHAPE (size, 6, 1) : -1);
 #else
                 L2 = external_cache_probe(512*1024, 6);
diff --git a/arch/alpha/kernel/smc37c93x.c b/arch/alpha/kernel/smc37c93x.c
index 3e6a2893af9f..6886b834f487 100644
--- a/arch/alpha/kernel/smc37c93x.c
+++ b/arch/alpha/kernel/smc37c93x.c
@@ -79,7 +79,6 @@
 static unsigned long __init SMCConfigState(unsigned long baseAddr)
 {
         unsigned char devId;
-        unsigned char devRev;
 
         unsigned long configPort;
         unsigned long indexPort;
@@ -100,7 +99,7 @@ static unsigned long __init SMCConfigState(unsigned long baseAddr)
                 devId = inb(dataPort);
                 if (devId == VALID_DEVICE_ID) {
                         outb(DEVICE_REV, indexPort);
-                        devRev = inb(dataPort);
+                        /* unsigned char devRev = */ inb(dataPort);
                         break;
                 }
                 else
diff --git a/arch/alpha/kernel/sys_wildfire.c b/arch/alpha/kernel/sys_wildfire.c
index d3cb28bb8eb0..d92cdc715c65 100644
--- a/arch/alpha/kernel/sys_wildfire.c
+++ b/arch/alpha/kernel/sys_wildfire.c
@@ -156,7 +156,6 @@ static void __init
 wildfire_init_irq_per_pca(int qbbno, int pcano)
 {
         int i, irq_bias;
-        unsigned long io_bias;
         static struct irqaction isa_enable = {
                 .handler        = no_action,
                 .name           = "isa_enable",
@@ -165,10 +164,12 @@ wildfire_init_irq_per_pca(int qbbno, int pcano)
         irq_bias = qbbno * (WILDFIRE_PCA_PER_QBB * WILDFIRE_IRQ_PER_PCA)
                  + pcano * WILDFIRE_IRQ_PER_PCA;
 
+#if 0
+        unsigned long io_bias;
+
         /* Only need the following for first PCI bus per PCA. */
         io_bias = WILDFIRE_IO(qbbno, pcano<<1) - WILDFIRE_IO_BIAS;
 
-#if 0
         outb(0, DMA1_RESET_REG + io_bias);
         outb(0, DMA2_RESET_REG + io_bias);
         outb(DMA_MODE_CASCADE, DMA2_MODE_REG + io_bias);
diff --git a/arch/alpha/kernel/time.c b/arch/alpha/kernel/time.c
index a58e84f1a63b..918e8e0b72ff 100644
--- a/arch/alpha/kernel/time.c
+++ b/arch/alpha/kernel/time.c
@@ -153,6 +153,7 @@ void read_persistent_clock(struct timespec *ts)
                 year += 100;
 
         ts->tv_sec = mktime(year, mon, day, hour, min, sec);
+        ts->tv_nsec = 0;
 }
 
 
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index fdc9d4dbf85b..377a7a595b08 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1540,7 +1540,6 @@ config HIGHMEM
 config HIGHPTE
         bool "Allocate 2nd-level pagetables from highmem"
         depends on HIGHMEM
-        depends on !OUTER_CACHE
 
 config HW_PERF_EVENTS
         bool "Enable hardware performance counter support for perf events"
@@ -2012,6 +2011,8 @@ source "kernel/power/Kconfig"
 
 config ARCH_SUSPEND_POSSIBLE
         depends on !ARCH_S5P64X0 && !ARCH_S5P6442
+        depends on CPU_ARM920T || CPU_ARM926T || CPU_SA1100 || \
+                CPU_V6 || CPU_V6K || CPU_V7 || CPU_XSC3 || CPU_XSCALE
         def_bool y
 
 endmenu
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 494224a9b459..03d01d783e3b 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -63,17 +63,6 @@ config DEBUG_USER
               8 - SIGSEGV faults
              16 - SIGBUS faults
 
-config DEBUG_ERRORS
-        bool "Verbose kernel error messages"
-        depends on DEBUG_KERNEL
-        help
-          This option controls verbose debugging information which can be
-          printed when the kernel detects an internal error. This debugging
-          information is useful to kernel hackers when tracking down problems,
-          but mostly meaningless to other people. It's safe to say Y unless
-          you are concerned with the code size or don't want to see these
-          messages.
-
 config DEBUG_STACK_USAGE
         bool "Enable stack utilization instrumentation"
         depends on DEBUG_KERNEL
diff --git a/arch/arm/common/Makefile b/arch/arm/common/Makefile
index e7521bca2c35..6ea9b6f3607a 100644
--- a/arch/arm/common/Makefile
+++ b/arch/arm/common/Makefile
@@ -16,5 +16,4 @@ obj-$(CONFIG_SHARP_SCOOP)	+= scoop.o
 obj-$(CONFIG_ARCH_IXP2000)      += uengine.o
 obj-$(CONFIG_ARCH_IXP23XX)      += uengine.o
 obj-$(CONFIG_PCI_HOST_ITE8152)  += it8152.o
-obj-$(CONFIG_COMMON_CLKDEV)     += clkdev.o
 obj-$(CONFIG_ARM_TIMER_SP804)   += timer-sp.o
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index ed5bc9e05a4e..cd4458f64171 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -2,6 +2,7 @@
 #define __ASM_ARM_CPUTYPE_H
 
 #include <linux/stringify.h>
+#include <linux/kernel.h>
 
 #define CPUID_ID        0
 #define CPUID_CACHETYPE 1
diff --git a/arch/arm/include/asm/kprobes.h b/arch/arm/include/asm/kprobes.h
index bb8a19bd5822..e46bdd0097eb 100644
--- a/arch/arm/include/asm/kprobes.h
+++ b/arch/arm/include/asm/kprobes.h
@@ -39,10 +39,13 @@ typedef u32 kprobe_opcode_t;
 struct kprobe;
 typedef void (kprobe_insn_handler_t)(struct kprobe *, struct pt_regs *);
 
+typedef unsigned long (kprobe_check_cc)(unsigned long);
+
 /* Architecture specific copy of original instruction. */
 struct arch_specific_insn {
         kprobe_opcode_t         *insn;
         kprobe_insn_handler_t   *insn_handler;
+        kprobe_check_cc         *insn_check_cc;
 };
 
 struct prev_kprobe {
diff --git a/arch/arm/include/asm/thread_notify.h b/arch/arm/include/asm/thread_notify.h
index c4391ba20350..1dc980675894 100644
--- a/arch/arm/include/asm/thread_notify.h
+++ b/arch/arm/include/asm/thread_notify.h
@@ -43,6 +43,7 @@ static inline void thread_notify(unsigned long rc, struct thread_info *thread)
 #define THREAD_NOTIFY_FLUSH     0
 #define THREAD_NOTIFY_EXIT      1
 #define THREAD_NOTIFY_SWITCH    2
+#define THREAD_NOTIFY_COPY      3
 
 #endif
 #endif
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index c891eb76c0e3..87dbe3e21970 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -396,6 +396,10 @@
 #define __NR_fanotify_init              (__NR_SYSCALL_BASE+367)
 #define __NR_fanotify_mark              (__NR_SYSCALL_BASE+368)
 #define __NR_prlimit64                  (__NR_SYSCALL_BASE+369)
+#define __NR_name_to_handle_at          (__NR_SYSCALL_BASE+370)
+#define __NR_open_by_handle_at          (__NR_SYSCALL_BASE+371)
+#define __NR_clock_adjtime              (__NR_SYSCALL_BASE+372)
+#define __NR_syncfs                     (__NR_SYSCALL_BASE+373)
 
 /*
  * The following SWIs are ARM private.
diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
index 74554f1742d7..8d95446150a3 100644
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -29,7 +29,7 @@ obj-$(CONFIG_MODULES)		+= armksyms.o module.o
 obj-$(CONFIG_ARTHUR)            += arthur.o
 obj-$(CONFIG_ISA_DMA)           += dma-isa.o
 obj-$(CONFIG_PCI)               += bios32.o isa.o
-obj-$(CONFIG_PM)                += sleep.o
+obj-$(CONFIG_PM_SLEEP)          += sleep.o
 obj-$(CONFIG_HAVE_SCHED_CLOCK)  += sched_clock.o
 obj-$(CONFIG_SMP)               += smp.o smp_tlb.o
 obj-$(CONFIG_HAVE_ARM_SCU)      += smp_scu.o
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 5c26eccef998..7fbf28c35bb2 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -379,6 +379,10 @@
                 CALL(sys_fanotify_init)
                 CALL(sys_fanotify_mark)
                 CALL(sys_prlimit64)
+/* 370 */       CALL(sys_name_to_handle_at)
+                CALL(sys_open_by_handle_at)
+                CALL(sys_clock_adjtime)
+                CALL(sys_syncfs)
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/kernel/elf.c b/arch/arm/kernel/elf.c
index d4a0da1e48f4..9b05c6a0dcea 100644
--- a/arch/arm/kernel/elf.c
+++ b/arch/arm/kernel/elf.c
@@ -40,15 +40,22 @@ EXPORT_SYMBOL(elf_check_arch);
 void elf_set_personality(const struct elf32_hdr *x)
 {
         unsigned int eflags = x->e_flags;
-        unsigned int personality = PER_LINUX_32BIT;
+        unsigned int personality = current->personality & ~PER_MASK;
+
+        /*
+         * We only support Linux ELF executables, so always set the
+         * personality to LINUX.
+         */
+        personality |= PER_LINUX;
 
         /*
          * APCS-26 is only valid for OABI executables
          */
-        if ((eflags & EF_ARM_EABI_MASK) == EF_ARM_EABI_UNKNOWN) {
-                if (eflags & EF_ARM_APCS_26)
-                        personality = PER_LINUX;
-        }
+        if ((eflags & EF_ARM_EABI_MASK) == EF_ARM_EABI_UNKNOWN &&
+            (eflags & EF_ARM_APCS_26))
+                personality &= ~ADDR_LIMIT_32BIT;
+        else
+                personality |= ADDR_LIMIT_32BIT;
 
         set_personality(personality);
 
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 8dbc126f7152..87acc25d7a3e 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -868,6 +868,13 @@ static void reset_ctrl_regs(void *info)
                  */
                 asm volatile("mcr p14, 0, %0, c1, c0, 4" : : "r" (0));
                 isb();
+
+                /*
+                 * Clear any configured vector-catch events before
+                 * enabling monitor mode.
+                 */
+                asm volatile("mcr p14, 0, %0, c0, c7, 0" : : "r" (0));
+                isb();
         }
 
         if (enable_monitor_mode())
diff --git a/arch/arm/kernel/kprobes-decode.c b/arch/arm/kernel/kprobes-decode.c
index 23891317dc4b..15eeff6aea0e 100644
--- a/arch/arm/kernel/kprobes-decode.c
+++ b/arch/arm/kernel/kprobes-decode.c
@@ -34,9 +34,6 @@
  *
  *   *) If the PC is written to by the instruction, the
  *      instruction must be fully simulated in software.
- *      If it is a conditional instruction, the handler
- *      will use insn[0] to copy its condition code to
- *      set r0 to 1 and insn[1] to "mov pc, lr" to return.
  *
  *   *) Otherwise, a modified form of the instruction is
  *      directly executed.  Its handler calls the
@@ -68,13 +65,17 @@
 
 #define branch_displacement(insn) sign_extend(((insn) & 0xffffff) << 2, 25)
 
+#define is_r15(insn, bitpos) (((insn) & (0xf << bitpos)) == (0xf << bitpos))
+
+/*
+ * Test if load/store instructions writeback the address register.
+ * if P (bit 24) == 0 or W (bit 21) == 1
+ */
+#define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000)
+
 #define PSR_fs  (PSR_f|PSR_s)
 
 #define KPROBE_RETURN_INSTRUCTION       0xe1a0f00e      /* mov pc, lr */
-#define SET_R0_TRUE_INSTRUCTION         0xe3a00001      /* mov  r0, #1 */
-
-#define truecc_insn(insn)       (((insn) & 0xf0000000) | \
-                                 (SET_R0_TRUE_INSTRUCTION & 0x0fffffff))
 
 typedef long (insn_0arg_fn_t)(void);
 typedef long (insn_1arg_fn_t)(long);
@@ -419,14 +420,10 @@ insnslot_llret_4arg_rwflags(long r0, long r1, long r2, long r3, long *cpsr,
 
 static void __kprobes simulate_bbl(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
         long iaddr = (long)p->addr;
         int disp  = branch_displacement(insn);
 
-        if (!insnslot_1arg_rflags(0, regs->ARM_cpsr, i_fn))
-                return;
-
         if (insn & (1 << 24))
                 regs->ARM_lr = iaddr + 4;
 
@@ -446,14 +443,10 @@ static void __kprobes simulate_blx1(struct kprobe *p, struct pt_regs *regs)
 
 static void __kprobes simulate_blx2bx(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
         int rm = insn & 0xf;
         long rmv = regs->uregs[rm];
 
-        if (!insnslot_1arg_rflags(0, regs->ARM_cpsr, i_fn))
-                return;
-
         if (insn & (1 << 5))
                 regs->ARM_lr = (long)p->addr + 4;
 
@@ -463,9 +456,16 @@ static void __kprobes simulate_blx2bx(struct kprobe *p, struct pt_regs *regs)
                 regs->ARM_cpsr |= PSR_T_BIT;
 }
 
+static void __kprobes simulate_mrs(struct kprobe *p, struct pt_regs *regs)
+{
+        kprobe_opcode_t insn = p->opcode;
+        int rd = (insn >> 12) & 0xf;
+        unsigned long mask = 0xf8ff03df; /* Mask out execution state */
+        regs->uregs[rd] = regs->ARM_cpsr & mask;
+}
+
 static void __kprobes simulate_ldm1stm1(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
         int rn = (insn >> 16) & 0xf;
         int lbit = insn & (1 << 20);
@@ -476,9 +476,6 @@ static void __kprobes simulate_ldm1stm1(struct kprobe *p, struct pt_regs *regs)
         int reg_bit_vector;
         int reg_count;
 
-        if (!insnslot_1arg_rflags(0, regs->ARM_cpsr, i_fn))
-                return;
-
         reg_count = 0;
         reg_bit_vector = insn & 0xffff;
         while (reg_bit_vector) {
@@ -510,11 +507,6 @@ static void __kprobes simulate_ldm1stm1(struct kprobe *p, struct pt_regs *regs)
 
 static void __kprobes simulate_stm1_pc(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
-
-        if (!insnslot_1arg_rflags(0, regs->ARM_cpsr, i_fn))
-                return;
-
         regs->ARM_pc = (long)p->addr + str_pc_offset;
         simulate_ldm1stm1(p, regs);
         regs->ARM_pc = (long)p->addr + 4;
@@ -525,24 +517,16 @@ static void __kprobes simulate_mov_ipsp(struct kprobe *p, struct pt_regs *regs)
         regs->uregs[12] = regs->uregs[13];
 }
 
-static void __kprobes emulate_ldcstc(struct kprobe *p, struct pt_regs *regs)
-{
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
-        kprobe_opcode_t insn = p->opcode;
-        int rn = (insn >> 16) & 0xf;
-        long rnv = regs->uregs[rn];
-
-        /* Save Rn in case of writeback. */
-        regs->uregs[rn] = insnslot_1arg_rflags(rnv, regs->ARM_cpsr, i_fn);
-}
-
 static void __kprobes emulate_ldrd(struct kprobe *p, struct pt_regs *regs)
 {
         insn_2arg_fn_t *i_fn = (insn_2arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
+        long ppc = (long)p->addr + 8;
         int rd = (insn >> 12) & 0xf;
         int rn = (insn >> 16) & 0xf;
         int rm = insn & 0xf;  /* rm may be invalid, don't care. */
+        long rmv = (rm == 15) ? ppc : regs->uregs[rm];
+        long rnv = (rn == 15) ? ppc : regs->uregs[rn];
 
         /* Not following the C calling convention here, so need asm(). */
         __asm__ __volatile__ (
@@ -554,29 +538,36 @@ static void __kprobes emulate_ldrd(struct kprobe *p, struct pt_regs *regs)
                 "str    r0, %[rn]       \n\t"   /* in case of writeback */
                 "str    r2, %[rd0]      \n\t"
                 "str    r3, %[rd1]      \n\t"
-                : [rn]  "+m" (regs->uregs[rn]),
+                : [rn]  "+m" (rnv),
                   [rd0] "=m" (regs->uregs[rd]),
                   [rd1] "=m" (regs->uregs[rd+1])
-                : [rm]   "m" (regs->uregs[rm]),
+                : [rm]   "m" (rmv),
                   [cpsr] "r" (regs->ARM_cpsr),
                   [i_fn] "r" (i_fn)
                 : "r0", "r1", "r2", "r3", "lr", "cc"
         );
+        if (is_writeback(insn))
+                regs->uregs[rn] = rnv;
 }
 
 static void __kprobes emulate_strd(struct kprobe *p, struct pt_regs *regs)
 {
         insn_4arg_fn_t *i_fn = (insn_4arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
+        long ppc = (long)p->addr + 8;
         int rd = (insn >> 12) & 0xf;
         int rn = (insn >> 16) & 0xf;
         int rm  = insn & 0xf;
-        long rnv = regs->uregs[rn];
-        long rmv = regs->uregs[rm];  /* rm/rmv may be invalid, don't care. */
+        long rnv = (rn == 15) ? ppc : regs->uregs[rn];
+        /* rm/rmv may be invalid, don't care. */
+        long rmv = (rm == 15) ? ppc : regs->uregs[rm];
+        long rnv_wb;
 
-        regs->uregs[rn] = insnslot_4arg_rflags(rnv, rmv, regs->uregs[rd],
+        rnv_wb = insnslot_4arg_rflags(rnv, rmv, regs->uregs[rd],
                                                regs->uregs[rd+1],
                                                regs->ARM_cpsr, i_fn);
+        if (is_writeback(insn))
+                regs->uregs[rn] = rnv_wb;
 }
 
 static void __kprobes emulate_ldr(struct kprobe *p, struct pt_regs *regs)
@@ -630,31 +621,6 @@ static void __kprobes emulate_str(struct kprobe *p, struct pt_regs *regs)
                 regs->uregs[rn] = rnv_wb;  /* Save Rn in case of writeback. */
 }
 
-static void __kprobes emulate_mrrc(struct kprobe *p, struct pt_regs *regs)
-{
-        insn_llret_0arg_fn_t *i_fn = (insn_llret_0arg_fn_t *)&p->ainsn.insn[0];
-        kprobe_opcode_t insn = p->opcode;
-        union reg_pair fnr;
-        int rd = (insn >> 12) & 0xf;
-        int rn = (insn >> 16) & 0xf;
-
-        fnr.dr = insnslot_llret_0arg_rflags(regs->ARM_cpsr, i_fn);
-        regs->uregs[rn] = fnr.r0;
-        regs->uregs[rd] = fnr.r1;
-}
-
-static void __kprobes emulate_mcrr(struct kprobe *p, struct pt_regs *regs)
-{
-        insn_2arg_fn_t *i_fn = (insn_2arg_fn_t *)&p->ainsn.insn[0];
-        kprobe_opcode_t insn = p->opcode;
-        int rd = (insn >> 12) & 0xf;
-        int rn = (insn >> 16) & 0xf;
-        long rnv = regs->uregs[rn];
-        long rdv = regs->uregs[rd];
-
-        insnslot_2arg_rflags(rnv, rdv, regs->ARM_cpsr, i_fn);
-}
-
 static void __kprobes emulate_sat(struct kprobe *p, struct pt_regs *regs)
 {
         insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
@@ -688,32 +654,32 @@ static void __kprobes emulate_none(struct kprobe *p, struct pt_regs *regs)
         insnslot_0arg_rflags(regs->ARM_cpsr, i_fn);
 }
 
-static void __kprobes emulate_rd12(struct kprobe *p, struct pt_regs *regs)
+static void __kprobes emulate_nop(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_0arg_fn_t *i_fn = (insn_0arg_fn_t *)&p->ainsn.insn[0];
-        kprobe_opcode_t insn = p->opcode;
-        int rd = (insn >> 12) & 0xf;
-
-        regs->uregs[rd] = insnslot_0arg_rflags(regs->ARM_cpsr, i_fn);
 }
 
-static void __kprobes emulate_ird12(struct kprobe *p, struct pt_regs *regs)
+static void __kprobes
+emulate_rd12_modify(struct kprobe *p, struct pt_regs *regs)
 {
         insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
-        int ird = (insn >> 12) & 0xf;
+        int rd = (insn >> 12) & 0xf;
+        long rdv = regs->uregs[rd];
 
-        insnslot_1arg_rflags(regs->uregs[ird], regs->ARM_cpsr, i_fn);
+        regs->uregs[rd] = insnslot_1arg_rflags(rdv, regs->ARM_cpsr, i_fn);
 }
 
-static void __kprobes emulate_rn16(struct kprobe *p, struct pt_regs *regs)
+static void __kprobes
+emulate_rd12rn0_modify(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
+        insn_2arg_fn_t *i_fn = (insn_2arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
-        int rn = (insn >> 16) & 0xf;
+        int rd = (insn >> 12) & 0xf;
+        int rn = insn & 0xf;
+        long rdv = regs->uregs[rd];
         long rnv = regs->uregs[rn];
 
-        insnslot_1arg_rflags(rnv, regs->ARM_cpsr, i_fn);
+        regs->uregs[rd] = insnslot_2arg_rflags(rdv, rnv, regs->ARM_cpsr, i_fn);
 }
 
 static void __kprobes emulate_rd12rm0(struct kprobe *p, struct pt_regs *regs)
@@ -819,6 +785,17 @@ emulate_alu_imm_rwflags(struct kprobe *p, struct pt_regs *regs)
 }
 
 static void __kprobes
+emulate_alu_tests_imm(struct kprobe *p, struct pt_regs *regs)
+{
+        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
+        kprobe_opcode_t insn = p->opcode;
+        int rn = (insn >> 16) & 0xf;
+        long rnv = (rn == 15) ? (long)p->addr + 8 : regs->uregs[rn];
+
+        insnslot_1arg_rwflags(rnv, &regs->ARM_cpsr, i_fn);
+}
+
+static void __kprobes
 emulate_alu_rflags(struct kprobe *p, struct pt_regs *regs)
 {
         insn_3arg_fn_t *i_fn = (insn_3arg_fn_t *)&p->ainsn.insn[0];
@@ -854,14 +831,34 @@ emulate_alu_rwflags(struct kprobe *p, struct pt_regs *regs)
                 insnslot_3arg_rwflags(rnv, rmv, rsv, &regs->ARM_cpsr, i_fn);
 }
 
+static void __kprobes
+emulate_alu_tests(struct kprobe *p, struct pt_regs *regs)
+{
+        insn_3arg_fn_t *i_fn = (insn_3arg_fn_t *)&p->ainsn.insn[0];
+        kprobe_opcode_t insn = p->opcode;
+        long ppc = (long)p->addr + 8;
+        int rn = (insn >> 16) & 0xf;
+        int rs = (insn >> 8) & 0xf;     /* rs/rsv may be invalid, don't care. */
+        int rm = insn & 0xf;
+        long rnv = (rn == 15) ? ppc : regs->uregs[rn];
+        long rmv = (rm == 15) ? ppc : regs->uregs[rm];
+        long rsv = regs->uregs[rs];
+
+        insnslot_3arg_rwflags(rnv, rmv, rsv, &regs->ARM_cpsr, i_fn);
+}
+
 static enum kprobe_insn __kprobes
 prep_emulate_ldr_str(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
-        int ibit = (insn & (1 << 26)) ? 25 : 22;
+        int not_imm = (insn & (1 << 26)) ? (insn & (1 << 25))
+                                         : (~insn & (1 << 22));
+
+        if (is_writeback(insn) && is_r15(insn, 16))
+                return INSN_REJECTED;   /* Writeback to PC */
 
         insn &= 0xfff00fff;
         insn |= 0x00001000;     /* Rn = r0, Rd = r1 */
-        if (insn & (1 << ibit)) {
+        if (not_imm) {
                 insn &= ~0xf;
                 insn |= 2;      /* Rm = r2 */
         }
@@ -871,20 +868,40 @@ prep_emulate_ldr_str(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 }
 
 static enum kprobe_insn __kprobes
-prep_emulate_rd12rm0(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+prep_emulate_rd12_modify(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
-        insn &= 0xffff0ff0;     /* Rd = r0, Rm = r0 */
+        if (is_r15(insn, 12))
+                return INSN_REJECTED;   /* Rd is PC */
+
+        insn &= 0xffff0fff;     /* Rd = r0 */
         asi->insn[0] = insn;
-        asi->insn_handler = emulate_rd12rm0;
+        asi->insn_handler = emulate_rd12_modify;
         return INSN_GOOD;
 }
 
 static enum kprobe_insn __kprobes
-prep_emulate_rd12(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+prep_emulate_rd12rn0_modify(kprobe_opcode_t insn,
+                            struct arch_specific_insn *asi)
 {
-        insn &= 0xffff0fff;     /* Rd = r0 */
+        if (is_r15(insn, 12))
+                return INSN_REJECTED;   /* Rd is PC */
+
+        insn &= 0xffff0ff0;     /* Rd = r0 */
+        insn |= 0x00000001;     /* Rn = r1 */
+        asi->insn[0] = insn;
+        asi->insn_handler = emulate_rd12rn0_modify;
+        return INSN_GOOD;
+}
+
+static enum kprobe_insn __kprobes
+prep_emulate_rd12rm0(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+{
+        if (is_r15(insn, 12))
+                return INSN_REJECTED;   /* Rd is PC */
+
+        insn &= 0xffff0ff0;     /* Rd = r0, Rm = r0 */
         asi->insn[0] = insn;
-        asi->insn_handler = emulate_rd12;
+        asi->insn_handler = emulate_rd12rm0;
         return INSN_GOOD;
 }
 
@@ -892,6 +909,9 @@ static enum kprobe_insn __kprobes
 prep_emulate_rd12rn16rm0_wflags(kprobe_opcode_t insn,
                                 struct arch_specific_insn *asi)
 {
+        if (is_r15(insn, 12))
+                return INSN_REJECTED;   /* Rd is PC */
+
         insn &= 0xfff00ff0;     /* Rd = r0, Rn = r0 */
         insn |= 0x00000001;     /* Rm = r1 */
         asi->insn[0] = insn;
@@ -903,6 +923,9 @@ static enum kprobe_insn __kprobes
 prep_emulate_rd16rs8rm0_wflags(kprobe_opcode_t insn,
                                struct arch_specific_insn *asi)
 {
+        if (is_r15(insn, 16))
+                return INSN_REJECTED;   /* Rd is PC */
+
         insn &= 0xfff0f0f0;     /* Rd = r0, Rs = r0 */
         insn |= 0x00000001;     /* Rm = r1          */
         asi->insn[0] = insn;
@@ -914,6 +937,9 @@ static enum kprobe_insn __kprobes
 prep_emulate_rd16rn12rs8rm0_wflags(kprobe_opcode_t insn,
                                    struct arch_specific_insn *asi)
 {
+        if (is_r15(insn, 16))
+                return INSN_REJECTED;   /* Rd is PC */
+
         insn &= 0xfff000f0;     /* Rd = r0, Rn = r0 */
         insn |= 0x00000102;     /* Rs = r1, Rm = r2 */
         asi->insn[0] = insn;
@@ -925,6 +951,9 @@ static enum kprobe_insn __kprobes
 prep_emulate_rdhi16rdlo12rs8rm0_wflags(kprobe_opcode_t insn,
                                        struct arch_specific_insn *asi)
 {
+        if (is_r15(insn, 16) || is_r15(insn, 12))
+                return INSN_REJECTED;   /* RdHi or RdLo is PC */
+
         insn &= 0xfff000f0;     /* RdHi = r0, RdLo = r1 */
         insn |= 0x00001203;     /* Rs = r2, Rm = r3 */
         asi->insn[0] = insn;
@@ -945,20 +974,13 @@ prep_emulate_rdhi16rdlo12rs8rm0_wflags(kprobe_opcode_t insn,
 static enum kprobe_insn __kprobes
 space_1111(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
-        /* CPS mmod == 1 : 1111 0001 0000 xx10 xxxx xxxx xx0x xxxx */
-        /* RFE           : 1111 100x x0x1 xxxx xxxx 1010 xxxx xxxx */
-        /* SRS           : 1111 100x x1x0 1101 xxxx 0101 xxxx xxxx */
-        if ((insn & 0xfff30020) == 0xf1020000 ||
-            (insn & 0xfe500f00) == 0xf8100a00 ||
-            (insn & 0xfe5f0f00) == 0xf84d0500)
-                return INSN_REJECTED;
-
-        /* PLD : 1111 01x1 x101 xxxx xxxx xxxx xxxx xxxx : */
-        if ((insn & 0xfd700000) == 0xf4500000) {
-                insn &= 0xfff0ffff;     /* Rn = r0 */
-                asi->insn[0] = insn;
-                asi->insn_handler = emulate_rn16;
-                return INSN_GOOD;
+        /* memory hint : 1111 0100 x001 xxxx xxxx xxxx xxxx xxxx : */
+        /* PLDI        : 1111 0100 x101 xxxx xxxx xxxx xxxx xxxx : */
+        /* PLDW        : 1111 0101 x001 xxxx xxxx xxxx xxxx xxxx : */
+        /* PLD         : 1111 0101 x101 xxxx xxxx xxxx xxxx xxxx : */
+        if ((insn & 0xfe300000) == 0xf4100000) {
+                asi->insn_handler = emulate_nop;
+                return INSN_GOOD_NO_SLOT;
         }
 
         /* BLX(1) : 1111 101x xxxx xxxx xxxx xxxx xxxx xxxx : */
@@ -967,41 +989,22 @@ space_1111(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                 return INSN_GOOD_NO_SLOT;
         }
 
-        /* SETEND : 1111 0001 0000 0001 xxxx xxxx 0000 xxxx */
-        /* CDP2   : 1111 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
-        if ((insn & 0xffff00f0) == 0xf1010000 ||
-            (insn & 0xff000010) == 0xfe000000) {
-                asi->insn[0] = insn;
-                asi->insn_handler = emulate_none;
-                return INSN_GOOD;
-        }
+        /* CPS   : 1111 0001 0000 xxx0 xxxx xxxx xx0x xxxx */
+        /* SETEND: 1111 0001 0000 0001 xxxx xxxx 0000 xxxx */
 
+        /* SRS   : 1111 100x x1x0 xxxx xxxx xxxx xxxx xxxx */
+        /* RFE   : 1111 100x x0x1 xxxx xxxx xxxx xxxx xxxx */
+
+        /* Coprocessor instructions... */
         /* MCRR2 : 1111 1100 0100 xxxx xxxx xxxx xxxx xxxx : (Rd != Rn) */
         /* MRRC2 : 1111 1100 0101 xxxx xxxx xxxx xxxx xxxx : (Rd != Rn) */
-        if ((insn & 0xffe00000) == 0xfc400000) {
-                insn &= 0xfff00fff;     /* Rn = r0 */
-                insn |= 0x00001000;     /* Rd = r1 */
-                asi->insn[0] = insn;
-                asi->insn_handler =
-                        (insn & (1 << 20)) ? emulate_mrrc : emulate_mcrr;
-                return INSN_GOOD;
-        }
+        /* LDC2  : 1111 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
+        /* STC2  : 1111 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
+        /* CDP2  : 1111 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
+        /* MCR2  : 1111 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
+        /* MRC2  : 1111 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
 
-        /* LDC2 : 1111 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
-        /* STC2 : 1111 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
-        if ((insn & 0xfe000000) == 0xfc000000) {
-                insn &= 0xfff0ffff;      /* Rn = r0 */
-                asi->insn[0] = insn;
-                asi->insn_handler = emulate_ldcstc;
-                return INSN_GOOD;
-        }
-
-        /* MCR2 : 1111 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
-        /* MRC2 : 1111 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
-        insn &= 0xffff0fff;     /* Rd = r0 */
-        asi->insn[0]      = insn;
-        asi->insn_handler = (insn & (1 << 20)) ? emulate_rd12 : emulate_ird12;
-        return INSN_GOOD;
+        return INSN_REJECTED;
 }
 
 static enum kprobe_insn __kprobes
@@ -1010,19 +1013,18 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
         /* cccc 0001 0xx0 xxxx xxxx xxxx xxxx xxx0 xxxx */
         if ((insn & 0x0f900010) == 0x01000000) {
 
-                /* BXJ  : cccc 0001 0010 xxxx xxxx xxxx 0010 xxxx */
-                /* MSR  : cccc 0001 0x10 xxxx xxxx xxxx 0000 xxxx */
-                if ((insn & 0x0ff000f0) == 0x01200020 ||
-                    (insn & 0x0fb000f0) == 0x01200000)
-                        return INSN_REJECTED;
-
-                /* MRS : cccc 0001 0x00 xxxx xxxx xxxx 0000 xxxx */
-                if ((insn & 0x0fb00010) == 0x01000000)
-                        return prep_emulate_rd12(insn, asi);
+                /* MRS cpsr : cccc 0001 0000 xxxx xxxx xxxx 0000 xxxx */
+                if ((insn & 0x0ff000f0) == 0x01000000) {
+                        if (is_r15(insn, 12))
+                                return INSN_REJECTED;   /* Rd is PC */
+                        asi->insn_handler = simulate_mrs;
+                        return INSN_GOOD_NO_SLOT;
+                }
 
                 /* SMLALxy : cccc 0001 0100 xxxx xxxx xxxx 1xx0 xxxx */
                 if ((insn & 0x0ff00090) == 0x01400080)
-                        return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn, asi);
+                        return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn,
+                                                                        asi);
 
                 /* SMULWy : cccc 0001 0010 xxxx xxxx xxxx 1x10 xxxx */
                 /* SMULxy : cccc 0001 0110 xxxx xxxx xxxx 1xx0 xxxx */
@@ -1031,24 +1033,29 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                         return prep_emulate_rd16rs8rm0_wflags(insn, asi);
 
                 /* SMLAxy : cccc 0001 0000 xxxx xxxx xxxx 1xx0 xxxx : Q */
-                /* SMLAWy : cccc 0001 0010 xxxx xxxx xxxx 0x00 xxxx : Q */
-                return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
+                /* SMLAWy : cccc 0001 0010 xxxx xxxx xxxx 1x00 xxxx : Q */
+                if ((insn & 0x0ff00090) == 0x01000080 ||
+                    (insn & 0x0ff000b0) == 0x01200080)
+                        return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
+
+                /* BXJ      : cccc 0001 0010 xxxx xxxx xxxx 0010 xxxx */
+                /* MSR      : cccc 0001 0x10 xxxx xxxx xxxx 0000 xxxx */
+                /* MRS spsr : cccc 0001 0100 xxxx xxxx xxxx 0000 xxxx */
 
+                /* Other instruction encodings aren't yet defined */
+                return INSN_REJECTED;
         }
 
         /* cccc 0001 0xx0 xxxx xxxx xxxx xxxx 0xx1 xxxx */
         else if ((insn & 0x0f900090) == 0x01000010) {
 
-                /* BKPT : 1110 0001 0010 xxxx xxxx xxxx 0111 xxxx */
-                if ((insn & 0xfff000f0) == 0xe1200070)
-                        return INSN_REJECTED;
-
                 /* BLX(2) : cccc 0001 0010 xxxx xxxx xxxx 0011 xxxx */
                 /* BX     : cccc 0001 0010 xxxx xxxx xxxx 0001 xxxx */
                 if ((insn & 0x0ff000d0) == 0x01200010) {
-                        asi->insn[0] = truecc_insn(insn);
+                        if ((insn & 0x0ff000ff) == 0x0120003f)
+                                return INSN_REJECTED; /* BLX pc */
                         asi->insn_handler = simulate_blx2bx;
-                        return INSN_GOOD;
+                        return INSN_GOOD_NO_SLOT;
                 }
 
                 /* CLZ : cccc 0001 0110 xxxx xxxx xxxx 0001 xxxx */
@@ -1059,17 +1066,27 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                 /* QSUB    : cccc 0001 0010 xxxx xxxx xxxx 0101 xxxx :Q */
                 /* QDADD   : cccc 0001 0100 xxxx xxxx xxxx 0101 xxxx :Q */
                 /* QDSUB   : cccc 0001 0110 xxxx xxxx xxxx 0101 xxxx :Q */
-                return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+                if ((insn & 0x0f9000f0) == 0x01000050)
+                        return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+
+                /* BKPT : 1110 0001 0010 xxxx xxxx xxxx 0111 xxxx */
+                /* SMC  : cccc 0001 0110 xxxx xxxx xxxx 0111 xxxx */
+
+                /* Other instruction encodings aren't yet defined */
+                return INSN_REJECTED;
         }
 
         /* cccc 0000 xxxx xxxx xxxx xxxx xxxx 1001 xxxx */
-        else if ((insn & 0x0f000090) == 0x00000090) {
+        else if ((insn & 0x0f0000f0) == 0x00000090) {
 
                 /* MUL    : cccc 0000 0000 xxxx xxxx xxxx 1001 xxxx :   */
                 /* MULS   : cccc 0000 0001 xxxx xxxx xxxx 1001 xxxx :cc */
                 /* MLA    : cccc 0000 0010 xxxx xxxx xxxx 1001 xxxx :   */
                 /* MLAS   : cccc 0000 0011 xxxx xxxx xxxx 1001 xxxx :cc */
                 /* UMAAL  : cccc 0000 0100 xxxx xxxx xxxx 1001 xxxx :   */
+                /* undef  : cccc 0000 0101 xxxx xxxx xxxx 1001 xxxx :   */
+                /* MLS    : cccc 0000 0110 xxxx xxxx xxxx 1001 xxxx :   */
+                /* undef  : cccc 0000 0111 xxxx xxxx xxxx 1001 xxxx :   */
                 /* UMULL  : cccc 0000 1000 xxxx xxxx xxxx 1001 xxxx :   */
                 /* UMULLS : cccc 0000 1001 xxxx xxxx xxxx 1001 xxxx :cc */
                 /* UMLAL  : cccc 0000 1010 xxxx xxxx xxxx 1001 xxxx :   */
@@ -1078,13 +1095,15 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                 /* SMULLS : cccc 0000 1101 xxxx xxxx xxxx 1001 xxxx :cc */
                 /* SMLAL  : cccc 0000 1110 xxxx xxxx xxxx 1001 xxxx :   */
                 /* SMLALS : cccc 0000 1111 xxxx xxxx xxxx 1001 xxxx :cc */
-                if ((insn & 0x0fe000f0) == 0x00000090) {
-                       return prep_emulate_rd16rs8rm0_wflags(insn, asi);
-                } else if  ((insn & 0x0fe000f0) == 0x00200090) {
-                       return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
-                } else {
-                       return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn, asi);
-                }
+                if ((insn & 0x00d00000) == 0x00500000)
+                        return INSN_REJECTED;
+                else if ((insn & 0x00e00000) == 0x00000000)
+                        return prep_emulate_rd16rs8rm0_wflags(insn, asi);
+                else if ((insn & 0x00a00000) == 0x00200000)
+                        return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
+                else
+                        return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn,
+                                                                        asi);
         }
 
         /* cccc 000x xxxx xxxx xxxx xxxx xxxx 1xx1 xxxx */
@@ -1092,23 +1111,45 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 
                 /* SWP   : cccc 0001 0000 xxxx xxxx xxxx 1001 xxxx */
                 /* SWPB  : cccc 0001 0100 xxxx xxxx xxxx 1001 xxxx */
-                /* LDRD  : cccc 000x xxx0 xxxx xxxx xxxx 1101 xxxx */
-                /* STRD  : cccc 000x xxx0 xxxx xxxx xxxx 1111 xxxx */
+                /* ???   : cccc 0001 0x01 xxxx xxxx xxxx 1001 xxxx */
+                /* ???   : cccc 0001 0x10 xxxx xxxx xxxx 1001 xxxx */
+                /* ???   : cccc 0001 0x11 xxxx xxxx xxxx 1001 xxxx */
                 /* STREX : cccc 0001 1000 xxxx xxxx xxxx 1001 xxxx */
                 /* LDREX : cccc 0001 1001 xxxx xxxx xxxx 1001 xxxx */
+                /* STREXD: cccc 0001 1010 xxxx xxxx xxxx 1001 xxxx */
+                /* LDREXD: cccc 0001 1011 xxxx xxxx xxxx 1001 xxxx */
+                /* STREXB: cccc 0001 1100 xxxx xxxx xxxx 1001 xxxx */
+                /* LDREXB: cccc 0001 1101 xxxx xxxx xxxx 1001 xxxx */
+                /* STREXH: cccc 0001 1110 xxxx xxxx xxxx 1001 xxxx */
+                /* LDREXH: cccc 0001 1111 xxxx xxxx xxxx 1001 xxxx */
+
+                /* LDRD  : cccc 000x xxx0 xxxx xxxx xxxx 1101 xxxx */
+                /* STRD  : cccc 000x xxx0 xxxx xxxx xxxx 1111 xxxx */
                 /* LDRH  : cccc 000x xxx1 xxxx xxxx xxxx 1011 xxxx */
                 /* STRH  : cccc 000x xxx0 xxxx xxxx xxxx 1011 xxxx */
                 /* LDRSB : cccc 000x xxx1 xxxx xxxx xxxx 1101 xxxx */
                 /* LDRSH : cccc 000x xxx1 xxxx xxxx xxxx 1111 xxxx */
-                if ((insn & 0x0fb000f0) == 0x01000090) {
-                        /* SWP/SWPB */
-                        return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+                if ((insn & 0x0f0000f0) == 0x01000090) {
+                        if ((insn & 0x0fb000f0) == 0x01000090) {
+                                /* SWP/SWPB */
+                                return prep_emulate_rd12rn16rm0_wflags(insn,
+                                                                        asi);
+                        } else {
+                                /* STREX/LDREX variants and unallocaed space */
+                                return INSN_REJECTED;
+                        }
+
                 } else if ((insn & 0x0e1000d0) == 0x00000d0) {
                         /* STRD/LDRD */
+                        if ((insn & 0x0000e000) == 0x0000e000)
+                                return INSN_REJECTED;   /* Rd is LR or PC */
+                        if (is_writeback(insn) && is_r15(insn, 16))
+                                return INSN_REJECTED;   /* Writeback to PC */
+
                         insn &= 0xfff00fff;
                         insn |= 0x00002000;     /* Rn = r0, Rd = r2 */
-                        if (insn & (1 << 22)) {
-                                /* I bit */
+                        if (!(insn & (1 << 22))) {
+                                /* Register index */
                                 insn &= ~0xf;
                                 insn |= 1;      /* Rm = r1 */
                         }
@@ -1118,6 +1159,9 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                         return INSN_GOOD;
                 }
 
+                /* LDRH/STRH/LDRSB/LDRSH */
+                if (is_r15(insn, 12))
+                        return INSN_REJECTED;   /* Rd is PC */
                 return prep_emulate_ldr_str(insn, asi);
         }
 
@@ -1125,7 +1169,7 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 
         /*
          * ALU op with S bit and Rd == 15 :
-         *      cccc 000x xxx1 xxxx 1111 xxxx xxxx xxxx
+         *      cccc 000x xxx1 xxxx 1111 xxxx xxxx xxxx
          */
         if ((insn & 0x0e10f000) == 0x0010f000)
                 return INSN_REJECTED;
@@ -1154,22 +1198,61 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                 insn |= 0x00000200;     /* Rs = r2 */
         }
         asi->insn[0] = insn;
-        asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
+
+        if ((insn & 0x0f900000) == 0x01100000) {
+                /*
+                 * TST : cccc 0001 0001 xxxx xxxx xxxx xxxx xxxx
+                 * TEQ : cccc 0001 0011 xxxx xxxx xxxx xxxx xxxx
+                 * CMP : cccc 0001 0101 xxxx xxxx xxxx xxxx xxxx
+                 * CMN : cccc 0001 0111 xxxx xxxx xxxx xxxx xxxx
+                 */
+                asi->insn_handler = emulate_alu_tests;
+        } else {
+                /* ALU ops which write to Rd */
+                asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
                                 emulate_alu_rwflags : emulate_alu_rflags;
+        }
         return INSN_GOOD;
 }
 
 static enum kprobe_insn __kprobes
 space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
+        /* MOVW  : cccc 0011 0000 xxxx xxxx xxxx xxxx xxxx */
+        /* MOVT  : cccc 0011 0100 xxxx xxxx xxxx xxxx xxxx */
+        if ((insn & 0x0fb00000) == 0x03000000)
+                return prep_emulate_rd12_modify(insn, asi);
+
+        /* hints : cccc 0011 0010 0000 xxxx xxxx xxxx xxxx */
+        if ((insn & 0x0fff0000) == 0x03200000) {
+                unsigned op2 = insn & 0x000000ff;
+                if (op2 == 0x01 || op2 == 0x04) {
+                        /* YIELD : cccc 0011 0010 0000 xxxx xxxx 0000 0001 */
+                        /* SEV   : cccc 0011 0010 0000 xxxx xxxx 0000 0100 */
+                        asi->insn[0] = insn;
+                        asi->insn_handler = emulate_none;
+                        return INSN_GOOD;
+                } else if (op2 <= 0x03) {
+                        /* NOP   : cccc 0011 0010 0000 xxxx xxxx 0000 0000 */
+                        /* WFE   : cccc 0011 0010 0000 xxxx xxxx 0000 0010 */
+                        /* WFI   : cccc 0011 0010 0000 xxxx xxxx 0000 0011 */
+                        /*
+                         * We make WFE and WFI true NOPs to avoid stalls due
+                         * to missing events whilst processing the probe.
+                         */
+                        asi->insn_handler = emulate_nop;
+                        return INSN_GOOD_NO_SLOT;
+                }
+                /* For DBG and unallocated hints it's safest to reject them */
+                return INSN_REJECTED;
+        }
+
         /*
          * MSR   : cccc 0011 0x10 xxxx xxxx xxxx xxxx xxxx
-         * Undef : cccc 0011 0100 xxxx xxxx xxxx xxxx xxxx
          * ALU op with S bit and Rd == 15 :
          *         cccc 001x xxx1 xxxx 1111 xxxx xxxx xxxx
          */
         if ((insn & 0x0fb00000) == 0x03200000 ||        /* MSR */
-            (insn & 0x0ff00000) == 0x03400000 ||        /* Undef */
             (insn & 0x0e10f000) == 0x0210f000)          /* ALU s-bit, R15  */
                 return INSN_REJECTED;
 
@@ -1180,10 +1263,22 @@ space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
          * *S (bit 20) updates condition codes
          * ADC/SBC/RSC reads the C flag
          */
-        insn &= 0xffff0fff;     /* Rd = r0 */
+        insn &= 0xfff00fff;     /* Rn = r0 and Rd = r0 */
         asi->insn[0] = insn;
-        asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
+
+        if ((insn & 0x0f900000) == 0x03100000) {
+                /*
+                 * TST : cccc 0011 0001 xxxx xxxx xxxx xxxx xxxx
+                 * TEQ : cccc 0011 0011 xxxx xxxx xxxx xxxx xxxx
+                 * CMP : cccc 0011 0101 xxxx xxxx xxxx xxxx xxxx
+                 * CMN : cccc 0011 0111 xxxx xxxx xxxx xxxx xxxx
+                 */
+                asi->insn_handler = emulate_alu_tests_imm;
+        } else {
+                /* ALU ops which write to Rd */
+                asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
                         emulate_alu_imm_rwflags : emulate_alu_imm_rflags;
+        }
         return INSN_GOOD;
 }
 
@@ -1192,6 +1287,8 @@ space_cccc_0110__1(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
         /* SEL : cccc 0110 1000 xxxx xxxx xxxx 1011 xxxx GE: !!! */
         if ((insn & 0x0ff000f0) == 0x068000b0) {
+                if (is_r15(insn, 12))
+                        return INSN_REJECTED;   /* Rd is PC */
                 insn &= 0xfff00ff0;     /* Rd = r0, Rn = r0 */
                 insn |= 0x00000001;     /* Rm = r1 */
                 asi->insn[0] = insn;
@@ -1205,6 +1302,8 @@ space_cccc_0110__1(kprobe_opcode_t insn, struct arch_specific_insn *asi)
         /* USAT16 : cccc 0110 1110 xxxx xxxx xxxx 0011 xxxx :Q */
         if ((insn & 0x0fa00030) == 0x06a00010 ||
             (insn & 0x0fb000f0) == 0x06a00030) {
+                if (is_r15(insn, 12))
+                        return INSN_REJECTED;   /* Rd is PC */
                 insn &= 0xffff0ff0;     /* Rd = r0, Rm = r0 */
                 asi->insn[0] = insn;
                 asi->insn_handler = emulate_sat;
@@ -1213,57 +1312,101 @@ space_cccc_0110__1(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 
         /* REV    : cccc 0110 1011 xxxx xxxx xxxx 0011 xxxx */
         /* REV16  : cccc 0110 1011 xxxx xxxx xxxx 1011 xxxx */
+        /* RBIT   : cccc 0110 1111 xxxx xxxx xxxx 0011 xxxx */
         /* REVSH  : cccc 0110 1111 xxxx xxxx xxxx 1011 xxxx */
         if ((insn & 0x0ff00070) == 0x06b00030 ||
-            (insn & 0x0ff000f0) == 0x06f000b0)
+            (insn & 0x0ff00070) == 0x06f00030)
                 return prep_emulate_rd12rm0(insn, asi);
 
+        /* ???       : cccc 0110 0000 xxxx xxxx xxxx xxx1 xxxx :   */
         /* SADD16    : cccc 0110 0001 xxxx xxxx xxxx 0001 xxxx :GE */
         /* SADDSUBX  : cccc 0110 0001 xxxx xxxx xxxx 0011 xxxx :GE */
         /* SSUBADDX  : cccc 0110 0001 xxxx xxxx xxxx 0101 xxxx :GE */
         /* SSUB16    : cccc 0110 0001 xxxx xxxx xxxx 0111 xxxx :GE */
         /* SADD8     : cccc 0110 0001 xxxx xxxx xxxx 1001 xxxx :GE */
+        /* ???       : cccc 0110 0001 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0001 xxxx xxxx xxxx 1101 xxxx :   */
         /* SSUB8     : cccc 0110 0001 xxxx xxxx xxxx 1111 xxxx :GE */
         /* QADD16    : cccc 0110 0010 xxxx xxxx xxxx 0001 xxxx :   */
         /* QADDSUBX  : cccc 0110 0010 xxxx xxxx xxxx 0011 xxxx :   */
         /* QSUBADDX  : cccc 0110 0010 xxxx xxxx xxxx 0101 xxxx :   */
         /* QSUB16    : cccc 0110 0010 xxxx xxxx xxxx 0111 xxxx :   */
         /* QADD8     : cccc 0110 0010 xxxx xxxx xxxx 1001 xxxx :   */
+        /* ???       : cccc 0110 0010 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0010 xxxx xxxx xxxx 1101 xxxx :   */
         /* QSUB8     : cccc 0110 0010 xxxx xxxx xxxx 1111 xxxx :   */
         /* SHADD16   : cccc 0110 0011 xxxx xxxx xxxx 0001 xxxx :   */
         /* SHADDSUBX : cccc 0110 0011 xxxx xxxx xxxx 0011 xxxx :   */
         /* SHSUBADDX : cccc 0110 0011 xxxx xxxx xxxx 0101 xxxx :   */
         /* SHSUB16   : cccc 0110 0011 xxxx xxxx xxxx 0111 xxxx :   */
         /* SHADD8    : cccc 0110 0011 xxxx xxxx xxxx 1001 xxxx :   */
+        /* ???       : cccc 0110 0011 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0011 xxxx xxxx xxxx 1101 xxxx :   */
         /* SHSUB8    : cccc 0110 0011 xxxx xxxx xxxx 1111 xxxx :   */
+        /* ???       : cccc 0110 0100 xxxx xxxx xxxx xxx1 xxxx :   */
         /* UADD16    : cccc 0110 0101 xxxx xxxx xxxx 0001 xxxx :GE */
         /* UADDSUBX  : cccc 0110 0101 xxxx xxxx xxxx 0011 xxxx :GE */
         /* USUBADDX  : cccc 0110 0101 xxxx xxxx xxxx 0101 xxxx :GE */
         /* USUB16    : cccc 0110 0101 xxxx xxxx xxxx 0111 xxxx :GE */
         /* UADD8     : cccc 0110 0101 xxxx xxxx xxxx 1001 xxxx :GE */
+        /* ???       : cccc 0110 0101 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0101 xxxx xxxx xxxx 1101 xxxx :   */
         /* USUB8     : cccc 0110 0101 xxxx xxxx xxxx 1111 xxxx :GE */
         /* UQADD16   : cccc 0110 0110 xxxx xxxx xxxx 0001 xxxx :   */
         /* UQADDSUBX : cccc 0110 0110 xxxx xxxx xxxx 0011 xxxx :   */
         /* UQSUBADDX : cccc 0110 0110 xxxx xxxx xxxx 0101 xxxx :   */
         /* UQSUB16   : cccc 0110 0110 xxxx xxxx xxxx 0111 xxxx :   */
         /* UQADD8    : cccc 0110 0110 xxxx xxxx xxxx 1001 xxxx :   */
+        /* ???       : cccc 0110 0110 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0110 xxxx xxxx xxxx 1101 xxxx :   */
         /* UQSUB8    : cccc 0110 0110 xxxx xxxx xxxx 1111 xxxx :   */
         /* UHADD16   : cccc 0110 0111 xxxx xxxx xxxx 0001 xxxx :   */
         /* UHADDSUBX : cccc 0110 0111 xxxx xxxx xxxx 0011 xxxx :   */
         /* UHSUBADDX : cccc 0110 0111 xxxx xxxx xxxx 0101 xxxx :   */
         /* UHSUB16   : cccc 0110 0111 xxxx xxxx xxxx 0111 xxxx :   */
         /* UHADD8    : cccc 0110 0111 xxxx xxxx xxxx 1001 xxxx :   */
+        /* ???       : cccc 0110 0111 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0111 xxxx xxxx xxxx 1101 xxxx :   */
         /* UHSUB8    : cccc 0110 0111 xxxx xxxx xxxx 1111 xxxx :   */
+        if ((insn & 0x0f800010) == 0x06000010) {
+                if ((insn & 0x00300000) == 0x00000000 ||
+                    (insn & 0x000000e0) == 0x000000a0 ||
+                    (insn & 0x000000e0) == 0x000000c0)
+                        return INSN_REJECTED;   /* Unallocated space */
+                return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+        }
+
         /* PKHBT     : cccc 0110 1000 xxxx xxxx xxxx x001 xxxx :   */
         /* PKHTB     : cccc 0110 1000 xxxx xxxx xxxx x101 xxxx :   */
+        if ((insn & 0x0ff00030) == 0x06800010)
+                return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+
         /* SXTAB16   : cccc 0110 1000 xxxx xxxx xxxx 0111 xxxx :   */
-        /* SXTB      : cccc 0110 1010 xxxx xxxx xxxx 0111 xxxx :   */
+        /* SXTB16    : cccc 0110 1000 1111 xxxx xxxx 0111 xxxx :   */
+        /* ???       : cccc 0110 1001 xxxx xxxx xxxx 0111 xxxx :   */
         /* SXTAB     : cccc 0110 1010 xxxx xxxx xxxx 0111 xxxx :   */
+        /* SXTB      : cccc 0110 1010 1111 xxxx xxxx 0111 xxxx :   */
         /* SXTAH     : cccc 0110 1011 xxxx xxxx xxxx 0111 xxxx :   */
+        /* SXTH      : cccc 0110 1011 1111 xxxx xxxx 0111 xxxx :   */
         /* UXTAB16   : cccc 0110 1100 xxxx xxxx xxxx 0111 xxxx :   */
+        /* UXTB16    : cccc 0110 1100 1111 xxxx xxxx 0111 xxxx :   */
+        /* ???       : cccc 0110 1101 xxxx xxxx xxxx 0111 xxxx :   */
         /* UXTAB     : cccc 0110 1110 xxxx xxxx xxxx 0111 xxxx :   */
+        /* UXTB      : cccc 0110 1110 1111 xxxx xxxx 0111 xxxx :   */
         /* UXTAH     : cccc 0110 1111 xxxx xxxx xxxx 0111 xxxx :   */
-        return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+        /* UXTH      : cccc 0110 1111 1111 xxxx xxxx 0111 xxxx :   */
+        if ((insn & 0x0f8000f0) == 0x06800070) {
+                if ((insn & 0x00300000) == 0x00100000)
+                        return INSN_REJECTED;   /* Unallocated space */
+
+                if ((insn & 0x000f0000) == 0x000f0000)
+                        return prep_emulate_rd12rm0(insn, asi);
+                else
+                        return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+        }
+
+        /* Other instruction encodings aren't yet defined */
+        return INSN_REJECTED;
 }
 
 static enum kprobe_insn __kprobes
@@ -1273,29 +1416,49 @@ space_cccc_0111__1(kprobe_opcode_t insn, struct arch_specific_insn *asi)
         if ((insn & 0x0ff000f0) == 0x03f000f0)
                 return INSN_REJECTED;
 
-        /* USADA8 : cccc 0111 1000 xxxx xxxx xxxx 0001 xxxx */
-        /* USAD8  : cccc 0111 1000 xxxx 1111 xxxx 0001 xxxx */
-        if ((insn & 0x0ff000f0) == 0x07800010)
-                 return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
-
         /* SMLALD : cccc 0111 0100 xxxx xxxx xxxx 00x1 xxxx */
         /* SMLSLD : cccc 0111 0100 xxxx xxxx xxxx 01x1 xxxx */
         if ((insn & 0x0ff00090) == 0x07400010)
                 return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn, asi);
 
         /* SMLAD  : cccc 0111 0000 xxxx xxxx xxxx 00x1 xxxx :Q */
+        /* SMUAD  : cccc 0111 0000 xxxx 1111 xxxx 00x1 xxxx :Q */
         /* SMLSD  : cccc 0111 0000 xxxx xxxx xxxx 01x1 xxxx :Q */
+        /* SMUSD  : cccc 0111 0000 xxxx 1111 xxxx 01x1 xxxx :  */
         /* SMMLA  : cccc 0111 0101 xxxx xxxx xxxx 00x1 xxxx :  */
-        /* SMMLS  : cccc 0111 0101 xxxx xxxx xxxx 11x1 xxxx :  */
+        /* SMMUL  : cccc 0111 0101 xxxx 1111 xxxx 00x1 xxxx :  */
+        /* USADA8 : cccc 0111 1000 xxxx xxxx xxxx 0001 xxxx :  */
+        /* USAD8  : cccc 0111 1000 xxxx 1111 xxxx 0001 xxxx :  */
         if ((insn & 0x0ff00090) == 0x07000010 ||
             (insn & 0x0ff000d0) == 0x07500010 ||
-            (insn & 0x0ff000d0) == 0x075000d0)
+            (insn & 0x0ff000f0) == 0x07800010) {
+
+                if ((insn & 0x0000f000) == 0x0000f000)
+                        return prep_emulate_rd16rs8rm0_wflags(insn, asi);
+                else
+                        return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
+        }
+
+        /* SMMLS  : cccc 0111 0101 xxxx xxxx xxxx 11x1 xxxx :  */
+        if ((insn & 0x0ff000d0) == 0x075000d0)
                 return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
 
-        /* SMUSD  : cccc 0111 0000 xxxx xxxx xxxx 01x1 xxxx :  */
-        /* SMUAD  : cccc 0111 0000 xxxx 1111 xxxx 00x1 xxxx :Q */
-        /* SMMUL  : cccc 0111 0101 xxxx 1111 xxxx 00x1 xxxx :  */
-        return prep_emulate_rd16rs8rm0_wflags(insn, asi);
+        /* SBFX   : cccc 0111 101x xxxx xxxx xxxx x101 xxxx :  */
+        /* UBFX   : cccc 0111 111x xxxx xxxx xxxx x101 xxxx :  */
+        if ((insn & 0x0fa00070) == 0x07a00050)
+                return prep_emulate_rd12rm0(insn, asi);
+
+        /* BFI    : cccc 0111 110x xxxx xxxx xxxx x001 xxxx :  */
+        /* BFC    : cccc 0111 110x xxxx xxxx xxxx x001 1111 :  */
+        if ((insn & 0x0fe00070) == 0x07c00010) {
+
+                if ((insn & 0x0000000f) == 0x0000000f)
+                        return prep_emulate_rd12_modify(insn, asi);
+                else
+                        return prep_emulate_rd12rn0_modify(insn, asi);
+        }
+
+        return INSN_REJECTED;
 }
 
 static enum kprobe_insn __kprobes
@@ -1309,6 +1472,10 @@ space_cccc_01xx(kprobe_opcode_t insn, struct arch_specific_insn *asi)
         /* STRB  : cccc 01xx x1x0 xxxx xxxx xxxx xxxx xxxx */
         /* STRBT : cccc 01x0 x110 xxxx xxxx xxxx xxxx xxxx */
         /* STRT  : cccc 01x0 x010 xxxx xxxx xxxx xxxx xxxx */
+
+        if ((insn & 0x00500000) == 0x00500000 && is_r15(insn, 12))
+                return INSN_REJECTED;   /* LDRB into PC */
+
         return prep_emulate_ldr_str(insn, asi);
 }
 
@@ -1323,10 +1490,9 @@ space_cccc_100x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 
         /* LDM(1) : cccc 100x x0x1 xxxx xxxx xxxx xxxx xxxx */
         /* STM(1) : cccc 100x x0x0 xxxx xxxx xxxx xxxx xxxx */
-        asi->insn[0] = truecc_insn(insn);
         asi->insn_handler = ((insn & 0x108000) == 0x008000) ? /* STM & R15 */
                                 simulate_stm1_pc : simulate_ldm1stm1;
-        return INSN_GOOD;
+        return INSN_GOOD_NO_SLOT;
 }
 
 static enum kprobe_insn __kprobes
@@ -1334,58 +1500,117 @@ space_cccc_101x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
         /* B  : cccc 1010 xxxx xxxx xxxx xxxx xxxx xxxx */
         /* BL : cccc 1011 xxxx xxxx xxxx xxxx xxxx xxxx */
-        asi->insn[0] = truecc_insn(insn);
         asi->insn_handler = simulate_bbl;
-        return INSN_GOOD;
+        return INSN_GOOD_NO_SLOT;
 }
 
 static enum kprobe_insn __kprobes
-space_cccc_1100_010x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+space_cccc_11xx(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
+        /* Coprocessor instructions... */
         /* MCRR : cccc 1100 0100 xxxx xxxx xxxx xxxx xxxx : (Rd!=Rn) */
         /* MRRC : cccc 1100 0101 xxxx xxxx xxxx xxxx xxxx : (Rd!=Rn) */
-        insn &= 0xfff00fff;
-        insn |= 0x00001000;     /* Rn = r0, Rd = r1 */
-        asi->insn[0] = insn;
-        asi->insn_handler = (insn & (1 << 20)) ? emulate_mrrc : emulate_mcrr;
-        return INSN_GOOD;
+        /* LDC  : cccc 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
+        /* STC  : cccc 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
+        /* CDP  : cccc 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
+        /* MCR  : cccc 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
+        /* MRC  : cccc 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
+
+        /* SVC  : cccc 1111 xxxx xxxx xxxx xxxx xxxx xxxx */
+
+        return INSN_REJECTED;
 }
 
-static enum kprobe_insn __kprobes
-space_cccc_110x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+static unsigned long __kprobes __check_eq(unsigned long cpsr)
 {
-        /* LDC : cccc 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
-        /* STC : cccc 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
-        insn &= 0xfff0ffff;     /* Rn = r0 */
-        asi->insn[0] = insn;
-        asi->insn_handler = emulate_ldcstc;
-        return INSN_GOOD;
+        return cpsr & PSR_Z_BIT;
 }
 
-static enum kprobe_insn __kprobes
-space_cccc_111x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+static unsigned long __kprobes __check_ne(unsigned long cpsr)
 {
-        /* BKPT : 1110 0001 0010 xxxx xxxx xxxx 0111 xxxx */
-        /* SWI  : cccc 1111 xxxx xxxx xxxx xxxx xxxx xxxx */
-        if ((insn & 0xfff000f0) == 0xe1200070 ||
-            (insn & 0x0f000000) == 0x0f000000)
-                return INSN_REJECTED;
+        return (~cpsr) & PSR_Z_BIT;
+}
 
-        /* CDP : cccc 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
-        if ((insn & 0x0f000010) == 0x0e000000) {
-                asi->insn[0] = insn;
-                asi->insn_handler = emulate_none;
-                return INSN_GOOD;
-        }
+static unsigned long __kprobes __check_cs(unsigned long cpsr)
+{
+        return cpsr & PSR_C_BIT;
+}
 
-        /* MCR : cccc 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
-        /* MRC : cccc 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
-        insn &= 0xffff0fff;     /* Rd = r0 */
-        asi->insn[0] = insn;
-        asi->insn_handler = (insn & (1 << 20)) ? emulate_rd12 : emulate_ird12;
-        return INSN_GOOD;
+static unsigned long __kprobes __check_cc(unsigned long cpsr)
+{
+        return (~cpsr) & PSR_C_BIT;
+}
+
+static unsigned long __kprobes __check_mi(unsigned long cpsr)
+{
+        return cpsr & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_pl(unsigned long cpsr)
+{
+        return (~cpsr) & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_vs(unsigned long cpsr)
+{
+        return cpsr & PSR_V_BIT;
+}
+
+static unsigned long __kprobes __check_vc(unsigned long cpsr)
+{
+        return (~cpsr) & PSR_V_BIT;
+}
+
+static unsigned long __kprobes __check_hi(unsigned long cpsr)
+{
+        cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */
+        return cpsr & PSR_C_BIT;
 }
 
+static unsigned long __kprobes __check_ls(unsigned long cpsr)
+{
+        cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */
+        return (~cpsr) & PSR_C_BIT;
+}
+
+static unsigned long __kprobes __check_ge(unsigned long cpsr)
+{
+        cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
+        return (~cpsr) & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_lt(unsigned long cpsr)
+{
+        cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
+        return cpsr & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_gt(unsigned long cpsr)
+{
+        unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
+        temp |= (cpsr << 1);                     /* PSR_N_BIT |= PSR_Z_BIT */
+        return (~temp) & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_le(unsigned long cpsr)
+{
+        unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
+        temp |= (cpsr << 1);                     /* PSR_N_BIT |= PSR_Z_BIT */
+        return temp & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_al(unsigned long cpsr)
+{
+        return true;
+}
+
+static kprobe_check_cc * const condition_checks[16] = {
+        &__check_eq, &__check_ne, &__check_cs, &__check_cc,
+        &__check_mi, &__check_pl, &__check_vs, &__check_vc,
+        &__check_hi, &__check_ls, &__check_ge, &__check_lt,
+        &__check_gt, &__check_le, &__check_al, &__check_al
+};
+
 /* Return:
  *   INSN_REJECTED     If instruction is one not allowed to kprobe,
  *   INSN_GOOD         If instruction is supported and uses instruction slot,
@@ -1401,133 +1626,45 @@ space_cccc_111x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 enum kprobe_insn __kprobes
 arm_kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
+        asi->insn_check_cc = condition_checks[insn>>28];
         asi->insn[1] = KPROBE_RETURN_INSTRUCTION;
 
-        if ((insn & 0xf0000000) == 0xf0000000) {
+        if ((insn & 0xf0000000) == 0xf0000000)
 
                 return space_1111(insn, asi);
 
-        } else if ((insn & 0x0e000000) == 0x00000000) {
+        else if ((insn & 0x0e000000) == 0x00000000)
 
                 return space_cccc_000x(insn, asi);
 
-        } else if ((insn & 0x0e000000) == 0x02000000) {
+        else if ((insn & 0x0e000000) == 0x02000000)
 
                 return space_cccc_001x(insn, asi);
 
-        } else if ((insn & 0x0f000010) == 0x06000010) {
+        else if ((insn & 0x0f000010) == 0x06000010)
 
                 return space_cccc_0110__1(insn, asi);
 
-        } else if ((insn & 0x0f000010) == 0x07000010) {
+        else if ((insn & 0x0f000010) == 0x07000010)
 
                 return space_cccc_0111__1(insn, asi);
 
-        } else if ((insn & 0x0c000000) == 0x04000000) {
+        else if ((insn & 0x0c000000) == 0x04000000)
 
                 return space_cccc_01xx(insn, asi);
 
-        } else if ((insn & 0x0e000000) == 0x08000000) {
+        else if ((insn & 0x0e000000) == 0x08000000)
 
                 return space_cccc_100x(insn, asi);
 
-        } else if ((insn & 0x0e000000) == 0x0a000000) {
+        else if ((insn & 0x0e000000) == 0x0a000000)
 
                 return space_cccc_101x(insn, asi);
 
-        } else if ((insn & 0x0fe00000) == 0x0c400000) {
-
-                return space_cccc_1100_010x(insn, asi);
-
-        } else if ((insn & 0x0e000000) == 0x0c000000) {
-
-                return space_cccc_110x(insn, asi);
-
-        }
-
-        return space_cccc_111x(insn, asi);
+        return space_cccc_11xx(insn, asi);
 }
 
 void __init arm_kprobe_decode_init(void)
 {
         find_str_pc_offset();
 }
-
-
-/*
- * All ARM instructions listed below.
- *
- * Instructions and their general purpose registers are given.
- * If a particular register may not use R15, it is prefixed with a "!".
- * If marked with a "*" means the value returned by reading R15
- * is implementation defined.
- *
- * ADC/ADD/AND/BIC/CMN/CMP/EOR/MOV/MVN/ORR/RSB/RSC/SBC/SUB/TEQ
- *     TST: Rd, Rn, Rm, !Rs
- * BX: Rm
- * BLX(2): !Rm
- * BX: Rm (R15 legal, but discouraged)
- * BXJ: !Rm,
- * CLZ: !Rd, !Rm
- * CPY: Rd, Rm
- * LDC/2,STC/2 immediate offset & unindex: Rn
- * LDC/2,STC/2 immediate pre/post-indexed: !Rn
- * LDM(1/3): !Rn, register_list
- * LDM(2): !Rn, !register_list
- * LDR,STR,PLD immediate offset: Rd, Rn
- * LDR,STR,PLD register offset: Rd, Rn, !Rm
- * LDR,STR,PLD scaled register offset: Rd, !Rn, !Rm
- * LDR,STR immediate pre/post-indexed: Rd, !Rn
- * LDR,STR register pre/post-indexed: Rd, !Rn, !Rm
- * LDR,STR scaled register pre/post-indexed: Rd, !Rn, !Rm
- * LDRB,STRB immediate offset: !Rd, Rn
- * LDRB,STRB register offset: !Rd, Rn, !Rm
- * LDRB,STRB scaled register offset: !Rd, !Rn, !Rm
- * LDRB,STRB immediate pre/post-indexed: !Rd, !Rn
- * LDRB,STRB register pre/post-indexed: !Rd, !Rn, !Rm
- * LDRB,STRB scaled register pre/post-indexed: !Rd, !Rn, !Rm
- * LDRT,LDRBT,STRBT immediate pre/post-indexed: !Rd, !Rn
- * LDRT,LDRBT,STRBT register pre/post-indexed: !Rd, !Rn, !Rm
- * LDRT,LDRBT,STRBT scaled register pre/post-indexed: !Rd, !Rn, !Rm
- * LDRH/SH/SB/D,STRH/SH/SB/D immediate offset: !Rd, Rn
- * LDRH/SH/SB/D,STRH/SH/SB/D register offset: !Rd, Rn, !Rm
- * LDRH/SH/SB/D,STRH/SH/SB/D immediate pre/post-indexed: !Rd, !Rn
- * LDRH/SH/SB/D,STRH/SH/SB/D register pre/post-indexed: !Rd, !Rn, !Rm
- * LDREX: !Rd, !Rn
- * MCR/2: !Rd
- * MCRR/2,MRRC/2: !Rd, !Rn
- * MLA: !Rd, !Rn, !Rm, !Rs
- * MOV: Rd
- * MRC/2: !Rd (if Rd==15, only changes cond codes, not the register)
- * MRS,MSR: !Rd
- * MUL: !Rd, !Rm, !Rs
- * PKH{BT,TB}: !Rd, !Rn, !Rm
- * QDADD,[U]QADD/16/8/SUBX: !Rd, !Rm, !Rn
- * QDSUB,[U]QSUB/16/8/ADDX: !Rd, !Rm, !Rn
- * REV/16/SH: !Rd, !Rm
- * RFE: !Rn
- * {S,U}[H]ADD{16,8,SUBX},{S,U}[H]SUB{16,8,ADDX}: !Rd, !Rn, !Rm
- * SEL: !Rd, !Rn, !Rm
- * SMLA<x><y>,SMLA{D,W<y>},SMLSD,SMML{A,S}: !Rd, !Rn, !Rm, !Rs
- * SMLAL<x><y>,SMLA{D,LD},SMLSLD,SMMULL,SMULW<y>: !RdHi, !RdLo, !Rm, !Rs
- * SMMUL,SMUAD,SMUL<x><y>,SMUSD: !Rd, !Rm, !Rs
- * SSAT/16: !Rd, !Rm
- * STM(1/2): !Rn, register_list* (R15 in reg list not recommended)
- * STRT immediate pre/post-indexed: Rd*, !Rn
- * STRT register pre/post-indexed: Rd*, !Rn, !Rm
- * STRT scaled register pre/post-indexed: Rd*, !Rn, !Rm
- * STREX: !Rd, !Rn, !Rm
- * SWP/B: !Rd, !Rn, !Rm
- * {S,U}XTA{B,B16,H}: !Rd, !Rn, !Rm
- * {S,U}XT{B,B16,H}: !Rd, !Rm
- * UM{AA,LA,UL}L: !RdHi, !RdLo, !Rm, !Rs
- * USA{D8,A8,T,T16}: !Rd, !Rm, !Rs
- *
- * May transfer control by writing R15 (possible mode changes or alternate
- * mode accesses marked by "*"):
- * ALU op (* with s-bit), B, BL, BKPT, BLX(1/2), BX, BXJ, CPS*, CPY,
- * LDM(1), LDM(2/3)*, LDR, MOV, RFE*, SWI*
- *
- * Instructions that do not take general registers, nor transfer control:
- * CDP/2, SETEND, SRS*
- */
diff --git a/arch/arm/kernel/kprobes.c b/arch/arm/kernel/kprobes.c
index 2ba7deb3072e..1656c87501c0 100644
--- a/arch/arm/kernel/kprobes.c
+++ b/arch/arm/kernel/kprobes.c
@@ -134,7 +134,8 @@ static void __kprobes singlestep(struct kprobe *p, struct pt_regs *regs,
                                  struct kprobe_ctlblk *kcb)
 {
         regs->ARM_pc += 4;
-        p->ainsn.insn_handler(p, regs);
+        if (p->ainsn.insn_check_cc(regs->ARM_cpsr))
+                p->ainsn.insn_handler(p, regs);
 }
 
 /*
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 69cfee0fe00f..139e3c827369 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -221,7 +221,7 @@ again:
         prev_raw_count &= armpmu->max_period;
 
         if (overflow)
-                delta = armpmu->max_period - prev_raw_count + new_raw_count;
+                delta = armpmu->max_period - prev_raw_count + new_raw_count + 1;
         else
                 delta = new_raw_count - prev_raw_count;
 
@@ -746,7 +746,8 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
 
         tail = (struct frame_tail __user *)regs->ARM_fp - 1;
 
-        while (tail && !((unsigned long)tail & 0x3))
+        while ((entry->nr < PERF_MAX_STACK_DEPTH) &&
+               tail && !((unsigned long)tail & 0x3))
                 tail = user_backtrace(tail, entry);
 }
 
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 94bbedbed639..5e1e54197227 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -372,6 +372,8 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start,
         if (clone_flags & CLONE_SETTLS)
                 thread->tp_value = regs->ARM_r3;
 
+        thread_notify(THREAD_NOTIFY_COPY, thread);
+
         return 0;
 }
 
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 8fe05ad932e4..f29b8a29b174 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -479,7 +479,7 @@ static void broadcast_timer_set_mode(enum clock_event_mode mode,
 {
 }
 
-static void broadcast_timer_setup(struct clock_event_device *evt)
+static void __cpuinit broadcast_timer_setup(struct clock_event_device *evt)
 {
         evt->name       = "dummy_timer";
         evt->features   = CLOCK_EVT_FEAT_ONESHOT |
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index 4ad8da15ef2b..af0aaebf4de6 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int semid,
         long err;
         int i;
 
-        if (nsops < 1)
+        if (nsops < 1 || nsops > SEMOPM)
                 return -EINVAL;
         sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
         if (!sops)
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index f0000e188c8c..3b54ad19d489 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -410,8 +410,7 @@ static int bad_syscall(int n, struct pt_regs *regs)
         struct thread_info *thread = current_thread_info();
         siginfo_t info;
 
-        if (current->personality != PER_LINUX &&
-            current->personality != PER_LINUX_32BIT &&
+        if ((current->personality & PER_MASK) != PER_LINUX &&
             thread->exec_domain->handler) {
                 thread->exec_domain->handler(n, regs);
                 return regs->ARM_r0;
diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig
index 32f147998cd9..c0deacae778d 100644
--- a/arch/arm/mach-davinci/Kconfig
+++ b/arch/arm/mach-davinci/Kconfig
@@ -63,6 +63,7 @@ config MACH_DAVINCI_EVM
         depends on ARCH_DAVINCI_DM644x
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Configure this option to specify the whether the board used
           for development is a DM644x EVM
@@ -72,6 +73,7 @@ config MACH_SFFSDR
         depends on ARCH_DAVINCI_DM644x
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Say Y here to select the Lyrtech Small Form Factor
           Software Defined Radio (SFFSDR) board.
@@ -105,6 +107,7 @@ config MACH_DAVINCI_DM6467_EVM
         select MACH_DAVINCI_DM6467TEVM
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Configure this option to specify the whether the board used
           for development is a DM6467 EVM
@@ -118,6 +121,7 @@ config MACH_DAVINCI_DM365_EVM
         depends on ARCH_DAVINCI_DM365
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Configure this option to specify whether the board used
           for development is a DM365 EVM
@@ -129,6 +133,7 @@ config MACH_DAVINCI_DA830_EVM
         select GPIO_PCF857X
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Say Y here to select the TI DA830/OMAP-L137/AM17x Evaluation Module.
 
@@ -205,6 +210,7 @@ config MACH_MITYOMAPL138
         depends on ARCH_DAVINCI_DA850
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Say Y here to select the Critical Link MityDSP-L138/MityARM-1808
           System on Module.  Information on this SoM may be found at
diff --git a/arch/arm/mach-davinci/board-mityomapl138.c b/arch/arm/mach-davinci/board-mityomapl138.c
index 2aa79c54f98e..606a6f27ed6c 100644
--- a/arch/arm/mach-davinci/board-mityomapl138.c
+++ b/arch/arm/mach-davinci/board-mityomapl138.c
@@ -29,7 +29,7 @@
 #include <mach/mux.h>
 #include <mach/spi.h>
 
-#define MITYOMAPL138_PHY_ID             "0:03"
+#define MITYOMAPL138_PHY_ID             ""
 
 #define FACTORY_CONFIG_MAGIC    0x012C0138
 #define FACTORY_CONFIG_VERSION  0x00010001
@@ -414,7 +414,7 @@ static struct resource mityomapl138_nandflash_resource[] = {
 
 static struct platform_device mityomapl138_nandflash_device = {
         .name           = "davinci_nand",
-        .id             = 0,
+        .id             = 1,
         .dev            = {
                 .platform_data  = &mityomapl138_nandflash_data,
         },
diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
index 625d4b66718b..58a02dc7b15a 100644
--- a/arch/arm/mach-davinci/devices-da8xx.c
+++ b/arch/arm/mach-davinci/devices-da8xx.c
@@ -39,7 +39,8 @@
 #define DA8XX_GPIO_BASE                 0x01e26000
 #define DA8XX_I2C1_BASE                 0x01e28000
 #define DA8XX_SPI0_BASE                 0x01c41000
-#define DA8XX_SPI1_BASE                 0x01f0e000
+#define DA830_SPI1_BASE                 0x01e12000
+#define DA850_SPI1_BASE                 0x01f0e000
 
 #define DA8XX_EMAC_CTRL_REG_OFFSET      0x3000
 #define DA8XX_EMAC_MOD_REG_OFFSET       0x2000
@@ -762,8 +763,8 @@ static struct resource da8xx_spi0_resources[] = {
 
 static struct resource da8xx_spi1_resources[] = {
         [0] = {
-                .start  = DA8XX_SPI1_BASE,
-                .end    = DA8XX_SPI1_BASE + SZ_4K - 1,
+                .start  = DA830_SPI1_BASE,
+                .end    = DA830_SPI1_BASE + SZ_4K - 1,
                 .flags  = IORESOURCE_MEM,
         },
         [1] = {
@@ -832,5 +833,10 @@ int __init da8xx_register_spi(int instance, struct spi_board_info *info,
 
         da8xx_spi_pdata[instance].num_chipselect = len;
 
+        if (instance == 1 && cpu_is_davinci_da850()) {
+                da8xx_spi1_resources[0].start = DA850_SPI1_BASE;
+                da8xx_spi1_resources[0].end = DA850_SPI1_BASE + SZ_4K - 1;
+        }
+
         return platform_device_register(&da8xx_spi_device[instance]);
 }
diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
index f68012239641..a3a94e9c9378 100644
--- a/arch/arm/mach-davinci/dm355.c
+++ b/arch/arm/mach-davinci/dm355.c
@@ -314,7 +314,7 @@ static struct clk timer2_clk = {
         .name = "timer2",
         .parent = &pll1_aux_clk,
         .lpsc = DAVINCI_LPSC_TIMER2,
-        .usecount = 1,              /* REVISIT: why can't' this be disabled? */
+        .usecount = 1,              /* REVISIT: why can't this be disabled? */
 };
 
 static struct clk timer3_clk = {
diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
index 5f8a65424184..4c82c2716293 100644
--- a/arch/arm/mach-davinci/dm644x.c
+++ b/arch/arm/mach-davinci/dm644x.c
@@ -274,7 +274,7 @@ static struct clk timer2_clk = {
         .name = "timer2",
         .parent = &pll1_aux_clk,
         .lpsc = DAVINCI_LPSC_TIMER2,
-        .usecount = 1,              /* REVISIT: why can't' this be disabled? */
+        .usecount = 1,              /* REVISIT: why can't this be disabled? */
 };
 
 static struct clk_lookup dm644x_clks[] = {
diff --git a/arch/arm/mach-davinci/include/mach/debug-macro.S b/arch/arm/mach-davinci/include/mach/debug-macro.S
index 9f1befc5ac38..f8b7ea4f6235 100644
--- a/arch/arm/mach-davinci/include/mach/debug-macro.S
+++ b/arch/arm/mach-davinci/include/mach/debug-macro.S
@@ -24,6 +24,9 @@
 
 #define UART_SHIFT      2
 
+#define davinci_uart_v2p(x)     ((x) - PAGE_OFFSET + PLAT_PHYS_OFFSET)
+#define davinci_uart_p2v(x)     ((x) - PLAT_PHYS_OFFSET + PAGE_OFFSET)
+
                 .pushsection .data
 davinci_uart_phys:      .word   0
 davinci_uart_virt:      .word   0
@@ -34,7 +37,7 @@ davinci_uart_virt:	.word	0
                 /* Use davinci_uart_phys/virt if already configured */
 10:             mrc     p15, 0, \rp, c1, c0
                 tst     \rp, #1                 @ MMU enabled?
-                ldreq   \rp, =__virt_to_phys(davinci_uart_phys)
+                ldreq   \rp, =davinci_uart_v2p(davinci_uart_phys)
                 ldrne   \rp, =davinci_uart_phys
                 add     \rv, \rp, #4            @ davinci_uart_virt
                 ldr     \rp, [\rp, #0]
@@ -48,18 +51,18 @@ davinci_uart_virt:	.word	0
                 tst     \rp, #1                 @ MMU enabled?
 
                 /* Copy uart phys address from decompressor uart info */
-                ldreq   \rv, =__virt_to_phys(davinci_uart_phys)
+                ldreq   \rv, =davinci_uart_v2p(davinci_uart_phys)
                 ldrne   \rv, =davinci_uart_phys
                 ldreq   \rp, =DAVINCI_UART_INFO
-                ldrne   \rp, =__phys_to_virt(DAVINCI_UART_INFO)
+                ldrne   \rp, =davinci_uart_p2v(DAVINCI_UART_INFO)
                 ldr     \rp, [\rp, #0]
                 str     \rp, [\rv]
 
                 /* Copy uart virt address from decompressor uart info */
-                ldreq   \rv, =__virt_to_phys(davinci_uart_virt)
+                ldreq   \rv, =davinci_uart_v2p(davinci_uart_virt)
                 ldrne   \rv, =davinci_uart_virt
                 ldreq   \rp, =DAVINCI_UART_INFO
-                ldrne   \rp, =__phys_to_virt(DAVINCI_UART_INFO)
+                ldrne   \rp, =davinci_uart_p2v(DAVINCI_UART_INFO)
                 ldr     \rp, [\rp, #4]
                 str     \rp, [\rv]
 
diff --git a/arch/arm/mach-davinci/include/mach/serial.h b/arch/arm/mach-davinci/include/mach/serial.h
index 8051110b8ac3..c9e6ce185a66 100644
--- a/arch/arm/mach-davinci/include/mach/serial.h
+++ b/arch/arm/mach-davinci/include/mach/serial.h
@@ -22,7 +22,7 @@
  *
  * This area sits just below the page tables (see arch/arm/kernel/head.S).
  */
-#define DAVINCI_UART_INFO       (PHYS_OFFSET + 0x3ff8)
+#define DAVINCI_UART_INFO       (PLAT_PHYS_OFFSET + 0x3ff8)
 
 #define DAVINCI_UART0_BASE      (IO_PHYS + 0x20000)
 #define DAVINCI_UART1_BASE      (IO_PHYS + 0x20400)
diff --git a/arch/arm/mach-mmp/include/mach/gpio.h b/arch/arm/mach-mmp/include/mach/gpio.h
index ee8b02ed8011..7bfb827f3fe3 100644
--- a/arch/arm/mach-mmp/include/mach/gpio.h
+++ b/arch/arm/mach-mmp/include/mach/gpio.h
@@ -10,7 +10,7 @@
 #define BANK_OFF(n)     (((n) < 3) ? (n) << 2 : 0x100 + (((n) - 3) << 2))
 #define GPIO_REG(x)     (*((volatile u32 *)(GPIO_REGS_VIRT + (x))))
 
-#define NR_BUILTIN_GPIO (192)
+#define NR_BUILTIN_GPIO         IRQ_GPIO_NUM
 
 #define gpio_to_bank(gpio)      ((gpio) >> 5)
 #define gpio_to_irq(gpio)       (IRQ_GPIO_START + (gpio))
diff --git a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
index 4621067c7720..713be155a44d 100644
--- a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
+++ b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
@@ -8,6 +8,15 @@
 #define MFP_DRIVE_MEDIUM        (0x2 << 13)
 #define MFP_DRIVE_FAST          (0x3 << 13)
 
+#undef MFP_CFG
+#undef MFP_CFG_DRV
+
+#define MFP_CFG(pin, af)                \
+        (MFP_LPM_INPUT | MFP_PIN(MFP_PIN_##pin) | MFP_##af | MFP_DRIVE_MEDIUM)
+
+#define MFP_CFG_DRV(pin, af, drv)       \
+        (MFP_LPM_INPUT | MFP_PIN(MFP_PIN_##pin) | MFP_##af | MFP_DRIVE_##drv)
+
 /* GPIO */
 #define GPIO0_GPIO              MFP_CFG(GPIO0, AF5)
 #define GPIO1_GPIO              MFP_CFG(GPIO1, AF5)
diff --git a/arch/arm/mach-msm/board-qsd8x50.c b/arch/arm/mach-msm/board-qsd8x50.c
index 7f568611547e..6a96911b0ad5 100644
--- a/arch/arm/mach-msm/board-qsd8x50.c
+++ b/arch/arm/mach-msm/board-qsd8x50.c
@@ -160,10 +160,7 @@ static struct msm_mmc_platform_data qsd8x50_sdc1_data = {
 
 static void __init qsd8x50_init_mmc(void)
 {
-        if (machine_is_qsd8x50_ffa() || machine_is_qsd8x50a_ffa())
-                vreg_mmc = vreg_get(NULL, "gp6");
-        else
-                vreg_mmc = vreg_get(NULL, "gp5");
+        vreg_mmc = vreg_get(NULL, "gp5");
 
         if (IS_ERR(vreg_mmc)) {
                 pr_err("vreg get for vreg_mmc failed (%ld)\n",
diff --git a/arch/arm/mach-msm/timer.c b/arch/arm/mach-msm/timer.c
index 56f920c55b6a..38b95e949d13 100644
--- a/arch/arm/mach-msm/timer.c
+++ b/arch/arm/mach-msm/timer.c
@@ -269,7 +269,7 @@ int __cpuinit local_timer_setup(struct clock_event_device *evt)
 
         /* Use existing clock_event for cpu 0 */
         if (!smp_processor_id())
-                return;
+                return 0;
 
         writel(DGT_CLK_CTL_DIV_4, MSM_TMR_BASE + DGT_CLK_CTL);
 
diff --git a/arch/arm/mach-mx3/mach-vpr200.c b/arch/arm/mach-mx3/mach-vpr200.c
index 2cf390fbd980..47a69cbc31a8 100644
--- a/arch/arm/mach-mx3/mach-vpr200.c
+++ b/arch/arm/mach-mx3/mach-vpr200.c
@@ -257,11 +257,16 @@ static const struct fsl_usb2_platform_data otg_device_pdata __initconst = {
         .workaround     = FLS_USB2_WORKAROUND_ENGCM09152,
 };
 
+static int vpr200_usbh_init(struct platform_device *pdev)
+{
+        return mx35_initialize_usb_hw(pdev->id,
+                        MXC_EHCI_INTERFACE_SINGLE_UNI | MXC_EHCI_INTERNAL_PHY);
+}
+
 /* USB HOST config */
 static const struct mxc_usbh_platform_data usb_host_pdata __initconst = {
-        .portsc         = MXC_EHCI_MODE_SERIAL,
-        .flags          = MXC_EHCI_INTERFACE_SINGLE_UNI |
-                          MXC_EHCI_INTERNAL_PHY,
+        .init = vpr200_usbh_init,
+        .portsc = MXC_EHCI_MODE_SERIAL,
 };
 
 static struct platform_device *devices[] __initdata = {
diff --git a/arch/arm/mach-mx5/board-mx53_loco.c b/arch/arm/mach-mx5/board-mx53_loco.c
index 10a1bea10548..6206b1191fe8 100644
--- a/arch/arm/mach-mx5/board-mx53_loco.c
+++ b/arch/arm/mach-mx5/board-mx53_loco.c
@@ -193,7 +193,7 @@ static iomux_v3_cfg_t mx53_loco_pads[] = {
         .wakeup         = wake,                                 \
 }
 
-static const struct gpio_keys_button loco_buttons[] __initconst = {
+static struct gpio_keys_button loco_buttons[] = {
         GPIO_BUTTON(MX53_LOCO_POWER, KEY_POWER, 1, "power", 0),
         GPIO_BUTTON(MX53_LOCO_UI1, KEY_VOLUMEUP, 1, "volume-up", 0),
         GPIO_BUTTON(MX53_LOCO_UI2, KEY_VOLUMEDOWN, 1, "volume-down", 0),
diff --git a/arch/arm/mach-mxs/clock-mx28.c b/arch/arm/mach-mxs/clock-mx28.c
index 1ad97fed1e94..5dcc59d5b9ec 100644
--- a/arch/arm/mach-mxs/clock-mx28.c
+++ b/arch/arm/mach-mxs/clock-mx28.c
@@ -295,11 +295,11 @@ static int name##_set_rate(struct clk *clk, unsigned long rate)		\
         unsigned long diff, parent_rate, calc_rate;                     \
         int i;                                                          \
                                                                         \
-        parent_rate = clk_get_rate(clk->parent);                        \
         div_max = BM_CLKCTRL_##dr##_DIV >> BP_CLKCTRL_##dr##_DIV;       \
         bm_busy = BM_CLKCTRL_##dr##_BUSY;                               \
                                                                         \
         if (clk->parent == &ref_xtal_clk) {                             \
+                parent_rate = clk_get_rate(clk->parent);                \
                 div = DIV_ROUND_UP(parent_rate, rate);                  \
                 if (clk == &cpu_clk) {                                  \
                         div_max = BM_CLKCTRL_CPU_DIV_XTAL >>            \
@@ -309,6 +309,11 @@ static int name##_set_rate(struct clk *clk, unsigned long rate)		\
                 if (div == 0 || div > div_max)                          \
                         return -EINVAL;                                 \
         } else {                                                        \
+                /*                                                      \
+                 * hack alert: this block modifies clk->parent, too,    \
+                 * so the base to use it the grand parent.              \
+                 */                                                     \
+                parent_rate = clk_get_rate(clk->parent->parent);        \
                 rate >>= PARENT_RATE_SHIFT;                             \
                 parent_rate >>= PARENT_RATE_SHIFT;                      \
                 diff = parent_rate;                                     \
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index a45cd6409686..512b15204450 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -68,7 +68,7 @@ obj-$(CONFIG_OMAP_SMARTREFLEX)          += sr_device.o smartreflex.o
 obj-$(CONFIG_OMAP_SMARTREFLEX_CLASS3)   += smartreflex-class3.o
 
 AFLAGS_sleep24xx.o                      :=-Wa,-march=armv6
-AFLAGS_sleep34xx.o                      :=-Wa,-march=armv7-a
+AFLAGS_sleep34xx.o                      :=-Wa,-march=armv7-a$(plus_sec)
 
 ifeq ($(CONFIG_PM_VERBOSE),y)
 CFLAGS_pm_bus.o                         += -DDEBUG
diff --git a/arch/arm/mach-omap2/board-rx51.c b/arch/arm/mach-omap2/board-rx51.c
index e964895b80e8..f8ba20a14e62 100644
--- a/arch/arm/mach-omap2/board-rx51.c
+++ b/arch/arm/mach-omap2/board-rx51.c
@@ -141,14 +141,19 @@ static void __init rx51_init(void)
 static void __init rx51_map_io(void)
 {
         omap2_set_globals_3xxx();
-        rx51_video_mem_init();
         omap34xx_map_common_io();
 }
 
+static void __init rx51_reserve(void)
+{
+        rx51_video_mem_init();
+        omap_reserve();
+}
+
 MACHINE_START(NOKIA_RX51, "Nokia RX-51 board")
         /* Maintainer: Lauri Leukkunen <lauri.leukkunen@nokia.com> */
         .boot_params    = 0x80000100,
-        .reserve        = omap_reserve,
+        .reserve        = rx51_reserve,
         .map_io         = rx51_map_io,
         .init_early     = rx51_init_early,
         .init_irq       = omap_init_irq,
diff --git a/arch/arm/mach-omap2/clock44xx_data.c b/arch/arm/mach-omap2/clock44xx_data.c
index 276992d3b7fb..8c965671b4d4 100644
--- a/arch/arm/mach-omap2/clock44xx_data.c
+++ b/arch/arm/mach-omap2/clock44xx_data.c
@@ -3116,14 +3116,9 @@ static struct omap_clk omap44xx_clks[] = {
         CLK(NULL,       "dsp_fck",                      &dsp_fck,       CK_443X),
         CLK("omapdss_dss",      "sys_clk",                      &dss_sys_clk,   CK_443X),
         CLK("omapdss_dss",      "tv_clk",                       &dss_tv_clk,    CK_443X),
-        CLK("omapdss_dss",      "dss_clk",                      &dss_dss_clk,   CK_443X),
         CLK("omapdss_dss",      "video_clk",                    &dss_48mhz_clk, CK_443X),
-        CLK("omapdss_dss",      "fck",                          &dss_fck,       CK_443X),
-        /*
-         * On OMAP4, DSS ick is a dummy clock; this is needed for compatibility
-         * with OMAP2/3.
-         */
-        CLK("omapdss_dss",      "ick",                          &dummy_ck,      CK_443X),
+        CLK("omapdss_dss",      "fck",                          &dss_dss_clk,   CK_443X),
+        CLK("omapdss_dss",      "ick",                          &dss_fck,       CK_443X),
         CLK(NULL,       "efuse_ctrl_cust_fck",          &efuse_ctrl_cust_fck,   CK_443X),
         CLK(NULL,       "emif1_fck",                    &emif1_fck,     CK_443X),
         CLK(NULL,       "emif2_fck",                    &emif2_fck,     CK_443X),
diff --git a/arch/arm/mach-omap2/cm2xxx_3xxx.c b/arch/arm/mach-omap2/cm2xxx_3xxx.c
index 9d0dec806e92..38830d8d4783 100644
--- a/arch/arm/mach-omap2/cm2xxx_3xxx.c
+++ b/arch/arm/mach-omap2/cm2xxx_3xxx.c
@@ -247,6 +247,7 @@ struct omap3_cm_regs {
         u32 per_cm_clksel;
         u32 emu_cm_clksel;
         u32 emu_cm_clkstctrl;
+        u32 pll_cm_autoidle;
         u32 pll_cm_autoidle2;
         u32 pll_cm_clksel4;
         u32 pll_cm_clksel5;
@@ -319,6 +320,15 @@ void omap3_cm_save_context(void)
                 omap2_cm_read_mod_reg(OMAP3430_EMU_MOD, CM_CLKSEL1);
         cm_context.emu_cm_clkstctrl =
                 omap2_cm_read_mod_reg(OMAP3430_EMU_MOD, OMAP2_CM_CLKSTCTRL);
+        /*
+         * As per erratum i671, ROM code does not respect the PER DPLL
+         * programming scheme if CM_AUTOIDLE_PLL.AUTO_PERIPH_DPLL == 1.
+         * In this case, even though this register has been saved in
+         * scratchpad contents, we need to restore AUTO_PERIPH_DPLL
+         * by ourselves. So, we need to save it anyway.
+         */
+        cm_context.pll_cm_autoidle =
+                omap2_cm_read_mod_reg(PLL_MOD, CM_AUTOIDLE);
         cm_context.pll_cm_autoidle2 =
                 omap2_cm_read_mod_reg(PLL_MOD, CM_AUTOIDLE2);
         cm_context.pll_cm_clksel4 =
@@ -441,6 +451,13 @@ void omap3_cm_restore_context(void)
                                CM_CLKSEL1);
         omap2_cm_write_mod_reg(cm_context.emu_cm_clkstctrl, OMAP3430_EMU_MOD,
                                OMAP2_CM_CLKSTCTRL);
+        /*
+         * As per erratum i671, ROM code does not respect the PER DPLL
+         * programming scheme if CM_AUTOIDLE_PLL.AUTO_PERIPH_DPLL == 1.
+         * In this case, we need to restore AUTO_PERIPH_DPLL by ourselves.
+         */
+        omap2_cm_write_mod_reg(cm_context.pll_cm_autoidle, PLL_MOD,
+                               CM_AUTOIDLE);
         omap2_cm_write_mod_reg(cm_context.pll_cm_autoidle2, PLL_MOD,
                                CM_AUTOIDLE2);
         omap2_cm_write_mod_reg(cm_context.pll_cm_clksel4, PLL_MOD,
diff --git a/arch/arm/mach-omap2/control.c b/arch/arm/mach-omap2/control.c
index 695279419020..da53ba3917ca 100644
--- a/arch/arm/mach-omap2/control.c
+++ b/arch/arm/mach-omap2/control.c
@@ -316,8 +316,14 @@ void omap3_save_scratchpad_contents(void)
                         omap2_cm_read_mod_reg(WKUP_MOD, CM_CLKSEL);
         prcm_block_contents.cm_clken_pll =
                         omap2_cm_read_mod_reg(PLL_MOD, CM_CLKEN);
+        /*
+         * As per erratum i671, ROM code does not respect the PER DPLL
+         * programming scheme if CM_AUTOIDLE_PLL..AUTO_PERIPH_DPLL == 1.
+         * Then,  in anycase, clear these bits to avoid extra latencies.
+         */
         prcm_block_contents.cm_autoidle_pll =
-                        omap2_cm_read_mod_reg(PLL_MOD, OMAP3430_CM_AUTOIDLE_PLL);
+                        omap2_cm_read_mod_reg(PLL_MOD, CM_AUTOIDLE) &
+                        ~OMAP3430_AUTO_PERIPH_DPLL_MASK;
         prcm_block_contents.cm_clksel1_pll =
                         omap2_cm_read_mod_reg(PLL_MOD, OMAP3430_CM_CLKSEL1_PLL);
         prcm_block_contents.cm_clksel2_pll =
diff --git a/arch/arm/mach-omap2/omap_hwmod_2420_data.c b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
index 8eb3ce1bbfbe..c4d0ae87d62a 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2420_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
@@ -1639,6 +1639,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio1_slaves[] = {
 
 static struct omap_hwmod omap2420_gpio1_hwmod = {
         .name           = "gpio1",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap242x_gpio1_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio1_irqs),
         .main_clk       = "gpios_fck",
@@ -1669,6 +1670,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio2_slaves[] = {
 
 static struct omap_hwmod omap2420_gpio2_hwmod = {
         .name           = "gpio2",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap242x_gpio2_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio2_irqs),
         .main_clk       = "gpios_fck",
@@ -1699,6 +1701,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio3_slaves[] = {
 
 static struct omap_hwmod omap2420_gpio3_hwmod = {
         .name           = "gpio3",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap242x_gpio3_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio3_irqs),
         .main_clk       = "gpios_fck",
@@ -1729,6 +1732,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio4_slaves[] = {
 
 static struct omap_hwmod omap2420_gpio4_hwmod = {
         .name           = "gpio4",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap242x_gpio4_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio4_irqs),
         .main_clk       = "gpios_fck",
@@ -1782,7 +1786,7 @@ static struct omap_hwmod_irq_info omap2420_dma_system_irqs[] = {
 static struct omap_hwmod_addr_space omap2420_dma_system_addrs[] = {
         {
                 .pa_start       = 0x48056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x48056fff,
                 .flags          = ADDR_TYPE_RT
         },
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_2430_data.c b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
index e6e3810db77f..9682dd519f8d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2430_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
@@ -1742,6 +1742,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio1_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio1_hwmod = {
         .name           = "gpio1",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio1_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio1_irqs),
         .main_clk       = "gpios_fck",
@@ -1772,6 +1773,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio2_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio2_hwmod = {
         .name           = "gpio2",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio2_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio2_irqs),
         .main_clk       = "gpios_fck",
@@ -1802,6 +1804,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio3_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio3_hwmod = {
         .name           = "gpio3",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio3_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio3_irqs),
         .main_clk       = "gpios_fck",
@@ -1832,6 +1835,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio4_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio4_hwmod = {
         .name           = "gpio4",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio4_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio4_irqs),
         .main_clk       = "gpios_fck",
@@ -1862,6 +1866,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio5_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio5_hwmod = {
         .name           = "gpio5",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio5_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio5_irqs),
         .main_clk       = "gpio5_fck",
@@ -1915,7 +1920,7 @@ static struct omap_hwmod_irq_info omap2430_dma_system_irqs[] = {
 static struct omap_hwmod_addr_space omap2430_dma_system_addrs[] = {
         {
                 .pa_start       = 0x48056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x48056fff,
                 .flags          = ADDR_TYPE_RT
         },
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index b98e2dfcba28..909a84de6682 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -2141,6 +2141,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio1_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio1_hwmod = {
         .name           = "gpio1",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio1_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio1_irqs),
         .main_clk       = "gpio1_ick",
@@ -2177,6 +2178,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio2_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio2_hwmod = {
         .name           = "gpio2",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio2_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio2_irqs),
         .main_clk       = "gpio2_ick",
@@ -2213,6 +2215,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio3_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio3_hwmod = {
         .name           = "gpio3",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio3_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio3_irqs),
         .main_clk       = "gpio3_ick",
@@ -2249,6 +2252,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio4_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio4_hwmod = {
         .name           = "gpio4",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio4_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio4_irqs),
         .main_clk       = "gpio4_ick",
@@ -2285,6 +2289,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio5_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio5_hwmod = {
         .name           = "gpio5",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio5_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio5_irqs),
         .main_clk       = "gpio5_ick",
@@ -2321,6 +2326,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio6_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio6_hwmod = {
         .name           = "gpio6",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio6_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio6_irqs),
         .main_clk       = "gpio6_ick",
@@ -2386,7 +2392,7 @@ static struct omap_hwmod_irq_info omap3xxx_dma_system_irqs[] = {
 static struct omap_hwmod_addr_space omap3xxx_dma_system_addrs[] = {
         {
                 .pa_start       = 0x48056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x48056fff,
                 .flags          = ADDR_TYPE_RT
         },
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index 3e88dd3f8ef3..abc548a0c98d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -885,7 +885,7 @@ static struct omap_hwmod_ocp_if *omap44xx_dma_system_masters[] = {
 static struct omap_hwmod_addr_space omap44xx_dma_system_addrs[] = {
         {
                 .pa_start       = 0x4a056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x4a056fff,
                 .flags          = ADDR_TYPE_RT
         },
 };
diff --git a/arch/arm/mach-omap2/omap_l3_smx.c b/arch/arm/mach-omap2/omap_l3_smx.c
index 5f2da7565b68..4321e7938929 100644
--- a/arch/arm/mach-omap2/omap_l3_smx.c
+++ b/arch/arm/mach-omap2/omap_l3_smx.c
@@ -196,11 +196,11 @@ static irqreturn_t omap3_l3_app_irq(int irq, void *_l3)
                 /* No timeout error for debug sources */
         }
 
-        base = ((l3->rt) + (*(omap3_l3_bases[int_type] + err_source)));
-
         /* identify the error source */
         for (err_source = 0; !(status & (1 << err_source)); err_source++)
                                                                         ;
+
+        base = l3->rt + *(omap3_l3_bases[int_type] + err_source);
         error = omap3_l3_readll(base, L3_ERROR_LOG);
 
         if (error) {
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index 30af3351c2d6..49486f522dca 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -89,6 +89,7 @@ static void omap2_init_processor_devices(void)
         if (cpu_is_omap44xx()) {
                 _init_omap_device("l3_main_1", &l3_dev);
                 _init_omap_device("dsp", &dsp_dev);
+                _init_omap_device("iva", &iva_dev);
         } else {
                 _init_omap_device("l3_main", &l3_dev);
         }
diff --git a/arch/arm/mach-omap2/voltage.c b/arch/arm/mach-omap2/voltage.c
index 6fb520999b6e..0c1552d9d995 100644
--- a/arch/arm/mach-omap2/voltage.c
+++ b/arch/arm/mach-omap2/voltage.c
@@ -114,7 +114,6 @@ static int __init _config_common_vdd_data(struct omap_vdd_info *vdd)
         sys_clk_speed /= 1000;
 
         /* Generic voltage parameters */
-        vdd->curr_volt = 1200000;
         vdd->volt_scale = vp_forceupdate_scale_voltage;
         vdd->vp_enabled = false;
 
diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
index 6de0ad0eea65..9cdcca597924 100644
--- a/arch/arm/mach-pxa/hx4700.c
+++ b/arch/arm/mach-pxa/hx4700.c
@@ -711,7 +711,7 @@ static struct regulator_consumer_supply bq24022_consumers[] = {
 static struct regulator_init_data bq24022_init_data = {
         .constraints = {
                 .max_uA         = 500000,
-                .valid_ops_mask = REGULATOR_CHANGE_CURRENT,
+                .valid_ops_mask = REGULATOR_CHANGE_CURRENT|REGULATOR_CHANGE_STATUS,
         },
         .num_consumer_supplies  = ARRAY_SIZE(bq24022_consumers),
         .consumer_supplies      = bq24022_consumers,
diff --git a/arch/arm/mach-pxa/include/mach/gpio.h b/arch/arm/mach-pxa/include/mach/gpio.h
index b024a8b37439..c4639502efca 100644
--- a/arch/arm/mach-pxa/include/mach/gpio.h
+++ b/arch/arm/mach-pxa/include/mach/gpio.h
@@ -99,11 +99,24 @@
 #define GAFR(x)         GPIO_REG(0x54 + (((x) & 0x70) >> 2))
 
 
-#define NR_BUILTIN_GPIO 128
+#define NR_BUILTIN_GPIO         PXA_GPIO_IRQ_NUM
 
 #define gpio_to_bank(gpio)      ((gpio) >> 5)
 #define gpio_to_irq(gpio)       IRQ_GPIO(gpio)
-#define irq_to_gpio(irq)        IRQ_TO_GPIO(irq)
+
+static inline int irq_to_gpio(unsigned int irq)
+{
+        int gpio;
+
+        if (irq == IRQ_GPIO0 || irq == IRQ_GPIO1)
+                return irq - IRQ_GPIO0;
+
+        gpio = irq - PXA_GPIO_IRQ_BASE;
+        if (gpio >= 2 && gpio < NR_BUILTIN_GPIO)
+                return gpio;
+
+        return -1;
+}
 
 #ifdef CONFIG_CPU_PXA26x
 /* GPIO86/87/88/89 on PXA26x have their direction bits in GPDR2 inverted,
diff --git a/arch/arm/mach-pxa/include/mach/irqs.h b/arch/arm/mach-pxa/include/mach/irqs.h
index a4285fc00878..038402404e39 100644
--- a/arch/arm/mach-pxa/include/mach/irqs.h
+++ b/arch/arm/mach-pxa/include/mach/irqs.h
@@ -93,9 +93,6 @@
 #define GPIO_2_x_TO_IRQ(x)      (PXA_GPIO_IRQ_BASE + (x))
 #define IRQ_GPIO(x)     (((x) < 2) ? (IRQ_GPIO0 + (x)) : GPIO_2_x_TO_IRQ(x))
 
-#define IRQ_TO_GPIO_2_x(i)      ((i) - PXA_GPIO_IRQ_BASE)
-#define IRQ_TO_GPIO(i)  (((i) < IRQ_GPIO(2)) ? ((i) - IRQ_GPIO0) : IRQ_TO_GPIO_2_x(i))
-
 /*
  * The following interrupts are for board specific purposes. Since
  * the kernel can only run on one machine at a time, we can re-use
diff --git a/arch/arm/mach-pxa/magician.c b/arch/arm/mach-pxa/magician.c
index a72993dde2b3..9984ef70bd79 100644
--- a/arch/arm/mach-pxa/magician.c
+++ b/arch/arm/mach-pxa/magician.c
@@ -599,7 +599,7 @@ static struct regulator_consumer_supply bq24022_consumers[] = {
 static struct regulator_init_data bq24022_init_data = {
         .constraints = {
                 .max_uA         = 500000,
-                .valid_ops_mask = REGULATOR_CHANGE_CURRENT,
+                .valid_ops_mask = REGULATOR_CHANGE_CURRENT | REGULATOR_CHANGE_STATUS,
         },
         .num_consumer_supplies  = ARRAY_SIZE(bq24022_consumers),
         .consumer_supplies      = bq24022_consumers,
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index 6bde5956358d..a4af8c52d7ee 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -285,7 +285,7 @@ static inline void pxa25x_init_pm(void) {}
 
 static int pxa25x_set_wake(struct irq_data *d, unsigned int on)
 {
-        int gpio = IRQ_TO_GPIO(d->irq);
+        int gpio = irq_to_gpio(d->irq);
         uint32_t mask = 0;
 
         if (gpio >= 0 && gpio < 85)
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index 1cb5d0f9723f..909756eaf4b7 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -345,7 +345,7 @@ static inline void pxa27x_init_pm(void) {}
  */
 static int pxa27x_set_wake(struct irq_data *d, unsigned int on)
 {
-        int gpio = IRQ_TO_GPIO(d->irq);
+        int gpio = irq_to_gpio(d->irq);
         uint32_t mask;
 
         if (gpio >= 0 && gpio < 128)
diff --git a/arch/arm/mach-s3c2440/mach-gta02.c b/arch/arm/mach-s3c2440/mach-gta02.c
index 0db2411ef4bb..716662008ce2 100644
--- a/arch/arm/mach-s3c2440/mach-gta02.c
+++ b/arch/arm/mach-s3c2440/mach-gta02.c
@@ -409,6 +409,10 @@ struct platform_device s3c24xx_pwm_device = {
         .num_resources  = 0,
 };
 
+static struct platform_device gta02_dfbmcs320_device = {
+        .name = "dfbmcs320",
+};
+
 static struct i2c_board_info gta02_i2c_devs[] __initdata = {
         {
                 I2C_BOARD_INFO("pcf50633", 0x73),
@@ -523,6 +527,7 @@ static struct platform_device *gta02_devices[] __initdata = {
         &s3c_device_iis,
         &samsung_asoc_dma,
         &s3c_device_i2c0,
+        &gta02_dfbmcs320_device,
         &gta02_buttons_device,
         &s3c_device_adc,
         &s3c_device_ts,
diff --git a/arch/arm/mach-tegra/gpio.c b/arch/arm/mach-tegra/gpio.c
index 76a3f654220f..65a1aba6823d 100644
--- a/arch/arm/mach-tegra/gpio.c
+++ b/arch/arm/mach-tegra/gpio.c
@@ -257,7 +257,8 @@ static void tegra_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
 void tegra_gpio_resume(void)
 {
         unsigned long flags;
-        int b, p, i;
+        int b;
+        int p;
 
         local_irq_save(flags);
 
@@ -280,7 +281,8 @@ void tegra_gpio_resume(void)
 void tegra_gpio_suspend(void)
 {
         unsigned long flags;
-        int b, p, i;
+        int b;
+        int p;
 
         local_irq_save(flags);
         for (b = 0; b < ARRAY_SIZE(tegra_gpio_banks); b++) {
diff --git a/arch/arm/mach-tegra/tegra2_clocks.c b/arch/arm/mach-tegra/tegra2_clocks.c
index 6d7c4eea4dcb..4459470c052d 100644
--- a/arch/arm/mach-tegra/tegra2_clocks.c
+++ b/arch/arm/mach-tegra/tegra2_clocks.c
@@ -1362,14 +1362,15 @@ static int tegra_clk_shared_bus_set_rate(struct clk *c, unsigned long rate)
 {
         unsigned long flags;
         int ret;
+        long new_rate = rate;
 
-        rate = clk_round_rate(c->parent, rate);
-        if (rate < 0)
-                return rate;
+        new_rate = clk_round_rate(c->parent, new_rate);
+        if (new_rate < 0)
+                return new_rate;
 
         spin_lock_irqsave(&c->parent->spinlock, flags);
 
-        c->u.shared_bus_user.rate = rate;
+        c->u.shared_bus_user.rate = new_rate;
         ret = tegra_clk_shared_bus_update(c->parent);
 
         spin_unlock_irqrestore(&c->parent->spinlock, flags);
diff --git a/arch/arm/mach-ux500/board-mop500.c b/arch/arm/mach-ux500/board-mop500.c
index af913741e6ec..6e1907fa94f0 100644
--- a/arch/arm/mach-ux500/board-mop500.c
+++ b/arch/arm/mach-ux500/board-mop500.c
@@ -178,16 +178,15 @@ static struct i2c_board_info __initdata mop500_i2c0_devices[] = {
                 .irq            = NOMADIK_GPIO_TO_IRQ(217),
                 .platform_data  = &mop500_tc35892_data,
         },
-};
-
-/* I2C0 devices only available prior to HREFv60 */
-static struct i2c_board_info __initdata mop500_i2c0_old_devices[] = {
+        /* I2C0 devices only available prior to HREFv60 */
         {
                 I2C_BOARD_INFO("tps61052", 0x33),
                 .platform_data  = &mop500_tps61052_data,
         },
 };
 
+#define NUM_PRE_V60_I2C0_DEVICES 1
+
 static struct i2c_board_info __initdata mop500_i2c2_devices[] = {
         {
                 /* lp5521 LED driver, 1st device */
@@ -425,6 +424,8 @@ static void __init mop500_uart_init(void)
 
 static void __init mop500_init_machine(void)
 {
+        int i2c0_devs;
+
         /*
          * The HREFv60 board removed a GPIO expander and routed
          * all these GPIO pins to the internal GPIO controller
@@ -448,11 +449,11 @@ static void __init mop500_init_machine(void)
 
         platform_device_register(&ab8500_device);
 
-        i2c_register_board_info(0, mop500_i2c0_devices,
-                                ARRAY_SIZE(mop500_i2c0_devices));
-        if (!machine_is_hrefv60())
-                i2c_register_board_info(0, mop500_i2c0_old_devices,
-                                        ARRAY_SIZE(mop500_i2c0_old_devices));
+        i2c0_devs = ARRAY_SIZE(mop500_i2c0_devices);
+        if (machine_is_hrefv60())
+                i2c0_devs -= NUM_PRE_V60_I2C0_DEVICES;
+
+        i2c_register_board_info(0, mop500_i2c0_devices, i2c0_devs);
         i2c_register_board_info(2, mop500_i2c2_devices,
                                 ARRAY_SIZE(mop500_i2c2_devices));
 }
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index afe209e1e1f8..74be05f3e03a 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -7,6 +7,7 @@
 #include <linux/shm.h>
 #include <linux/sched.h>
 #include <linux/io.h>
+#include <linux/personality.h>
 #include <linux/random.h>
 #include <asm/cputype.h>
 #include <asm/system.h>
@@ -82,7 +83,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 mm->cached_hole_size = 0;
         }
         /* 8 bits of randomness in 20 address space bits */
-        if (current->flags & PF_RANDOMIZE)
+        if ((current->flags & PF_RANDOMIZE) &&
+            !(current->personality & ADDR_NO_RANDOMIZE))
                 addr += (get_random_int() % (1 << 8)) << PAGE_SHIFT;
 
 full_search:
diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
index b46eb21f05c7..bf8a1d1cccb6 100644
--- a/arch/arm/mm/proc-arm920.S
+++ b/arch/arm/mm/proc-arm920.S
@@ -390,7 +390,7 @@ ENTRY(cpu_arm920_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm920_suspend_size
 .equ    cpu_arm920_suspend_size, 4 * 3
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_arm920_do_suspend)
         stmfd   sp!, {r4 - r7, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ PID
diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
index 6a4bdb2c94a7..0ed85d930c09 100644
--- a/arch/arm/mm/proc-arm926.S
+++ b/arch/arm/mm/proc-arm926.S
@@ -404,7 +404,7 @@ ENTRY(cpu_arm926_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm926_suspend_size
 .equ    cpu_arm926_suspend_size, 4 * 3
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_arm926_do_suspend)
         stmfd   sp!, {r4 - r7, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ PID
diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
index 74483d1977fe..184a9c997e36 100644
--- a/arch/arm/mm/proc-sa1100.S
+++ b/arch/arm/mm/proc-sa1100.S
@@ -171,7 +171,7 @@ ENTRY(cpu_sa1100_set_pte_ext)
 
 .globl  cpu_sa1100_suspend_size
 .equ    cpu_sa1100_suspend_size, 4*4
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_sa1100_do_suspend)
         stmfd   sp!, {r4 - r7, lr}
         mrc     p15, 0, r4, c3, c0, 0           @ domain ID
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index bfa0c9f611c5..7c99cb4c8e4f 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -124,7 +124,7 @@ ENTRY(cpu_v6_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/mach-s3c64xx/sleep.S */
 .globl  cpu_v6_suspend_size
 .equ    cpu_v6_suspend_size, 4 * 8
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_v6_do_suspend)
         stmfd   sp!, {r4 - r11, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ FCSE/PID
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index c35618e42f6f..babfba09c89f 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -211,7 +211,7 @@ cpu_v7_name:
 /* Suspend/resume support: derived from arch/arm/mach-s5pv210/sleep.S */
 .globl  cpu_v7_suspend_size
 .equ    cpu_v7_suspend_size, 4 * 8
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_v7_do_suspend)
         stmfd   sp!, {r4 - r11, lr}
         mrc     p15, 0, r4, c13, c0, 0  @ FCSE/PID
diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
index 63d8b2044e84..596213699f37 100644
--- a/arch/arm/mm/proc-xsc3.S
+++ b/arch/arm/mm/proc-xsc3.S
@@ -417,7 +417,7 @@ ENTRY(cpu_xsc3_set_pte_ext)
 
 .globl  cpu_xsc3_suspend_size
 .equ    cpu_xsc3_suspend_size, 4 * 8
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_xsc3_do_suspend)
         stmfd   sp!, {r4 - r10, lr}
         mrc     p14, 0, r4, c6, c0, 0   @ clock configuration, for turbo mode
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 086038cd86ab..42af97664c9d 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -395,7 +395,7 @@ ENTRY(xscale_dma_a0_map_area)
         teq     r2, #DMA_TO_DEVICE
         beq     xscale_dma_clean_range
         b       xscale_dma_flush_range
-ENDPROC(xscsale_dma_a0_map_area)
+ENDPROC(xscale_dma_a0_map_area)
 
 /*
  *      dma_unmap_area(start, size, dir)
@@ -518,7 +518,7 @@ ENTRY(cpu_xscale_set_pte_ext)
 
 .globl  cpu_xscale_suspend_size
 .equ    cpu_xscale_suspend_size, 4 * 7
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_xscale_do_suspend)
         stmfd   sp!, {r4 - r10, lr}
         mrc     p14, 0, r4, c6, c0, 0   @ clock configuration, for turbo mode
diff --git a/arch/arm/plat-mxc/gpio.c b/arch/arm/plat-mxc/gpio.c
index 7a107246fd98..6cd6d7f686f6 100644
--- a/arch/arm/plat-mxc/gpio.c
+++ b/arch/arm/plat-mxc/gpio.c
@@ -295,6 +295,12 @@ static int mxc_gpio_direction_output(struct gpio_chip *chip,
         return 0;
 }
 
+/*
+ * This lock class tells lockdep that GPIO irqs are in a different
+ * category than their parents, so it won't report false recursion.
+ */
+static struct lock_class_key gpio_lock_class;
+
 int __init mxc_gpio_init(struct mxc_gpio_port *port, int cnt)
 {
         int i, j;
@@ -311,6 +317,7 @@ int __init mxc_gpio_init(struct mxc_gpio_port *port, int cnt)
                 __raw_writel(~0, port[i].base + GPIO_ISR);
                 for (j = port[i].virtual_irq_start;
                         j < port[i].virtual_irq_start + 32; j++) {
+                        irq_set_lockdep_class(j, &gpio_lock_class);
                         irq_set_chip_and_handler(j, &gpio_irq_chip,
                                                  handle_level_irq);
                         set_irq_flags(j, IRQF_VALID);
diff --git a/arch/arm/plat-mxc/ssi-fiq.S b/arch/arm/plat-mxc/ssi-fiq.S
index 4ddce565b353..8397a2dd19f2 100644
--- a/arch/arm/plat-mxc/ssi-fiq.S
+++ b/arch/arm/plat-mxc/ssi-fiq.S
@@ -124,6 +124,8 @@ imx_ssi_fiq_start:
 1:
                 @ return from FIQ
                 subs    pc, lr, #4
+
+                .align
 imx_ssi_fiq_base:
                 .word 0x0
 imx_ssi_fiq_rx_buffer:
diff --git a/arch/arm/plat-s5p/pm.c b/arch/arm/plat-s5p/pm.c
index d592b6304b48..d15dc47b0e3d 100644
--- a/arch/arm/plat-s5p/pm.c
+++ b/arch/arm/plat-s5p/pm.c
@@ -19,17 +19,6 @@
 
 #define PFX "s5p pm: "
 
-/* s3c_pm_check_resume_pin
- *
- * check to see if the pin is configured correctly for sleep mode, and
- * make any necessary adjustments if it is not
-*/
-
-static void s3c_pm_check_resume_pin(unsigned int pin, unsigned int irqoffs)
-{
-        /* nothing here yet */
-}
-
 /* s3c_pm_configure_extint
  *
  * configure all external interrupt pins
diff --git a/arch/arm/plat-samsung/pm-check.c b/arch/arm/plat-samsung/pm-check.c
index e4baf76f374a..6b733fafe7cd 100644
--- a/arch/arm/plat-samsung/pm-check.c
+++ b/arch/arm/plat-samsung/pm-check.c
@@ -164,7 +164,6 @@ static inline int in_region(void *ptr, int size, void *what, size_t whatsz)
  */
 static u32 *s3c_pm_runcheck(struct resource *res, u32 *val)
 {
-        void *save_at = phys_to_virt(s3c_sleep_save_phys);
         unsigned long addr;
         unsigned long left;
         void *stkpage;
@@ -192,11 +191,6 @@ static u32 *s3c_pm_runcheck(struct resource *res, u32 *val)
                         goto skip_check;
                 }
 
-                if (in_region(ptr, left, save_at, 32*4 )) {
-                        S3C_PMDBG("skipping %08lx, has save block in\n", addr);
-                        goto skip_check;
-                }
-
                 /* calculate and check the checksum */
 
                 calc = crc32_le(~0, ptr, left);
diff --git a/arch/arm/plat-samsung/pm.c b/arch/arm/plat-samsung/pm.c
index d5b58d31903c..5c0a440d6e16 100644
--- a/arch/arm/plat-samsung/pm.c
+++ b/arch/arm/plat-samsung/pm.c
@@ -214,8 +214,9 @@ void s3c_pm_do_restore_core(struct sleep_save *ptr, int count)
  *
  * print any IRQs asserted at resume time (ie, we woke from)
 */
-static void s3c_pm_show_resume_irqs(int start, unsigned long which,
-                                    unsigned long mask)
+static void __maybe_unused s3c_pm_show_resume_irqs(int start,
+                                                   unsigned long which,
+                                                   unsigned long mask)
 {
         int i;
 
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index bbf3da012afd..f74695075e64 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -78,6 +78,14 @@ static void vfp_thread_exit(struct thread_info *thread)
         put_cpu();
 }
 
+static void vfp_thread_copy(struct thread_info *thread)
+{
+        struct thread_info *parent = current_thread_info();
+
+        vfp_sync_hwstate(parent);
+        thread->vfpstate = parent->vfpstate;
+}
+
 /*
  * When this function is called with the following 'cmd's, the following
  * is true while this function is being run:
@@ -104,12 +112,17 @@ static void vfp_thread_exit(struct thread_info *thread)
 static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
 {
         struct thread_info *thread = v;
+        u32 fpexc;
+#ifdef CONFIG_SMP
+        unsigned int cpu;
+#endif
 
-        if (likely(cmd == THREAD_NOTIFY_SWITCH)) {
-                u32 fpexc = fmrx(FPEXC);
+        switch (cmd) {
+        case THREAD_NOTIFY_SWITCH:
+                fpexc = fmrx(FPEXC);
 
 #ifdef CONFIG_SMP
-                unsigned int cpu = thread->cpu;
+                cpu = thread->cpu;
 
                 /*
                  * On SMP, if VFP is enabled, save the old state in
@@ -134,13 +147,20 @@ static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
                  * old state.
                  */
                 fmxr(FPEXC, fpexc & ~FPEXC_EN);
-                return NOTIFY_DONE;
-        }
+                break;
 
-        if (cmd == THREAD_NOTIFY_FLUSH)
+        case THREAD_NOTIFY_FLUSH:
                 vfp_thread_flush(thread);
-        else
+                break;
+
+        case THREAD_NOTIFY_EXIT:
                 vfp_thread_exit(thread);
+                break;
+
+        case THREAD_NOTIFY_COPY:
+                vfp_thread_copy(thread);
+                break;
+        }
 
         return NOTIFY_DONE;
 }
diff --git a/arch/avr32/include/asm/setup.h b/arch/avr32/include/asm/setup.h
index ff5b7cf6be4d..160543dbec7e 100644
--- a/arch/avr32/include/asm/setup.h
+++ b/arch/avr32/include/asm/setup.h
@@ -94,6 +94,13 @@ struct tag_ethernet {
 
 #define ETH_INVALID_PHY 0xff
 
+/* board information */
+#define ATAG_BOARDINFO  0x54410008
+
+struct tag_boardinfo {
+        u32     board_number;
+};
+
 struct tag {
         struct tag_header hdr;
         union {
@@ -102,6 +109,7 @@ struct tag {
                 struct tag_cmdline cmdline;
                 struct tag_clock clock;
                 struct tag_ethernet ethernet;
+                struct tag_boardinfo boardinfo;
         } u;
 };
 
@@ -128,6 +136,7 @@ extern struct tag *bootloader_tags;
 
 extern resource_size_t fbmem_start;
 extern resource_size_t fbmem_size;
+extern u32 board_number;
 
 void setup_processor(void);
 
diff --git a/arch/avr32/kernel/setup.c b/arch/avr32/kernel/setup.c
index 5c7083916c33..bb0974cce4ac 100644
--- a/arch/avr32/kernel/setup.c
+++ b/arch/avr32/kernel/setup.c
@@ -391,6 +391,21 @@ static int __init parse_tag_clock(struct tag *tag)
 __tagtable(ATAG_CLOCK, parse_tag_clock);
 
 /*
+ * The board_number correspond to the bd->bi_board_number in U-Boot. This
+ * parameter is only available during initialisation and can be used in some
+ * kind of board identification.
+ */
+u32 __initdata board_number;
+
+static int __init parse_tag_boardinfo(struct tag *tag)
+{
+        board_number = tag->u.boardinfo.board_number;
+
+        return 0;
+}
+__tagtable(ATAG_BOARDINFO, parse_tag_boardinfo);
+
+/*
  * Scan the tag table for this tag, and call its parse function. The
  * tag table is built by the linker from all the __tagtable
  * declarations.
diff --git a/arch/avr32/kernel/traps.c b/arch/avr32/kernel/traps.c
index b91b2044af9c..7aa25756412f 100644
--- a/arch/avr32/kernel/traps.c
+++ b/arch/avr32/kernel/traps.c
@@ -95,28 +95,6 @@ void _exception(long signr, struct pt_regs *regs, int code,
         info.si_code = code;
         info.si_addr = (void __user *)addr;
         force_sig_info(signr, &info, current);
-
-        /*
-         * Init gets no signals that it doesn't have a handler for.
-         * That's all very well, but if it has caused a synchronous
-         * exception and we ignore the resulting signal, it will just
-         * generate the same exception over and over again and we get
-         * nowhere.  Better to kill it and let the kernel panic.
-         */
-        if (is_global_init(current)) {
-                __sighandler_t handler;
-
-                spin_lock_irq(&current->sighand->siglock);
-                handler = current->sighand->action[signr-1].sa.sa_handler;
-                spin_unlock_irq(&current->sighand->siglock);
-                if (handler == SIG_DFL) {
-                        /* init has generated a synchronous exception
-                           and it doesn't have a handler for the signal */
-                        printk(KERN_CRIT "init has generated signal %ld "
-                               "but has no handler for it\n", signr);
-                        do_exit(signr);
-                }
-        }
 }
 
 asmlinkage void do_nmi(unsigned long ecr, struct pt_regs *regs)
diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
index 442f08c5e641..86925fd6ea5b 100644
--- a/arch/avr32/mach-at32ap/clock.c
+++ b/arch/avr32/mach-at32ap/clock.c
@@ -35,22 +35,30 @@ void at32_clk_register(struct clk *clk)
         spin_unlock(&clk_list_lock);
 }
 
-struct clk *clk_get(struct device *dev, const char *id)
+static struct clk *__clk_get(struct device *dev, const char *id)
 {
         struct clk *clk;
 
-        spin_lock(&clk_list_lock);
-
         list_for_each_entry(clk, &at32_clock_list, list) {
                 if (clk->dev == dev && strcmp(id, clk->name) == 0) {
-                        spin_unlock(&clk_list_lock);
                         return clk;
                 }
         }
 
-        spin_unlock(&clk_list_lock);
         return ERR_PTR(-ENOENT);
 }
+
+struct clk *clk_get(struct device *dev, const char *id)
+{
+        struct clk *clk;
+
+        spin_lock(&clk_list_lock);
+        clk = __clk_get(dev, id);
+        spin_unlock(&clk_list_lock);
+
+        return clk;
+}
+
 EXPORT_SYMBOL(clk_get);
 
 void clk_put(struct clk *clk)
@@ -257,15 +265,15 @@ static int clk_show(struct seq_file *s, void *unused)
         spin_lock(&clk_list_lock);
 
         /* show clock tree as derived from the three oscillators */
-        clk = clk_get(NULL, "osc32k");
+        clk = __clk_get(NULL, "osc32k");
         dump_clock(clk, &r);
         clk_put(clk);
 
-        clk = clk_get(NULL, "osc0");
+        clk = __clk_get(NULL, "osc0");
         dump_clock(clk, &r);
         clk_put(clk);
 
-        clk = clk_get(NULL, "osc1");
+        clk = __clk_get(NULL, "osc1");
         dump_clock(clk, &r);
         clk_put(clk);
 
diff --git a/arch/avr32/mach-at32ap/extint.c b/arch/avr32/mach-at32ap/extint.c
index 47ba4b9b6db1..fbc2aeaebddb 100644
--- a/arch/avr32/mach-at32ap/extint.c
+++ b/arch/avr32/mach-at32ap/extint.c
@@ -61,34 +61,34 @@ struct eic {
 static struct eic *nmi_eic;
 static bool nmi_enabled;
 
-static void eic_ack_irq(struct irq_chip *d)
+static void eic_ack_irq(struct irq_data *d)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         eic_writel(eic, ICR, 1 << (d->irq - eic->first_irq));
 }
 
-static void eic_mask_irq(struct irq_chip *d)
+static void eic_mask_irq(struct irq_data *d)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         eic_writel(eic, IDR, 1 << (d->irq - eic->first_irq));
 }
 
-static void eic_mask_ack_irq(struct irq_chip *d)
+static void eic_mask_ack_irq(struct irq_data *d)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         eic_writel(eic, ICR, 1 << (d->irq - eic->first_irq));
         eic_writel(eic, IDR, 1 << (d->irq - eic->first_irq));
 }
 
-static void eic_unmask_irq(struct irq_chip *d)
+static void eic_unmask_irq(struct irq_data *d)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         eic_writel(eic, IER, 1 << (d->irq - eic->first_irq));
 }
 
-static int eic_set_irq_type(struct irq_chip *d, unsigned int flow_type)
+static int eic_set_irq_type(struct irq_data *d, unsigned int flow_type)
 {
-        struct eic *eic = irq_data_get_irq_chip_data(data);
+        struct eic *eic = irq_data_get_irq_chip_data(d);
         unsigned int irq = d->irq;
         unsigned int i = irq - eic->first_irq;
         u32 mode, edge, level;
@@ -191,7 +191,7 @@ static int __init eic_probe(struct platform_device *pdev)
 
         regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         int_irq = platform_get_irq(pdev, 0);
-        if (!regs || !int_irq) {
+        if (!regs || (int)int_irq <= 0) {
                 dev_dbg(&pdev->dev, "missing regs and/or irq resource\n");
                 return -ENXIO;
         }
diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
index f308e1ddc629..2e0aa853a4bc 100644
--- a/arch/avr32/mach-at32ap/pio.c
+++ b/arch/avr32/mach-at32ap/pio.c
@@ -257,7 +257,7 @@ static void gpio_irq_mask(struct irq_data *d)
         pio_writel(pio, IDR, 1 << (gpio & 0x1f));
 }
 
-static void gpio_irq_unmask(struct irq_data *d))
+static void gpio_irq_unmask(struct irq_data *d)
 {
         unsigned                gpio = irq_to_gpio(d->irq);
         struct pio_device       *pio = &pio_dev[gpio >> 5];
diff --git a/arch/avr32/mach-at32ap/pm-at32ap700x.S b/arch/avr32/mach-at32ap/pm-at32ap700x.S
index 17503b0ed6c9..f868f4ce761b 100644
--- a/arch/avr32/mach-at32ap/pm-at32ap700x.S
+++ b/arch/avr32/mach-at32ap/pm-at32ap700x.S
@@ -53,7 +53,7 @@ cpu_enter_idle:
         st.w    r8[TI_flags], r9
         unmask_interrupts
         sleep   CPU_SLEEP_IDLE
-        .size   cpu_idle_sleep, . - cpu_idle_sleep
+        .size   cpu_enter_idle, . - cpu_enter_idle
 
         /*
          * Common return path for PM functions that don't run from
diff --git a/arch/blackfin/include/asm/system.h b/arch/blackfin/include/asm/system.h
index 19e2c7c3e63a..44bd0cced725 100644
--- a/arch/blackfin/include/asm/system.h
+++ b/arch/blackfin/include/asm/system.h
@@ -19,11 +19,11 @@
  * Force strict CPU ordering.
  */
 #define nop()  __asm__ __volatile__ ("nop;\n\t" : : )
-#define mb()   __asm__ __volatile__ (""   : : : "memory")
-#define rmb()  __asm__ __volatile__ (""   : : : "memory")
-#define wmb()  __asm__ __volatile__ (""   : : : "memory")
-#define set_mb(var, value) do { (void) xchg(&var, value); } while (0)
-#define read_barrier_depends()          do { } while(0)
+#define smp_mb()  mb()
+#define smp_rmb() rmb()
+#define smp_wmb() wmb()
+#define set_mb(var, value) do { var = value; mb(); } while (0)
+#define smp_read_barrier_depends()      read_barrier_depends()
 
 #ifdef CONFIG_SMP
 asmlinkage unsigned long __raw_xchg_1_asm(volatile void *ptr, unsigned long value);
@@ -37,16 +37,16 @@ asmlinkage unsigned long __raw_cmpxchg_4_asm(volatile void *ptr,
                                         unsigned long new, unsigned long old);
 
 #ifdef __ARCH_SYNC_CORE_DCACHE
-# define smp_mb()       do { barrier(); smp_check_barrier(); smp_mark_barrier(); } while (0)
-# define smp_rmb()      do { barrier(); smp_check_barrier(); } while (0)
-# define smp_wmb()      do { barrier(); smp_mark_barrier(); } while (0)
-#define smp_read_barrier_depends()      do { barrier(); smp_check_barrier(); } while (0)
-
+/* Force Core data cache coherence */
+# define mb()   do { barrier(); smp_check_barrier(); smp_mark_barrier(); } while (0)
+# define rmb()  do { barrier(); smp_check_barrier(); } while (0)
+# define wmb()  do { barrier(); smp_mark_barrier(); } while (0)
+# define read_barrier_depends() do { barrier(); smp_check_barrier(); } while (0)
 #else
-# define smp_mb()       barrier()
-# define smp_rmb()      barrier()
-# define smp_wmb()      barrier()
-#define smp_read_barrier_depends()      barrier()
+# define mb()   barrier()
+# define rmb()  barrier()
+# define wmb()  barrier()
+# define read_barrier_depends() do { } while (0)
 #endif
 
 static inline unsigned long __xchg(unsigned long x, volatile void *ptr,
@@ -99,10 +99,10 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
 
 #else /* !CONFIG_SMP */
 
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()      do { } while(0)
+#define mb()    barrier()
+#define rmb()   barrier()
+#define wmb()   barrier()
+#define read_barrier_depends()  do { } while (0)
 
 struct __xchg_dummy {
         unsigned long a[100];
diff --git a/arch/blackfin/kernel/gptimers.c b/arch/blackfin/kernel/gptimers.c
index cdbe075de1dc..8b81dc04488a 100644
--- a/arch/blackfin/kernel/gptimers.c
+++ b/arch/blackfin/kernel/gptimers.c
@@ -268,7 +268,7 @@ void disable_gptimers(uint16_t mask)
         _disable_gptimers(mask);
         for (i = 0; i < MAX_BLACKFIN_GPTIMERS; ++i)
                 if (mask & (1 << i))
-                        group_regs[BFIN_TIMER_OCTET(i)]->status |= trun_mask[i];
+                        group_regs[BFIN_TIMER_OCTET(i)]->status = trun_mask[i];
         SSYNC();
 }
 EXPORT_SYMBOL(disable_gptimers);
diff --git a/arch/blackfin/kernel/time-ts.c b/arch/blackfin/kernel/time-ts.c
index 8c9a43daf80f..cdb4beb6bc8f 100644
--- a/arch/blackfin/kernel/time-ts.c
+++ b/arch/blackfin/kernel/time-ts.c
@@ -206,8 +206,14 @@ irqreturn_t bfin_gptmr0_interrupt(int irq, void *dev_id)
 {
         struct clock_event_device *evt = dev_id;
         smp_mb();
-        evt->event_handler(evt);
+        /*
+         * We want to ACK before we handle so that we can handle smaller timer
+         * intervals.  This way if the timer expires again while we're handling
+         * things, we're more likely to see that 2nd int rather than swallowing
+         * it by ACKing the int at the end of this handler.
+         */
         bfin_gptmr0_ack();
+        evt->event_handler(evt);
         return IRQ_HANDLED;
 }
 
diff --git a/arch/blackfin/mach-common/smp.c b/arch/blackfin/mach-common/smp.c
index 6e17a265c4d3..8bce5ed031e4 100644
--- a/arch/blackfin/mach-common/smp.c
+++ b/arch/blackfin/mach-common/smp.c
@@ -109,10 +109,23 @@ static void ipi_flush_icache(void *info)
         struct blackfin_flush_data *fdata = info;
 
         /* Invalidate the memory holding the bounds of the flushed region. */
-        invalidate_dcache_range((unsigned long)fdata,
-                (unsigned long)fdata + sizeof(*fdata));
+        blackfin_dcache_invalidate_range((unsigned long)fdata,
+                                         (unsigned long)fdata + sizeof(*fdata));
+
+        /* Make sure all write buffers in the data side of the core
+         * are flushed before trying to invalidate the icache.  This
+         * needs to be after the data flush and before the icache
+         * flush so that the SSYNC does the right thing in preventing
+         * the instruction prefetcher from hitting things in cached
+         * memory at the wrong time -- it runs much further ahead than
+         * the pipeline.
+         */
+        SSYNC();
 
-        flush_icache_range(fdata->start, fdata->end);
+        /* ipi_flaush_icache is invoked by generic flush_icache_range,
+         * so call blackfin arch icache flush directly here.
+         */
+        blackfin_icache_flush_range(fdata->start, fdata->end);
 }
 
 static void ipi_call_function(unsigned int cpu, struct ipi_message *msg)
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 26d851d385bb..29e17907d9f2 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -343,10 +343,14 @@
 #define __NR_fanotify_init      337
 #define __NR_fanotify_mark      338
 #define __NR_prlimit64          339
+#define __NR_name_to_handle_at  340
+#define __NR_open_by_handle_at  341
+#define __NR_clock_adjtime      342
+#define __NR_syncfs             343
 
 #ifdef __KERNEL__
 
-#define NR_syscalls             340
+#define NR_syscalls             344
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/m68k/kernel/entry_mm.S b/arch/m68k/kernel/entry_mm.S
index 1559dea36e55..1359ee659574 100644
--- a/arch/m68k/kernel/entry_mm.S
+++ b/arch/m68k/kernel/entry_mm.S
@@ -750,4 +750,8 @@ sys_call_table:
         .long sys_fanotify_init
         .long sys_fanotify_mark
         .long sys_prlimit64
+        .long sys_name_to_handle_at     /* 340 */
+        .long sys_open_by_handle_at
+        .long sys_clock_adjtime
+        .long sys_syncfs
 
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 79b1ed198c07..9b8393d8adb8 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -358,6 +358,10 @@ ENTRY(sys_call_table)
         .long sys_fanotify_init
         .long sys_fanotify_mark
         .long sys_prlimit64
+        .long sys_name_to_handle_at     /* 340 */
+        .long sys_open_by_handle_at
+        .long sys_clock_adjtime
+        .long sys_syncfs
 
         .rept NR_syscalls-(.-sys_call_table)/4
                 .long sys_ni_syscall
diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
index 02b7a03e4226..8b3db1c587fc 100644
--- a/arch/m68k/mm/motorola.c
+++ b/arch/m68k/mm/motorola.c
@@ -300,6 +300,8 @@ void __init paging_init(void)
                 zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
                 free_area_init_node(i, zones_size,
                                     m68k_memory[i].addr >> PAGE_SHIFT, NULL);
+                if (node_present_pages(i))
+                        node_set_state(i, N_NORMAL_MEMORY);
         }
 }
 
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 851b3bf6e962..eccdefe70d4e 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -6,7 +6,6 @@ config MICROBLAZE
         select HAVE_FUNCTION_GRAPH_TRACER
         select HAVE_DYNAMIC_FTRACE
         select HAVE_FTRACE_MCOUNT_RECORD
-        select USB_ARCH_HAS_EHCI
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select HAVE_OPROFILE
         select HAVE_ARCH_KGDB
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index b7ed8d7a9b33..b1d126258dee 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -266,8 +266,10 @@ static void __init setup_bootmem(void)
         }
         memset(pfnnid_map, 0xff, sizeof(pfnnid_map));
 
-        for (i = 0; i < npmem_ranges; i++)
+        for (i = 0; i < npmem_ranges; i++) {
+                node_set_state(i, N_NORMAL_MEMORY);
                 node_set_online(i);
+        }
 #endif
 
         /*
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index b6ff882f695b..8f4d50b0adfa 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -209,7 +209,7 @@ config ARCH_HIBERNATION_POSSIBLE
 config ARCH_SUSPEND_POSSIBLE
         def_bool y
         depends on ADB_PMU || PPC_EFIKA || PPC_LITE5200 || PPC_83xx || \
-                   PPC_85xx || PPC_86xx || PPC_PSERIES || 44x || 40x
+                   (PPC_85xx && !SMP) || PPC_86xx || PPC_PSERIES || 44x || 40x
 
 config PPC_DCR_NATIVE
         bool
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index be3cdf9134ce..1833d1a07e79 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -382,10 +382,12 @@ extern const char *powerpc_base_platform;
 #define CPU_FTRS_E500_2 (CPU_FTR_MAYBE_CAN_DOZE | CPU_FTR_USE_TB | \
             CPU_FTR_SPE_COMP | CPU_FTR_MAYBE_CAN_NAP | \
             CPU_FTR_NODSISRALIGN | CPU_FTR_NOEXECUTE)
-#define CPU_FTRS_E500MC (CPU_FTR_MAYBE_CAN_DOZE | CPU_FTR_USE_TB | \
-            CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_NODSISRALIGN | \
+#define CPU_FTRS_E500MC (CPU_FTR_USE_TB | CPU_FTR_NODSISRALIGN | \
             CPU_FTR_L2CSR | CPU_FTR_LWSYNC | CPU_FTR_NOEXECUTE | \
             CPU_FTR_DBELL)
+#define CPU_FTRS_E5500  (CPU_FTR_USE_TB | CPU_FTR_NODSISRALIGN | \
+            CPU_FTR_L2CSR | CPU_FTR_LWSYNC | CPU_FTR_NOEXECUTE | \
+            CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD)
 #define CPU_FTRS_GENERIC_32     (CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
 
 /* 64-bit CPUs */
@@ -435,11 +437,15 @@ extern const char *powerpc_base_platform;
 #define CPU_FTRS_COMPATIBLE     (CPU_FTR_USE_TB | CPU_FTR_PPCAS_ARCH_V2)
 
 #ifdef __powerpc64__
+#ifdef CONFIG_PPC_BOOK3E
+#define CPU_FTRS_POSSIBLE       (CPU_FTRS_E5500)
+#else
 #define CPU_FTRS_POSSIBLE       \
             (CPU_FTRS_POWER3 | CPU_FTRS_RS64 | CPU_FTRS_POWER4 |        \
             CPU_FTRS_PPC970 | CPU_FTRS_POWER5 | CPU_FTRS_POWER6 |       \
             CPU_FTRS_POWER7 | CPU_FTRS_CELL | CPU_FTRS_PA6T |           \
             CPU_FTR_1T_SEGMENT | CPU_FTR_VSX)
+#endif
 #else
 enum {
         CPU_FTRS_POSSIBLE =
@@ -473,16 +479,21 @@ enum {
 #endif
 #ifdef CONFIG_E500
             CPU_FTRS_E500 | CPU_FTRS_E500_2 | CPU_FTRS_E500MC |
+            CPU_FTRS_E5500 |
 #endif
             0,
 };
 #endif /* __powerpc64__ */
 
 #ifdef __powerpc64__
+#ifdef CONFIG_PPC_BOOK3E
+#define CPU_FTRS_ALWAYS         (CPU_FTRS_E5500)
+#else
 #define CPU_FTRS_ALWAYS         \
             (CPU_FTRS_POWER3 & CPU_FTRS_RS64 & CPU_FTRS_POWER4 &        \
             CPU_FTRS_PPC970 & CPU_FTRS_POWER5 & CPU_FTRS_POWER6 &       \
             CPU_FTRS_POWER7 & CPU_FTRS_CELL & CPU_FTRS_PA6T & CPU_FTRS_POSSIBLE)
+#endif
 #else
 enum {
         CPU_FTRS_ALWAYS =
@@ -513,6 +524,7 @@ enum {
 #endif
 #ifdef CONFIG_E500
             CPU_FTRS_E500 & CPU_FTRS_E500_2 & CPU_FTRS_E500MC &
+            CPU_FTRS_E5500 &
 #endif
             CPU_FTRS_POSSIBLE,
 };
diff --git a/arch/powerpc/include/asm/pte-common.h b/arch/powerpc/include/asm/pte-common.h
index 811f04ac3660..8d1569c29042 100644
--- a/arch/powerpc/include/asm/pte-common.h
+++ b/arch/powerpc/include/asm/pte-common.h
@@ -162,7 +162,7 @@ extern unsigned long bad_call_to_PMD_PAGE_SIZE(void);
  * on platforms where such control is possible.
  */
 #if defined(CONFIG_KGDB) || defined(CONFIG_XMON) || defined(CONFIG_BDI_SWITCH) ||\
-        defined(CONFIG_KPROBES)
+        defined(CONFIG_KPROBES) || defined(CONFIG_DYNAMIC_FTRACE)
 #define PAGE_KERNEL_TEXT        PAGE_KERNEL_X
 #else
 #define PAGE_KERNEL_TEXT        PAGE_KERNEL_ROX
diff --git a/arch/powerpc/include/asm/uninorth.h b/arch/powerpc/include/asm/uninorth.h
index ae9c899c8a6d..d12b11d7641e 100644
--- a/arch/powerpc/include/asm/uninorth.h
+++ b/arch/powerpc/include/asm/uninorth.h
@@ -60,7 +60,7 @@
  *
  * Obviously, the GART is not cache coherent and so any change to it
  * must be flushed to memory (or maybe just make the GART space non
- * cachable). AGP memory itself does't seem to be cache coherent neither.
+ * cachable). AGP memory itself doesn't seem to be cache coherent neither.
  *
  * In order to invalidate the GART (which is probably necessary to inval
  * the bridge internal TLBs), the following sequence has to be written,
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index c9b68d07ac4f..b9602ee06deb 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -1973,7 +1973,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pvr_mask               = 0xffff0000,
                 .pvr_value              = 0x80240000,
                 .cpu_name               = "e5500",
-                .cpu_features           = CPU_FTRS_E500MC,
+                .cpu_features           = CPU_FTRS_E5500,
                 .cpu_user_features      = COMMON_USER_BOOKE,
                 .mmu_features           = MMU_FTR_TYPE_FSL_E | MMU_FTR_BIG_PHYS |
                         MMU_FTR_USE_TLBILX,
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index 3d3d416339dd..5b5e1f002a8e 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -163,7 +163,7 @@ static void crash_kexec_prepare_cpus(int cpu)
 }
 
 /* wait for all the CPUs to hit real mode but timeout if they don't come in */
-#if defined(CONFIG_PPC_STD_MMU_64) && defined(CONFIG_SMP)
+#ifdef CONFIG_PPC_STD_MMU_64
 static void crash_kexec_wait_realmode(int cpu)
 {
         unsigned int msecs;
@@ -188,9 +188,7 @@ static void crash_kexec_wait_realmode(int cpu)
         }
         mb();
 }
-#else
-static inline void crash_kexec_wait_realmode(int cpu) {}
-#endif
+#endif  /* CONFIG_PPC_STD_MMU_64 */
 
 /*
  * This function will be called by secondary cpus or by kexec cpu
@@ -235,7 +233,9 @@ void crash_kexec_secondary(struct pt_regs *regs)
         crash_ipi_callback(regs);
 }
 
-#else
+#else   /* ! CONFIG_SMP */
+static inline void crash_kexec_wait_realmode(int cpu) {}
+
 static void crash_kexec_prepare_cpus(int cpu)
 {
         /*
@@ -255,7 +255,7 @@ void crash_kexec_secondary(struct pt_regs *regs)
 {
         cpus_in_sr = CPU_MASK_NONE;
 }
-#endif
+#endif  /* CONFIG_SMP */
 
 /*
  * Register a function to be called on shutdown.  Only use this if you
diff --git a/arch/powerpc/kernel/ibmebus.c b/arch/powerpc/kernel/ibmebus.c
index c00d4ca1ee15..28581f1ad2c0 100644
--- a/arch/powerpc/kernel/ibmebus.c
+++ b/arch/powerpc/kernel/ibmebus.c
@@ -527,7 +527,7 @@ static int ibmebus_bus_pm_resume_noirq(struct device *dev)
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int ibmebus_bus_pm_freeze(struct device *dev)
 {
@@ -665,7 +665,7 @@ static int ibmebus_bus_pm_restore_noirq(struct device *dev)
         return ret;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define ibmebus_bus_pm_freeze           NULL
 #define ibmebus_bus_pm_thaw             NULL
@@ -676,7 +676,7 @@ static int ibmebus_bus_pm_restore_noirq(struct device *dev)
 #define ibmebus_bus_pm_poweroff_noirq   NULL
 #define ibmebus_bus_pm_restore_noirq    NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 static struct dev_pm_ops ibmebus_bus_dev_pm_ops = {
         .prepare = ibmebus_bus_pm_prepare,
diff --git a/arch/powerpc/kernel/legacy_serial.c b/arch/powerpc/kernel/legacy_serial.c
index c834757bebc0..2b97b80d6d7d 100644
--- a/arch/powerpc/kernel/legacy_serial.c
+++ b/arch/powerpc/kernel/legacy_serial.c
@@ -330,9 +330,11 @@ void __init find_legacy_serial_ports(void)
                 if (!parent)
                         continue;
                 if (of_match_node(legacy_serial_parents, parent) != NULL) {
-                        index = add_legacy_soc_port(np, np);
-                        if (index >= 0 && np == stdout)
-                                legacy_serial_console = index;
+                        if (of_device_is_available(np)) {
+                                index = add_legacy_soc_port(np, np);
+                                if (index >= 0 && np == stdout)
+                                        legacy_serial_console = index;
+                        }
                 }
                 of_node_put(parent);
         }
diff --git a/arch/powerpc/kernel/perf_event.c b/arch/powerpc/kernel/perf_event.c
index c4063b7f49a0..822f63008ae1 100644
--- a/arch/powerpc/kernel/perf_event.c
+++ b/arch/powerpc/kernel/perf_event.c
@@ -398,6 +398,25 @@ static int check_excludes(struct perf_event **ctrs, unsigned int cflags[],
         return 0;
 }
 
+static u64 check_and_compute_delta(u64 prev, u64 val)
+{
+        u64 delta = (val - prev) & 0xfffffffful;
+
+        /*
+         * POWER7 can roll back counter values, if the new value is smaller
+         * than the previous value it will cause the delta and the counter to
+         * have bogus values unless we rolled a counter over.  If a coutner is
+         * rolled back, it will be smaller, but within 256, which is the maximum
+         * number of events to rollback at once.  If we dectect a rollback
+         * return 0.  This can lead to a small lack of precision in the
+         * counters.
+         */
+        if (prev > val && (prev - val) < 256)
+                delta = 0;
+
+        return delta;
+}
+
 static void power_pmu_read(struct perf_event *event)
 {
         s64 val, delta, prev;
@@ -416,10 +435,11 @@ static void power_pmu_read(struct perf_event *event)
                 prev = local64_read(&event->hw.prev_count);
                 barrier();
                 val = read_pmc(event->hw.idx);
+                delta = check_and_compute_delta(prev, val);
+                if (!delta)
+                        return;
         } while (local64_cmpxchg(&event->hw.prev_count, prev, val) != prev);
 
-        /* The counters are only 32 bits wide */
-        delta = (val - prev) & 0xfffffffful;
         local64_add(delta, &event->count);
         local64_sub(delta, &event->hw.period_left);
 }
@@ -449,8 +469,9 @@ static void freeze_limited_counters(struct cpu_hw_events *cpuhw,
                 val = (event->hw.idx == 5) ? pmc5 : pmc6;
                 prev = local64_read(&event->hw.prev_count);
                 event->hw.idx = 0;
-                delta = (val - prev) & 0xfffffffful;
-                local64_add(delta, &event->count);
+                delta = check_and_compute_delta(prev, val);
+                if (delta)
+                        local64_add(delta, &event->count);
         }
 }
 
@@ -458,14 +479,16 @@ static void thaw_limited_counters(struct cpu_hw_events *cpuhw,
                                   unsigned long pmc5, unsigned long pmc6)
 {
         struct perf_event *event;
-        u64 val;
+        u64 val, prev;
         int i;
 
         for (i = 0; i < cpuhw->n_limited; ++i) {
                 event = cpuhw->limited_counter[i];
                 event->hw.idx = cpuhw->limited_hwidx[i];
                 val = (event->hw.idx == 5) ? pmc5 : pmc6;
-                local64_set(&event->hw.prev_count, val);
+                prev = local64_read(&event->hw.prev_count);
+                if (check_and_compute_delta(prev, val))
+                        local64_set(&event->hw.prev_count, val);
                 perf_event_update_userpage(event);
         }
 }
@@ -1197,7 +1220,7 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
 
         /* we don't have to worry about interrupts here */
         prev = local64_read(&event->hw.prev_count);
-        delta = (val - prev) & 0xfffffffful;
+        delta = check_and_compute_delta(prev, val);
         local64_add(delta, &event->count);
 
         /*
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 375480c56eb9..f33acfd872ad 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -229,6 +229,9 @@ static u64 scan_dispatch_log(u64 stop_tb)
         u64 stolen = 0;
         u64 dtb;
 
+        if (!dtl)
+                return 0;
+
         if (i == vpa->dtl_idx)
                 return 0;
         while (i < vpa->dtl_idx) {
diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
index a830c5e80657..bc5f0dc6ae1e 100644
--- a/arch/powerpc/platforms/powermac/smp.c
+++ b/arch/powerpc/platforms/powermac/smp.c
@@ -842,6 +842,7 @@ static void __devinit smp_core99_setup_cpu(int cpu_nr)
         mpic_setup_this_cpu();
 }
 
+#ifdef CONFIG_PPC64
 #ifdef CONFIG_HOTPLUG_CPU
 static int smp_core99_cpu_notify(struct notifier_block *self,
                                  unsigned long action, void *hcpu)
@@ -879,7 +880,6 @@ static struct notifier_block __cpuinitdata smp_core99_cpu_nb = {
 
 static void __init smp_core99_bringup_done(void)
 {
-#ifdef CONFIG_PPC64
         extern void g5_phy_disable_cpu1(void);
 
         /* Close i2c bus if it was used for tb sync */
@@ -894,14 +894,14 @@ static void __init smp_core99_bringup_done(void)
                 set_cpu_present(1, false);
                 g5_phy_disable_cpu1();
         }
-#endif /* CONFIG_PPC64 */
-
 #ifdef CONFIG_HOTPLUG_CPU
         register_cpu_notifier(&smp_core99_cpu_nb);
 #endif
+
         if (ppc_md.progress)
                 ppc_md.progress("smp_core99_bringup_done", 0x349);
 }
+#endif /* CONFIG_PPC64 */
 
 #ifdef CONFIG_HOTPLUG_CPU
 
@@ -975,7 +975,9 @@ static void pmac_cpu_die(void)
 struct smp_ops_t core99_smp_ops = {
         .message_pass   = smp_mpic_message_pass,
         .probe          = smp_core99_probe,
+#ifdef CONFIG_PPC64
         .bringup_done   = smp_core99_bringup_done,
+#endif
         .kick_cpu       = smp_core99_kick_cpu,
         .setup_cpu      = smp_core99_setup_cpu,
         .give_timebase  = smp_core99_give_timebase,
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 000724149089..6c42cfde8415 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -287,14 +287,22 @@ static int alloc_dispatch_logs(void)
         int cpu, ret;
         struct paca_struct *pp;
         struct dtl_entry *dtl;
+        struct kmem_cache *dtl_cache;
 
         if (!firmware_has_feature(FW_FEATURE_SPLPAR))
                 return 0;
 
+        dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES,
+                                                DISPATCH_LOG_BYTES, 0, NULL);
+        if (!dtl_cache) {
+                pr_warn("Failed to create dispatch trace log buffer cache\n");
+                pr_warn("Stolen time statistics will be unreliable\n");
+                return 0;
+        }
+
         for_each_possible_cpu(cpu) {
                 pp = &paca[cpu];
-                dtl = kmalloc_node(DISPATCH_LOG_BYTES, GFP_KERNEL,
-                                   cpu_to_node(cpu));
+                dtl = kmem_cache_alloc(dtl_cache, GFP_KERNEL);
                 if (!dtl) {
                         pr_warn("Failed to allocate dispatch trace log for cpu %d\n",
                                 cpu);
diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c
index f8f7f28c6343..68ca9290df94 100644
--- a/arch/powerpc/sysdev/fsl_pci.c
+++ b/arch/powerpc/sysdev/fsl_pci.c
@@ -324,6 +324,11 @@ int __init fsl_add_bridge(struct device_node *dev, int is_primary)
         struct resource rsrc;
         const int *bus_range;
 
+        if (!of_device_is_available(dev)) {
+                pr_warning("%s: disabled\n", dev->full_name);
+                return -ENODEV;
+        }
+
         pr_debug("Adding PCI host bridge %s\n", dev->full_name);
 
         /* Fetch host bridge registers address */
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 14232d57369c..49798532b477 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -1457,7 +1457,6 @@ int fsl_rio_setup(struct platform_device *dev)
         port->ops = ops;
         port->priv = priv;
         port->phys_efptr = 0x100;
-        rio_register_mport(port);
 
         priv->regs_win = ioremap(regs.start, regs.end - regs.start + 1);
         rio_regs_win = priv->regs_win;
@@ -1504,6 +1503,9 @@ int fsl_rio_setup(struct platform_device *dev)
         dev_info(&dev->dev, "RapidIO Common Transport System size: %d\n",
                         port->sys_size ? 65536 : 256);
 
+        if (rio_register_mport(port))
+                goto err;
+
         if (port->host_deviceid >= 0)
                 out_be32(priv->regs_win + RIO_GCCSR, RIO_PORT_GEN_HOST |
                         RIO_PORT_GEN_MASTER | RIO_PORT_GEN_DISCOVERED);
diff --git a/arch/s390/crypto/prng.c b/arch/s390/crypto/prng.c
index 975e3ab13cb5..8b16c479585b 100644
--- a/arch/s390/crypto/prng.c
+++ b/arch/s390/crypto/prng.c
@@ -76,7 +76,7 @@ static void prng_seed(int nbytes)
 
         /* Add the entropy */
         while (nbytes >= 8) {
-                *((__u64 *)parm_block) ^= *((__u64 *)buf+i*8);
+                *((__u64 *)parm_block) ^= *((__u64 *)(buf+i));
                 prng_add_entropy();
                 i += 8;
                 nbytes -= 8;
diff --git a/arch/s390/kvm/sie64a.S b/arch/s390/kvm/sie64a.S
index 7e9d30d567b0..ab0e041ac54c 100644
--- a/arch/s390/kvm/sie64a.S
+++ b/arch/s390/kvm/sie64a.S
@@ -48,10 +48,10 @@ sie_irq_handler:
         tm      __TI_flags+7(%r2),_TIF_EXIT_SIE
         jz      0f
         larl    %r2,sie_exit                    # work pending, leave sie
-        stg     %r2,__LC_RETURN_PSW+8
+        stg     %r2,SPI_PSW+8(0,%r15)
         br      %r14
 0:      larl    %r2,sie_reenter                 # re-enter with guest id
-        stg     %r2,__LC_RETURN_PSW+8
+        stg     %r2,SPI_PSW+8(0,%r15)
 1:      br      %r14
 
 /*
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 9217e332b118..ab988135e5c6 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -543,7 +543,6 @@ static void pfault_interrupt(unsigned int ext_int_code,
         struct task_struct *tsk;
         __u16 subcode;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_PFL]++;
         /*
          * Get the external interruption subcode & pfault
          * initial/completion signal bit. VM stores this 
@@ -553,14 +552,15 @@ static void pfault_interrupt(unsigned int ext_int_code,
         subcode = ext_int_code >> 16;
         if ((subcode & 0xff00) != __SUBCODE_MASK)
                 return;
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_PFL]++;
 
         /*
          * Get the token (= address of the task structure of the affected task).
          */
 #ifdef CONFIG_64BIT
-        tsk = *(struct task_struct **) param64;
+        tsk = (struct task_struct *) param64;
 #else
-        tsk = *(struct task_struct **) param32;
+        tsk = (struct task_struct *) param32;
 #endif
 
         if (subcode & 0x0080) {
diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c
index 122ffbd08ce0..0607e4b14b27 100644
--- a/arch/s390/mm/pageattr.c
+++ b/arch/s390/mm/pageattr.c
@@ -24,12 +24,13 @@ static void change_page_attr(unsigned long addr, int numpages,
                         WARN_ON_ONCE(1);
                         continue;
                 }
-                ptep = pte_offset_kernel(pmdp, addr + i * PAGE_SIZE);
+                ptep = pte_offset_kernel(pmdp, addr);
 
                 pte = *ptep;
                 pte = set(pte);
-                ptep_invalidate(&init_mm, addr + i * PAGE_SIZE, ptep);
+                ptep_invalidate(&init_mm, addr, ptep);
                 *ptep = pte;
+                addr += PAGE_SIZE;
         }
 }
 
diff --git a/arch/um/Kconfig.um b/arch/um/Kconfig.um
index 90a438acbfaf..b5e675e370c6 100644
--- a/arch/um/Kconfig.um
+++ b/arch/um/Kconfig.um
@@ -47,7 +47,7 @@ config HOSTFS
 
 config HPPFS
         tristate "HoneyPot ProcFS (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        depends on EXPERIMENTAL && PROC_FS
         help
           hppfs (HoneyPot ProcFS) is a filesystem which allows UML /proc
           entries to be overridden, removed, or fabricated from the host.
diff --git a/arch/um/Kconfig.x86 b/arch/um/Kconfig.x86
index 02fb017fed47..a9da516a5274 100644
--- a/arch/um/Kconfig.x86
+++ b/arch/um/Kconfig.x86
@@ -4,6 +4,10 @@ menu "UML-specific options"
 
 menu "Host processor type and features"
 
+config CMPXCHG_LOCAL
+        bool
+        default n
+
 source "arch/x86/Kconfig.cpu"
 
 endmenu
diff --git a/arch/um/include/asm/bug.h b/arch/um/include/asm/bug.h
new file mode 100644
index 000000000000..9e33b864c359
--- /dev/null
+++ b/arch/um/include/asm/bug.h
@@ -0,0 +1,6 @@
+#ifndef __UM_BUG_H
+#define __UM_BUG_H
+
+#include <asm-generic/bug.h>
+
+#endif
diff --git a/arch/um/include/asm/thread_info.h b/arch/um/include/asm/thread_info.h
index e2cf786bda0a..5bd1bad33fab 100644
--- a/arch/um/include/asm/thread_info.h
+++ b/arch/um/include/asm/thread_info.h
@@ -49,7 +49,10 @@ static inline struct thread_info *current_thread_info(void)
 {
         struct thread_info *ti;
         unsigned long mask = THREAD_SIZE - 1;
-        ti = (struct thread_info *) (((unsigned long) &ti) & ~mask);
+        void *p;
+
+        asm volatile ("" : "=r" (p) : "0" (&ti));
+        ti = (struct thread_info *) (((unsigned long)p) & ~mask);
         return ti;
 }
 
diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
index 804b28dd0328..b1da91c1b200 100644
--- a/arch/um/sys-i386/Makefile
+++ b/arch/um/sys-i386/Makefile
@@ -4,7 +4,7 @@
 
 obj-y = bug.o bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
         ptrace_user.o setjmp.o signal.o stub.o stub_segv.o syscalls.o sysrq.o \
-        sys_call_table.o tls.o
+        sys_call_table.o tls.o atomic64_cx8_32.o
 
 obj-$(CONFIG_BINFMT_ELF) += elfcore.o
 
diff --git a/arch/um/sys-i386/atomic64_cx8_32.S b/arch/um/sys-i386/atomic64_cx8_32.S
new file mode 100644
index 000000000000..1e901d3d4a95
--- /dev/null
+++ b/arch/um/sys-i386/atomic64_cx8_32.S
@@ -0,0 +1,225 @@
+/*
+ * atomic64_t for 586+
+ *
+ * Copied from arch/x86/lib/atomic64_cx8_32.S
+ *
+ * Copyright © 2010  Luca Barbieri
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+
+#include <linux/linkage.h>
+#include <asm/alternative-asm.h>
+#include <asm/dwarf2.h>
+
+.macro SAVE reg
+        pushl_cfi %\reg
+        CFI_REL_OFFSET \reg, 0
+.endm
+
+.macro RESTORE reg
+        popl_cfi %\reg
+        CFI_RESTORE \reg
+.endm
+
+.macro read64 reg
+        movl %ebx, %eax
+        movl %ecx, %edx
+/* we need LOCK_PREFIX since otherwise cmpxchg8b always does the write */
+        LOCK_PREFIX
+        cmpxchg8b (\reg)
+.endm
+
+ENTRY(atomic64_read_cx8)
+        CFI_STARTPROC
+
+        read64 %ecx
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_read_cx8)
+
+ENTRY(atomic64_set_cx8)
+        CFI_STARTPROC
+
+1:
+/* we don't need LOCK_PREFIX since aligned 64-bit writes
+ * are atomic on 586 and newer */
+        cmpxchg8b (%esi)
+        jne 1b
+
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_set_cx8)
+
+ENTRY(atomic64_xchg_cx8)
+        CFI_STARTPROC
+
+        movl %ebx, %eax
+        movl %ecx, %edx
+1:
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_xchg_cx8)
+
+.macro addsub_return func ins insc
+ENTRY(atomic64_\func\()_return_cx8)
+        CFI_STARTPROC
+        SAVE ebp
+        SAVE ebx
+        SAVE esi
+        SAVE edi
+
+        movl %eax, %esi
+        movl %edx, %edi
+        movl %ecx, %ebp
+
+        read64 %ebp
+1:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        \ins\()l %esi, %ebx
+        \insc\()l %edi, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%ebp)
+        jne 1b
+
+10:
+        movl %ebx, %eax
+        movl %ecx, %edx
+        RESTORE edi
+        RESTORE esi
+        RESTORE ebx
+        RESTORE ebp
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_\func\()_return_cx8)
+.endm
+
+addsub_return add add adc
+addsub_return sub sub sbb
+
+.macro incdec_return func ins insc
+ENTRY(atomic64_\func\()_return_cx8)
+        CFI_STARTPROC
+        SAVE ebx
+
+        read64 %esi
+1:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        \ins\()l $1, %ebx
+        \insc\()l $0, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+
+10:
+        movl %ebx, %eax
+        movl %ecx, %edx
+        RESTORE ebx
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_\func\()_return_cx8)
+.endm
+
+incdec_return inc add adc
+incdec_return dec sub sbb
+
+ENTRY(atomic64_dec_if_positive_cx8)
+        CFI_STARTPROC
+        SAVE ebx
+
+        read64 %esi
+1:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        subl $1, %ebx
+        sbb $0, %ecx
+        js 2f
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+
+2:
+        movl %ebx, %eax
+        movl %ecx, %edx
+        RESTORE ebx
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_dec_if_positive_cx8)
+
+ENTRY(atomic64_add_unless_cx8)
+        CFI_STARTPROC
+        SAVE ebp
+        SAVE ebx
+/* these just push these two parameters on the stack */
+        SAVE edi
+        SAVE esi
+
+        movl %ecx, %ebp
+        movl %eax, %esi
+        movl %edx, %edi
+
+        read64 %ebp
+1:
+        cmpl %eax, 0(%esp)
+        je 4f
+2:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        addl %esi, %ebx
+        adcl %edi, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%ebp)
+        jne 1b
+
+        movl $1, %eax
+3:
+        addl $8, %esp
+        CFI_ADJUST_CFA_OFFSET -8
+        RESTORE ebx
+        RESTORE ebp
+        ret
+4:
+        cmpl %edx, 4(%esp)
+        jne 2b
+        xorl %eax, %eax
+        jmp 3b
+        CFI_ENDPROC
+ENDPROC(atomic64_add_unless_cx8)
+
+ENTRY(atomic64_inc_not_zero_cx8)
+        CFI_STARTPROC
+        SAVE ebx
+
+        read64 %esi
+1:
+        testl %eax, %eax
+        je 4f
+2:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        addl $1, %ebx
+        adcl $0, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+
+        movl $1, %eax
+3:
+        RESTORE ebx
+        ret
+4:
+        testl %edx, %edx
+        jne 2b
+        jmp 3b
+        CFI_ENDPROC
+ENDPROC(atomic64_inc_not_zero_cx8)
diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
index cae3feb1035e..db75d07c3645 100644
--- a/arch/x86/boot/memory.c
+++ b/arch/x86/boot/memory.c
@@ -91,7 +91,7 @@ static int detect_memory_e801(void)
         if (oreg.ax > 15*1024) {
                 return -1;      /* Bogus! */
         } else if (oreg.ax == 15*1024) {
-                boot_params.alt_mem_k = (oreg.dx << 6) + oreg.ax;
+                boot_params.alt_mem_k = (oreg.bx << 6) + oreg.ax;
         } else {
                 /*
                  * This ignores memory above 16MB if we have a memory
diff --git a/arch/x86/include/asm/gart.h b/arch/x86/include/asm/gart.h
index 43085bfc99c3..156cd5d18d2a 100644
--- a/arch/x86/include/asm/gart.h
+++ b/arch/x86/include/asm/gart.h
@@ -66,7 +66,7 @@ static inline void gart_set_size_and_enable(struct pci_dev *dev, u32 order)
          * Don't enable translation but enable GART IO and CPU accesses.
          * Also, set DISTLBWALKPRB since GART tables memory is UC.
          */
-        ctl = DISTLBWALKPRB | order << 1;
+        ctl = order << 1;
 
         pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl);
 }
@@ -75,17 +75,17 @@ static inline void enable_gart_translation(struct pci_dev *dev, u64 addr)
 {
         u32 tmp, ctl;
 
-        /* address of the mappings table */
-        addr >>= 12;
-        tmp = (u32) addr<<4;
-        tmp &= ~0xf;
-        pci_write_config_dword(dev, AMD64_GARTTABLEBASE, tmp);
-
-        /* Enable GART translation for this hammer. */
-        pci_read_config_dword(dev, AMD64_GARTAPERTURECTL, &ctl);
-        ctl |= GARTEN;
-        ctl &= ~(DISGARTCPU | DISGARTIO);
-        pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl);
+        /* address of the mappings table */
+        addr >>= 12;
+        tmp = (u32) addr<<4;
+        tmp &= ~0xf;
+        pci_write_config_dword(dev, AMD64_GARTTABLEBASE, tmp);
+
+        /* Enable GART translation for this hammer. */
+        pci_read_config_dword(dev, AMD64_GARTAPERTURECTL, &ctl);
+        ctl |= GARTEN | DISTLBWALKPRB;
+        ctl &= ~(DISGARTCPU | DISGARTIO);
+        pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, ctl);
 }
 
 static inline int aperture_valid(u64 aper_base, u32 aper_size, u32 min_size)
diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h
index c4bd267dfc50..a97a240f67f3 100644
--- a/arch/x86/include/asm/io_apic.h
+++ b/arch/x86/include/asm/io_apic.h
@@ -150,7 +150,7 @@ void setup_IO_APIC_irq_extra(u32 gsi);
 extern void ioapic_and_gsi_init(void);
 extern void ioapic_insert_resources(void);
 
-int io_apic_setup_irq_pin(unsigned int irq, int node, struct io_apic_irq_attr *attr);
+int io_apic_setup_irq_pin_once(unsigned int irq, int node, struct io_apic_irq_attr *attr);
 
 extern struct IO_APIC_route_entry **alloc_ioapic_entries(void);
 extern void free_ioapic_entries(struct IO_APIC_route_entry **ioapic_entries);
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index fd5a1f365c95..3cce71413d0b 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -96,11 +96,15 @@
 #define MSR_IA32_MC0_ADDR               0x00000402
 #define MSR_IA32_MC0_MISC               0x00000403
 
+#define MSR_AMD64_MC0_MASK              0xc0010044
+
 #define MSR_IA32_MCx_CTL(x)             (MSR_IA32_MC0_CTL + 4*(x))
 #define MSR_IA32_MCx_STATUS(x)          (MSR_IA32_MC0_STATUS + 4*(x))
 #define MSR_IA32_MCx_ADDR(x)            (MSR_IA32_MC0_ADDR + 4*(x))
 #define MSR_IA32_MCx_MISC(x)            (MSR_IA32_MC0_MISC + 4*(x))
 
+#define MSR_AMD64_MCx_MASK(x)           (MSR_AMD64_MC0_MASK + (x))
+
 /* These are consecutive and not in the normal 4er MCE bank block */
 #define MSR_IA32_MC0_CTL2               0x00000280
 #define MSR_IA32_MCx_CTL2(x)            (MSR_IA32_MC0_CTL2 + (x))
diff --git a/arch/x86/include/asm/numa.h b/arch/x86/include/asm/numa.h
index 3d4dab43c994..a50fc9f493b3 100644
--- a/arch/x86/include/asm/numa.h
+++ b/arch/x86/include/asm/numa.h
@@ -51,7 +51,7 @@ static inline void numa_remove_cpu(int cpu)		{ }
 #endif  /* CONFIG_NUMA */
 
 #ifdef CONFIG_DEBUG_PER_CPU_MAPS
-struct cpumask __cpuinit *debug_cpumask_set_cpu(int cpu, int enable);
+void debug_cpumask_set_cpu(int cpu, int node, bool enable);
 #endif
 
 #endif  /* _ASM_X86_NUMA_H */
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index 86d1ad4962a7..73fb469908c6 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -499,7 +499,7 @@ out:
                  * Don't enable translation yet but enable GART IO and CPU
                  * accesses and set DISTLBWALKPRB since GART table memory is UC.
                  */
-                u32 ctl = DISTLBWALKPRB | aper_order << 1;
+                u32 ctl = aper_order << 1;
 
                 bus = amd_nb_bus_dev_ranges[i].bus;
                 dev_base = amd_nb_bus_dev_ranges[i].dev_base;
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 68df09bba92e..45fd33d1fd3a 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -128,8 +128,8 @@ static int __init parse_noapic(char *str)
 }
 early_param("noapic", parse_noapic);
 
-static int io_apic_setup_irq_pin_once(unsigned int irq, int node,
-                                      struct io_apic_irq_attr *attr);
+static int io_apic_setup_irq_pin(unsigned int irq, int node,
+                                 struct io_apic_irq_attr *attr);
 
 /* Will be called in mpparse/acpi/sfi codes for saving IRQ info */
 void mp_save_irq(struct mpc_intsrc *m)
@@ -3570,7 +3570,7 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
 }
 #endif /* CONFIG_HT_IRQ */
 
-int
+static int
 io_apic_setup_irq_pin(unsigned int irq, int node, struct io_apic_irq_attr *attr)
 {
         struct irq_cfg *cfg = alloc_irq_and_cfg_at(irq, node);
@@ -3585,8 +3585,8 @@ io_apic_setup_irq_pin(unsigned int irq, int node, struct io_apic_irq_attr *attr)
         return ret;
 }
 
-static int io_apic_setup_irq_pin_once(unsigned int irq, int node,
-                                      struct io_apic_irq_attr *attr)
+int io_apic_setup_irq_pin_once(unsigned int irq, int node,
+                               struct io_apic_irq_attr *attr)
 {
         unsigned int id = attr->ioapic, pin = attr->ioapic_pin;
         int ret;
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index 0b4be431c620..adee12e0da1f 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -228,6 +228,7 @@
 #include <linux/kthread.h>
 #include <linux/jiffies.h>
 #include <linux/acpi.h>
+#include <linux/syscore_ops.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -1238,6 +1239,7 @@ static int suspend(int vetoable)
 
         local_irq_disable();
         sysdev_suspend(PMSG_SUSPEND);
+        syscore_suspend();
 
         local_irq_enable();
 
@@ -1255,6 +1257,7 @@ static int suspend(int vetoable)
                 apm_error("suspend", err);
         err = (err == APM_SUCCESS) ? 0 : -EIO;
 
+        syscore_resume();
         sysdev_resume();
         local_irq_enable();
 
@@ -1280,6 +1283,7 @@ static void standby(void)
 
         local_irq_disable();
         sysdev_suspend(PMSG_SUSPEND);
+        syscore_suspend();
         local_irq_enable();
 
         err = set_system_power_state(APM_STATE_STANDBY);
@@ -1287,6 +1291,7 @@ static void standby(void)
                 apm_error("standby", err);
 
         local_irq_disable();
+        syscore_resume();
         sysdev_resume();
         local_irq_enable();
 
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 3ecece0217ef..3532d3bf8105 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -615,6 +615,25 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
         /* As a rule processors have APIC timer running in deep C states */
         if (c->x86 >= 0xf && !cpu_has_amd_erratum(amd_erratum_400))
                 set_cpu_cap(c, X86_FEATURE_ARAT);
+
+        /*
+         * Disable GART TLB Walk Errors on Fam10h. We do this here
+         * because this is always needed when GART is enabled, even in a
+         * kernel which has no MCE support built in.
+         */
+        if (c->x86 == 0x10) {
+                /*
+                 * BIOS should disable GartTlbWlk Errors themself. If
+                 * it doesn't do it here as suggested by the BKDG.
+                 *
+                 * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012
+                 */
+                u64 mask;
+
+                rdmsrl(MSR_AMD64_MCx_MASK(4), mask);
+                mask |= (1 << 10);
+                wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
+        }
 }
 
 #ifdef CONFIG_X86_32
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index eed3673a8656..e638689279d3 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -586,8 +586,12 @@ static int x86_setup_perfctr(struct perf_event *event)
                         return -EOPNOTSUPP;
         }
 
+        /*
+         * Do not allow config1 (extended registers) to propagate,
+         * there's no sane user-space generalization yet:
+         */
         if (attr->type == PERF_TYPE_RAW)
-                return x86_pmu_extra_regs(event->attr.config, event);
+                return 0;
 
         if (attr->type == PERF_TYPE_HW_CACHE)
                 return set_ext_hw_attr(hwc, event);
@@ -609,8 +613,8 @@ static int x86_setup_perfctr(struct perf_event *event)
         /*
          * Branch tracing:
          */
-        if ((attr->config == PERF_COUNT_HW_BRANCH_INSTRUCTIONS) &&
-            (hwc->sample_period == 1)) {
+        if (attr->config == PERF_COUNT_HW_BRANCH_INSTRUCTIONS &&
+            !attr->freq && hwc->sample_period == 1) {
                 /* BTS is not supported by this architecture. */
                 if (!x86_pmu.bts_active)
                         return -EOPNOTSUPP;
@@ -1284,6 +1288,16 @@ static int x86_pmu_handle_irq(struct pt_regs *regs)
 
         cpuc = &__get_cpu_var(cpu_hw_events);
 
+        /*
+         * Some chipsets need to unmask the LVTPC in a particular spot
+         * inside the nmi handler.  As a result, the unmasking was pushed
+         * into all the nmi handlers.
+         *
+         * This generic handler doesn't seem to have any issues where the
+         * unmasking occurs so it was left at the top.
+         */
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+
         for (idx = 0; idx < x86_pmu.num_counters; idx++) {
                 if (!test_bit(idx, cpuc->active_mask)) {
                         /*
@@ -1370,8 +1384,6 @@ perf_event_nmi_handler(struct notifier_block *self,
                 return NOTIFY_DONE;
         }
 
-        apic_write(APIC_LVTPC, APIC_DM_NMI);
-
         handled = x86_pmu.handle_irq(args->regs);
         if (!handled)
                 return NOTIFY_DONE;
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index 461f62bbd774..cf4e369cea67 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -8,7 +8,7 @@ static __initconst const u64 amd_hw_cache_event_ids
  [ C(L1D) ] = {
         [ C(OP_READ) ] = {
                 [ C(RESULT_ACCESS) ] = 0x0040, /* Data Cache Accesses        */
-                [ C(RESULT_MISS)   ] = 0x0041, /* Data Cache Misses          */
+                [ C(RESULT_MISS)   ] = 0x0141, /* Data Cache Misses          */
         },
         [ C(OP_WRITE) ] = {
                 [ C(RESULT_ACCESS) ] = 0x0142, /* Data Cache Refills :system */
@@ -427,7 +427,9 @@ static __initconst const struct x86_pmu amd_pmu = {
  *
  * Exceptions:
  *
+ * 0x000        FP      PERF_CTL[3], PERF_CTL[5:3] (*)
  * 0x003        FP      PERF_CTL[3]
+ * 0x004        FP      PERF_CTL[3], PERF_CTL[5:3] (*)
  * 0x00B        FP      PERF_CTL[3]
  * 0x00D        FP      PERF_CTL[3]
  * 0x023        DE      PERF_CTL[2:0]
@@ -448,6 +450,8 @@ static __initconst const struct x86_pmu amd_pmu = {
  * 0x0DF        LS      PERF_CTL[5:0]
  * 0x1D6        EX      PERF_CTL[5:0]
  * 0x1D8        EX      PERF_CTL[5:0]
+ *
+ * (*) depending on the umask all FPU counters may be used
  */
 
 static struct event_constraint amd_f15_PMC0  = EVENT_CONSTRAINT(0, 0x01, 0);
@@ -460,18 +464,28 @@ static struct event_constraint amd_f15_PMC53 = EVENT_CONSTRAINT(0, 0x38, 0);
 static struct event_constraint *
 amd_get_event_constraints_f15h(struct cpu_hw_events *cpuc, struct perf_event *event)
 {
-        unsigned int event_code = amd_get_event_code(&event->hw);
+        struct hw_perf_event *hwc = &event->hw;
+        unsigned int event_code = amd_get_event_code(hwc);
 
         switch (event_code & AMD_EVENT_TYPE_MASK) {
         case AMD_EVENT_FP:
                 switch (event_code) {
+                case 0x000:
+                        if (!(hwc->config & 0x0000F000ULL))
+                                break;
+                        if (!(hwc->config & 0x00000F00ULL))
+                                break;
+                        return &amd_f15_PMC3;
+                case 0x004:
+                        if (hweight_long(hwc->config & ARCH_PERFMON_EVENTSEL_UMASK) <= 1)
+                                break;
+                        return &amd_f15_PMC3;
                 case 0x003:
                 case 0x00B:
                 case 0x00D:
                         return &amd_f15_PMC3;
-                default:
-                        return &amd_f15_PMC53;
                 }
+                return &amd_f15_PMC53;
         case AMD_EVENT_LS:
         case AMD_EVENT_DC:
         case AMD_EVENT_EX_LS:
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 8fc2b2cee1da..e61539b07d2c 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -25,7 +25,7 @@ struct intel_percore {
 /*
  * Intel PerfMon, used on Core and later.
  */
-static const u64 intel_perfmon_event_map[] =
+static u64 intel_perfmon_event_map[PERF_COUNT_HW_MAX] __read_mostly =
 {
   [PERF_COUNT_HW_CPU_CYCLES]            = 0x003c,
   [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,
@@ -391,12 +391,12 @@ static __initconst const u64 nehalem_hw_cache_event_ids
 {
  [ C(L1D) ] = {
         [ C(OP_READ) ] = {
-                [ C(RESULT_ACCESS) ] = 0x0f40, /* L1D_CACHE_LD.MESI            */
-                [ C(RESULT_MISS)   ] = 0x0140, /* L1D_CACHE_LD.I_STATE         */
+                [ C(RESULT_ACCESS) ] = 0x010b, /* MEM_INST_RETIRED.LOADS       */
+                [ C(RESULT_MISS)   ] = 0x0151, /* L1D.REPL                     */
         },
         [ C(OP_WRITE) ] = {
-                [ C(RESULT_ACCESS) ] = 0x0f41, /* L1D_CACHE_ST.MESI            */
-                [ C(RESULT_MISS)   ] = 0x0141, /* L1D_CACHE_ST.I_STATE         */
+                [ C(RESULT_ACCESS) ] = 0x020b, /* MEM_INST_RETURED.STORES      */
+                [ C(RESULT_MISS)   ] = 0x0251, /* L1D.M_REPL                   */
         },
         [ C(OP_PREFETCH) ] = {
                 [ C(RESULT_ACCESS) ] = 0x014e, /* L1D_PREFETCH.REQUESTS        */
@@ -933,6 +933,16 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
 
         cpuc = &__get_cpu_var(cpu_hw_events);
 
+        /*
+         * Some chipsets need to unmask the LVTPC in a particular spot
+         * inside the nmi handler.  As a result, the unmasking was pushed
+         * into all the nmi handlers.
+         *
+         * This handler doesn't seem to have any issues with the unmasking
+         * so it was left at the top.
+         */
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+
         intel_pmu_disable_all();
         handled = intel_pmu_drain_bts_buffer();
         status = intel_pmu_get_status();
@@ -998,6 +1008,9 @@ intel_bts_constraints(struct perf_event *event)
         struct hw_perf_event *hwc = &event->hw;
         unsigned int hw_event, bts_event;
 
+        if (event->attr.freq)
+                return NULL;
+
         hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
         bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
 
@@ -1305,7 +1318,7 @@ static void intel_clovertown_quirks(void)
          * AJ106 could possibly be worked around by not allowing LBR
          *       usage from PEBS, including the fixup.
          * AJ68  could possibly be worked around by always programming
-         *       a pebs_event_reset[0] value and coping with the lost events.
+         *       a pebs_event_reset[0] value and coping with the lost events.
          *
          * But taken together it might just make sense to not enable PEBS on
          * these chips.
@@ -1409,6 +1422,18 @@ static __init int intel_pmu_init(void)
                 x86_pmu.percore_constraints = intel_nehalem_percore_constraints;
                 x86_pmu.enable_all = intel_pmu_nhm_enable_all;
                 x86_pmu.extra_regs = intel_nehalem_extra_regs;
+
+                if (ebx & 0x40) {
+                        /*
+                         * Erratum AAJ80 detected, we work it around by using
+                         * the BR_MISP_EXEC.ANY event. This will over-count
+                         * branch-misses, but it's still much better than the
+                         * architectural event which is often completely bogus:
+                         */
+                        intel_perfmon_event_map[PERF_COUNT_HW_BRANCH_MISSES] = 0x7f89;
+
+                        pr_cont("erratum AAJ80 worked around, ");
+                }
                 pr_cont("Nehalem events, ");
                 break;
 
@@ -1425,6 +1450,7 @@ static __init int intel_pmu_init(void)
 
         case 37: /* 32 nm nehalem, "Clarkdale" */
         case 44: /* 32 nm nehalem, "Gulftown" */
+        case 47: /* 32 nm Xeon E7 */
                 memcpy(hw_cache_event_ids, westmere_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
                 memcpy(hw_cache_extra_regs, nehalem_hw_cache_extra_regs,
diff --git a/arch/x86/kernel/cpu/perf_event_p4.c b/arch/x86/kernel/cpu/perf_event_p4.c
index c2520e178d32..e93fcd55fae1 100644
--- a/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/arch/x86/kernel/cpu/perf_event_p4.c
@@ -947,14 +947,23 @@ static int p4_pmu_handle_irq(struct pt_regs *regs)
                 if (!x86_perf_event_set_period(event))
                         continue;
                 if (perf_event_overflow(event, 1, &data, regs))
-                        p4_pmu_disable_event(event);
+                        x86_pmu_stop(event, 0);
         }
 
-        if (handled) {
-                /* p4 quirk: unmask it again */
-                apic_write(APIC_LVTPC, apic_read(APIC_LVTPC) & ~APIC_LVT_MASKED);
+        if (handled)
                 inc_irq_stat(apic_perf_irqs);
-        }
+
+        /*
+         * When dealing with the unmasking of the LVTPC on P4 perf hw, it has
+         * been observed that the OVF bit flag has to be cleared first _before_
+         * the LVTPC can be unmasked.
+         *
+         * The reason is the NMI line will continue to be asserted while the OVF
+         * bit is set.  This causes a second NMI to generate if the LVTPC is
+         * unmasked before the OVF bit is cleared, leading to unknown NMI
+         * messages.
+         */
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
 
         return handled;
 }
diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
index 706a9fb46a58..e90f08458e6b 100644
--- a/arch/x86/kernel/devicetree.c
+++ b/arch/x86/kernel/devicetree.c
@@ -391,7 +391,7 @@ static int ioapic_xlate(struct irq_domain *id, const u32 *intspec, u32 intsize,
 
         set_io_apic_irq_attr(&attr, idx, line, it->trigger, it->polarity);
 
-        return io_apic_setup_irq_pin(*out_hwirq, cpu_to_node(0), &attr);
+        return io_apic_setup_irq_pin_once(*out_hwirq, cpu_to_node(0), &attr);
 }
 
 static void __init ioapic_add_ofnode(struct device_node *np)
diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
index 82ada01625b9..b117efd24f71 100644
--- a/arch/x86/kernel/pci-gart_64.c
+++ b/arch/x86/kernel/pci-gart_64.c
@@ -81,6 +81,9 @@ static u32 gart_unmapped_entry;
 #define AGPEXTERN
 #endif
 
+/* GART can only remap to physical addresses < 1TB */
+#define GART_MAX_PHYS_ADDR      (1ULL << 40)
+
 /* backdoor interface to AGP driver */
 AGPEXTERN int agp_memory_reserved;
 AGPEXTERN __u32 *agp_gatt_table;
@@ -212,9 +215,13 @@ static dma_addr_t dma_map_area(struct device *dev, dma_addr_t phys_mem,
                                 size_t size, int dir, unsigned long align_mask)
 {
         unsigned long npages = iommu_num_pages(phys_mem, size, PAGE_SIZE);
-        unsigned long iommu_page = alloc_iommu(dev, npages, align_mask);
+        unsigned long iommu_page;
         int i;
 
+        if (unlikely(phys_mem + size > GART_MAX_PHYS_ADDR))
+                return bad_dma_addr;
+
+        iommu_page = alloc_iommu(dev, npages, align_mask);
         if (iommu_page == -1) {
                 if (!nonforced_iommu(dev, phys_mem, size))
                         return phys_mem;
diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
index 9559d360fde7..745258dfc4dc 100644
--- a/arch/x86/mm/numa.c
+++ b/arch/x86/mm/numa.c
@@ -213,53 +213,48 @@ int early_cpu_to_node(int cpu)
         return per_cpu(x86_cpu_to_node_map, cpu);
 }
 
-struct cpumask __cpuinit *debug_cpumask_set_cpu(int cpu, int enable)
+void debug_cpumask_set_cpu(int cpu, int node, bool enable)
 {
-        int node = early_cpu_to_node(cpu);
         struct cpumask *mask;
         char buf[64];
 
         if (node == NUMA_NO_NODE) {
                 /* early_cpu_to_node() already emits a warning and trace */
-                return NULL;
+                return;
         }
         mask = node_to_cpumask_map[node];
         if (!mask) {
                 pr_err("node_to_cpumask_map[%i] NULL\n", node);
                 dump_stack();
-                return NULL;
+                return;
         }
 
+        if (enable)
+                cpumask_set_cpu(cpu, mask);
+        else
+                cpumask_clear_cpu(cpu, mask);
+
         cpulist_scnprintf(buf, sizeof(buf), mask);
         printk(KERN_DEBUG "%s cpu %d node %d: mask now %s\n",
                 enable ? "numa_add_cpu" : "numa_remove_cpu",
                 cpu, node, buf);
-        return mask;
+        return;
 }
 
 # ifndef CONFIG_NUMA_EMU
-static void __cpuinit numa_set_cpumask(int cpu, int enable)
+static void __cpuinit numa_set_cpumask(int cpu, bool enable)
 {
-        struct cpumask *mask;
-
-        mask = debug_cpumask_set_cpu(cpu, enable);
-        if (!mask)
-                return;
-
-        if (enable)
-                cpumask_set_cpu(cpu, mask);
-        else
-                cpumask_clear_cpu(cpu, mask);
+        debug_cpumask_set_cpu(cpu, early_cpu_to_node(cpu), enable);
 }
 
 void __cpuinit numa_add_cpu(int cpu)
 {
-        numa_set_cpumask(cpu, 1);
+        numa_set_cpumask(cpu, true);
 }
 
 void __cpuinit numa_remove_cpu(int cpu)
 {
-        numa_set_cpumask(cpu, 0);
+        numa_set_cpumask(cpu, false);
 }
 # endif /* !CONFIG_NUMA_EMU */
 
diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
index ad091e4cff17..de84cc140379 100644
--- a/arch/x86/mm/numa_emulation.c
+++ b/arch/x86/mm/numa_emulation.c
@@ -454,10 +454,9 @@ void __cpuinit numa_remove_cpu(int cpu)
                 cpumask_clear_cpu(cpu, node_to_cpumask_map[i]);
 }
 #else   /* !CONFIG_DEBUG_PER_CPU_MAPS */
-static void __cpuinit numa_set_cpumask(int cpu, int enable)
+static void __cpuinit numa_set_cpumask(int cpu, bool enable)
 {
-        struct cpumask *mask;
-        int nid, physnid, i;
+        int nid, physnid;
 
         nid = early_cpu_to_node(cpu);
         if (nid == NUMA_NO_NODE) {
@@ -467,28 +466,21 @@ static void __cpuinit numa_set_cpumask(int cpu, int enable)
 
         physnid = emu_nid_to_phys[nid];
 
-        for_each_online_node(i) {
+        for_each_online_node(nid) {
                 if (emu_nid_to_phys[nid] != physnid)
                         continue;
 
-                mask = debug_cpumask_set_cpu(cpu, enable);
-                if (!mask)
-                        return;
-
-                if (enable)
-                        cpumask_set_cpu(cpu, mask);
-                else
-                        cpumask_clear_cpu(cpu, mask);
+                debug_cpumask_set_cpu(cpu, nid, enable);
         }
 }
 
 void __cpuinit numa_add_cpu(int cpu)
 {
-        numa_set_cpumask(cpu, 1);
+        numa_set_cpumask(cpu, true);
 }
 
 void __cpuinit numa_remove_cpu(int cpu)
 {
-        numa_set_cpumask(cpu, 0);
+        numa_set_cpumask(cpu, false);
 }
 #endif  /* !CONFIG_DEBUG_PER_CPU_MAPS */
diff --git a/arch/x86/platform/ce4100/falconfalls.dts b/arch/x86/platform/ce4100/falconfalls.dts
index dc701ea58546..e70be38ce039 100644
--- a/arch/x86/platform/ce4100/falconfalls.dts
+++ b/arch/x86/platform/ce4100/falconfalls.dts
@@ -74,6 +74,7 @@
                                 compatible = "intel,ce4100-pci", "pci";
                                 device_type = "pci";
                                 bus-range = <1 1>;
+                                reg = <0x0800 0x0 0x0 0x0 0x0>;
                                 ranges = <0x2000000 0 0xdffe0000 0x2000000 0 0xdffe0000 0 0x1000>;
 
                                 interrupt-parent = <&ioapic2>;
@@ -346,7 +347,7 @@
                                                    "pciclass0c03";
 
                                         reg = <0x16800 0x0 0x0 0x0 0x0>;
-                                        interrupts = <22 3>;
+                                        interrupts = <22 1>;
                                 };
 
                                 usb@d,1 {
@@ -356,7 +357,7 @@
                                                    "pciclass0c03";
 
                                         reg = <0x16900 0x0 0x0 0x0 0x0>;
-                                        interrupts = <22 3>;
+                                        interrupts = <22 1>;
                                 };
 
                                 sata@e,0 {
@@ -366,7 +367,7 @@
                                                    "pciclass0106";
 
                                         reg = <0x17000 0x0 0x0 0x0 0x0>;
-                                        interrupts = <23 3>;
+                                        interrupts = <23 1>;
                                 };
 
                                 flash@f,0 {
@@ -412,6 +413,7 @@
                                 #address-cells = <2>;
                                 #size-cells = <1>;
                                 compatible = "isa";
+                                reg = <0xf800 0x0 0x0 0x0 0x0>;
                                 ranges = <1 0 0 0 0 0x100>;
 
                                 rtc@70 {
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index 5c0207bf959b..275dbc19e2cf 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -97,11 +97,11 @@ static int __init sfi_parse_mtmr(struct sfi_table_header *table)
                         pentry->freq_hz, pentry->irq);
                         if (!pentry->irq)
                                 continue;
-                        mp_irq.type = MP_IOAPIC;
+                        mp_irq.type = MP_INTSRC;
                         mp_irq.irqtype = mp_INT;
 /* triggering mode edge bit 2-3, active high polarity bit 0-1 */
                         mp_irq.irqflag = 5;
-                        mp_irq.srcbus = 0;
+                        mp_irq.srcbus = MP_BUS_ISA;
                         mp_irq.srcbusirq = pentry->irq; /* IRQ */
                         mp_irq.dstapic = MP_APIC_ALL;
                         mp_irq.dstirq = pentry->irq;
@@ -168,10 +168,10 @@ int __init sfi_parse_mrtc(struct sfi_table_header *table)
         for (totallen = 0; totallen < sfi_mrtc_num; totallen++, pentry++) {
                 pr_debug("RTC[%d]: paddr = 0x%08x, irq = %d\n",
                         totallen, (u32)pentry->phys_addr, pentry->irq);
-                mp_irq.type = MP_IOAPIC;
+                mp_irq.type = MP_INTSRC;
                 mp_irq.irqtype = mp_INT;
                 mp_irq.irqflag = 0xf;   /* level trigger and active low */
-                mp_irq.srcbus = 0;
+                mp_irq.srcbus = MP_BUS_ISA;
                 mp_irq.srcbusirq = pentry->irq; /* IRQ */
                 mp_irq.dstapic = MP_APIC_ALL;
                 mp_irq.dstirq = pentry->irq;
@@ -282,7 +282,7 @@ void __init x86_mrst_early_setup(void)
         /* Avoid searching for BIOS MP tables */
         x86_init.mpparse.find_smp_config = x86_init_noop;
         x86_init.mpparse.get_smp_config = x86_init_uint_noop;
-
+        set_bit(MP_BUS_ISA, mp_bus_not_pci);
 }
 
 /*
diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
index 1c7121ba18ff..5cc821cb2e09 100644
--- a/arch/x86/xen/Kconfig
+++ b/arch/x86/xen/Kconfig
@@ -39,6 +39,7 @@ config XEN_MAX_DOMAIN_MEMORY
 config XEN_SAVE_RESTORE
        bool
        depends on XEN
+       select HIBERNATE_CALLBACKS
        default y
 
 config XEN_DEBUG_FS
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 49dbd78ec3cb..e3c6a06cf725 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -238,6 +238,7 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
 static __init void xen_init_cpuid_mask(void)
 {
         unsigned int ax, bx, cx, dx;
+        unsigned int xsave_mask;
 
         cpuid_leaf1_edx_mask =
                 ~((1 << X86_FEATURE_MCE)  |  /* disable MCE */
@@ -249,24 +250,16 @@ static __init void xen_init_cpuid_mask(void)
                 cpuid_leaf1_edx_mask &=
                         ~((1 << X86_FEATURE_APIC) |  /* disable local APIC */
                           (1 << X86_FEATURE_ACPI));  /* disable ACPI */
-
         ax = 1;
-        cx = 0;
         xen_cpuid(&ax, &bx, &cx, &dx);
 
-        /* cpuid claims we support xsave; try enabling it to see what happens */
-        if (cx & (1 << (X86_FEATURE_XSAVE % 32))) {
-                unsigned long cr4;
-
-                set_in_cr4(X86_CR4_OSXSAVE);
-                
-                cr4 = read_cr4();
+        xsave_mask =
+                (1 << (X86_FEATURE_XSAVE % 32)) |
+                (1 << (X86_FEATURE_OSXSAVE % 32));
 
-                if ((cr4 & X86_CR4_OSXSAVE) == 0)
-                        cpuid_leaf1_ecx_mask &= ~(1 << (X86_FEATURE_XSAVE % 32));
-
-                clear_in_cr4(X86_CR4_OSXSAVE);
-        }
+        /* Xen will set CR4.OSXSAVE if supported and not disabled by force */
+        if ((cx & xsave_mask) != xsave_mask)
+                cpuid_leaf1_ecx_mask &= ~xsave_mask; /* disable XSAVE & OSXSAVE */
 }
 
 static void xen_set_debugreg(int reg, unsigned long val)
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index c82df6c9c0f0..aef7af92b28b 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -565,13 +565,13 @@ pte_t xen_make_pte_debug(pteval_t pte)
         if (io_page &&
             (xen_initial_domain() || addr >= ISA_END_ADDRESS)) {
                 other_addr = pfn_to_mfn(addr >> PAGE_SHIFT) << PAGE_SHIFT;
-                WARN(addr != other_addr,
+                WARN_ONCE(addr != other_addr,
                         "0x%lx is using VM_IO, but it is 0x%lx!\n",
                         (unsigned long)addr, (unsigned long)other_addr);
         } else {
                 pteval_t iomap_set = (_pte.pte & PTE_FLAGS_MASK) & _PAGE_IOMAP;
                 other_addr = (_pte.pte & PTE_PFN_MASK);
-                WARN((addr == other_addr) && (!io_page) && (!iomap_set),
+                WARN_ONCE((addr == other_addr) && (!io_page) && (!iomap_set),
                         "0x%lx is missing VM_IO (and wasn't fixed)!\n",
                         (unsigned long)addr);
         }
@@ -1473,16 +1473,20 @@ static void xen_pgd_free(struct mm_struct *mm, pgd_t *pgd)
 #endif
 }
 
+#ifdef CONFIG_X86_32
 static __init pte_t mask_rw_pte(pte_t *ptep, pte_t pte)
 {
-        unsigned long pfn = pte_pfn(pte);
-
-#ifdef CONFIG_X86_32
         /* If there's an existing pte, then don't allow _PAGE_RW to be set */
         if (pte_val_ma(*ptep) & _PAGE_PRESENT)
                 pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) &
                                pte_val_ma(pte));
-#endif
+
+        return pte;
+}
+#else /* CONFIG_X86_64 */
+static __init pte_t mask_rw_pte(pte_t *ptep, pte_t pte)
+{
+        unsigned long pfn = pte_pfn(pte);
 
         /*
          * If the new pfn is within the range of the newly allocated
@@ -1497,6 +1501,7 @@ static __init pte_t mask_rw_pte(pte_t *ptep, pte_t pte)
 
         return pte;
 }
+#endif /* CONFIG_X86_64 */
 
 /* Init-time set_pte while constructing initial pagetables, which
    doesn't allow RO pagetable pages to be remapped RW */
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index fa0269a99377..90bac0aac3a5 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -227,7 +227,7 @@ char * __init xen_memory_setup(void)
 
         memcpy(map_raw, map, sizeof(map));
         e820.nr_map = 0;
-        xen_extra_mem_start = mem_end;
+        xen_extra_mem_start = max((1ULL << 32), mem_end);
         for (i = 0; i < memmap.nr_entries; i++) {
                 unsigned long long end;
 
diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c
index d77089df412e..4340ee076bd5 100644
--- a/arch/xtensa/kernel/irq.c
+++ b/arch/xtensa/kernel/irq.c
@@ -64,47 +64,41 @@ asmlinkage void do_IRQ(int irq, struct pt_regs *regs)
 
 int arch_show_interrupts(struct seq_file *p, int prec)
 {
-        int j;
-
-        seq_printf(p, "%*s: ", prec, "NMI");
-        for_each_online_cpu(j)
-                seq_printf(p, "%10u ", nmi_count(j));
-        seq_putc(p, '\n');
         seq_printf(p, "%*s: ", prec, "ERR");
         seq_printf(p, "%10u\n", atomic_read(&irq_err_count));
         return 0;
 }
 
-static void xtensa_irq_mask(struct irq_chip *d)
+static void xtensa_irq_mask(struct irq_data *d)
 {
         cached_irq_mask &= ~(1 << d->irq);
         set_sr (cached_irq_mask, INTENABLE);
 }
 
-static void xtensa_irq_unmask(struct irq_chip *d)
+static void xtensa_irq_unmask(struct irq_data *d)
 {
         cached_irq_mask |= 1 << d->irq;
         set_sr (cached_irq_mask, INTENABLE);
 }
 
-static void xtensa_irq_enable(struct irq_chip *d)
+static void xtensa_irq_enable(struct irq_data *d)
 {
         variant_irq_enable(d->irq);
         xtensa_irq_unmask(d->irq);
 }
 
-static void xtensa_irq_disable(struct irq_chip *d)
+static void xtensa_irq_disable(struct irq_data *d)
 {
         xtensa_irq_mask(d->irq);
         variant_irq_disable(d->irq);
 }
 
-static void xtensa_irq_ack(struct irq_chip *d)
+static void xtensa_irq_ack(struct irq_data *d)
 {
         set_sr(1 << d->irq, INTCLEAR);
 }
 
-static int xtensa_irq_retrigger(struct irq_chip *d)
+static int xtensa_irq_retrigger(struct irq_data *d)
 {
         set_sr (1 << d->irq, INTSET);
         return 1;
diff --git a/block/blk-core.c b/block/blk-core.c
index 90f22cc30799..a2e58eeb3549 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -198,26 +198,13 @@ void blk_dump_rq_flags(struct request *rq, char *msg)
 }
 EXPORT_SYMBOL(blk_dump_rq_flags);
 
-/*
- * Make sure that plugs that were pending when this function was entered,
- * are now complete and requests pushed to the queue.
-*/
-static inline void queue_sync_plugs(struct request_queue *q)
-{
-        /*
-         * If the current process is plugged and has barriers submitted,
-         * we will livelock if we don't unplug first.
-         */
-        blk_flush_plug(current);
-}
-
 static void blk_delay_work(struct work_struct *work)
 {
         struct request_queue *q;
 
         q = container_of(work, struct request_queue, delay_work.work);
         spin_lock_irq(q->queue_lock);
-        __blk_run_queue(q, false);
+        __blk_run_queue(q);
         spin_unlock_irq(q->queue_lock);
 }
 
@@ -233,7 +220,8 @@ static void blk_delay_work(struct work_struct *work)
  */
 void blk_delay_queue(struct request_queue *q, unsigned long msecs)
 {
-        schedule_delayed_work(&q->delay_work, msecs_to_jiffies(msecs));
+        queue_delayed_work(kblockd_workqueue, &q->delay_work,
+                                msecs_to_jiffies(msecs));
 }
 EXPORT_SYMBOL(blk_delay_queue);
 
@@ -251,7 +239,7 @@ void blk_start_queue(struct request_queue *q)
         WARN_ON(!irqs_disabled());
 
         queue_flag_clear(QUEUE_FLAG_STOPPED, q);
-        __blk_run_queue(q, false);
+        __blk_run_queue(q);
 }
 EXPORT_SYMBOL(blk_start_queue);
 
@@ -298,38 +286,42 @@ void blk_sync_queue(struct request_queue *q)
 {
         del_timer_sync(&q->timeout);
         cancel_delayed_work_sync(&q->delay_work);
-        queue_sync_plugs(q);
 }
 EXPORT_SYMBOL(blk_sync_queue);
 
 /**
  * __blk_run_queue - run a single device queue
  * @q:  The queue to run
- * @force_kblockd: Don't run @q->request_fn directly.  Use kblockd.
  *
  * Description:
  *    See @blk_run_queue. This variant must be called with the queue lock
  *    held and interrupts disabled.
- *
  */
-void __blk_run_queue(struct request_queue *q, bool force_kblockd)
+void __blk_run_queue(struct request_queue *q)
 {
         if (unlikely(blk_queue_stopped(q)))
                 return;
 
-        /*
-         * Only recurse once to avoid overrunning the stack, let the unplug
-         * handling reinvoke the handler shortly if we already got there.
-         */
-        if (!force_kblockd && !queue_flag_test_and_set(QUEUE_FLAG_REENTER, q)) {
-                q->request_fn(q);
-                queue_flag_clear(QUEUE_FLAG_REENTER, q);
-        } else
-                queue_delayed_work(kblockd_workqueue, &q->delay_work, 0);
+        q->request_fn(q);
 }
 EXPORT_SYMBOL(__blk_run_queue);
 
 /**
+ * blk_run_queue_async - run a single device queue in workqueue context
+ * @q:  The queue to run
+ *
+ * Description:
+ *    Tells kblockd to perform the equivalent of @blk_run_queue on behalf
+ *    of us.
+ */
+void blk_run_queue_async(struct request_queue *q)
+{
+        if (likely(!blk_queue_stopped(q)))
+                queue_delayed_work(kblockd_workqueue, &q->delay_work, 0);
+}
+EXPORT_SYMBOL(blk_run_queue_async);
+
+/**
  * blk_run_queue - run a single device queue
  * @q: The queue to run
  *
@@ -342,7 +334,7 @@ void blk_run_queue(struct request_queue *q)
         unsigned long flags;
 
         spin_lock_irqsave(q->queue_lock, flags);
-        __blk_run_queue(q, false);
+        __blk_run_queue(q);
         spin_unlock_irqrestore(q->queue_lock, flags);
 }
 EXPORT_SYMBOL(blk_run_queue);
@@ -991,7 +983,7 @@ void blk_insert_request(struct request_queue *q, struct request *rq,
                 blk_queue_end_tag(q, rq);
 
         add_acct_request(q, rq, where);
-        __blk_run_queue(q, false);
+        __blk_run_queue(q);
         spin_unlock_irqrestore(q->queue_lock, flags);
 }
 EXPORT_SYMBOL(blk_insert_request);
@@ -1311,7 +1303,15 @@ get_rq:
 
         plug = current->plug;
         if (plug) {
-                if (!plug->should_sort && !list_empty(&plug->list)) {
+                /*
+                 * If this is the first request added after a plug, fire
+                 * of a plug trace. If others have been added before, check
+                 * if we have multiple devices in this plug. If so, make a
+                 * note to sort the list before dispatch.
+                 */
+                if (list_empty(&plug->list))
+                        trace_block_plug(q);
+                else if (!plug->should_sort) {
                         struct request *__rq;
 
                         __rq = list_entry_rq(plug->list.prev);
@@ -1327,7 +1327,7 @@ get_rq:
         } else {
                 spin_lock_irq(q->queue_lock);
                 add_acct_request(q, req, where);
-                __blk_run_queue(q, false);
+                __blk_run_queue(q);
 out_unlock:
                 spin_unlock_irq(q->queue_lock);
         }
@@ -2644,6 +2644,7 @@ void blk_start_plug(struct blk_plug *plug)
 
         plug->magic = PLUG_MAGIC;
         INIT_LIST_HEAD(&plug->list);
+        INIT_LIST_HEAD(&plug->cb_list);
         plug->should_sort = 0;
 
         /*
@@ -2668,33 +2669,93 @@ static int plug_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
         return !(rqa->q <= rqb->q);
 }
 
-static void flush_plug_list(struct blk_plug *plug)
+/*
+ * If 'from_schedule' is true, then postpone the dispatch of requests
+ * until a safe kblockd context. We due this to avoid accidental big
+ * additional stack usage in driver dispatch, in places where the originally
+ * plugger did not intend it.
+ */
+static void queue_unplugged(struct request_queue *q, unsigned int depth,
+                            bool from_schedule)
+        __releases(q->queue_lock)
+{
+        trace_block_unplug(q, depth, !from_schedule);
+
+        /*
+         * If we are punting this to kblockd, then we can safely drop
+         * the queue_lock before waking kblockd (which needs to take
+         * this lock).
+         */
+        if (from_schedule) {
+                spin_unlock(q->queue_lock);
+                blk_run_queue_async(q);
+        } else {
+                __blk_run_queue(q);
+                spin_unlock(q->queue_lock);
+        }
+
+}
+
+static void flush_plug_callbacks(struct blk_plug *plug)
+{
+        LIST_HEAD(callbacks);
+
+        if (list_empty(&plug->cb_list))
+                return;
+
+        list_splice_init(&plug->cb_list, &callbacks);
+
+        while (!list_empty(&callbacks)) {
+                struct blk_plug_cb *cb = list_first_entry(&callbacks,
+                                                          struct blk_plug_cb,
+                                                          list);
+                list_del(&cb->list);
+                cb->callback(cb);
+        }
+}
+
+void blk_flush_plug_list(struct blk_plug *plug, bool from_schedule)
 {
         struct request_queue *q;
         unsigned long flags;
         struct request *rq;
+        LIST_HEAD(list);
+        unsigned int depth;
 
         BUG_ON(plug->magic != PLUG_MAGIC);
 
+        flush_plug_callbacks(plug);
         if (list_empty(&plug->list))
                 return;
 
-        if (plug->should_sort)
-                list_sort(NULL, &plug->list, plug_rq_cmp);
+        list_splice_init(&plug->list, &list);
+
+        if (plug->should_sort) {
+                list_sort(NULL, &list, plug_rq_cmp);
+                plug->should_sort = 0;
+        }
 
         q = NULL;
+        depth = 0;
+
+        /*
+         * Save and disable interrupts here, to avoid doing it for every
+         * queue lock we have to take.
+         */
         local_irq_save(flags);
-        while (!list_empty(&plug->list)) {
-                rq = list_entry_rq(plug->list.next);
+        while (!list_empty(&list)) {
+                rq = list_entry_rq(list.next);
                 list_del_init(&rq->queuelist);
                 BUG_ON(!(rq->cmd_flags & REQ_ON_PLUG));
                 BUG_ON(!rq->q);
                 if (rq->q != q) {
-                        if (q) {
-                                __blk_run_queue(q, false);
-                                spin_unlock(q->queue_lock);
-                        }
+                        /*
+                         * This drops the queue lock
+                         */
+                        if (q)
+                                queue_unplugged(q, depth, from_schedule);
                         q = rq->q;
+                        depth = 0;
                         spin_lock(q->queue_lock);
                 }
                 rq->cmd_flags &= ~REQ_ON_PLUG;
@@ -2706,38 +2767,27 @@ static void flush_plug_list(struct blk_plug *plug)
                         __elv_add_request(q, rq, ELEVATOR_INSERT_FLUSH);
                 else
                         __elv_add_request(q, rq, ELEVATOR_INSERT_SORT_MERGE);
-        }
 
-        if (q) {
-                __blk_run_queue(q, false);
-                spin_unlock(q->queue_lock);
+                depth++;
         }
 
-        BUG_ON(!list_empty(&plug->list));
-        local_irq_restore(flags);
-}
-
-static void __blk_finish_plug(struct task_struct *tsk, struct blk_plug *plug)
-{
-        flush_plug_list(plug);
+        /*
+         * This drops the queue lock
+         */
+        if (q)
+                queue_unplugged(q, depth, from_schedule);
 
-        if (plug == tsk->plug)
-                tsk->plug = NULL;
+        local_irq_restore(flags);
 }
 
 void blk_finish_plug(struct blk_plug *plug)
 {
-        if (plug)
-                __blk_finish_plug(current, plug);
-}
-EXPORT_SYMBOL(blk_finish_plug);
+        blk_flush_plug_list(plug, false);
 
-void __blk_flush_plug(struct task_struct *tsk, struct blk_plug *plug)
-{
-        __blk_finish_plug(tsk, plug);
-        tsk->plug = plug;
+        if (plug == current->plug)
+                current->plug = NULL;
 }
-EXPORT_SYMBOL(__blk_flush_plug);
+EXPORT_SYMBOL(blk_finish_plug);
 
 int __init blk_dev_init(void)
 {
diff --git a/block/blk-exec.c b/block/blk-exec.c
index 7482b7fa863b..81e31819a597 100644
--- a/block/blk-exec.c
+++ b/block/blk-exec.c
@@ -55,7 +55,7 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
         WARN_ON(irqs_disabled());
         spin_lock_irq(q->queue_lock);
         __elv_add_request(q, rq, where);
-        __blk_run_queue(q, false);
+        __blk_run_queue(q);
         /* the queue is stopped so it won't be plugged+unplugged */
         if (rq->cmd_type == REQ_TYPE_PM_RESUME)
                 q->request_fn(q);
diff --git a/block/blk-flush.c b/block/blk-flush.c
index eba4a2790c6c..6c9b5e189e62 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -218,7 +218,7 @@ static void flush_end_io(struct request *flush_rq, int error)
          * request_fn may confuse the driver.  Always use kblockd.
          */
         if (queued)
-                __blk_run_queue(q, true);
+                blk_run_queue_async(q);
 }
 
 /**
@@ -274,7 +274,7 @@ static void flush_data_end_io(struct request *rq, int error)
          * the comment in flush_end_io().
          */
         if (blk_flush_complete_seq(rq, REQ_FSEQ_DATA, error))
-                __blk_run_queue(q, true);
+                blk_run_queue_async(q);
 }
 
 /**
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 261c75c665ae..bd236313f35d 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -66,14 +66,14 @@ queue_requests_store(struct request_queue *q, const char *page, size_t count)
 
         if (rl->count[BLK_RW_SYNC] >= q->nr_requests) {
                 blk_set_queue_full(q, BLK_RW_SYNC);
-        } else if (rl->count[BLK_RW_SYNC]+1 <= q->nr_requests) {
+        } else {
                 blk_clear_queue_full(q, BLK_RW_SYNC);
                 wake_up(&rl->wait[BLK_RW_SYNC]);
         }
 
         if (rl->count[BLK_RW_ASYNC] >= q->nr_requests) {
                 blk_set_queue_full(q, BLK_RW_ASYNC);
-        } else if (rl->count[BLK_RW_ASYNC]+1 <= q->nr_requests) {
+        } else {
                 blk_clear_queue_full(q, BLK_RW_ASYNC);
                 wake_up(&rl->wait[BLK_RW_ASYNC]);
         }
@@ -498,7 +498,6 @@ int blk_register_queue(struct gendisk *disk)
 {
         int ret;
         struct device *dev = disk_to_dev(disk);
-
         struct request_queue *q = disk->queue;
 
         if (WARN_ON(!q))
@@ -509,8 +508,10 @@ int blk_register_queue(struct gendisk *disk)
                 return ret;
 
         ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
-        if (ret < 0)
+        if (ret < 0) {
+                blk_trace_remove_sysfs(dev);
                 return ret;
+        }
 
         kobject_uevent(&q->kobj, KOBJ_ADD);
 
@@ -521,7 +522,7 @@ int blk_register_queue(struct gendisk *disk)
         if (ret) {
                 kobject_uevent(&q->kobj, KOBJ_REMOVE);
                 kobject_del(&q->kobj);
-                blk_trace_remove_sysfs(disk_to_dev(disk));
+                blk_trace_remove_sysfs(dev);
                 kobject_put(&dev->kobj);
                 return ret;
         }
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 3be881ec95ad..5b52011e3a40 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -2582,28 +2582,20 @@ static void cfq_put_queue(struct cfq_queue *cfqq)
 }
 
 /*
- * Must always be called with the rcu_read_lock() held
+ * Call func for each cic attached to this ioc.
  */
 static void
-__call_for_each_cic(struct io_context *ioc,
-                    void (*func)(struct io_context *, struct cfq_io_context *))
+call_for_each_cic(struct io_context *ioc,
+                  void (*func)(struct io_context *, struct cfq_io_context *))
 {
         struct cfq_io_context *cic;
         struct hlist_node *n;
 
+        rcu_read_lock();
+
         hlist_for_each_entry_rcu(cic, n, &ioc->cic_list, cic_list)
                 func(ioc, cic);
-}
 
-/*
- * Call func for each cic attached to this ioc.
- */
-static void
-call_for_each_cic(struct io_context *ioc,
-                  void (*func)(struct io_context *, struct cfq_io_context *))
-{
-        rcu_read_lock();
-        __call_for_each_cic(ioc, func);
         rcu_read_unlock();
 }
 
@@ -2664,7 +2656,7 @@ static void cfq_free_io_context(struct io_context *ioc)
          * should be ok to iterate over the known list, we will see all cic's
          * since no new ones are added.
          */
-        __call_for_each_cic(ioc, cic_free_func);
+        call_for_each_cic(ioc, cic_free_func);
 }
 
 static void cfq_put_cooperator(struct cfq_queue *cfqq)
@@ -3368,7 +3360,7 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                             cfqd->busy_queues > 1) {
                                 cfq_del_timer(cfqd, cfqq);
                                 cfq_clear_cfqq_wait_request(cfqq);
-                                __blk_run_queue(cfqd->queue, false);
+                                __blk_run_queue(cfqd->queue);
                         } else {
                                 cfq_blkiocg_update_idle_time_stats(
                                                 &cfqq->cfqg->blkg);
@@ -3383,7 +3375,7 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                  * this new queue is RT and the current one is BE
                  */
                 cfq_preempt_queue(cfqd, cfqq);
-                __blk_run_queue(cfqd->queue, false);
+                __blk_run_queue(cfqd->queue);
         }
 }
 
@@ -3743,7 +3735,7 @@ static void cfq_kick_queue(struct work_struct *work)
         struct request_queue *q = cfqd->queue;
 
         spin_lock_irq(q->queue_lock);
-        __blk_run_queue(cfqd->queue, false);
+        __blk_run_queue(cfqd->queue);
         spin_unlock_irq(q->queue_lock);
 }
 
diff --git a/block/elevator.c b/block/elevator.c
index 0cdb4e7ebab4..45ca1e34f582 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -642,7 +642,7 @@ void elv_quiesce_start(struct request_queue *q)
          */
         elv_drain_elevator(q);
         while (q->rq.elvpriv) {
-                __blk_run_queue(q, false);
+                __blk_run_queue(q);
                 spin_unlock_irq(q->queue_lock);
                 msleep(10);
                 spin_lock_irq(q->queue_lock);
@@ -671,7 +671,8 @@ void __elv_add_request(struct request_queue *q, struct request *rq, int where)
                         q->boundary_rq = rq;
                 }
         } else if (!(rq->cmd_flags & REQ_ELVPRIV) &&
-                    where == ELEVATOR_INSERT_SORT)
+                    (where == ELEVATOR_INSERT_SORT ||
+                     where == ELEVATOR_INSERT_SORT_MERGE))
                 where = ELEVATOR_INSERT_BACK;
 
         switch (where) {
@@ -695,7 +696,7 @@ void __elv_add_request(struct request_queue *q, struct request *rq, int where)
                  *   with anything.  There's no point in delaying queue
                  *   processing.
                  */
-                __blk_run_queue(q, false);
+                __blk_run_queue(q);
                 break;
 
         case ELEVATOR_INSERT_SORT_MERGE:
diff --git a/block/genhd.c b/block/genhd.c
index b364bd038a18..2dd988723d73 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -1588,9 +1588,13 @@ static void disk_events_workfn(struct work_struct *work)
 
         spin_unlock_irq(&ev->lock);
 
-        /* tell userland about new events */
+        /*
+         * Tell userland about new events.  Only the events listed in
+         * @disk->events are reported.  Unlisted events are processed the
+         * same internally but never get reported to userland.
+         */
         for (i = 0; i < ARRAY_SIZE(disk_uevents); i++)
-                if (events & (1 << i))
+                if (events & disk->events & (1 << i))
                         envp[nr_events++] = disk_uevents[i];
 
         if (nr_events)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index b136c9c1e531..449c556274c0 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -943,6 +943,10 @@ static int acpi_bus_get_flags(struct acpi_device *device)
         if (ACPI_SUCCESS(status))
                 device->flags.lockable = 1;
 
+        /* Power resources cannot be power manageable. */
+        if (device->device_type == ACPI_BUS_TYPE_POWER)
+                return 0;
+
         /* Presence of _PS0|_PR0 indicates 'power manageable' */
         status = acpi_get_handle(device->handle, "_PS0", &temp);
         if (ACPI_FAILURE(status))
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 821040503154..7025593a58c8 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -214,7 +214,7 @@ static int amba_pm_resume_noirq(struct device *dev)
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int amba_pm_freeze(struct device *dev)
 {
@@ -352,7 +352,7 @@ static int amba_pm_restore_noirq(struct device *dev)
         return ret;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define amba_pm_freeze          NULL
 #define amba_pm_thaw            NULL
@@ -363,7 +363,7 @@ static int amba_pm_restore_noirq(struct device *dev)
 #define amba_pm_poweroff_noirq  NULL
 #define amba_pm_restore_noirq   NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #ifdef CONFIG_PM
 
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 39d829cd82dd..71afe0371311 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -150,7 +150,7 @@ static const struct ata_port_info ahci_port_info[] = {
         {
                 AHCI_HFLAGS     (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
                                  AHCI_HFLAG_YES_NCQ),
-                .flags          = AHCI_FLAG_COMMON,
+                .flags          = AHCI_FLAG_COMMON | ATA_FLAG_NO_DIPM,
                 .pio_mask       = ATA_PIO4,
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &ahci_ops,
@@ -261,6 +261,12 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
         { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* PBG RAID */
         { PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */
+        { PCI_VDEVICE(INTEL, 0x1e02), board_ahci }, /* Panther Point AHCI */
+        { PCI_VDEVICE(INTEL, 0x1e03), board_ahci }, /* Panther Point AHCI */
+        { PCI_VDEVICE(INTEL, 0x1e04), board_ahci }, /* Panther Point RAID */
+        { PCI_VDEVICE(INTEL, 0x1e05), board_ahci }, /* Panther Point RAID */
+        { PCI_VDEVICE(INTEL, 0x1e06), board_ahci }, /* Panther Point RAID */
+        { PCI_VDEVICE(INTEL, 0x1e07), board_ahci }, /* Panther Point RAID */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 39865009c251..12c5282e7fca 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -229,6 +229,10 @@ enum {
         EM_CTL_ALHD             = (1 << 26), /* Activity LED */
         EM_CTL_XMT              = (1 << 25), /* Transmit Only */
         EM_CTL_SMB              = (1 << 24), /* Single Message Buffer */
+        EM_CTL_SGPIO            = (1 << 19), /* SGPIO messages supported */
+        EM_CTL_SES              = (1 << 18), /* SES-2 messages supported */
+        EM_CTL_SAFTE            = (1 << 17), /* SAF-TE messages supported */
+        EM_CTL_LED              = (1 << 16), /* LED messages supported */
 
         /* em message type */
         EM_MSG_TYPE_LED         = (1 << 0), /* LED */
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 0bc3fd6c3fdb..6f6e7718b05c 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -309,6 +309,14 @@ static const struct pci_device_id piix_pci_tbl[] = {
         { 0x8086, 0x1d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
         /* SATA Controller IDE (PBG) */
         { 0x8086, 0x1d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (Panther Point) */
+        { 0x8086, 0x1e00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
+        /* SATA Controller IDE (Panther Point) */
+        { 0x8086, 0x1e01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
+        /* SATA Controller IDE (Panther Point) */
+        { 0x8086, 0x1e08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (Panther Point) */
+        { 0x8086, 0x1e09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
         { }     /* terminate list */
 };
 
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 26d452339e98..ff9d832a163d 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -109,6 +109,8 @@ static ssize_t ahci_read_em_buffer(struct device *dev,
 static ssize_t ahci_store_em_buffer(struct device *dev,
                                     struct device_attribute *attr,
                                     const char *buf, size_t size);
+static ssize_t ahci_show_em_supported(struct device *dev,
+                                      struct device_attribute *attr, char *buf);
 
 static DEVICE_ATTR(ahci_host_caps, S_IRUGO, ahci_show_host_caps, NULL);
 static DEVICE_ATTR(ahci_host_cap2, S_IRUGO, ahci_show_host_cap2, NULL);
@@ -116,6 +118,7 @@ static DEVICE_ATTR(ahci_host_version, S_IRUGO, ahci_show_host_version, NULL);
 static DEVICE_ATTR(ahci_port_cmd, S_IRUGO, ahci_show_port_cmd, NULL);
 static DEVICE_ATTR(em_buffer, S_IWUSR | S_IRUGO,
                    ahci_read_em_buffer, ahci_store_em_buffer);
+static DEVICE_ATTR(em_message_supported, S_IRUGO, ahci_show_em_supported, NULL);
 
 struct device_attribute *ahci_shost_attrs[] = {
         &dev_attr_link_power_management_policy,
@@ -126,6 +129,7 @@ struct device_attribute *ahci_shost_attrs[] = {
         &dev_attr_ahci_host_version,
         &dev_attr_ahci_port_cmd,
         &dev_attr_em_buffer,
+        &dev_attr_em_message_supported,
         NULL
 };
 EXPORT_SYMBOL_GPL(ahci_shost_attrs);
@@ -343,6 +347,24 @@ static ssize_t ahci_store_em_buffer(struct device *dev,
         return size;
 }
 
+static ssize_t ahci_show_em_supported(struct device *dev,
+                                      struct device_attribute *attr, char *buf)
+{
+        struct Scsi_Host *shost = class_to_shost(dev);
+        struct ata_port *ap = ata_shost_to_port(shost);
+        struct ahci_host_priv *hpriv = ap->host->private_data;
+        void __iomem *mmio = hpriv->mmio;
+        u32 em_ctl;
+
+        em_ctl = readl(mmio + HOST_EM_CTL);
+
+        return sprintf(buf, "%s%s%s%s\n",
+                       em_ctl & EM_CTL_LED ? "led " : "",
+                       em_ctl & EM_CTL_SAFTE ? "saf-te " : "",
+                       em_ctl & EM_CTL_SES ? "ses-2 " : "",
+                       em_ctl & EM_CTL_SGPIO ? "sgpio " : "");
+}
+
 /**
  *      ahci_save_initial_config - Save and fixup initial config values
  *      @dev: target AHCI device
@@ -539,6 +561,27 @@ void ahci_start_engine(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
         u32 tmp;
+        u8 status;
+
+        status = readl(port_mmio + PORT_TFDATA) & 0xFF;
+
+        /*
+         * At end of section 10.1 of AHCI spec (rev 1.3), it states
+         * Software shall not set PxCMD.ST to 1 until it is determined
+         * that a functoinal device is present on the port as determined by
+         * PxTFD.STS.BSY=0, PxTFD.STS.DRQ=0 and PxSSTS.DET=3h
+         *
+         * Even though most AHCI host controllers work without this check,
+         * specific controller will fail under this condition
+         */
+        if (status & (ATA_BUSY | ATA_DRQ))
+                return;
+        else {
+                ahci_scr_read(&ap->link, SCR_STATUS, &tmp);
+
+                if ((tmp & 0xf) != 0x3)
+                        return;
+        }
 
         /* start DMA */
         tmp = readl(port_mmio + PORT_CMD);
@@ -1897,7 +1940,17 @@ static void ahci_pmp_attach(struct ata_port *ap)
         ahci_enable_fbs(ap);
 
         pp->intr_mask |= PORT_IRQ_BAD_PMP;
-        writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
+
+        /*
+         * We must not change the port interrupt mask register if the
+         * port is marked frozen, the value in pp->intr_mask will be
+         * restored later when the port is thawed.
+         *
+         * Note that during initialization, the port is marked as
+         * frozen since the irq handler is not yet registered.
+         */
+        if (!(ap->pflags & ATA_PFLAG_FROZEN))
+                writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
 }
 
 static void ahci_pmp_detach(struct ata_port *ap)
@@ -1913,7 +1966,10 @@ static void ahci_pmp_detach(struct ata_port *ap)
         writel(cmd, port_mmio + PORT_CMD);
 
         pp->intr_mask &= ~PORT_IRQ_BAD_PMP;
-        writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
+
+        /* see comment above in ahci_pmp_attach() */
+        if (!(ap->pflags & ATA_PFLAG_FROZEN))
+                writel(pp->intr_mask, port_mmio + PORT_IRQ_MASK);
 }
 
 int ahci_port_resume(struct ata_port *ap)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 423c0a6952b2..76c3c15cb1e6 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4139,6 +4139,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
          */
         { "PIONEER DVD-RW  DVRTD08",    "1.00", ATA_HORKAGE_NOSETXFER },
         { "PIONEER DVD-RW  DVR-212D",   "1.28", ATA_HORKAGE_NOSETXFER },
+        { "PIONEER DVD-RW  DVR-216D",   "1.08", ATA_HORKAGE_NOSETXFER },
 
         /* End Marker */
         { }
@@ -5480,7 +5481,7 @@ struct ata_port *ata_port_alloc(struct ata_host *host)
         if (!ap)
                 return NULL;
 
-        ap->pflags |= ATA_PFLAG_INITIALIZING;
+        ap->pflags |= ATA_PFLAG_INITIALIZING | ATA_PFLAG_FROZEN;
         ap->lock = &host->lock;
         ap->print_id = -1;
         ap->host = host;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 88cd22fa65cd..f26f2fe3480a 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -3316,6 +3316,7 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
         struct ata_eh_context *ehc = &link->eh_context;
         struct ata_device *dev, *link_dev = NULL, *lpm_dev = NULL;
         enum ata_lpm_policy old_policy = link->lpm_policy;
+        bool no_dipm = ap->flags & ATA_FLAG_NO_DIPM;
         unsigned int hints = ATA_LPM_EMPTY | ATA_LPM_HIPM;
         unsigned int err_mask;
         int rc;
@@ -3332,7 +3333,7 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
          */
         ata_for_each_dev(dev, link, ENABLED) {
                 bool hipm = ata_id_has_hipm(dev->id);
-                bool dipm = ata_id_has_dipm(dev->id);
+                bool dipm = ata_id_has_dipm(dev->id) && !no_dipm;
 
                 /* find the first enabled and LPM enabled devices */
                 if (!link_dev)
@@ -3389,7 +3390,8 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
 
         /* host config updated, enable DIPM if transitioning to MIN_POWER */
         ata_for_each_dev(dev, link, ENABLED) {
-                if (policy == ATA_LPM_MIN_POWER && ata_id_has_dipm(dev->id)) {
+                if (policy == ATA_LPM_MIN_POWER && !no_dipm &&
+                    ata_id_has_dipm(dev->id)) {
                         err_mask = ata_dev_set_feature(dev,
                                         SETFEATURES_SATA_ENABLE, SATA_DIPM);
                         if (err_mask && err_mask != AC_ERR_DEV) {
diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
index 0da0dcc7dd08..a5fdbdcb0faf 100644
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -33,11 +33,12 @@
 
 
 #define DRV_NAME "pata_at91"
-#define DRV_VERSION "0.1"
+#define DRV_VERSION "0.2"
 
 #define CF_IDE_OFFSET       0x00c00000
 #define CF_ALT_IDE_OFFSET   0x00e00000
 #define CF_IDE_RES_SIZE     0x08
+#define NCS_RD_PULSE_LIMIT  0x3f /* maximal value for pulse bitfields */
 
 struct at91_ide_info {
         unsigned long mode;
@@ -49,8 +50,18 @@ struct at91_ide_info {
         void __iomem *alt_addr;
 };
 
-static const struct ata_timing initial_timing =
-        {XFER_PIO_0, 70, 290, 240, 600, 165, 150, 600, 0};
+static const struct ata_timing initial_timing = {
+        .mode           = XFER_PIO_0,
+        .setup          = 70,
+        .act8b          = 290,
+        .rec8b          = 240,
+        .cyc8b          = 600,
+        .active         = 165,
+        .recover        = 150,
+        .dmack_hold     = 0,
+        .cycle          = 600,
+        .udma           = 0
+};
 
 static unsigned long calc_mck_cycles(unsigned long ns, unsigned long mck_hz)
 {
@@ -109,6 +120,11 @@ static void set_smc_timing(struct device *dev,
         /* (CS0, CS1, DIR, OE) <= (CFCE1, CFCE2, CFRNW, NCSX) timings */
         ncs_read_setup = 1;
         ncs_read_pulse = read_cycle - 2;
+        if (ncs_read_pulse > NCS_RD_PULSE_LIMIT) {
+                ncs_read_pulse = NCS_RD_PULSE_LIMIT;
+                dev_warn(dev, "ncs_read_pulse limited to maximal value %lu\n",
+                        ncs_read_pulse);
+        }
 
         /* Write timings same as read timings */
         write_cycle = read_cycle;
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index f051cfff18af..9e0e4fc24c46 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -149,6 +149,7 @@ static void platform_device_release(struct device *dev)
 
         of_device_node_put(&pa->pdev.dev);
         kfree(pa->pdev.dev.platform_data);
+        kfree(pa->pdev.mfd_cell);
         kfree(pa->pdev.resource);
         kfree(pa);
 }
@@ -771,7 +772,7 @@ int __weak platform_pm_resume_noirq(struct device *dev)
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int platform_pm_freeze(struct device *dev)
 {
@@ -909,7 +910,7 @@ static int platform_pm_restore_noirq(struct device *dev)
         return ret;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define platform_pm_freeze              NULL
 #define platform_pm_thaw                NULL
@@ -920,7 +921,7 @@ static int platform_pm_restore_noirq(struct device *dev)
 #define platform_pm_poweroff_noirq      NULL
 #define platform_pm_restore_noirq       NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #ifdef CONFIG_PM_RUNTIME
 
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 052dc53eef38..abe3ab709e87 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -63,6 +63,7 @@ void device_pm_init(struct device *dev)
         dev->power.wakeup = NULL;
         spin_lock_init(&dev->power.lock);
         pm_runtime_init(dev);
+        INIT_LIST_HEAD(&dev->power.entry);
 }
 
 /**
@@ -233,7 +234,7 @@ static int pm_op(struct device *dev,
                 }
                 break;
 #endif /* CONFIG_SUSPEND */
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
         case PM_EVENT_FREEZE:
         case PM_EVENT_QUIESCE:
                 if (ops->freeze) {
@@ -260,7 +261,7 @@ static int pm_op(struct device *dev,
                         suspend_report_result(ops->restore, error);
                 }
                 break;
-#endif /* CONFIG_HIBERNATION */
+#endif /* CONFIG_HIBERNATE_CALLBACKS */
         default:
                 error = -EINVAL;
         }
@@ -308,7 +309,7 @@ static int pm_noirq_op(struct device *dev,
                 }
                 break;
 #endif /* CONFIG_SUSPEND */
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
         case PM_EVENT_FREEZE:
         case PM_EVENT_QUIESCE:
                 if (ops->freeze_noirq) {
@@ -335,7 +336,7 @@ static int pm_noirq_op(struct device *dev,
                         suspend_report_result(ops->restore_noirq, error);
                 }
                 break;
-#endif /* CONFIG_HIBERNATION */
+#endif /* CONFIG_HIBERNATE_CALLBACKS */
         default:
                 error = -EINVAL;
         }
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 4573c83df6dd..abbbd33e8d8a 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -258,7 +258,7 @@ void device_set_wakeup_capable(struct device *dev, bool capable)
         if (!!dev->power.can_wakeup == !!capable)
                 return;
 
-        if (device_is_registered(dev)) {
+        if (device_is_registered(dev) && !list_empty(&dev->power.entry)) {
                 if (capable) {
                         if (wakeup_sysfs_add(dev))
                                 return;
diff --git a/drivers/base/syscore.c b/drivers/base/syscore.c
index 90af2943f9e4..c126db3cb7d1 100644
--- a/drivers/base/syscore.c
+++ b/drivers/base/syscore.c
@@ -73,6 +73,7 @@ int syscore_suspend(void)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(syscore_suspend);
 
 /**
  * syscore_resume - Execute all the registered system core resume callbacks.
@@ -95,6 +96,7 @@ void syscore_resume(void)
                                 "Interrupts enabled after %pF\n", ops->resume);
                 }
 }
+EXPORT_SYMBOL_GPL(syscore_resume);
 #endif /* CONFIG_PM_SLEEP */
 
 /**
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 012cba0d6d96..b072648dc3f6 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -115,6 +115,9 @@ static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
         struct agp_memory *new;
         unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
 
+        if (INT_MAX/sizeof(struct page *) < num_agp_pages)
+                return NULL;
+
         new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
         if (new == NULL)
                 return NULL;
@@ -234,11 +237,14 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
         int scratch_pages;
         struct agp_memory *new;
         size_t i;
+        int cur_memory;
 
         if (!bridge)
                 return NULL;
 
-        if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
+        cur_memory = atomic_read(&bridge->current_memory_agp);
+        if ((cur_memory + page_count > bridge->max_memory_agp) ||
+            (cur_memory + page_count < page_count))
                 return NULL;
 
         if (type >= AGP_USER_TYPES) {
@@ -1089,8 +1095,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
                 return -EINVAL;
         }
 
-        /* AK: could wrap */
-        if ((pg_start + mem->page_count) > num_entries)
+        if (((pg_start + mem->page_count) > num_entries) ||
+            ((pg_start + mem->page_count) < pg_start))
                 return -EINVAL;
 
         j = pg_start;
@@ -1124,7 +1130,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
         size_t i;
         struct agp_bridge_data *bridge;
-        int mask_type;
+        int mask_type, num_entries;
 
         bridge = mem->bridge;
         if (!bridge)
@@ -1136,6 +1142,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
         if (type != mem->type)
                 return -EINVAL;
 
+        num_entries = agp_num_entries();
+        if (((pg_start + mem->page_count) > num_entries) ||
+            ((pg_start + mem->page_count) < pg_start))
+                return -EINVAL;
+
         mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
         if (mask_type != 0) {
                 /* The generic routines know nothing of memory types */
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 84b164d1eb2b..838568a7dbf5 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1280,18 +1280,7 @@ static void unplug_port(struct port *port)
                 spin_lock_irq(&pdrvdata_lock);
                 list_del(&port->cons.list);
                 spin_unlock_irq(&pdrvdata_lock);
-#if 0
-                /*
-                 * hvc_remove() not called as removing one hvc port
-                 * results in other hvc ports getting frozen.
-                 *
-                 * Once this is resolved in hvc, this functionality
-                 * will be enabled.  Till that is done, the -EPIPE
-                 * return from get_chars() above will help
-                 * hvc_console.c to clean up on ports we remove here.
-                 */
                 hvc_remove(port->cons.hvc);
-#endif
         }
 
         /* Remove unused data this port might have received. */
diff --git a/drivers/clk/clkdev.c b/drivers/clk/clkdev.c
index 0fc0a79852de..6db161f64ae0 100644
--- a/drivers/clk/clkdev.c
+++ b/drivers/clk/clkdev.c
@@ -32,10 +32,9 @@ static DEFINE_MUTEX(clocks_mutex);
  * Then we take the most specific entry - with the following
  * order of precedence: dev+con > dev only > con only.
  */
-static struct clk *clk_find(const char *dev_id, const char *con_id)
+static struct clk_lookup *clk_find(const char *dev_id, const char *con_id)
 {
-        struct clk_lookup *p;
-        struct clk *clk = NULL;
+        struct clk_lookup *p, *cl = NULL;
         int match, best = 0;
 
         list_for_each_entry(p, &clocks, node) {
@@ -52,27 +51,27 @@ static struct clk *clk_find(const char *dev_id, const char *con_id)
                 }
 
                 if (match > best) {
-                        clk = p->clk;
+                        cl = p;
                         if (match != 3)
                                 best = match;
                         else
                                 break;
                 }
         }
-        return clk;
+        return cl;
 }
 
 struct clk *clk_get_sys(const char *dev_id, const char *con_id)
 {
-        struct clk *clk;
+        struct clk_lookup *cl;
 
         mutex_lock(&clocks_mutex);
-        clk = clk_find(dev_id, con_id);
-        if (clk && !__clk_get(clk))
-                clk = NULL;
+        cl = clk_find(dev_id, con_id);
+        if (cl && !__clk_get(cl->clk))
+                cl = NULL;
         mutex_unlock(&clocks_mutex);
 
-        return clk ? clk : ERR_PTR(-ENOENT);
+        return cl ? cl->clk : ERR_PTR(-ENOENT);
 }
 EXPORT_SYMBOL(clk_get_sys);
 
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 6b396759e7f5..8a781540590c 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1448,7 +1448,7 @@ static const struct of_device_id fsldma_of_ids[] = {
         {}
 };
 
-static struct of_platform_driver fsldma_of_driver = {
+static struct platform_driver fsldma_of_driver = {
         .driver = {
                 .name = "fsl-elo-dma",
                 .owner = THIS_MODULE,
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 31e71c4fc831..9a8bebcf6b17 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -211,8 +211,6 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci)
 
         scrubval = scrubval & 0x001F;
 
-        amd64_debug("pci-read, sdram scrub control value: %d\n", scrubval);
-
         for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
                 if (scrubrates[i].scrubval == scrubval) {
                         retval = scrubrates[i].bandwidth;
@@ -933,25 +931,74 @@ static int k8_early_channel_count(struct amd64_pvt *pvt)
 /* On F10h and later ErrAddr is MC4_ADDR[47:1] */
 static u64 get_error_address(struct mce *m)
 {
+        struct cpuinfo_x86 *c = &boot_cpu_data;
+        u64 addr;
         u8 start_bit = 1;
         u8 end_bit   = 47;
 
-        if (boot_cpu_data.x86 == 0xf) {
+        if (c->x86 == 0xf) {
                 start_bit = 3;
                 end_bit   = 39;
         }
 
-        return m->addr & GENMASK(start_bit, end_bit);
+        addr = m->addr & GENMASK(start_bit, end_bit);
+
+        /*
+         * Erratum 637 workaround
+         */
+        if (c->x86 == 0x15) {
+                struct amd64_pvt *pvt;
+                u64 cc6_base, tmp_addr;
+                u32 tmp;
+                u8 mce_nid, intlv_en;
+
+                if ((addr & GENMASK(24, 47)) >> 24 != 0x00fdf7)
+                        return addr;
+
+                mce_nid = amd_get_nb_id(m->extcpu);
+                pvt     = mcis[mce_nid]->pvt_info;
+
+                amd64_read_pci_cfg(pvt->F1, DRAM_LOCAL_NODE_LIM, &tmp);
+                intlv_en = tmp >> 21 & 0x7;
+
+                /* add [47:27] + 3 trailing bits */
+                cc6_base  = (tmp & GENMASK(0, 20)) << 3;
+
+                /* reverse and add DramIntlvEn */
+                cc6_base |= intlv_en ^ 0x7;
+
+                /* pin at [47:24] */
+                cc6_base <<= 24;
+
+                if (!intlv_en)
+                        return cc6_base | (addr & GENMASK(0, 23));
+
+                amd64_read_pci_cfg(pvt->F1, DRAM_LOCAL_NODE_BASE, &tmp);
+
+                                                        /* faster log2 */
+                tmp_addr  = (addr & GENMASK(12, 23)) << __fls(intlv_en + 1);
+
+                /* OR DramIntlvSel into bits [14:12] */
+                tmp_addr |= (tmp & GENMASK(21, 23)) >> 9;
+
+                /* add remaining [11:0] bits from original MC4_ADDR */
+                tmp_addr |= addr & GENMASK(0, 11);
+
+                return cc6_base | tmp_addr;
+        }
+
+        return addr;
 }
 
 static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
 {
+        struct cpuinfo_x86 *c = &boot_cpu_data;
         int off = range << 3;
 
         amd64_read_pci_cfg(pvt->F1, DRAM_BASE_LO + off,  &pvt->ranges[range].base.lo);
         amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_LO + off, &pvt->ranges[range].lim.lo);
 
-        if (boot_cpu_data.x86 == 0xf)
+        if (c->x86 == 0xf)
                 return;
 
         if (!dram_rw(pvt, range))
@@ -959,6 +1006,31 @@ static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
 
         amd64_read_pci_cfg(pvt->F1, DRAM_BASE_HI + off,  &pvt->ranges[range].base.hi);
         amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_HI + off, &pvt->ranges[range].lim.hi);
+
+        /* Factor in CC6 save area by reading dst node's limit reg */
+        if (c->x86 == 0x15) {
+                struct pci_dev *f1 = NULL;
+                u8 nid = dram_dst_node(pvt, range);
+                u32 llim;
+
+                f1 = pci_get_domain_bus_and_slot(0, 0, PCI_DEVFN(0x18 + nid, 1));
+                if (WARN_ON(!f1))
+                        return;
+
+                amd64_read_pci_cfg(f1, DRAM_LOCAL_NODE_LIM, &llim);
+
+                pvt->ranges[range].lim.lo &= GENMASK(0, 15);
+
+                                            /* {[39:27],111b} */
+                pvt->ranges[range].lim.lo |= ((llim & 0x1fff) << 3 | 0x7) << 16;
+
+                pvt->ranges[range].lim.hi &= GENMASK(0, 7);
+
+                                            /* [47:40] */
+                pvt->ranges[range].lim.hi |= llim >> 13;
+
+                pci_dev_put(f1);
+        }
 }
 
 static void k8_map_sysaddr_to_csrow(struct mem_ctl_info *mci, u64 sys_addr,
@@ -1403,12 +1475,8 @@ static int f1x_match_to_this_node(struct amd64_pvt *pvt, unsigned range,
                 return -EINVAL;
         }
 
-        if (intlv_en &&
-            (intlv_sel != ((sys_addr >> 12) & intlv_en))) {
-                amd64_warn("Botched intlv bits, en: 0x%x, sel: 0x%x\n",
-                           intlv_en, intlv_sel);
+        if (intlv_en && (intlv_sel != ((sys_addr >> 12) & intlv_en)))
                 return -EINVAL;
-        }
 
         sys_addr = f1x_swap_interleaved_region(pvt, sys_addr);
 
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index 11be36a311eb..9a666cb985b2 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -196,6 +196,9 @@
 
 #define DCT_CFG_SEL                     0x10C
 
+#define DRAM_LOCAL_NODE_BASE            0x120
+#define DRAM_LOCAL_NODE_LIM             0x124
+
 #define DRAM_BASE_HI                    0x140
 #define DRAM_LIMIT_HI                   0x144
 
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 26343fd46596..29ffa350bfbe 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -458,13 +458,13 @@ static ssize_t mci_sdram_scrub_rate_store(struct mem_ctl_info *mci,
                 return -EINVAL;
 
         new_bw = mci->set_sdram_scrub_rate(mci, bandwidth);
-        if (new_bw >= 0) {
-                edac_printk(KERN_DEBUG, EDAC_MC, "Scrub rate set to %d\n", new_bw);
-                return count;
+        if (new_bw < 0) {
+                edac_printk(KERN_WARNING, EDAC_MC,
+                            "Error setting scrub rate to: %lu\n", bandwidth);
+                return -EINVAL;
         }
 
-        edac_printk(KERN_DEBUG, EDAC_MC, "Error setting scrub rate to: %lu\n", bandwidth);
-        return -EINVAL;
+        return count;
 }
 
 /*
@@ -483,7 +483,6 @@ static ssize_t mci_sdram_scrub_rate_show(struct mem_ctl_info *mci, char *data)
                 return bandwidth;
         }
 
-        edac_printk(KERN_DEBUG, EDAC_MC, "Read scrub rate: %d\n", bandwidth);
         return sprintf(data, "%d\n", bandwidth);
 }
 
diff --git a/drivers/gpio/ml_ioh_gpio.c b/drivers/gpio/ml_ioh_gpio.c
index 7f6f01a4b145..0a775f7987c2 100644
--- a/drivers/gpio/ml_ioh_gpio.c
+++ b/drivers/gpio/ml_ioh_gpio.c
@@ -116,6 +116,7 @@ static int ioh_gpio_direction_output(struct gpio_chip *gpio, unsigned nr,
                 reg_val |= (1 << nr);
         else
                 reg_val &= ~(1 << nr);
+        iowrite32(reg_val, &chip->reg->regs[chip->ch].po);
 
         mutex_unlock(&chip->lock);
 
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 583e92592073..7630ab7b9bec 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -558,7 +558,7 @@ static int __devinit pca953x_probe(struct i2c_client *client,
 
         ret = gpiochip_add(&chip->gpio_chip);
         if (ret)
-                goto out_failed;
+                goto out_failed_irq;
 
         if (pdata->setup) {
                 ret = pdata->setup(client, chip->gpio_chip.base,
@@ -570,8 +570,9 @@ static int __devinit pca953x_probe(struct i2c_client *client,
         i2c_set_clientdata(client, chip);
         return 0;
 
-out_failed:
+out_failed_irq:
         pca953x_irq_teardown(chip);
+out_failed:
         kfree(chip->dyn_pdata);
         kfree(chip);
         return ret;
diff --git a/drivers/gpio/pch_gpio.c b/drivers/gpio/pch_gpio.c
index 2c6af8705103..f970a5f3585e 100644
--- a/drivers/gpio/pch_gpio.c
+++ b/drivers/gpio/pch_gpio.c
@@ -105,6 +105,7 @@ static int pch_gpio_direction_output(struct gpio_chip *gpio, unsigned nr,
                 reg_val |= (1 << nr);
         else
                 reg_val &= ~(1 << nr);
+        iowrite32(reg_val, &chip->reg->po);
 
         mutex_unlock(&chip->lock);
 
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index a6feb78c404c..b493663c7ba7 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -24,6 +24,7 @@ config DRM_KMS_HELPER
         depends on DRM
         select FB
         select FRAMEBUFFER_CONSOLE if !EXPERT
+        select FRAMEBUFFER_CONSOLE_DETECT_PRIMARY if FRAMEBUFFER_CONSOLE
         help
           FB and CRTC helpers for KMS drivers.
 
@@ -96,6 +97,7 @@ config DRM_I915
         # i915 depends on ACPI_VIDEO when ACPI is enabled
         # but for select to work, need to select ACPI_VIDEO's dependencies, ick
         select BACKLIGHT_CLASS_DEVICE if ACPI
+        select VIDEO_OUTPUT_CONTROL if ACPI
         select INPUT if ACPI
         select ACPI_VIDEO if ACPI
         select ACPI_BUTTON if ACPI
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 950720473967..11d7a72c22d9 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -342,9 +342,22 @@ int drm_fb_helper_debug_leave(struct fb_info *info)
 }
 EXPORT_SYMBOL(drm_fb_helper_debug_leave);
 
+bool drm_fb_helper_restore_fbdev_mode(struct drm_fb_helper *fb_helper)
+{
+        bool error = false;
+        int i, ret;
+        for (i = 0; i < fb_helper->crtc_count; i++) {
+                struct drm_mode_set *mode_set = &fb_helper->crtc_info[i].mode_set;
+                ret = drm_crtc_helper_set_config(mode_set);
+                if (ret)
+                        error = true;
+        }
+        return error;
+}
+EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode);
+
 bool drm_fb_helper_force_kernel_mode(void)
 {
-        int i = 0;
         bool ret, error = false;
         struct drm_fb_helper *helper;
 
@@ -352,12 +365,12 @@ bool drm_fb_helper_force_kernel_mode(void)
                 return false;
 
         list_for_each_entry(helper, &kernel_fb_helper_list, kernel_fb_list) {
-                for (i = 0; i < helper->crtc_count; i++) {
-                        struct drm_mode_set *mode_set = &helper->crtc_info[i].mode_set;
-                        ret = drm_crtc_helper_set_config(mode_set);
-                        if (ret)
-                                error = true;
-                }
+                if (helper->dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+                        continue;
+
+                ret = drm_fb_helper_restore_fbdev_mode(helper);
+                if (ret)
+                        error = true;
         }
         return error;
 }
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 72730377a01b..12876f2795d2 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -2207,7 +2207,7 @@ void i915_driver_lastclose(struct drm_device * dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
 
         if (!dev_priv || drm_core_check_feature(dev, DRIVER_MODESET)) {
-                drm_fb_helper_restore();
+                intel_fb_restore_mode(dev);
                 vga_switcheroo_process_delayed_switch();
                 return;
         }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 432fc04c6bff..e522c702b04e 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3771,8 +3771,11 @@ static bool g4x_compute_wm0(struct drm_device *dev,
         int entries, tlb_miss;
 
         crtc = intel_get_crtc_for_plane(dev, plane);
-        if (crtc->fb == NULL || !crtc->enabled)
+        if (crtc->fb == NULL || !crtc->enabled) {
+                *cursor_wm = cursor->guard_size;
+                *plane_wm = display->guard_size;
                 return false;
+        }
 
         htotal = crtc->mode.htotal;
         hdisplay = crtc->mode.hdisplay;
@@ -6215,36 +6218,6 @@ cleanup_work:
         return ret;
 }
 
-static void intel_crtc_reset(struct drm_crtc *crtc)
-{
-        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-
-        /* Reset flags back to the 'unknown' status so that they
-         * will be correctly set on the initial modeset.
-         */
-        intel_crtc->dpms_mode = -1;
-}
-
-static struct drm_crtc_helper_funcs intel_helper_funcs = {
-        .dpms = intel_crtc_dpms,
-        .mode_fixup = intel_crtc_mode_fixup,
-        .mode_set = intel_crtc_mode_set,
-        .mode_set_base = intel_pipe_set_base,
-        .mode_set_base_atomic = intel_pipe_set_base_atomic,
-        .load_lut = intel_crtc_load_lut,
-        .disable = intel_crtc_disable,
-};
-
-static const struct drm_crtc_funcs intel_crtc_funcs = {
-        .reset = intel_crtc_reset,
-        .cursor_set = intel_crtc_cursor_set,
-        .cursor_move = intel_crtc_cursor_move,
-        .gamma_set = intel_crtc_gamma_set,
-        .set_config = drm_crtc_helper_set_config,
-        .destroy = intel_crtc_destroy,
-        .page_flip = intel_crtc_page_flip,
-};
-
 static void intel_sanitize_modesetting(struct drm_device *dev,
                                        int pipe, int plane)
 {
@@ -6281,6 +6254,42 @@ static void intel_sanitize_modesetting(struct drm_device *dev,
         intel_disable_pipe(dev_priv, pipe);
 }
 
+static void intel_crtc_reset(struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+
+        /* Reset flags back to the 'unknown' status so that they
+         * will be correctly set on the initial modeset.
+         */
+        intel_crtc->dpms_mode = -1;
+
+        /* We need to fix up any BIOS configuration that conflicts with
+         * our expectations.
+         */
+        intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
+}
+
+static struct drm_crtc_helper_funcs intel_helper_funcs = {
+        .dpms = intel_crtc_dpms,
+        .mode_fixup = intel_crtc_mode_fixup,
+        .mode_set = intel_crtc_mode_set,
+        .mode_set_base = intel_pipe_set_base,
+        .mode_set_base_atomic = intel_pipe_set_base_atomic,
+        .load_lut = intel_crtc_load_lut,
+        .disable = intel_crtc_disable,
+};
+
+static const struct drm_crtc_funcs intel_crtc_funcs = {
+        .reset = intel_crtc_reset,
+        .cursor_set = intel_crtc_cursor_set,
+        .cursor_move = intel_crtc_cursor_move,
+        .gamma_set = intel_crtc_gamma_set,
+        .set_config = drm_crtc_helper_set_config,
+        .destroy = intel_crtc_destroy,
+        .page_flip = intel_crtc_page_flip,
+};
+
 static void intel_crtc_init(struct drm_device *dev, int pipe)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
@@ -6330,8 +6339,6 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
 
         setup_timer(&intel_crtc->idle_timer, intel_crtc_idle_timer,
                     (unsigned long)intel_crtc);
-
-        intel_sanitize_modesetting(dev, intel_crtc->pipe, intel_crtc->plane);
 }
 
 int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f5b0d8306d83..1d20712d527f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -338,4 +338,5 @@ extern int intel_overlay_attrs(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
 
 extern void intel_fb_output_poll_changed(struct drm_device *dev);
+extern void intel_fb_restore_mode(struct drm_device *dev);
 #endif /* __INTEL_DRV_H__ */
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 512782728e51..ec49bae73382 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -264,3 +264,13 @@ void intel_fb_output_poll_changed(struct drm_device *dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
         drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper);
 }
+
+void intel_fb_restore_mode(struct drm_device *dev)
+{
+        int ret;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+
+        ret = drm_fb_helper_restore_fbdev_mode(&dev_priv->fbdev->helper);
+        if (ret)
+                DRM_DEBUG("failed to restore crtc mode\n");
+}
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 4256b8ef3947..6b22c1dcc015 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1151,10 +1151,10 @@ intel_tv_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
                             (video_levels->blank << TV_BLANK_LEVEL_SHIFT)));
         {
                 int pipeconf_reg = PIPECONF(pipe);
-                int dspcntr_reg = DSPCNTR(pipe);
+                int dspcntr_reg = DSPCNTR(intel_crtc->plane);
                 int pipeconf = I915_READ(pipeconf_reg);
                 int dspcntr = I915_READ(dspcntr_reg);
-                int dspbase_reg = DSPADDR(pipe);
+                int dspbase_reg = DSPADDR(intel_crtc->plane);
                 int xpos = 0x0, ypos = 0x0;
                 unsigned int xsize, ysize;
                 /* Pipe must be off here */
@@ -1378,7 +1378,9 @@ intel_tv_detect(struct drm_connector *connector, bool force)
         if (type < 0)
                 return connector_status_disconnected;
 
+        intel_tv->type = type;
         intel_tv_find_better_format(connector);
+
         return connector_status_connected;
 }
 
@@ -1670,8 +1672,7 @@ intel_tv_init(struct drm_device *dev)
          *
          * More recent chipsets favour HDMI rather than integrated S-Video.
          */
-        connector->polled =
-                DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT;
+        connector->polled = DRM_CONNECTOR_POLL_CONNECT;
 
         drm_connector_init(dev, connector, &intel_tv_connector_funcs,
                            DRM_MODE_CONNECTOR_SVIDEO);
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 8314a49b6b9a..90aef64b76f2 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -269,7 +269,7 @@ struct init_tbl_entry {
         int (*handler)(struct nvbios *, uint16_t, struct init_exec *);
 };
 
-static int parse_init_table(struct nvbios *, unsigned int, struct init_exec *);
+static int parse_init_table(struct nvbios *, uint16_t, struct init_exec *);
 
 #define MACRO_INDEX_SIZE        2
 #define MACRO_SIZE              8
@@ -2011,6 +2011,27 @@ init_sub_direct(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 }
 
 static int
+init_jump(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+        /*
+         * INIT_JUMP   opcode: 0x5C ('\')
+         *
+         * offset      (8  bit): opcode
+         * offset + 1  (16 bit): offset (in bios)
+         *
+         * Continue execution of init table from 'offset'
+         */
+
+        uint16_t jmp_offset = ROM16(bios->data[offset + 1]);
+
+        if (!iexec->execute)
+                return 3;
+
+        BIOSLOG(bios, "0x%04X: Jump to 0x%04X\n", offset, jmp_offset);
+        return jmp_offset - offset;
+}
+
+static int
 init_i2c_if(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 {
         /*
@@ -3659,6 +3680,7 @@ static struct init_tbl_entry itbl_entry[] = {
         { "INIT_ZM_REG_SEQUENCE"              , 0x58, init_zm_reg_sequence            },
         /* INIT_INDIRECT_REG (0x5A, 7, 0, 0) removed due to no example of use */
         { "INIT_SUB_DIRECT"                   , 0x5B, init_sub_direct                 },
+        { "INIT_JUMP"                         , 0x5C, init_jump                       },
         { "INIT_I2C_IF"                       , 0x5E, init_i2c_if                     },
         { "INIT_COPY_NV_REG"                  , 0x5F, init_copy_nv_reg                },
         { "INIT_ZM_INDEX_IO"                  , 0x62, init_zm_index_io                },
@@ -3700,8 +3722,7 @@ static struct init_tbl_entry itbl_entry[] = {
 #define MAX_TABLE_OPS 1000
 
 static int
-parse_init_table(struct nvbios *bios, unsigned int offset,
-                 struct init_exec *iexec)
+parse_init_table(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 {
         /*
          * Parses all commands in an init table.
@@ -6333,6 +6354,32 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)
                 }
         }
 
+        /* XFX GT-240X-YA
+         *
+         * So many things wrong here, replace the entire encoder table..
+         */
+        if (nv_match_device(dev, 0x0ca3, 0x1682, 0x3003)) {
+                if (idx == 0) {
+                        *conn = 0x02001300; /* VGA, connector 1 */
+                        *conf = 0x00000028;
+                } else
+                if (idx == 1) {
+                        *conn = 0x01010312; /* DVI, connector 0 */
+                        *conf = 0x00020030;
+                } else
+                if (idx == 2) {
+                        *conn = 0x01010310; /* VGA, connector 0 */
+                        *conf = 0x00000028;
+                } else
+                if (idx == 3) {
+                        *conn = 0x02022362; /* HDMI, connector 2 */
+                        *conf = 0x00020010;
+                } else {
+                        *conn = 0x0000000e; /* EOL */
+                        *conf = 0x00000000;
+                }
+        }
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_dma.c b/drivers/gpu/drm/nouveau/nouveau_dma.c
index ce38e97b9428..568caedd7216 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dma.c
@@ -83,7 +83,7 @@ nouveau_dma_init(struct nouveau_channel *chan)
                 return ret;
 
         /* NV_MEMORY_TO_MEMORY_FORMAT requires a notifier object */
-        ret = nouveau_notifier_alloc(chan, NvNotify0, 32, 0xfd0, 0x1000,
+        ret = nouveau_notifier_alloc(chan, NvNotify0, 32, 0xfe0, 0x1000,
                                      &chan->m2mf_ntfy);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 57e5302503db..a76514a209b3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -682,6 +682,9 @@ struct drm_nouveau_private {
         /* For PFIFO and PGRAPH. */
         spinlock_t context_switch_lock;
 
+        /* VM/PRAMIN flush, legacy PRAMIN aperture */
+        spinlock_t vm_lock;
+
         /* RAMIN configuration, RAMFC, RAMHT and RAMRO offsets */
         struct nouveau_ramht  *ramht;
         struct nouveau_gpuobj *ramfc;
@@ -1190,7 +1193,7 @@ extern int  nv50_graph_load_context(struct nouveau_channel *);
 extern int  nv50_graph_unload_context(struct drm_device *);
 extern int  nv50_grctx_init(struct nouveau_grctx *);
 extern void nv50_graph_tlb_flush(struct drm_device *dev);
-extern void nv86_graph_tlb_flush(struct drm_device *dev);
+extern void nv84_graph_tlb_flush(struct drm_device *dev);
 extern struct nouveau_enum nv50_data_error_names[];
 
 /* nvc0_graph.c */
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 889c4454682e..39aee6d4daf8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -181,13 +181,13 @@ nouveau_fbcon_sync(struct fb_info *info)
                 OUT_RING  (chan, 0);
         }
 
-        nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy + 3, 0xffffffff);
+        nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3, 0xffffffff);
         FIRE_RING(chan);
         mutex_unlock(&chan->mutex);
 
         ret = -EBUSY;
         for (i = 0; i < 100000; i++) {
-                if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy + 3)) {
+                if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy/4 + 3)) {
                         ret = 0;
                         break;
                 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 2683377f4131..5045f8b921d6 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -398,7 +398,7 @@ nouveau_mem_vram_init(struct drm_device *dev)
                         dma_bits = 40;
         } else
         if (drm_pci_device_is_pcie(dev) &&
-            dev_priv->chipset != 0x40 &&
+            dev_priv->chipset  > 0x40 &&
             dev_priv->chipset != 0x45) {
                 if (pci_dma_supported(dev->pdev, DMA_BIT_MASK(39)))
                         dma_bits = 39;
@@ -552,6 +552,7 @@ nouveau_mem_timing_init(struct drm_device *dev)
         u8 tRC;         /* Byte 9 */
         u8 tUNK_10, tUNK_11, tUNK_12, tUNK_13, tUNK_14;
         u8 tUNK_18, tUNK_19, tUNK_20, tUNK_21;
+        u8 magic_number = 0; /* Yeah... sorry*/
         u8 *mem = NULL, *entry;
         int i, recordlen, entries;
 
@@ -596,6 +597,12 @@ nouveau_mem_timing_init(struct drm_device *dev)
         if (!memtimings->timing)
                 return;
 
+        /* Get "some number" from the timing reg for NV_40
+         * Used in calculations later */
+        if(dev_priv->card_type == NV_40) {
+                magic_number = (nv_rd32(dev,0x100228) & 0x0f000000) >> 24;
+        }
+
         entry = mem + mem[1];
         for (i = 0; i < entries; i++, entry += recordlen) {
                 struct nouveau_pm_memtiming *timing = &pm->memtimings.timing[i];
@@ -635,36 +642,51 @@ nouveau_mem_timing_init(struct drm_device *dev)
 
                 /* XXX: I don't trust the -1's and +1's... they must come
                  *      from somewhere! */
-                timing->reg_100224 = ((tUNK_0 + tUNK_19 + 1) << 24 |
+                timing->reg_100224 = (tUNK_0 + tUNK_19 + 1 + magic_number) << 24 |
                                       tUNK_18 << 16 |
-                                      (tUNK_1 + tUNK_19 + 1) << 8 |
-                                      (tUNK_2 - 1));
+                                      (tUNK_1 + tUNK_19 + 1 + magic_number) << 8;
+                if(dev_priv->chipset == 0xa8) {
+                        timing->reg_100224 |= (tUNK_2 - 1);
+                } else {
+                        timing->reg_100224 |= (tUNK_2 + 2 - magic_number);
+                }
 
                 timing->reg_100228 = (tUNK_12 << 16 | tUNK_11 << 8 | tUNK_10);
-                if(recordlen > 19) {
-                        timing->reg_100228 += (tUNK_19 - 1) << 24;
-                }/* I cannot back-up this else-statement right now
-                         else {
-                        timing->reg_100228 += tUNK_12 << 24;
-                }*/
-
-                /* XXX: reg_10022c */
-                timing->reg_10022c = tUNK_2 - 1;
-
-                timing->reg_100230 = (tUNK_20 << 24 | tUNK_21 << 16 |
-                                      tUNK_13 << 8  | tUNK_13);
-
-                /* XXX: +6? */
-                timing->reg_100234 = (tRAS << 24 | (tUNK_19 + 6) << 8 | tRC);
-                timing->reg_100234 += max(tUNK_10,tUNK_11) << 16;
-
-                /* XXX; reg_100238, reg_10023c
-                 * reg: 0x00??????
-                 * reg_10023c:
-                 *      0 for pre-NV50 cards
-                 *      0x????0202 for NV50+ cards (empirical evidence) */
-                if(dev_priv->card_type >= NV_50) {
+                if(dev_priv->chipset >= 0xa3 && dev_priv->chipset < 0xaa) {
+                        timing->reg_100228 |= (tUNK_19 - 1) << 24;
+                }
+
+                if(dev_priv->card_type == NV_40) {
+                        /* NV40: don't know what the rest of the regs are..
+                         * And don't need to know either */
+                        timing->reg_100228 |= 0x20200000 | magic_number << 24;
+                } else if(dev_priv->card_type >= NV_50) {
+                        /* XXX: reg_10022c */
+                        timing->reg_10022c = tUNK_2 - 1;
+
+                        timing->reg_100230 = (tUNK_20 << 24 | tUNK_21 << 16 |
+                                                  tUNK_13 << 8  | tUNK_13);
+
+                        timing->reg_100234 = (tRAS << 24 | tRC);
+                        timing->reg_100234 += max(tUNK_10,tUNK_11) << 16;
+
+                        if(dev_priv->chipset < 0xa3) {
+                                timing->reg_100234 |= (tUNK_2 + 2) << 8;
+                        } else {
+                                /* XXX: +6? */
+                                timing->reg_100234 |= (tUNK_19 + 6) << 8;
+                        }
+
+                        /* XXX; reg_100238, reg_10023c
+                         * reg_100238: 0x00??????
+                         * reg_10023c: 0x!!??0202 for NV50+ cards (empirical evidence) */
                         timing->reg_10023c = 0x202;
+                        if(dev_priv->chipset < 0xa3) {
+                                timing->reg_10023c |= 0x4000000 | (tUNK_2 - 1) << 16;
+                        } else {
+                                /* currently unknown
+                                 * 10023c seen as 06xxxxxx, 0bxxxxxx or 0fxxxxxx */
+                        }
                 }
 
                 NV_DEBUG(dev, "Entry %d: 220: %08x %08x %08x %08x\n", i,
@@ -675,7 +697,7 @@ nouveau_mem_timing_init(struct drm_device *dev)
                          timing->reg_100238, timing->reg_10023c);
         }
 
-        memtimings->nr_timing  = entries;
+        memtimings->nr_timing = entries;
         memtimings->supported = true;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 7ba3fc0b30c1..5b39718ae1f8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -35,19 +35,22 @@ nouveau_notifier_init_channel(struct nouveau_channel *chan)
 {
         struct drm_device *dev = chan->dev;
         struct nouveau_bo *ntfy = NULL;
-        uint32_t flags;
+        uint32_t flags, ttmpl;
         int ret;
 
-        if (nouveau_vram_notify)
+        if (nouveau_vram_notify) {
                 flags = NOUVEAU_GEM_DOMAIN_VRAM;
-        else
+                ttmpl = TTM_PL_FLAG_VRAM;
+        } else {
                 flags = NOUVEAU_GEM_DOMAIN_GART;
+                ttmpl = TTM_PL_FLAG_TT;
+        }
 
         ret = nouveau_gem_new(dev, NULL, PAGE_SIZE, 0, flags, 0, 0, &ntfy);
         if (ret)
                 return ret;
 
-        ret = nouveau_bo_pin(ntfy, flags);
+        ret = nouveau_bo_pin(ntfy, ttmpl);
         if (ret)
                 goto out_err;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_object.c b/drivers/gpu/drm/nouveau/nouveau_object.c
index 4f00c87ed86e..67a16e01ffa6 100644
--- a/drivers/gpu/drm/nouveau/nouveau_object.c
+++ b/drivers/gpu/drm/nouveau/nouveau_object.c
@@ -1039,19 +1039,20 @@ nv_ro32(struct nouveau_gpuobj *gpuobj, u32 offset)
 {
         struct drm_nouveau_private *dev_priv = gpuobj->dev->dev_private;
         struct drm_device *dev = gpuobj->dev;
+        unsigned long flags;
 
         if (gpuobj->pinst == ~0 || !dev_priv->ramin_available) {
                 u64  ptr = gpuobj->vinst + offset;
                 u32 base = ptr >> 16;
                 u32  val;
 
-                spin_lock(&dev_priv->ramin_lock);
+                spin_lock_irqsave(&dev_priv->vm_lock, flags);
                 if (dev_priv->ramin_base != base) {
                         dev_priv->ramin_base = base;
                         nv_wr32(dev, 0x001700, dev_priv->ramin_base);
                 }
                 val = nv_rd32(dev, 0x700000 + (ptr & 0xffff));
-                spin_unlock(&dev_priv->ramin_lock);
+                spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
                 return val;
         }
 
@@ -1063,18 +1064,19 @@ nv_wo32(struct nouveau_gpuobj *gpuobj, u32 offset, u32 val)
 {
         struct drm_nouveau_private *dev_priv = gpuobj->dev->dev_private;
         struct drm_device *dev = gpuobj->dev;
+        unsigned long flags;
 
         if (gpuobj->pinst == ~0 || !dev_priv->ramin_available) {
                 u64  ptr = gpuobj->vinst + offset;
                 u32 base = ptr >> 16;
 
-                spin_lock(&dev_priv->ramin_lock);
+                spin_lock_irqsave(&dev_priv->vm_lock, flags);
                 if (dev_priv->ramin_base != base) {
                         dev_priv->ramin_base = base;
                         nv_wr32(dev, 0x001700, dev_priv->ramin_base);
                 }
                 nv_wr32(dev, 0x700000 + (ptr & 0xffff), val);
-                spin_unlock(&dev_priv->ramin_lock);
+                spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
                 return;
         }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_perf.c b/drivers/gpu/drm/nouveau/nouveau_perf.c
index ac62a1b8c4fc..670e3cb697ec 100644
--- a/drivers/gpu/drm/nouveau/nouveau_perf.c
+++ b/drivers/gpu/drm/nouveau/nouveau_perf.c
@@ -134,7 +134,7 @@ nouveau_perf_init(struct drm_device *dev)
                 case 0x13:
                 case 0x15:
                         perflvl->fanspeed = entry[55];
-                        perflvl->voltage = entry[56];
+                        perflvl->voltage = (recordlen > 56) ? entry[56] : 0;
                         perflvl->core = ROM32(entry[1]) * 10;
                         perflvl->memory = ROM32(entry[5]) * 20;
                         break;
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
index a33fe4019286..4bce801bc588 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -55,6 +55,7 @@ nouveau_sgdma_populate(struct ttm_backend *be, unsigned long num_pages,
                                 be->func->clear(be);
                                 return -EFAULT;
                         }
+                        nvbe->ttm_alloced[nvbe->nr_pages] = false;
                 }
 
                 nvbe->nr_pages++;
@@ -427,7 +428,7 @@ nouveau_sgdma_init(struct drm_device *dev)
         u32 aper_size, align;
         int ret;
 
-        if (dev_priv->card_type >= NV_50 || drm_pci_device_is_pcie(dev))
+        if (dev_priv->card_type >= NV_40 && drm_pci_device_is_pcie(dev))
                 aper_size = 512 * 1024 * 1024;
         else
                 aper_size = 64 * 1024 * 1024;
@@ -457,7 +458,7 @@ nouveau_sgdma_init(struct drm_device *dev)
                 dev_priv->gart_info.func = &nv50_sgdma_backend;
         } else
         if (drm_pci_device_is_pcie(dev) &&
-            dev_priv->chipset != 0x40 && dev_priv->chipset != 0x45) {
+            dev_priv->chipset > 0x40 && dev_priv->chipset != 0x45) {
                 if (nv44_graph_class(dev)) {
                         dev_priv->gart_info.func = &nv44_sgdma_backend;
                         align = 512 * 1024;
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index 5bb2859001e2..a30adec5beaa 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -376,15 +376,11 @@ static int nouveau_init_engine_ptrs(struct drm_device *dev)
                 engine->graph.destroy_context   = nv50_graph_destroy_context;
                 engine->graph.load_context      = nv50_graph_load_context;
                 engine->graph.unload_context    = nv50_graph_unload_context;
-                if (dev_priv->chipset != 0x86)
+                if (dev_priv->chipset == 0x50 ||
+                    dev_priv->chipset == 0xac)
                         engine->graph.tlb_flush = nv50_graph_tlb_flush;
-                else {
-                        /* from what i can see nvidia do this on every
-                         * pre-NVA3 board except NVAC, but, we've only
-                         * ever seen problems on NV86
-                         */
-                        engine->graph.tlb_flush = nv86_graph_tlb_flush;
-                }
+                else
+                        engine->graph.tlb_flush = nv84_graph_tlb_flush;
                 engine->fifo.channels           = 128;
                 engine->fifo.init               = nv50_fifo_init;
                 engine->fifo.takedown           = nv50_fifo_takedown;
@@ -612,6 +608,7 @@ nouveau_card_init(struct drm_device *dev)
         spin_lock_init(&dev_priv->channels.lock);
         spin_lock_init(&dev_priv->tile.lock);
         spin_lock_init(&dev_priv->context_switch_lock);
+        spin_lock_init(&dev_priv->vm_lock);
 
         /* Make the CRTCs and I2C buses accessible */
         ret = engine->display.early_init(dev);
diff --git a/drivers/gpu/drm/nouveau/nv04_dfp.c b/drivers/gpu/drm/nouveau/nv04_dfp.c
index c82db37d9f41..12098bf839c4 100644
--- a/drivers/gpu/drm/nouveau/nv04_dfp.c
+++ b/drivers/gpu/drm/nouveau/nv04_dfp.c
@@ -581,12 +581,13 @@ static void nv04_dfp_restore(struct drm_encoder *encoder)
         int head = nv_encoder->restore.head;
 
         if (nv_encoder->dcb->type == OUTPUT_LVDS) {
-                struct drm_display_mode *native_mode = nouveau_encoder_connector_get(nv_encoder)->native_mode;
-                if (native_mode)
-                        call_lvds_script(dev, nv_encoder->dcb, head, LVDS_PANEL_ON,
-                                         native_mode->clock);
-                else
-                        NV_ERROR(dev, "Not restoring LVDS without native mode\n");
+                struct nouveau_connector *connector =
+                        nouveau_encoder_connector_get(nv_encoder);
+
+                if (connector && connector->native_mode)
+                        call_lvds_script(dev, nv_encoder->dcb, head,
+                                         LVDS_PANEL_ON,
+                                         connector->native_mode->clock);
 
         } else if (nv_encoder->dcb->type == OUTPUT_TMDS) {
                 int clock = nouveau_hw_pllvals_to_clk
diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
index 2b9984027f41..a19ccaa025b3 100644
--- a/drivers/gpu/drm/nouveau/nv50_crtc.c
+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
@@ -469,9 +469,6 @@ nv50_crtc_wait_complete(struct drm_crtc *crtc)
 
         start = ptimer->read(dev);
         do {
-                nv_wr32(dev, 0x61002c, 0x370);
-                nv_wr32(dev, 0x000140, 1);
-
                 if (nv_ro32(disp->ntfy, 0x000))
                         return 0;
         } while (ptimer->read(dev) - start < 2000000000ULL);
diff --git a/drivers/gpu/drm/nouveau/nv50_evo.c b/drivers/gpu/drm/nouveau/nv50_evo.c
index a2cfaa691e9b..c8e83c1a4de8 100644
--- a/drivers/gpu/drm/nouveau/nv50_evo.c
+++ b/drivers/gpu/drm/nouveau/nv50_evo.c
@@ -186,6 +186,7 @@ nv50_evo_channel_init(struct nouveau_channel *evo)
         nv_mask(dev, 0x610028, 0x00000000, 0x00010001 << id);
 
         evo->dma.max = (4096/4) - 2;
+        evo->dma.max &= ~7;
         evo->dma.put = 0;
         evo->dma.cur = evo->dma.put;
         evo->dma.free = evo->dma.max - evo->dma.cur;
diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
index 8675b00caf18..b02a5b1e7d37 100644
--- a/drivers/gpu/drm/nouveau/nv50_graph.c
+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
@@ -503,7 +503,7 @@ nv50_graph_tlb_flush(struct drm_device *dev)
 }
 
 void
-nv86_graph_tlb_flush(struct drm_device *dev)
+nv84_graph_tlb_flush(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nouveau_timer_engine *ptimer = &dev_priv->engine.timer;
diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
index a6f8aa651fc6..4f95a1e5822e 100644
--- a/drivers/gpu/drm/nouveau/nv50_instmem.c
+++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
@@ -404,23 +404,25 @@ void
 nv50_instmem_flush(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
+        unsigned long flags;
 
-        spin_lock(&dev_priv->ramin_lock);
+        spin_lock_irqsave(&dev_priv->vm_lock, flags);
         nv_wr32(dev, 0x00330c, 0x00000001);
         if (!nv_wait(dev, 0x00330c, 0x00000002, 0x00000000))
                 NV_ERROR(dev, "PRAMIN flush timeout\n");
-        spin_unlock(&dev_priv->ramin_lock);
+        spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
 }
 
 void
 nv84_instmem_flush(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
+        unsigned long flags;
 
-        spin_lock(&dev_priv->ramin_lock);
+        spin_lock_irqsave(&dev_priv->vm_lock, flags);
         nv_wr32(dev, 0x070000, 0x00000001);
         if (!nv_wait(dev, 0x070000, 0x00000002, 0x00000000))
                 NV_ERROR(dev, "PRAMIN flush timeout\n");
-        spin_unlock(&dev_priv->ramin_lock);
+        spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nv50_vm.c b/drivers/gpu/drm/nouveau/nv50_vm.c
index 4fd3432b5b8d..6c2694490741 100644
--- a/drivers/gpu/drm/nouveau/nv50_vm.c
+++ b/drivers/gpu/drm/nouveau/nv50_vm.c
@@ -174,10 +174,11 @@ void
 nv50_vm_flush_engine(struct drm_device *dev, int engine)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
+        unsigned long flags;
 
-        spin_lock(&dev_priv->ramin_lock);
+        spin_lock_irqsave(&dev_priv->vm_lock, flags);
         nv_wr32(dev, 0x100c80, (engine << 16) | 1);
         if (!nv_wait(dev, 0x100c80, 0x00000001, 0x00000000))
                 NV_ERROR(dev, "vm flush timeout: engine %d\n", engine);
-        spin_unlock(&dev_priv->ramin_lock);
+        spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
 }
diff --git a/drivers/gpu/drm/nouveau/nvc0_vm.c b/drivers/gpu/drm/nouveau/nvc0_vm.c
index 69af0ba7edd3..a179e6c55afb 100644
--- a/drivers/gpu/drm/nouveau/nvc0_vm.c
+++ b/drivers/gpu/drm/nouveau/nvc0_vm.c
@@ -104,20 +104,27 @@ nvc0_vm_flush(struct nouveau_vm *vm)
         struct nouveau_instmem_engine *pinstmem = &dev_priv->engine.instmem;
         struct drm_device *dev = vm->dev;
         struct nouveau_vm_pgd *vpgd;
-        u32 r100c80, engine;
+        unsigned long flags;
+        u32 engine = (dev_priv->chan_vm == vm) ? 1 : 5;
 
         pinstmem->flush(vm->dev);
 
-        if (vm == dev_priv->chan_vm)
-                engine = 1;
-        else
-                engine = 5;
-
+        spin_lock_irqsave(&dev_priv->vm_lock, flags);
         list_for_each_entry(vpgd, &vm->pgd_list, head) {
-                r100c80 = nv_rd32(dev, 0x100c80);
+                /* looks like maybe a "free flush slots" counter, the
+                 * faster you write to 0x100cbc to more it decreases
+                 */
+                if (!nv_wait_ne(dev, 0x100c80, 0x00ff0000, 0x00000000)) {
+                        NV_ERROR(dev, "vm timeout 0: 0x%08x %d\n",
+                                 nv_rd32(dev, 0x100c80), engine);
+                }
                 nv_wr32(dev, 0x100cb8, vpgd->obj->vinst >> 8);
                 nv_wr32(dev, 0x100cbc, 0x80000000 | engine);
-                if (!nv_wait(dev, 0x100c80, 0xffffffff, r100c80))
-                        NV_ERROR(dev, "vm flush timeout eng %d\n", engine);
+                /* wait for flush to be queued? */
+                if (!nv_wait(dev, 0x100c80, 0x00008000, 0x00008000)) {
+                        NV_ERROR(dev, "vm timeout 1: 0x%08x %d\n",
+                                 nv_rd32(dev, 0x100c80), engine);
+                }
         }
+        spin_unlock_irqrestore(&dev_priv->vm_lock, flags);
 }
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 258fa5e7a2d9..7bd745689097 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -32,6 +32,7 @@
 #include "atom.h"
 #include "atom-names.h"
 #include "atom-bits.h"
+#include "radeon.h"
 
 #define ATOM_COND_ABOVE         0
 #define ATOM_COND_ABOVEOREQUAL  1
@@ -101,7 +102,9 @@ static void debug_print_spaces(int n)
 static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                                  uint32_t index, uint32_t data)
 {
+        struct radeon_device *rdev = ctx->card->dev->dev_private;
         uint32_t temp = 0xCDCDCDCD;
+
         while (1)
                 switch (CU8(base)) {
                 case ATOM_IIO_NOP:
@@ -112,7 +115,8 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                         base += 3;
                         break;
                 case ATOM_IIO_WRITE:
-                        (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
+                        if (rdev->family == CHIP_RV515)
+                                (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
                         ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp);
                         base += 3;
                         break;
@@ -131,7 +135,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                 case ATOM_IIO_MOVE_INDEX:
                         temp &=
                             ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
-                              CU8(base + 2));
+                              CU8(base + 3));
                         temp |=
                             ((index >> CU8(base + 2)) &
                              (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -141,7 +145,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                 case ATOM_IIO_MOVE_DATA:
                         temp &=
                             ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
-                              CU8(base + 2));
+                              CU8(base + 3));
                         temp |=
                             ((data >> CU8(base + 2)) &
                              (0xFFFFFFFF >> (32 - CU8(base + 1)))) << CU8(base +
@@ -151,7 +155,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                 case ATOM_IIO_MOVE_ATTR:
                         temp &=
                             ~((0xFFFFFFFF >> (32 - CU8(base + 1))) <<
-                              CU8(base + 2));
+                              CU8(base + 3));
                         temp |=
                             ((ctx->
                               io_attr >> CU8(base + 2)) & (0xFFFFFFFF >> (32 -
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index b41ec59c7100..529a3a704731 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -531,6 +531,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                         pll->flags |= RADEON_PLL_PREFER_HIGH_FB_DIV;
                 else
                         pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+
+                if (rdev->family < CHIP_RV770)
+                        pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
         } else {
                 pll->flags |= RADEON_PLL_LEGACY;
 
@@ -559,7 +562,6 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                         if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
                                 if (ss_enabled) {
                                         if (ss->refdiv) {
-                                                pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
                                                 pll->flags |= RADEON_PLL_USE_REF_DIV;
                                                 pll->reference_div = ss->refdiv;
                                                 if (ASIC_IS_AVIVO(rdev))
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 0b0cc74c08c0..e9bc135d9189 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -120,11 +120,16 @@ void evergreen_pm_misc(struct radeon_device *rdev)
         struct radeon_power_state *ps = &rdev->pm.power_state[req_ps_idx];
         struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
 
-        if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
-                if (voltage->voltage != rdev->pm.current_vddc) {
-                        radeon_atom_set_voltage(rdev, voltage->voltage);
+        if (voltage->type == VOLTAGE_SW) {
+                if (voltage->voltage && (voltage->voltage != rdev->pm.current_vddc)) {
+                        radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                         rdev->pm.current_vddc = voltage->voltage;
-                        DRM_DEBUG("Setting: v: %d\n", voltage->voltage);
+                        DRM_DEBUG("Setting: vddc: %d\n", voltage->voltage);
+                }
+                if (voltage->vddci && (voltage->vddci != rdev->pm.current_vddci)) {
+                        radeon_atom_set_voltage(rdev, voltage->vddci, SET_VOLTAGE_TYPE_ASIC_VDDCI);
+                        rdev->pm.current_vddci = voltage->vddci;
+                        DRM_DEBUG("Setting: vddci: %d\n", voltage->vddci);
                 }
         }
 }
@@ -348,7 +353,7 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev,
                                         struct drm_display_mode *mode,
                                         struct drm_display_mode *other_mode)
 {
-        u32 tmp = 0;
+        u32 tmp;
         /*
          * Line Buffer Setup
          * There are 3 line buffers, each one shared by 2 display controllers.
@@ -358,64 +363,63 @@ static u32 evergreen_line_buffer_adjust(struct radeon_device *rdev,
          * first display controller
          *  0 - first half of lb (3840 * 2)
          *  1 - first 3/4 of lb (5760 * 2)
-         *  2 - whole lb (7680 * 2)
+         *  2 - whole lb (7680 * 2), other crtc must be disabled
          *  3 - first 1/4 of lb (1920 * 2)
          * second display controller
          *  4 - second half of lb (3840 * 2)
          *  5 - second 3/4 of lb (5760 * 2)
-         *  6 - whole lb (7680 * 2)
+         *  6 - whole lb (7680 * 2), other crtc must be disabled
          *  7 - last 1/4 of lb (1920 * 2)
          */
-        if (mode && other_mode) {
-                if (mode->hdisplay > other_mode->hdisplay) {
-                        if (mode->hdisplay > 2560)
-                                tmp = 1; /* 3/4 */
-                        else
-                                tmp = 0; /* 1/2 */
-                } else if (other_mode->hdisplay > mode->hdisplay) {
-                        if (other_mode->hdisplay > 2560)
-                                tmp = 3; /* 1/4 */
-                        else
-                                tmp = 0; /* 1/2 */
-                } else
+        /* this can get tricky if we have two large displays on a paired group
+         * of crtcs.  Ideally for multiple large displays we'd assign them to
+         * non-linked crtcs for maximum line buffer allocation.
+         */
+        if (radeon_crtc->base.enabled && mode) {
+                if (other_mode)
                         tmp = 0; /* 1/2 */
-        } else if (mode)
-                tmp = 2; /* whole */
-        else if (other_mode)
-                tmp = 3; /* 1/4 */
+                else
+                        tmp = 2; /* whole */
+        } else
+                tmp = 0;
 
         /* second controller of the pair uses second half of the lb */
         if (radeon_crtc->crtc_id % 2)
                 tmp += 4;
         WREG32(DC_LB_MEMORY_SPLIT + radeon_crtc->crtc_offset, tmp);
 
-        switch (tmp) {
-        case 0:
-        case 4:
-        default:
-                if (ASIC_IS_DCE5(rdev))
-                        return 4096 * 2;
-                else
-                        return 3840 * 2;
-        case 1:
-        case 5:
-                if (ASIC_IS_DCE5(rdev))
-                        return 6144 * 2;
-                else
-                        return 5760 * 2;
-        case 2:
-        case 6:
-                if (ASIC_IS_DCE5(rdev))
-                        return 8192 * 2;
-                else
-                        return 7680 * 2;
-        case 3:
-        case 7:
-                if (ASIC_IS_DCE5(rdev))
-                        return 2048 * 2;
-                else
-                        return 1920 * 2;
+        if (radeon_crtc->base.enabled && mode) {
+                switch (tmp) {
+                case 0:
+                case 4:
+                default:
+                        if (ASIC_IS_DCE5(rdev))
+                                return 4096 * 2;
+                        else
+                                return 3840 * 2;
+                case 1:
+                case 5:
+                        if (ASIC_IS_DCE5(rdev))
+                                return 6144 * 2;
+                        else
+                                return 5760 * 2;
+                case 2:
+                case 6:
+                        if (ASIC_IS_DCE5(rdev))
+                                return 8192 * 2;
+                        else
+                                return 7680 * 2;
+                case 3:
+                case 7:
+                        if (ASIC_IS_DCE5(rdev))
+                                return 2048 * 2;
+                        else
+                                return 1920 * 2;
+                }
         }
+
+        /* controller not enabled, so no lb used */
+        return 0;
 }
 
 static u32 evergreen_get_number_of_dram_channels(struct radeon_device *rdev)
@@ -2576,7 +2580,7 @@ static inline u32 evergreen_get_ih_wptr(struct radeon_device *rdev)
         u32 wptr, tmp;
 
         if (rdev->wb.enabled)
-                wptr = rdev->wb.wb[R600_WB_IH_WPTR_OFFSET/4];
+                wptr = le32_to_cpu(rdev->wb.wb[R600_WB_IH_WPTR_OFFSET/4]);
         else
                 wptr = RREG32(IH_RB_WPTR);
 
@@ -3036,9 +3040,6 @@ int evergreen_init(struct radeon_device *rdev)
 {
         int r;
 
-        r = radeon_dummy_page_init(rdev);
-        if (r)
-                return r;
         /* This don't do much */
         r = radeon_gem_init(rdev);
         if (r)
@@ -3150,7 +3151,6 @@ void evergreen_fini(struct radeon_device *rdev)
         radeon_atombios_fini(rdev);
         kfree(rdev->bios);
         rdev->bios = NULL;
-        radeon_dummy_page_fini(rdev);
 }
 
 static void evergreen_pcie_gen2_enable(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index be271c42de4d..6f27593901c7 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -587,7 +587,7 @@ void r600_pm_misc(struct radeon_device *rdev)
 
         if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
                 if (voltage->voltage != rdev->pm.current_vddc) {
-                        radeon_atom_set_voltage(rdev, voltage->voltage);
+                        radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                         rdev->pm.current_vddc = voltage->voltage;
                         DRM_DEBUG_DRIVER("Setting: v: %d\n", voltage->voltage);
                 }
@@ -2509,9 +2509,6 @@ int r600_init(struct radeon_device *rdev)
 {
         int r;
 
-        r = radeon_dummy_page_init(rdev);
-        if (r)
-                return r;
         if (r600_debugfs_mc_info_init(rdev)) {
                 DRM_ERROR("Failed to register debugfs file for mc !\n");
         }
@@ -2625,7 +2622,6 @@ void r600_fini(struct radeon_device *rdev)
         radeon_atombios_fini(rdev);
         kfree(rdev->bios);
         rdev->bios = NULL;
-        radeon_dummy_page_fini(rdev);
 }
 
 
@@ -3235,7 +3231,7 @@ static inline u32 r600_get_ih_wptr(struct radeon_device *rdev)
         u32 wptr, tmp;
 
         if (rdev->wb.enabled)
-                wptr = rdev->wb.wb[R600_WB_IH_WPTR_OFFSET/4];
+                wptr = le32_to_cpu(rdev->wb.wb[R600_WB_IH_WPTR_OFFSET/4]);
         else
                 wptr = RREG32(IH_RB_WPTR);
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 93f536594c73..ba643b576054 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -177,7 +177,7 @@ void radeon_pm_suspend(struct radeon_device *rdev);
 void radeon_pm_resume(struct radeon_device *rdev);
 void radeon_combios_get_power_modes(struct radeon_device *rdev);
 void radeon_atombios_get_power_modes(struct radeon_device *rdev);
-void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level);
+void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 voltage_type);
 void rs690_pm_info(struct radeon_device *rdev);
 extern int rv6xx_get_temp(struct radeon_device *rdev);
 extern int rv770_get_temp(struct radeon_device *rdev);
@@ -767,7 +767,9 @@ struct radeon_voltage {
         u8 vddci_id; /* index into vddci voltage table */
         bool vddci_enabled;
         /* r6xx+ sw */
-        u32 voltage;
+        u16 voltage;
+        /* evergreen+ vddci */
+        u16 vddci;
 };
 
 /* clock mode flags */
@@ -835,10 +837,12 @@ struct radeon_pm {
         int                     default_power_state_index;
         u32                     current_sclk;
         u32                     current_mclk;
-        u32                     current_vddc;
+        u16                     current_vddc;
+        u16                     current_vddci;
         u32                     default_sclk;
         u32                     default_mclk;
-        u32                     default_vddc;
+        u16                     default_vddc;
+        u16                     default_vddci;
         struct radeon_i2c_chan *i2c_bus;
         /* selected pm method */
         enum radeon_pm_method     pm_method;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index eb888ee5f674..ca576191d058 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -94,7 +94,7 @@ static void radeon_register_accessor_init(struct radeon_device *rdev)
                 rdev->mc_rreg = &rs600_mc_rreg;
                 rdev->mc_wreg = &rs600_mc_wreg;
         }
-        if ((rdev->family >= CHIP_R600) && (rdev->family <= CHIP_HEMLOCK)) {
+        if (rdev->family >= CHIP_R600) {
                 rdev->pciep_rreg = &r600_pciep_rreg;
                 rdev->pciep_wreg = &r600_pciep_wreg;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 99768d9d91da..f5d12fb103fa 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2176,24 +2176,27 @@ static void radeon_atombios_add_pplib_thermal_controller(struct radeon_device *r
         }
 }
 
-static u16 radeon_atombios_get_default_vddc(struct radeon_device *rdev)
+static void radeon_atombios_get_default_voltages(struct radeon_device *rdev,
+                                                 u16 *vddc, u16 *vddci)
 {
         struct radeon_mode_info *mode_info = &rdev->mode_info;
         int index = GetIndexIntoMasterTable(DATA, FirmwareInfo);
         u8 frev, crev;
         u16 data_offset;
         union firmware_info *firmware_info;
-        u16 vddc = 0;
+
+        *vddc = 0;
+        *vddci = 0;
 
         if (atom_parse_data_header(mode_info->atom_context, index, NULL,
                                    &frev, &crev, &data_offset)) {
                 firmware_info =
                         (union firmware_info *)(mode_info->atom_context->bios +
                                                 data_offset);
-                vddc = le16_to_cpu(firmware_info->info_14.usBootUpVDDCVoltage);
+                *vddc = le16_to_cpu(firmware_info->info_14.usBootUpVDDCVoltage);
+                if ((frev == 2) && (crev >= 2))
+                        *vddci = le16_to_cpu(firmware_info->info_22.usBootUpVDDCIVoltage);
         }
-
-        return vddc;
 }
 
 static void radeon_atombios_parse_pplib_non_clock_info(struct radeon_device *rdev,
@@ -2203,7 +2206,9 @@ static void radeon_atombios_parse_pplib_non_clock_info(struct radeon_device *rde
         int j;
         u32 misc = le32_to_cpu(non_clock_info->ulCapsAndSettings);
         u32 misc2 = le16_to_cpu(non_clock_info->usClassification);
-        u16 vddc = radeon_atombios_get_default_vddc(rdev);
+        u16 vddc, vddci;
+
+        radeon_atombios_get_default_voltages(rdev, &vddc, &vddci);
 
         rdev->pm.power_state[state_index].misc = misc;
         rdev->pm.power_state[state_index].misc2 = misc2;
@@ -2244,6 +2249,7 @@ static void radeon_atombios_parse_pplib_non_clock_info(struct radeon_device *rde
                         rdev->pm.default_sclk = rdev->pm.power_state[state_index].clock_info[0].sclk;
                         rdev->pm.default_mclk = rdev->pm.power_state[state_index].clock_info[0].mclk;
                         rdev->pm.default_vddc = rdev->pm.power_state[state_index].clock_info[0].voltage.voltage;
+                        rdev->pm.default_vddci = rdev->pm.power_state[state_index].clock_info[0].voltage.vddci;
                 } else {
                         /* patch the table values with the default slck/mclk from firmware info */
                         for (j = 0; j < mode_index; j++) {
@@ -2286,6 +2292,8 @@ static bool radeon_atombios_parse_pplib_clock_info(struct radeon_device *rdev,
                         VOLTAGE_SW;
                 rdev->pm.power_state[state_index].clock_info[mode_index].voltage.voltage =
                         le16_to_cpu(clock_info->evergreen.usVDDC);
+                rdev->pm.power_state[state_index].clock_info[mode_index].voltage.vddci =
+                        le16_to_cpu(clock_info->evergreen.usVDDCI);
         } else {
                 sclk = le16_to_cpu(clock_info->r600.usEngineClockLow);
                 sclk |= clock_info->r600.ucEngineClockHigh << 16;
@@ -2577,25 +2585,25 @@ union set_voltage {
         struct _SET_VOLTAGE_PARAMETERS_V2 v2;
 };
 
-void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level)
+void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 voltage_type)
 {
         union set_voltage args;
         int index = GetIndexIntoMasterTable(COMMAND, SetVoltage);
-        u8 frev, crev, volt_index = level;
+        u8 frev, crev, volt_index = voltage_level;
 
         if (!atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev))
                 return;
 
         switch (crev) {
         case 1:
-                args.v1.ucVoltageType = SET_VOLTAGE_TYPE_ASIC_VDDC;
+                args.v1.ucVoltageType = voltage_type;
                 args.v1.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_ALL_SOURCE;
                 args.v1.ucVoltageIndex = volt_index;
                 break;
         case 2:
-                args.v2.ucVoltageType = SET_VOLTAGE_TYPE_ASIC_VDDC;
+                args.v2.ucVoltageType = voltage_type;
                 args.v2.ucVoltageMode = SET_ASIC_VOLTAGE_MODE_SET_VOLTAGE;
-                args.v2.usVoltageLevel = cpu_to_le16(level);
+                args.v2.usVoltageLevel = cpu_to_le16(voltage_level);
                 break;
         default:
                 DRM_ERROR("Unknown table version %d, %d\n", frev, crev);
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 2ef6d5135064..5f45fa12bb8b 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1199,7 +1199,7 @@ radeon_add_atom_connector(struct drm_device *dev,
         if (router->ddc_valid || router->cd_valid) {
                 radeon_connector->router_bus = radeon_i2c_lookup(rdev, &router->i2c_info);
                 if (!radeon_connector->router_bus)
-                        goto failed;
+                        DRM_ERROR("Failed to assign router i2c bus! Check dmesg for i2c errors.\n");
         }
         switch (connector_type) {
         case DRM_MODE_CONNECTOR_VGA:
@@ -1208,7 +1208,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("VGA: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 radeon_connector->dac_load_detect = true;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1226,7 +1226,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DVIA: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 radeon_connector->dac_load_detect = true;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1249,7 +1249,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DVI: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 subpixel_order = SubPixelHorizontalRGB;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1290,7 +1290,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("HDMI: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 drm_connector_attach_property(&radeon_connector->base,
                                               rdev->mode_info.coherent_mode_property,
@@ -1329,10 +1329,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                         else
                                 radeon_dig_connector->dp_i2c_bus = radeon_i2c_create_dp(dev, i2c_bus, "DP-auxch");
                         if (!radeon_dig_connector->dp_i2c_bus)
-                                goto failed;
+                                DRM_ERROR("DP: Failed to assign dp ddc bus! Check dmesg for i2c errors.\n");
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DP: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 subpixel_order = SubPixelHorizontalRGB;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1381,7 +1381,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("LVDS: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 drm_connector_attach_property(&radeon_connector->base,
                                               dev->mode_config.scaling_mode_property,
@@ -1457,7 +1457,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("VGA: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 radeon_connector->dac_load_detect = true;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1475,7 +1475,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DVIA: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 radeon_connector->dac_load_detect = true;
                 drm_connector_attach_property(&radeon_connector->base,
@@ -1493,7 +1493,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("DVI: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                         radeon_connector->dac_load_detect = true;
@@ -1538,7 +1538,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                 if (i2c_bus->valid) {
                         radeon_connector->ddc_bus = radeon_i2c_lookup(rdev, i2c_bus);
                         if (!radeon_connector->ddc_bus)
-                                goto failed;
+                                DRM_ERROR("LVDS: Failed to assign ddc bus! Check dmesg for i2c errors.\n");
                 }
                 drm_connector_attach_property(&radeon_connector->base,
                                               dev->mode_config.scaling_mode_property,
@@ -1567,9 +1567,4 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                 radeon_legacy_backlight_init(radeon_encoder, connector);
                 }
         }
-        return;
-
-failed:
-        drm_connector_cleanup(connector);
-        kfree(connector);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 9e59868d354e..bbcd1dd7bac0 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -79,7 +79,7 @@ static bool radeon_fence_poll_locked(struct radeon_device *rdev)
                         scratch_index = R600_WB_EVENT_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
                 else
                         scratch_index = RADEON_WB_SCRATCH_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
-                seq = rdev->wb.wb[scratch_index/4];
+                seq = le32_to_cpu(rdev->wb.wb[scratch_index/4]);
         } else
                 seq = RREG32(rdev->fence_drv.scratch_reg);
         if (seq != rdev->fence_drv.last_seq) {
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index f0534ef2f331..8a955bbdb608 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -285,4 +285,6 @@ void radeon_gart_fini(struct radeon_device *rdev)
         rdev->gart.pages = NULL;
         rdev->gart.pages_addr = NULL;
         rdev->gart.ttm_alloced = NULL;
+
+        radeon_dummy_page_fini(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index ded2a45bc95c..983cbac75af0 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -1062,7 +1062,7 @@ void radeon_i2c_get_byte(struct radeon_i2c_chan *i2c_bus,
                 *val = in_buf[0];
                 DRM_DEBUG("val = 0x%02x\n", *val);
         } else {
-                DRM_ERROR("i2c 0x%02x 0x%02x read failed\n",
+                DRM_DEBUG("i2c 0x%02x 0x%02x read failed\n",
                           addr, *val);
         }
 }
@@ -1084,7 +1084,7 @@ void radeon_i2c_put_byte(struct radeon_i2c_chan *i2c_bus,
         out_buf[1] = val;
 
         if (i2c_transfer(&i2c_bus->adapter, &msg, 1) != 1)
-                DRM_ERROR("i2c 0x%02x 0x%02x write failed\n",
+                DRM_DEBUG("i2c 0x%02x 0x%02x write failed\n",
                           addr, val);
 }
 
@@ -1096,6 +1096,9 @@ void radeon_router_select_ddc_port(struct radeon_connector *radeon_connector)
         if (!radeon_connector->router.ddc_valid)
                 return;
 
+        if (!radeon_connector->router_bus)
+                return;
+
         radeon_i2c_get_byte(radeon_connector->router_bus,
                             radeon_connector->router.i2c_addr,
                             0x3, &val);
@@ -1121,6 +1124,9 @@ void radeon_router_select_cd_port(struct radeon_connector *radeon_connector)
         if (!radeon_connector->router.cd_valid)
                 return;
 
+        if (!radeon_connector->router_bus)
+                return;
+
         radeon_i2c_get_byte(radeon_connector->router_bus,
                             radeon_connector->router.i2c_addr,
                             0x3, &val);
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index bf7d4c061451..871df0376b1c 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -221,6 +221,19 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                         return -EINVAL;
                 }
                 break;
+        case RADEON_INFO_NUM_TILE_PIPES:
+                if (rdev->family >= CHIP_CAYMAN)
+                        value = rdev->config.cayman.max_tile_pipes;
+                else if (rdev->family >= CHIP_CEDAR)
+                        value = rdev->config.evergreen.max_tile_pipes;
+                else if (rdev->family >= CHIP_RV770)
+                        value = rdev->config.rv770.max_tile_pipes;
+                else if (rdev->family >= CHIP_R600)
+                        value = rdev->config.r600.max_tile_pipes;
+                else {
+                        return -EINVAL;
+                }
+                break;
         default:
                 DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 5b54268ed6b2..2f46e0c8df53 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -269,7 +269,7 @@ static const struct drm_encoder_helper_funcs radeon_legacy_lvds_helper_funcs = {
         .disable = radeon_legacy_encoder_disable,
 };
 
-#ifdef CONFIG_BACKLIGHT_CLASS_DEVICE
+#if defined(CONFIG_BACKLIGHT_CLASS_DEVICE) || defined(CONFIG_BACKLIGHT_CLASS_DEVICE_MODULE)
 
 #define MAX_RADEON_LEVEL 0xFF
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 08de669e025a..86eda1ea94df 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -23,6 +23,7 @@
 #include "drmP.h"
 #include "radeon.h"
 #include "avivod.h"
+#include "atom.h"
 #ifdef CONFIG_ACPI
 #include <linux/acpi.h>
 #endif
@@ -535,7 +536,11 @@ void radeon_pm_resume(struct radeon_device *rdev)
         /* set up the default clocks if the MC ucode is loaded */
         if (ASIC_IS_DCE5(rdev) && rdev->mc_fw) {
                 if (rdev->pm.default_vddc)
-                        radeon_atom_set_voltage(rdev, rdev->pm.default_vddc);
+                        radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
+                                                SET_VOLTAGE_TYPE_ASIC_VDDC);
+                if (rdev->pm.default_vddci)
+                        radeon_atom_set_voltage(rdev, rdev->pm.default_vddci,
+                                                SET_VOLTAGE_TYPE_ASIC_VDDCI);
                 if (rdev->pm.default_sclk)
                         radeon_set_engine_clock(rdev, rdev->pm.default_sclk);
                 if (rdev->pm.default_mclk)
@@ -548,6 +553,7 @@ void radeon_pm_resume(struct radeon_device *rdev)
         rdev->pm.current_sclk = rdev->pm.default_sclk;
         rdev->pm.current_mclk = rdev->pm.default_mclk;
         rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
+        rdev->pm.current_vddci = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.vddci;
         if (rdev->pm.pm_method == PM_METHOD_DYNPM
             && rdev->pm.dynpm_state == DYNPM_STATE_SUSPENDED) {
                 rdev->pm.dynpm_state = DYNPM_STATE_ACTIVE;
@@ -585,7 +591,8 @@ int radeon_pm_init(struct radeon_device *rdev)
                 /* set up the default clocks if the MC ucode is loaded */
                 if (ASIC_IS_DCE5(rdev) && rdev->mc_fw) {
                         if (rdev->pm.default_vddc)
-                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc);
+                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
+                                                        SET_VOLTAGE_TYPE_ASIC_VDDC);
                         if (rdev->pm.default_sclk)
                                 radeon_set_engine_clock(rdev, rdev->pm.default_sclk);
                         if (rdev->pm.default_mclk)
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index bbc9cd823334..c6776e48fdde 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -248,7 +248,7 @@ void radeon_ib_pool_fini(struct radeon_device *rdev)
 void radeon_ring_free_size(struct radeon_device *rdev)
 {
         if (rdev->wb.enabled)
-                rdev->cp.rptr = rdev->wb.wb[RADEON_WB_CP_RPTR_OFFSET/4];
+                rdev->cp.rptr = le32_to_cpu(rdev->wb.wb[RADEON_WB_CP_RPTR_OFFSET/4]);
         else {
                 if (rdev->family >= CHIP_R600)
                         rdev->cp.rptr = RREG32(R600_CP_RB_RPTR);
diff --git a/drivers/gpu/drm/radeon/reg_srcs/r600 b/drivers/gpu/drm/radeon/reg_srcs/r600
index af0da4ae3f55..92f1900dc7ca 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/r600
+++ b/drivers/gpu/drm/radeon/reg_srcs/r600
@@ -708,6 +708,7 @@ r600 0x9400
 0x00028D0C DB_RENDER_CONTROL
 0x00028D10 DB_RENDER_OVERRIDE
 0x0002880C DB_SHADER_CONTROL
+0x00028D28 DB_SRESULTS_COMPARE_STATE0
 0x00028D2C DB_SRESULTS_COMPARE_STATE1
 0x00028430 DB_STENCILREFMASK
 0x00028434 DB_STENCILREFMASK_BF
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 876cebc4b8ba..6e3b11e5abbe 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -114,7 +114,7 @@ void rs600_pm_misc(struct radeon_device *rdev)
                                 udelay(voltage->delay);
                 }
         } else if (voltage->type == VOLTAGE_VDDC)
-                radeon_atom_set_voltage(rdev, voltage->vddc_id);
+                radeon_atom_set_voltage(rdev, voltage->vddc_id, SET_VOLTAGE_TYPE_ASIC_VDDC);
 
         dyn_pwrmgt_sclk_length = RREG32_PLL(DYN_PWRMGT_SCLK_LENGTH);
         dyn_pwrmgt_sclk_length &= ~REDUCED_POWER_SCLK_HILEN(0xf);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index b974ac7df8df..ef8a5babe9f7 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -106,7 +106,7 @@ void rv770_pm_misc(struct radeon_device *rdev)
 
         if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
                 if (voltage->voltage != rdev->pm.current_vddc) {
-                        radeon_atom_set_voltage(rdev, voltage->voltage);
+                        radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                         rdev->pm.current_vddc = voltage->voltage;
                         DRM_DEBUG("Setting: v: %d\n", voltage->voltage);
                 }
@@ -1255,9 +1255,6 @@ int rv770_init(struct radeon_device *rdev)
 {
         int r;
 
-        r = radeon_dummy_page_init(rdev);
-        if (r)
-                return r;
         /* This don't do much */
         r = radeon_gem_init(rdev);
         if (r)
@@ -1372,7 +1369,6 @@ void rv770_fini(struct radeon_device *rdev)
         radeon_atombios_fini(rdev);
         kfree(rdev->bios);
         rdev->bios = NULL;
-        radeon_dummy_page_fini(rdev);
 }
 
 static void rv770_pcie_gen2_enable(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 737a2a2e46a5..9d9d92945f8c 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -683,22 +683,14 @@ int ttm_get_pages(struct list_head *pages, int flags,
                         gfp_flags |= GFP_HIGHUSER;
 
                 for (r = 0; r < count; ++r) {
-                        if ((flags & TTM_PAGE_FLAG_DMA32) && dma_address) {
-                                void *addr;
-                                addr = dma_alloc_coherent(NULL, PAGE_SIZE,
-                                                          &dma_address[r],
-                                                          gfp_flags);
-                                if (addr == NULL)
-                                        return -ENOMEM;
-                                p = virt_to_page(addr);
-                        } else
-                                p = alloc_page(gfp_flags);
+                        p = alloc_page(gfp_flags);
                         if (!p) {
 
                                 printk(KERN_ERR TTM_PFX
                                        "Unable to allocate page.");
                                 return -ENOMEM;
                         }
+
                         list_add(&p->lru, pages);
                 }
                 return 0;
@@ -746,24 +738,12 @@ void ttm_put_pages(struct list_head *pages, unsigned page_count, int flags,
         unsigned long irq_flags;
         struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
         struct page *p, *tmp;
-        unsigned r;
 
         if (pool == NULL) {
                 /* No pool for this memory type so free the pages */
 
-                r = page_count-1;
                 list_for_each_entry_safe(p, tmp, pages, lru) {
-                        if ((flags & TTM_PAGE_FLAG_DMA32) && dma_address) {
-                                void *addr = page_address(p);
-                                WARN_ON(!addr || !dma_address[r]);
-                                if (addr)
-                                        dma_free_coherent(NULL, PAGE_SIZE,
-                                                          addr,
-                                                          dma_address[r]);
-                                dma_address[r] = 0;
-                        } else
-                                __free_page(p);
-                        r--;
+                        __free_page(p);
                 }
                 /* Make the pages list empty */
                 INIT_LIST_HEAD(pages);
diff --git a/drivers/gpu/stub/Kconfig b/drivers/gpu/stub/Kconfig
index 70e60a4bb678..419917955bf6 100644
--- a/drivers/gpu/stub/Kconfig
+++ b/drivers/gpu/stub/Kconfig
@@ -5,6 +5,7 @@ config STUB_POULSBO
         # Poulsbo stub depends on ACPI_VIDEO when ACPI is enabled
         # but for select to work, need to select ACPI_VIDEO's dependencies, ick
         select BACKLIGHT_CLASS_DEVICE if ACPI
+        select VIDEO_OUTPUT_CONTROL if ACPI
         select INPUT if ACPI
         select ACPI_VIDEO if ACPI
         select THERMAL if ACPI
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 060ef6327876..50e40dbd8bb6 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -110,8 +110,7 @@ config SENSORS_ADM1021
         help
           If you say yes here you get support for Analog Devices ADM1021
           and ADM1023 sensor chips and clones: Maxim MAX1617 and MAX1617A,
-          Genesys Logic GL523SM, National Semiconductor LM84, TI THMC10,
-          and the XEON processor built-in sensor.
+          Genesys Logic GL523SM, National Semiconductor LM84 and TI THMC10.
 
           This driver can also be built as a module.  If so, the module
           will be called adm1021.
@@ -618,10 +617,10 @@ config SENSORS_LM90
         depends on I2C
         help
           If you say yes here you get support for National Semiconductor LM90,
-          LM86, LM89 and LM99, Analog Devices ADM1032 and ADT7461, Maxim
-          MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
-          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, and Winbond/Nuvoton
-          W83L771W/G/AWG/ASG sensor chips.
+          LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A,
+          Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
+          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008,
+          and Winbond/Nuvoton W83L771W/G/AWG/ASG sensor chips.
 
           This driver can also be built as a module.  If so, the module
           will be called lm90.
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 250d099ca398..da72dc12068c 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1094,6 +1094,7 @@ static struct attribute *lm85_attributes_minctl[] = {
         &sensor_dev_attr_pwm1_auto_pwm_minctl.dev_attr.attr,
         &sensor_dev_attr_pwm2_auto_pwm_minctl.dev_attr.attr,
         &sensor_dev_attr_pwm3_auto_pwm_minctl.dev_attr.attr,
+        NULL
 };
 
 static const struct attribute_group lm85_group_minctl = {
@@ -1104,6 +1105,7 @@ static struct attribute *lm85_attributes_temp_off[] = {
         &sensor_dev_attr_temp1_auto_temp_off.dev_attr.attr,
         &sensor_dev_attr_temp2_auto_temp_off.dev_attr.attr,
         &sensor_dev_attr_temp3_auto_temp_off.dev_attr.attr,
+        NULL
 };
 
 static const struct attribute_group lm85_group_temp_off = {
@@ -1329,11 +1331,11 @@ static int lm85_probe(struct i2c_client *client,
         if (data->type != emc6d103s) {
                 err = sysfs_create_group(&client->dev.kobj, &lm85_group_minctl);
                 if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
                 err = sysfs_create_group(&client->dev.kobj,
                                          &lm85_group_temp_off);
                 if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
         }
 
         /* The ADT7463/68 have an optional VRM 10 mode where pin 21 is used
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index c43b4e9f96a9..2f94f9504804 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -49,10 +49,10 @@
  * chips, but support three temperature sensors instead of two. MAX6695
  * and MAX6696 only differ in the pinout so they can be treated identically.
  *
- * This driver also supports the ADT7461 chip from Analog Devices.
- * It's supported in both compatibility and extended mode. It is mostly
- * compatible with LM90 except for a data format difference for the
- * temperature value registers.
+ * This driver also supports ADT7461 and ADT7461A from Analog Devices as well as
+ * NCT1008 from ON Semiconductor. The chips are supported in both compatibility
+ * and extended mode. They are mostly compatible with LM90 except for a data
+ * format difference for the temperature value registers.
  *
  * Since the LM90 was the first chipset supported by this driver, most
  * comments will refer to this chipset, but are actually general and
@@ -88,9 +88,10 @@
  * Addresses to scan
  * Address is fully defined internally and cannot be changed except for
  * MAX6659, MAX6680 and MAX6681.
- * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, MAX6649, MAX6657,
- * MAX6658 and W83L771 have address 0x4c.
- * ADM1032-2, ADT7461-2, LM89-1, LM99-1 and MAX6646 have address 0x4d.
+ * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, ADT7461A, MAX6649,
+ * MAX6657, MAX6658, NCT1008 and W83L771 have address 0x4c.
+ * ADM1032-2, ADT7461-2, ADT7461A-2, LM89-1, LM99-1, MAX6646, and NCT1008D
+ * have address 0x4d.
  * MAX6647 has address 0x4e.
  * MAX6659 can have address 0x4c, 0x4d or 0x4e.
  * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b,
@@ -174,6 +175,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
 static const struct i2c_device_id lm90_id[] = {
         { "adm1032", adm1032 },
         { "adt7461", adt7461 },
+        { "adt7461a", adt7461 },
         { "lm90", lm90 },
         { "lm86", lm86 },
         { "lm89", lm86 },
@@ -188,6 +190,7 @@ static const struct i2c_device_id lm90_id[] = {
         { "max6681", max6680 },
         { "max6695", max6696 },
         { "max6696", max6696 },
+        { "nct1008", adt7461 },
         { "w83l771", w83l771 },
         { }
 };
@@ -1153,6 +1156,11 @@ static int lm90_detect(struct i2c_client *new_client,
                  && (reg_config1 & 0x1B) == 0x00
                  && reg_convrate <= 0x0A) {
                         name = "adt7461";
+                } else
+                if (chip_id == 0x57 /* ADT7461A, NCT1008 */
+                 && (reg_config1 & 0x1B) == 0x00
+                 && reg_convrate <= 0x0A) {
+                        name = "adt7461a";
                 }
         } else
         if (man_id == 0x4D) { /* Maxim */
diff --git a/drivers/hwmon/pmbus_core.c b/drivers/hwmon/pmbus_core.c
index edfb92e41735..196ffafafd88 100644
--- a/drivers/hwmon/pmbus_core.c
+++ b/drivers/hwmon/pmbus_core.c
@@ -139,7 +139,6 @@ struct pmbus_data {
          * A single status register covers multiple attributes,
          * so we keep them all together.
          */
-        u8 status_bits;
         u8 status[PB_NUM_STATUS_REG];
 
         u8 currpage;
diff --git a/drivers/hwmon/twl4030-madc-hwmon.c b/drivers/hwmon/twl4030-madc-hwmon.c
index de5819199e2e..57240740b161 100644
--- a/drivers/hwmon/twl4030-madc-hwmon.c
+++ b/drivers/hwmon/twl4030-madc-hwmon.c
@@ -98,7 +98,6 @@ static const struct attribute_group twl4030_madc_group = {
 static int __devinit twl4030_madc_hwmon_probe(struct platform_device *pdev)
 {
         int ret;
-        int status;
         struct device *hwmon;
 
         ret = sysfs_create_group(&pdev->dev.kobj, &twl4030_madc_group);
@@ -107,7 +106,7 @@ static int __devinit twl4030_madc_hwmon_probe(struct platform_device *pdev)
         hwmon = hwmon_device_register(&pdev->dev);
         if (IS_ERR(hwmon)) {
                 dev_err(&pdev->dev, "hwmon_device_register failed.\n");
-                status = PTR_ERR(hwmon);
+                ret = PTR_ERR(hwmon);
                 goto err_reg;
         }
 
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 38319a69bd0a..d6d58684712b 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -232,9 +232,17 @@ static int i2c_inb(struct i2c_adapter *i2c_adap)
  * Sanity check for the adapter hardware - check the reaction of
  * the bus lines only if it seems to be idle.
  */
-static int test_bus(struct i2c_algo_bit_data *adap, char *name)
+static int test_bus(struct i2c_adapter *i2c_adap)
 {
-        int scl, sda;
+        struct i2c_algo_bit_data *adap = i2c_adap->algo_data;
+        const char *name = i2c_adap->name;
+        int scl, sda, ret;
+
+        if (adap->pre_xfer) {
+                ret = adap->pre_xfer(i2c_adap);
+                if (ret < 0)
+                        return -ENODEV;
+        }
 
         if (adap->getscl == NULL)
                 pr_info("%s: Testing SDA only, SCL is not readable\n", name);
@@ -297,11 +305,19 @@ static int test_bus(struct i2c_algo_bit_data *adap, char *name)
                        "while pulling SCL high!\n", name);
                 goto bailout;
         }
+
+        if (adap->post_xfer)
+                adap->post_xfer(i2c_adap);
+
         pr_info("%s: Test OK\n", name);
         return 0;
 bailout:
         sdahi(adap);
         sclhi(adap);
+
+        if (adap->post_xfer)
+                adap->post_xfer(i2c_adap);
+
         return -ENODEV;
 }
 
@@ -607,7 +623,7 @@ static int __i2c_bit_add_bus(struct i2c_adapter *adap,
         int ret;
 
         if (bit_test) {
-                ret = test_bus(bit_adap, adap->name);
+                ret = test_bus(adap);
                 if (ret < 0)
                         return -ENODEV;
         }
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 72c0415f6f94..455e909bc768 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -134,10 +134,15 @@
                                  SMBHSTSTS_BUS_ERR | SMBHSTSTS_DEV_ERR | \
                                  SMBHSTSTS_INTR)
 
+/* Older devices have their ID defined in <linux/pci_ids.h> */
+#define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS   0x1c22
+#define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS      0x1d22
 /* Patsburg also has three 'Integrated Device Function' SMBus controllers */
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF0 0x1d70
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF1 0x1d71
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF2 0x1d72
+#define PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS      0x2330
+#define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
 
 struct i801_priv {
         struct i2c_adapter adapter;
diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
index 0eb1515541e7..2dbba163b102 100644
--- a/drivers/i2c/busses/i2c-parport.c
+++ b/drivers/i2c/busses/i2c-parport.c
@@ -1,7 +1,7 @@
 /* ------------------------------------------------------------------------ *
  * i2c-parport.c I2C bus over parallel port                                 *
  * ------------------------------------------------------------------------ *
-   Copyright (C) 2003-2010 Jean Delvare <khali@linux-fr.org>
+   Copyright (C) 2003-2011 Jean Delvare <khali@linux-fr.org>
    
    Based on older i2c-philips-par.c driver
    Copyright (C) 1995-2000 Simon G. Vogl
@@ -33,6 +33,8 @@
 #include <linux/i2c-algo-bit.h>
 #include <linux/i2c-smbus.h>
 #include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
 #include "i2c-parport.h"
 
 /* ----- Device list ------------------------------------------------------ */
@@ -43,10 +45,11 @@ struct i2c_par {
         struct i2c_algo_bit_data algo_data;
         struct i2c_smbus_alert_setup alert_data;
         struct i2c_client *ara;
-        struct i2c_par *next;
+        struct list_head node;
 };
 
-static struct i2c_par *adapter_list;
+static LIST_HEAD(adapter_list);
+static DEFINE_MUTEX(adapter_list_lock);
 
 /* ----- Low-level parallel port access ----------------------------------- */
 
@@ -228,8 +231,9 @@ static void i2c_parport_attach (struct parport *port)
         }
 
         /* Add the new adapter to the list */
-        adapter->next = adapter_list;
-        adapter_list = adapter;
+        mutex_lock(&adapter_list_lock);
+        list_add_tail(&adapter->node, &adapter_list);
+        mutex_unlock(&adapter_list_lock);
         return;
 
 ERROR1:
@@ -241,11 +245,11 @@ ERROR0:
 
 static void i2c_parport_detach (struct parport *port)
 {
-        struct i2c_par *adapter, *prev;
+        struct i2c_par *adapter, *_n;
 
         /* Walk the list */
-        for (prev = NULL, adapter = adapter_list; adapter;
-             prev = adapter, adapter = adapter->next) {
+        mutex_lock(&adapter_list_lock);
+        list_for_each_entry_safe(adapter, _n, &adapter_list, node) {
                 if (adapter->pdev->port == port) {
                         if (adapter->ara) {
                                 parport_disable_irq(port);
@@ -259,14 +263,11 @@ static void i2c_parport_detach (struct parport *port)
                                 
                         parport_release(adapter->pdev);
                         parport_unregister_device(adapter->pdev);
-                        if (prev)
-                                prev->next = adapter->next;
-                        else
-                                adapter_list = adapter->next;
+                        list_del(&adapter->node);
                         kfree(adapter);
-                        return;
                 }
         }
+        mutex_unlock(&adapter_list_lock);
 }
 
 static struct parport_driver i2c_parport_driver = {
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 70c30e6bce0b..9a58994ff7ea 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -797,7 +797,8 @@ static int i2c_do_add_adapter(struct i2c_driver *driver,
 
         /* Let legacy drivers scan this bus for matching devices */
         if (driver->attach_adapter) {
-                dev_warn(&adap->dev, "attach_adapter method is deprecated\n");
+                dev_warn(&adap->dev, "%s: attach_adapter method is deprecated\n",
+                         driver->driver.name);
                 dev_warn(&adap->dev, "Please use another way to instantiate "
                          "your i2c_client\n");
                 /* We ignore the return code; if it fails, too bad */
@@ -984,7 +985,8 @@ static int i2c_do_del_adapter(struct i2c_driver *driver,
 
         if (!driver->detach_adapter)
                 return 0;
-        dev_warn(&adapter->dev, "detach_adapter method is deprecated\n");
+        dev_warn(&adapter->dev, "%s: detach_adapter method is deprecated\n",
+                 driver->driver.name);
         res = driver->detach_adapter(adapter);
         if (res)
                 dev_err(&adapter->dev, "detach_adapter failed (%d) "
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index fd1e11799137..a5ec5a7cb381 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -1782,7 +1782,6 @@ static int ide_cd_probe(ide_drive_t *drive)
         ide_cd_read_toc(drive, &sense);
         g->fops = &idecd_ops;
         g->flags |= GENHD_FL_REMOVABLE;
-        g->events = DISK_EVENT_MEDIA_CHANGE;
         add_disk(g);
         return 0;
 
diff --git a/drivers/ide/ide-cd_ioctl.c b/drivers/ide/ide-cd_ioctl.c
index 2a6bc50e8a41..02caa7dd51c8 100644
--- a/drivers/ide/ide-cd_ioctl.c
+++ b/drivers/ide/ide-cd_ioctl.c
@@ -79,6 +79,12 @@ int ide_cdrom_drive_status(struct cdrom_device_info *cdi, int slot_nr)
         return CDS_DRIVE_NOT_READY;
 }
 
+/*
+ * ide-cd always generates media changed event if media is missing, which
+ * makes it impossible to use for proper event reporting, so disk->events
+ * is cleared to 0 and the following function is used only to trigger
+ * revalidation and never propagated to userland.
+ */
 unsigned int ide_cdrom_check_events_real(struct cdrom_device_info *cdi,
                                          unsigned int clearing, int slot_nr)
 {
diff --git a/drivers/ide/ide-gd.c b/drivers/ide/ide-gd.c
index c4ffd4888939..70ea8763567d 100644
--- a/drivers/ide/ide-gd.c
+++ b/drivers/ide/ide-gd.c
@@ -298,6 +298,12 @@ static unsigned int ide_gd_check_events(struct gendisk *disk,
                 return 0;
         }
 
+        /*
+         * The following is used to force revalidation on the first open on
+         * removeable devices, and never gets reported to userland as
+         * genhd->events is 0.  This is intended as removeable ide disk
+         * can't really detect MEDIA_CHANGE events.
+         */
         ret = drive->dev_flags & IDE_DFLAG_MEDIA_CHANGED;
         drive->dev_flags &= ~IDE_DFLAG_MEDIA_CHANGED;
 
@@ -413,7 +419,6 @@ static int ide_gd_probe(ide_drive_t *drive)
         if (drive->dev_flags & IDE_DFLAG_REMOVABLE)
                 g->flags = GENHD_FL_REMOVABLE;
         g->fops = &ide_gd_ops;
-        g->events = DISK_EVENT_MEDIA_CHANGE;
         add_disk(g);
         return 0;
 
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index 7de4b7ebffc5..d8ca0a0b970d 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -1799,7 +1799,7 @@ static int qib_6120_setup_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
index 74fe0360bec7..c765a2eb04cf 100644
--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
@@ -2111,7 +2111,7 @@ static int qib_setup_7220_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 55de3cf3441c..6bab3eaea70f 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -3299,7 +3299,7 @@ static int qib_do_7322_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT | QIB_BADINTR);
         dd->flags |= QIB_DOING_RESET;
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 7f42d3a454d2..88d8e4cb419a 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -39,13 +39,13 @@ struct evdev {
 };
 
 struct evdev_client {
-        int head;
-        int tail;
+        unsigned int head;
+        unsigned int tail;
         spinlock_t buffer_lock; /* protects access to buffer, head and tail */
         struct fasync_struct *fasync;
         struct evdev *evdev;
         struct list_head node;
-        int bufsize;
+        unsigned int bufsize;
         struct input_event buffer[];
 };
 
@@ -55,16 +55,25 @@ static DEFINE_MUTEX(evdev_table_mutex);
 static void evdev_pass_event(struct evdev_client *client,
                              struct input_event *event)
 {
-        /*
-         * Interrupts are disabled, just acquire the lock.
-         * Make sure we don't leave with the client buffer
-         * "empty" by having client->head == client->tail.
-         */
+        /* Interrupts are disabled, just acquire the lock. */
         spin_lock(&client->buffer_lock);
-        do {
-                client->buffer[client->head++] = *event;
-                client->head &= client->bufsize - 1;
-        } while (client->head == client->tail);
+
+        client->buffer[client->head++] = *event;
+        client->head &= client->bufsize - 1;
+
+        if (unlikely(client->head == client->tail)) {
+                /*
+                 * This effectively "drops" all unconsumed events, leaving
+                 * EV_SYN/SYN_DROPPED plus the newest event in the queue.
+                 */
+                client->tail = (client->head - 2) & (client->bufsize - 1);
+
+                client->buffer[client->tail].time = event->time;
+                client->buffer[client->tail].type = EV_SYN;
+                client->buffer[client->tail].code = SYN_DROPPED;
+                client->buffer[client->tail].value = 0;
+        }
+
         spin_unlock(&client->buffer_lock);
 
         if (event->type == EV_SYN)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index d6e8bd8a851c..ebbceedc92f4 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1746,6 +1746,42 @@ void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int
 }
 EXPORT_SYMBOL(input_set_capability);
 
+static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
+{
+        int mt_slots;
+        int i;
+        unsigned int events;
+
+        if (dev->mtsize) {
+                mt_slots = dev->mtsize;
+        } else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
+                mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
+                           dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
+                clamp(mt_slots, 2, 32);
+        } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+                mt_slots = 2;
+        } else {
+                mt_slots = 0;
+        }
+
+        events = mt_slots + 1; /* count SYN_MT_REPORT and SYN_REPORT */
+
+        for (i = 0; i < ABS_CNT; i++) {
+                if (test_bit(i, dev->absbit)) {
+                        if (input_is_mt_axis(i))
+                                events += mt_slots;
+                        else
+                                events++;
+                }
+        }
+
+        for (i = 0; i < REL_CNT; i++)
+                if (test_bit(i, dev->relbit))
+                        events++;
+
+        return events;
+}
+
 #define INPUT_CLEANSE_BITMASK(dev, type, bits)                          \
         do {                                                            \
                 if (!test_bit(EV_##type, dev->evbit))                   \
@@ -1793,6 +1829,10 @@ int input_register_device(struct input_dev *dev)
         /* Make sure that bitmasks not mentioned in dev->evbit are clean. */
         input_cleanse_bitmasks(dev);
 
+        if (!dev->hint_events_per_packet)
+                dev->hint_events_per_packet =
+                                input_estimate_events_per_packet(dev);
+
         /*
          * If delay and period are pre-set by the driver, then autorepeating
          * is handled by the driver itself and we don't do it in input.c.
diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
index 09bef79d9da1..a26922cf0e84 100644
--- a/drivers/input/keyboard/twl4030_keypad.c
+++ b/drivers/input/keyboard/twl4030_keypad.c
@@ -332,18 +332,20 @@ static int __devinit twl4030_kp_program(struct twl4030_keypad *kp)
 static int __devinit twl4030_kp_probe(struct platform_device *pdev)
 {
         struct twl4030_keypad_data *pdata = pdev->dev.platform_data;
-        const struct matrix_keymap_data *keymap_data = pdata->keymap_data;
+        const struct matrix_keymap_data *keymap_data;
         struct twl4030_keypad *kp;
         struct input_dev *input;
         u8 reg;
         int error;
 
-        if (!pdata || !pdata->rows || !pdata->cols ||
+        if (!pdata || !pdata->rows || !pdata->cols || !pdata->keymap_data ||
             pdata->rows > TWL4030_MAX_ROWS || pdata->cols > TWL4030_MAX_COLS) {
                 dev_err(&pdev->dev, "Invalid platform_data\n");
                 return -EINVAL;
         }
 
+        keymap_data = pdata->keymap_data;
+
         kp = kzalloc(sizeof(*kp), GFP_KERNEL);
         input = input_allocate_device();
         if (!kp || !input) {
diff --git a/drivers/input/misc/xen-kbdfront.c b/drivers/input/misc/xen-kbdfront.c
index 7077f9bf5ead..62bae99424e6 100644
--- a/drivers/input/misc/xen-kbdfront.c
+++ b/drivers/input/misc/xen-kbdfront.c
@@ -303,7 +303,7 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
                                    enum xenbus_state backend_state)
 {
         struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
-        int val;
+        int ret, val;
 
         switch (backend_state) {
         case XenbusStateInitialising:
@@ -316,6 +316,17 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
 
         case XenbusStateInitWait:
 InitWait:
+                ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+                                   "feature-abs-pointer", "%d", &val);
+                if (ret < 0)
+                        val = 0;
+                if (val) {
+                        ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
+                                            "request-abs-pointer", "1");
+                        if (ret)
+                                pr_warning("xenkbd: can't request abs-pointer");
+                }
+
                 xenbus_switch_state(dev, XenbusStateConnected);
                 break;
 
diff --git a/drivers/input/touchscreen/h3600_ts_input.c b/drivers/input/touchscreen/h3600_ts_input.c
index efa06882de00..45f93d0f5592 100644
--- a/drivers/input/touchscreen/h3600_ts_input.c
+++ b/drivers/input/touchscreen/h3600_ts_input.c
@@ -399,31 +399,34 @@ static int h3600ts_connect(struct serio *serio, struct serio_driver *drv)
                         IRQF_SHARED | IRQF_DISABLED, "h3600_action", &ts->dev)) {
                 printk(KERN_ERR "h3600ts.c: Could not allocate Action Button IRQ!\n");
                 err = -EBUSY;
-                goto fail2;
+                goto fail1;
         }
 
         if (request_irq(IRQ_GPIO_BITSY_NPOWER_BUTTON, npower_button_handler,
                         IRQF_SHARED | IRQF_DISABLED, "h3600_suspend", &ts->dev)) {
                 printk(KERN_ERR "h3600ts.c: Could not allocate Power Button IRQ!\n");
                 err = -EBUSY;
-                goto fail3;
+                goto fail2;
         }
 
         serio_set_drvdata(serio, ts);
 
         err = serio_open(serio, drv);
         if (err)
-                return err;
+                goto fail3;
 
         //h3600_flite_control(1, 25);     /* default brightness */
-        input_register_device(ts->dev);
+        err = input_register_device(ts->dev);
+        if (err)
+                goto fail4;
 
         return 0;
 
-fail3:  free_irq(IRQ_GPIO_BITSY_NPOWER_BUTTON, ts->dev);
+fail4:  serio_close(serio);
+fail3:  serio_set_drvdata(serio, NULL);
+        free_irq(IRQ_GPIO_BITSY_NPOWER_BUTTON, ts->dev);
 fail2:  free_irq(IRQ_GPIO_BITSY_ACTION_BUTTON, ts->dev);
-fail1:  serio_set_drvdata(serio, NULL);
-        input_free_device(input_dev);
+fail1:  input_free_device(input_dev);
         kfree(ts);
         return err;
 }
diff --git a/drivers/leds/leds-regulator.c b/drivers/leds/leds-regulator.c
index 3790816643be..8497f56f8e46 100644
--- a/drivers/leds/leds-regulator.c
+++ b/drivers/leds/leds-regulator.c
@@ -178,6 +178,10 @@ static int __devinit regulator_led_probe(struct platform_device *pdev)
         led->cdev.flags |= LED_CORE_SUSPENDRESUME;
         led->vcc = vcc;
 
+        /* to handle correctly an already enabled regulator */
+        if (regulator_is_enabled(led->vcc))
+                led->enabled = 1;
+
         mutex_init(&led->mutex);
         INIT_WORK(&led->work, led_work);
 
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 5ef136cdba91..e5d8904fc8f6 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -390,13 +390,6 @@ static int raid_is_congested(struct dm_target_callbacks *cb, int bits)
         return md_raid5_congested(&rs->md, bits);
 }
 
-static void raid_unplug(struct dm_target_callbacks *cb)
-{
-        struct raid_set *rs = container_of(cb, struct raid_set, callbacks);
-
-        md_raid5_kick_device(rs->md.private);
-}
-
 /*
  * Construct a RAID4/5/6 mapping:
  * Args:
@@ -487,7 +480,6 @@ static int raid_ctr(struct dm_target *ti, unsigned argc, char **argv)
         }
 
         rs->callbacks.congested_fn = raid_is_congested;
-        rs->callbacks.unplug_fn = raid_unplug;
         dm_table_add_target_callbacks(ti->table, &rs->callbacks);
 
         return 0;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index b12b3776c0c0..7d6f7f18a920 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -447,48 +447,59 @@ EXPORT_SYMBOL(md_flush_request);
 
 /* Support for plugging.
  * This mirrors the plugging support in request_queue, but does not
- * require having a whole queue
+ * require having a whole queue or request structures.
+ * We allocate an md_plug_cb for each md device and each thread it gets
+ * plugged on.  This links tot the private plug_handle structure in the
+ * personality data where we keep a count of the number of outstanding
+ * plugs so other code can see if a plug is active.
  */
-static void plugger_work(struct work_struct *work)
-{
-        struct plug_handle *plug =
-                container_of(work, struct plug_handle, unplug_work);
-        plug->unplug_fn(plug);
-}
-static void plugger_timeout(unsigned long data)
-{
-        struct plug_handle *plug = (void *)data;
-        kblockd_schedule_work(NULL, &plug->unplug_work);
-}
-void plugger_init(struct plug_handle *plug,
-                  void (*unplug_fn)(struct plug_handle *))
-{
-        plug->unplug_flag = 0;
-        plug->unplug_fn = unplug_fn;
-        init_timer(&plug->unplug_timer);
-        plug->unplug_timer.function = plugger_timeout;
-        plug->unplug_timer.data = (unsigned long)plug;
-        INIT_WORK(&plug->unplug_work, plugger_work);
-}
-EXPORT_SYMBOL_GPL(plugger_init);
+struct md_plug_cb {
+        struct blk_plug_cb cb;
+        mddev_t *mddev;
+};
 
-void plugger_set_plug(struct plug_handle *plug)
+static void plugger_unplug(struct blk_plug_cb *cb)
 {
-        if (!test_and_set_bit(PLUGGED_FLAG, &plug->unplug_flag))
-                mod_timer(&plug->unplug_timer, jiffies + msecs_to_jiffies(3)+1);
+        struct md_plug_cb *mdcb = container_of(cb, struct md_plug_cb, cb);
+        if (atomic_dec_and_test(&mdcb->mddev->plug_cnt))
+                md_wakeup_thread(mdcb->mddev->thread);
+        kfree(mdcb);
 }
-EXPORT_SYMBOL_GPL(plugger_set_plug);
 
-int plugger_remove_plug(struct plug_handle *plug)
+/* Check that an unplug wakeup will come shortly.
+ * If not, wakeup the md thread immediately
+ */
+int mddev_check_plugged(mddev_t *mddev)
 {
-        if (test_and_clear_bit(PLUGGED_FLAG, &plug->unplug_flag)) {
-                del_timer(&plug->unplug_timer);
-                return 1;
-        } else
+        struct blk_plug *plug = current->plug;
+        struct md_plug_cb *mdcb;
+
+        if (!plug)
                 return 0;
-}
-EXPORT_SYMBOL_GPL(plugger_remove_plug);
 
+        list_for_each_entry(mdcb, &plug->cb_list, cb.list) {
+                if (mdcb->cb.callback == plugger_unplug &&
+                    mdcb->mddev == mddev) {
+                        /* Already on the list, move to top */
+                        if (mdcb != list_first_entry(&plug->cb_list,
+                                                    struct md_plug_cb,
+                                                    cb.list))
+                                list_move(&mdcb->cb.list, &plug->cb_list);
+                        return 1;
+                }
+        }
+        /* Not currently on the callback list */
+        mdcb = kmalloc(sizeof(*mdcb), GFP_ATOMIC);
+        if (!mdcb)
+                return 0;
+
+        mdcb->mddev = mddev;
+        mdcb->cb.callback = plugger_unplug;
+        atomic_inc(&mddev->plug_cnt);
+        list_add(&mdcb->cb.list, &plug->cb_list);
+        return 1;
+}
+EXPORT_SYMBOL_GPL(mddev_check_plugged);
 
 static inline mddev_t *mddev_get(mddev_t *mddev)
 {
@@ -538,6 +549,7 @@ void mddev_init(mddev_t *mddev)
         atomic_set(&mddev->active, 1);
         atomic_set(&mddev->openers, 0);
         atomic_set(&mddev->active_io, 0);
+        atomic_set(&mddev->plug_cnt, 0);
         spin_lock_init(&mddev->write_lock);
         atomic_set(&mddev->flush_pending, 0);
         init_waitqueue_head(&mddev->sb_wait);
@@ -3158,6 +3170,7 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
         mddev->layout = mddev->new_layout;
         mddev->chunk_sectors = mddev->new_chunk_sectors;
         mddev->delta_disks = 0;
+        mddev->degraded = 0;
         if (mddev->pers->sync_request == NULL) {
                 /* this is now an array without redundancy, so
                  * it must always be in_sync
@@ -4723,7 +4736,6 @@ static void md_clean(mddev_t *mddev)
         mddev->bitmap_info.chunksize = 0;
         mddev->bitmap_info.daemon_sleep = 0;
         mddev->bitmap_info.max_write_behind = 0;
-        mddev->plug = NULL;
 }
 
 static void __md_stop_writes(mddev_t *mddev)
@@ -6688,12 +6700,6 @@ int md_allow_write(mddev_t *mddev)
 }
 EXPORT_SYMBOL_GPL(md_allow_write);
 
-void md_unplug(mddev_t *mddev)
-{
-        if (mddev->plug)
-                mddev->plug->unplug_fn(mddev->plug);
-}
-
 #define SYNC_MARKS      10
 #define SYNC_MARK_STEP  (3*HZ)
 void md_do_sync(mddev_t *mddev)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 52b407369e13..0b1fd3f1d85b 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -29,26 +29,6 @@
 typedef struct mddev_s mddev_t;
 typedef struct mdk_rdev_s mdk_rdev_t;
 
-/* generic plugging support - like that provided with request_queue,
- * but does not require a request_queue
- */
-struct plug_handle {
-        void                    (*unplug_fn)(struct plug_handle *);
-        struct timer_list       unplug_timer;
-        struct work_struct      unplug_work;
-        unsigned long           unplug_flag;
-};
-#define PLUGGED_FLAG 1
-void plugger_init(struct plug_handle *plug,
-                  void (*unplug_fn)(struct plug_handle *));
-void plugger_set_plug(struct plug_handle *plug);
-int plugger_remove_plug(struct plug_handle *plug);
-static inline void plugger_flush(struct plug_handle *plug)
-{
-        del_timer_sync(&plug->unplug_timer);
-        cancel_work_sync(&plug->unplug_work);
-}
-
 /*
  * MD's 'extended' device
  */
@@ -199,6 +179,9 @@ struct mddev_s
         int                             delta_disks, new_level, new_layout;
         int                             new_chunk_sectors;
 
+        atomic_t                        plug_cnt;       /* If device is expecting
+                                                         * more bios soon.
+                                                         */
         struct mdk_thread_s             *thread;        /* management thread */
         struct mdk_thread_s             *sync_thread;   /* doing resync or reconstruct */
         sector_t                        curr_resync;    /* last block scheduled */
@@ -336,7 +319,6 @@ struct mddev_s
         struct list_head                all_mddevs;
 
         struct attribute_group          *to_remove;
-        struct plug_handle              *plug; /* if used by personality */
 
         struct bio_set                  *bio_set;
 
@@ -516,7 +498,6 @@ extern int md_integrity_register(mddev_t *mddev);
 extern void md_integrity_add_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
 extern int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale);
 extern void restore_bitmap_write_access(struct file *file);
-extern void md_unplug(mddev_t *mddev);
 
 extern void mddev_init(mddev_t *mddev);
 extern int md_run(mddev_t *mddev);
@@ -530,4 +511,5 @@ extern struct bio *bio_clone_mddev(struct bio *bio, gfp_t gfp_mask,
                                    mddev_t *mddev);
 extern struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
                                    mddev_t *mddev);
+extern int mddev_check_plugged(mddev_t *mddev);
 #endif /* _MD_MD_H */
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index c2a21ae56d97..2b7a7ff401dc 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -565,12 +565,6 @@ static void flush_pending_writes(conf_t *conf)
                 spin_unlock_irq(&conf->device_lock);
 }
 
-static void md_kick_device(mddev_t *mddev)
-{
-        blk_flush_plug(current);
-        md_wakeup_thread(mddev->thread);
-}
-
 /* Barriers....
  * Sometimes we need to suspend IO while we do something else,
  * either some resync/recovery, or reconfigure the array.
@@ -600,7 +594,7 @@ static void raise_barrier(conf_t *conf)
 
         /* Wait until no block IO is waiting */
         wait_event_lock_irq(conf->wait_barrier, !conf->nr_waiting,
-                            conf->resync_lock, md_kick_device(conf->mddev));
+                            conf->resync_lock, );
 
         /* block any new IO from starting */
         conf->barrier++;
@@ -608,7 +602,7 @@ static void raise_barrier(conf_t *conf)
         /* Now wait for all pending IO to complete */
         wait_event_lock_irq(conf->wait_barrier,
                             !conf->nr_pending && conf->barrier < RESYNC_DEPTH,
-                            conf->resync_lock, md_kick_device(conf->mddev));
+                            conf->resync_lock, );
 
         spin_unlock_irq(&conf->resync_lock);
 }
@@ -630,7 +624,7 @@ static void wait_barrier(conf_t *conf)
                 conf->nr_waiting++;
                 wait_event_lock_irq(conf->wait_barrier, !conf->barrier,
                                     conf->resync_lock,
-                                    md_kick_device(conf->mddev));
+                                    );
                 conf->nr_waiting--;
         }
         conf->nr_pending++;
@@ -666,8 +660,7 @@ static void freeze_array(conf_t *conf)
         wait_event_lock_irq(conf->wait_barrier,
                             conf->nr_pending == conf->nr_queued+1,
                             conf->resync_lock,
-                            ({ flush_pending_writes(conf);
-                               md_kick_device(conf->mddev); }));
+                            flush_pending_writes(conf));
         spin_unlock_irq(&conf->resync_lock);
 }
 static void unfreeze_array(conf_t *conf)
@@ -729,6 +722,7 @@ static int make_request(mddev_t *mddev, struct bio * bio)
         const unsigned long do_sync = (bio->bi_rw & REQ_SYNC);
         const unsigned long do_flush_fua = (bio->bi_rw & (REQ_FLUSH | REQ_FUA));
         mdk_rdev_t *blocked_rdev;
+        int plugged;
 
         /*
          * Register the new request and wait if the reconstruction
@@ -820,6 +814,8 @@ static int make_request(mddev_t *mddev, struct bio * bio)
          * inc refcount on their rdev.  Record them by setting
          * bios[x] to bio
          */
+        plugged = mddev_check_plugged(mddev);
+
         disks = conf->raid_disks;
  retry_write:
         blocked_rdev = NULL;
@@ -925,7 +921,7 @@ static int make_request(mddev_t *mddev, struct bio * bio)
         /* In case raid1d snuck in to freeze_array */
         wake_up(&conf->wait_barrier);
 
-        if (do_sync || !bitmap)
+        if (do_sync || !bitmap || !plugged)
                 md_wakeup_thread(mddev->thread);
 
         return 0;
@@ -1516,13 +1512,16 @@ static void raid1d(mddev_t *mddev)
         conf_t *conf = mddev->private;
         struct list_head *head = &conf->retry_list;
         mdk_rdev_t *rdev;
+        struct blk_plug plug;
 
         md_check_recovery(mddev);
-        
+
+        blk_start_plug(&plug);
         for (;;) {
                 char b[BDEVNAME_SIZE];
 
-                flush_pending_writes(conf);
+                if (atomic_read(&mddev->plug_cnt) == 0)
+                        flush_pending_writes(conf);
 
                 spin_lock_irqsave(&conf->device_lock, flags);
                 if (list_empty(head)) {
@@ -1593,6 +1592,7 @@ static void raid1d(mddev_t *mddev)
                 }
                 cond_resched();
         }
+        blk_finish_plug(&plug);
 }
 
 
@@ -2039,7 +2039,6 @@ static int stop(mddev_t *mddev)
 
         md_unregister_thread(mddev->thread);
         mddev->thread = NULL;
-        blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
         if (conf->r1bio_pool)
                 mempool_destroy(conf->r1bio_pool);
         kfree(conf->mirrors);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 2da83d566592..8e9462626ec5 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -634,12 +634,6 @@ static void flush_pending_writes(conf_t *conf)
                 spin_unlock_irq(&conf->device_lock);
 }
 
-static void md_kick_device(mddev_t *mddev)
-{
-        blk_flush_plug(current);
-        md_wakeup_thread(mddev->thread);
-}
-
 /* Barriers....
  * Sometimes we need to suspend IO while we do something else,
  * either some resync/recovery, or reconfigure the array.
@@ -669,15 +663,15 @@ static void raise_barrier(conf_t *conf, int force)
 
         /* Wait until no block IO is waiting (unless 'force') */
         wait_event_lock_irq(conf->wait_barrier, force || !conf->nr_waiting,
-                            conf->resync_lock, md_kick_device(conf->mddev));
+                            conf->resync_lock, );
 
         /* block any new IO from starting */
         conf->barrier++;
 
-        /* No wait for all pending IO to complete */
+        /* Now wait for all pending IO to complete */
         wait_event_lock_irq(conf->wait_barrier,
                             !conf->nr_pending && conf->barrier < RESYNC_DEPTH,
-                            conf->resync_lock, md_kick_device(conf->mddev));
+                            conf->resync_lock, );
 
         spin_unlock_irq(&conf->resync_lock);
 }
@@ -698,7 +692,7 @@ static void wait_barrier(conf_t *conf)
                 conf->nr_waiting++;
                 wait_event_lock_irq(conf->wait_barrier, !conf->barrier,
                                     conf->resync_lock,
-                                    md_kick_device(conf->mddev));
+                                    );
                 conf->nr_waiting--;
         }
         conf->nr_pending++;
@@ -734,8 +728,8 @@ static void freeze_array(conf_t *conf)
         wait_event_lock_irq(conf->wait_barrier,
                             conf->nr_pending == conf->nr_queued+1,
                             conf->resync_lock,
-                            ({ flush_pending_writes(conf);
-                               md_kick_device(conf->mddev); }));
+                            flush_pending_writes(conf));
+
         spin_unlock_irq(&conf->resync_lock);
 }
 
@@ -762,6 +756,7 @@ static int make_request(mddev_t *mddev, struct bio * bio)
         const unsigned long do_fua = (bio->bi_rw & REQ_FUA);
         unsigned long flags;
         mdk_rdev_t *blocked_rdev;
+        int plugged;
 
         if (unlikely(bio->bi_rw & REQ_FLUSH)) {
                 md_flush_request(mddev, bio);
@@ -870,6 +865,8 @@ static int make_request(mddev_t *mddev, struct bio * bio)
          * inc refcount on their rdev.  Record them by setting
          * bios[x] to bio
          */
+        plugged = mddev_check_plugged(mddev);
+
         raid10_find_phys(conf, r10_bio);
  retry_write:
         blocked_rdev = NULL;
@@ -946,9 +943,8 @@ static int make_request(mddev_t *mddev, struct bio * bio)
         /* In case raid10d snuck in to freeze_array */
         wake_up(&conf->wait_barrier);
 
-        if (do_sync || !mddev->bitmap)
+        if (do_sync || !mddev->bitmap || !plugged)
                 md_wakeup_thread(mddev->thread);
-
         return 0;
 }
 
@@ -1640,9 +1636,11 @@ static void raid10d(mddev_t *mddev)
         conf_t *conf = mddev->private;
         struct list_head *head = &conf->retry_list;
         mdk_rdev_t *rdev;
+        struct blk_plug plug;
 
         md_check_recovery(mddev);
 
+        blk_start_plug(&plug);
         for (;;) {
                 char b[BDEVNAME_SIZE];
 
@@ -1716,6 +1714,7 @@ static void raid10d(mddev_t *mddev)
                 }
                 cond_resched();
         }
+        blk_finish_plug(&plug);
 }
 
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e867ee42b152..49bf5f891435 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -27,12 +27,12 @@
  *
  * We group bitmap updates into batches.  Each batch has a number.
  * We may write out several batches at once, but that isn't very important.
- * conf->bm_write is the number of the last batch successfully written.
- * conf->bm_flush is the number of the last batch that was closed to
+ * conf->seq_write is the number of the last batch successfully written.
+ * conf->seq_flush is the number of the last batch that was closed to
  *    new additions.
  * When we discover that we will need to write to any block in a stripe
  * (in add_stripe_bio) we update the in-memory bitmap and record in sh->bm_seq
- * the number of the batch it will be in. This is bm_flush+1.
+ * the number of the batch it will be in. This is seq_flush+1.
  * When we are ready to do a write, if that batch hasn't been written yet,
  *   we plug the array and queue the stripe for later.
  * When an unplug happens, we increment bm_flush, thus closing the current
@@ -199,14 +199,12 @@ static void __release_stripe(raid5_conf_t *conf, struct stripe_head *sh)
                 BUG_ON(!list_empty(&sh->lru));
                 BUG_ON(atomic_read(&conf->active_stripes)==0);
                 if (test_bit(STRIPE_HANDLE, &sh->state)) {
-                        if (test_bit(STRIPE_DELAYED, &sh->state)) {
+                        if (test_bit(STRIPE_DELAYED, &sh->state))
                                 list_add_tail(&sh->lru, &conf->delayed_list);
-                                plugger_set_plug(&conf->plug);
-                        } else if (test_bit(STRIPE_BIT_DELAY, &sh->state) &&
-                                   sh->bm_seq - conf->seq_write > 0) {
+                        else if (test_bit(STRIPE_BIT_DELAY, &sh->state) &&
+                                   sh->bm_seq - conf->seq_write > 0)
                                 list_add_tail(&sh->lru, &conf->bitmap_list);
-                                plugger_set_plug(&conf->plug);
-                        } else {
+                        else {
                                 clear_bit(STRIPE_BIT_DELAY, &sh->state);
                                 list_add_tail(&sh->lru, &conf->handle_list);
                         }
@@ -461,7 +459,7 @@ get_active_stripe(raid5_conf_t *conf, sector_t sector,
                                                      < (conf->max_nr_stripes *3/4)
                                                      || !conf->inactive_blocked),
                                                     conf->device_lock,
-                                                    md_raid5_kick_device(conf));
+                                                    );
                                 conf->inactive_blocked = 0;
                         } else
                                 init_stripe(sh, sector, previous);
@@ -1470,7 +1468,7 @@ static int resize_stripes(raid5_conf_t *conf, int newsize)
                 wait_event_lock_irq(conf->wait_for_stripe,
                                     !list_empty(&conf->inactive_list),
                                     conf->device_lock,
-                                    blk_flush_plug(current));
+                                    );
                 osh = get_free_stripe(conf);
                 spin_unlock_irq(&conf->device_lock);
                 atomic_set(&nsh->count, 1);
@@ -3623,8 +3621,7 @@ static void raid5_activate_delayed(raid5_conf_t *conf)
                                 atomic_inc(&conf->preread_active_stripes);
                         list_add_tail(&sh->lru, &conf->hold_list);
                 }
-        } else
-                plugger_set_plug(&conf->plug);
+        }
 }
 
 static void activate_bit_delay(raid5_conf_t *conf)
@@ -3641,21 +3638,6 @@ static void activate_bit_delay(raid5_conf_t *conf)
         }
 }
 
-void md_raid5_kick_device(raid5_conf_t *conf)
-{
-        blk_flush_plug(current);
-        raid5_activate_delayed(conf);
-        md_wakeup_thread(conf->mddev->thread);
-}
-EXPORT_SYMBOL_GPL(md_raid5_kick_device);
-
-static void raid5_unplug(struct plug_handle *plug)
-{
-        raid5_conf_t *conf = container_of(plug, raid5_conf_t, plug);
-
-        md_raid5_kick_device(conf);
-}
-
 int md_raid5_congested(mddev_t *mddev, int bits)
 {
         raid5_conf_t *conf = mddev->private;
@@ -3945,6 +3927,7 @@ static int make_request(mddev_t *mddev, struct bio * bi)
         struct stripe_head *sh;
         const int rw = bio_data_dir(bi);
         int remaining;
+        int plugged;
 
         if (unlikely(bi->bi_rw & REQ_FLUSH)) {
                 md_flush_request(mddev, bi);
@@ -3963,6 +3946,7 @@ static int make_request(mddev_t *mddev, struct bio * bi)
         bi->bi_next = NULL;
         bi->bi_phys_segments = 1;       /* over-loaded to count active stripes */
 
+        plugged = mddev_check_plugged(mddev);
         for (;logical_sector < last_sector; logical_sector += STRIPE_SECTORS) {
                 DEFINE_WAIT(w);
                 int disks, data_disks;
@@ -4057,7 +4041,7 @@ static int make_request(mddev_t *mddev, struct bio * bi)
                                  * add failed due to overlap.  Flush everything
                                  * and wait a while
                                  */
-                                md_raid5_kick_device(conf);
+                                md_wakeup_thread(mddev->thread);
                                 release_stripe(sh);
                                 schedule();
                                 goto retry;
@@ -4077,6 +4061,9 @@ static int make_request(mddev_t *mddev, struct bio * bi)
                 }
                         
         }
+        if (!plugged)
+                md_wakeup_thread(mddev->thread);
+
         spin_lock_irq(&conf->device_lock);
         remaining = raid5_dec_bi_phys_segments(bi);
         spin_unlock_irq(&conf->device_lock);
@@ -4478,24 +4465,30 @@ static void raid5d(mddev_t *mddev)
         struct stripe_head *sh;
         raid5_conf_t *conf = mddev->private;
         int handled;
+        struct blk_plug plug;
 
         pr_debug("+++ raid5d active\n");
 
         md_check_recovery(mddev);
 
+        blk_start_plug(&plug);
         handled = 0;
         spin_lock_irq(&conf->device_lock);
         while (1) {
                 struct bio *bio;
 
-                if (conf->seq_flush != conf->seq_write) {
-                        int seq = conf->seq_flush;
+                if (atomic_read(&mddev->plug_cnt) == 0 &&
+                    !list_empty(&conf->bitmap_list)) {
+                        /* Now is a good time to flush some bitmap updates */
+                        conf->seq_flush++;
                         spin_unlock_irq(&conf->device_lock);
                         bitmap_unplug(mddev->bitmap);
                         spin_lock_irq(&conf->device_lock);
-                        conf->seq_write = seq;
+                        conf->seq_write = conf->seq_flush;
                         activate_bit_delay(conf);
                 }
+                if (atomic_read(&mddev->plug_cnt) == 0)
+                        raid5_activate_delayed(conf);
 
                 while ((bio = remove_bio_from_retry(conf))) {
                         int ok;
@@ -4525,6 +4518,7 @@ static void raid5d(mddev_t *mddev)
         spin_unlock_irq(&conf->device_lock);
 
         async_tx_issue_pending_all();
+        blk_finish_plug(&plug);
 
         pr_debug("--- raid5d inactive\n");
 }
@@ -5141,8 +5135,6 @@ static int run(mddev_t *mddev)
                        mdname(mddev));
         md_set_array_sectors(mddev, raid5_size(mddev, 0, 0));
 
-        plugger_init(&conf->plug, raid5_unplug);
-        mddev->plug = &conf->plug;
         if (mddev->queue) {
                 int chunk_size;
                 /* read-ahead size must cover two whole stripes, which
@@ -5159,7 +5151,6 @@ static int run(mddev_t *mddev)
 
                 mddev->queue->backing_dev_info.congested_data = mddev;
                 mddev->queue->backing_dev_info.congested_fn = raid5_congested;
-                mddev->queue->queue_lock = &conf->device_lock;
 
                 chunk_size = mddev->chunk_sectors << 9;
                 blk_queue_io_min(mddev->queue, chunk_size);
@@ -5192,7 +5183,6 @@ static int stop(mddev_t *mddev)
         mddev->thread = NULL;
         if (mddev->queue)
                 mddev->queue->backing_dev_info.congested_fn = NULL;
-        plugger_flush(&conf->plug); /* the unplug fn references 'conf'*/
         free_conf(conf);
         mddev->private = NULL;
         mddev->to_remove = &raid5_attrs_group;
@@ -5688,6 +5678,7 @@ static void raid5_quiesce(mddev_t *mddev, int state)
 static void *raid45_takeover_raid0(mddev_t *mddev, int level)
 {
         struct raid0_private_data *raid0_priv = mddev->private;
+        sector_t sectors;
 
         /* for raid0 takeover only one zone is supported */
         if (raid0_priv->nr_strip_zones > 1) {
@@ -5696,6 +5687,9 @@ static void *raid45_takeover_raid0(mddev_t *mddev, int level)
                 return ERR_PTR(-EINVAL);
         }
 
+        sectors = raid0_priv->strip_zone[0].zone_end;
+        sector_div(sectors, raid0_priv->strip_zone[0].nb_dev);
+        mddev->dev_sectors = sectors;
         mddev->new_level = level;
         mddev->new_layout = ALGORITHM_PARITY_N;
         mddev->new_chunk_sectors = mddev->chunk_sectors;
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index 8d563a4f022a..3ca77a2613ba 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -400,8 +400,6 @@ struct raid5_private_data {
                                             * Cleared when a sync completes.
                                             */
 
-        struct plug_handle      plug;
-
         /* per cpu variables */
         struct raid5_percpu {
                 struct page     *spare_page; /* Used when checking P/Q in raid6 */
diff --git a/drivers/media/common/tuners/tda18271-common.c b/drivers/media/common/tuners/tda18271-common.c
index 5466d47db899..aae40e52af5b 100644
--- a/drivers/media/common/tuners/tda18271-common.c
+++ b/drivers/media/common/tuners/tda18271-common.c
@@ -533,16 +533,7 @@ int tda18271_calc_main_pll(struct dvb_frontend *fe, u32 freq)
         if (tda_fail(ret))
                 goto fail;
 
-        regs[R_MPD]   = (0x77 & pd);
-
-        switch (priv->mode) {
-        case TDA18271_ANALOG:
-                regs[R_MPD]  &= ~0x08;
-                break;
-        case TDA18271_DIGITAL:
-                regs[R_MPD]  |=  0x08;
-                break;
-        }
+        regs[R_MPD]   = (0x7f & pd);
 
         div =  ((d * (freq / 1000)) << 7) / 125;
 
diff --git a/drivers/media/common/tuners/tda18271-fe.c b/drivers/media/common/tuners/tda18271-fe.c
index 9ad4454a148d..d884f5eee73c 100644
--- a/drivers/media/common/tuners/tda18271-fe.c
+++ b/drivers/media/common/tuners/tda18271-fe.c
@@ -579,8 +579,8 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
 #define RF3 2
         u32 rf_default[3];
         u32 rf_freq[3];
-        u8 prog_cal[3];
-        u8 prog_tab[3];
+        s32 prog_cal[3];
+        s32 prog_tab[3];
 
         i = tda18271_lookup_rf_band(fe, &freq, NULL);
 
@@ -602,32 +602,33 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
                         return bcal;
 
                 tda18271_calc_rf_cal(fe, &rf_freq[rf]);
-                prog_tab[rf] = regs[R_EB14];
+                prog_tab[rf] = (s32)regs[R_EB14];
 
                 if (1 == bcal)
-                        prog_cal[rf] = tda18271_calibrate_rf(fe, rf_freq[rf]);
+                        prog_cal[rf] =
+                                (s32)tda18271_calibrate_rf(fe, rf_freq[rf]);
                 else
                         prog_cal[rf] = prog_tab[rf];
 
                 switch (rf) {
                 case RF1:
                         map[i].rf_a1 = 0;
-                        map[i].rf_b1 = (s32)(prog_cal[RF1] - prog_tab[RF1]);
+                        map[i].rf_b1 = (prog_cal[RF1] - prog_tab[RF1]);
                         map[i].rf1   = rf_freq[RF1] / 1000;
                         break;
                 case RF2:
-                        dividend = (s32)(prog_cal[RF2] - prog_tab[RF2]) -
-                                   (s32)(prog_cal[RF1] + prog_tab[RF1]);
+                        dividend = (prog_cal[RF2] - prog_tab[RF2] -
+                                    prog_cal[RF1] + prog_tab[RF1]);
                         divisor = (s32)(rf_freq[RF2] - rf_freq[RF1]) / 1000;
                         map[i].rf_a1 = (dividend / divisor);
                         map[i].rf2   = rf_freq[RF2] / 1000;
                         break;
                 case RF3:
-                        dividend = (s32)(prog_cal[RF3] - prog_tab[RF3]) -
-                                   (s32)(prog_cal[RF2] + prog_tab[RF2]);
+                        dividend = (prog_cal[RF3] - prog_tab[RF3] -
+                                    prog_cal[RF2] + prog_tab[RF2]);
                         divisor = (s32)(rf_freq[RF3] - rf_freq[RF2]) / 1000;
                         map[i].rf_a2 = (dividend / divisor);
-                        map[i].rf_b2 = (s32)(prog_cal[RF2] - prog_tab[RF2]);
+                        map[i].rf_b2 = (prog_cal[RF2] - prog_tab[RF2]);
                         map[i].rf3   = rf_freq[RF3] / 1000;
                         break;
                 default:
diff --git a/drivers/media/common/tuners/tda18271-maps.c b/drivers/media/common/tuners/tda18271-maps.c
index e7f84c705da8..3d5b6ab7e332 100644
--- a/drivers/media/common/tuners/tda18271-maps.c
+++ b/drivers/media/common/tuners/tda18271-maps.c
@@ -229,8 +229,7 @@ static struct tda18271_map tda18271c2_km[] = {
 static struct tda18271_map tda18271_rf_band[] = {
         { .rfmax =  47900, .val = 0x00 },
         { .rfmax =  61100, .val = 0x01 },
-/*      { .rfmax = 152600, .val = 0x02 }, */
-        { .rfmax = 121200, .val = 0x02 },
+        { .rfmax = 152600, .val = 0x02 },
         { .rfmax = 164700, .val = 0x03 },
         { .rfmax = 203500, .val = 0x04 },
         { .rfmax = 457800, .val = 0x05 },
@@ -448,7 +447,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 150000, .val = 0xb0 },
         { .rfmax = 151000, .val = 0xb1 },
         { .rfmax = 152000, .val = 0xb7 },
-        { .rfmax = 153000, .val = 0xbd },
+        { .rfmax = 152600, .val = 0xbd },
         { .rfmax = 154000, .val = 0x20 },
         { .rfmax = 155000, .val = 0x22 },
         { .rfmax = 156000, .val = 0x24 },
@@ -459,7 +458,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 161000, .val = 0x2d },
         { .rfmax = 163000, .val = 0x2e },
         { .rfmax = 164000, .val = 0x2f },
-        { .rfmax = 165000, .val = 0x30 },
+        { .rfmax = 164700, .val = 0x30 },
         { .rfmax = 166000, .val = 0x11 },
         { .rfmax = 167000, .val = 0x12 },
         { .rfmax = 168000, .val = 0x13 },
@@ -510,7 +509,8 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 236000, .val = 0x1b },
         { .rfmax = 237000, .val = 0x1c },
         { .rfmax = 240000, .val = 0x1d },
-        { .rfmax = 242000, .val = 0x1f },
+        { .rfmax = 242000, .val = 0x1e },
+        { .rfmax = 244000, .val = 0x1f },
         { .rfmax = 247000, .val = 0x20 },
         { .rfmax = 249000, .val = 0x21 },
         { .rfmax = 252000, .val = 0x22 },
@@ -624,7 +624,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 453000, .val = 0x93 },
         { .rfmax = 454000, .val = 0x94 },
         { .rfmax = 456000, .val = 0x96 },
-        { .rfmax = 457000, .val = 0x98 },
+        { .rfmax = 457800, .val = 0x98 },
         { .rfmax = 461000, .val = 0x11 },
         { .rfmax = 468000, .val = 0x12 },
         { .rfmax = 472000, .val = 0x13 },
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
index 955254090a0e..03f96d6ca894 100644
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
         DEBSTATUS);
 
 #define DRIVER_VERSION "0.1"
-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
+#define DRIVER_NAME "flexcop-pci"
 #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
 
 struct flexcop_pci {
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index fe4f894183ff..ccbd39a38c46 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -362,7 +362,7 @@ config DVB_USB_LME2510
 config DVB_USB_TECHNISAT_USB2
         tristate "Technisat DVB-S/S2 USB2.0 support"
         depends on DVB_USB
-        select DVB_STB0899 if !DVB_FE_CUSTOMISE
-        select DVB_STB6100 if !DVB_FE_CUSTOMISE
+        select DVB_STV090x if !DVB_FE_CUSTOMISE
+        select DVB_STV6110x if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the Technisat USB2 DVB-S/S2 device
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 97af266d7f1d..65214af5cd74 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -2162,7 +2162,7 @@ struct dibx000_agc_config dib7090_agc_config[2] = {
                 .agc1_pt3       = 98,
                 .agc1_slope1    = 0,
                 .agc1_slope2    = 167,
-                .agc1_pt1       = 98,
+                .agc2_pt1       = 98,
                 .agc2_pt2       = 255,
                 .agc2_slope1    = 104,
                 .agc2_slope2    = 0,
@@ -2440,11 +2440,11 @@ static int tfe7090pvr_frontend0_attach(struct dvb_usb_adapter *adap)
         dib0700_set_i2c_speed(adap->dev, 340);
         adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x90, &tfe7090pvr_dib7000p_config[0]);
 
-        dib7090_slave_reset(adap->fe);
-
         if (adap->fe == NULL)
                 return -ENODEV;
 
+        dib7090_slave_reset(adap->fe);
+
         return 0;
 }
 
diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c
index 23640ed44d85..056138f63c7d 100644
--- a/drivers/media/media-entity.c
+++ b/drivers/media/media-entity.c
@@ -378,7 +378,6 @@ EXPORT_SYMBOL_GPL(media_entity_create_link);
 
 static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
 {
-        const u32 mask = MEDIA_LNK_FL_ENABLED;
         int ret;
 
         /* Notify both entities. */
@@ -395,7 +394,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
                 return ret;
         }
 
-        link->flags = (link->flags & ~mask) | (flags & mask);
+        link->flags = flags;
         link->reverse->flags = link->flags;
 
         return 0;
@@ -417,6 +416,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
  */
 int __media_entity_setup_link(struct media_link *link, u32 flags)
 {
+        const u32 mask = MEDIA_LNK_FL_ENABLED;
         struct media_device *mdev;
         struct media_entity *source, *sink;
         int ret = -EBUSY;
@@ -424,6 +424,10 @@ int __media_entity_setup_link(struct media_link *link, u32 flags)
         if (link == NULL)
                 return -EINVAL;
 
+        /* The non-modifiable link flags must not be modified. */
+        if ((link->flags & ~mask) != (flags & ~mask))
+                return -EINVAL;
+
         if (link->flags & MEDIA_LNK_FL_IMMUTABLE)
                 return link->flags == flags ? 0 : -EINVAL;
 
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index dc3f04c52d5e..87bad7678d92 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -170,7 +170,7 @@ static int fmr2_setfreq(struct fmr2 *dev)
         return 0;
 }
 
-/* !!! not tested, in my card this does't work !!! */
+/* !!! not tested, in my card this doesn't work !!! */
 static int fmr2_setvolume(struct fmr2 *dev)
 {
         int vol[16] = { 0x021, 0x084, 0x090, 0x104,
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 4498b944dec8..00f51dd121f3 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -875,7 +875,7 @@ config MX3_VIDEO
 config VIDEO_MX3
         tristate "i.MX3x Camera Sensor Interface driver"
         depends on VIDEO_DEV && MX3_IPU && SOC_CAMERA
-        select VIDEOBUF_DMA_CONTIG
+        select VIDEOBUF2_DMA_CONTIG
         select MX3_VIDEO
         ---help---
           This is a v4l2 driver for the i.MX3x Camera Sensor Interface
diff --git a/drivers/media/video/cx18/cx18-streams.c b/drivers/media/video/cx18/cx18-streams.c
index c6e2ca3b1149..6fbc356113c1 100644
--- a/drivers/media/video/cx18/cx18-streams.c
+++ b/drivers/media/video/cx18/cx18-streams.c
@@ -350,9 +350,17 @@ void cx18_streams_cleanup(struct cx18 *cx, int unregister)
 
                 /* No struct video_device, but can have buffers allocated */
                 if (type == CX18_ENC_STREAM_TYPE_IDX) {
+                        /* If the module params didn't inhibit IDX ... */
                         if (cx->stream_buffers[type] != 0) {
                                 cx->stream_buffers[type] = 0;
-                                cx18_stream_free(&cx->streams[type]);
+                                /*
+                                 * Before calling cx18_stream_free(),
+                                 * check if the IDX stream was actually set up.
+                                 * Needed, since the cx18_probe() error path
+                                 * exits through here as well as normal clean up
+                                 */
+                                if (cx->streams[type].buffers != 0)
+                                        cx18_stream_free(&cx->streams[type]);
                         }
                         continue;
                 }
diff --git a/drivers/media/video/cx23885/Kconfig b/drivers/media/video/cx23885/Kconfig
index 3b6e7f28568e..caab1bfb79e2 100644
--- a/drivers/media/video/cx23885/Kconfig
+++ b/drivers/media/video/cx23885/Kconfig
@@ -22,6 +22,7 @@ config VIDEO_CX23885
         select DVB_CX24116 if !DVB_FE_CUSTOMISE
         select DVB_STV0900 if !DVB_FE_CUSTOMISE
         select DVB_DS3000 if !DVB_FE_CUSTOMISE
+        select DVB_STV0367 if !DVB_FE_CUSTOMISE
         select MEDIA_TUNER_MT2131 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_TDA8290 if !MEDIA_TUNER_CUSTOMISE
diff --git a/drivers/media/video/imx074.c b/drivers/media/video/imx074.c
index 1a1169115716..0382ea752e6f 100644
--- a/drivers/media/video/imx074.c
+++ b/drivers/media/video/imx074.c
@@ -298,7 +298,7 @@ static unsigned long imx074_query_bus_param(struct soc_camera_device *icd)
 static int imx074_set_bus_param(struct soc_camera_device *icd,
                                  unsigned long flags)
 {
-        return -1;
+        return -EINVAL;
 }
 
 static struct soc_camera_ops imx074_ops = {
diff --git a/drivers/media/video/omap3isp/isp.c b/drivers/media/video/omap3isp/isp.c
index 503bd7922bd6..472a69359e60 100644
--- a/drivers/media/video/omap3isp/isp.c
+++ b/drivers/media/video/omap3isp/isp.c
@@ -215,20 +215,21 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
         }
 
         switch (xclksel) {
-        case 0:
+        case ISP_XCLK_A:
                 isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                 ISPTCTRL_CTRL_DIVA_MASK,
                                 divisor << ISPTCTRL_CTRL_DIVA_SHIFT);
                 dev_dbg(isp->dev, "isp_set_xclk(): cam_xclka set to %d Hz\n",
                         currentxclk);
                 break;
-        case 1:
+        case ISP_XCLK_B:
                 isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                 ISPTCTRL_CTRL_DIVB_MASK,
                                 divisor << ISPTCTRL_CTRL_DIVB_SHIFT);
                 dev_dbg(isp->dev, "isp_set_xclk(): cam_xclkb set to %d Hz\n",
                         currentxclk);
                 break;
+        case ISP_XCLK_NONE:
         default:
                 omap3isp_put(isp);
                 dev_dbg(isp->dev, "ISP_ERR: isp_set_xclk(): Invalid requested "
@@ -237,13 +238,13 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
         }
 
         /* Do we go from stable whatever to clock? */
-        if (divisor >= 2 && isp->xclk_divisor[xclksel] < 2)
+        if (divisor >= 2 && isp->xclk_divisor[xclksel - 1] < 2)
                 omap3isp_get(isp);
         /* Stopping the clock. */
-        else if (divisor < 2 && isp->xclk_divisor[xclksel] >= 2)
+        else if (divisor < 2 && isp->xclk_divisor[xclksel - 1] >= 2)
                 omap3isp_put(isp);
 
-        isp->xclk_divisor[xclksel] = divisor;
+        isp->xclk_divisor[xclksel - 1] = divisor;
 
         omap3isp_put(isp);
 
@@ -285,7 +286,8 @@ static void isp_power_settings(struct isp_device *isp, int idle)
  */
 void omap3isp_configure_bridge(struct isp_device *isp,
                                enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata)
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift)
 {
         u32 ispctrl_val;
 
@@ -298,9 +300,9 @@ void omap3isp_configure_bridge(struct isp_device *isp,
         switch (input) {
         case CCDC_INPUT_PARALLEL:
                 ispctrl_val |= ISPCTRL_PAR_SER_CLK_SEL_PARALLEL;
-                ispctrl_val |= pdata->data_lane_shift << ISPCTRL_SHIFT_SHIFT;
                 ispctrl_val |= pdata->clk_pol << ISPCTRL_PAR_CLK_POL_SHIFT;
                 ispctrl_val |= pdata->bridge << ISPCTRL_PAR_BRIDGE_SHIFT;
+                shift += pdata->data_lane_shift * 2;
                 break;
 
         case CCDC_INPUT_CSI2A:
@@ -319,6 +321,8 @@ void omap3isp_configure_bridge(struct isp_device *isp,
                 return;
         }
 
+        ispctrl_val |= ((shift/2) << ISPCTRL_SHIFT_SHIFT) & ISPCTRL_SHIFT_MASK;
+
         ispctrl_val &= ~ISPCTRL_SYNC_DETECT_MASK;
         ispctrl_val |= ISPCTRL_SYNC_DETECT_VSRISE;
 
@@ -658,6 +662,8 @@ int omap3isp_pipeline_pm_use(struct media_entity *entity, int use)
 
         /* Apply power change to connected non-nodes. */
         ret = isp_pipeline_pm_power(entity, change);
+        if (ret < 0)
+                entity->use_count -= change;
 
         mutex_unlock(&entity->parent->graph_mutex);
 
@@ -872,6 +878,9 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
                 }
         }
 
+        if (failure < 0)
+                isp->needs_reset = true;
+
         return failure;
 }
 
@@ -884,7 +893,8 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
  * single-shot or continuous mode.
  *
  * Return 0 if successful, or the return value of the failed video::s_stream
- * operation otherwise.
+ * operation otherwise. The pipeline state is not updated when the operation
+ * fails, except when stopping the pipeline.
  */
 int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                  enum isp_pipeline_stream_state state)
@@ -895,7 +905,9 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                 ret = isp_pipeline_disable(pipe);
         else
                 ret = isp_pipeline_enable(pipe, state);
-        pipe->stream_state = state;
+
+        if (ret == 0 || state == ISP_PIPELINE_STREAM_STOPPED)
+                pipe->stream_state = state;
 
         return ret;
 }
@@ -1481,6 +1493,10 @@ void omap3isp_put(struct isp_device *isp)
         if (--isp->ref_count == 0) {
                 isp_disable_interrupts(isp);
                 isp_save_ctx(isp);
+                if (isp->needs_reset) {
+                        isp_reset(isp);
+                        isp->needs_reset = false;
+                }
                 isp_disable_clocks(isp);
         }
         mutex_unlock(&isp->isp_mutex);
diff --git a/drivers/media/video/omap3isp/isp.h b/drivers/media/video/omap3isp/isp.h
index cf5214e95a92..2620c405f5e4 100644
--- a/drivers/media/video/omap3isp/isp.h
+++ b/drivers/media/video/omap3isp/isp.h
@@ -132,7 +132,6 @@ struct isp_reg {
 
 /**
  * struct isp_parallel_platform_data - Parallel interface platform data
- * @width: Parallel bus width in bits (8, 10, 11 or 12)
  * @data_lane_shift: Data lane shifter
  *              0 - CAMEXT[13:0] -> CAM[13:0]
  *              1 - CAMEXT[13:2] -> CAM[11:0]
@@ -146,7 +145,6 @@ struct isp_reg {
  *              ISPCTRL_PAR_BRIDGE_BENDIAN - Big endian
  */
 struct isp_parallel_platform_data {
-        unsigned int width;
         unsigned int data_lane_shift:2;
         unsigned int clk_pol:1;
         unsigned int bridge:4;
@@ -262,6 +260,7 @@ struct isp_device {
         /* ISP Obj */
         spinlock_t stat_lock;   /* common lock for statistic drivers */
         struct mutex isp_mutex; /* For handling ref_count field */
+        bool needs_reset;
         int has_context;
         int ref_count;
         unsigned int autoidle;
@@ -311,11 +310,12 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                  enum isp_pipeline_stream_state state);
 void omap3isp_configure_bridge(struct isp_device *isp,
                                enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata);
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift);
 
-#define ISP_XCLK_NONE                   -1
-#define ISP_XCLK_A                      0
-#define ISP_XCLK_B                      1
+#define ISP_XCLK_NONE                   0
+#define ISP_XCLK_A                      1
+#define ISP_XCLK_B                      2
 
 struct isp_device *omap3isp_get(struct isp_device *isp);
 void omap3isp_put(struct isp_device *isp);
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 5ff9d14ce710..39d501bda636 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -43,6 +43,12 @@ __ccdc_get_format(struct isp_ccdc_device *ccdc, struct v4l2_subdev_fh *fh,
 
 static const unsigned int ccdc_fmts[] = {
         V4L2_MBUS_FMT_Y8_1X8,
+        V4L2_MBUS_FMT_Y10_1X10,
+        V4L2_MBUS_FMT_Y12_1X12,
+        V4L2_MBUS_FMT_SGRBG8_1X8,
+        V4L2_MBUS_FMT_SRGGB8_1X8,
+        V4L2_MBUS_FMT_SBGGR8_1X8,
+        V4L2_MBUS_FMT_SGBRG8_1X8,
         V4L2_MBUS_FMT_SGRBG10_1X10,
         V4L2_MBUS_FMT_SRGGB10_1X10,
         V4L2_MBUS_FMT_SBGGR10_1X10,
@@ -1110,21 +1116,38 @@ static void ccdc_configure(struct isp_ccdc_device *ccdc)
         struct isp_parallel_platform_data *pdata = NULL;
         struct v4l2_subdev *sensor;
         struct v4l2_mbus_framefmt *format;
+        const struct isp_format_info *fmt_info;
+        struct v4l2_subdev_format fmt_src;
+        unsigned int depth_out;
+        unsigned int depth_in = 0;
         struct media_pad *pad;
         unsigned long flags;
+        unsigned int shift;
         u32 syn_mode;
         u32 ccdc_pattern;
 
-        if (ccdc->input == CCDC_INPUT_PARALLEL) {
-                pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
-                sensor = media_entity_to_v4l2_subdev(pad->entity);
+        pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
+        sensor = media_entity_to_v4l2_subdev(pad->entity);
+        if (ccdc->input == CCDC_INPUT_PARALLEL)
                 pdata = &((struct isp_v4l2_subdevs_group *)sensor->host_priv)
                         ->bus.parallel;
+
+        /* Compute shift value for lane shifter to configure the bridge. */
+        fmt_src.pad = pad->index;
+        fmt_src.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+        if (!v4l2_subdev_call(sensor, pad, get_fmt, NULL, &fmt_src)) {
+                fmt_info = omap3isp_video_format_info(fmt_src.format.code);
+                depth_in = fmt_info->bpp;
         }
 
-        omap3isp_configure_bridge(isp, ccdc->input, pdata);
+        fmt_info = omap3isp_video_format_info
+                (isp->isp_ccdc.formats[CCDC_PAD_SINK].code);
+        depth_out = fmt_info->bpp;
+
+        shift = depth_in - depth_out;
+        omap3isp_configure_bridge(isp, ccdc->input, pdata, shift);
 
-        ccdc->syncif.datsz = pdata ? pdata->width : 10;
+        ccdc->syncif.datsz = depth_out;
         ccdc_config_sync_if(ccdc, &ccdc->syncif);
 
         /* CCDC_PAD_SINK */
@@ -1338,7 +1361,7 @@ static int ccdc_sbl_wait_idle(struct isp_ccdc_device *ccdc,
  * @ccdc: Pointer to ISP CCDC device.
  * @event: Pointing which event trigger handler
  *
- * Return 1 when the event and stopping request combination is satisfyied,
+ * Return 1 when the event and stopping request combination is satisfied,
  * zero otherwise.
  */
 static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
@@ -1618,7 +1641,7 @@ static int ccdc_video_queue(struct isp_video *video, struct isp_buffer *buffer)
 
         ccdc_set_outaddr(ccdc, buffer->isp_addr);
 
-        /* We now have a buffer queued on the output, restart the pipeline in
+        /* We now have a buffer queued on the output, restart the pipeline
          * on the next CCDC interrupt if running in continuous mode (or when
          * starting the stream).
          */
diff --git a/drivers/media/video/omap3isp/isppreview.c b/drivers/media/video/omap3isp/isppreview.c
index 2b16988a501d..aba537af87e4 100644
--- a/drivers/media/video/omap3isp/isppreview.c
+++ b/drivers/media/video/omap3isp/isppreview.c
@@ -755,7 +755,7 @@ static struct preview_update update_attrs[] = {
  * @configs - pointer to update config structure.
  * @config - return pointer to appropriate structure field.
  * @bit - for which feature to return pointers.
- * Return size of coresponding prev_params member
+ * Return size of corresponding prev_params member
  */
 static u32
 __preview_get_ptrs(struct prev_params *params, void **param,
diff --git a/drivers/media/video/omap3isp/ispqueue.c b/drivers/media/video/omap3isp/ispqueue.c
index 8fddc5806b0d..9c317148205f 100644
--- a/drivers/media/video/omap3isp/ispqueue.c
+++ b/drivers/media/video/omap3isp/ispqueue.c
@@ -339,7 +339,7 @@ static int isp_video_buffer_prepare_user(struct isp_video_buffer *buf)
         up_read(&current->mm->mmap_sem);
 
         if (ret != buf->npages) {
-                buf->npages = ret;
+                buf->npages = ret < 0 ? 0 : ret;
                 isp_video_buffer_cleanup(buf);
                 return -EFAULT;
         }
@@ -408,8 +408,8 @@ done:
  * isp_video_buffer_prepare_vm_flags - Get VMA flags for a userspace address
  *
  * This function locates the VMAs for the buffer's userspace address and checks
- * that their flags match. The onlflag that we need to care for at the moment is
- * VM_PFNMAP.
+ * that their flags match. The only flag that we need to care for at the moment
+ * is VM_PFNMAP.
  *
  * The buffer vm_flags field is set to the first VMA flags.
  *
diff --git a/drivers/media/video/omap3isp/ispresizer.c b/drivers/media/video/omap3isp/ispresizer.c
index 653f88ba56db..0bb0f8cd36f5 100644
--- a/drivers/media/video/omap3isp/ispresizer.c
+++ b/drivers/media/video/omap3isp/ispresizer.c
@@ -714,19 +714,50 @@ static void resizer_print_status(struct isp_res_device *res)
  * iw and ih are the input width and height after cropping. Those equations need
  * to be satisfied exactly for the resizer to work correctly.
  *
- * Reverting the equations, we can compute the resizing ratios with
+ * The equations can't be easily reverted, as the >> 8 operation is not linear.
+ * In addition, not all input sizes can be achieved for a given output size. To
+ * get the highest input size lower than or equal to the requested input size,
+ * we need to compute the highest resizing ratio that satisfies the following
+ * inequality (taking the 4-tap mode width equation as an example)
+ *
+ *      iw >= (32 * sph + (ow - 1) * hrsz + 16) >> 8 - 7
+ *
+ * (where iw is the requested input width) which can be rewritten as
+ *
+ *        iw - 7            >= (32 * sph + (ow - 1) * hrsz + 16) >> 8
+ *       (iw - 7) << 8      >=  32 * sph + (ow - 1) * hrsz + 16 - b
+ *      ((iw - 7) << 8) + b >=  32 * sph + (ow - 1) * hrsz + 16
+ *
+ * where b is the value of the 8 least significant bits of the right hand side
+ * expression of the last inequality. The highest resizing ratio value will be
+ * achieved when b is equal to its maximum value of 255. That resizing ratio
+ * value will still satisfy the original inequality, as b will disappear when
+ * the expression will be shifted right by 8.
+ *
+ * The reverted the equations thus become
  *
  * - 8-phase, 4-tap mode
- *      hrsz = ((iw - 7) * 256 - 16 - 32 * sph) / (ow - 1)
- *      vrsz = ((ih - 4) * 256 - 16 - 32 * spv) / (oh - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 16 - 32 * sph) / (ow - 1)
+ *      vrsz = ((ih - 4) * 256 + 255 - 16 - 32 * spv) / (oh - 1)
  * - 4-phase, 7-tap mode
- *      hrsz = ((iw - 7) * 256 - 32 - 64 * sph) / (ow - 1)
- *      vrsz = ((ih - 7) * 256 - 32 - 64 * spv) / (oh - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 32 - 64 * sph) / (ow - 1)
+ *      vrsz = ((ih - 7) * 256 + 255 - 32 - 64 * spv) / (oh - 1)
  *
- * The ratios are integer values, and must be rounded down to ensure that the
- * cropped input size is not bigger than the uncropped input size. As the ratio
- * in 7-tap mode is always smaller than the ratio in 4-tap mode, we can use the
- * 7-tap mode equations to compute a ratio approximation.
+ * The ratios are integer values, and are rounded down to ensure that the
+ * cropped input size is not bigger than the uncropped input size.
+ *
+ * As the number of phases/taps, used to select the correct equations to compute
+ * the ratio, depends on the ratio, we start with the 4-tap mode equations to
+ * compute an approximation of the ratio, and switch to the 7-tap mode equations
+ * if the approximation is higher than the ratio threshold.
+ *
+ * As the 7-tap mode equations will return a ratio smaller than or equal to the
+ * 4-tap mode equations, the resulting ratio could become lower than or equal to
+ * the ratio threshold. This 'equations loop' isn't an issue as long as the
+ * correct equations are used to compute the final input size. Starting with the
+ * 4-tap mode equations ensure that, in case of values resulting in a 'ratio
+ * loop', the smallest of the ratio values will be used, never exceeding the
+ * requested input size.
  *
  * We first clamp the output size according to the hardware capabilitie to avoid
  * auto-cropping the input more than required to satisfy the TRM equations. The
@@ -775,6 +806,8 @@ static void resizer_calc_ratios(struct isp_res_device *res,
         unsigned int max_width;
         unsigned int max_height;
         unsigned int width_alignment;
+        unsigned int width;
+        unsigned int height;
 
         /*
          * Clamp the output height based on the hardware capabilities and
@@ -786,19 +819,22 @@ static void resizer_calc_ratios(struct isp_res_device *res,
         max_height = min_t(unsigned int, max_height, MAX_OUT_HEIGHT);
         output->height = clamp(output->height, min_height, max_height);
 
-        ratio->vert = ((input->height - 7) * 256 - 32 - 64 * spv)
+        ratio->vert = ((input->height - 4) * 256 + 255 - 16 - 32 * spv)
                     / (output->height - 1);
+        if (ratio->vert > MID_RESIZE_VALUE)
+                ratio->vert = ((input->height - 7) * 256 + 255 - 32 - 64 * spv)
+                            / (output->height - 1);
         ratio->vert = clamp_t(unsigned int, ratio->vert,
                               MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
 
         if (ratio->vert <= MID_RESIZE_VALUE) {
                 upscaled_height = (output->height - 1) * ratio->vert
                                 + 32 * spv + 16;
-                input->height = (upscaled_height >> 8) + 4;
+                height = (upscaled_height >> 8) + 4;
         } else {
                 upscaled_height = (output->height - 1) * ratio->vert
                                 + 64 * spv + 32;
-                input->height = (upscaled_height >> 8) + 7;
+                height = (upscaled_height >> 8) + 7;
         }
 
         /*
@@ -854,20 +890,29 @@ static void resizer_calc_ratios(struct isp_res_device *res,
                               max_width & ~(width_alignment - 1));
         output->width = ALIGN(output->width, width_alignment);
 
-        ratio->horz = ((input->width - 7) * 256 - 32 - 64 * sph)
+        ratio->horz = ((input->width - 7) * 256 + 255 - 16 - 32 * sph)
                     / (output->width - 1);
+        if (ratio->horz > MID_RESIZE_VALUE)
+                ratio->horz = ((input->width - 7) * 256 + 255 - 32 - 64 * sph)
+                            / (output->width - 1);
         ratio->horz = clamp_t(unsigned int, ratio->horz,
                               MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
 
         if (ratio->horz <= MID_RESIZE_VALUE) {
                 upscaled_width = (output->width - 1) * ratio->horz
                                + 32 * sph + 16;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
         } else {
                 upscaled_width = (output->width - 1) * ratio->horz
                                + 64 * sph + 32;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
         }
+
+        /* Center the new crop rectangle. */
+        input->left += (input->width - width) / 2;
+        input->top += (input->height - height) / 2;
+        input->width = width;
+        input->height = height;
 }
 
 /*
diff --git a/drivers/media/video/omap3isp/ispstat.h b/drivers/media/video/omap3isp/ispstat.h
index 820950c9ef46..d86da94fa50d 100644
--- a/drivers/media/video/omap3isp/ispstat.h
+++ b/drivers/media/video/omap3isp/ispstat.h
@@ -131,9 +131,9 @@ struct ispstat {
 struct ispstat_generic_config {
         /*
          * Fields must be in the same order as in:
-         *  - isph3a_aewb_config
-         *  - isph3a_af_config
-         *  - isphist_config
+         *  - omap3isp_h3a_aewb_config
+         *  - omap3isp_h3a_af_config
+         *  - omap3isp_hist_config
          */
         u32 buf_size;
         u16 config_counter;
diff --git a/drivers/media/video/omap3isp/ispvideo.c b/drivers/media/video/omap3isp/ispvideo.c
index 208a7ec739d7..9cd8f1aa567b 100644
--- a/drivers/media/video/omap3isp/ispvideo.c
+++ b/drivers/media/video/omap3isp/ispvideo.c
@@ -47,29 +47,59 @@
 
 static struct isp_format_info formats[] = {
         { V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
-          V4L2_MBUS_FMT_Y8_1X8, V4L2_PIX_FMT_GREY, 8, },
+          V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_GREY, 8, },
+        { V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y10, 10, },
+        { V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y12, 12, },
+        { V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR8, 8, },
+        { V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG8, 8, },
+        { V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG8, 8, },
+        { V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB8, 8, },
         { V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8, V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, 0,
+          V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
         { V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_PIX_FMT_SBGGR10, 10, },
+          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR10, 10, },
         { V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_PIX_FMT_SGBRG10, 10, },
+          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG10, 10, },
         { V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10, 10, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG10, 10, },
         { V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_PIX_FMT_SRGGB10, 10, },
+          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB10, 10, },
         { V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_PIX_FMT_SBGGR12, 12, },
+          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR12, 12, },
         { V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_PIX_FMT_SGBRG12, 12, },
+          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG12, 12, },
         { V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_PIX_FMT_SGRBG12, 12, },
+          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG12, 12, },
         { V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_PIX_FMT_SRGGB12, 12, },
+          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB12, 12, },
         { V4L2_MBUS_FMT_UYVY8_1X16, V4L2_MBUS_FMT_UYVY8_1X16,
-          V4L2_MBUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_UYVY, 16, },
+          V4L2_MBUS_FMT_UYVY8_1X16, 0,
+          V4L2_PIX_FMT_UYVY, 16, },
         { V4L2_MBUS_FMT_YUYV8_1X16, V4L2_MBUS_FMT_YUYV8_1X16,
-          V4L2_MBUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_YUYV, 16, },
+          V4L2_MBUS_FMT_YUYV8_1X16, 0,
+          V4L2_PIX_FMT_YUYV, 16, },
 };
 
 const struct isp_format_info *
@@ -86,6 +116,37 @@ omap3isp_video_format_info(enum v4l2_mbus_pixelcode code)
 }
 
 /*
+ * Decide whether desired output pixel code can be obtained with
+ * the lane shifter by shifting the input pixel code.
+ * @in: input pixelcode to shifter
+ * @out: output pixelcode from shifter
+ * @additional_shift: # of bits the sensor's LSB is offset from CAMEXT[0]
+ *
+ * return true if the combination is possible
+ * return false otherwise
+ */
+static bool isp_video_is_shiftable(enum v4l2_mbus_pixelcode in,
+                enum v4l2_mbus_pixelcode out,
+                unsigned int additional_shift)
+{
+        const struct isp_format_info *in_info, *out_info;
+
+        if (in == out)
+                return true;
+
+        in_info = omap3isp_video_format_info(in);
+        out_info = omap3isp_video_format_info(out);
+
+        if ((in_info->flavor == 0) || (out_info->flavor == 0))
+                return false;
+
+        if (in_info->flavor != out_info->flavor)
+                return false;
+
+        return in_info->bpp - out_info->bpp + additional_shift <= 6;
+}
+
+/*
  * isp_video_mbus_to_pix - Convert v4l2_mbus_framefmt to v4l2_pix_format
  * @video: ISP video instance
  * @mbus: v4l2_mbus_framefmt format (input)
@@ -235,6 +296,7 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                 return -EPIPE;
 
         while (1) {
+                unsigned int shifter_link;
                 /* Retrieve the sink format */
                 pad = &subdev->entity.pads[0];
                 if (!(pad->flags & MEDIA_PAD_FL_SINK))
@@ -263,6 +325,10 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                                 return -ENOSPC;
                 }
 
+                /* If sink pad is on CCDC, the link has the lane shifter
+                 * in the middle of it. */
+                shifter_link = subdev == &isp->isp_ccdc.subdev;
+
                 /* Retrieve the source format */
                 pad = media_entity_remote_source(pad);
                 if (pad == NULL ||
@@ -278,10 +344,24 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                         return -EPIPE;
 
                 /* Check if the two ends match */
-                if (fmt_source.format.code != fmt_sink.format.code ||
-                    fmt_source.format.width != fmt_sink.format.width ||
+                if (fmt_source.format.width != fmt_sink.format.width ||
                     fmt_source.format.height != fmt_sink.format.height)
                         return -EPIPE;
+
+                if (shifter_link) {
+                        unsigned int parallel_shift = 0;
+                        if (isp->isp_ccdc.input == CCDC_INPUT_PARALLEL) {
+                                struct isp_parallel_platform_data *pdata =
+                                        &((struct isp_v4l2_subdevs_group *)
+                                              subdev->host_priv)->bus.parallel;
+                                parallel_shift = pdata->data_lane_shift * 2;
+                        }
+                        if (!isp_video_is_shiftable(fmt_source.format.code,
+                                                fmt_sink.format.code,
+                                                parallel_shift))
+                                return -EPIPE;
+                } else if (fmt_source.format.code != fmt_sink.format.code)
+                        return -EPIPE;
         }
 
         return 0;
diff --git a/drivers/media/video/omap3isp/ispvideo.h b/drivers/media/video/omap3isp/ispvideo.h
index 524a1acd0906..911bea64e78a 100644
--- a/drivers/media/video/omap3isp/ispvideo.h
+++ b/drivers/media/video/omap3isp/ispvideo.h
@@ -49,6 +49,8 @@ struct v4l2_pix_format;
  *      bits. Identical to @code if the format is 10 bits wide or less.
  * @uncompressed: V4L2 media bus format code for the corresponding uncompressed
  *      format. Identical to @code if the format is not DPCM compressed.
+ * @flavor: V4L2 media bus format code for the same pixel layout but
+ *      shifted to be 8 bits per pixel. =0 if format is not shiftable.
  * @pixelformat: V4L2 pixel format FCC identifier
  * @bpp: Bits per pixel
  */
@@ -56,6 +58,7 @@ struct isp_format_info {
         enum v4l2_mbus_pixelcode code;
         enum v4l2_mbus_pixelcode truncated;
         enum v4l2_mbus_pixelcode uncompressed;
+        enum v4l2_mbus_pixelcode flavor;
         u32 pixelformat;
         unsigned int bpp;
 };
diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index 95f8b4e11e46..d142b40ea64e 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -527,7 +527,7 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
         if (ret)
                 return ret;
 
-        if (vb2_is_streaming(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
+        if (vb2_is_busy(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
                 return -EBUSY;
 
         frame = &ctx->d_frame;
@@ -539,8 +539,10 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
                 return -EINVAL;
         }
 
-        for (i = 0; i < frame->fmt->colplanes; i++)
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+        for (i = 0; i < frame->fmt->colplanes; i++) {
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) >> 3;
+        }
 
         /* Output DMA frame pixel size and offsets. */
         frame->f_width = pix->plane_fmt[0].bytesperline * 8
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index 6c919b38a3d8..dc91a8511af6 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -361,10 +361,20 @@ static void fimc_capture_irq_handler(struct fimc_dev *fimc)
 {
         struct fimc_vid_cap *cap = &fimc->vid_cap;
         struct fimc_vid_buffer *v_buf;
+        struct timeval *tv;
+        struct timespec ts;
 
         if (!list_empty(&cap->active_buf_q) &&
             test_bit(ST_CAPT_RUN, &fimc->state)) {
+                ktime_get_real_ts(&ts);
+
                 v_buf = active_queue_pop(cap);
+
+                tv = &v_buf->vb.v4l2_buf.timestamp;
+                tv->tv_sec = ts.tv_sec;
+                tv->tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+                v_buf->vb.v4l2_buf.sequence = cap->frame_count++;
+
                 vb2_buffer_done(&v_buf->vb, VB2_BUF_STATE_DONE);
         }
 
@@ -758,7 +768,7 @@ static void fimc_unlock(struct vb2_queue *vq)
         mutex_unlock(&ctx->fimc_dev->lock);
 }
 
-struct vb2_ops fimc_qops = {
+static struct vb2_ops fimc_qops = {
         .queue_setup     = fimc_queue_setup,
         .buf_prepare     = fimc_buf_prepare,
         .buf_queue       = fimc_buf_queue,
@@ -927,23 +937,23 @@ int fimc_vidioc_try_fmt_mplane(struct file *file, void *priv,
         pix->num_planes = fmt->memplanes;
         pix->colorspace = V4L2_COLORSPACE_JPEG;
 
-        for (i = 0; i < pix->num_planes; ++i) {
-                int bpl = pix->plane_fmt[i].bytesperline;
 
-                dbg("[%d] bpl: %d, depth: %d, w: %d, h: %d",
-                    i, bpl, fmt->depth[i], pix->width, pix->height);
+        for (i = 0; i < pix->num_planes; ++i) {
+                u32 bpl = pix->plane_fmt[i].bytesperline;
+                u32 *sizeimage = &pix->plane_fmt[i].sizeimage;
 
-                if (!bpl || (bpl * 8 / fmt->depth[i]) > pix->width)
-                        bpl = (pix->width * fmt->depth[0]) >> 3;
+                if (fmt->colplanes > 1 && (bpl == 0 || bpl < pix->width))
+                        bpl = pix->width; /* Planar */
 
-                if (!pix->plane_fmt[i].sizeimage)
-                        pix->plane_fmt[i].sizeimage = pix->height * bpl;
+                if (fmt->colplanes == 1 && /* Packed */
+                    (bpl == 0 || ((bpl * 8) / fmt->depth[i]) < pix->width))
+                        bpl = (pix->width * fmt->depth[0]) / 8;
 
-                pix->plane_fmt[i].bytesperline = bpl;
+                if (i == 0) /* Same bytesperline for each plane. */
+                        mod_x = bpl;
 
-                dbg("[%d]: bpl: %d, sizeimage: %d",
-                    i, pix->plane_fmt[i].bytesperline,
-                    pix->plane_fmt[i].sizeimage);
+                pix->plane_fmt[i].bytesperline = mod_x;
+                *sizeimage = (pix->width * pix->height * fmt->depth[i]) / 8;
         }
 
         return 0;
@@ -965,7 +975,7 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
 
         vq = v4l2_m2m_get_vq(ctx->m2m_ctx, f->type);
 
-        if (vb2_is_streaming(vq)) {
+        if (vb2_is_busy(vq)) {
                 v4l2_err(&fimc->m2m.v4l2_dev, "queue (%d) busy\n", f->type);
                 return -EBUSY;
         }
@@ -985,8 +995,10 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
         if (!frame->fmt)
                 return -EINVAL;
 
-        for (i = 0; i < frame->fmt->colplanes; i++)
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+        for (i = 0; i < frame->fmt->colplanes; i++) {
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) / 8;
+        }
 
         frame->f_width  = pix->plane_fmt[0].bytesperline * 8 /
                 frame->fmt->depth[0];
@@ -1750,7 +1762,7 @@ static int __devexit fimc_remove(struct platform_device *pdev)
 }
 
 /* Image pixel limits, similar across several FIMC HW revisions. */
-static struct fimc_pix_limit s5p_pix_limit[3] = {
+static struct fimc_pix_limit s5p_pix_limit[4] = {
         [0] = {
                 .scaler_en_w    = 3264,
                 .scaler_dis_w   = 8192,
@@ -1775,6 +1787,14 @@ static struct fimc_pix_limit s5p_pix_limit[3] = {
                 .out_rot_en_w   = 1280,
                 .out_rot_dis_w  = 1920,
         },
+        [3] = {
+                .scaler_en_w    = 1920,
+                .scaler_dis_w   = 8192,
+                .in_rot_en_h    = 1366,
+                .in_rot_dis_w   = 8192,
+                .out_rot_en_w   = 1366,
+                .out_rot_dis_w  = 1920,
+        },
 };
 
 static struct samsung_fimc_variant fimc0_variant_s5p = {
@@ -1827,7 +1847,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
         .pix_limit       = &s5p_pix_limit[2],
 };
 
-static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc0_variant_exynos4 = {
         .pix_hoff        = 1,
         .has_inp_rot     = 1,
         .has_out_rot     = 1,
@@ -1840,7 +1860,7 @@ static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
         .pix_limit       = &s5p_pix_limit[1],
 };
 
-static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc2_variant_exynos4 = {
         .pix_hoff        = 1,
         .has_cistatus2   = 1,
         .has_mainscaler_ext = 1,
@@ -1848,7 +1868,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
         .min_out_pixsize = 16,
         .hor_offs_align  = 1,
         .out_buf_count   = 32,
-        .pix_limit       = &s5p_pix_limit[2],
+        .pix_limit       = &s5p_pix_limit[3],
 };
 
 /* S5PC100 */
@@ -1874,12 +1894,12 @@ static struct samsung_fimc_driverdata fimc_drvdata_s5pv210 = {
 };
 
 /* S5PV310, S5PC210 */
-static struct samsung_fimc_driverdata fimc_drvdata_s5pv310 = {
+static struct samsung_fimc_driverdata fimc_drvdata_exynos4 = {
         .variant = {
-                [0] = &fimc0_variant_s5pv310,
-                [1] = &fimc0_variant_s5pv310,
-                [2] = &fimc0_variant_s5pv310,
-                [3] = &fimc2_variant_s5pv310,
+                [0] = &fimc0_variant_exynos4,
+                [1] = &fimc0_variant_exynos4,
+                [2] = &fimc0_variant_exynos4,
+                [3] = &fimc2_variant_exynos4,
         },
         .num_entities = 4,
         .lclk_frequency = 166000000UL,
@@ -1893,8 +1913,8 @@ static struct platform_device_id fimc_driver_ids[] = {
                 .name           = "s5pv210-fimc",
                 .driver_data    = (unsigned long)&fimc_drvdata_s5pv210,
         }, {
-                .name           = "s5pv310-fimc",
-                .driver_data    = (unsigned long)&fimc_drvdata_s5pv310,
+                .name           = "exynos4-fimc",
+                .driver_data    = (unsigned long)&fimc_drvdata_exynos4,
         },
         {},
 };
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 3fe54bf41142..134e86bf6d97 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -922,7 +922,7 @@ static int sh_mobile_ceu_get_formats(struct soc_camera_device *icd, unsigned int
                         /* Try 2560x1920, 1280x960, 640x480, 320x240 */
                         mf.width        = 2560 >> shift;
                         mf.height       = 1920 >> shift;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                          s_mbus_fmt, &mf);
                         if (ret < 0)
                                 return ret;
@@ -1224,7 +1224,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
         struct v4l2_cropcap cap;
         int ret;
 
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                          s_mbus_fmt, mf);
         if (ret < 0)
                 return ret;
@@ -1254,7 +1254,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
                 tmp_h = min(2 * tmp_h, max_height);
                 mf->width = tmp_w;
                 mf->height = tmp_h;
-                ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                  s_mbus_fmt, mf);
                 dev_geo(dev, "Camera scaled to %ux%u\n",
                         mf->width, mf->height);
@@ -1658,7 +1658,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
         mf.code         = xlate->code;
         mf.colorspace   = pix->colorspace;
 
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video, try_mbus_fmt, &mf);
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video, try_mbus_fmt, &mf);
         if (ret < 0)
                 return ret;
 
@@ -1682,7 +1682,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
                          */
                         mf.width = 2560;
                         mf.height = 1920;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                          try_mbus_fmt, &mf);
                         if (ret < 0) {
                                 /* Shouldn't actually happen... */
diff --git a/drivers/media/video/sh_mobile_csi2.c b/drivers/media/video/sh_mobile_csi2.c
index dd1b81b1442b..98b87481fa94 100644
--- a/drivers/media/video/sh_mobile_csi2.c
+++ b/drivers/media/video/sh_mobile_csi2.c
@@ -38,6 +38,8 @@ struct sh_csi2 {
         void __iomem                    *base;
         struct platform_device          *pdev;
         struct sh_csi2_client_config    *client;
+        unsigned long (*query_bus_param)(struct soc_camera_device *);
+        int (*set_bus_param)(struct soc_camera_device *, unsigned long);
 };
 
 static int sh_csi2_try_fmt(struct v4l2_subdev *sd,
@@ -208,6 +210,7 @@ static int sh_csi2_notify(struct notifier_block *nb,
         case BUS_NOTIFY_BOUND_DRIVER:
                 snprintf(priv->subdev.name, V4L2_SUBDEV_NAME_SIZE, "%s%s",
                          dev_name(v4l2_dev->dev), ".mipi-csi");
+                priv->subdev.grp_id = (long)icd;
                 ret = v4l2_device_register_subdev(v4l2_dev, &priv->subdev);
                 dev_dbg(dev, "%s(%p): ret(register_subdev) = %d\n", __func__, priv, ret);
                 if (ret < 0)
@@ -215,6 +218,8 @@ static int sh_csi2_notify(struct notifier_block *nb,
 
                 priv->client = pdata->clients + i;
 
+                priv->set_bus_param             = icd->ops->set_bus_param;
+                priv->query_bus_param           = icd->ops->query_bus_param;
                 icd->ops->set_bus_param         = sh_csi2_set_bus_param;
                 icd->ops->query_bus_param       = sh_csi2_query_bus_param;
 
@@ -226,8 +231,10 @@ static int sh_csi2_notify(struct notifier_block *nb,
                 priv->client = NULL;
 
                 /* Driver is about to be unbound */
-                icd->ops->set_bus_param         = NULL;
-                icd->ops->query_bus_param       = NULL;
+                icd->ops->set_bus_param         = priv->set_bus_param;
+                icd->ops->query_bus_param       = priv->query_bus_param;
+                priv->set_bus_param             = NULL;
+                priv->query_bus_param           = NULL;
 
                 v4l2_device_unregister_subdev(&priv->subdev);
 
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 46284489e4eb..3973f9a94753 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -996,10 +996,11 @@ static void soc_camera_free_i2c(struct soc_camera_device *icd)
 {
         struct i2c_client *client =
                 to_i2c_client(to_soc_camera_control(icd));
+        struct i2c_adapter *adap = client->adapter;
         dev_set_drvdata(&icd->dev, NULL);
         v4l2_device_unregister_subdev(i2c_get_clientdata(client));
         i2c_unregister_device(client);
-        i2c_put_adapter(client->adapter);
+        i2c_put_adapter(adap);
 }
 #else
 #define soc_camera_init_i2c(icd, icl)   (-ENODEV)
@@ -1071,6 +1072,9 @@ static int soc_camera_probe(struct device *dev)
                 }
         }
 
+        sd = soc_camera_to_subdev(icd);
+        sd->grp_id = (long)icd;
+
         /* At this point client .probe() should have run already */
         ret = soc_camera_init_user_formats(icd);
         if (ret < 0)
@@ -1092,7 +1096,6 @@ static int soc_camera_probe(struct device *dev)
                 goto evidstart;
 
         /* Try to improve our guess of a reasonable window format */
-        sd = soc_camera_to_subdev(icd);
         if (!v4l2_subdev_call(sd, video, g_mbus_fmt, &mf)) {
                 icd->user_width         = mf.width;
                 icd->user_height        = mf.height;
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 498e6742579e..6dc7196296b3 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -389,7 +389,8 @@ static int v4l2_open(struct inode *inode, struct file *filp)
         video_get(vdev);
         mutex_unlock(&videodev_lock);
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                 entity = media_entity_get(&vdev->entity);
                 if (!entity) {
                         ret = -EBUSY;
@@ -415,7 +416,8 @@ err:
         /* decrease the refcount in case of an error */
         if (ret) {
 #if defined(CONFIG_MEDIA_CONTROLLER)
-                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+                    vdev->vfl_type != VFL_TYPE_SUBDEV)
                         media_entity_put(entity);
 #endif
                 video_put(vdev);
@@ -437,7 +439,8 @@ static int v4l2_release(struct inode *inode, struct file *filp)
                         mutex_unlock(vdev->lock);
         }
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                 media_entity_put(&vdev->entity);
 #endif
         /* decrease the refcount unconditionally since the release()
@@ -686,7 +689,8 @@ int __video_register_device(struct video_device *vdev, int type, int nr,
 
 #if defined(CONFIG_MEDIA_CONTROLLER)
         /* Part 5: Register the entity. */
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                 vdev->entity.type = MEDIA_ENT_T_DEVNODE_V4L;
                 vdev->entity.name = vdev->name;
                 vdev->entity.v4l.major = VIDEO_MAJOR;
@@ -733,7 +737,8 @@ void video_unregister_device(struct video_device *vdev)
                 return;
 
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                 media_device_unregister_entity(&vdev->entity);
 #endif
 
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index c4742fc15529..c9691115f2d2 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -300,7 +300,7 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q,
 
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
         retval = remap_pfn_range(vma, vma->vm_start,
-                                 PFN_DOWN(virt_to_phys(mem->vaddr)),
+                                 mem->dma_handle >> PAGE_SHIFT,
                                  size, vma->vm_page_prot);
         if (retval) {
                 dev_err(q->dev, "mmap: remap failed with error %d. ", retval);
diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c
index 6698c77e0f64..6ba1461d51ef 100644
--- a/drivers/media/video/videobuf2-core.c
+++ b/drivers/media/video/videobuf2-core.c
@@ -37,6 +37,9 @@ module_param(debug, int, 0644);
 #define call_qop(q, op, args...)                                        \
         (((q)->ops->op) ? ((q)->ops->op(args)) : 0)
 
+#define V4L2_BUFFER_STATE_FLAGS (V4L2_BUF_FLAG_MAPPED | V4L2_BUF_FLAG_QUEUED | \
+                                 V4L2_BUF_FLAG_DONE | V4L2_BUF_FLAG_ERROR)
+
 /**
  * __vb2_buf_mem_alloc() - allocate video memory for the given buffer
  */
@@ -51,7 +54,7 @@ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb,
         for (plane = 0; plane < vb->num_planes; ++plane) {
                 mem_priv = call_memop(q, plane, alloc, q->alloc_ctx[plane],
                                         plane_sizes[plane]);
-                if (!mem_priv)
+                if (IS_ERR_OR_NULL(mem_priv))
                         goto free;
 
                 /* Associate allocator private data with this plane */
@@ -284,7 +287,7 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
         struct vb2_queue *q = vb->vb2_queue;
         int ret = 0;
 
-        /* Copy back data such as timestamp, input, etc. */
+        /* Copy back data such as timestamp, flags, input, etc. */
         memcpy(b, &vb->v4l2_buf, offsetof(struct v4l2_buffer, m));
         b->input = vb->v4l2_buf.input;
         b->reserved = vb->v4l2_buf.reserved;
@@ -313,7 +316,10 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
                         b->m.userptr = vb->v4l2_planes[0].m.userptr;
         }
 
-        b->flags = 0;
+        /*
+         * Clear any buffer state related flags.
+         */
+        b->flags &= ~V4L2_BUFFER_STATE_FLAGS;
 
         switch (vb->state) {
         case VB2_BUF_STATE_QUEUED:
@@ -519,6 +525,7 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
         num_buffers = min_t(unsigned int, req->count, VIDEO_MAX_FRAME);
         memset(plane_sizes, 0, sizeof(plane_sizes));
         memset(q->alloc_ctx, 0, sizeof(q->alloc_ctx));
+        q->memory = req->memory;
 
         /*
          * Ask the driver how many buffers and planes per buffer it requires.
@@ -560,8 +567,6 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
                 ret = num_buffers;
         }
 
-        q->memory = req->memory;
-
         /*
          * Return the number of successfully allocated buffers
          * to the userspace.
@@ -715,6 +720,8 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b,
 
         vb->v4l2_buf.field = b->field;
         vb->v4l2_buf.timestamp = b->timestamp;
+        vb->v4l2_buf.input = b->input;
+        vb->v4l2_buf.flags = b->flags & ~V4L2_BUFFER_STATE_FLAGS;
 
         return 0;
 }
diff --git a/drivers/media/video/videobuf2-dma-contig.c b/drivers/media/video/videobuf2-dma-contig.c
index 58205d596138..a790a5f8c06f 100644
--- a/drivers/media/video/videobuf2-dma-contig.c
+++ b/drivers/media/video/videobuf2-dma-contig.c
@@ -46,7 +46,7 @@ static void *vb2_dma_contig_alloc(void *alloc_ctx, unsigned long size)
                                         GFP_KERNEL);
         if (!buf->vaddr) {
                 dev_err(conf->dev, "dma_alloc_coherent of size %ld failed\n",
-                        buf->size);
+                        size);
                 kfree(buf);
                 return ERR_PTR(-ENOMEM);
         }
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index d01574d98870..f4c8c844b913 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -55,6 +55,19 @@ int mfd_cell_disable(struct platform_device *pdev)
 }
 EXPORT_SYMBOL(mfd_cell_disable);
 
+static int mfd_platform_add_cell(struct platform_device *pdev,
+                                 const struct mfd_cell *cell)
+{
+        if (!cell)
+                return 0;
+
+        pdev->mfd_cell = kmemdup(cell, sizeof(*cell), GFP_KERNEL);
+        if (!pdev->mfd_cell)
+                return -ENOMEM;
+
+        return 0;
+}
+
 static int mfd_add_device(struct device *parent, int id,
                           const struct mfd_cell *cell,
                           struct resource *mem_base,
@@ -75,7 +88,7 @@ static int mfd_add_device(struct device *parent, int id,
 
         pdev->dev.parent = parent;
 
-        ret = platform_device_add_data(pdev, cell, sizeof(*cell));
+        ret = mfd_platform_add_cell(pdev, cell);
         if (ret)
                 goto fail_res;
 
@@ -123,7 +136,6 @@ static int mfd_add_device(struct device *parent, int id,
 
         return 0;
 
-/*      platform_device_del(pdev); */
 fail_res:
         kfree(res);
 fail_device:
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 20e4e9395b61..ecafa4ba238b 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -348,15 +348,15 @@ static unsigned long gru_chiplet_cpu_to_mmr(int chiplet, int cpu, int *corep)
 
 static int gru_irq_count[GRU_CHIPLETS_PER_BLADE];
 
-static void gru_noop(unsigned int irq)
+static void gru_noop(struct irq_data *d)
 {
 }
 
 static struct irq_chip gru_chip[GRU_CHIPLETS_PER_BLADE] = {
         [0 ... GRU_CHIPLETS_PER_BLADE - 1] {
-                .mask           = gru_noop,
-                .unmask         = gru_noop,
-                .ack            = gru_noop
+                .irq_mask       = gru_noop,
+                .irq_unmask     = gru_noop,
+                .irq_ack        = gru_noop
         }
 };
 
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 96c0b34ba8db..657b9f4b6f9b 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -400,7 +400,7 @@ static uint16_t __init doc200x_ident_chip(struct mtd_info *mtd, int nr)
         doc200x_hwcontrol(mtd, 0, NAND_CTRL_ALE | NAND_CTRL_CHANGE);
         doc200x_hwcontrol(mtd, NAND_CMD_NONE, NAND_NCE | NAND_CTRL_CHANGE);
 
-        /* We can't' use dev_ready here, but at least we wait for the
+        /* We can't use dev_ready here, but at least we wait for the
          * command to complete
          */
         udelay(50);
diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index a3755ffc03d4..bc8ce48f0778 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -2550,7 +2550,6 @@ static int __devinit sio_ite_8872_probe(struct pci_dev *pdev, int autoirq,
                                          const struct parport_pc_via_data *via)
 {
         short inta_addr[6] = { 0x2A0, 0x2C0, 0x220, 0x240, 0x1E0 };
-        struct resource *base_res;
         u32 ite8872set;
         u32 ite8872_lpt, ite8872_lpthi;
         u8 ite8872_irq, type;
@@ -2561,8 +2560,7 @@ static int __devinit sio_ite_8872_probe(struct pci_dev *pdev, int autoirq,
 
         /* make sure which one chip */
         for (i = 0; i < 5; i++) {
-                base_res = request_region(inta_addr[i], 32, "it887x");
-                if (base_res) {
+                if (request_region(inta_addr[i], 32, "it887x")) {
                         int test;
                         pci_write_config_dword(pdev, 0x60,
                                                 0xe5000000 | inta_addr[i]);
@@ -2571,7 +2569,7 @@ static int __devinit sio_ite_8872_probe(struct pci_dev *pdev, int autoirq,
                         test = inb(inta_addr[i]);
                         if (test != 0xff)
                                 break;
-                        release_region(inta_addr[i], 0x8);
+                        release_region(inta_addr[i], 32);
                 }
         }
         if (i >= 5) {
@@ -2635,7 +2633,7 @@ static int __devinit sio_ite_8872_probe(struct pci_dev *pdev, int autoirq,
         /*
          * Release the resource so that parport_pc_probe_port can get it.
          */
-        release_resource(base_res);
+        release_region(inta_addr[i], 32);
         if (parport_pc_probe_port(ite8872_lpt, ite8872_lpthi,
                                    irq, PARPORT_DMA_NONE, &pdev->dev, 0)) {
                 printk(KERN_INFO
diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
index c8ff646c0b05..0fa466a91bf4 100644
--- a/drivers/pci/Kconfig
+++ b/drivers/pci/Kconfig
@@ -88,4 +88,6 @@ config PCI_IOAPIC
         depends on HOTPLUG
         default y
 
-select NLS if (DMI || ACPI)
+config PCI_LABEL
+        def_bool y if (DMI || ACPI)
+        select NLS
diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
index 98d61c8e984b..c85f744270a5 100644
--- a/drivers/pci/Makefile
+++ b/drivers/pci/Makefile
@@ -56,10 +56,10 @@ obj-$(CONFIG_TILE) += setup-bus.o setup-irq.o
 # ACPI Related PCI FW Functions
 # ACPI _DSM provided firmware instance and string name
 #
-obj-$(CONFIG_ACPI)    += pci-acpi.o pci-label.o
+obj-$(CONFIG_ACPI)    += pci-acpi.o
 
 # SMBIOS provided firmware instance and labels
-obj-$(CONFIG_DMI)    += pci-label.o
+obj-$(CONFIG_PCI_LABEL) += pci-label.o
 
 # Cardbus & CompactPCI use setup-bus
 obj-$(CONFIG_HOTPLUG) += setup-bus.o
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 505c1c7075f0..d552d2c77844 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -1299,7 +1299,7 @@ static void iommu_detach_domain(struct dmar_domain *domain,
 static struct iova_domain reserved_iova_list;
 static struct lock_class_key reserved_rbtree_key;
 
-static void dmar_init_reserved_ranges(void)
+static int dmar_init_reserved_ranges(void)
 {
         struct pci_dev *pdev = NULL;
         struct iova *iova;
@@ -1313,8 +1313,10 @@ static void dmar_init_reserved_ranges(void)
         /* IOAPIC ranges shouldn't be accessed by DMA */
         iova = reserve_iova(&reserved_iova_list, IOVA_PFN(IOAPIC_RANGE_START),
                 IOVA_PFN(IOAPIC_RANGE_END));
-        if (!iova)
+        if (!iova) {
                 printk(KERN_ERR "Reserve IOAPIC range failed\n");
+                return -ENODEV;
+        }
 
         /* Reserve all PCI MMIO to avoid peer-to-peer access */
         for_each_pci_dev(pdev) {
@@ -1327,11 +1329,13 @@ static void dmar_init_reserved_ranges(void)
                         iova = reserve_iova(&reserved_iova_list,
                                             IOVA_PFN(r->start),
                                             IOVA_PFN(r->end));
-                        if (!iova)
+                        if (!iova) {
                                 printk(KERN_ERR "Reserve iova failed\n");
+                                return -ENODEV;
+                        }
                 }
         }
-
+        return 0;
 }
 
 static void domain_reserve_special_ranges(struct dmar_domain *domain)
@@ -1835,7 +1839,7 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
 
         ret = iommu_attach_domain(domain, iommu);
         if (ret) {
-                domain_exit(domain);
+                free_domain_mem(domain);
                 goto error;
         }
 
@@ -2213,7 +2217,7 @@ static int __init iommu_prepare_static_identity_mapping(int hw)
         return 0;
 }
 
-int __init init_dmars(void)
+static int __init init_dmars(int force_on)
 {
         struct dmar_drhd_unit *drhd;
         struct dmar_rmrr_unit *rmrr;
@@ -2393,8 +2397,15 @@ int __init init_dmars(void)
          *   enable translation
          */
         for_each_drhd_unit(drhd) {
-                if (drhd->ignored)
+                if (drhd->ignored) {
+                        /*
+                         * we always have to disable PMRs or DMA may fail on
+                         * this device
+                         */
+                        if (force_on)
+                                iommu_disable_protect_mem_regions(drhd->iommu);
                         continue;
+                }
                 iommu = drhd->iommu;
 
                 iommu_flush_write_buffer(iommu);
@@ -3240,9 +3251,15 @@ static int device_notifier(struct notifier_block *nb,
         if (!domain)
                 return 0;
 
-        if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through)
+        if (action == BUS_NOTIFY_UNBOUND_DRIVER && !iommu_pass_through) {
                 domain_remove_one_dev_info(domain, pdev);
 
+                if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
+                    !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
+                    list_empty(&domain->devices))
+                        domain_exit(domain);
+        }
+
         return 0;
 }
 
@@ -3277,12 +3294,21 @@ int __init intel_iommu_init(void)
         if (no_iommu || dmar_disabled)
                 return -ENODEV;
 
-        iommu_init_mempool();
-        dmar_init_reserved_ranges();
+        if (iommu_init_mempool()) {
+                if (force_on)
+                        panic("tboot: Failed to initialize iommu memory\n");
+                return  -ENODEV;
+        }
+
+        if (dmar_init_reserved_ranges()) {
+                if (force_on)
+                        panic("tboot: Failed to reserve iommu ranges\n");
+                return  -ENODEV;
+        }
 
         init_no_remapping_devices();
 
-        ret = init_dmars();
+        ret = init_dmars(force_on);
         if (ret) {
                 if (force_on)
                         panic("tboot: Failed to initialize DMARs\n");
@@ -3391,6 +3417,11 @@ static void domain_remove_one_dev_info(struct dmar_domain *domain,
                 domain->iommu_count--;
                 domain_update_iommu_cap(domain);
                 spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
+
+                spin_lock_irqsave(&iommu->lock, tmp_flags);
+                clear_bit(domain->id, iommu->domain_ids);
+                iommu->domains[domain->id] = NULL;
+                spin_unlock_irqrestore(&iommu->lock, tmp_flags);
         }
 
         spin_unlock_irqrestore(&device_domain_lock, flags);
@@ -3607,9 +3638,9 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
 
                 pte = dmar_domain->pgd;
                 if (dma_pte_present(pte)) {
-                        free_pgtable_page(dmar_domain->pgd);
                         dmar_domain->pgd = (struct dma_pte *)
                                 phys_to_virt(dma_pte_addr(pte));
+                        free_pgtable_page(pte);
                 }
                 dmar_domain->agaw--;
         }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index d86ea8b01137..135df164a4c1 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -781,7 +781,7 @@ static int pci_pm_resume(struct device *dev)
 
 #endif /* !CONFIG_SUSPEND */
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 
 static int pci_pm_freeze(struct device *dev)
 {
@@ -970,7 +970,7 @@ static int pci_pm_restore(struct device *dev)
         return error;
 }
 
-#else /* !CONFIG_HIBERNATION */
+#else /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #define pci_pm_freeze           NULL
 #define pci_pm_freeze_noirq     NULL
@@ -981,7 +981,7 @@ static int pci_pm_restore(struct device *dev)
 #define pci_pm_restore          NULL
 #define pci_pm_restore_noirq    NULL
 
-#endif /* !CONFIG_HIBERNATION */
+#endif /* !CONFIG_HIBERNATE_CALLBACKS */
 
 #ifdef CONFIG_PM_RUNTIME
 
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index fe77e8223841..e8c19def1b0f 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -173,7 +173,7 @@ static int pcmcia_access_config(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
 
         if (!(c->state & CONFIG_LOCKED)) {
-                dev_dbg(&p_dev->dev, "Configuration isn't't locked\n");
+                dev_dbg(&p_dev->dev, "Configuration isn't locked\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EACCES;
         }
diff --git a/drivers/pcmcia/pxa2xx_balloon3.c b/drivers/pcmcia/pxa2xx_balloon3.c
index 453c54c97612..4c3e94c0ae85 100644
--- a/drivers/pcmcia/pxa2xx_balloon3.c
+++ b/drivers/pcmcia/pxa2xx_balloon3.c
@@ -25,6 +25,8 @@
 
 #include <mach/balloon3.h>
 
+#include <asm/mach-types.h>
+
 #include "soc_common.h"
 
 /*
@@ -127,6 +129,9 @@ static int __init balloon3_pcmcia_init(void)
 {
         int ret;
 
+        if (!machine_is_balloon3())
+                return -ENODEV;
+
         balloon3_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
         if (!balloon3_pcmcia_device)
                 return -ENOMEM;
diff --git a/drivers/pcmcia/pxa2xx_trizeps4.c b/drivers/pcmcia/pxa2xx_trizeps4.c
index b7e596620db1..b829e655457b 100644
--- a/drivers/pcmcia/pxa2xx_trizeps4.c
+++ b/drivers/pcmcia/pxa2xx_trizeps4.c
@@ -69,15 +69,15 @@ static int trizeps_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
         for (i = 0; i < ARRAY_SIZE(irqs); i++) {
                 if (irqs[i].sock != skt->nr)
                         continue;
-                if (gpio_request(IRQ_TO_GPIO(irqs[i].irq), irqs[i].str) < 0) {
+                if (gpio_request(irq_to_gpio(irqs[i].irq), irqs[i].str) < 0) {
                         pr_err("%s: sock %d unable to request gpio %d\n",
-                                __func__, skt->nr, IRQ_TO_GPIO(irqs[i].irq));
+                                __func__, skt->nr, irq_to_gpio(irqs[i].irq));
                         ret = -EBUSY;
                         goto error;
                 }
-                if (gpio_direction_input(IRQ_TO_GPIO(irqs[i].irq)) < 0) {
+                if (gpio_direction_input(irq_to_gpio(irqs[i].irq)) < 0) {
                         pr_err("%s: sock %d unable to set input gpio %d\n",
-                                __func__, skt->nr, IRQ_TO_GPIO(irqs[i].irq));
+                                __func__, skt->nr, irq_to_gpio(irqs[i].irq));
                         ret = -EINVAL;
                         goto error;
                 }
@@ -86,7 +86,7 @@ static int trizeps_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
 
 error:
         for (; i >= 0; i--) {
-                gpio_free(IRQ_TO_GPIO(irqs[i].irq));
+                gpio_free(irq_to_gpio(irqs[i].irq));
         }
         return (ret);
 }
@@ -97,7 +97,7 @@ static void trizeps_pcmcia_hw_shutdown(struct soc_pcmcia_socket *skt)
         /* free allocated gpio's */
         gpio_free(GPIO_PRDY);
         for (i = 0; i < ARRAY_SIZE(irqs); i++)
-                gpio_free(IRQ_TO_GPIO(irqs[i].irq));
+                gpio_free(irq_to_gpio(irqs[i].irq));
 }
 
 static unsigned long trizeps_pcmcia_status[2];
@@ -226,6 +226,9 @@ static int __init trizeps_pcmcia_init(void)
 {
         int ret;
 
+        if (!machine_is_trizeps4() && !machine_is_trizeps4wl())
+                return -ENODEV;
+
         trizeps_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
         if (!trizeps_pcmcia_device)
                 return -ENOMEM;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 2ee442c2a5db..0485e394712a 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -187,7 +187,8 @@ config MSI_LAPTOP
         depends on ACPI
         depends on BACKLIGHT_CLASS_DEVICE
         depends on RFKILL
-        depends on SERIO_I8042
+        depends on INPUT && SERIO_I8042
+        select INPUT_SPARSEKMAP
         ---help---
           This is a driver for laptops built by MSI (MICRO-STAR
           INTERNATIONAL):
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 5ea6c3477d17..ac4e7f83ce6c 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -89,7 +89,7 @@ MODULE_LICENSE("GPL");
 #define ACERWMID_EVENT_GUID "676AA15E-6A47-4D9F-A2CC-1E6D18D14026"
 
 MODULE_ALIAS("wmi:67C3371D-95A3-4C37-BB61-DD47B491DAAB");
-MODULE_ALIAS("wmi:6AF4F258-B401-42Fd-BE91-3D4AC2D7C0D3");
+MODULE_ALIAS("wmi:6AF4F258-B401-42FD-BE91-3D4AC2D7C0D3");
 MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
 
 enum acer_wmi_event_ids {
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index efc776cb0c66..832a3fd7c1c8 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -201,8 +201,8 @@ static int asus_wmi_input_init(struct asus_wmi *asus)
         if (!asus->inputdev)
                 return -ENOMEM;
 
-        asus->inputdev->name = asus->driver->input_phys;
-        asus->inputdev->phys = asus->driver->input_name;
+        asus->inputdev->name = asus->driver->input_name;
+        asus->inputdev->phys = asus->driver->input_phys;
         asus->inputdev->id.bustype = BUS_HOST;
         asus->inputdev->dev.parent = &asus->platform_device->dev;
 
diff --git a/drivers/platform/x86/eeepc-wmi.c b/drivers/platform/x86/eeepc-wmi.c
index 0ddc434fb93b..649dcadd8ea3 100644
--- a/drivers/platform/x86/eeepc-wmi.c
+++ b/drivers/platform/x86/eeepc-wmi.c
@@ -67,9 +67,11 @@ static const struct key_entry eeepc_wmi_keymap[] = {
         { KE_KEY, 0x82, { KEY_CAMERA } },
         { KE_KEY, 0x83, { KEY_CAMERA_ZOOMIN } },
         { KE_KEY, 0x88, { KEY_WLAN } },
+        { KE_KEY, 0xbd, { KEY_CAMERA } },
         { KE_KEY, 0xcc, { KEY_SWITCHVIDEOMODE } },
         { KE_KEY, 0xe0, { KEY_PROG1 } }, /* Task Manager */
         { KE_KEY, 0xe1, { KEY_F14 } }, /* Change Resolution */
+        { KE_KEY, 0xe8, { KEY_SCREENLOCK } },
         { KE_KEY, 0xe9, { KEY_BRIGHTNESS_ZERO } },
         { KE_KEY, 0xeb, { KEY_CAMERA_ZOOMOUT } },
         { KE_KEY, 0xec, { KEY_CAMERA_UP } },
diff --git a/drivers/platform/x86/intel_pmic_gpio.c b/drivers/platform/x86/intel_pmic_gpio.c
index d653104b59cb..464bb3fc4d88 100644
--- a/drivers/platform/x86/intel_pmic_gpio.c
+++ b/drivers/platform/x86/intel_pmic_gpio.c
@@ -74,6 +74,19 @@ struct pmic_gpio {
         u32                     trigger_type;
 };
 
+static void pmic_program_irqtype(int gpio, int type)
+{
+        if (type & IRQ_TYPE_EDGE_RISING)
+                intel_scu_ipc_update_register(GPIO0 + gpio, 0x20, 0x20);
+        else
+                intel_scu_ipc_update_register(GPIO0 + gpio, 0x00, 0x20);
+
+        if (type & IRQ_TYPE_EDGE_FALLING)
+                intel_scu_ipc_update_register(GPIO0 + gpio, 0x10, 0x10);
+        else
+                intel_scu_ipc_update_register(GPIO0 + gpio, 0x00, 0x10);
+};
+
 static int pmic_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 {
         if (offset > 8) {
@@ -166,16 +179,38 @@ static int pmic_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
         return pg->irq_base + offset;
 }
 
+static void pmic_bus_lock(struct irq_data *data)
+{
+        struct pmic_gpio *pg = irq_data_get_irq_chip_data(data);
+
+        mutex_lock(&pg->buslock);
+}
+
+static void pmic_bus_sync_unlock(struct irq_data *data)
+{
+        struct pmic_gpio *pg = irq_data_get_irq_chip_data(data);
+
+        if (pg->update_type) {
+                unsigned int gpio = pg->update_type & ~GPIO_UPDATE_TYPE;
+
+                pmic_program_irqtype(gpio, pg->trigger_type);
+                pg->update_type = 0;
+        }
+        mutex_unlock(&pg->buslock);
+}
+
 /* the gpiointr register is read-clear, so just do nothing. */
 static void pmic_irq_unmask(struct irq_data *data) { }
 
 static void pmic_irq_mask(struct irq_data *data) { }
 
 static struct irq_chip pmic_irqchip = {
-        .name           = "PMIC-GPIO",
-        .irq_mask       = pmic_irq_mask,
-        .irq_unmask     = pmic_irq_unmask,
-        .irq_set_type   = pmic_irq_type,
+        .name                   = "PMIC-GPIO",
+        .irq_mask               = pmic_irq_mask,
+        .irq_unmask             = pmic_irq_unmask,
+        .irq_set_type           = pmic_irq_type,
+        .irq_bus_lock           = pmic_bus_lock,
+        .irq_bus_sync_unlock    = pmic_bus_sync_unlock,
 };
 
 static irqreturn_t pmic_irq_handler(int irq, void *data)
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index de434c6dc2d6..d347116d150e 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -571,6 +571,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
                 .callback = dmi_check_cb,
         },
         {
+                .ident = "R410 Plus",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR,
+                                        "SAMSUNG ELECTRONICS CO., LTD."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "R410P"),
+                        DMI_MATCH(DMI_BOARD_NAME, "R460"),
+                },
+                .callback = dmi_check_cb,
+        },
+        {
                 .ident = "R518",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR,
@@ -591,12 +601,12 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
                 .callback = dmi_check_cb,
         },
         {
-                .ident = "N150/N210/N220",
+                .ident = "N150/N210/N220/N230",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR,
                                         "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220/N230"),
+                        DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220/N230"),
                 },
                 .callback = dmi_check_cb,
         },
@@ -771,6 +781,7 @@ static int __init samsung_init(void)
 
         /* create a backlight device to talk to this one */
         memset(&props, 0, sizeof(struct backlight_properties));
+        props.type = BACKLIGHT_PLATFORM;
         props.max_brightness = sabi_config->max_brightness;
         backlight_device = backlight_device_register("samsung", &sdev->dev,
                                                      NULL, &backlight_ops,
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index e642f5f29504..8f709aec4da0 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -138,6 +138,8 @@ MODULE_PARM_DESC(kbd_backlight_timeout,
                  "1 for 30 seconds, 2 for 60 seconds and 3 to disable timeout "
                  "(default: 0)");
 
+static void sony_nc_kbd_backlight_resume(void);
+
 enum sony_nc_rfkill {
         SONY_WIFI,
         SONY_BLUETOOTH,
@@ -771,11 +773,6 @@ static int sony_nc_handles_setup(struct platform_device *pd)
         if (!handles)
                 return -ENOMEM;
 
-        sysfs_attr_init(&handles->devattr.attr);
-        handles->devattr.attr.name = "handles";
-        handles->devattr.attr.mode = S_IRUGO;
-        handles->devattr.show = sony_nc_handles_show;
-
         for (i = 0; i < ARRAY_SIZE(handles->cap); i++) {
                 if (!acpi_callsetfunc(sony_nc_acpi_handle,
                                         "SN00", i + 0x20, &result)) {
@@ -785,11 +782,18 @@ static int sony_nc_handles_setup(struct platform_device *pd)
                 }
         }
 
-        /* allow reading capabilities via sysfs */
-        if (device_create_file(&pd->dev, &handles->devattr)) {
-                kfree(handles);
-                handles = NULL;
-                return -1;
+        if (debug) {
+                sysfs_attr_init(&handles->devattr.attr);
+                handles->devattr.attr.name = "handles";
+                handles->devattr.attr.mode = S_IRUGO;
+                handles->devattr.show = sony_nc_handles_show;
+
+                /* allow reading capabilities via sysfs */
+                if (device_create_file(&pd->dev, &handles->devattr)) {
+                        kfree(handles);
+                        handles = NULL;
+                        return -1;
+                }
         }
 
         return 0;
@@ -798,7 +802,8 @@ static int sony_nc_handles_setup(struct platform_device *pd)
 static int sony_nc_handles_cleanup(struct platform_device *pd)
 {
         if (handles) {
-                device_remove_file(&pd->dev, &handles->devattr);
+                if (debug)
+                        device_remove_file(&pd->dev, &handles->devattr);
                 kfree(handles);
                 handles = NULL;
         }
@@ -808,6 +813,11 @@ static int sony_nc_handles_cleanup(struct platform_device *pd)
 static int sony_find_snc_handle(int handle)
 {
         int i;
+
+        /* not initialized yet, return early */
+        if (!handles)
+                return -1;
+
         for (i = 0; i < 0x10; i++) {
                 if (handles->cap[i] == handle) {
                         dprintk("found handle 0x%.4x (offset: 0x%.2x)\n",
@@ -1168,6 +1178,9 @@ static int sony_nc_resume(struct acpi_device *device)
         /* re-read rfkill state */
         sony_nc_rfkill_update();
 
+        /* restore kbd backlight states */
+        sony_nc_kbd_backlight_resume();
+
         return 0;
 }
 
@@ -1355,6 +1368,7 @@ out_no_enum:
 #define KBDBL_HANDLER   0x137
 #define KBDBL_PRESENT   0xB00
 #define SET_MODE        0xC00
+#define SET_STATE       0xD00
 #define SET_TIMEOUT     0xE00
 
 struct kbd_backlight {
@@ -1377,6 +1391,10 @@ static ssize_t __sony_nc_kbd_backlight_mode_set(u8 value)
                                 (value << 0x10) | SET_MODE, &result))
                 return -EIO;
 
+        /* Try to turn the light on/off immediately */
+        sony_call_snc_handle(KBDBL_HANDLER, (value << 0x10) | SET_STATE,
+                        &result);
+
         kbdbl_handle->mode = value;
 
         return 0;
@@ -1458,7 +1476,7 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd)
 {
         int result;
 
-        if (sony_call_snc_handle(0x137, KBDBL_PRESENT, &result))
+        if (sony_call_snc_handle(KBDBL_HANDLER, KBDBL_PRESENT, &result))
                 return 0;
         if (!(result & 0x02))
                 return 0;
@@ -1501,13 +1519,36 @@ outkzalloc:
 static int sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
 {
         if (kbdbl_handle) {
+                int result;
+
                 device_remove_file(&pd->dev, &kbdbl_handle->mode_attr);
                 device_remove_file(&pd->dev, &kbdbl_handle->timeout_attr);
+
+                /* restore the default hw behaviour */
+                sony_call_snc_handle(KBDBL_HANDLER, 0x1000 | SET_MODE, &result);
+                sony_call_snc_handle(KBDBL_HANDLER, SET_TIMEOUT, &result);
+
                 kfree(kbdbl_handle);
         }
         return 0;
 }
 
+static void sony_nc_kbd_backlight_resume(void)
+{
+        int ignore = 0;
+
+        if (!kbdbl_handle)
+                return;
+
+        if (kbdbl_handle->mode == 0)
+                sony_call_snc_handle(KBDBL_HANDLER, SET_MODE, &ignore);
+
+        if (kbdbl_handle->timeout != 0)
+                sony_call_snc_handle(KBDBL_HANDLER,
+                                (kbdbl_handle->timeout << 0x10) | SET_TIMEOUT,
+                                &ignore);
+}
+
 static void sony_nc_backlight_setup(void)
 {
         acpi_handle unused;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index a08561f5349e..efb3b6b9bcdb 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -8618,8 +8618,7 @@ static bool __pure __init tpacpi_is_valid_fw_id(const char* const s,
                 tpacpi_is_fw_digit(s[1]) &&
                 s[2] == t && s[3] == 'T' &&
                 tpacpi_is_fw_digit(s[4]) &&
-                tpacpi_is_fw_digit(s[5]) &&
-                s[6] == 'W' && s[7] == 'W';
+                tpacpi_is_fw_digit(s[5]);
 }
 
 /* returns 0 - probe ok, or < 0 - probe error.
diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index c29719cacbca..86c9a091a2ff 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1171,16 +1171,17 @@ static int rio_hdid_setup(char *str)
 
 __setup("riohdid=", rio_hdid_setup);
 
-void rio_register_mport(struct rio_mport *port)
+int rio_register_mport(struct rio_mport *port)
 {
         if (next_portid >= RIO_MAX_MPORTS) {
                 pr_err("RIO: reached specified max number of mports\n");
-                return;
+                return 1;
         }
 
         port->id = next_portid++;
         port->host_deviceid = rio_get_hdid(port->id);
         list_add_tail(&port->node, &rio_mports);
+        return 0;
 }
 
 EXPORT_SYMBOL_GPL(rio_local_get_device_id);
diff --git a/drivers/rapidio/switches/idt_gen2.c b/drivers/rapidio/switches/idt_gen2.c
index 095016a9dec1..ac2701b22e71 100644
--- a/drivers/rapidio/switches/idt_gen2.c
+++ b/drivers/rapidio/switches/idt_gen2.c
@@ -418,3 +418,4 @@ DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTCPS1848, idtg2_switch_init);
 DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTCPS1616, idtg2_switch_init);
 DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTVPS1616, idtg2_switch_init);
 DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTSPS1616, idtg2_switch_init);
+DECLARE_RIO_SWITCH_INIT(RIO_VID_IDT, RIO_DID_IDTCPS1432, idtg2_switch_init);
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index 09b4437b3e61..39013867cbd6 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -171,7 +171,7 @@ struct rtc_device *rtc_device_register(const char *name, struct device *dev,
         err = __rtc_read_alarm(rtc, &alrm);
 
         if (!err && !rtc_valid_tm(&alrm.time))
-                rtc_set_alarm(rtc, &alrm);
+                rtc_initialize_alarm(rtc, &alrm);
 
         strlcpy(rtc->name, name, RTC_DEVICE_NAME_SIZE);
         dev_set_name(&rtc->dev, "rtc%d", id);
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 23719f0acbf6..ef6316acec43 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -375,6 +375,32 @@ int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
 }
 EXPORT_SYMBOL_GPL(rtc_set_alarm);
 
+/* Called once per device from rtc_device_register */
+int rtc_initialize_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+{
+        int err;
+
+        err = rtc_valid_tm(&alarm->time);
+        if (err != 0)
+                return err;
+
+        err = mutex_lock_interruptible(&rtc->ops_lock);
+        if (err)
+                return err;
+
+        rtc->aie_timer.node.expires = rtc_tm_to_ktime(alarm->time);
+        rtc->aie_timer.period = ktime_set(0, 0);
+        if (alarm->enabled) {
+                rtc->aie_timer.enabled = 1;
+                timerqueue_add(&rtc->timerqueue, &rtc->aie_timer.node);
+        }
+        mutex_unlock(&rtc->ops_lock);
+        return err;
+}
+EXPORT_SYMBOL_GPL(rtc_initialize_alarm);
+
+
+
 int rtc_alarm_irq_enable(struct rtc_device *rtc, unsigned int enabled)
 {
         int err = mutex_lock_interruptible(&rtc->ops_lock);
diff --git a/drivers/rtc/rtc-bfin.c b/drivers/rtc/rtc-bfin.c
index a0fc4cf42abf..90d866272c8e 100644
--- a/drivers/rtc/rtc-bfin.c
+++ b/drivers/rtc/rtc-bfin.c
@@ -250,6 +250,8 @@ static int bfin_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
                 bfin_rtc_int_set_alarm(rtc);
         else
                 bfin_rtc_int_clear(~(RTC_ISTAT_ALARM | RTC_ISTAT_ALARM_DAY));
+
+        return 0;
 }
 
 static int bfin_rtc_read_time(struct device *dev, struct rtc_time *tm)
diff --git a/drivers/rtc/rtc-coh901331.c b/drivers/rtc/rtc-coh901331.c
index 316f484999b5..80f9c88214c5 100644
--- a/drivers/rtc/rtc-coh901331.c
+++ b/drivers/rtc/rtc-coh901331.c
@@ -220,6 +220,7 @@ static int __init coh901331_probe(struct platform_device *pdev)
         }
         clk_disable(rtap->clk);
 
+        platform_set_drvdata(pdev, rtap);
         rtap->rtc = rtc_device_register("coh901331", &pdev->dev, &coh901331_ops,
                                          THIS_MODULE);
         if (IS_ERR(rtap->rtc)) {
@@ -227,11 +228,10 @@ static int __init coh901331_probe(struct platform_device *pdev)
                 goto out_no_rtc;
         }
 
-        platform_set_drvdata(pdev, rtap);
-
         return 0;
 
  out_no_rtc:
+        platform_set_drvdata(pdev, NULL);
  out_no_clk_enable:
         clk_put(rtap->clk);
  out_no_clk:
diff --git a/drivers/rtc/rtc-max8925.c b/drivers/rtc/rtc-max8925.c
index 174036dda786..20494b5edc3c 100644
--- a/drivers/rtc/rtc-max8925.c
+++ b/drivers/rtc/rtc-max8925.c
@@ -257,6 +257,8 @@ static int __devinit max8925_rtc_probe(struct platform_device *pdev)
                 goto out_irq;
         }
 
+        dev_set_drvdata(&pdev->dev, info);
+
         info->rtc_dev = rtc_device_register("max8925-rtc", &pdev->dev,
                                         &max8925_rtc_ops, THIS_MODULE);
         ret = PTR_ERR(info->rtc_dev);
@@ -265,7 +267,6 @@ static int __devinit max8925_rtc_probe(struct platform_device *pdev)
                 goto out_rtc;
         }
 
-        dev_set_drvdata(&pdev->dev, info);
         platform_set_drvdata(pdev, info);
 
         return 0;
diff --git a/drivers/rtc/rtc-mc13xxx.c b/drivers/rtc/rtc-mc13xxx.c
index c42006469559..c5ac03793e79 100644
--- a/drivers/rtc/rtc-mc13xxx.c
+++ b/drivers/rtc/rtc-mc13xxx.c
@@ -401,6 +401,7 @@ const struct platform_device_id mc13xxx_rtc_idtable[] = {
         }, {
                 .name = "mc13892-rtc",
         },
+        { }
 };
 
 static struct platform_driver mc13xxx_rtc_driver = {
diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
index de0dd7b1f146..bcae8dd41496 100644
--- a/drivers/rtc/rtc-omap.c
+++ b/drivers/rtc/rtc-omap.c
@@ -394,7 +394,7 @@ static int __init omap_rtc_probe(struct platform_device *pdev)
         return 0;
 
 fail2:
-        free_irq(omap_rtc_timer, NULL);
+        free_irq(omap_rtc_timer, rtc);
 fail1:
         rtc_device_unregister(rtc);
 fail0:
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 714964913e5e..b3466c491cd3 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -336,7 +336,6 @@ static void s3c_rtc_release(struct device *dev)
 
         /* do not clear AIE here, it may be needed for wake */
 
-        s3c_rtc_setpie(dev, 0);
         free_irq(s3c_rtc_alarmno, rtc_dev);
         free_irq(s3c_rtc_tickno, rtc_dev);
 }
@@ -408,7 +407,6 @@ static int __devexit s3c_rtc_remove(struct platform_device *dev)
         platform_set_drvdata(dev, NULL);
         rtc_device_unregister(rtc);
 
-        s3c_rtc_setpie(&dev->dev, 0);
         s3c_rtc_setaie(&dev->dev, 0);
 
         clk_disable(rtc_clk);
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 4d2df2f76ea0..475e603fc584 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2314,15 +2314,14 @@ static void dasd_flush_request_queue(struct dasd_block *block)
 
 static int dasd_open(struct block_device *bdev, fmode_t mode)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
         struct dasd_device *base;
         int rc;
 
-        if (!block)
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
                 return -ENODEV;
 
-        base = block->base;
-        atomic_inc(&block->open_count);
+        atomic_inc(&base->block->open_count);
         if (test_bit(DASD_FLAG_OFFLINE, &base->flags)) {
                 rc = -ENODEV;
                 goto unlock;
@@ -2355,21 +2354,28 @@ static int dasd_open(struct block_device *bdev, fmode_t mode)
                 goto out;
         }
 
+        dasd_put_device(base);
         return 0;
 
 out:
         module_put(base->discipline->owner);
 unlock:
-        atomic_dec(&block->open_count);
+        atomic_dec(&base->block->open_count);
+        dasd_put_device(base);
         return rc;
 }
 
 static int dasd_release(struct gendisk *disk, fmode_t mode)
 {
-        struct dasd_block *block = disk->private_data;
+        struct dasd_device *base;
 
-        atomic_dec(&block->open_count);
-        module_put(block->base->discipline->owner);
+        base = dasd_device_from_gendisk(disk);
+        if (!base)
+                return -ENODEV;
+
+        atomic_dec(&base->block->open_count);
+        module_put(base->discipline->owner);
+        dasd_put_device(base);
         return 0;
 }
 
@@ -2378,20 +2384,20 @@ static int dasd_release(struct gendisk *disk, fmode_t mode)
  */
 static int dasd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 {
-        struct dasd_block *block;
         struct dasd_device *base;
 
-        block = bdev->bd_disk->private_data;
-        if (!block)
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
                 return -ENODEV;
-        base = block->base;
 
         if (!base->discipline ||
-            !base->discipline->fill_geometry)
+            !base->discipline->fill_geometry) {
+                dasd_put_device(base);
                 return -EINVAL;
-
-        base->discipline->fill_geometry(block, geo);
-        geo->start = get_start_sect(bdev) >> block->s2b_shift;
+        }
+        base->discipline->fill_geometry(base->block, geo);
+        geo->start = get_start_sect(bdev) >> base->block->s2b_shift;
+        dasd_put_device(base);
         return 0;
 }
 
@@ -2528,7 +2534,6 @@ void dasd_generic_remove(struct ccw_device *cdev)
         dasd_set_target_state(device, DASD_STATE_NEW);
         /* dasd_delete_device destroys the device reference. */
         block = device->block;
-        device->block = NULL;
         dasd_delete_device(device);
         /*
          * life cycle of block is bound to device, so delete it after
@@ -2650,7 +2655,6 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
         dasd_set_target_state(device, DASD_STATE_NEW);
         /* dasd_delete_device destroys the device reference. */
         block = device->block;
-        device->block = NULL;
         dasd_delete_device(device);
         /*
          * life cycle of block is bound to device, so delete it after
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index 42e1bf35f689..d71511c7850a 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -674,6 +674,36 @@ dasd_device_from_cdev(struct ccw_device *cdev)
         return device;
 }
 
+void dasd_add_link_to_gendisk(struct gendisk *gdp, struct dasd_device *device)
+{
+        struct dasd_devmap *devmap;
+
+        devmap = dasd_find_busid(dev_name(&device->cdev->dev));
+        if (IS_ERR(devmap))
+                return;
+        spin_lock(&dasd_devmap_lock);
+        gdp->private_data = devmap;
+        spin_unlock(&dasd_devmap_lock);
+}
+
+struct dasd_device *dasd_device_from_gendisk(struct gendisk *gdp)
+{
+        struct dasd_device *device;
+        struct dasd_devmap *devmap;
+
+        if (!gdp->private_data)
+                return NULL;
+        device = NULL;
+        spin_lock(&dasd_devmap_lock);
+        devmap = gdp->private_data;
+        if (devmap && devmap->device) {
+                device = devmap->device;
+                dasd_get_device(device);
+        }
+        spin_unlock(&dasd_devmap_lock);
+        return device;
+}
+
 /*
  * SECTION: files in sysfs
  */
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index 29143eda9dd9..85dddb1e4126 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -239,7 +239,6 @@ static void dasd_ext_handler(unsigned int ext_int_code,
         addr_t ip;
         int rc;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
         switch (ext_int_code >> 24) {
         case DASD_DIAG_CODE_31BIT:
                 ip = (addr_t) param32;
@@ -250,6 +249,7 @@ static void dasd_ext_handler(unsigned int ext_int_code,
         default:
                 return;
         }
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
         if (!ip) {              /* no intparm: unsolicited interrupt */
                 DBF_EVENT(DBF_NOTICE, "%s", "caught unsolicited "
                               "interrupt");
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index db8005d9f2fd..3ebdf5f92f8f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2037,7 +2037,7 @@ static void dasd_eckd_check_for_device_change(struct dasd_device *device,
                 return;
 
         /* summary unit check */
-        if ((sense[7] == 0x0D) &&
+        if ((sense[27] & DASD_SENSE_BIT_0) && (sense[7] == 0x0D) &&
             (scsw_dstat(&irb->scsw) & DEV_STAT_UNIT_CHECK)) {
                 dasd_alias_handle_summary_unit_check(device, irb);
                 return;
@@ -2053,7 +2053,8 @@ static void dasd_eckd_check_for_device_change(struct dasd_device *device,
         /* loss of device reservation is handled via base devices only
          * as alias devices may be used with several bases
          */
-        if (device->block && (sense[7] == 0x3F) &&
+        if (device->block && (sense[27] & DASD_SENSE_BIT_0) &&
+            (sense[7] == 0x3F) &&
             (scsw_dstat(&irb->scsw) & DEV_STAT_UNIT_CHECK) &&
             test_bit(DASD_FLAG_IS_RESERVED, &device->flags)) {
                 if (device->features & DASD_FEATURE_FAILONSLCK)
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index 5505bc07e1e7..19a1ff03d65e 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -73,7 +73,7 @@ int dasd_gendisk_alloc(struct dasd_block *block)
         if (base->features & DASD_FEATURE_READONLY ||
             test_bit(DASD_FLAG_DEVICE_RO, &base->flags))
                 set_disk_ro(gdp, 1);
-        gdp->private_data = block;
+        dasd_add_link_to_gendisk(gdp, base);
         gdp->queue = block->request_queue;
         block->gdp = gdp;
         set_capacity(block->gdp, 0);
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index df9f6999411d..d1e4f2c1264c 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -686,6 +686,9 @@ struct dasd_device *dasd_device_from_cdev(struct ccw_device *);
 struct dasd_device *dasd_device_from_cdev_locked(struct ccw_device *);
 struct dasd_device *dasd_device_from_devindex(int);
 
+void dasd_add_link_to_gendisk(struct gendisk *, struct dasd_device *);
+struct dasd_device *dasd_device_from_gendisk(struct gendisk *);
+
 int dasd_parse(void);
 int dasd_busid_known(const char *);
 
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 26075e95b1ba..72261e4c516d 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -42,16 +42,22 @@ dasd_ioctl_api_version(void __user *argp)
 static int
 dasd_ioctl_enable(struct block_device *bdev)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
-        dasd_enable_device(block->base);
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+
+        dasd_enable_device(base);
         /* Formatting the dasd device can change the capacity. */
         mutex_lock(&bdev->bd_mutex);
-        i_size_write(bdev->bd_inode, (loff_t)get_capacity(block->gdp) << 9);
+        i_size_write(bdev->bd_inode,
+                     (loff_t)get_capacity(base->block->gdp) << 9);
         mutex_unlock(&bdev->bd_mutex);
+        dasd_put_device(base);
         return 0;
 }
 
@@ -62,11 +68,14 @@ dasd_ioctl_enable(struct block_device *bdev)
 static int
 dasd_ioctl_disable(struct block_device *bdev)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
         /*
          * Man this is sick. We don't do a real disable but only downgrade
          * the device to DASD_STATE_BASIC. The reason is that dasdfmt uses
@@ -75,7 +84,7 @@ dasd_ioctl_disable(struct block_device *bdev)
          * using the BIODASDFMT ioctl. Therefore the correct state for the
          * device is DASD_STATE_BASIC that allows to do basic i/o.
          */
-        dasd_set_target_state(block->base, DASD_STATE_BASIC);
+        dasd_set_target_state(base, DASD_STATE_BASIC);
         /*
          * Set i_size to zero, since read, write, etc. check against this
          * value.
@@ -83,6 +92,7 @@ dasd_ioctl_disable(struct block_device *bdev)
         mutex_lock(&bdev->bd_mutex);
         i_size_write(bdev->bd_inode, 0);
         mutex_unlock(&bdev->bd_mutex);
+        dasd_put_device(base);
         return 0;
 }
 
@@ -191,26 +201,36 @@ static int dasd_format(struct dasd_block *block, struct format_data_t *fdata)
 static int
 dasd_ioctl_format(struct block_device *bdev, void __user *argp)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
         struct format_data_t fdata;
+        int rc;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
         if (!argp)
                 return -EINVAL;
-
-        if (block->base->features & DASD_FEATURE_READONLY ||
-            test_bit(DASD_FLAG_DEVICE_RO, &block->base->flags))
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        if (base->features & DASD_FEATURE_READONLY ||
+            test_bit(DASD_FLAG_DEVICE_RO, &base->flags)) {
+                dasd_put_device(base);
                 return -EROFS;
-        if (copy_from_user(&fdata, argp, sizeof(struct format_data_t)))
+        }
+        if (copy_from_user(&fdata, argp, sizeof(struct format_data_t))) {
+                dasd_put_device(base);
                 return -EFAULT;
+        }
         if (bdev != bdev->bd_contains) {
                 pr_warning("%s: The specified DASD is a partition and cannot "
                            "be formatted\n",
-                           dev_name(&block->base->cdev->dev));
+                           dev_name(&base->cdev->dev));
+                dasd_put_device(base);
                 return -EINVAL;
         }
-        return dasd_format(block, &fdata);
+        rc = dasd_format(base->block, &fdata);
+        dasd_put_device(base);
+        return rc;
 }
 
 #ifdef CONFIG_DASD_PROFILE
@@ -340,8 +360,8 @@ static int dasd_ioctl_information(struct dasd_block *block,
 static int
 dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
 {
-        struct dasd_block *block =  bdev->bd_disk->private_data;
-        int intval;
+        struct dasd_device *base;
+        int intval, rc;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -350,10 +370,17 @@ dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
                 return -EINVAL;
         if (get_user(intval, (int __user *)argp))
                 return -EFAULT;
-        if (!intval && test_bit(DASD_FLAG_DEVICE_RO, &block->base->flags))
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        if (!intval && test_bit(DASD_FLAG_DEVICE_RO, &base->flags)) {
+                dasd_put_device(base);
                 return -EROFS;
+        }
         set_disk_ro(bdev->bd_disk, intval);
-        return dasd_set_feature(block->base->cdev, DASD_FEATURE_READONLY, intval);
+        rc = dasd_set_feature(base->cdev, DASD_FEATURE_READONLY, intval);
+        dasd_put_device(base);
+        return rc;
 }
 
 static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
@@ -372,59 +399,78 @@ static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
 int dasd_ioctl(struct block_device *bdev, fmode_t mode,
                unsigned int cmd, unsigned long arg)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_block *block;
+        struct dasd_device *base;
         void __user *argp;
+        int rc;
 
         if (is_compat_task())
                 argp = compat_ptr(arg);
         else
                 argp = (void __user *)arg;
 
-        if (!block)
-                return -ENODEV;
-
         if ((_IOC_DIR(cmd) != _IOC_NONE) && !arg) {
                 PRINT_DEBUG("empty data ptr");
                 return -EINVAL;
         }
 
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        block = base->block;
+        rc = 0;
         switch (cmd) {
         case BIODASDDISABLE:
-                return dasd_ioctl_disable(bdev);
+                rc = dasd_ioctl_disable(bdev);
+                break;
         case BIODASDENABLE:
-                return dasd_ioctl_enable(bdev);
+                rc = dasd_ioctl_enable(bdev);
+                break;
         case BIODASDQUIESCE:
-                return dasd_ioctl_quiesce(block);
+                rc = dasd_ioctl_quiesce(block);
+                break;
         case BIODASDRESUME:
-                return dasd_ioctl_resume(block);
+                rc = dasd_ioctl_resume(block);
+                break;
         case BIODASDFMT:
-                return dasd_ioctl_format(bdev, argp);
+                rc = dasd_ioctl_format(bdev, argp);
+                break;
         case BIODASDINFO:
-                return dasd_ioctl_information(block, cmd, argp);
+                rc = dasd_ioctl_information(block, cmd, argp);
+                break;
         case BIODASDINFO2:
-                return dasd_ioctl_information(block, cmd, argp);
+                rc = dasd_ioctl_information(block, cmd, argp);
+                break;
         case BIODASDPRRD:
-                return dasd_ioctl_read_profile(block, argp);
+                rc = dasd_ioctl_read_profile(block, argp);
+                break;
         case BIODASDPRRST:
-                return dasd_ioctl_reset_profile(block);
+                rc = dasd_ioctl_reset_profile(block);
+                break;
         case BLKROSET:
-                return dasd_ioctl_set_ro(bdev, argp);
+                rc = dasd_ioctl_set_ro(bdev, argp);
+                break;
         case DASDAPIVER:
-                return dasd_ioctl_api_version(argp);
+                rc = dasd_ioctl_api_version(argp);
+                break;
         case BIODASDCMFENABLE:
-                return enable_cmf(block->base->cdev);
+                rc = enable_cmf(base->cdev);
+                break;
         case BIODASDCMFDISABLE:
-                return disable_cmf(block->base->cdev);
+                rc = disable_cmf(base->cdev);
+                break;
         case BIODASDREADALLCMB:
-                return dasd_ioctl_readall_cmb(block, cmd, argp);
+                rc = dasd_ioctl_readall_cmb(block, cmd, argp);
+                break;
         default:
                 /* if the discipline has an ioctl method try it. */
-                if (block->base->discipline->ioctl) {
-                        int rval = block->base->discipline->ioctl(block, cmd, argp);
-                        if (rval != -ENOIOCTLCMD)
-                                return rval;
-                }
-
-                return -EINVAL;
+                if (base->discipline->ioctl) {
+                        rc = base->discipline->ioctl(block, cmd, argp);
+                        if (rc == -ENOIOCTLCMD)
+                                rc = -EINVAL;
+                } else
+                        rc = -EINVAL;
         }
+        dasd_put_device(base);
+        return rc;
 }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index c532ba929ccd..e8f267eb8887 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -407,8 +407,11 @@ static inline void account_sbals(struct qdio_q *q, int count)
         q->q_stats.nr_sbals[pos]++;
 }
 
-static void announce_buffer_error(struct qdio_q *q, int count)
+static void process_buffer_error(struct qdio_q *q, int count)
 {
+        unsigned char state = (q->is_input_q) ? SLSB_P_INPUT_NOT_INIT :
+                                        SLSB_P_OUTPUT_NOT_INIT;
+
         q->qdio_error |= QDIO_ERROR_SLSB_STATE;
 
         /* special handling for no target buffer empty */
@@ -426,6 +429,12 @@ static void announce_buffer_error(struct qdio_q *q, int count)
         DBF_ERROR("F14:%2x F15:%2x",
                   q->sbal[q->first_to_check]->element[14].flags & 0xff,
                   q->sbal[q->first_to_check]->element[15].flags & 0xff);
+
+        /*
+         * Interrupts may be avoided as long as the error is present
+         * so change the buffer state immediately to avoid starvation.
+         */
+        set_buf_states(q, q->first_to_check, state, count);
 }
 
 static inline void inbound_primed(struct qdio_q *q, int count)
@@ -506,8 +515,7 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
                         account_sbals(q, count);
                 break;
         case SLSB_P_INPUT_ERROR:
-                announce_buffer_error(q, count);
-                /* process the buffer, the upper layer will take care of it */
+                process_buffer_error(q, count);
                 q->first_to_check = add_buf(q->first_to_check, count);
                 atomic_sub(count, &q->nr_buf_used);
                 if (q->irq_ptr->perf_stat_enabled)
@@ -677,8 +685,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
                         account_sbals(q, count);
                 break;
         case SLSB_P_OUTPUT_ERROR:
-                announce_buffer_error(q, count);
-                /* process the buffer, the upper layer will take care of it */
+                process_buffer_error(q, count);
                 q->first_to_check = add_buf(q->first_to_check, count);
                 atomic_sub(count, &q->nr_buf_used);
                 if (q->irq_ptr->perf_stat_enabled)
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/kvm/kvm_virtio.c
index 414427d64a8f..607998f0b7d8 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/kvm/kvm_virtio.c
@@ -381,10 +381,10 @@ static void kvm_extint_handler(unsigned int ext_int_code,
         u16 subcode;
         u32 param;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
         subcode = ext_int_code >> 16;
         if ((subcode & 0xff00) != VIRTIO_SUBCODE_64)
                 return;
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
 
         /* The LSB might be overloaded, we have to mask it */
         vq = (struct virtqueue *)(param64 & ~1UL);
diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
index 564e6ecd17c2..0119b8147797 100644
--- a/drivers/scsi/device_handler/scsi_dh.c
+++ b/drivers/scsi/device_handler/scsi_dh.c
@@ -394,12 +394,14 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
         unsigned long flags;
         struct scsi_device *sdev;
         struct scsi_device_handler *scsi_dh = NULL;
+        struct device *dev = NULL;
 
         spin_lock_irqsave(q->queue_lock, flags);
         sdev = q->queuedata;
         if (sdev && sdev->scsi_dh_data)
                 scsi_dh = sdev->scsi_dh_data->scsi_dh;
-        if (!scsi_dh || !get_device(&sdev->sdev_gendev) ||
+        dev = get_device(&sdev->sdev_gendev);
+        if (!scsi_dh || !dev ||
             sdev->sdev_state == SDEV_CANCEL ||
             sdev->sdev_state == SDEV_DEL)
                 err = SCSI_DH_NOSYS;
@@ -410,12 +412,13 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
         if (err) {
                 if (fn)
                         fn(data, err);
-                return err;
+                goto out;
         }
 
         if (scsi_dh->activate)
                 err = scsi_dh->activate(sdev, fn, data);
-        put_device(&sdev->sdev_gendev);
+out:
+        put_device(dev);
         return err;
 }
 EXPORT_SYMBOL_GPL(scsi_dh_activate);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index 1c6d2b405eef..d72f1f2b1392 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
                 goto out;
         }
 
+        /* Check for overflow and wraparound */
+        if (karg.data_sge_offset * 4 > ioc->request_sz ||
+            karg.data_sge_offset > (UINT_MAX / 4)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         /* copy in request message frame from user */
         if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
                 printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
@@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
         Mpi2DiagBufferPostReply_t *mpi_reply;
         int rc, i;
         u8 buffer_type;
-        unsigned long timeleft;
+        unsigned long timeleft, request_size, copy_size;
         u16 smid;
         u16 ioc_status;
         u8 issue_reset = 0;
@@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
                 return -ENOMEM;
         }
 
+        request_size = ioc->diag_buffer_sz[buffer_type];
+
         if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
                 printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
                     "or bytes_to_read are not 4 byte aligned\n", ioc->name,
@@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
                 return -EINVAL;
         }
 
+        if (karg.starting_offset > request_size)
+                return -EINVAL;
+
         diag_data = (void *)(request_data + karg.starting_offset);
         dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), "
             "offset(%d), sz(%d)\n", ioc->name, __func__,
             diag_data, karg.starting_offset, karg.bytes_to_read));
 
+        /* Truncate data on requests that are too large */
+        if ((diag_data + karg.bytes_to_read < diag_data) ||
+            (diag_data + karg.bytes_to_read > request_data + request_size))
+                copy_size = request_size - karg.starting_offset;
+        else
+                copy_size = karg.bytes_to_read;
+
         if (copy_to_user((void __user *)uarg->diagnostic_data,
-            diag_data, karg.bytes_to_read)) {
+            diag_data, copy_size)) {
                 printk(MPT2SAS_ERR_FMT "%s: Unable to write "
                     "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
                     __func__, diag_data);
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 96d5ad0c1e42..7f636b118287 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3814,6 +3814,9 @@ static long pmcraid_ioctl_passthrough(
                         rc = -EFAULT;
                         goto out_free_buffer;
                 }
+        } else if (request_size < 0) {
+                rc = -EINVAL;
+                goto out_free_buffer;
         }
 
         /* check if we have any additional command parameters */
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 6d5c7ff43f5b..e9901b8f8443 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -411,8 +411,6 @@ static void scsi_run_queue(struct request_queue *q)
         list_splice_init(&shost->starved_list, &starved_list);
 
         while (!list_empty(&starved_list)) {
-                int flagset;
-
                 /*
                  * As long as shost is accepting commands and we have
                  * starved queues, call blk_run_queue. scsi_request_fn
@@ -435,20 +433,7 @@ static void scsi_run_queue(struct request_queue *q)
                         continue;
                 }
 
-                spin_unlock(shost->host_lock);
-
-                spin_lock(sdev->request_queue->queue_lock);
-                flagset = test_bit(QUEUE_FLAG_REENTER, &q->queue_flags) &&
-                                !test_bit(QUEUE_FLAG_REENTER,
-                                        &sdev->request_queue->queue_flags);
-                if (flagset)
-                        queue_flag_set(QUEUE_FLAG_REENTER, sdev->request_queue);
-                __blk_run_queue(sdev->request_queue, false);
-                if (flagset)
-                        queue_flag_clear(QUEUE_FLAG_REENTER, sdev->request_queue);
-                spin_unlock(sdev->request_queue->queue_lock);
-
-                spin_lock(shost->host_lock);
+                blk_run_queue_async(sdev->request_queue);
         }
         /* put any unprocessed entries back */
         list_splice(&starved_list, &shost->starved_list);
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index e44ff64233fd..e63912510fb9 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -322,14 +322,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
                 kfree(evt);
         }
 
-        if (sdev->request_queue) {
-                sdev->request_queue->queuedata = NULL;
-                /* user context needed to free queue */
-                scsi_free_queue(sdev->request_queue);
-                /* temporary expedient, try to catch use of queue lock
-                 * after free of sdev */
-                sdev->request_queue = NULL;
-        }
+        /* NULL queue means the device can't be used */
+        sdev->request_queue = NULL;
 
         scsi_target_reap(scsi_target(sdev));
 
@@ -937,6 +931,12 @@ void __scsi_remove_device(struct scsi_device *sdev)
         if (sdev->host->hostt->slave_destroy)
                 sdev->host->hostt->slave_destroy(sdev);
         transport_destroy_device(dev);
+
+        /* cause the request function to reject all I/O requests */
+        sdev->request_queue->queuedata = NULL;
+
+        /* Freeing the queue signals to block that we're done */
+        scsi_free_queue(sdev->request_queue);
         put_device(dev);
 }
 
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index fdf3fa639056..815069d13f9b 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3816,28 +3816,17 @@ fail_host_msg:
 static void
 fc_bsg_goose_queue(struct fc_rport *rport)
 {
-        int flagset;
-        unsigned long flags;
-
         if (!rport->rqst_q)
                 return;
 
+        /*
+         * This get/put dance makes no sense
+         */
         get_device(&rport->dev);
-
-        spin_lock_irqsave(rport->rqst_q->queue_lock, flags);
-        flagset = test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags) &&
-                  !test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags);
-        if (flagset)
-                queue_flag_set(QUEUE_FLAG_REENTER, rport->rqst_q);
-        __blk_run_queue(rport->rqst_q, false);
-        if (flagset)
-                queue_flag_clear(QUEUE_FLAG_REENTER, rport->rqst_q);
-        spin_unlock_irqrestore(rport->rqst_q->queue_lock, flags);
-
+        blk_run_queue_async(rport->rqst_q);
         put_device(&rport->dev);
 }
 
-
 /**
  * fc_bsg_rport_dispatch - process rport bsg requests and dispatch to LLDD
  * @q:          rport request queue
diff --git a/drivers/spi/amba-pl022.c b/drivers/spi/amba-pl022.c
index 5825370bad25..08de58e7f59f 100644
--- a/drivers/spi/amba-pl022.c
+++ b/drivers/spi/amba-pl022.c
@@ -1555,7 +1555,7 @@ static int stop_queue(struct pl022 *pl022)
          * A wait_queue on the pl022->busy could be used, but then the common
          * execution path (pump_messages) would be required to call wake_up or
          * friends on every SPI message. Do this instead */
-        while (!list_empty(&pl022->queue) && pl022->busy && limit--) {
+        while ((!list_empty(&pl022->queue) || pl022->busy) && limit--) {
                 spin_unlock_irqrestore(&pl022->queue_lock, flags);
                 msleep(10);
                 spin_lock_irqsave(&pl022->queue_lock, flags);
diff --git a/drivers/spi/dw_spi.c b/drivers/spi/dw_spi.c
index b1a4b9f503ae..871e337c917f 100644
--- a/drivers/spi/dw_spi.c
+++ b/drivers/spi/dw_spi.c
@@ -821,7 +821,7 @@ static int stop_queue(struct dw_spi *dws)
 
         spin_lock_irqsave(&dws->lock, flags);
         dws->run = QUEUE_STOPPED;
-        while (!list_empty(&dws->queue) && dws->busy && limit--) {
+        while ((!list_empty(&dws->queue) || dws->busy) && limit--) {
                 spin_unlock_irqrestore(&dws->lock, flags);
                 msleep(10);
                 spin_lock_irqsave(&dws->lock, flags);
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 9c74aad6be93..dc25bee8d33f 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1493,7 +1493,7 @@ static int stop_queue(struct driver_data *drv_data)
          * execution path (pump_messages) would be required to call wake_up or
          * friends on every SPI message. Do this instead */
         drv_data->run = QUEUE_STOPPED;
-        while (!list_empty(&drv_data->queue) && drv_data->busy && limit--) {
+        while ((!list_empty(&drv_data->queue) || drv_data->busy) && limit--) {
                 spin_unlock_irqrestore(&drv_data->lock, flags);
                 msleep(10);
                 spin_lock_irqsave(&drv_data->lock, flags);
diff --git a/drivers/spi/spi_bfin5xx.c b/drivers/spi/spi_bfin5xx.c
index bdb7289a1d22..f706dba165cf 100644
--- a/drivers/spi/spi_bfin5xx.c
+++ b/drivers/spi/spi_bfin5xx.c
@@ -1284,7 +1284,7 @@ static inline int bfin_spi_stop_queue(struct bfin_spi_master_data *drv_data)
          * friends on every SPI message. Do this instead
          */
         drv_data->running = false;
-        while (!list_empty(&drv_data->queue) && drv_data->busy && limit--) {
+        while ((!list_empty(&drv_data->queue) || drv_data->busy) && limit--) {
                 spin_unlock_irqrestore(&drv_data->lock, flags);
                 msleep(10);
                 spin_lock_irqsave(&drv_data->lock, flags);
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index dca4a0bb6ca9..e3786f161bc3 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -131,8 +131,6 @@ source "drivers/staging/wlags49_h2/Kconfig"
 
 source "drivers/staging/wlags49_h25/Kconfig"
 
-source "drivers/staging/samsung-laptop/Kconfig"
-
 source "drivers/staging/sm7xx/Kconfig"
 
 source "drivers/staging/dt3155v4l/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index eb93012b6f59..f0d5c5315612 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -48,7 +48,6 @@ obj-$(CONFIG_XVMALLOC)		+= zram/
 obj-$(CONFIG_ZCACHE)            += zcache/
 obj-$(CONFIG_WLAGS49_H2)        += wlags49_h2/
 obj-$(CONFIG_WLAGS49_H25)       += wlags49_h25/
-obj-$(CONFIG_SAMSUNG_LAPTOP)    += samsung-laptop/
 obj-$(CONFIG_FB_SM7XX)          += sm7xx/
 obj-$(CONFIG_VIDEO_DT3155)      += dt3155v4l/
 obj-$(CONFIG_CRYSTALHD)         += crystalhd/
diff --git a/drivers/staging/rt2860/common/cmm_data_pci.c b/drivers/staging/rt2860/common/cmm_data_pci.c
index bef0bbd8cef7..f01a51c381f1 100644
--- a/drivers/staging/rt2860/common/cmm_data_pci.c
+++ b/drivers/staging/rt2860/common/cmm_data_pci.c
@@ -444,7 +444,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                         return (NDIS_STATUS_FAILURE);
                 }
         }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
         /* I am kind of doubting the U2M bit operation */
         /* if (pRxD->U2M == 0) */
         /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/rt2860/common/cmm_data_usb.c b/drivers/staging/rt2860/common/cmm_data_usb.c
index 5637857ae9eb..83a62faa7e57 100644
--- a/drivers/staging/rt2860/common/cmm_data_usb.c
+++ b/drivers/staging/rt2860/common/cmm_data_usb.c
@@ -860,7 +860,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("received packet too long\n"));
                 return NDIS_STATUS_FAILURE;
         }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
         /* I am kind of doubting the U2M bit operation */
         /* if (pRxD->U2M == 0) */
         /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/samsung-laptop/Kconfig b/drivers/staging/samsung-laptop/Kconfig
deleted file mode 100644
index f27c60864c26..000000000000
--- a/drivers/staging/samsung-laptop/Kconfig
+++ /dev/null
@@ -1,10 +0,0 @@
-config SAMSUNG_LAPTOP
-        tristate "Samsung Laptop driver"
-        default n
-        depends on RFKILL && BACKLIGHT_CLASS_DEVICE && X86
-        help
-          This module implements a driver for the N128 Samsung Laptop
-          providing control over the Wireless LED and the LCD backlight
-
-          To compile this driver as a module, choose
-          M here: the module will be called samsung-laptop.
diff --git a/drivers/staging/samsung-laptop/Makefile b/drivers/staging/samsung-laptop/Makefile
deleted file mode 100644
index 3c6f42045211..000000000000
--- a/drivers/staging/samsung-laptop/Makefile
+++ /dev/null
@@ -1 +0,0 @@
-obj-$(CONFIG_SAMSUNG_LAPTOP)    += samsung-laptop.o
diff --git a/drivers/staging/samsung-laptop/TODO b/drivers/staging/samsung-laptop/TODO
deleted file mode 100644
index f7a6d589916e..000000000000
--- a/drivers/staging/samsung-laptop/TODO
+++ /dev/null
@@ -1,5 +0,0 @@
-TODO:
-        - review from other developers
-        - figure out ACPI video issues
-
-Please send patches to Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/drivers/staging/samsung-laptop/samsung-laptop.c b/drivers/staging/samsung-laptop/samsung-laptop.c
deleted file mode 100644
index 25294462b8b6..000000000000
--- a/drivers/staging/samsung-laptop/samsung-laptop.c
+++ /dev/null
@@ -1,843 +0,0 @@
-/*
- * Samsung Laptop driver
- *
- * Copyright (C) 2009,2011 Greg Kroah-Hartman (gregkh@suse.de)
- * Copyright (C) 2009,2011 Novell Inc.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/delay.h>
-#include <linux/pci.h>
-#include <linux/backlight.h>
-#include <linux/fb.h>
-#include <linux/dmi.h>
-#include <linux/platform_device.h>
-#include <linux/rfkill.h>
-
-/*
- * This driver is needed because a number of Samsung laptops do not hook
- * their control settings through ACPI.  So we have to poke around in the
- * BIOS to do things like brightness values, and "special" key controls.
- */
-
-/*
- * We have 0 - 8 as valid brightness levels.  The specs say that level 0 should
- * be reserved by the BIOS (which really doesn't make much sense), we tell
- * userspace that the value is 0 - 7 and then just tell the hardware 1 - 8
- */
-#define MAX_BRIGHT      0x07
-
-
-#define SABI_IFACE_MAIN                 0x00
-#define SABI_IFACE_SUB                  0x02
-#define SABI_IFACE_COMPLETE             0x04
-#define SABI_IFACE_DATA                 0x05
-
-/* Structure to get data back to the calling function */
-struct sabi_retval {
-        u8 retval[20];
-};
-
-struct sabi_header_offsets {
-        u8 port;
-        u8 re_mem;
-        u8 iface_func;
-        u8 en_mem;
-        u8 data_offset;
-        u8 data_segment;
-};
-
-struct sabi_commands {
-        /*
-         * Brightness is 0 - 8, as described above.
-         * Value 0 is for the BIOS to use
-         */
-        u8 get_brightness;
-        u8 set_brightness;
-
-        /*
-         * first byte:
-         * 0x00 - wireless is off
-         * 0x01 - wireless is on
-         * second byte:
-         * 0x02 - 3G is off
-         * 0x03 - 3G is on
-         * TODO, verify 3G is correct, that doesn't seem right...
-         */
-        u8 get_wireless_button;
-        u8 set_wireless_button;
-
-        /* 0 is off, 1 is on */
-        u8 get_backlight;
-        u8 set_backlight;
-
-        /*
-         * 0x80 or 0x00 - no action
-         * 0x81 - recovery key pressed
-         */
-        u8 get_recovery_mode;
-        u8 set_recovery_mode;
-
-        /*
-         * on seclinux: 0 is low, 1 is high,
-         * on swsmi: 0 is normal, 1 is silent, 2 is turbo
-         */
-        u8 get_performance_level;
-        u8 set_performance_level;
-
-        /*
-         * Tell the BIOS that Linux is running on this machine.
-         * 81 is on, 80 is off
-         */
-        u8 set_linux;
-};
-
-struct sabi_performance_level {
-        const char *name;
-        u8 value;
-};
-
-struct sabi_config {
-        const char *test_string;
-        u16 main_function;
-        const struct sabi_header_offsets header_offsets;
-        const struct sabi_commands commands;
-        const struct sabi_performance_level performance_levels[4];
-        u8 min_brightness;
-        u8 max_brightness;
-};
-
-static const struct sabi_config sabi_configs[] = {
-        {
-                .test_string = "SECLINUX",
-
-                .main_function = 0x4c49,
-
-                .header_offsets = {
-                        .port = 0x00,
-                        .re_mem = 0x02,
-                        .iface_func = 0x03,
-                        .en_mem = 0x04,
-                        .data_offset = 0x05,
-                        .data_segment = 0x07,
-                },
-
-                .commands = {
-                        .get_brightness = 0x00,
-                        .set_brightness = 0x01,
-
-                        .get_wireless_button = 0x02,
-                        .set_wireless_button = 0x03,
-
-                        .get_backlight = 0x04,
-                        .set_backlight = 0x05,
-
-                        .get_recovery_mode = 0x06,
-                        .set_recovery_mode = 0x07,
-
-                        .get_performance_level = 0x08,
-                        .set_performance_level = 0x09,
-
-                        .set_linux = 0x0a,
-                },
-
-                .performance_levels = {
-                        {
-                                .name = "silent",
-                                .value = 0,
-                        },
-                        {
-                                .name = "normal",
-                                .value = 1,
-                        },
-                        { },
-                },
-                .min_brightness = 1,
-                .max_brightness = 8,
-        },
-        {
-                .test_string = "SwSmi@",
-
-                .main_function = 0x5843,
-
-                .header_offsets = {
-                        .port = 0x00,
-                        .re_mem = 0x04,
-                        .iface_func = 0x02,
-                        .en_mem = 0x03,
-                        .data_offset = 0x05,
-                        .data_segment = 0x07,
-                },
-
-                .commands = {
-                        .get_brightness = 0x10,
-                        .set_brightness = 0x11,
-
-                        .get_wireless_button = 0x12,
-                        .set_wireless_button = 0x13,
-
-                        .get_backlight = 0x2d,
-                        .set_backlight = 0x2e,
-
-                        .get_recovery_mode = 0xff,
-                        .set_recovery_mode = 0xff,
-
-                        .get_performance_level = 0x31,
-                        .set_performance_level = 0x32,
-
-                        .set_linux = 0xff,
-                },
-
-                .performance_levels = {
-                        {
-                                .name = "normal",
-                                .value = 0,
-                        },
-                        {
-                                .name = "silent",
-                                .value = 1,
-                        },
-                        {
-                                .name = "overclock",
-                                .value = 2,
-                        },
-                        { },
-                },
-                .min_brightness = 0,
-                .max_brightness = 8,
-        },
-        { },
-};
-
-static const struct sabi_config *sabi_config;
-
-static void __iomem *sabi;
-static void __iomem *sabi_iface;
-static void __iomem *f0000_segment;
-static struct backlight_device *backlight_device;
-static struct mutex sabi_mutex;
-static struct platform_device *sdev;
-static struct rfkill *rfk;
-
-static int force;
-module_param(force, bool, 0);
-MODULE_PARM_DESC(force,
-                "Disable the DMI check and forces the driver to be loaded");
-
-static int debug;
-module_param(debug, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(debug, "Debug enabled or not");
-
-static int sabi_get_command(u8 command, struct sabi_retval *sretval)
-{
-        int retval = 0;
-        u16 port = readw(sabi + sabi_config->header_offsets.port);
-        u8 complete, iface_data;
-
-        mutex_lock(&sabi_mutex);
-
-        /* enable memory to be able to write to it */
-        outb(readb(sabi + sabi_config->header_offsets.en_mem), port);
-
-        /* write out the command */
-        writew(sabi_config->main_function, sabi_iface + SABI_IFACE_MAIN);
-        writew(command, sabi_iface + SABI_IFACE_SUB);
-        writeb(0, sabi_iface + SABI_IFACE_COMPLETE);
-        outb(readb(sabi + sabi_config->header_offsets.iface_func), port);
-
-        /* write protect memory to make it safe */
-        outb(readb(sabi + sabi_config->header_offsets.re_mem), port);
-
-        /* see if the command actually succeeded */
-        complete = readb(sabi_iface + SABI_IFACE_COMPLETE);
-        iface_data = readb(sabi_iface + SABI_IFACE_DATA);
-        if (complete != 0xaa || iface_data == 0xff) {
-                pr_warn("SABI get command 0x%02x failed with completion flag 0x%02x and data 0x%02x\n",
-                        command, complete, iface_data);
-                retval = -EINVAL;
-                goto exit;
-        }
-        /*
-         * Save off the data into a structure so the caller use it.
-         * Right now we only want the first 4 bytes,
-         * There are commands that need more, but not for the ones we
-         * currently care about.
-         */
-        sretval->retval[0] = readb(sabi_iface + SABI_IFACE_DATA);
-        sretval->retval[1] = readb(sabi_iface + SABI_IFACE_DATA + 1);
-        sretval->retval[2] = readb(sabi_iface + SABI_IFACE_DATA + 2);
-        sretval->retval[3] = readb(sabi_iface + SABI_IFACE_DATA + 3);
-
-exit:
-        mutex_unlock(&sabi_mutex);
-        return retval;
-
-}
-
-static int sabi_set_command(u8 command, u8 data)
-{
-        int retval = 0;
-        u16 port = readw(sabi + sabi_config->header_offsets.port);
-        u8 complete, iface_data;
-
-        mutex_lock(&sabi_mutex);
-
-        /* enable memory to be able to write to it */
-        outb(readb(sabi + sabi_config->header_offsets.en_mem), port);
-
-        /* write out the command */
-        writew(sabi_config->main_function, sabi_iface + SABI_IFACE_MAIN);
-        writew(command, sabi_iface + SABI_IFACE_SUB);
-        writeb(0, sabi_iface + SABI_IFACE_COMPLETE);
-        writeb(data, sabi_iface + SABI_IFACE_DATA);
-        outb(readb(sabi + sabi_config->header_offsets.iface_func), port);
-
-        /* write protect memory to make it safe */
-        outb(readb(sabi + sabi_config->header_offsets.re_mem), port);
-
-        /* see if the command actually succeeded */
-        complete = readb(sabi_iface + SABI_IFACE_COMPLETE);
-        iface_data = readb(sabi_iface + SABI_IFACE_DATA);
-        if (complete != 0xaa || iface_data == 0xff) {
-                pr_warn("SABI set command 0x%02x failed with completion flag 0x%02x and data 0x%02x\n",
-                       command, complete, iface_data);
-                retval = -EINVAL;
-        }
-
-        mutex_unlock(&sabi_mutex);
-        return retval;
-}
-
-static void test_backlight(void)
-{
-        struct sabi_retval sretval;
-
-        sabi_get_command(sabi_config->commands.get_backlight, &sretval);
-        printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
-
-        sabi_set_command(sabi_config->commands.set_backlight, 0);
-        printk(KERN_DEBUG "backlight should be off\n");
-
-        sabi_get_command(sabi_config->commands.get_backlight, &sretval);
-        printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
-
-        msleep(1000);
-
-        sabi_set_command(sabi_config->commands.set_backlight, 1);
-        printk(KERN_DEBUG "backlight should be on\n");
-
-        sabi_get_command(sabi_config->commands.get_backlight, &sretval);
-        printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
-}
-
-static void test_wireless(void)
-{
-        struct sabi_retval sretval;
-
-        sabi_get_command(sabi_config->commands.get_wireless_button, &sretval);
-        printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
-
-        sabi_set_command(sabi_config->commands.set_wireless_button, 0);
-        printk(KERN_DEBUG "wireless led should be off\n");
-
-        sabi_get_command(sabi_config->commands.get_wireless_button, &sretval);
-        printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
-
-        msleep(1000);
-
-        sabi_set_command(sabi_config->commands.set_wireless_button, 1);
-        printk(KERN_DEBUG "wireless led should be on\n");
-
-        sabi_get_command(sabi_config->commands.get_wireless_button, &sretval);
-        printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
-}
-
-static u8 read_brightness(void)
-{
-        struct sabi_retval sretval;
-        int user_brightness = 0;
-        int retval;
-
-        retval = sabi_get_command(sabi_config->commands.get_brightness,
-                                  &sretval);
-        if (!retval) {
-                user_brightness = sretval.retval[0];
-                if (user_brightness != 0)
-                        user_brightness -= sabi_config->min_brightness;
-        }
-        return user_brightness;
-}
-
-static void set_brightness(u8 user_brightness)
-{
-        u8 user_level = user_brightness - sabi_config->min_brightness;
-
-        sabi_set_command(sabi_config->commands.set_brightness, user_level);
-}
-
-static int get_brightness(struct backlight_device *bd)
-{
-        return (int)read_brightness();
-}
-
-static int update_status(struct backlight_device *bd)
-{
-        set_brightness(bd->props.brightness);
-
-        if (bd->props.power == FB_BLANK_UNBLANK)
-                sabi_set_command(sabi_config->commands.set_backlight, 1);
-        else
-                sabi_set_command(sabi_config->commands.set_backlight, 0);
-        return 0;
-}
-
-static const struct backlight_ops backlight_ops = {
-        .get_brightness = get_brightness,
-        .update_status  = update_status,
-};
-
-static int rfkill_set(void *data, bool blocked)
-{
-        /* Do something with blocked...*/
-        /*
-         * blocked == false is on
-         * blocked == true is off
-         */
-        if (blocked)
-                sabi_set_command(sabi_config->commands.set_wireless_button, 0);
-        else
-                sabi_set_command(sabi_config->commands.set_wireless_button, 1);
-
-        return 0;
-}
-
-static struct rfkill_ops rfkill_ops = {
-        .set_block = rfkill_set,
-};
-
-static int init_wireless(struct platform_device *sdev)
-{
-        int retval;
-
-        rfk = rfkill_alloc("samsung-wifi", &sdev->dev, RFKILL_TYPE_WLAN,
-                           &rfkill_ops, NULL);
-        if (!rfk)
-                return -ENOMEM;
-
-        retval = rfkill_register(rfk);
-        if (retval) {
-                rfkill_destroy(rfk);
-                return -ENODEV;
-        }
-
-        return 0;
-}
-
-static void destroy_wireless(void)
-{
-        rfkill_unregister(rfk);
-        rfkill_destroy(rfk);
-}
-
-static ssize_t get_performance_level(struct device *dev,
-                                     struct device_attribute *attr, char *buf)
-{
-        struct sabi_retval sretval;
-        int retval;
-        int i;
-
-        /* Read the state */
-        retval = sabi_get_command(sabi_config->commands.get_performance_level,
-                                  &sretval);
-        if (retval)
-                return retval;
-
-        /* The logic is backwards, yeah, lots of fun... */
-        for (i = 0; sabi_config->performance_levels[i].name; ++i) {
-                if (sretval.retval[0] == sabi_config->performance_levels[i].value)
-                        return sprintf(buf, "%s\n", sabi_config->performance_levels[i].name);
-        }
-        return sprintf(buf, "%s\n", "unknown");
-}
-
-static ssize_t set_performance_level(struct device *dev,
-                                struct device_attribute *attr, const char *buf,
-                                size_t count)
-{
-        if (count >= 1) {
-                int i;
-                for (i = 0; sabi_config->performance_levels[i].name; ++i) {
-                        const struct sabi_performance_level *level =
-                                &sabi_config->performance_levels[i];
-                        if (!strncasecmp(level->name, buf, strlen(level->name))) {
-                                sabi_set_command(sabi_config->commands.set_performance_level,
-                                                 level->value);
-                                break;
-                        }
-                }
-                if (!sabi_config->performance_levels[i].name)
-                        return -EINVAL;
-        }
-        return count;
-}
-static DEVICE_ATTR(performance_level, S_IWUSR | S_IRUGO,
-                   get_performance_level, set_performance_level);
-
-
-static int __init dmi_check_cb(const struct dmi_system_id *id)
-{
-        pr_info("found laptop model '%s'\n",
-                id->ident);
-        return 0;
-}
-
-static struct dmi_system_id __initdata samsung_dmi_table[] = {
-        {
-                .ident = "N128",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N128"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N128"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "N130",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N130"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N130"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "X125",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "X125"),
-                        DMI_MATCH(DMI_BOARD_NAME, "X125"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "X120/X170",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "X120/X170"),
-                        DMI_MATCH(DMI_BOARD_NAME, "X120/X170"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "NC10",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
-                        DMI_MATCH(DMI_BOARD_NAME, "NC10"),
-                },
-                .callback = dmi_check_cb,
-        },
-                {
-                .ident = "NP-Q45",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "SQ45S70S"),
-                        DMI_MATCH(DMI_BOARD_NAME, "SQ45S70S"),
-                },
-                .callback = dmi_check_cb,
-                },
-        {
-                .ident = "X360",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "X360"),
-                        DMI_MATCH(DMI_BOARD_NAME, "X360"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R410 Plus",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "R410P"),
-                        DMI_MATCH(DMI_BOARD_NAME, "R460"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R518",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "R518"),
-                        DMI_MATCH(DMI_BOARD_NAME, "R518"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R519/R719",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "R519/R719"),
-                        DMI_MATCH(DMI_BOARD_NAME, "R519/R719"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "N150/N210/N220/N230",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N150/N210/N220/N230"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N150/N210/N220/N230"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "N150P/N210P/N220P",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N150P/N210P/N220P"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N150P/N210P/N220P"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R530/R730",
-                .matches = {
-                      DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-                      DMI_MATCH(DMI_PRODUCT_NAME, "R530/R730"),
-                      DMI_MATCH(DMI_BOARD_NAME, "R530/R730"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "NF110/NF210/NF310",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "NF110/NF210/NF310"),
-                        DMI_MATCH(DMI_BOARD_NAME, "NF110/NF210/NF310"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "N145P/N250P/N260P",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N145P/N250P/N260P"),
-                        DMI_MATCH(DMI_BOARD_NAME, "N145P/N250P/N260P"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "R70/R71",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR,
-                                        "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "R70/R71"),
-                        DMI_MATCH(DMI_BOARD_NAME, "R70/R71"),
-                },
-                .callback = dmi_check_cb,
-        },
-        {
-                .ident = "P460",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "P460"),
-                        DMI_MATCH(DMI_BOARD_NAME, "P460"),
-                },
-                .callback = dmi_check_cb,
-        },
-        { },
-};
-MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
-
-static int find_signature(void __iomem *memcheck, const char *testStr)
-{
-        int i = 0;
-        int loca;
-
-        for (loca = 0; loca < 0xffff; loca++) {
-                char temp = readb(memcheck + loca);
-
-                if (temp == testStr[i]) {
-                        if (i == strlen(testStr)-1)
-                                break;
-                        ++i;
-                } else {
-                        i = 0;
-                }
-        }
-        return loca;
-}
-
-static int __init samsung_init(void)
-{
-        struct backlight_properties props;
-        struct sabi_retval sretval;
-        unsigned int ifaceP;
-        int i;
-        int loca;
-        int retval;
-
-        mutex_init(&sabi_mutex);
-
-        if (!force && !dmi_check_system(samsung_dmi_table))
-                return -ENODEV;
-
-        f0000_segment = ioremap_nocache(0xf0000, 0xffff);
-        if (!f0000_segment) {
-                pr_err("Can't map the segment at 0xf0000\n");
-                return -EINVAL;
-        }
-
-        /* Try to find one of the signatures in memory to find the header */
-        for (i = 0; sabi_configs[i].test_string != 0; ++i) {
-                sabi_config = &sabi_configs[i];
-                loca = find_signature(f0000_segment, sabi_config->test_string);
-                if (loca != 0xffff)
-                        break;
-        }
-
-        if (loca == 0xffff) {
-                pr_err("This computer does not support SABI\n");
-                goto error_no_signature;
-        }
-
-        /* point to the SMI port Number */
-        loca += 1;
-        sabi = (f0000_segment + loca);
-
-        if (debug) {
-                printk(KERN_DEBUG "This computer supports SABI==%x\n",
-                        loca + 0xf0000 - 6);
-                printk(KERN_DEBUG "SABI header:\n");
-                printk(KERN_DEBUG " SMI Port Number = 0x%04x\n",
-                        readw(sabi + sabi_config->header_offsets.port));
-                printk(KERN_DEBUG " SMI Interface Function = 0x%02x\n",
-                        readb(sabi + sabi_config->header_offsets.iface_func));
-                printk(KERN_DEBUG " SMI enable memory buffer = 0x%02x\n",
-                        readb(sabi + sabi_config->header_offsets.en_mem));
-                printk(KERN_DEBUG " SMI restore memory buffer = 0x%02x\n",
-                        readb(sabi + sabi_config->header_offsets.re_mem));
-                printk(KERN_DEBUG " SABI data offset = 0x%04x\n",
-                        readw(sabi + sabi_config->header_offsets.data_offset));
-                printk(KERN_DEBUG " SABI data segment = 0x%04x\n",
-                        readw(sabi + sabi_config->header_offsets.data_segment));
-        }
-
-        /* Get a pointer to the SABI Interface */
-        ifaceP = (readw(sabi + sabi_config->header_offsets.data_segment) & 0x0ffff) << 4;
-        ifaceP += readw(sabi + sabi_config->header_offsets.data_offset) & 0x0ffff;
-        sabi_iface = ioremap_nocache(ifaceP, 16);
-        if (!sabi_iface) {
-                pr_err("Can't remap %x\n", ifaceP);
-                goto exit;
-        }
-        if (debug) {
-                printk(KERN_DEBUG "ifaceP = 0x%08x\n", ifaceP);
-                printk(KERN_DEBUG "sabi_iface = %p\n", sabi_iface);
-
-                test_backlight();
-                test_wireless();
-
-                retval = sabi_get_command(sabi_config->commands.get_brightness,
-                                          &sretval);
-                printk(KERN_DEBUG "brightness = 0x%02x\n", sretval.retval[0]);
-        }
-
-        /* Turn on "Linux" mode in the BIOS */
-        if (sabi_config->commands.set_linux != 0xff) {
-                retval = sabi_set_command(sabi_config->commands.set_linux,
-                                          0x81);
-                if (retval) {
-                        pr_warn("Linux mode was not set!\n");
-                        goto error_no_platform;
-                }
-        }
-
-        /* knock up a platform device to hang stuff off of */
-        sdev = platform_device_register_simple("samsung", -1, NULL, 0);
-        if (IS_ERR(sdev))
-                goto error_no_platform;
-
-        /* create a backlight device to talk to this one */
-        memset(&props, 0, sizeof(struct backlight_properties));
-        props.type = BACKLIGHT_PLATFORM;
-        props.max_brightness = sabi_config->max_brightness;
-        backlight_device = backlight_device_register("samsung", &sdev->dev,
-                                                     NULL, &backlight_ops,
-                                                     &props);
-        if (IS_ERR(backlight_device))
-                goto error_no_backlight;
-
-        backlight_device->props.brightness = read_brightness();
-        backlight_device->props.power = FB_BLANK_UNBLANK;
-        backlight_update_status(backlight_device);
-
-        retval = init_wireless(sdev);
-        if (retval)
-                goto error_no_rfk;
-
-        retval = device_create_file(&sdev->dev, &dev_attr_performance_level);
-        if (retval)
-                goto error_file_create;
-
-exit:
-        return 0;
-
-error_file_create:
-        destroy_wireless();
-
-error_no_rfk:
-        backlight_device_unregister(backlight_device);
-
-error_no_backlight:
-        platform_device_unregister(sdev);
-
-error_no_platform:
-        iounmap(sabi_iface);
-
-error_no_signature:
-        iounmap(f0000_segment);
-        return -EINVAL;
-}
-
-static void __exit samsung_exit(void)
-{
-        /* Turn off "Linux" mode in the BIOS */
-        if (sabi_config->commands.set_linux != 0xff)
-                sabi_set_command(sabi_config->commands.set_linux, 0x80);
-
-        device_remove_file(&sdev->dev, &dev_attr_performance_level);
-        backlight_device_unregister(backlight_device);
-        destroy_wireless();
-        iounmap(sabi_iface);
-        iounmap(f0000_segment);
-        platform_device_unregister(sdev);
-}
-
-module_init(samsung_init);
-module_exit(samsung_exit);
-
-MODULE_AUTHOR("Greg Kroah-Hartman <gregkh@suse.de>");
-MODULE_DESCRIPTION("Samsung Backlight driver");
-MODULE_LICENSE("GPL");
diff --git a/drivers/staging/spectra/ffsport.c b/drivers/staging/spectra/ffsport.c
index 20dae73d3b78..506547b603e1 100644
--- a/drivers/staging/spectra/ffsport.c
+++ b/drivers/staging/spectra/ffsport.c
@@ -653,7 +653,7 @@ static int SBD_setup_device(struct spectra_nand_dev *dev, int which)
         }
         dev->queue->queuedata = dev;
 
-        /* As Linux block layer does't support >4KB hardware sector,  */
+        /* As Linux block layer doesn't support >4KB hardware sector,  */
         /* Here we force report 512 byte hardware sector size to Kernel */
         blk_queue_logical_block_size(dev->queue, 512);
 
diff --git a/drivers/staging/tidspbridge/dynload/cload.c b/drivers/staging/tidspbridge/dynload/cload.c
index 5cecd237e3f6..fe1ef0addb09 100644
--- a/drivers/staging/tidspbridge/dynload/cload.c
+++ b/drivers/staging/tidspbridge/dynload/cload.c
@@ -718,7 +718,7 @@ static void dload_symbols(struct dload_state *dlthis)
          * as a temporary for .dllview record construction.
          * Allocate storage for the whole table.  Add 1 to the section count
          * in case a trampoline section is auto-generated as well as the
-         * size of the trampoline section name so DLLView does't get lost.
+         * size of the trampoline section name so DLLView doesn't get lost.
          */
 
         siz = sym_count * sizeof(struct local_symbol);
diff --git a/drivers/staging/tty/specialix.c b/drivers/staging/tty/specialix.c
index cb24c6d999db..5c3598ec7456 100644
--- a/drivers/staging/tty/specialix.c
+++ b/drivers/staging/tty/specialix.c
@@ -978,7 +978,7 @@ static void sx_change_speed(struct specialix_board *bp,
         spin_lock_irqsave(&bp->lock, flags);
         sx_out(bp, CD186x_CAR, port_No(port));
 
-        /* The Specialix board does't implement the RTS lines.
+        /* The Specialix board doesn't implement the RTS lines.
            They are used to set the IRQ level. Don't touch them. */
         if (sx_crtscts(tty))
                 port->MSVR = MSVR_DTR | (sx_in(bp, CD186x_MSVR) & MSVR_RTS);
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 47f8cdb207f1..74273e638c0d 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -1658,8 +1658,12 @@ static void gsm_queue(struct gsm_mux *gsm)
 
         if ((gsm->control & ~PF) == UI)
                 gsm->fcs = gsm_fcs_add_block(gsm->fcs, gsm->buf, gsm->len);
-        /* generate final CRC with received FCS */
-        gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->received_fcs);
+        if (gsm->encoding == 0){
+                /* WARNING: gsm->received_fcs is used for gsm->encoding = 0 only.
+                            In this case it contain the last piece of data
+                            required to generate final CRC */
+                gsm->fcs = gsm_fcs_add(gsm->fcs, gsm->received_fcs);
+        }
         if (gsm->fcs != GOOD_FCS) {
                 gsm->bad_fcs++;
                 if (debug & 4)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index cb36b0d4ef3c..62df72d9f0aa 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -382,12 +382,13 @@ static void imx_start_tx(struct uart_port *port)
 static irqreturn_t imx_rtsint(int irq, void *dev_id)
 {
         struct imx_port *sport = dev_id;
-        unsigned int val = readl(sport->port.membase + USR1) & USR1_RTSS;
+        unsigned int val;
         unsigned long flags;
 
         spin_lock_irqsave(&sport->port.lock, flags);
 
         writel(USR1_RTSD, sport->port.membase + USR1);
+        val = readl(sport->port.membase + USR1) & USR1_RTSS;
         uart_handle_cts_change(&sport->port, !!val);
         wake_up_interruptible(&sport->port.state->port.delta_msr_wait);
 
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 41b6e51188e4..006489d82dc3 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -66,6 +66,7 @@ config USB_ARCH_HAS_EHCI
         default y if ARCH_VT8500
         default y if PLAT_SPEAR
         default y if ARCH_MSM
+        default y if MICROBLAZE
         default PCI
 
 # ARM SA1111 chips have a non-PCI based "OHCI-compatible" USB host interface.
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index a3d2e2399655..96fdfb815f89 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -221,7 +221,7 @@ static char *usb_dump_endpoint_descriptor(int speed, char *start, char *end,
                 break;
         case USB_ENDPOINT_XFER_INT:
                 type = "Int.";
-                if (speed == USB_SPEED_HIGH)
+                if (speed == USB_SPEED_HIGH || speed == USB_SPEED_SUPER)
                         interval = 1 << (desc->bInterval - 1);
                 else
                         interval = desc->bInterval;
@@ -229,7 +229,8 @@ static char *usb_dump_endpoint_descriptor(int speed, char *start, char *end,
         default:        /* "can't happen" */
                 return start;
         }
-        interval *= (speed == USB_SPEED_HIGH) ? 125 : 1000;
+        interval *= (speed == USB_SPEED_HIGH ||
+                     speed == USB_SPEED_SUPER) ? 125 : 1000;
         if (interval % 1000)
                 unit = 'u';
         else {
@@ -542,8 +543,9 @@ static ssize_t usb_device_dump(char __user **buffer, size_t *nbytes,
         if (level == 0) {
                 int     max;
 
-                /* high speed reserves 80%, full/low reserves 90% */
-                if (usbdev->speed == USB_SPEED_HIGH)
+                /* super/high speed reserves 80%, full/low reserves 90% */
+                if (usbdev->speed == USB_SPEED_HIGH ||
+                    usbdev->speed == USB_SPEED_SUPER)
                         max = 800;
                 else
                         max = FRAME_TIME_MAX_USECS_ALLOC;
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 8eed05d23838..77a7faec8d78 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1908,7 +1908,7 @@ void usb_free_streams(struct usb_interface *interface,
 
         /* Streams only apply to bulk endpoints. */
         for (i = 0; i < num_eps; i++)
-                if (!usb_endpoint_xfer_bulk(&eps[i]->desc))
+                if (!eps[i] || !usb_endpoint_xfer_bulk(&eps[i]->desc))
                         return;
 
         hcd->driver->free_streams(hcd, dev, eps, num_eps, mem_flags);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 8fb754916c67..93720bdc9efd 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2285,7 +2285,17 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
         }
 
         /* see 7.1.7.6 */
-        status = set_port_feature(hub->hdev, port1, USB_PORT_FEAT_SUSPEND);
+        /* Clear PORT_POWER if it's a USB3.0 device connected to USB 3.0
+         * external hub.
+         * FIXME: this is a temporary workaround to make the system able
+         * to suspend/resume.
+         */
+        if ((hub->hdev->parent != NULL) && hub_is_superspeed(hub->hdev))
+                status = clear_port_feature(hub->hdev, port1,
+                                                USB_PORT_FEAT_POWER);
+        else
+                status = set_port_feature(hub->hdev, port1,
+                                                USB_PORT_FEAT_SUSPEND);
         if (status) {
                 dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
                                 port1, status);
diff --git a/drivers/usb/gadget/f_audio.c b/drivers/usb/gadget/f_audio.c
index 9abecfddb27d..0111f8a9cf7f 100644
--- a/drivers/usb/gadget/f_audio.c
+++ b/drivers/usb/gadget/f_audio.c
@@ -706,6 +706,7 @@ f_audio_unbind(struct usb_configuration *c, struct usb_function *f)
         struct f_audio          *audio = func_to_audio(f);
 
         usb_free_descriptors(f->descriptors);
+        usb_free_descriptors(f->hs_descriptors);
         kfree(audio);
 }
 
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 95dd4662d6a8..b3c304290150 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -314,6 +314,9 @@ eem_unbind(struct usb_configuration *c, struct usb_function *f)
 
 static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 {
+        struct sk_buff *skb = (struct sk_buff *)req->context;
+
+        dev_kfree_skb_any(skb);
 }
 
 /*
@@ -428,10 +431,11 @@ static int eem_unwrap(struct gether *port,
                                 skb_trim(skb2, len);
                                 put_unaligned_le16(BIT(15) | BIT(11) | len,
                                                         skb_push(skb2, 2));
-                                skb_copy_bits(skb, 0, req->buf, skb->len);
-                                req->length = skb->len;
+                                skb_copy_bits(skb2, 0, req->buf, skb2->len);
+                                req->length = skb2->len;
                                 req->complete = eem_cmd_complete;
                                 req->zero = 1;
+                                req->context = skb2;
                                 if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
                                         DBG(cdev, "echo response queue fail\n");
                                 break;
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index aee7e3c53c38..36613b37c504 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -1148,6 +1148,12 @@ static int qe_ep_tx(struct qe_ep *ep, struct qe_frame *frame)
 static int txcomplete(struct qe_ep *ep, unsigned char restart)
 {
         if (ep->tx_req != NULL) {
+                struct qe_req *req = ep->tx_req;
+                unsigned zlp = 0, last_len = 0;
+
+                last_len = min_t(unsigned, req->req.length - ep->sent,
+                                ep->ep.maxpacket);
+
                 if (!restart) {
                         int asent = ep->last;
                         ep->sent += asent;
@@ -1156,9 +1162,18 @@ static int txcomplete(struct qe_ep *ep, unsigned char restart)
                         ep->last = 0;
                 }
 
+                /* zlp needed when req->re.zero is set */
+                if (req->req.zero) {
+                        if (last_len == 0 ||
+                                (req->req.length % ep->ep.maxpacket) != 0)
+                                zlp = 0;
+                        else
+                                zlp = 1;
+                } else
+                        zlp = 0;
+
                 /* a request already were transmitted completely */
-                if ((ep->tx_req->req.length - ep->sent) <= 0) {
-                        ep->tx_req->req.actual = (unsigned int)ep->sent;
+                if (((ep->tx_req->req.length - ep->sent) <= 0) && !zlp) {
                         done(ep, ep->tx_req, 0);
                         ep->tx_req = NULL;
                         ep->last = 0;
@@ -1191,6 +1206,7 @@ static int qe_usb_senddata(struct qe_ep *ep, struct qe_frame *frame)
         buf = (u8 *)ep->tx_req->req.buf + ep->sent;
         if (buf && size) {
                 ep->last = size;
+                ep->tx_req->req.actual += size;
                 frame_set_data(frame, buf);
                 frame_set_length(frame, size);
                 frame_set_status(frame, FRAME_OK);
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 3ed73f49cf18..a01383f71f38 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -386,8 +386,10 @@ ep_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
 
         /* halt any endpoint by doing a "wrong direction" i/o call */
         if (usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc))
+                if (usb_endpoint_xfer_isoc(&data->desc)) {
+                        mutex_unlock(&data->lock);
                         return -EINVAL;
+                }
                 DBG (data->dev, "%s halt\n", data->name);
                 spin_lock_irq (&data->dev->lock);
                 if (likely (data->ep != NULL))
diff --git a/drivers/usb/gadget/pch_udc.c b/drivers/usb/gadget/pch_udc.c
index 3e4b35e50c24..68dbcc3e4cc2 100644
--- a/drivers/usb/gadget/pch_udc.c
+++ b/drivers/usb/gadget/pch_udc.c
@@ -1608,7 +1608,7 @@ static int pch_udc_pcd_queue(struct usb_ep *usbep, struct usb_request *usbreq,
                 return -EINVAL;
         if (!dev->driver || (dev->gadget.speed == USB_SPEED_UNKNOWN))
                 return -ESHUTDOWN;
-        spin_lock_irqsave(&ep->dev->lock, iflags);
+        spin_lock_irqsave(&dev->lock, iflags);
         /* map the buffer for dma */
         if (usbreq->length &&
             ((usbreq->dma == DMA_ADDR_INVALID) || !usbreq->dma)) {
@@ -1625,8 +1625,10 @@ static int pch_udc_pcd_queue(struct usb_ep *usbep, struct usb_request *usbreq,
                                                              DMA_FROM_DEVICE);
                 } else {
                         req->buf = kzalloc(usbreq->length, GFP_ATOMIC);
-                        if (!req->buf)
-                                return -ENOMEM;
+                        if (!req->buf) {
+                                retval = -ENOMEM;
+                                goto probe_end;
+                        }
                         if (ep->in) {
                                 memcpy(req->buf, usbreq->buf, usbreq->length);
                                 req->dma = dma_map_single(&dev->pdev->dev,
diff --git a/drivers/usb/gadget/r8a66597-udc.c b/drivers/usb/gadget/r8a66597-udc.c
index 015118535f77..6dcc1f68fa60 100644
--- a/drivers/usb/gadget/r8a66597-udc.c
+++ b/drivers/usb/gadget/r8a66597-udc.c
@@ -1083,7 +1083,9 @@ static void irq_device_state(struct r8a66597 *r8a66597)
 
         if (dvsq == DS_DFLT) {
                 /* bus reset */
+                spin_unlock(&r8a66597->lock);
                 r8a66597->driver->disconnect(&r8a66597->gadget);
+                spin_lock(&r8a66597->lock);
                 r8a66597_update_usb_speed(r8a66597);
         }
         if (r8a66597->old_dvsq == DS_CNFG && dvsq != DS_CNFG)
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 98ded66e8d3f..42abd0f603bf 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1247,24 +1247,27 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
 static void scan_async (struct ehci_hcd *ehci)
 {
+        bool                    stopped;
         struct ehci_qh          *qh;
         enum ehci_timer_action  action = TIMER_IO_WATCHDOG;
 
         ehci->stamp = ehci_readl(ehci, &ehci->regs->frame_index);
         timer_action_done (ehci, TIMER_ASYNC_SHRINK);
 rescan:
+        stopped = !HC_IS_RUNNING(ehci_to_hcd(ehci)->state);
         qh = ehci->async->qh_next.qh;
         if (likely (qh != NULL)) {
                 do {
                         /* clean any finished work for this qh */
-                        if (!list_empty (&qh->qtd_list)
-                                        && qh->stamp != ehci->stamp) {
+                        if (!list_empty(&qh->qtd_list) && (stopped ||
+                                        qh->stamp != ehci->stamp)) {
                                 int temp;
 
                                 /* unlinks could happen here; completion
                                  * reporting drops the lock.  rescan using
                                  * the latest schedule, but don't rescan
-                                 * qhs we already finished (no looping).
+                                 * qhs we already finished (no looping)
+                                 * unless the controller is stopped.
                                  */
                                 qh = qh_get (qh);
                                 qh->stamp = ehci->stamp;
@@ -1285,9 +1288,9 @@ rescan:
                          */
                         if (list_empty(&qh->qtd_list)
                                         && qh->qh_state == QH_STATE_LINKED) {
-                                if (!ehci->reclaim
-                                        && ((ehci->stamp - qh->stamp) & 0x1fff)
-                                                >= (EHCI_SHRINK_FRAMES * 8))
+                                if (!ehci->reclaim && (stopped ||
+                                        ((ehci->stamp - qh->stamp) & 0x1fff)
+                                                >= EHCI_SHRINK_FRAMES * 8))
                                         start_unlink_async(ehci, qh);
                                 else
                                         action = TIMER_ASYNC_SHRINK;
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index f50e84ac570a..795345ad45e6 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -295,7 +295,7 @@ static void alloc_mem(struct usb_hcd *hcd, struct isp1760_qtd *qtd)
         }
 
         dev_err(hcd->self.controller,
-                                "%s: Can not allocate %lu bytes of memory\n"
+                                "%s: Cannot allocate %zu bytes of memory\n"
                                 "Current memory map:\n",
                                 __func__, qtd->length);
         for (i = 0; i < BLOCKS; i++) {
diff --git a/drivers/usb/host/ohci-au1xxx.c b/drivers/usb/host/ohci-au1xxx.c
index 17a6043c1fa0..958d985f2951 100644
--- a/drivers/usb/host/ohci-au1xxx.c
+++ b/drivers/usb/host/ohci-au1xxx.c
@@ -33,7 +33,7 @@
 
 #ifdef __LITTLE_ENDIAN
 #define USBH_ENABLE_INIT (USBH_ENABLE_CE | USBH_ENABLE_E | USBH_ENABLE_C)
-#elif __BIG_ENDIAN
+#elif defined(__BIG_ENDIAN)
 #define USBH_ENABLE_INIT (USBH_ENABLE_CE | USBH_ENABLE_E | USBH_ENABLE_C | \
                           USBH_ENABLE_BE)
 #else
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 1d586d4f7b56..9b166d70ae91 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -84,65 +84,92 @@ int usb_amd_find_chipset_info(void)
 {
         u8 rev = 0;
         unsigned long flags;
+        struct amd_chipset_info info;
+        int ret;
 
         spin_lock_irqsave(&amd_lock, flags);
 
-        amd_chipset.probe_count++;
         /* probe only once */
-        if (amd_chipset.probe_count > 1) {
+        if (amd_chipset.probe_count > 0) {
+                amd_chipset.probe_count++;
                 spin_unlock_irqrestore(&amd_lock, flags);
                 return amd_chipset.probe_result;
         }
+        memset(&info, 0, sizeof(info));
+        spin_unlock_irqrestore(&amd_lock, flags);
 
-        amd_chipset.smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
-        if (amd_chipset.smbus_dev) {
-                rev = amd_chipset.smbus_dev->revision;
+        info.smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
+        if (info.smbus_dev) {
+                rev = info.smbus_dev->revision;
                 if (rev >= 0x40)
-                        amd_chipset.sb_type = 1;
+                        info.sb_type = 1;
                 else if (rev >= 0x30 && rev <= 0x3b)
-                        amd_chipset.sb_type = 3;
+                        info.sb_type = 3;
         } else {
-                amd_chipset.smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
-                                                        0x780b, NULL);
-                if (!amd_chipset.smbus_dev) {
-                        spin_unlock_irqrestore(&amd_lock, flags);
-                        return 0;
+                info.smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+                                                0x780b, NULL);
+                if (!info.smbus_dev) {
+                        ret = 0;
+                        goto commit;
                 }
-                rev = amd_chipset.smbus_dev->revision;
+
+                rev = info.smbus_dev->revision;
                 if (rev >= 0x11 && rev <= 0x18)
-                        amd_chipset.sb_type = 2;
+                        info.sb_type = 2;
         }
 
-        if (amd_chipset.sb_type == 0) {
-                if (amd_chipset.smbus_dev) {
-                        pci_dev_put(amd_chipset.smbus_dev);
-                        amd_chipset.smbus_dev = NULL;
+        if (info.sb_type == 0) {
+                if (info.smbus_dev) {
+                        pci_dev_put(info.smbus_dev);
+                        info.smbus_dev = NULL;
                 }
-                spin_unlock_irqrestore(&amd_lock, flags);
-                return 0;
+                ret = 0;
+                goto commit;
         }
 
-        amd_chipset.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x9601, NULL);
-        if (amd_chipset.nb_dev) {
-                amd_chipset.nb_type = 1;
+        info.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x9601, NULL);
+        if (info.nb_dev) {
+                info.nb_type = 1;
         } else {
-                amd_chipset.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD,
-                                                        0x1510, NULL);
-                if (amd_chipset.nb_dev) {
-                        amd_chipset.nb_type = 2;
-                } else  {
-                        amd_chipset.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD,
-                                                                0x9600, NULL);
-                        if (amd_chipset.nb_dev)
-                                amd_chipset.nb_type = 3;
+                info.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x1510, NULL);
+                if (info.nb_dev) {
+                        info.nb_type = 2;
+                } else {
+                        info.nb_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+                                                     0x9600, NULL);
+                        if (info.nb_dev)
+                                info.nb_type = 3;
                 }
         }
 
-        amd_chipset.probe_result = 1;
+        ret = info.probe_result = 1;
         printk(KERN_DEBUG "QUIRK: Enable AMD PLL fix\n");
 
-        spin_unlock_irqrestore(&amd_lock, flags);
-        return amd_chipset.probe_result;
+commit:
+
+        spin_lock_irqsave(&amd_lock, flags);
+        if (amd_chipset.probe_count > 0) {
+                /* race - someone else was faster - drop devices */
+
+                /* Mark that we where here */
+                amd_chipset.probe_count++;
+                ret = amd_chipset.probe_result;
+
+                spin_unlock_irqrestore(&amd_lock, flags);
+
+                if (info.nb_dev)
+                        pci_dev_put(info.nb_dev);
+                if (info.smbus_dev)
+                        pci_dev_put(info.smbus_dev);
+
+        } else {
+                /* no race - commit the result */
+                info.probe_count++;
+                amd_chipset = info;
+                spin_unlock_irqrestore(&amd_lock, flags);
+        }
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(usb_amd_find_chipset_info);
 
@@ -284,6 +311,7 @@ EXPORT_SYMBOL_GPL(usb_amd_quirk_pll_enable);
 
 void usb_amd_dev_put(void)
 {
+        struct pci_dev *nb, *smbus;
         unsigned long flags;
 
         spin_lock_irqsave(&amd_lock, flags);
@@ -294,20 +322,23 @@ void usb_amd_dev_put(void)
                 return;
         }
 
-        if (amd_chipset.nb_dev) {
-                pci_dev_put(amd_chipset.nb_dev);
-                amd_chipset.nb_dev = NULL;
-        }
-        if (amd_chipset.smbus_dev) {
-                pci_dev_put(amd_chipset.smbus_dev);
-                amd_chipset.smbus_dev = NULL;
-        }
+        /* save them to pci_dev_put outside of spinlock */
+        nb    = amd_chipset.nb_dev;
+        smbus = amd_chipset.smbus_dev;
+
+        amd_chipset.nb_dev = NULL;
+        amd_chipset.smbus_dev = NULL;
         amd_chipset.nb_type = 0;
         amd_chipset.sb_type = 0;
         amd_chipset.isoc_reqs = 0;
         amd_chipset.probe_result = 0;
 
         spin_unlock_irqrestore(&amd_lock, flags);
+
+        if (nb)
+                pci_dev_put(nb);
+        if (smbus)
+                pci_dev_put(smbus);
 }
 EXPORT_SYMBOL_GPL(usb_amd_dev_put);
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index a003e79aacdc..627f3438028c 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -846,7 +846,7 @@ static u32 xhci_find_real_port_number(struct xhci_hcd *xhci,
                  * Skip ports that don't have known speeds, or have duplicate
                  * Extended Capabilities port speed entries.
                  */
-                if (port_speed == 0 || port_speed == -1)
+                if (port_speed == 0 || port_speed == DUPLICATE_ENTRY)
                         continue;
 
                 /*
@@ -974,6 +974,47 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
         return 0;
 }
 
+/*
+ * Convert interval expressed as 2^(bInterval - 1) == interval into
+ * straight exponent value 2^n == interval.
+ *
+ */
+static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        unsigned int interval;
+
+        interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
+        if (interval != ep->desc.bInterval - 1)
+                dev_warn(&udev->dev,
+                         "ep %#x - rounding interval to %d microframes\n",
+                         ep->desc.bEndpointAddress,
+                         1 << interval);
+
+        return interval;
+}
+
+/*
+ * Convert bInterval expressed in frames (in 1-255 range) to exponent of
+ * microframes, rounded down to nearest power of 2.
+ */
+static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        unsigned int interval;
+
+        interval = fls(8 * ep->desc.bInterval) - 1;
+        interval = clamp_val(interval, 3, 10);
+        if ((1 << interval) != 8 * ep->desc.bInterval)
+                dev_warn(&udev->dev,
+                         "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
+                         ep->desc.bEndpointAddress,
+                         1 << interval,
+                         8 * ep->desc.bInterval);
+
+        return interval;
+}
+
 /* Return the polling or NAK interval.
  *
  * The polling interval is expressed in "microframes".  If xHCI's Interval field
@@ -982,7 +1023,7 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
  * The NAK interval is one NAK per 1 to 255 microframes, or no NAKs if interval
  * is set to 0.
  */
-static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
+static unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
         unsigned int interval = 0;
@@ -991,45 +1032,38 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
         case USB_SPEED_HIGH:
                 /* Max NAK rate */
                 if (usb_endpoint_xfer_control(&ep->desc) ||
-                                usb_endpoint_xfer_bulk(&ep->desc))
+                    usb_endpoint_xfer_bulk(&ep->desc)) {
                         interval = ep->desc.bInterval;
+                        break;
+                }
                 /* Fall through - SS and HS isoc/int have same decoding */
+
         case USB_SPEED_SUPER:
                 if (usb_endpoint_xfer_int(&ep->desc) ||
-                                usb_endpoint_xfer_isoc(&ep->desc)) {
-                        if (ep->desc.bInterval == 0)
-                                interval = 0;
-                        else
-                                interval = ep->desc.bInterval - 1;
-                        if (interval > 15)
-                                interval = 15;
-                        if (interval != ep->desc.bInterval + 1)
-                                dev_warn(&udev->dev, "ep %#x - rounding interval to %d microframes\n",
-                                                ep->desc.bEndpointAddress, 1 << interval);
+                    usb_endpoint_xfer_isoc(&ep->desc)) {
+                        interval = xhci_parse_exponent_interval(udev, ep);
                 }
                 break;
-        /* Convert bInterval (in 1-255 frames) to microframes and round down to
-         * nearest power of 2.
-         */
+
         case USB_SPEED_FULL:
+                if (usb_endpoint_xfer_int(&ep->desc)) {
+                        interval = xhci_parse_exponent_interval(udev, ep);
+                        break;
+                }
+                /*
+                 * Fall through for isochronous endpoint interval decoding
+                 * since it uses the same rules as low speed interrupt
+                 * endpoints.
+                 */
+
         case USB_SPEED_LOW:
                 if (usb_endpoint_xfer_int(&ep->desc) ||
-                                usb_endpoint_xfer_isoc(&ep->desc)) {
-                        interval = fls(8*ep->desc.bInterval) - 1;
-                        if (interval > 10)
-                                interval = 10;
-                        if (interval < 3)
-                                interval = 3;
-                        if ((1 << interval) != 8*ep->desc.bInterval)
-                                dev_warn(&udev->dev,
-                                                "ep %#x - rounding interval"
-                                                " to %d microframes, "
-                                                "ep desc says %d microframes\n",
-                                                ep->desc.bEndpointAddress,
-                                                1 << interval,
-                                                8*ep->desc.bInterval);
+                    usb_endpoint_xfer_isoc(&ep->desc)) {
+
+                        interval = xhci_parse_frame_interval(udev, ep);
                 }
                 break;
+
         default:
                 BUG();
         }
@@ -1041,7 +1075,7 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
  * transaction opportunities per microframe", but that goes in the Max Burst
  * endpoint context field.
  */
-static inline u32 xhci_get_endpoint_mult(struct usb_device *udev,
+static u32 xhci_get_endpoint_mult(struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
         if (udev->speed != USB_SPEED_SUPER ||
@@ -1050,7 +1084,7 @@ static inline u32 xhci_get_endpoint_mult(struct usb_device *udev,
         return ep->ss_ep_comp.bmAttributes;
 }
 
-static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
+static u32 xhci_get_endpoint_type(struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
         int in;
@@ -1084,7 +1118,7 @@ static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
  * Basically, this is the maxpacket size, multiplied by the burst size
  * and mult size.
  */
-static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
+static u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
                 struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
@@ -1727,12 +1761,12 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
                          * found a similar duplicate.
                          */
                         if (xhci->port_array[i] != major_revision &&
-                                xhci->port_array[i] != (u8) -1) {
+                                xhci->port_array[i] != DUPLICATE_ENTRY) {
                                 if (xhci->port_array[i] == 0x03)
                                         xhci->num_usb3_ports--;
                                 else
                                         xhci->num_usb2_ports--;
-                                xhci->port_array[i] = (u8) -1;
+                                xhci->port_array[i] = DUPLICATE_ENTRY;
                         }
                         /* FIXME: Should we disable the port? */
                         continue;
@@ -1831,7 +1865,7 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
                 for (i = 0; i < num_ports; i++) {
                         if (xhci->port_array[i] == 0x03 ||
                                         xhci->port_array[i] == 0 ||
-                                        xhci->port_array[i] == -1)
+                                        xhci->port_array[i] == DUPLICATE_ENTRY)
                                 continue;
 
                         xhci->usb2_ports[port_index] =
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index ceea9f33491c..a10494c2f3c7 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -114,6 +114,10 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
         if (pdev->vendor == PCI_VENDOR_ID_NEC)
                 xhci->quirks |= XHCI_NEC_HOST;
 
+        /* AMD PLL quirk */
+        if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
+                xhci->quirks |= XHCI_AMD_PLL_FIX;
+
         /* Make sure the HC is halted. */
         retval = xhci_halt(xhci);
         if (retval)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index cfc1ad92473f..7437386a9a50 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -93,7 +93,7 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg,
 /* Does this link TRB point to the first segment in a ring,
  * or was the previous TRB the last TRB on the last segment in the ERST?
  */
-static inline bool last_trb_on_last_seg(struct xhci_hcd *xhci, struct xhci_ring *ring,
+static bool last_trb_on_last_seg(struct xhci_hcd *xhci, struct xhci_ring *ring,
                 struct xhci_segment *seg, union xhci_trb *trb)
 {
         if (ring == xhci->event_ring)
@@ -107,7 +107,7 @@ static inline bool last_trb_on_last_seg(struct xhci_hcd *xhci, struct xhci_ring
  * segment?  I.e. would the updated event TRB pointer step off the end of the
  * event seg?
  */
-static inline int last_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
+static int last_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
                 struct xhci_segment *seg, union xhci_trb *trb)
 {
         if (ring == xhci->event_ring)
@@ -116,7 +116,7 @@ static inline int last_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
                 return (trb->link.control & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK);
 }
 
-static inline int enqueue_is_link_trb(struct xhci_ring *ring)
+static int enqueue_is_link_trb(struct xhci_ring *ring)
 {
         struct xhci_link_trb *link = &ring->enqueue->link;
         return ((link->control & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK));
@@ -592,7 +592,7 @@ void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci,
         ep->ep_state |= SET_DEQ_PENDING;
 }
 
-static inline void xhci_stop_watchdog_timer_in_irq(struct xhci_hcd *xhci,
+static void xhci_stop_watchdog_timer_in_irq(struct xhci_hcd *xhci,
                 struct xhci_virt_ep *ep)
 {
         ep->ep_state &= ~EP_HALT_PENDING;
@@ -619,6 +619,13 @@ static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
 
         /* Only giveback urb when this is the last td in urb */
         if (urb_priv->td_cnt == urb_priv->length) {
+                if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+                        xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs--;
+                        if (xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs == 0) {
+                                if (xhci->quirks & XHCI_AMD_PLL_FIX)
+                                        usb_amd_quirk_pll_enable();
+                        }
+                }
                 usb_hcd_unlink_urb_from_ep(hcd, urb);
                 xhci_dbg(xhci, "Giveback %s URB %p\n", adjective, urb);
 
@@ -1209,7 +1216,7 @@ static unsigned int find_faked_portnum_from_hw_portnum(struct usb_hcd *hcd,
                  * Skip ports that don't have known speeds, or have duplicate
                  * Extended Capabilities port speed entries.
                  */
-                if (port_speed == 0 || port_speed == -1)
+                if (port_speed == 0 || port_speed == DUPLICATE_ENTRY)
                         continue;
 
                 /*
@@ -1235,6 +1242,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
         u8 major_revision;
         struct xhci_bus_state *bus_state;
         u32 __iomem **port_array;
+        bool bogus_port_status = false;
 
         /* Port status change events always have a successful completion code */
         if (GET_COMP_CODE(event->generic.field[2]) != COMP_SUCCESS) {
@@ -1247,6 +1255,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
         max_ports = HCS_MAX_PORTS(xhci->hcs_params1);
         if ((port_id <= 0) || (port_id > max_ports)) {
                 xhci_warn(xhci, "Invalid port id %d\n", port_id);
+                bogus_port_status = true;
                 goto cleanup;
         }
 
@@ -1258,12 +1267,14 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 xhci_warn(xhci, "Event for port %u not in "
                                 "Extended Capabilities, ignoring.\n",
                                 port_id);
+                bogus_port_status = true;
                 goto cleanup;
         }
-        if (major_revision == (u8) -1) {
+        if (major_revision == DUPLICATE_ENTRY) {
                 xhci_warn(xhci, "Event for port %u duplicated in"
                                 "Extended Capabilities, ignoring.\n",
                                 port_id);
+                bogus_port_status = true;
                 goto cleanup;
         }
 
@@ -1335,6 +1346,13 @@ cleanup:
         /* Update event ring dequeue pointer before dropping the lock */
         inc_deq(xhci, xhci->event_ring, true);
 
+        /* Don't make the USB core poll the roothub if we got a bad port status
+         * change event.  Besides, at that point we can't tell which roothub
+         * (USB 2.0 or USB 3.0) to kick.
+         */
+        if (bogus_port_status)
+                return;
+
         spin_unlock(&xhci->lock);
         /* Pass this up to the core */
         usb_hcd_poll_rh_status(hcd);
@@ -1554,8 +1572,17 @@ td_cleanup:
 
                 urb_priv->td_cnt++;
                 /* Giveback the urb when all the tds are completed */
-                if (urb_priv->td_cnt == urb_priv->length)
+                if (urb_priv->td_cnt == urb_priv->length) {
                         ret = 1;
+                        if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+                                xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs--;
+                                if (xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs
+                                        == 0) {
+                                        if (xhci->quirks & XHCI_AMD_PLL_FIX)
+                                                usb_amd_quirk_pll_enable();
+                                }
+                        }
+                }
         }
 
         return ret;
@@ -1675,71 +1702,52 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
         struct urb_priv *urb_priv;
         int idx;
         int len = 0;
-        int skip_td = 0;
         union xhci_trb *cur_trb;
         struct xhci_segment *cur_seg;
+        struct usb_iso_packet_descriptor *frame;
         u32 trb_comp_code;
+        bool skip_td = false;
 
         ep_ring = xhci_dma_to_transfer_ring(ep, event->buffer);
         trb_comp_code = GET_COMP_CODE(event->transfer_len);
         urb_priv = td->urb->hcpriv;
         idx = urb_priv->td_cnt;
+        frame = &td->urb->iso_frame_desc[idx];
 
-        if (ep->skip) {
-                /* The transfer is partly done */
-                *status = -EXDEV;
-                td->urb->iso_frame_desc[idx].status = -EXDEV;
-        } else {
-                /* handle completion code */
-                switch (trb_comp_code) {
-                case COMP_SUCCESS:
-                        td->urb->iso_frame_desc[idx].status = 0;
-                        xhci_dbg(xhci, "Successful isoc transfer!\n");
-                        break;
-                case COMP_SHORT_TX:
-                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
-                                td->urb->iso_frame_desc[idx].status =
-                                         -EREMOTEIO;
-                        else
-                                td->urb->iso_frame_desc[idx].status = 0;
-                        break;
-                case COMP_BW_OVER:
-                        td->urb->iso_frame_desc[idx].status = -ECOMM;
-                        skip_td = 1;
-                        break;
-                case COMP_BUFF_OVER:
-                case COMP_BABBLE:
-                        td->urb->iso_frame_desc[idx].status = -EOVERFLOW;
-                        skip_td = 1;
-                        break;
-                case COMP_STALL:
-                        td->urb->iso_frame_desc[idx].status = -EPROTO;
-                        skip_td = 1;
-                        break;
-                case COMP_STOP:
-                case COMP_STOP_INVAL:
-                        break;
-                default:
-                        td->urb->iso_frame_desc[idx].status = -1;
-                        break;
-                }
-        }
-
-        /* calc actual length */
-        if (ep->skip) {
-                td->urb->iso_frame_desc[idx].actual_length = 0;
-                /* Update ring dequeue pointer */
-                while (ep_ring->dequeue != td->last_trb)
-                        inc_deq(xhci, ep_ring, false);
-                inc_deq(xhci, ep_ring, false);
-                return finish_td(xhci, td, event_trb, event, ep, status, true);
+        /* handle completion code */
+        switch (trb_comp_code) {
+        case COMP_SUCCESS:
+                frame->status = 0;
+                xhci_dbg(xhci, "Successful isoc transfer!\n");
+                break;
+        case COMP_SHORT_TX:
+                frame->status = td->urb->transfer_flags & URB_SHORT_NOT_OK ?
+                                -EREMOTEIO : 0;
+                break;
+        case COMP_BW_OVER:
+                frame->status = -ECOMM;
+                skip_td = true;
+                break;
+        case COMP_BUFF_OVER:
+        case COMP_BABBLE:
+                frame->status = -EOVERFLOW;
+                skip_td = true;
+                break;
+        case COMP_STALL:
+                frame->status = -EPROTO;
+                skip_td = true;
+                break;
+        case COMP_STOP:
+        case COMP_STOP_INVAL:
+                break;
+        default:
+                frame->status = -1;
+                break;
         }
 
-        if (trb_comp_code == COMP_SUCCESS || skip_td == 1) {
-                td->urb->iso_frame_desc[idx].actual_length =
-                        td->urb->iso_frame_desc[idx].length;
-                td->urb->actual_length +=
-                        td->urb->iso_frame_desc[idx].length;
+        if (trb_comp_code == COMP_SUCCESS || skip_td) {
+                frame->actual_length = frame->length;
+                td->urb->actual_length += frame->length;
         } else {
                 for (cur_trb = ep_ring->dequeue,
                      cur_seg = ep_ring->deq_seg; cur_trb != event_trb;
@@ -1755,7 +1763,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
                         TRB_LEN(event->transfer_len);
 
                 if (trb_comp_code != COMP_STOP_INVAL) {
-                        td->urb->iso_frame_desc[idx].actual_length = len;
+                        frame->actual_length = len;
                         td->urb->actual_length += len;
                 }
         }
@@ -1766,6 +1774,35 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
         return finish_td(xhci, td, event_trb, event, ep, status, false);
 }
 
+static int skip_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+                        struct xhci_transfer_event *event,
+                        struct xhci_virt_ep *ep, int *status)
+{
+        struct xhci_ring *ep_ring;
+        struct urb_priv *urb_priv;
+        struct usb_iso_packet_descriptor *frame;
+        int idx;
+
+        ep_ring = xhci_dma_to_transfer_ring(ep, event->buffer);
+        urb_priv = td->urb->hcpriv;
+        idx = urb_priv->td_cnt;
+        frame = &td->urb->iso_frame_desc[idx];
+
+        /* The transfer is partly done */
+        *status = -EXDEV;
+        frame->status = -EXDEV;
+
+        /* calc actual length */
+        frame->actual_length = 0;
+
+        /* Update ring dequeue pointer */
+        while (ep_ring->dequeue != td->last_trb)
+                inc_deq(xhci, ep_ring, false);
+        inc_deq(xhci, ep_ring, false);
+
+        return finish_td(xhci, td, NULL, event, ep, status, true);
+}
+
 /*
  * Process bulk and interrupt tds, update urb status and actual_length.
  */
@@ -2024,36 +2061,42 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 }
 
                 td = list_entry(ep_ring->td_list.next, struct xhci_td, td_list);
+
                 /* Is this a TRB in the currently executing TD? */
                 event_seg = trb_in_td(ep_ring->deq_seg, ep_ring->dequeue,
                                 td->last_trb, event_dma);
-                if (event_seg && ep->skip) {
+                if (!event_seg) {
+                        if (!ep->skip ||
+                            !usb_endpoint_xfer_isoc(&td->urb->ep->desc)) {
+                                /* HC is busted, give up! */
+                                xhci_err(xhci,
+                                        "ERROR Transfer event TRB DMA ptr not "
+                                        "part of current TD\n");
+                                return -ESHUTDOWN;
+                        }
+
+                        ret = skip_isoc_td(xhci, td, event, ep, &status);
+                        goto cleanup;
+                }
+
+                if (ep->skip) {
                         xhci_dbg(xhci, "Found td. Clear skip flag.\n");
                         ep->skip = false;
                 }
-                if (!event_seg &&
-                   (!ep->skip || !usb_endpoint_xfer_isoc(&td->urb->ep->desc))) {
-                        /* HC is busted, give up! */
-                        xhci_err(xhci, "ERROR Transfer event TRB DMA ptr not "
-                                        "part of current TD\n");
-                        return -ESHUTDOWN;
-                }
 
-                if (event_seg) {
-                        event_trb = &event_seg->trbs[(event_dma -
-                                         event_seg->dma) / sizeof(*event_trb)];
-                        /*
-                         * No-op TRB should not trigger interrupts.
-                         * If event_trb is a no-op TRB, it means the
-                         * corresponding TD has been cancelled. Just ignore
-                         * the TD.
-                         */
-                        if ((event_trb->generic.field[3] & TRB_TYPE_BITMASK)
-                                         == TRB_TYPE(TRB_TR_NOOP)) {
-                                xhci_dbg(xhci, "event_trb is a no-op TRB. "
-                                                "Skip it\n");
-                                goto cleanup;
-                        }
+                event_trb = &event_seg->trbs[(event_dma - event_seg->dma) /
+                                                sizeof(*event_trb)];
+                /*
+                 * No-op TRB should not trigger interrupts.
+                 * If event_trb is a no-op TRB, it means the
+                 * corresponding TD has been cancelled. Just ignore
+                 * the TD.
+                 */
+                if ((event_trb->generic.field[3] & TRB_TYPE_BITMASK)
+                                 == TRB_TYPE(TRB_TR_NOOP)) {
+                        xhci_dbg(xhci,
+                                 "event_trb is a no-op TRB. Skip it\n");
+                        goto cleanup;
                 }
 
                 /* Now update the urb's actual_length and give back to
@@ -3126,6 +3169,12 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 }
         }
 
+        if (xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs == 0) {
+                if (xhci->quirks & XHCI_AMD_PLL_FIX)
+                        usb_amd_quirk_pll_disable();
+        }
+        xhci_to_hcd(xhci)->self.bandwidth_isoc_reqs++;
+
         giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
                         start_cycle, start_trb);
         return 0;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 196e0181b2ed..81b976e45880 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -550,6 +550,9 @@ void xhci_stop(struct usb_hcd *hcd)
         del_timer_sync(&xhci->event_ring_timer);
 #endif
 
+        if (xhci->quirks & XHCI_AMD_PLL_FIX)
+                usb_amd_dev_put();
+
         xhci_dbg(xhci, "// Disabling event ring interrupts\n");
         temp = xhci_readl(xhci, &xhci->op_regs->status);
         xhci_writel(xhci, temp & ~STS_EINT, &xhci->op_regs->status);
@@ -771,7 +774,9 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 
         /* If restore operation fails, re-initialize the HC during resume */
         if ((temp & STS_SRE) || hibernated) {
-                usb_root_hub_lost_power(hcd->self.root_hub);
+                /* Let the USB core know _both_ roothubs lost power. */
+                usb_root_hub_lost_power(xhci->main_hcd->self.root_hub);
+                usb_root_hub_lost_power(xhci->shared_hcd->self.root_hub);
 
                 xhci_dbg(xhci, "Stop HCD\n");
                 xhci_halt(xhci);
@@ -2386,10 +2391,18 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
         /* Everything but endpoint 0 is disabled, so free or cache the rings. */
         last_freed_endpoint = 1;
         for (i = 1; i < 31; ++i) {
-                if (!virt_dev->eps[i].ring)
-                        continue;
-                xhci_free_or_cache_endpoint_ring(xhci, virt_dev, i);
-                last_freed_endpoint = i;
+                struct xhci_virt_ep *ep = &virt_dev->eps[i];
+
+                if (ep->ep_state & EP_HAS_STREAMS) {
+                        xhci_free_stream_info(xhci, ep->stream_info);
+                        ep->stream_info = NULL;
+                        ep->ep_state &= ~EP_HAS_STREAMS;
+                }
+
+                if (ep->ring) {
+                        xhci_free_or_cache_endpoint_ring(xhci, virt_dev, i);
+                        last_freed_endpoint = i;
+                }
         }
         xhci_dbg(xhci, "Output context after successful reset device cmd:\n");
         xhci_dbg_ctx(xhci, virt_dev->out_ctx, last_freed_endpoint);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 07e263063e37..ba1be6b7cc6d 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -30,6 +30,7 @@
 
 /* Code sharing between pci-quirks and xhci hcd */
 #include        "xhci-ext-caps.h"
+#include "pci-quirks.h"
 
 /* xHCI PCI Configuration Registers */
 #define XHCI_SBRN_OFFSET        (0x60)
@@ -232,7 +233,7 @@ struct xhci_op_regs {
  * notification type that matches a bit set in this bit field.
  */
 #define DEV_NOTE_MASK           (0xffff)
-#define ENABLE_DEV_NOTE(x)      (1 << x)
+#define ENABLE_DEV_NOTE(x)      (1 << (x))
 /* Most of the device notification types should only be used for debug.
  * SW does need to pay attention to function wake notifications.
  */
@@ -348,6 +349,9 @@ struct xhci_op_regs {
 /* Initiate a warm port reset - complete when PORT_WRC is '1' */
 #define PORT_WR         (1 << 31)
 
+/* We mark duplicate entries with -1 */
+#define DUPLICATE_ENTRY ((u8)(-1))
+
 /* Port Power Management Status and Control - port_power_base bitmasks */
 /* Inactivity timer value for transitions into U1, in microseconds.
  * Timeout can be up to 127us.  0xFF means an infinite timeout.
@@ -601,11 +605,11 @@ struct xhci_ep_ctx {
 #define EP_STATE_STOPPED        3
 #define EP_STATE_ERROR          4
 /* Mult - Max number of burtst within an interval, in EP companion desc. */
-#define EP_MULT(p)              ((p & 0x3) << 8)
+#define EP_MULT(p)              (((p) & 0x3) << 8)
 /* bits 10:14 are Max Primary Streams */
 /* bit 15 is Linear Stream Array */
 /* Interval - period between requests to an endpoint - 125u increments. */
-#define EP_INTERVAL(p)          ((p & 0xff) << 16)
+#define EP_INTERVAL(p)          (((p) & 0xff) << 16)
 #define EP_INTERVAL_TO_UFRAMES(p)               (1 << (((p) >> 16) & 0xff))
 #define EP_MAXPSTREAMS_MASK     (0x1f << 10)
 #define EP_MAXPSTREAMS(p)       (((p) << 10) & EP_MAXPSTREAMS_MASK)
@@ -1276,6 +1280,7 @@ struct xhci_hcd {
 #define XHCI_LINK_TRB_QUIRK     (1 << 0)
 #define XHCI_RESET_EP_QUIRK     (1 << 1)
 #define XHCI_NEC_HOST           (1 << 2)
+#define XHCI_AMD_PLL_FIX        (1 << 3)
         /* There are two roothubs to keep track of bus suspend info for */
         struct xhci_bus_state   bus_state[2];
         /* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 4cbb7e4b368d..74073b363c30 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -14,7 +14,7 @@ config USB_MUSB_HDRC
         select TWL4030_USB if MACH_OMAP_3430SDP
         select TWL6030_USB if MACH_OMAP_4430SDP || MACH_OMAP4_PANDA
         select USB_OTG_UTILS
-        tristate 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
+        bool 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
         help
           Say Y here if your system has a dual role high speed USB
           controller based on the Mentor Graphics silicon IP.  Then
@@ -30,8 +30,8 @@ config USB_MUSB_HDRC
 
           If you do not know what this is, please say N.
 
-          To compile this driver as a module, choose M here; the
-          module will be called "musb-hdrc".
+#         To compile this driver as a module, choose M here; the
+#         module will be called "musb-hdrc".
 
 choice
         prompt "Platform Glue Layer"
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index 52312e8af213..8e2a1ff8a35a 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -21,6 +21,7 @@
 #include <asm/cacheflush.h>
 
 #include "musb_core.h"
+#include "musbhsdma.h"
 #include "blackfin.h"
 
 struct bfin_glue {
@@ -332,6 +333,27 @@ static int bfin_musb_set_mode(struct musb *musb, u8 musb_mode)
         return -EIO;
 }
 
+static int bfin_musb_adjust_channel_params(struct dma_channel *channel,
+                                u16 packet_sz, u8 *mode,
+                                dma_addr_t *dma_addr, u32 *len)
+{
+        struct musb_dma_channel *musb_channel = channel->private_data;
+
+        /*
+         * Anomaly 05000450 might cause data corruption when using DMA
+         * MODE 1 transmits with short packet.  So to work around this,
+         * we truncate all MODE 1 transfers down to a multiple of the
+         * max packet size, and then do the last short packet transfer
+         * (if there is any) using MODE 0.
+         */
+        if (ANOMALY_05000450) {
+                if (musb_channel->transmit && *mode == 1)
+                        *len = *len - (*len % packet_sz);
+        }
+
+        return 0;
+}
+
 static void bfin_musb_reg_init(struct musb *musb)
 {
         if (ANOMALY_05000346) {
@@ -430,6 +452,8 @@ static const struct musb_platform_ops bfin_ops = {
 
         .vbus_status    = bfin_musb_vbus_status,
         .set_vbus       = bfin_musb_set_vbus,
+
+        .adjust_channel_params = bfin_musb_adjust_channel_params,
 };
 
 static u64 bfin_dmamask = DMA_BIT_MASK(32);
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index de55a3c3259a..ab434fbd8c35 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -597,12 +597,12 @@ cppi_next_tx_segment(struct musb *musb, struct cppi_channel *tx)
                 length = min(n_bds * maxpacket, length);
         }
 
-        DBG(4, "TX DMA%d, pktSz %d %s bds %d dma 0x%x len %u\n",
+        DBG(4, "TX DMA%d, pktSz %d %s bds %d dma 0x%llx len %u\n",
                         tx->index,
                         maxpacket,
                         rndis ? "rndis" : "transparent",
                         n_bds,
-                        addr, length);
+                        (unsigned long long)addr, length);
 
         cppi_rndis_update(tx, 0, musb->ctrl_base, rndis);
 
@@ -820,7 +820,7 @@ cppi_next_rx_segment(struct musb *musb, struct cppi_channel *rx, int onepacket)
         length = min(n_bds * maxpacket, length);
 
         DBG(4, "RX DMA%d seg, maxp %d %s bds %d (cnt %d) "
-                        "dma 0x%x len %u %u/%u\n",
+                        "dma 0x%llx len %u %u/%u\n",
                         rx->index, maxpacket,
                         onepacket
                                 ? (is_rndis ? "rndis" : "onepacket")
@@ -829,7 +829,8 @@ cppi_next_rx_segment(struct musb *musb, struct cppi_channel *rx, int onepacket)
                         musb_readl(tibase,
                                 DAVINCI_RXCPPI_BUFCNT0_REG + (rx->index * 4))
                                         & 0xffff,
-                        addr, length, rx->channel.actual_len, rx->buf_len);
+                        (unsigned long long)addr, length,
+                        rx->channel.actual_len, rx->buf_len);
 
         /* only queue one segment at a time, since the hardware prevents
          * correct queue shutdown after unexpected short packets
@@ -1039,9 +1040,9 @@ static bool cppi_rx_scan(struct cppi *cppi, unsigned ch)
                 if (!completed && (bd->hw_options & CPPI_OWN_SET))
                         break;
 
-                DBG(5, "C/RXBD %08x: nxt %08x buf %08x "
+                DBG(5, "C/RXBD %llx: nxt %08x buf %08x "
                         "off.len %08x opt.len %08x (%d)\n",
-                        bd->dma, bd->hw_next, bd->hw_bufp,
+                        (unsigned long long)bd->dma, bd->hw_next, bd->hw_bufp,
                         bd->hw_off_len, bd->hw_options,
                         rx->channel.actual_len);
 
@@ -1111,11 +1112,12 @@ static bool cppi_rx_scan(struct cppi *cppi, unsigned ch)
                 musb_ep_select(cppi->mregs, rx->index + 1);
                 csr = musb_readw(regs, MUSB_RXCSR);
                 if (csr & MUSB_RXCSR_DMAENAB) {
-                        DBG(4, "list%d %p/%p, last %08x%s, csr %04x\n",
+                        DBG(4, "list%d %p/%p, last %llx%s, csr %04x\n",
                                 rx->index,
                                 rx->head, rx->tail,
                                 rx->last_processed
-                                        ? rx->last_processed->dma
+                                        ? (unsigned long long)
+                                                rx->last_processed->dma
                                         : 0,
                                 completed ? ", completed" : "",
                                 csr);
@@ -1167,8 +1169,11 @@ irqreturn_t cppi_interrupt(int irq, void *dev_id)
         tx = musb_readl(tibase, DAVINCI_TXCPPI_MASKED_REG);
         rx = musb_readl(tibase, DAVINCI_RXCPPI_MASKED_REG);
 
-        if (!tx && !rx)
+        if (!tx && !rx) {
+                if (cppi->irq)
+                        spin_unlock_irqrestore(&musb->lock, flags);
                 return IRQ_NONE;
+        }
 
         DBG(4, "CPPI IRQ Tx%x Rx%x\n", tx, rx);
 
@@ -1199,7 +1204,7 @@ irqreturn_t cppi_interrupt(int irq, void *dev_id)
                  */
                 if (NULL == bd) {
                         DBG(1, "null BD\n");
-                        tx_ram->tx_complete = 0;
+                        musb_writel(&tx_ram->tx_complete, 0, 0);
                         continue;
                 }
 
@@ -1452,7 +1457,7 @@ static int cppi_channel_abort(struct dma_channel *channel)
                  *    compare mode by writing 1 to the tx_complete register.
                  */
                 cppi_reset_tx(tx_ram, 1);
-                cppi_ch->head = 0;
+                cppi_ch->head = NULL;
                 musb_writel(&tx_ram->tx_complete, 0, 1);
                 cppi_dump_tx(5, cppi_ch, " (done teardown)");
 
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 630ae7f3cd4c..f10ff00ca09e 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1030,6 +1030,7 @@ static void musb_shutdown(struct platform_device *pdev)
         struct musb     *musb = dev_to_musb(&pdev->dev);
         unsigned long   flags;
 
+        pm_runtime_get_sync(musb->controller);
         spin_lock_irqsave(&musb->lock, flags);
         musb_platform_disable(musb);
         musb_generic_disable(musb);
@@ -1040,6 +1041,7 @@ static void musb_shutdown(struct platform_device *pdev)
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
         musb_platform_exit(musb);
 
+        pm_runtime_put(musb->controller);
         /* FIXME power down */
 }
 
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 4bd9e2145ee4..0e053b587960 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -261,6 +261,7 @@ enum musb_g_ep0_state {
  * @try_ilde:   tries to idle the IP
  * @vbus_status: returns vbus status if possible
  * @set_vbus:   forces vbus status
+ * @channel_program: pre check for standard dma channel_program func
  */
 struct musb_platform_ops {
         int     (*init)(struct musb *musb);
@@ -274,6 +275,10 @@ struct musb_platform_ops {
 
         int     (*vbus_status)(struct musb *musb);
         void    (*set_vbus)(struct musb *musb, int on);
+
+        int     (*adjust_channel_params)(struct dma_channel *channel,
+                                u16 packet_sz, u8 *mode,
+                                dma_addr_t *dma_addr, u32 *len);
 };
 
 /*
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 98519c5d8b5c..6dfbf9ffd7a6 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -535,7 +535,7 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                         is_dma = 1;
                         csr |= MUSB_TXCSR_P_WZC_BITS;
                         csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
-                                 MUSB_TXCSR_TXPKTRDY);
+                                 MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
                         musb_writew(epio, MUSB_TXCSR, csr);
                         /* Ensure writebuffer is empty. */
                         csr = musb_readw(epio, MUSB_TXCSR);
@@ -1296,7 +1296,7 @@ static int musb_gadget_dequeue(struct usb_ep *ep, struct usb_request *request)
         }
 
         /* if the hardware doesn't have the request, easy ... */
-        if (musb_ep->req_list.next != &request->list || musb_ep->busy)
+        if (musb_ep->req_list.next != &req->list || musb_ep->busy)
                 musb_g_giveback(musb_ep, request, -ECONNRESET);
 
         /* ... else abort the dma transfer ... */
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 0144a2d481fd..d281792db05c 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -169,6 +169,14 @@ static int dma_channel_program(struct dma_channel *channel,
         BUG_ON(channel->status == MUSB_DMA_STATUS_UNKNOWN ||
                 channel->status == MUSB_DMA_STATUS_BUSY);
 
+        /* Let targets check/tweak the arguments */
+        if (musb->ops->adjust_channel_params) {
+                int ret = musb->ops->adjust_channel_params(channel,
+                        packet_sz, &mode, &dma_addr, &len);
+                if (ret)
+                        return ret;
+        }
+
         /*
          * The DMA engine in RTL1.8 and above cannot handle
          * DMA addresses that are not aligned to a 4 byte boundary.
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 25cb8b0003b1..57a27fa954b4 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -259,9 +259,10 @@ static int musb_otg_notifications(struct notifier_block *nb,
         case USB_EVENT_VBUS:
                 DBG(4, "VBUS Connect\n");
 
+#ifdef CONFIG_USB_GADGET_MUSB_HDRC
                 if (musb->gadget_driver)
                         pm_runtime_get_sync(musb->controller);
-
+#endif
                 otg_init(musb->xceiv);
                 break;
 
diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index d6384e4aeef9..f7e04bf34a13 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -93,6 +93,8 @@ static int __init ux500_probe(struct platform_device *pdev)
         }
 
         musb->dev.parent                = &pdev->dev;
+        musb->dev.dma_mask              = pdev->dev.dma_mask;
+        musb->dev.coherent_dma_mask     = pdev->dev.coherent_dma_mask;
 
         glue->dev                       = &pdev->dev;
         glue->musb                      = musb;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index a973c7a29d6e..4de6ef0ae52a 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -151,6 +151,8 @@ static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
  * /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
  */
 static struct usb_device_id id_table_combined [] = {
+        { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
@@ -525,6 +527,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(SEALEVEL_VID, SEALEVEL_2803_8_PID) },
         { USB_DEVICE(IDTECH_VID, IDTECH_IDT1221U_PID) },
         { USB_DEVICE(OCT_VID, OCT_US101_PID) },
+        { USB_DEVICE(OCT_VID, OCT_DK201_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_HE_TIRA1_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_HE_TIRA1_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_USB_UIRT_PID),
@@ -787,6 +790,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
+        { USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
+        { USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
         { USB_DEVICE(FTDI_VID, HAMEG_HO870_PID) },
         { USB_DEVICE(FTDI_VID, MJSG_GENERIC_PID) },
         { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index c543e55bafba..efffc23723bd 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -300,6 +300,8 @@
  * Hameg HO820 and HO870 interface (using VID 0x0403)
  */
 #define HAMEG_HO820_PID                 0xed74
+#define HAMEG_HO730_PID                 0xed73
+#define HAMEG_HO720_PID                 0xed72
 #define HAMEG_HO870_PID                 0xed71
 
 /*
@@ -572,6 +574,7 @@
 /* Note: OCT US101 is also rebadged as Dick Smith Electronics (NZ) XH6381 */
 /* Also rebadged as Dick Smith Electronics (Aus) XH6451 */
 /* Also rebadged as SIIG Inc. model US2308 hardware version 1 */
+#define OCT_DK201_PID           0x0103  /* OCT DK201 USB docking station */
 #define OCT_US101_PID           0x0421  /* OCT US101 USB to RS-232 */
 
 /*
@@ -1141,3 +1144,12 @@
 #define QIHARDWARE_VID                  0x20B7
 #define MILKYMISTONE_JTAGSERIAL_PID     0x0713
 
+/*
+ * CTI GmbH RS485 Converter http://www.cti-lean.com/
+ */
+/* USB-485-Mini*/
+#define FTDI_CTI_MINI_PID       0xF608
+/* USB-Nano-485*/
+#define FTDI_CTI_NANO_PID       0xF60B
+
+
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 75c7f456eed5..d77ff0435896 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -407,6 +407,10 @@ static void option_instat_callback(struct urb *urb);
 /* ONDA MT825UP HSDPA 14.2 modem */
 #define ONDA_MT825UP         0x000b
 
+/* Samsung products */
+#define SAMSUNG_VENDOR_ID                       0x04e8
+#define SAMSUNG_PRODUCT_GT_B3730                0x6889
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                 OPTION_BLACKLIST_NONE = 0,
@@ -968,6 +972,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
         { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
         { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
+        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730/GT-B3710 LTE USB modem.*/
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 8858201eb1d3..54a9dab1f33b 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -111,7 +111,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
         ifnum = intf->desc.bInterfaceNumber;
         dbg("This Interface = %d", ifnum);
 
-        data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
+        data = kzalloc(sizeof(struct usb_wwan_intf_private),
                                          GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
@@ -134,8 +134,10 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                     usb_endpoint_is_bulk_out(&intf->endpoint[1].desc)) {
                         dbg("QDL port found");
 
-                        if (serial->interface->num_altsetting == 1)
-                                return 0;
+                        if (serial->interface->num_altsetting == 1) {
+                                retval = 0; /* Success */
+                                break;
+                        }
 
                         retval = usb_set_interface(serial->dev, ifnum, 1);
                         if (retval < 0) {
@@ -145,7 +147,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                 retval = -ENODEV;
                                 kfree(data);
                         }
-                        return retval;
                 }
                 break;
 
@@ -166,6 +167,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                         "Could not set interface, error %d\n",
                                         retval);
                                 retval = -ENODEV;
+                                kfree(data);
                         }
                 } else if (ifnum == 2) {
                         dbg("Modem port found");
@@ -177,7 +179,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                 retval = -ENODEV;
                                 kfree(data);
                         }
-                        return retval;
                 } else if (ifnum==3) {
                         /*
                          * NMEA (serial line 9600 8N1)
@@ -191,6 +192,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                         "Could not set interface, error %d\n",
                                         retval);
                                 retval = -ENODEV;
+                                kfree(data);
                         }
                 }
                 break;
@@ -199,12 +201,27 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                 dev_err(&serial->dev->dev,
                         "unknown number of interfaces: %d\n", nintf);
                 kfree(data);
-                return -ENODEV;
+                retval = -ENODEV;
         }
 
+        /* Set serial->private if not returning -ENODEV */
+        if (retval != -ENODEV)
+                usb_set_serial_data(serial, data);
         return retval;
 }
 
+static void qc_release(struct usb_serial *serial)
+{
+        struct usb_wwan_intf_private *priv = usb_get_serial_data(serial);
+
+        dbg("%s", __func__);
+
+        /* Call usb_wwan release & free the private data allocated in qcprobe */
+        usb_wwan_release(serial);
+        usb_set_serial_data(serial, NULL);
+        kfree(priv);
+}
+
 static struct usb_serial_driver qcdevice = {
         .driver = {
                 .owner     = THIS_MODULE,
@@ -222,7 +239,7 @@ static struct usb_serial_driver qcdevice = {
         .chars_in_buffer     = usb_wwan_chars_in_buffer,
         .attach              = usb_wwan_startup,
         .disconnect          = usb_wwan_disconnect,
-        .release             = usb_wwan_release,
+        .release             = qc_release,
 #ifdef CONFIG_PM
         .suspend             = usb_wwan_suspend,
         .resume              = usb_wwan_resume,
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index a2e5b5100ab4..0f4e8c942f9e 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -1648,7 +1648,9 @@ pxafb_freq_transition(struct notifier_block *nb, unsigned long val, void *data)
 
         switch (val) {
         case CPUFREQ_PRECHANGE:
-                if (!fbi->overlay[0].usage && !fbi->overlay[1].usage)
+#ifdef CONFIG_FB_PXA_OVERLAY
+                if (!(fbi->overlay[0].usage || fbi->overlay[1].usage))
+#endif
                         set_ctrlr_state(fbi, C_DISABLE_CLKCHANGE);
                 break;
 
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index 4fb5b2bf2348..4bcc8b82640b 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -590,15 +590,10 @@ static struct virtio_config_ops virtio_pci_config_ops = {
 
 static void virtio_pci_release_dev(struct device *_d)
 {
-        struct virtio_device *dev = container_of(_d, struct virtio_device, dev);
+        struct virtio_device *dev = container_of(_d, struct virtio_device,
+                                                 dev);
         struct virtio_pci_device *vp_dev = to_vp_device(dev);
-        struct pci_dev *pci_dev = vp_dev->pci_dev;
 
-        vp_del_vqs(dev);
-        pci_set_drvdata(pci_dev, NULL);
-        pci_iounmap(pci_dev, vp_dev->ioaddr);
-        pci_release_regions(pci_dev);
-        pci_disable_device(pci_dev);
         kfree(vp_dev);
 }
 
@@ -681,6 +676,12 @@ static void __devexit virtio_pci_remove(struct pci_dev *pci_dev)
         struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
 
         unregister_virtio_device(&vp_dev->vdev);
+
+        vp_del_vqs(&vp_dev->vdev);
+        pci_set_drvdata(pci_dev, NULL);
+        pci_iounmap(pci_dev, vp_dev->ioaddr);
+        pci_release_regions(pci_dev);
+        pci_disable_device(pci_dev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index cc2f73e03475..b0043fb26a4d 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -371,6 +371,7 @@ void *virtqueue_detach_unused_buf(struct virtqueue *_vq)
                 /* detach_buf clears data, so grab it now. */
                 buf = vq->data[i];
                 detach_buf(vq, i);
+                vq->vring.avail->idx--;
                 END_USE(vq);
                 return buf;
         }
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index 35a0d12dad73..5fd020da7c55 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -35,6 +35,7 @@
  *      document number 324645-001, 324646-001: Cougar Point (CPT)
  *      document number TBD                   : Patsburg (PBG)
  *      document number TBD                   : DH89xxCC
+ *      document number TBD                   : Panther Point
  */
 
 /*
@@ -153,6 +154,38 @@ enum iTCO_chipsets {
         TCO_PBG1,       /* Patsburg */
         TCO_PBG2,       /* Patsburg */
         TCO_DH89XXCC,   /* DH89xxCC */
+        TCO_PPT0,       /* Panther Point */
+        TCO_PPT1,       /* Panther Point */
+        TCO_PPT2,       /* Panther Point */
+        TCO_PPT3,       /* Panther Point */
+        TCO_PPT4,       /* Panther Point */
+        TCO_PPT5,       /* Panther Point */
+        TCO_PPT6,       /* Panther Point */
+        TCO_PPT7,       /* Panther Point */
+        TCO_PPT8,       /* Panther Point */
+        TCO_PPT9,       /* Panther Point */
+        TCO_PPT10,      /* Panther Point */
+        TCO_PPT11,      /* Panther Point */
+        TCO_PPT12,      /* Panther Point */
+        TCO_PPT13,      /* Panther Point */
+        TCO_PPT14,      /* Panther Point */
+        TCO_PPT15,      /* Panther Point */
+        TCO_PPT16,      /* Panther Point */
+        TCO_PPT17,      /* Panther Point */
+        TCO_PPT18,      /* Panther Point */
+        TCO_PPT19,      /* Panther Point */
+        TCO_PPT20,      /* Panther Point */
+        TCO_PPT21,      /* Panther Point */
+        TCO_PPT22,      /* Panther Point */
+        TCO_PPT23,      /* Panther Point */
+        TCO_PPT24,      /* Panther Point */
+        TCO_PPT25,      /* Panther Point */
+        TCO_PPT26,      /* Panther Point */
+        TCO_PPT27,      /* Panther Point */
+        TCO_PPT28,      /* Panther Point */
+        TCO_PPT29,      /* Panther Point */
+        TCO_PPT30,      /* Panther Point */
+        TCO_PPT31,      /* Panther Point */
 };
 
 static struct {
@@ -244,6 +277,38 @@ static struct {
         {"Patsburg", 2},
         {"Patsburg", 2},
         {"DH89xxCC", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
         {NULL, 0}
 };
 
@@ -363,6 +428,38 @@ static DEFINE_PCI_DEVICE_TABLE(iTCO_wdt_pci_tbl) = {
         { ITCO_PCI_DEVICE(0x1d40,                               TCO_PBG1)},
         { ITCO_PCI_DEVICE(0x1d41,                               TCO_PBG2)},
         { ITCO_PCI_DEVICE(0x2310,                               TCO_DH89XXCC)},
+        { ITCO_PCI_DEVICE(0x1e40,                               TCO_PPT0)},
+        { ITCO_PCI_DEVICE(0x1e41,                               TCO_PPT1)},
+        { ITCO_PCI_DEVICE(0x1e42,                               TCO_PPT2)},
+        { ITCO_PCI_DEVICE(0x1e43,                               TCO_PPT3)},
+        { ITCO_PCI_DEVICE(0x1e44,                               TCO_PPT4)},
+        { ITCO_PCI_DEVICE(0x1e45,                               TCO_PPT5)},
+        { ITCO_PCI_DEVICE(0x1e46,                               TCO_PPT6)},
+        { ITCO_PCI_DEVICE(0x1e47,                               TCO_PPT7)},
+        { ITCO_PCI_DEVICE(0x1e48,                               TCO_PPT8)},
+        { ITCO_PCI_DEVICE(0x1e49,                               TCO_PPT9)},
+        { ITCO_PCI_DEVICE(0x1e4a,                               TCO_PPT10)},
+        { ITCO_PCI_DEVICE(0x1e4b,                               TCO_PPT11)},
+        { ITCO_PCI_DEVICE(0x1e4c,                               TCO_PPT12)},
+        { ITCO_PCI_DEVICE(0x1e4d,                               TCO_PPT13)},
+        { ITCO_PCI_DEVICE(0x1e4e,                               TCO_PPT14)},
+        { ITCO_PCI_DEVICE(0x1e4f,                               TCO_PPT15)},
+        { ITCO_PCI_DEVICE(0x1e50,                               TCO_PPT16)},
+        { ITCO_PCI_DEVICE(0x1e51,                               TCO_PPT17)},
+        { ITCO_PCI_DEVICE(0x1e52,                               TCO_PPT18)},
+        { ITCO_PCI_DEVICE(0x1e53,                               TCO_PPT19)},
+        { ITCO_PCI_DEVICE(0x1e54,                               TCO_PPT20)},
+        { ITCO_PCI_DEVICE(0x1e55,                               TCO_PPT21)},
+        { ITCO_PCI_DEVICE(0x1e56,                               TCO_PPT22)},
+        { ITCO_PCI_DEVICE(0x1e57,                               TCO_PPT23)},
+        { ITCO_PCI_DEVICE(0x1e58,                               TCO_PPT24)},
+        { ITCO_PCI_DEVICE(0x1e59,                               TCO_PPT25)},
+        { ITCO_PCI_DEVICE(0x1e5a,                               TCO_PPT26)},
+        { ITCO_PCI_DEVICE(0x1e5b,                               TCO_PPT27)},
+        { ITCO_PCI_DEVICE(0x1e5c,                               TCO_PPT28)},
+        { ITCO_PCI_DEVICE(0x1e5d,                               TCO_PPT29)},
+        { ITCO_PCI_DEVICE(0x1e5e,                               TCO_PPT30)},
+        { ITCO_PCI_DEVICE(0x1e5f,                               TCO_PPT31)},
         { 0, },                 /* End of list */
 };
 MODULE_DEVICE_TABLE(pci, iTCO_wdt_pci_tbl);
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 42d6c930cc87..33167b43ac7e 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -912,8 +912,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
                               unsigned long irqflags,
                               const char *devname, void *dev_id)
 {
-        unsigned int irq;
-        int retval;
+        int irq, retval;
 
         irq = bind_evtchn_to_irq(evtchn);
         if (irq < 0)
@@ -955,8 +954,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
                             irq_handler_t handler,
                             unsigned long irqflags, const char *devname, void *dev_id)
 {
-        unsigned int irq;
-        int retval;
+        int irq, retval;
 
         irq = bind_virq_to_irq(virq, cpu);
         if (irq < 0)
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 95143dd6904d..a2eee574784e 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -8,6 +8,7 @@
 #include <linux/sysrq.h>
 #include <linux/stop_machine.h>
 #include <linux/freezer.h>
+#include <linux/syscore_ops.h>
 
 #include <xen/xen.h>
 #include <xen/xenbus.h>
@@ -61,7 +62,7 @@ static void xen_post_suspend(int cancelled)
         xen_mm_unpin_all();
 }
 
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
 static int xen_suspend(void *data)
 {
         struct suspend_info *si = data;
@@ -70,8 +71,13 @@ static int xen_suspend(void *data)
         BUG_ON(!irqs_disabled());
 
         err = sysdev_suspend(PMSG_FREEZE);
+        if (!err) {
+                err = syscore_suspend();
+                if (err)
+                        sysdev_resume();
+        }
         if (err) {
-                printk(KERN_ERR "xen_suspend: sysdev_suspend failed: %d\n",
+                printk(KERN_ERR "xen_suspend: system core suspend failed: %d\n",
                         err);
                 return err;
         }
@@ -95,6 +101,7 @@ static int xen_suspend(void *data)
                 xen_timer_resume();
         }
 
+        syscore_resume();
         sysdev_resume();
 
         return 0;
@@ -173,7 +180,7 @@ out:
 #endif
         shutting_down = SHUTDOWN_INVALID;
 }
-#endif  /* CONFIG_HIBERNATION */
+#endif  /* CONFIG_HIBERNATE_CALLBACKS */
 
 struct shutdown_handler {
         const char *command;
@@ -202,7 +209,7 @@ static void shutdown_handler(struct xenbus_watch *watch,
                 { "poweroff",   do_poweroff },
                 { "halt",       do_poweroff },
                 { "reboot",     do_reboot   },
-#ifdef CONFIG_HIBERNATION
+#ifdef CONFIG_HIBERNATE_CALLBACKS
                 { "suspend",    do_suspend  },
 #endif
                 {NULL, NULL},
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 0ee594569dcc..85b67ffa2a43 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -286,11 +286,9 @@ static struct p9_fid *v9fs_fid_clone_with_uid(struct dentry *dentry, uid_t uid)
 
 struct p9_fid *v9fs_writeback_fid(struct dentry *dentry)
 {
-        int err, flags;
+        int err;
         struct p9_fid *fid;
-        struct v9fs_session_info *v9ses;
 
-        v9ses = v9fs_dentry2v9ses(dentry);
         fid = v9fs_fid_clone_with_uid(dentry, 0);
         if (IS_ERR(fid))
                 goto error_out;
@@ -299,17 +297,8 @@ struct p9_fid *v9fs_writeback_fid(struct dentry *dentry)
          * dirty pages. We always request for the open fid in read-write
          * mode so that a partial page write which result in page
          * read can work.
-         *
-         * we don't have a tsyncfs operation for older version
-         * of protocol. So make sure the write back fid is
-         * opened in O_SYNC mode.
          */
-        if (!v9fs_proto_dotl(v9ses))
-                flags = O_RDWR | O_SYNC;
-        else
-                flags = O_RDWR;
-
-        err = p9_client_open(fid, flags);
+        err = p9_client_open(fid, O_RDWR);
         if (err < 0) {
                 p9_client_clunk(fid);
                 fid = ERR_PTR(err);
diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h
index 9665c2b840e6..e5ebedfc5ed8 100644
--- a/fs/9p/v9fs.h
+++ b/fs/9p/v9fs.h
@@ -116,7 +116,6 @@ struct v9fs_session_info {
         struct list_head slist; /* list of sessions registered with v9fs */
         struct backing_dev_info bdi;
         struct rw_semaphore rename_sem;
-        struct p9_fid *root_fid; /* Used for file system sync */
 };
 
 /* cache_validity flags */
diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c
index b6a3b9f7fe4d..e022890c6f40 100644
--- a/fs/9p/vfs_dentry.c
+++ b/fs/9p/vfs_dentry.c
@@ -126,7 +126,9 @@ static int v9fs_lookup_revalidate(struct dentry *dentry, struct nameidata *nd)
                         retval = v9fs_refresh_inode_dotl(fid, inode);
                 else
                         retval = v9fs_refresh_inode(fid, inode);
-                if (retval <= 0)
+                if (retval == -ENOENT)
+                        return 0;
+                if (retval < 0)
                         return retval;
         }
 out_valid:
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index ffbb113d5f33..82a7c38ddad0 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -811,7 +811,7 @@ v9fs_vfs_follow_link_dotl(struct dentry *dentry, struct nameidata *nd)
         fid = v9fs_fid_lookup(dentry);
         if (IS_ERR(fid)) {
                 __putname(link);
-                link = ERR_PTR(PTR_ERR(fid));
+                link = ERR_CAST(fid);
                 goto ndset;
         }
         retval = p9_client_readlink(fid, &target);
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index f3eed3383e4f..feef6cdc1fd2 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -154,6 +154,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
                 retval = PTR_ERR(inode);
                 goto release_sb;
         }
+
         root = d_alloc_root(inode);
         if (!root) {
                 iput(inode);
@@ -185,21 +186,10 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
                 p9stat_free(st);
                 kfree(st);
         }
-        v9fs_fid_add(root, fid);
         retval = v9fs_get_acl(inode, fid);
         if (retval)
                 goto release_sb;
-        /*
-         * Add the root fid to session info. This is used
-         * for file system sync. We want a cloned fid here
-         * so that we can do a sync_filesystem after a
-         * shrink_dcache_for_umount
-         */
-        v9ses->root_fid = v9fs_fid_clone(root);
-        if (IS_ERR(v9ses->root_fid)) {
-                retval = PTR_ERR(v9ses->root_fid);
-                goto release_sb;
-        }
+        v9fs_fid_add(root, fid);
 
         P9_DPRINTK(P9_DEBUG_VFS, " simple set mount, return 0\n");
         return dget(sb->s_root);
@@ -210,11 +200,15 @@ close_session:
         v9fs_session_close(v9ses);
         kfree(v9ses);
         return ERR_PTR(retval);
+
 release_sb:
         /*
-         * we will do the session_close and root dentry
-         * release in the below call.
+         * we will do the session_close and root dentry release
+         * in the below call. But we need to clunk fid, because we haven't
+         * attached the fid to dentry so it won't get clunked
+         * automatically.
          */
+        p9_client_clunk(fid);
         deactivate_locked_super(sb);
         return ERR_PTR(retval);
 }
@@ -232,7 +226,7 @@ static void v9fs_kill_super(struct super_block *s)
         P9_DPRINTK(P9_DEBUG_VFS, " %p\n", s);
 
         kill_anon_super(s);
-        p9_client_clunk(v9ses->root_fid);
+
         v9fs_session_cancel(v9ses);
         v9fs_session_close(v9ses);
         kfree(v9ses);
@@ -285,14 +279,6 @@ done:
         return res;
 }
 
-static int v9fs_sync_fs(struct super_block *sb, int wait)
-{
-        struct v9fs_session_info *v9ses = sb->s_fs_info;
-
-        P9_DPRINTK(P9_DEBUG_VFS, "v9fs_sync_fs: super_block %p\n", sb);
-        return p9_client_sync_fs(v9ses->root_fid);
-}
-
 static int v9fs_drop_inode(struct inode *inode)
 {
         struct v9fs_session_info *v9ses;
@@ -307,6 +293,51 @@ static int v9fs_drop_inode(struct inode *inode)
         return 1;
 }
 
+static int v9fs_write_inode(struct inode *inode,
+                            struct writeback_control *wbc)
+{
+        int ret;
+        struct p9_wstat wstat;
+        struct v9fs_inode *v9inode;
+        /*
+         * send an fsync request to server irrespective of
+         * wbc->sync_mode.
+         */
+        P9_DPRINTK(P9_DEBUG_VFS, "%s: inode %p\n", __func__, inode);
+        v9inode = V9FS_I(inode);
+        if (!v9inode->writeback_fid)
+                return 0;
+        v9fs_blank_wstat(&wstat);
+
+        ret = p9_client_wstat(v9inode->writeback_fid, &wstat);
+        if (ret < 0) {
+                __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+                return ret;
+        }
+        return 0;
+}
+
+static int v9fs_write_inode_dotl(struct inode *inode,
+                                 struct writeback_control *wbc)
+{
+        int ret;
+        struct v9fs_inode *v9inode;
+        /*
+         * send an fsync request to server irrespective of
+         * wbc->sync_mode.
+         */
+        P9_DPRINTK(P9_DEBUG_VFS, "%s: inode %p\n", __func__, inode);
+        v9inode = V9FS_I(inode);
+        if (!v9inode->writeback_fid)
+                return 0;
+        ret = p9_client_fsync(v9inode->writeback_fid, 0);
+        if (ret < 0) {
+                __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+                return ret;
+        }
+        return 0;
+}
+
 static const struct super_operations v9fs_super_ops = {
         .alloc_inode = v9fs_alloc_inode,
         .destroy_inode = v9fs_destroy_inode,
@@ -314,17 +345,18 @@ static const struct super_operations v9fs_super_ops = {
         .evict_inode = v9fs_evict_inode,
         .show_options = generic_show_options,
         .umount_begin = v9fs_umount_begin,
+        .write_inode = v9fs_write_inode,
 };
 
 static const struct super_operations v9fs_super_ops_dotl = {
         .alloc_inode = v9fs_alloc_inode,
         .destroy_inode = v9fs_destroy_inode,
-        .sync_fs = v9fs_sync_fs,
         .statfs = v9fs_statfs,
         .drop_inode = v9fs_drop_inode,
         .evict_inode = v9fs_evict_inode,
         .show_options = generic_show_options,
         .umount_begin = v9fs_umount_begin,
+        .write_inode = v9fs_write_inode_dotl,
 };
 
 struct file_system_type v9fs_fs_type = {
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index f34078d702d3..303983fabfd6 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -941,9 +941,13 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
         current->mm->start_stack = bprm->p;
 
 #ifdef arch_randomize_brk
-        if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1))
+        if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
                 current->mm->brk = current->mm->start_brk =
                         arch_randomize_brk(current->mm);
+#ifdef CONFIG_COMPAT_BRK
+                current->brk_randomized = 1;
+#endif
+        }
 #endif
 
         if (current->personality & MMAP_PAGE_ZERO) {
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index de34bfad9ec3..5d505aaa72fb 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -178,16 +178,17 @@ static int btrfs_xattr_acl_set(struct dentry *dentry, const char *name,
 
         if (value) {
                 acl = posix_acl_from_xattr(value, size);
-                if (acl == NULL) {
-                        value = NULL;
-                        size = 0;
+                if (acl) {
+                        ret = posix_acl_valid(acl);
+                        if (ret)
+                                goto out;
                 } else if (IS_ERR(acl)) {
                         return PTR_ERR(acl);
                 }
         }
 
         ret = btrfs_set_acl(NULL, dentry->d_inode, acl, type);
-
+out:
         posix_acl_release(acl);
 
         return ret;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 3458b5725540..8f4b81de3ae2 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -718,7 +718,7 @@ struct btrfs_space_info {
         u64 total_bytes;        /* total bytes in the space,
                                    this doesn't take mirrors into account */
         u64 bytes_used;         /* total bytes used,
-                                   this does't take mirrors into account */
+                                   this doesn't take mirrors into account */
         u64 bytes_pinned;       /* total bytes pinned, will be freed when the
                                    transaction finishes */
         u64 bytes_reserved;     /* total bytes the allocator has reserved for
@@ -740,8 +740,10 @@ struct btrfs_space_info {
          */
         unsigned long reservation_progress;
 
-        int full;               /* indicates that we cannot allocate any more
+        int full:1;             /* indicates that we cannot allocate any more
                                    chunks for this space */
+        int chunk_alloc:1;      /* set if we are allocating a chunk */
+
         int force_alloc;        /* set if we need to force a chunk alloc for
                                    this space */
 
@@ -2576,6 +2578,11 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, struct inode *inode,
 int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
                               struct inode *inode, u64 start, u64 end);
 int btrfs_release_file(struct inode *inode, struct file *file);
+void btrfs_drop_pages(struct page **pages, size_t num_pages);
+int btrfs_dirty_pages(struct btrfs_root *root, struct inode *inode,
+                      struct page **pages, size_t num_pages,
+                      loff_t pos, size_t write_bytes,
+                      struct extent_state **cached);
 
 /* tree-defrag.c */
 int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8f1d44ba332f..228cf36ece83 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2824,6 +2824,7 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
 
         spin_lock(&delayed_refs->lock);
         if (delayed_refs->num_entries == 0) {
+                spin_unlock(&delayed_refs->lock);
                 printk(KERN_INFO "delayed_refs has NO entry\n");
                 return ret;
         }
@@ -3057,7 +3058,7 @@ static int btrfs_cleanup_transaction(struct btrfs_root *root)
                 btrfs_destroy_pinned_extent(root,
                                             root->fs_info->pinned_extents);
 
-                t->use_count = 0;
+                atomic_set(&t->use_count, 0);
                 list_del_init(&t->list);
                 memset(t, 0, sizeof(*t));
                 kmem_cache_free(btrfs_transaction_cachep, t);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index f619c3cb13b7..cd52f7f556ef 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -33,6 +33,25 @@
 #include "locking.h"
 #include "free-space-cache.h"
 
+/* control flags for do_chunk_alloc's force field
+ * CHUNK_ALLOC_NO_FORCE means to only allocate a chunk
+ * if we really need one.
+ *
+ * CHUNK_ALLOC_FORCE means it must try to allocate one
+ *
+ * CHUNK_ALLOC_LIMITED means to only try and allocate one
+ * if we have very few chunks already allocated.  This is
+ * used as part of the clustering code to help make sure
+ * we have a good pool of storage to cluster in, without
+ * filling the FS with empty chunks
+ *
+ */
+enum {
+        CHUNK_ALLOC_NO_FORCE = 0,
+        CHUNK_ALLOC_FORCE = 1,
+        CHUNK_ALLOC_LIMITED = 2,
+};
+
 static int update_block_group(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root,
                               u64 bytenr, u64 num_bytes, int alloc);
@@ -3019,7 +3038,8 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
         found->bytes_readonly = 0;
         found->bytes_may_use = 0;
         found->full = 0;
-        found->force_alloc = 0;
+        found->force_alloc = CHUNK_ALLOC_NO_FORCE;
+        found->chunk_alloc = 0;
         *space_info = found;
         list_add_rcu(&found->list, &info->space_info);
         atomic_set(&found->caching_threads, 0);
@@ -3150,7 +3170,7 @@ again:
                 if (!data_sinfo->full && alloc_chunk) {
                         u64 alloc_target;
 
-                        data_sinfo->force_alloc = 1;
+                        data_sinfo->force_alloc = CHUNK_ALLOC_FORCE;
                         spin_unlock(&data_sinfo->lock);
 alloc:
                         alloc_target = btrfs_get_alloc_profile(root, 1);
@@ -3160,7 +3180,8 @@ alloc:
 
                         ret = do_chunk_alloc(trans, root->fs_info->extent_root,
                                              bytes + 2 * 1024 * 1024,
-                                             alloc_target, 0);
+                                             alloc_target,
+                                             CHUNK_ALLOC_NO_FORCE);
                         btrfs_end_transaction(trans, root);
                         if (ret < 0) {
                                 if (ret != -ENOSPC)
@@ -3239,31 +3260,56 @@ static void force_metadata_allocation(struct btrfs_fs_info *info)
         rcu_read_lock();
         list_for_each_entry_rcu(found, head, list) {
                 if (found->flags & BTRFS_BLOCK_GROUP_METADATA)
-                        found->force_alloc = 1;
+                        found->force_alloc = CHUNK_ALLOC_FORCE;
         }
         rcu_read_unlock();
 }
 
 static int should_alloc_chunk(struct btrfs_root *root,
-                              struct btrfs_space_info *sinfo, u64 alloc_bytes)
+                              struct btrfs_space_info *sinfo, u64 alloc_bytes,
+                              int force)
 {
         u64 num_bytes = sinfo->total_bytes - sinfo->bytes_readonly;
+        u64 num_allocated = sinfo->bytes_used + sinfo->bytes_reserved;
         u64 thresh;
 
-        if (sinfo->bytes_used + sinfo->bytes_reserved +
-            alloc_bytes + 256 * 1024 * 1024 < num_bytes)
+        if (force == CHUNK_ALLOC_FORCE)
+                return 1;
+
+        /*
+         * in limited mode, we want to have some free space up to
+         * about 1% of the FS size.
+         */
+        if (force == CHUNK_ALLOC_LIMITED) {
+                thresh = btrfs_super_total_bytes(&root->fs_info->super_copy);
+                thresh = max_t(u64, 64 * 1024 * 1024,
+                               div_factor_fine(thresh, 1));
+
+                if (num_bytes - num_allocated < thresh)
+                        return 1;
+        }
+
+        /*
+         * we have two similar checks here, one based on percentage
+         * and once based on a hard number of 256MB.  The idea
+         * is that if we have a good amount of free
+         * room, don't allocate a chunk.  A good mount is
+         * less than 80% utilized of the chunks we have allocated,
+         * or more than 256MB free
+         */
+        if (num_allocated + alloc_bytes + 256 * 1024 * 1024 < num_bytes)
                 return 0;
 
-        if (sinfo->bytes_used + sinfo->bytes_reserved +
-            alloc_bytes < div_factor(num_bytes, 8))
+        if (num_allocated + alloc_bytes < div_factor(num_bytes, 8))
                 return 0;
 
         thresh = btrfs_super_total_bytes(&root->fs_info->super_copy);
+
+        /* 256MB or 5% of the FS */
         thresh = max_t(u64, 256 * 1024 * 1024, div_factor_fine(thresh, 5));
 
         if (num_bytes > thresh && sinfo->bytes_used < div_factor(num_bytes, 3))
                 return 0;
-
         return 1;
 }
 
@@ -3273,10 +3319,9 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
 {
         struct btrfs_space_info *space_info;
         struct btrfs_fs_info *fs_info = extent_root->fs_info;
+        int wait_for_alloc = 0;
         int ret = 0;
 
-        mutex_lock(&fs_info->chunk_mutex);
-
         flags = btrfs_reduce_alloc_profile(extent_root, flags);
 
         space_info = __find_space_info(extent_root->fs_info, flags);
@@ -3287,21 +3332,40 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
         }
         BUG_ON(!space_info);
 
+again:
         spin_lock(&space_info->lock);
         if (space_info->force_alloc)
-                force = 1;
+                force = space_info->force_alloc;
         if (space_info->full) {
                 spin_unlock(&space_info->lock);
-                goto out;
+                return 0;
         }
 
-        if (!force && !should_alloc_chunk(extent_root, space_info,
-                                          alloc_bytes)) {
+        if (!should_alloc_chunk(extent_root, space_info, alloc_bytes, force)) {
                 spin_unlock(&space_info->lock);
-                goto out;
+                return 0;
+        } else if (space_info->chunk_alloc) {
+                wait_for_alloc = 1;
+        } else {
+                space_info->chunk_alloc = 1;
         }
+
         spin_unlock(&space_info->lock);
 
+        mutex_lock(&fs_info->chunk_mutex);
+
+        /*
+         * The chunk_mutex is held throughout the entirety of a chunk
+         * allocation, so once we've acquired the chunk_mutex we know that the
+         * other guy is done and we need to recheck and see if we should
+         * allocate.
+         */
+        if (wait_for_alloc) {
+                mutex_unlock(&fs_info->chunk_mutex);
+                wait_for_alloc = 0;
+                goto again;
+        }
+
         /*
          * If we have mixed data/metadata chunks we want to make sure we keep
          * allocating mixed chunks instead of individual chunks.
@@ -3327,9 +3391,10 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
                 space_info->full = 1;
         else
                 ret = 1;
-        space_info->force_alloc = 0;
+
+        space_info->force_alloc = CHUNK_ALLOC_NO_FORCE;
+        space_info->chunk_alloc = 0;
         spin_unlock(&space_info->lock);
-out:
         mutex_unlock(&extent_root->fs_info->chunk_mutex);
         return ret;
 }
@@ -5303,11 +5368,13 @@ loop:
 
                 if (allowed_chunk_alloc) {
                         ret = do_chunk_alloc(trans, root, num_bytes +
-                                             2 * 1024 * 1024, data, 1);
+                                             2 * 1024 * 1024, data,
+                                             CHUNK_ALLOC_LIMITED);
                         allowed_chunk_alloc = 0;
                         done_chunk_alloc = 1;
-                } else if (!done_chunk_alloc) {
-                        space_info->force_alloc = 1;
+                } else if (!done_chunk_alloc &&
+                           space_info->force_alloc == CHUNK_ALLOC_NO_FORCE) {
+                        space_info->force_alloc = CHUNK_ALLOC_LIMITED;
                 }
 
                 if (loop < LOOP_NO_EMPTY_SIZE) {
@@ -5393,7 +5460,8 @@ again:
          */
         if (empty_size || root->ref_cows)
                 ret = do_chunk_alloc(trans, root->fs_info->extent_root,
-                                     num_bytes + 2 * 1024 * 1024, data, 0);
+                                     num_bytes + 2 * 1024 * 1024, data,
+                                     CHUNK_ALLOC_NO_FORCE);
 
         WARN_ON(num_bytes < root->sectorsize);
         ret = find_free_extent(trans, root, num_bytes, empty_size,
@@ -5405,7 +5473,7 @@ again:
                 num_bytes = num_bytes & ~(root->sectorsize - 1);
                 num_bytes = max(num_bytes, min_alloc_size);
                 do_chunk_alloc(trans, root->fs_info->extent_root,
-                               num_bytes, data, 1);
+                               num_bytes, data, CHUNK_ALLOC_FORCE);
                 goto again;
         }
         if (ret == -ENOSPC && btrfs_test_opt(root, ENOSPC_DEBUG)) {
@@ -7991,6 +8059,10 @@ static noinline int relocate_one_extent(struct btrfs_root *extent_root,
                                 u64 group_start = group->key.objectid;
                                 new_extents = kmalloc(sizeof(*new_extents),
                                                       GFP_NOFS);
+                                if (!new_extents) {
+                                        ret = -ENOMEM;
+                                        goto out;
+                                }
                                 nr_extents = 1;
                                 ret = get_new_locations(reloc_inode,
                                                         extent_key,
@@ -8109,13 +8181,15 @@ int btrfs_set_block_group_ro(struct btrfs_root *root,
 
         alloc_flags = update_block_group_flags(root, cache->flags);
         if (alloc_flags != cache->flags)
-                do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags, 1);
+                do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags,
+                               CHUNK_ALLOC_FORCE);
 
         ret = set_block_group_ro(cache);
         if (!ret)
                 goto out;
         alloc_flags = get_alloc_profile(root, cache->space_info->flags);
-        ret = do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags, 1);
+        ret = do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags,
+                             CHUNK_ALLOC_FORCE);
         if (ret < 0)
                 goto out;
         ret = set_block_group_ro(cache);
@@ -8128,7 +8202,8 @@ int btrfs_force_chunk_alloc(struct btrfs_trans_handle *trans,
                             struct btrfs_root *root, u64 type)
 {
         u64 alloc_flags = get_alloc_profile(root, type);
-        return do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags, 1);
+        return do_chunk_alloc(trans, root, 2 * 1024 * 1024, alloc_flags,
+                              CHUNK_ALLOC_FORCE);
 }
 
 /*
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 20ddb28602a8..ba41da59e31b 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -690,6 +690,15 @@ static void cache_state(struct extent_state *state,
         }
 }
 
+static void uncache_state(struct extent_state **cached_ptr)
+{
+        if (cached_ptr && (*cached_ptr)) {
+                struct extent_state *state = *cached_ptr;
+                *cached_ptr = NULL;
+                free_extent_state(state);
+        }
+}
+
 /*
  * set some bits on a range in the tree.  This may require allocations or
  * sleeping, so the gfp mask is used to indicate what is allowed.
@@ -940,10 +949,10 @@ static int clear_extent_new(struct extent_io_tree *tree, u64 start, u64 end,
 }
 
 int set_extent_uptodate(struct extent_io_tree *tree, u64 start, u64 end,
-                        gfp_t mask)
+                        struct extent_state **cached_state, gfp_t mask)
 {
-        return set_extent_bit(tree, start, end, EXTENT_UPTODATE, 0, NULL,
-                              NULL, mask);
+        return set_extent_bit(tree, start, end, EXTENT_UPTODATE, 0,
+                              NULL, cached_state, mask);
 }
 
 static int clear_extent_uptodate(struct extent_io_tree *tree, u64 start,
@@ -1012,8 +1021,7 @@ int unlock_extent_cached(struct extent_io_tree *tree, u64 start, u64 end,
                                 mask);
 }
 
-int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end,
-                  gfp_t mask)
+int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end, gfp_t mask)
 {
         return clear_extent_bit(tree, start, end, EXTENT_LOCKED, 1, 0, NULL,
                                 mask);
@@ -1735,6 +1743,9 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
 
         do {
                 struct page *page = bvec->bv_page;
+                struct extent_state *cached = NULL;
+                struct extent_state *state;
+
                 tree = &BTRFS_I(page->mapping->host)->io_tree;
 
                 start = ((u64)page->index << PAGE_CACHE_SHIFT) +
@@ -1749,9 +1760,20 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                 if (++bvec <= bvec_end)
                         prefetchw(&bvec->bv_page->flags);
 
+                spin_lock(&tree->lock);
+                state = find_first_extent_bit_state(tree, start, EXTENT_LOCKED);
+                if (state && state->start == start) {
+                        /*
+                         * take a reference on the state, unlock will drop
+                         * the ref
+                         */
+                        cache_state(state, &cached);
+                }
+                spin_unlock(&tree->lock);
+
                 if (uptodate && tree->ops && tree->ops->readpage_end_io_hook) {
                         ret = tree->ops->readpage_end_io_hook(page, start, end,
-                                                              NULL);
+                                                              state);
                         if (ret)
                                 uptodate = 0;
                 }
@@ -1764,15 +1786,16 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                                         test_bit(BIO_UPTODATE, &bio->bi_flags);
                                 if (err)
                                         uptodate = 0;
+                                uncache_state(&cached);
                                 continue;
                         }
                 }
 
                 if (uptodate) {
-                        set_extent_uptodate(tree, start, end,
+                        set_extent_uptodate(tree, start, end, &cached,
                                             GFP_ATOMIC);
                 }
-                unlock_extent(tree, start, end, GFP_ATOMIC);
+                unlock_extent_cached(tree, start, end, &cached, GFP_ATOMIC);
 
                 if (whole_page) {
                         if (uptodate) {
@@ -1811,6 +1834,7 @@ static void end_bio_extent_preparewrite(struct bio *bio, int err)
 
         do {
                 struct page *page = bvec->bv_page;
+                struct extent_state *cached = NULL;
                 tree = &BTRFS_I(page->mapping->host)->io_tree;
 
                 start = ((u64)page->index << PAGE_CACHE_SHIFT) +
@@ -1821,13 +1845,14 @@ static void end_bio_extent_preparewrite(struct bio *bio, int err)
                         prefetchw(&bvec->bv_page->flags);
 
                 if (uptodate) {
-                        set_extent_uptodate(tree, start, end, GFP_ATOMIC);
+                        set_extent_uptodate(tree, start, end, &cached,
+                                            GFP_ATOMIC);
                 } else {
                         ClearPageUptodate(page);
                         SetPageError(page);
                 }
 
-                unlock_extent(tree, start, end, GFP_ATOMIC);
+                unlock_extent_cached(tree, start, end, &cached, GFP_ATOMIC);
 
         } while (bvec >= bio->bi_io_vec);
 
@@ -2016,14 +2041,17 @@ static int __extent_read_full_page(struct extent_io_tree *tree,
         while (cur <= end) {
                 if (cur >= last_byte) {
                         char *userpage;
+                        struct extent_state *cached = NULL;
+
                         iosize = PAGE_CACHE_SIZE - page_offset;
                         userpage = kmap_atomic(page, KM_USER0);
                         memset(userpage + page_offset, 0, iosize);
                         flush_dcache_page(page);
                         kunmap_atomic(userpage, KM_USER0);
                         set_extent_uptodate(tree, cur, cur + iosize - 1,
-                                            GFP_NOFS);
-                        unlock_extent(tree, cur, cur + iosize - 1, GFP_NOFS);
+                                            &cached, GFP_NOFS);
+                        unlock_extent_cached(tree, cur, cur + iosize - 1,
+                                             &cached, GFP_NOFS);
                         break;
                 }
                 em = get_extent(inode, page, page_offset, cur,
@@ -2063,14 +2091,17 @@ static int __extent_read_full_page(struct extent_io_tree *tree,
                 /* we've found a hole, just zero and go on */
                 if (block_start == EXTENT_MAP_HOLE) {
                         char *userpage;
+                        struct extent_state *cached = NULL;
+
                         userpage = kmap_atomic(page, KM_USER0);
                         memset(userpage + page_offset, 0, iosize);
                         flush_dcache_page(page);
                         kunmap_atomic(userpage, KM_USER0);
 
                         set_extent_uptodate(tree, cur, cur + iosize - 1,
-                                            GFP_NOFS);
-                        unlock_extent(tree, cur, cur + iosize - 1, GFP_NOFS);
+                                            &cached, GFP_NOFS);
+                        unlock_extent_cached(tree, cur, cur + iosize - 1,
+                                             &cached, GFP_NOFS);
                         cur = cur + iosize;
                         page_offset += iosize;
                         continue;
@@ -2650,7 +2681,7 @@ int extent_readpages(struct extent_io_tree *tree,
                 prefetchw(&page->flags);
                 list_del(&page->lru);
                 if (!add_to_page_cache_lru(page, mapping,
-                                        page->index, GFP_KERNEL)) {
+                                        page->index, GFP_NOFS)) {
                         __extent_read_full_page(tree, page, get_extent,
                                                 &bio, 0, &bio_flags);
                 }
@@ -2789,9 +2820,12 @@ int extent_prepare_write(struct extent_io_tree *tree,
                         iocount++;
                         block_start = block_start + iosize;
                 } else {
-                        set_extent_uptodate(tree, block_start, cur_end,
+                        struct extent_state *cached = NULL;
+
+                        set_extent_uptodate(tree, block_start, cur_end, &cached,
                                             GFP_NOFS);
-                        unlock_extent(tree, block_start, cur_end, GFP_NOFS);
+                        unlock_extent_cached(tree, block_start, cur_end,
+                                             &cached, GFP_NOFS);
                         block_start = cur_end + 1;
                 }
                 page_offset = block_start & (PAGE_CACHE_SIZE - 1);
@@ -3457,7 +3491,7 @@ int set_extent_buffer_uptodate(struct extent_io_tree *tree,
         num_pages = num_extent_pages(eb->start, eb->len);
 
         set_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
-                            GFP_NOFS);
+                            NULL, GFP_NOFS);
         for (i = 0; i < num_pages; i++) {
                 page = extent_buffer_page(eb, i);
                 if ((i == 0 && (eb->start & (PAGE_CACHE_SIZE - 1))) ||
@@ -3885,6 +3919,12 @@ static void move_pages(struct page *dst_page, struct page *src_page,
         kunmap_atomic(dst_kaddr, KM_USER0);
 }
 
+static inline bool areas_overlap(unsigned long src, unsigned long dst, unsigned long len)
+{
+        unsigned long distance = (src > dst) ? src - dst : dst - src;
+        return distance < len;
+}
+
 static void copy_pages(struct page *dst_page, struct page *src_page,
                        unsigned long dst_off, unsigned long src_off,
                        unsigned long len)
@@ -3892,10 +3932,12 @@ static void copy_pages(struct page *dst_page, struct page *src_page,
         char *dst_kaddr = kmap_atomic(dst_page, KM_USER0);
         char *src_kaddr;
 
-        if (dst_page != src_page)
+        if (dst_page != src_page) {
                 src_kaddr = kmap_atomic(src_page, KM_USER1);
-        else
+        } else {
                 src_kaddr = dst_kaddr;
+                BUG_ON(areas_overlap(src_off, dst_off, len));
+        }
 
         memcpy(dst_kaddr + dst_off, src_kaddr + src_off, len);
         kunmap_atomic(dst_kaddr, KM_USER0);
@@ -3970,7 +4012,7 @@ void memmove_extent_buffer(struct extent_buffer *dst, unsigned long dst_offset,
                        "len %lu len %lu\n", dst_offset, len, dst->len);
                 BUG_ON(1);
         }
-        if (dst_offset < src_offset) {
+        if (!areas_overlap(src_offset, dst_offset, len)) {
                 memcpy_extent_buffer(dst, dst_offset, src_offset, len);
                 return;
         }
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index f62c5442835d..af2d7179c372 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -208,7 +208,7 @@ int set_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
                    int bits, int exclusive_bits, u64 *failed_start,
                    struct extent_state **cached_state, gfp_t mask);
 int set_extent_uptodate(struct extent_io_tree *tree, u64 start, u64 end,
-                        gfp_t mask);
+                        struct extent_state **cached_state, gfp_t mask);
 int set_extent_new(struct extent_io_tree *tree, u64 start, u64 end,
                    gfp_t mask);
 int set_extent_dirty(struct extent_io_tree *tree, u64 start, u64 end,
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index e621ea54a3fd..75899a01dded 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -104,7 +104,7 @@ static noinline int btrfs_copy_from_user(loff_t pos, int num_pages,
 /*
  * unlocks pages after btrfs_file_write is done with them
  */
-static noinline void btrfs_drop_pages(struct page **pages, size_t num_pages)
+void btrfs_drop_pages(struct page **pages, size_t num_pages)
 {
         size_t i;
         for (i = 0; i < num_pages; i++) {
@@ -127,16 +127,13 @@ static noinline void btrfs_drop_pages(struct page **pages, size_t num_pages)
  * this also makes the decision about creating an inline extent vs
  * doing real data extents, marking pages dirty and delalloc as required.
  */
-static noinline int dirty_and_release_pages(struct btrfs_root *root,
-                                            struct file *file,
-                                            struct page **pages,
-                                            size_t num_pages,
-                                            loff_t pos,
-                                            size_t write_bytes)
+int btrfs_dirty_pages(struct btrfs_root *root, struct inode *inode,
+                      struct page **pages, size_t num_pages,
+                      loff_t pos, size_t write_bytes,
+                      struct extent_state **cached)
 {
         int err = 0;
         int i;
-        struct inode *inode = fdentry(file)->d_inode;
         u64 num_bytes;
         u64 start_pos;
         u64 end_of_last_block;
@@ -149,7 +146,7 @@ static noinline int dirty_and_release_pages(struct btrfs_root *root,
 
         end_of_last_block = start_pos + num_bytes - 1;
         err = btrfs_set_extent_delalloc(inode, start_pos, end_of_last_block,
-                                        NULL);
+                                        cached);
         if (err)
                 return err;
 
@@ -992,9 +989,9 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
                 }
 
                 if (copied > 0) {
-                        ret = dirty_and_release_pages(root, file, pages,
-                                                      dirty_pages, pos,
-                                                      copied);
+                        ret = btrfs_dirty_pages(root, inode, pages,
+                                                dirty_pages, pos, copied,
+                                                NULL);
                         if (ret) {
                                 btrfs_delalloc_release_space(inode,
                                         dirty_pages << PAGE_CACHE_SHIFT);
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index f561c953205b..63731a1fb0a1 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -508,6 +508,7 @@ int btrfs_write_out_cache(struct btrfs_root *root,
         struct inode *inode;
         struct rb_node *node;
         struct list_head *pos, *n;
+        struct page **pages;
         struct page *page;
         struct extent_state *cached_state = NULL;
         struct btrfs_free_cluster *cluster = NULL;
@@ -517,13 +518,13 @@ int btrfs_write_out_cache(struct btrfs_root *root,
         u64 start, end, len;
         u64 bytes = 0;
         u32 *crc, *checksums;
-        pgoff_t index = 0, last_index = 0;
         unsigned long first_page_offset;
-        int num_checksums;
+        int index = 0, num_pages = 0;
         int entries = 0;
         int bitmaps = 0;
         int ret = 0;
         bool next_page = false;
+        bool out_of_space = false;
 
         root = root->fs_info->tree_root;
 
@@ -551,24 +552,31 @@ int btrfs_write_out_cache(struct btrfs_root *root,
                 return 0;
         }
 
-        last_index = (i_size_read(inode) - 1) >> PAGE_CACHE_SHIFT;
+        num_pages = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >>
+                PAGE_CACHE_SHIFT;
         filemap_write_and_wait(inode->i_mapping);
         btrfs_wait_ordered_range(inode, inode->i_size &
                                  ~(root->sectorsize - 1), (u64)-1);
 
         /* We need a checksum per page. */
-        num_checksums = i_size_read(inode) / PAGE_CACHE_SIZE;
-        crc = checksums  = kzalloc(sizeof(u32) * num_checksums, GFP_NOFS);
+        crc = checksums = kzalloc(sizeof(u32) * num_pages, GFP_NOFS);
         if (!crc) {
                 iput(inode);
                 return 0;
         }
 
+        pages = kzalloc(sizeof(struct page *) * num_pages, GFP_NOFS);
+        if (!pages) {
+                kfree(crc);
+                iput(inode);
+                return 0;
+        }
+
         /* Since the first page has all of our checksums and our generation we
          * need to calculate the offset into the page that we can start writing
          * our entries.
          */
-        first_page_offset = (sizeof(u32) * num_checksums) + sizeof(u64);
+        first_page_offset = (sizeof(u32) * num_pages) + sizeof(u64);
 
         /* Get the cluster for this block_group if it exists */
         if (!list_empty(&block_group->cluster_list))
@@ -590,20 +598,18 @@ int btrfs_write_out_cache(struct btrfs_root *root,
          * after find_get_page at this point.  Just putting this here so people
          * know and don't freak out.
          */
-        while (index <= last_index) {
+        while (index < num_pages) {
                 page = grab_cache_page(inode->i_mapping, index);
                 if (!page) {
-                        pgoff_t i = 0;
+                        int i;
 
-                        while (i < index) {
-                                page = find_get_page(inode->i_mapping, i);
-                                unlock_page(page);
-                                page_cache_release(page);
-                                page_cache_release(page);
-                                i++;
+                        for (i = 0; i < num_pages; i++) {
+                                unlock_page(pages[i]);
+                                page_cache_release(pages[i]);
                         }
                         goto out_free;
                 }
+                pages[index] = page;
                 index++;
         }
 
@@ -631,7 +637,12 @@ int btrfs_write_out_cache(struct btrfs_root *root,
                         offset = start_offset;
                 }
 
-                page = find_get_page(inode->i_mapping, index);
+                if (index >= num_pages) {
+                        out_of_space = true;
+                        break;
+                }
+
+                page = pages[index];
 
                 addr = kmap(page);
                 entry = addr + start_offset;
@@ -708,23 +719,6 @@ int btrfs_write_out_cache(struct btrfs_root *root,
 
                 bytes += PAGE_CACHE_SIZE;
 
-                ClearPageChecked(page);
-                set_page_extent_mapped(page);
-                SetPageUptodate(page);
-                set_page_dirty(page);
-
-                /*
-                 * We need to release our reference we got for grab_cache_page,
-                 * except for the first page which will hold our checksums, we
-                 * do that below.
-                 */
-                if (index != 0) {
-                        unlock_page(page);
-                        page_cache_release(page);
-                }
-
-                page_cache_release(page);
-
                 index++;
         } while (node || next_page);
 
@@ -734,7 +728,11 @@ int btrfs_write_out_cache(struct btrfs_root *root,
                 struct btrfs_free_space *entry =
                         list_entry(pos, struct btrfs_free_space, list);
 
-                page = find_get_page(inode->i_mapping, index);
+                if (index >= num_pages) {
+                        out_of_space = true;
+                        break;
+                }
+                page = pages[index];
 
                 addr = kmap(page);
                 memcpy(addr, entry->bitmap, PAGE_CACHE_SIZE);
@@ -745,64 +743,58 @@ int btrfs_write_out_cache(struct btrfs_root *root,
                 crc++;
                 bytes += PAGE_CACHE_SIZE;
 
-                ClearPageChecked(page);
-                set_page_extent_mapped(page);
-                SetPageUptodate(page);
-                set_page_dirty(page);
-                unlock_page(page);
-                page_cache_release(page);
-                page_cache_release(page);
                 list_del_init(&entry->list);
                 index++;
         }
 
+        if (out_of_space) {
+                btrfs_drop_pages(pages, num_pages);
+                unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0,
+                                     i_size_read(inode) - 1, &cached_state,
+                                     GFP_NOFS);
+                ret = 0;
+                goto out_free;
+        }
+
         /* Zero out the rest of the pages just to make sure */
-        while (index <= last_index) {
+        while (index < num_pages) {
                 void *addr;
 
-                page = find_get_page(inode->i_mapping, index);
-
+                page = pages[index];
                 addr = kmap(page);
                 memset(addr, 0, PAGE_CACHE_SIZE);
                 kunmap(page);
-                ClearPageChecked(page);
-                set_page_extent_mapped(page);
-                SetPageUptodate(page);
-                set_page_dirty(page);
-                unlock_page(page);
-                page_cache_release(page);
-                page_cache_release(page);
                 bytes += PAGE_CACHE_SIZE;
                 index++;
         }
 
-        btrfs_set_extent_delalloc(inode, 0, bytes - 1, &cached_state);
-
         /* Write the checksums and trans id to the first page */
         {
                 void *addr;
                 u64 *gen;
 
-                page = find_get_page(inode->i_mapping, 0);
+                page = pages[0];
 
                 addr = kmap(page);
-                memcpy(addr, checksums, sizeof(u32) * num_checksums);
-                gen = addr + (sizeof(u32) * num_checksums);
+                memcpy(addr, checksums, sizeof(u32) * num_pages);
+                gen = addr + (sizeof(u32) * num_pages);
                 *gen = trans->transid;
                 kunmap(page);
-                ClearPageChecked(page);
-                set_page_extent_mapped(page);
-                SetPageUptodate(page);
-                set_page_dirty(page);
-                unlock_page(page);
-                page_cache_release(page);
-                page_cache_release(page);
         }
-        BTRFS_I(inode)->generation = trans->transid;
 
+        ret = btrfs_dirty_pages(root, inode, pages, num_pages, 0,
+                                            bytes, &cached_state);
+        btrfs_drop_pages(pages, num_pages);
         unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0,
                              i_size_read(inode) - 1, &cached_state, GFP_NOFS);
 
+        if (ret) {
+                ret = 0;
+                goto out_free;
+        }
+
+        BTRFS_I(inode)->generation = trans->transid;
+
         filemap_write_and_wait(inode->i_mapping);
 
         key.objectid = BTRFS_FREE_SPACE_OBJECTID;
@@ -853,6 +845,7 @@ out_free:
                 BTRFS_I(inode)->generation = 0;
         }
         kfree(checksums);
+        kfree(pages);
         btrfs_update_inode(trans, root, inode);
         iput(inode);
         return ret;
@@ -1775,10 +1768,13 @@ void btrfs_remove_free_space_cache(struct btrfs_block_group_cache *block_group)
 
         while ((node = rb_last(&block_group->free_space_offset)) != NULL) {
                 info = rb_entry(node, struct btrfs_free_space, offset_index);
-                unlink_free_space(block_group, info);
-                if (info->bitmap)
-                        kfree(info->bitmap);
-                kmem_cache_free(btrfs_free_space_cachep, info);
+                if (!info->bitmap) {
+                        unlink_free_space(block_group, info);
+                        kmem_cache_free(btrfs_free_space_cachep, info);
+                } else {
+                        free_bitmap(block_group, info);
+                }
+
                 if (need_resched()) {
                         spin_unlock(&block_group->tree_lock);
                         cond_resched();
@@ -2308,7 +2304,7 @@ int btrfs_trim_block_group(struct btrfs_block_group_cache *block_group,
                         start = entry->offset;
                         bytes = min(entry->bytes, end - start);
                         unlink_free_space(block_group, entry);
-                        kfree(entry);
+                        kmem_cache_free(btrfs_free_space_cachep, entry);
                 }
 
                 spin_unlock(&block_group->tree_lock);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 5cc64ab9c485..7cd8ab0ef04d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -954,6 +954,7 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
                          1, 0, NULL, GFP_NOFS);
         while (start < end) {
                 async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
+                BUG_ON(!async_cow);
                 async_cow->inode = inode;
                 async_cow->root = root;
                 async_cow->locked_page = locked_page;
@@ -1770,9 +1771,12 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
         add_pending_csums(trans, inode, ordered_extent->file_offset,
                           &ordered_extent->list);
 
-        btrfs_ordered_update_i_size(inode, 0, ordered_extent);
-        ret = btrfs_update_inode(trans, root, inode);
-        BUG_ON(ret);
+        ret = btrfs_ordered_update_i_size(inode, 0, ordered_extent);
+        if (!ret) {
+                ret = btrfs_update_inode(trans, root, inode);
+                BUG_ON(ret);
+        }
+        ret = 0;
 out:
         if (nolock) {
                 if (trans)
@@ -2590,6 +2594,13 @@ static void fill_inode_item(struct btrfs_trans_handle *trans,
                             struct btrfs_inode_item *item,
                             struct inode *inode)
 {
+        if (!leaf->map_token)
+                map_private_extent_buffer(leaf, (unsigned long)item,
+                                          sizeof(struct btrfs_inode_item),
+                                          &leaf->map_token, &leaf->kaddr,
+                                          &leaf->map_start, &leaf->map_len,
+                                          KM_USER1);
+
         btrfs_set_inode_uid(leaf, item, inode->i_uid);
         btrfs_set_inode_gid(leaf, item, inode->i_gid);
         btrfs_set_inode_size(leaf, item, BTRFS_I(inode)->disk_i_size);
@@ -2618,6 +2629,11 @@ static void fill_inode_item(struct btrfs_trans_handle *trans,
         btrfs_set_inode_rdev(leaf, item, inode->i_rdev);
         btrfs_set_inode_flags(leaf, item, BTRFS_I(inode)->flags);
         btrfs_set_inode_block_group(leaf, item, BTRFS_I(inode)->block_group);
+
+        if (leaf->map_token) {
+                unmap_extent_buffer(leaf, leaf->map_token, KM_USER1);
+                leaf->map_token = NULL;
+        }
 }
 
 /*
@@ -4207,10 +4223,8 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
         struct btrfs_key found_key;
         struct btrfs_path *path;
         int ret;
-        u32 nritems;
         struct extent_buffer *leaf;
         int slot;
-        int advance;
         unsigned char d_type;
         int over = 0;
         u32 di_cur;
@@ -4253,27 +4267,19 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
         ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
         if (ret < 0)
                 goto err;
-        advance = 0;
 
         while (1) {
                 leaf = path->nodes[0];
-                nritems = btrfs_header_nritems(leaf);
                 slot = path->slots[0];
-                if (advance || slot >= nritems) {
-                        if (slot >= nritems - 1) {
-                                ret = btrfs_next_leaf(root, path);
-                                if (ret)
-                                        break;
-                                leaf = path->nodes[0];
-                                nritems = btrfs_header_nritems(leaf);
-                                slot = path->slots[0];
-                        } else {
-                                slot++;
-                                path->slots[0]++;
-                        }
+                if (slot >= btrfs_header_nritems(leaf)) {
+                        ret = btrfs_next_leaf(root, path);
+                        if (ret < 0)
+                                goto err;
+                        else if (ret > 0)
+                                break;
+                        continue;
                 }
 
-                advance = 1;
                 item = btrfs_item_nr(leaf, slot);
                 btrfs_item_key_to_cpu(leaf, &found_key, slot);
 
@@ -4282,7 +4288,7 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
                 if (btrfs_key_type(&found_key) != key_type)
                         break;
                 if (found_key.offset < filp->f_pos)
-                        continue;
+                        goto next;
 
                 filp->f_pos = found_key.offset;
 
@@ -4335,6 +4341,8 @@ skip:
                         di_cur += di_len;
                         di = (struct btrfs_dir_item *)((char *)di + di_len);
                 }
+next:
+                path->slots[0]++;
         }
 
         /* Reached end of directory/root. Bump pos past the last item. */
@@ -4527,14 +4535,17 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
         BUG_ON(!path);
 
         inode = new_inode(root->fs_info->sb);
-        if (!inode)
+        if (!inode) {
+                btrfs_free_path(path);
                 return ERR_PTR(-ENOMEM);
+        }
 
         if (dir) {
                 trace_btrfs_inode_request(dir);
 
                 ret = btrfs_set_inode_index(dir, index);
                 if (ret) {
+                        btrfs_free_path(path);
                         iput(inode);
                         return ERR_PTR(ret);
                 }
@@ -4721,9 +4732,10 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
         inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
                                 dentry->d_name.len, dir->i_ino, objectid,
                                 BTRFS_I(dir)->block_group, mode, &index);
-        err = PTR_ERR(inode);
-        if (IS_ERR(inode))
+        if (IS_ERR(inode)) {
+                err = PTR_ERR(inode);
                 goto out_unlock;
+        }
 
         err = btrfs_init_inode_security(trans, inode, dir, &dentry->d_name);
         if (err) {
@@ -4782,9 +4794,10 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
         inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
                                 dentry->d_name.len, dir->i_ino, objectid,
                                 BTRFS_I(dir)->block_group, mode, &index);
-        err = PTR_ERR(inode);
-        if (IS_ERR(inode))
+        if (IS_ERR(inode)) {
+                err = PTR_ERR(inode);
                 goto out_unlock;
+        }
 
         err = btrfs_init_inode_security(trans, inode, dir, &dentry->d_name);
         if (err) {
@@ -4834,9 +4847,6 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
         if (inode->i_nlink == ~0U)
                 return -EMLINK;
 
-        btrfs_inc_nlink(inode);
-        inode->i_ctime = CURRENT_TIME;
-
         err = btrfs_set_inode_index(dir, &index);
         if (err)
                 goto fail;
@@ -4852,6 +4862,9 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                 goto fail;
         }
 
+        btrfs_inc_nlink(inode);
+        inode->i_ctime = CURRENT_TIME;
+
         btrfs_set_trans_block_group(trans, dir);
         ihold(inode);
 
@@ -4989,6 +5002,8 @@ static noinline int uncompress_inline(struct btrfs_path *path,
         inline_size = btrfs_file_extent_inline_item_len(leaf,
                                         btrfs_item_nr(leaf, path->slots[0]));
         tmp = kmalloc(inline_size, GFP_NOFS);
+        if (!tmp)
+                return -ENOMEM;
         ptr = btrfs_file_extent_inline_start(item);
 
         read_extent_buffer(leaf, tmp, ptr, inline_size);
@@ -5221,7 +5236,7 @@ again:
                         btrfs_mark_buffer_dirty(leaf);
                 }
                 set_extent_uptodate(io_tree, em->start,
-                                    extent_map_end(em) - 1, GFP_NOFS);
+                                    extent_map_end(em) - 1, NULL, GFP_NOFS);
                 goto insert;
         } else {
                 printk(KERN_ERR "btrfs unknown found_type %d\n", found_type);
@@ -5428,17 +5443,30 @@ out:
 }
 
 static struct extent_map *btrfs_new_extent_direct(struct inode *inode,
+                                                  struct extent_map *em,
                                                   u64 start, u64 len)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_trans_handle *trans;
-        struct extent_map *em;
         struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
         struct btrfs_key ins;
         u64 alloc_hint;
         int ret;
+        bool insert = false;
 
-        btrfs_drop_extent_cache(inode, start, start + len - 1, 0);
+        /*
+         * Ok if the extent map we looked up is a hole and is for the exact
+         * range we want, there is no reason to allocate a new one, however if
+         * it is not right then we need to free this one and drop the cache for
+         * our range.
+         */
+        if (em->block_start != EXTENT_MAP_HOLE || em->start != start ||
+            em->len != len) {
+                free_extent_map(em);
+                em = NULL;
+                insert = true;
+                btrfs_drop_extent_cache(inode, start, start + len - 1, 0);
+        }
 
         trans = btrfs_join_transaction(root, 0);
         if (IS_ERR(trans))
@@ -5454,10 +5482,12 @@ static struct extent_map *btrfs_new_extent_direct(struct inode *inode,
                 goto out;
         }
 
-        em = alloc_extent_map(GFP_NOFS);
         if (!em) {
-                em = ERR_PTR(-ENOMEM);
-                goto out;
+                em = alloc_extent_map(GFP_NOFS);
+                if (!em) {
+                        em = ERR_PTR(-ENOMEM);
+                        goto out;
+                }
         }
 
         em->start = start;
@@ -5467,9 +5497,15 @@ static struct extent_map *btrfs_new_extent_direct(struct inode *inode,
         em->block_start = ins.objectid;
         em->block_len = ins.offset;
         em->bdev = root->fs_info->fs_devices->latest_bdev;
+
+        /*
+         * We need to do this because if we're using the original em we searched
+         * for, we could have EXTENT_FLAG_VACANCY set, and we don't want that.
+         */
+        em->flags = 0;
         set_bit(EXTENT_FLAG_PINNED, &em->flags);
 
-        while (1) {
+        while (insert) {
                 write_lock(&em_tree->lock);
                 ret = add_extent_mapping(em_tree, em);
                 write_unlock(&em_tree->lock);
@@ -5687,8 +5723,7 @@ must_cow:
          * it above
          */
         len = bh_result->b_size;
-        free_extent_map(em);
-        em = btrfs_new_extent_direct(inode, start, len);
+        em = btrfs_new_extent_direct(inode, em, start, len);
         if (IS_ERR(em))
                 return PTR_ERR(em);
         len = min(len, em->len - (start - em->start));
@@ -5851,8 +5886,10 @@ again:
         }
 
         add_pending_csums(trans, inode, ordered->file_offset, &ordered->list);
-        btrfs_ordered_update_i_size(inode, 0, ordered);
-        btrfs_update_inode(trans, root, inode);
+        ret = btrfs_ordered_update_i_size(inode, 0, ordered);
+        if (!ret)
+                btrfs_update_inode(trans, root, inode);
+        ret = 0;
 out_unlock:
         unlock_extent_cached(&BTRFS_I(inode)->io_tree, ordered->file_offset,
                              ordered->file_offset + ordered->len - 1,
@@ -5938,7 +5975,7 @@ static struct bio *btrfs_dio_bio_alloc(struct block_device *bdev,
 
 static inline int __btrfs_submit_dio_bio(struct bio *bio, struct inode *inode,
                                          int rw, u64 file_offset, int skip_sum,
-                                         u32 *csums)
+                                         u32 *csums, int async_submit)
 {
         int write = rw & REQ_WRITE;
         struct btrfs_root *root = BTRFS_I(inode)->root;
@@ -5949,13 +5986,24 @@ static inline int __btrfs_submit_dio_bio(struct bio *bio, struct inode *inode,
         if (ret)
                 goto err;
 
-        if (write && !skip_sum) {
+        if (skip_sum)
+                goto map;
+
+        if (write && async_submit) {
                 ret = btrfs_wq_submit_bio(root->fs_info,
                                    inode, rw, bio, 0, 0,
                                    file_offset,
                                    __btrfs_submit_bio_start_direct_io,
                                    __btrfs_submit_bio_done);
                 goto err;
+        } else if (write) {
+                /*
+                 * If we aren't doing async submit, calculate the csum of the
+                 * bio now.
+                 */
+                ret = btrfs_csum_one_bio(root, inode, bio, file_offset, 1);
+                if (ret)
+                        goto err;
         } else if (!skip_sum) {
                 ret = btrfs_lookup_bio_sums_dio(root, inode, bio,
                                           file_offset, csums);
@@ -5963,7 +6011,8 @@ static inline int __btrfs_submit_dio_bio(struct bio *bio, struct inode *inode,
                         goto err;
         }
 
-        ret = btrfs_map_bio(root, rw, bio, 0, 1);
+map:
+        ret = btrfs_map_bio(root, rw, bio, 0, async_submit);
 err:
         bio_put(bio);
         return ret;
@@ -5985,23 +6034,30 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
         int nr_pages = 0;
         u32 *csums = dip->csums;
         int ret = 0;
+        int async_submit = 0;
         int write = rw & REQ_WRITE;
 
-        bio = btrfs_dio_bio_alloc(orig_bio->bi_bdev, start_sector, GFP_NOFS);
-        if (!bio)
-                return -ENOMEM;
-        bio->bi_private = dip;
-        bio->bi_end_io = btrfs_end_dio_bio;
-        atomic_inc(&dip->pending_bios);
-
         map_length = orig_bio->bi_size;
         ret = btrfs_map_block(map_tree, READ, start_sector << 9,
                               &map_length, NULL, 0);
         if (ret) {
-                bio_put(bio);
+                bio_put(orig_bio);
                 return -EIO;
         }
 
+        if (map_length >= orig_bio->bi_size) {
+                bio = orig_bio;
+                goto submit;
+        }
+
+        async_submit = 1;
+        bio = btrfs_dio_bio_alloc(orig_bio->bi_bdev, start_sector, GFP_NOFS);
+        if (!bio)
+                return -ENOMEM;
+        bio->bi_private = dip;
+        bio->bi_end_io = btrfs_end_dio_bio;
+        atomic_inc(&dip->pending_bios);
+
         while (bvec <= (orig_bio->bi_io_vec + orig_bio->bi_vcnt - 1)) {
                 if (unlikely(map_length < submit_len + bvec->bv_len ||
                     bio_add_page(bio, bvec->bv_page, bvec->bv_len,
@@ -6015,7 +6071,7 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
                         atomic_inc(&dip->pending_bios);
                         ret = __btrfs_submit_dio_bio(bio, inode, rw,
                                                      file_offset, skip_sum,
-                                                     csums);
+                                                     csums, async_submit);
                         if (ret) {
                                 bio_put(bio);
                                 atomic_dec(&dip->pending_bios);
@@ -6052,8 +6108,9 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
                 }
         }
 
+submit:
         ret = __btrfs_submit_dio_bio(bio, inode, rw, file_offset, skip_sum,
-                                     csums);
+                                     csums, async_submit);
         if (!ret)
                 return 0;
 
@@ -6148,6 +6205,7 @@ static ssize_t check_direct_IO(struct btrfs_root *root, int rw, struct kiocb *io
                         unsigned long nr_segs)
 {
         int seg;
+        int i;
         size_t size;
         unsigned long addr;
         unsigned blocksize_mask = root->sectorsize - 1;
@@ -6162,8 +6220,22 @@ static ssize_t check_direct_IO(struct btrfs_root *root, int rw, struct kiocb *io
                 addr = (unsigned long)iov[seg].iov_base;
                 size = iov[seg].iov_len;
                 end += size;
-                if ((addr & blocksize_mask) || (size & blocksize_mask)) 
+                if ((addr & blocksize_mask) || (size & blocksize_mask))
                         goto out;
+
+                /* If this is a write we don't need to check anymore */
+                if (rw & WRITE)
+                        continue;
+
+                /*
+                 * Check to make sure we don't have duplicate iov_base's in this
+                 * iovec, if so return EINVAL, otherwise we'll get csum errors
+                 * when reading back.
+                 */
+                for (i = seg + 1; i < nr_segs; i++) {
+                        if (iov[seg].iov_base == iov[i].iov_base)
+                                goto out;
+                }
         }
         retval = 0;
 out:
@@ -7206,9 +7278,10 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
                                 dentry->d_name.len, dir->i_ino, objectid,
                                 BTRFS_I(dir)->block_group, S_IFLNK|S_IRWXUGO,
                                 &index);
-        err = PTR_ERR(inode);
-        if (IS_ERR(inode))
+        if (IS_ERR(inode)) {
+                err = PTR_ERR(inode);
                 goto out_unlock;
+        }
 
         err = btrfs_init_inode_security(trans, inode, dir, &dentry->d_name);
         if (err) {
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index cfc264fefdb0..ffb48d6c5433 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2287,7 +2287,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
         struct btrfs_ioctl_space_info space;
         struct btrfs_ioctl_space_info *dest;
         struct btrfs_ioctl_space_info *dest_orig;
-        struct btrfs_ioctl_space_info *user_dest;
+        struct btrfs_ioctl_space_info __user *user_dest;
         struct btrfs_space_info *info;
         u64 types[] = {BTRFS_BLOCK_GROUP_DATA,
                        BTRFS_BLOCK_GROUP_SYSTEM,
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 58e7de9cc90c..0ac712efcdf2 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -159,7 +159,7 @@ enum {
         Opt_compress_type, Opt_compress_force, Opt_compress_force_type,
         Opt_notreelog, Opt_ratio, Opt_flushoncommit, Opt_discard,
         Opt_space_cache, Opt_clear_cache, Opt_user_subvol_rm_allowed,
-        Opt_enospc_debug, Opt_err,
+        Opt_enospc_debug, Opt_subvolrootid, Opt_err,
 };
 
 static match_table_t tokens = {
@@ -189,6 +189,7 @@ static match_table_t tokens = {
         {Opt_clear_cache, "clear_cache"},
         {Opt_user_subvol_rm_allowed, "user_subvol_rm_allowed"},
         {Opt_enospc_debug, "enospc_debug"},
+        {Opt_subvolrootid, "subvolrootid=%d"},
         {Opt_err, NULL},
 };
 
@@ -232,6 +233,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                         break;
                 case Opt_subvol:
                 case Opt_subvolid:
+                case Opt_subvolrootid:
                 case Opt_device:
                         /*
                          * These are parsed by btrfs_parse_early_options
@@ -388,7 +390,7 @@ out:
  */
 static int btrfs_parse_early_options(const char *options, fmode_t flags,
                 void *holder, char **subvol_name, u64 *subvol_objectid,
-                struct btrfs_fs_devices **fs_devices)
+                u64 *subvol_rootid, struct btrfs_fs_devices **fs_devices)
 {
         substring_t args[MAX_OPT_ARGS];
         char *opts, *orig, *p;
@@ -429,6 +431,18 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
                                         *subvol_objectid = intarg;
                         }
                         break;
+                case Opt_subvolrootid:
+                        intarg = 0;
+                        error = match_int(&args[0], &intarg);
+                        if (!error) {
+                                /* we want the original fs_tree */
+                                if (!intarg)
+                                        *subvol_rootid =
+                                                BTRFS_FS_TREE_OBJECTID;
+                                else
+                                        *subvol_rootid = intarg;
+                        }
+                        break;
                 case Opt_device:
                         error = btrfs_scan_one_device(match_strdup(&args[0]),
                                         flags, holder, fs_devices);
@@ -736,6 +750,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
         fmode_t mode = FMODE_READ;
         char *subvol_name = NULL;
         u64 subvol_objectid = 0;
+        u64 subvol_rootid = 0;
         int error = 0;
 
         if (!(flags & MS_RDONLY))
@@ -743,7 +758,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
 
         error = btrfs_parse_early_options(data, mode, fs_type,
                                           &subvol_name, &subvol_objectid,
-                                          &fs_devices);
+                                          &subvol_rootid, &fs_devices);
         if (error)
                 return ERR_PTR(error);
 
@@ -807,15 +822,17 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                 s->s_flags |= MS_ACTIVE;
         }
 
-        root = get_default_root(s, subvol_objectid);
-        if (IS_ERR(root)) {
-                error = PTR_ERR(root);
-                deactivate_locked_super(s);
-                goto error_free_subvol_name;
-        }
         /* if they gave us a subvolume name bind mount into that */
         if (strcmp(subvol_name, ".")) {
                 struct dentry *new_root;
+
+                root = get_default_root(s, subvol_rootid);
+                if (IS_ERR(root)) {
+                        error = PTR_ERR(root);
+                        deactivate_locked_super(s);
+                        goto error_free_subvol_name;
+                }
+
                 mutex_lock(&root->d_inode->i_mutex);
                 new_root = lookup_one_len(subvol_name, root,
                                       strlen(subvol_name));
@@ -836,6 +853,13 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                 }
                 dput(root);
                 root = new_root;
+        } else {
+                root = get_default_root(s, subvol_objectid);
+                if (IS_ERR(root)) {
+                        error = PTR_ERR(root);
+                        deactivate_locked_super(s);
+                        goto error_free_subvol_name;
+                }
         }
 
         kfree(subvol_name);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 5b158da7e0bb..c571734d5e5a 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -32,10 +32,8 @@
 
 static noinline void put_transaction(struct btrfs_transaction *transaction)
 {
-        WARN_ON(transaction->use_count == 0);
-        transaction->use_count--;
-        if (transaction->use_count == 0) {
-                list_del_init(&transaction->list);
+        WARN_ON(atomic_read(&transaction->use_count) == 0);
+        if (atomic_dec_and_test(&transaction->use_count)) {
                 memset(transaction, 0, sizeof(*transaction));
                 kmem_cache_free(btrfs_transaction_cachep, transaction);
         }
@@ -60,14 +58,14 @@ static noinline int join_transaction(struct btrfs_root *root)
                 if (!cur_trans)
                         return -ENOMEM;
                 root->fs_info->generation++;
-                cur_trans->num_writers = 1;
+                atomic_set(&cur_trans->num_writers, 1);
                 cur_trans->num_joined = 0;
                 cur_trans->transid = root->fs_info->generation;
                 init_waitqueue_head(&cur_trans->writer_wait);
                 init_waitqueue_head(&cur_trans->commit_wait);
                 cur_trans->in_commit = 0;
                 cur_trans->blocked = 0;
-                cur_trans->use_count = 1;
+                atomic_set(&cur_trans->use_count, 1);
                 cur_trans->commit_done = 0;
                 cur_trans->start_time = get_seconds();
 
@@ -88,7 +86,7 @@ static noinline int join_transaction(struct btrfs_root *root)
                 root->fs_info->running_transaction = cur_trans;
                 spin_unlock(&root->fs_info->new_trans_lock);
         } else {
-                cur_trans->num_writers++;
+                atomic_inc(&cur_trans->num_writers);
                 cur_trans->num_joined++;
         }
 
@@ -145,7 +143,7 @@ static void wait_current_trans(struct btrfs_root *root)
         cur_trans = root->fs_info->running_transaction;
         if (cur_trans && cur_trans->blocked) {
                 DEFINE_WAIT(wait);
-                cur_trans->use_count++;
+                atomic_inc(&cur_trans->use_count);
                 while (1) {
                         prepare_to_wait(&root->fs_info->transaction_wait, &wait,
                                         TASK_UNINTERRUPTIBLE);
@@ -181,6 +179,7 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
 {
         struct btrfs_trans_handle *h;
         struct btrfs_transaction *cur_trans;
+        int retries = 0;
         int ret;
 
         if (root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR)
@@ -204,7 +203,7 @@ again:
         }
 
         cur_trans = root->fs_info->running_transaction;
-        cur_trans->use_count++;
+        atomic_inc(&cur_trans->use_count);
         if (type != TRANS_JOIN_NOLOCK)
                 mutex_unlock(&root->fs_info->trans_mutex);
 
@@ -224,10 +223,18 @@ again:
 
         if (num_items > 0) {
                 ret = btrfs_trans_reserve_metadata(h, root, num_items);
-                if (ret == -EAGAIN) {
+                if (ret == -EAGAIN && !retries) {
+                        retries++;
                         btrfs_commit_transaction(h, root);
                         goto again;
+                } else if (ret == -EAGAIN) {
+                        /*
+                         * We have already retried and got EAGAIN, so really we
+                         * don't have space, so set ret to -ENOSPC.
+                         */
+                        ret = -ENOSPC;
                 }
+
                 if (ret < 0) {
                         btrfs_end_transaction(h, root);
                         return ERR_PTR(ret);
@@ -327,7 +334,7 @@ int btrfs_wait_for_commit(struct btrfs_root *root, u64 transid)
                         goto out_unlock;  /* nothing committing|committed */
         }
 
-        cur_trans->use_count++;
+        atomic_inc(&cur_trans->use_count);
         mutex_unlock(&root->fs_info->trans_mutex);
 
         wait_for_commit(root, cur_trans);
@@ -457,18 +464,14 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
                         wake_up_process(info->transaction_kthread);
         }
 
-        if (lock)
-                mutex_lock(&info->trans_mutex);
         WARN_ON(cur_trans != info->running_transaction);
-        WARN_ON(cur_trans->num_writers < 1);
-        cur_trans->num_writers--;
+        WARN_ON(atomic_read(&cur_trans->num_writers) < 1);
+        atomic_dec(&cur_trans->num_writers);
 
         smp_mb();
         if (waitqueue_active(&cur_trans->writer_wait))
                 wake_up(&cur_trans->writer_wait);
         put_transaction(cur_trans);
-        if (lock)
-                mutex_unlock(&info->trans_mutex);
 
         if (current->journal_info == trans)
                 current->journal_info = NULL;
@@ -1178,7 +1181,7 @@ int btrfs_commit_transaction_async(struct btrfs_trans_handle *trans,
         /* take transaction reference */
         mutex_lock(&root->fs_info->trans_mutex);
         cur_trans = trans->transaction;
-        cur_trans->use_count++;
+        atomic_inc(&cur_trans->use_count);
         mutex_unlock(&root->fs_info->trans_mutex);
 
         btrfs_end_transaction(trans, root);
@@ -1237,7 +1240,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         mutex_lock(&root->fs_info->trans_mutex);
         if (cur_trans->in_commit) {
-                cur_trans->use_count++;
+                atomic_inc(&cur_trans->use_count);
                 mutex_unlock(&root->fs_info->trans_mutex);
                 btrfs_end_transaction(trans, root);
 
@@ -1259,7 +1262,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
                 prev_trans = list_entry(cur_trans->list.prev,
                                         struct btrfs_transaction, list);
                 if (!prev_trans->commit_done) {
-                        prev_trans->use_count++;
+                        atomic_inc(&prev_trans->use_count);
                         mutex_unlock(&root->fs_info->trans_mutex);
 
                         wait_for_commit(root, prev_trans);
@@ -1300,14 +1303,14 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
                                 TASK_UNINTERRUPTIBLE);
 
                 smp_mb();
-                if (cur_trans->num_writers > 1)
+                if (atomic_read(&cur_trans->num_writers) > 1)
                         schedule_timeout(MAX_SCHEDULE_TIMEOUT);
                 else if (should_grow)
                         schedule_timeout(1);
 
                 mutex_lock(&root->fs_info->trans_mutex);
                 finish_wait(&cur_trans->writer_wait, &wait);
-        } while (cur_trans->num_writers > 1 ||
+        } while (atomic_read(&cur_trans->num_writers) > 1 ||
                  (should_grow && cur_trans->num_joined != joined));
 
         ret = create_pending_snapshots(trans, root->fs_info);
@@ -1394,6 +1397,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         wake_up(&cur_trans->commit_wait);
 
+        list_del_init(&cur_trans->list);
         put_transaction(cur_trans);
         put_transaction(cur_trans);
 
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 229a594cacd5..e441acc6c584 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -27,11 +27,11 @@ struct btrfs_transaction {
          * total writers in this transaction, it must be zero before the
          * transaction can end
          */
-        unsigned long num_writers;
+        atomic_t num_writers;
 
         unsigned long num_joined;
         int in_commit;
-        int use_count;
+        atomic_t use_count;
         int commit_done;
         int blocked;
         struct list_head list;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index c50271ad3157..f997ec0c1ba4 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2209,8 +2209,10 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
 
         log = root->log_root;
         path = btrfs_alloc_path();
-        if (!path)
-                return -ENOMEM;
+        if (!path) {
+                err = -ENOMEM;
+                goto out_unlock;
+        }
 
         di = btrfs_lookup_dir_item(trans, log, path, dir->i_ino,
                                    name, name_len, -1);
@@ -2271,6 +2273,7 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
         }
 fail:
         btrfs_free_path(path);
+out_unlock:
         mutex_unlock(&BTRFS_I(dir)->log_mutex);
         if (ret == -ENOSPC) {
                 root->fs_info->last_trans_log_full_commit = trans->transid;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 309a57b9fc85..c7367ae5a3e6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -155,6 +155,15 @@ static noinline int run_scheduled_bios(struct btrfs_device *device)
         unsigned long limit;
         unsigned long last_waited = 0;
         int force_reg = 0;
+        struct blk_plug plug;
+
+        /*
+         * this function runs all the bios we've collected for
+         * a particular device.  We don't want to wander off to
+         * another device without first sending all of these down.
+         * So, setup a plug here and finish it off before we return
+         */
+        blk_start_plug(&plug);
 
         bdi = blk_get_backing_dev_info(device->bdev);
         fs_info = device->dev_root->fs_info;
@@ -294,6 +303,7 @@ loop_lock:
         spin_unlock(&device->io_lock);
 
 done:
+        blk_finish_plug(&plug);
         return 0;
 }
 
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index a5303b871b13..cfd660550ded 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -180,11 +180,10 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size)
         struct btrfs_path *path;
         struct extent_buffer *leaf;
         struct btrfs_dir_item *di;
-        int ret = 0, slot, advance;
+        int ret = 0, slot;
         size_t total_size = 0, size_left = size;
         unsigned long name_ptr;
         size_t name_len;
-        u32 nritems;
 
         /*
          * ok we want all objects associated with this id.
@@ -204,34 +203,24 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size)
         ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
         if (ret < 0)
                 goto err;
-        advance = 0;
+
         while (1) {
                 leaf = path->nodes[0];
-                nritems = btrfs_header_nritems(leaf);
                 slot = path->slots[0];
 
                 /* this is where we start walking through the path */
-                if (advance || slot >= nritems) {
+                if (slot >= btrfs_header_nritems(leaf)) {
                         /*
                          * if we've reached the last slot in this leaf we need
                          * to go to the next leaf and reset everything
                          */
-                        if (slot >= nritems-1) {
-                                ret = btrfs_next_leaf(root, path);
-                                if (ret)
-                                        break;
-                                leaf = path->nodes[0];
-                                nritems = btrfs_header_nritems(leaf);
-                                slot = path->slots[0];
-                        } else {
-                                /*
-                                 * just walking through the slots on this leaf
-                                 */
-                                slot++;
-                                path->slots[0]++;
-                        }
+                        ret = btrfs_next_leaf(root, path);
+                        if (ret < 0)
+                                goto err;
+                        else if (ret > 0)
+                                break;
+                        continue;
                 }
-                advance = 1;
 
                 btrfs_item_key_to_cpu(leaf, &found_key, slot);
 
@@ -250,7 +239,7 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size)
 
                 /* we are just looking for how big our buffer needs to be */
                 if (!size)
-                        continue;
+                        goto next;
 
                 if (!buffer || (name_len + 1) > size_left) {
                         ret = -ERANGE;
@@ -263,6 +252,8 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size)
 
                 size_left -= name_len + 1;
                 buffer += name_len + 1;
+next:
+                path->slots[0]++;
         }
         ret = total_size;
 
diff --git a/fs/cifs/README b/fs/cifs/README
index fe1683590828..74ab165fc646 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -685,22 +685,6 @@ LinuxExtensionsEnabled	If set to one then the client will attempt to
                         support and want to map the uid and gid fields 
                         to values supplied at mount (rather than the 
                         actual values, then set this to zero. (default 1)
-Experimental            When set to 1 used to enable certain experimental
-                        features (currently enables multipage writes
-                        when signing is enabled, the multipage write
-                        performance enhancement was disabled when
-                        signing turned on in case buffer was modified
-                        just before it was sent, also this flag will
-                        be used to use the new experimental directory change 
-                        notification code).  When set to 2 enables
-                        an additional experimental feature, "raw ntlmssp"
-                        session establishment support (which allows
-                        specifying "sec=ntlmssp" on mount). The Linux cifs
-                        module will use ntlmv2 authentication encapsulated
-                        in "raw ntlmssp" (not using SPNEGO) when
-                        "sec=ntlmssp" is specified on mount.
-                        This support also requires building cifs with
-                        the CONFIG_CIFS_EXPERIMENTAL configuration flag.
 
 These experimental features and tracing can be enabled by changing flags in 
 /proc/fs/cifs (after the cifs module has been installed or built into the 
diff --git a/fs/cifs/cache.c b/fs/cifs/cache.c
index e654dfd092c3..53d57a3fe427 100644
--- a/fs/cifs/cache.c
+++ b/fs/cifs/cache.c
@@ -50,7 +50,7 @@ void cifs_fscache_unregister(void)
  */
 struct cifs_server_key {
         uint16_t        family;         /* address family */
-        uint16_t        port;           /* IP port */
+        __be16          port;           /* IP port */
         union {
                 struct in_addr  ipv4_addr;
                 struct in6_addr ipv6_addr;
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 65829d32128c..30d01bc90855 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -423,7 +423,6 @@ static const struct file_operations cifs_lookup_cache_proc_fops;
 static const struct file_operations traceSMB_proc_fops;
 static const struct file_operations cifs_multiuser_mount_proc_fops;
 static const struct file_operations cifs_security_flags_proc_fops;
-static const struct file_operations cifs_experimental_proc_fops;
 static const struct file_operations cifs_linux_ext_proc_fops;
 
 void
@@ -441,8 +440,6 @@ cifs_proc_init(void)
         proc_create("cifsFYI", 0, proc_fs_cifs, &cifsFYI_proc_fops);
         proc_create("traceSMB", 0, proc_fs_cifs, &traceSMB_proc_fops);
         proc_create("OplockEnabled", 0, proc_fs_cifs, &cifs_oplock_proc_fops);
-        proc_create("Experimental", 0, proc_fs_cifs,
-                    &cifs_experimental_proc_fops);
         proc_create("LinuxExtensionsEnabled", 0, proc_fs_cifs,
                     &cifs_linux_ext_proc_fops);
         proc_create("MultiuserMount", 0, proc_fs_cifs,
@@ -469,7 +466,6 @@ cifs_proc_clean(void)
         remove_proc_entry("OplockEnabled", proc_fs_cifs);
         remove_proc_entry("SecurityFlags", proc_fs_cifs);
         remove_proc_entry("LinuxExtensionsEnabled", proc_fs_cifs);
-        remove_proc_entry("Experimental", proc_fs_cifs);
         remove_proc_entry("LookupCacheEnabled", proc_fs_cifs);
         remove_proc_entry("fs/cifs", NULL);
 }
@@ -550,45 +546,6 @@ static const struct file_operations cifs_oplock_proc_fops = {
         .write          = cifs_oplock_proc_write,
 };
 
-static int cifs_experimental_proc_show(struct seq_file *m, void *v)
-{
-        seq_printf(m, "%d\n", experimEnabled);
-        return 0;
-}
-
-static int cifs_experimental_proc_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, cifs_experimental_proc_show, NULL);
-}
-
-static ssize_t cifs_experimental_proc_write(struct file *file,
-                const char __user *buffer, size_t count, loff_t *ppos)
-{
-        char c;
-        int rc;
-
-        rc = get_user(c, buffer);
-        if (rc)
-                return rc;
-        if (c == '0' || c == 'n' || c == 'N')
-                experimEnabled = 0;
-        else if (c == '1' || c == 'y' || c == 'Y')
-                experimEnabled = 1;
-        else if (c == '2')
-                experimEnabled = 2;
-
-        return count;
-}
-
-static const struct file_operations cifs_experimental_proc_fops = {
-        .owner          = THIS_MODULE,
-        .open           = cifs_experimental_proc_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-        .write          = cifs_experimental_proc_write,
-};
-
 static int cifs_linux_ext_proc_show(struct seq_file *m, void *v)
 {
         seq_printf(m, "%d\n", linuxExtEnabled);
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 4dfba8283165..33d221394aca 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -113,7 +113,7 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
                    MAX_MECH_STR_LEN +
                    UID_KEY_LEN + (sizeof(uid_t) * 2) +
                    CREDUID_KEY_LEN + (sizeof(uid_t) * 2) +
-                   USER_KEY_LEN + strlen(sesInfo->userName) +
+                   USER_KEY_LEN + strlen(sesInfo->user_name) +
                    PID_KEY_LEN + (sizeof(pid_t) * 2) + 1;
 
         spnego_key = ERR_PTR(-ENOMEM);
@@ -153,7 +153,7 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
         sprintf(dp, ";creduid=0x%x", sesInfo->cred_uid);
 
         dp = description + strlen(description);
-        sprintf(dp, ";user=%s", sesInfo->userName);
+        sprintf(dp, ";user=%s", sesInfo->user_name);
 
         dp = description + strlen(description);
         sprintf(dp, ";pid=0x%x", current->pid);
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index fc0fd4fde306..23d43cde4306 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -90,7 +90,7 @@ cifs_mapchar(char *target, const __u16 src_char, const struct nls_table *cp,
         case UNI_COLON:
                 *target = ':';
                 break;
-        case UNI_ASTERIK:
+        case UNI_ASTERISK:
                 *target = '*';
                 break;
         case UNI_QUESTION:
@@ -264,40 +264,40 @@ cifs_strndup_from_ucs(const char *src, const int maxlen, const bool is_unicode,
  * names are little endian 16 bit Unicode on the wire
  */
 int
-cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
+cifsConvertToUCS(__le16 *target, const char *source, int srclen,
                  const struct nls_table *cp, int mapChars)
 {
         int i, j, charlen;
-        int len_remaining = maxlen;
         char src_char;
-        __u16 temp;
+        __le16 dst_char;
+        wchar_t tmp;
 
         if (!mapChars)
                 return cifs_strtoUCS(target, source, PATH_MAX, cp);
 
-        for (i = 0, j = 0; i < maxlen; j++) {
+        for (i = 0, j = 0; i < srclen; j++) {
                 src_char = source[i];
                 switch (src_char) {
                 case 0:
-                        put_unaligned_le16(0, &target[j]);
+                        put_unaligned(0, &target[j]);
                         goto ctoUCS_out;
                 case ':':
-                        temp = UNI_COLON;
+                        dst_char = cpu_to_le16(UNI_COLON);
                         break;
                 case '*':
-                        temp = UNI_ASTERIK;
+                        dst_char = cpu_to_le16(UNI_ASTERISK);
                         break;
                 case '?':
-                        temp = UNI_QUESTION;
+                        dst_char = cpu_to_le16(UNI_QUESTION);
                         break;
                 case '<':
-                        temp = UNI_LESSTHAN;
+                        dst_char = cpu_to_le16(UNI_LESSTHAN);
                         break;
                 case '>':
-                        temp = UNI_GRTRTHAN;
+                        dst_char = cpu_to_le16(UNI_GRTRTHAN);
                         break;
                 case '|':
-                        temp = UNI_PIPE;
+                        dst_char = cpu_to_le16(UNI_PIPE);
                         break;
                 /*
                  * FIXME: We can not handle remapping backslash (UNI_SLASH)
@@ -305,17 +305,17 @@ cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
                  * as they use backslash as separator.
                  */
                 default:
-                        charlen = cp->char2uni(source+i, len_remaining,
-                                                &temp);
+                        charlen = cp->char2uni(source + i, srclen - i, &tmp);
+                        dst_char = cpu_to_le16(tmp);
+
                         /*
                          * if no match, use question mark, which at least in
                          * some cases serves as wild card
                          */
                         if (charlen < 1) {
-                                temp = 0x003f;
+                                dst_char = cpu_to_le16(0x003f);
                                 charlen = 1;
                         }
-                        len_remaining -= charlen;
                         /*
                          * character may take more than one byte in the source
                          * string, but will take exactly two bytes in the
@@ -324,9 +324,8 @@ cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
                         i += charlen;
                         continue;
                 }
-                put_unaligned_le16(temp, &target[j]);
+                put_unaligned(dst_char, &target[j]);
                 i++; /* move to next char in source string */
-                len_remaining--;
         }
 
 ctoUCS_out:
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index 7fe6b52df507..644dd882a560 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -44,7 +44,7 @@
  * reserved symbols (along with \ and /), otherwise illegal to store
  * in filenames in NTFS
  */
-#define UNI_ASTERIK     (__u16) ('*' + 0xF000)
+#define UNI_ASTERISK    (__u16) ('*' + 0xF000)
 #define UNI_QUESTION    (__u16) ('?' + 0xF000)
 #define UNI_COLON       (__u16) (':' + 0xF000)
 #define UNI_GRTRTHAN    (__u16) ('>' + 0xF000)
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index a51585f9852b..d1a016be73ba 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -30,12 +30,13 @@
 #include <linux/ctype.h>
 #include <linux/random.h>
 
-/* Calculate and return the CIFS signature based on the mac key and SMB PDU */
-/* the 16 byte signature must be allocated by the caller  */
-/* Note we only use the 1st eight bytes */
-/* Note that the smb header signature field on input contains the
-        sequence number before this function is called */
-
+/*
+ * Calculate and return the CIFS signature based on the mac key and SMB PDU.
+ * The 16 byte signature must be allocated by the caller. Note we only use the
+ * 1st eight bytes and that the smb header signature field on input contains
+ * the sequence number before this function is called. Also, this function
+ * should be called with the server->srv_mutex held.
+ */
 static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
                                 struct TCP_Server_Info *server, char *signature)
 {
@@ -209,8 +210,10 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu,
                                         cpu_to_le32(expected_sequence_number);
         cifs_pdu->Signature.Sequence.Reserved = 0;
 
+        mutex_lock(&server->srv_mutex);
         rc = cifs_calculate_signature(cifs_pdu, server,
                 what_we_think_sig_should_be);
+        mutex_unlock(&server->srv_mutex);
 
         if (rc)
                 return rc;
@@ -469,15 +472,15 @@ static int calc_ntlmv2_hash(struct cifsSesInfo *ses, char *ntlmv2_hash,
                 return rc;
         }
 
-        /* convert ses->userName to unicode and uppercase */
-        len = strlen(ses->userName);
+        /* convert ses->user_name to unicode and uppercase */
+        len = strlen(ses->user_name);
         user = kmalloc(2 + (len * 2), GFP_KERNEL);
         if (user == NULL) {
                 cERROR(1, "calc_ntlmv2_hash: user mem alloc failure\n");
                 rc = -ENOMEM;
                 goto calc_exit_2;
         }
-        len = cifs_strtoUCS((__le16 *)user, ses->userName, len, nls_cp);
+        len = cifs_strtoUCS((__le16 *)user, ses->user_name, len, nls_cp);
         UniStrupr(user);
 
         crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f2970136d17d..5c412b33cd7c 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -53,7 +53,6 @@ int cifsFYI = 0;
 int cifsERROR = 1;
 int traceSMB = 0;
 unsigned int oplockEnabled = 1;
-unsigned int experimEnabled = 0;
 unsigned int linuxExtEnabled = 1;
 unsigned int lookupCacheEnabled = 1;
 unsigned int multiuser_mount = 0;
@@ -127,6 +126,7 @@ cifs_read_super(struct super_block *sb, void *data,
                 kfree(cifs_sb);
                 return rc;
         }
+        cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
 
 #ifdef CONFIG_CIFS_DFS_UPCALL
         /* copy mount params to sb for use in submounts */
@@ -409,8 +409,8 @@ cifs_show_options(struct seq_file *s, struct vfsmount *m)
 
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER)
                 seq_printf(s, ",multiuser");
-        else if (tcon->ses->userName)
-                seq_printf(s, ",username=%s", tcon->ses->userName);
+        else if (tcon->ses->user_name)
+                seq_printf(s, ",username=%s", tcon->ses->user_name);
 
         if (tcon->ses->domainName)
                 seq_printf(s, ",domain=%s", tcon->ses->domainName);
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 17afb0fbcaed..a5d1106fcbde 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -37,10 +37,9 @@
 
 #define MAX_TREE_SIZE (2 + MAX_SERVER_SIZE + 1 + MAX_SHARE_SIZE + 1)
 #define MAX_SERVER_SIZE 15
-#define MAX_SHARE_SIZE  64      /* used to be 20, this should still be enough */
-#define MAX_USERNAME_SIZE 32    /* 32 is to allow for 15 char names + null
-                                   termination then *2 for unicode versions */
-#define MAX_PASSWORD_SIZE 512  /* max for windows seems to be 256 wide chars */
+#define MAX_SHARE_SIZE 80
+#define MAX_USERNAME_SIZE 256   /* reasonable maximum for current servers */
+#define MAX_PASSWORD_SIZE 512   /* max for windows seems to be 256 wide chars */
 
 #define CIFS_MIN_RCV_POOL 4
 
@@ -92,7 +91,8 @@ enum statusEnum {
         CifsNew = 0,
         CifsGood,
         CifsExiting,
-        CifsNeedReconnect
+        CifsNeedReconnect,
+        CifsNeedNegotiate
 };
 
 enum securityEnum {
@@ -274,7 +274,7 @@ struct cifsSesInfo {
         int capabilities;
         char serverName[SERVER_NAME_LEN_WITH_NULL * 2]; /* BB make bigger for
                                 TCP names - will ipv6 and sctp addresses fit? */
-        char userName[MAX_USERNAME_SIZE + 1];
+        char *user_name;
         char *domainName;
         char *password;
         struct session_key auth_key;
@@ -817,7 +817,6 @@ GLOBAL_EXTERN unsigned int multiuser_mount; /* if enabled allows new sessions
                                 have the uid/password or Kerberos credential
                                 or equivalent for current user */
 GLOBAL_EXTERN unsigned int oplockEnabled;
-GLOBAL_EXTERN unsigned int experimEnabled;
 GLOBAL_EXTERN unsigned int lookupCacheEnabled;
 GLOBAL_EXTERN unsigned int global_secflags;     /* if on, session setup sent
                                 with more secure ntlmssp2 challenge/resp */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 2644a5d6cc67..df959bae6728 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -142,9 +142,9 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
          */
         while (server->tcpStatus == CifsNeedReconnect) {
                 wait_event_interruptible_timeout(server->response_q,
-                        (server->tcpStatus == CifsGood), 10 * HZ);
+                        (server->tcpStatus != CifsNeedReconnect), 10 * HZ);
 
-                /* is TCP session is reestablished now ?*/
+                /* are we still trying to reconnect? */
                 if (server->tcpStatus != CifsNeedReconnect)
                         break;
 
@@ -729,7 +729,7 @@ CIFSSMBEcho(struct TCP_Server_Info *server)
                 return rc;
 
         /* set up echo request */
-        smb->hdr.Tid = cpu_to_le16(0xffff);
+        smb->hdr.Tid = 0xffff;
         smb->hdr.WordCount = 1;
         put_unaligned_le16(1, &smb->EchoCount);
         put_bcc_le(1, &smb->hdr);
@@ -1884,10 +1884,10 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
                                         __constant_cpu_to_le16(CIFS_WRLCK))
                                 pLockData->fl_type = F_WRLCK;
 
-                        pLockData->fl_start = parm_data->start;
-                        pLockData->fl_end = parm_data->start +
-                                                parm_data->length - 1;
-                        pLockData->fl_pid = parm_data->pid;
+                        pLockData->fl_start = le64_to_cpu(parm_data->start);
+                        pLockData->fl_end = pLockData->fl_start +
+                                        le64_to_cpu(parm_data->length) - 1;
+                        pLockData->fl_pid = le32_to_cpu(parm_data->pid);
                 }
         }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 6e2b2addfc78..4bc862a80efa 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -199,8 +199,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         }
         spin_unlock(&GlobalMid_Lock);
 
-        while ((server->tcpStatus != CifsExiting) &&
-               (server->tcpStatus != CifsGood)) {
+        while (server->tcpStatus == CifsNeedReconnect) {
                 try_to_freeze();
 
                 /* we should try only the port we connected to before */
@@ -212,7 +211,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
                         atomic_inc(&tcpSesReconnectCount);
                         spin_lock(&GlobalMid_Lock);
                         if (server->tcpStatus != CifsExiting)
-                                server->tcpStatus = CifsGood;
+                                server->tcpStatus = CifsNeedNegotiate;
                         spin_unlock(&GlobalMid_Lock);
                 }
         }
@@ -248,24 +247,24 @@ static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
         data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 
-        remaining = total_data_size - data_in_this_rsp;
-
-        if (remaining == 0)
+        if (total_data_size == data_in_this_rsp)
                 return 0;
-        else if (remaining < 0) {
+        else if (total_data_size < data_in_this_rsp) {
                 cFYI(1, "total data %d smaller than data in frame %d",
                         total_data_size, data_in_this_rsp);
                 return -EINVAL;
-        } else {
-                cFYI(1, "missing %d bytes from transact2, check next response",
-                        remaining);
-                if (total_data_size > maxBufSize) {
-                        cERROR(1, "TotalDataSize %d is over maximum buffer %d",
-                                total_data_size, maxBufSize);
-                        return -EINVAL;
-                }
-                return remaining;
         }
+
+        remaining = total_data_size - data_in_this_rsp;
+
+        cFYI(1, "missing %d bytes from transact2, check next response",
+                remaining);
+        if (total_data_size > maxBufSize) {
+                cERROR(1, "TotalDataSize %d is over maximum buffer %d",
+                        total_data_size, maxBufSize);
+                return -EINVAL;
+        }
+        return remaining;
 }
 
 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
@@ -421,7 +420,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                 pdu_length = 4; /* enough to get RFC1001 header */
 
 incomplete_rcv:
-                if (echo_retries > 0 &&
+                if (echo_retries > 0 && server->tcpStatus == CifsGood &&
                     time_after(jiffies, server->lstrp +
                                         (echo_retries * SMB_ECHO_INTERVAL))) {
                         cERROR(1, "Server %s has not responded in %d seconds. "
@@ -808,8 +807,7 @@ static int
 cifs_parse_mount_options(char *options, const char *devname,
                          struct smb_vol *vol)
 {
-        char *value;
-        char *data;
+        char *value, *data, *end;
         unsigned int  temp_len, i, j;
         char separator[2];
         short int override_uid = -1;
@@ -852,6 +850,7 @@ cifs_parse_mount_options(char *options, const char *devname,
         if (!options)
                 return 1;
 
+        end = options + strlen(options);
         if (strncmp(options, "sep=", 4) == 0) {
                 if (options[4] != 0) {
                         separator[0] = options[4];
@@ -881,7 +880,8 @@ cifs_parse_mount_options(char *options, const char *devname,
                                 /* null user, ie anonymous, authentication */
                                 vol->nullauth = 1;
                         }
-                        if (strnlen(value, 200) < 200) {
+                        if (strnlen(value, MAX_USERNAME_SIZE) <
+                                                MAX_USERNAME_SIZE) {
                                 vol->username = value;
                         } else {
                                 printk(KERN_WARNING "CIFS: username too long\n");
@@ -916,6 +916,7 @@ cifs_parse_mount_options(char *options, const char *devname,
                         the only illegal character in a password is null */
 
                         if ((value[temp_len] == 0) &&
+                            (value + temp_len < end) &&
                             (value[temp_len+1] == separator[0])) {
                                 /* reinsert comma */
                                 value[temp_len] = separator[0];
@@ -1472,7 +1473,7 @@ srcip_matches(struct sockaddr *srcaddr, struct sockaddr *rhs)
 static bool
 match_port(struct TCP_Server_Info *server, struct sockaddr *addr)
 {
-        unsigned short int port, *sport;
+        __be16 port, *sport;
 
         switch (addr->sa_family) {
         case AF_INET:
@@ -1765,6 +1766,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
                 module_put(THIS_MODULE);
                 goto out_err_crypto_release;
         }
+        tcp_ses->tcpStatus = CifsNeedNegotiate;
 
         /* thread spawned, put it on the list */
         spin_lock(&cifs_tcp_ses_lock);
@@ -1808,7 +1810,9 @@ cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol)
                         break;
                 default:
                         /* anything else takes username/password */
-                        if (strncmp(ses->userName, vol->username,
+                        if (ses->user_name == NULL)
+                                continue;
+                        if (strncmp(ses->user_name, vol->username,
                                     MAX_USERNAME_SIZE))
                                 continue;
                         if (strlen(vol->username) != 0 &&
@@ -1851,6 +1855,8 @@ cifs_put_smb_ses(struct cifsSesInfo *ses)
         cifs_put_tcp_session(server);
 }
 
+static bool warned_on_ntlm;  /* globals init to false automatically */
+
 static struct cifsSesInfo *
 cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
 {
@@ -1906,9 +1912,11 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
         else
                 sprintf(ses->serverName, "%pI4", &addr->sin_addr);
 
-        if (volume_info->username)
-                strncpy(ses->userName, volume_info->username,
-                        MAX_USERNAME_SIZE);
+        if (volume_info->username) {
+                ses->user_name = kstrdup(volume_info->username, GFP_KERNEL);
+                if (!ses->user_name)
+                        goto get_ses_fail;
+        }
 
         /* volume_info->password freed at unmount */
         if (volume_info->password) {
@@ -1923,6 +1931,15 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
         }
         ses->cred_uid = volume_info->cred_uid;
         ses->linux_uid = volume_info->linux_uid;
+
+        /* ntlmv2 is much stronger than ntlm security, and has been broadly
+        supported for many years, time to update default security mechanism */
+        if ((volume_info->secFlg == 0) && warned_on_ntlm == false) {
+                warned_on_ntlm = true;
+                cERROR(1, "default security mechanism requested.  The default "
+                        "security mechanism will be upgraded from ntlm to "
+                        "ntlmv2 in kernel release 2.6.41");
+        }
         ses->overrideSecFlg = volume_info->secFlg;
 
         mutex_lock(&ses->session_mutex);
@@ -2276,7 +2293,7 @@ static int
 generic_ip_connect(struct TCP_Server_Info *server)
 {
         int rc = 0;
-        unsigned short int sport;
+        __be16 sport;
         int slen, sfamily;
         struct socket *socket = server->ssocket;
         struct sockaddr *saddr;
@@ -2361,7 +2378,7 @@ generic_ip_connect(struct TCP_Server_Info *server)
 static int
 ip_connect(struct TCP_Server_Info *server)
 {
-        unsigned short int *sport;
+        __be16 *sport;
         struct sockaddr_in6 *addr6 = (struct sockaddr_in6 *)&server->dstaddr;
         struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
 
@@ -2826,7 +2843,7 @@ try_mount_again:
 
 remote_path_check:
         /* check if a whole path (including prepath) is not remote */
-        if (!rc && cifs_sb->prepathlen && tcon) {
+        if (!rc && tcon) {
                 /* build_path_to_root works only when we have a valid tcon */
                 full_path = cifs_build_path_to_root(cifs_sb, tcon);
                 if (full_path == NULL) {
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index c27d236738fc..faf59529e847 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -575,8 +575,10 @@ reopen_error_exit:
 
 int cifs_close(struct inode *inode, struct file *file)
 {
-        cifsFileInfo_put(file->private_data);
-        file->private_data = NULL;
+        if (file->private_data != NULL) {
+                cifsFileInfo_put(file->private_data);
+                file->private_data = NULL;
+        }
 
         /* return code from the ->release op is always ignored */
         return 0;
@@ -970,6 +972,9 @@ static ssize_t cifs_write(struct cifsFileInfo *open_file,
              total_written += bytes_written) {
                 rc = -EAGAIN;
                 while (rc == -EAGAIN) {
+                        struct kvec iov[2];
+                        unsigned int len;
+
                         if (open_file->invalidHandle) {
                                 /* we could deadlock if we called
                                    filemap_fdatawait from here so tell
@@ -979,31 +984,14 @@ static ssize_t cifs_write(struct cifsFileInfo *open_file,
                                 if (rc != 0)
                                         break;
                         }
-                        if (experimEnabled || (pTcon->ses->server &&
-                                ((pTcon->ses->server->secMode &
-                                (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
-                                == 0))) {
-                                struct kvec iov[2];
-                                unsigned int len;
-
-                                len = min((size_t)cifs_sb->wsize,
-                                          write_size - total_written);
-                                /* iov[0] is reserved for smb header */
-                                iov[1].iov_base = (char *)write_data +
-                                                  total_written;
-                                iov[1].iov_len = len;
-                                rc = CIFSSMBWrite2(xid, pTcon,
-                                                open_file->netfid, len,
-                                                *poffset, &bytes_written,
-                                                iov, 1, 0);
-                        } else
-                                rc = CIFSSMBWrite(xid, pTcon,
-                                         open_file->netfid,
-                                         min_t(const int, cifs_sb->wsize,
-                                               write_size - total_written),
-                                         *poffset, &bytes_written,
-                                         write_data + total_written,
-                                         NULL, 0);
+
+                        len = min((size_t)cifs_sb->wsize,
+                                  write_size - total_written);
+                        /* iov[0] is reserved for smb header */
+                        iov[1].iov_base = (char *)write_data + total_written;
+                        iov[1].iov_len = len;
+                        rc = CIFSSMBWrite2(xid, pTcon, open_file->netfid, len,
+                                           *poffset, &bytes_written, iov, 1, 0);
                 }
                 if (rc || (bytes_written == 0)) {
                         if (total_written)
@@ -1240,12 +1228,6 @@ static int cifs_writepages(struct address_space *mapping,
         }
 
         tcon = tlink_tcon(open_file->tlink);
-        if (!experimEnabled && tcon->ses->server->secMode &
-                        (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
-                cifsFileInfo_put(open_file);
-                kfree(iov);
-                return generic_writepages(mapping, wbc);
-        }
         cifsFileInfo_put(open_file);
 
         xid = GetXid();
@@ -1980,6 +1962,24 @@ static ssize_t cifs_read(struct file *file, char *read_data, size_t read_size,
         return total_read;
 }
 
+/*
+ * If the page is mmap'ed into a process' page tables, then we need to make
+ * sure that it doesn't change while being written back.
+ */
+static int
+cifs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct page *page = vmf->page;
+
+        lock_page(page);
+        return VM_FAULT_LOCKED;
+}
+
+static struct vm_operations_struct cifs_file_vm_ops = {
+        .fault = filemap_fault,
+        .page_mkwrite = cifs_page_mkwrite,
+};
+
 int cifs_file_strict_mmap(struct file *file, struct vm_area_struct *vma)
 {
         int rc, xid;
@@ -1991,6 +1991,8 @@ int cifs_file_strict_mmap(struct file *file, struct vm_area_struct *vma)
                 cifs_invalidate_mapping(inode);
 
         rc = generic_file_mmap(file, vma);
+        if (rc == 0)
+                vma->vm_ops = &cifs_file_vm_ops;
         FreeXid(xid);
         return rc;
 }
@@ -2007,6 +2009,8 @@ int cifs_file_mmap(struct file *file, struct vm_area_struct *vma)
                 return rc;
         }
         rc = generic_file_mmap(file, vma);
+        if (rc == 0)
+                vma->vm_ops = &cifs_file_vm_ops;
         FreeXid(xid);
         return rc;
 }
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index e8804d373404..ce417a9764a3 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -239,7 +239,7 @@ CIFSQueryMFSymLink(const int xid, struct cifsTconInfo *tcon,
         if (rc != 0)
                 return rc;
 
-        if (file_info.EndOfFile != CIFS_MF_SYMLINK_FILE_SIZE) {
+        if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) {
                 CIFSSMBClose(xid, tcon, netfid);
                 /* it's not a symlink */
                 return -EINVAL;
@@ -316,7 +316,7 @@ CIFSCheckMFSymlink(struct cifs_fattr *fattr,
         if (rc != 0)
                 goto out;
 
-        if (file_info.EndOfFile != CIFS_MF_SYMLINK_FILE_SIZE) {
+        if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) {
                 CIFSSMBClose(xid, pTcon, netfid);
                 /* it's not a symlink */
                 goto out;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 2a930a752a78..0c684ae4c071 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -100,6 +100,7 @@ sesInfoFree(struct cifsSesInfo *buf_to_free)
                 memset(buf_to_free->password, 0, strlen(buf_to_free->password));
                 kfree(buf_to_free->password);
         }
+        kfree(buf_to_free->user_name);
         kfree(buf_to_free->domainName);
         kfree(buf_to_free);
 }
@@ -520,7 +521,7 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
                         (struct smb_com_transaction_change_notify_rsp *)buf;
                 struct file_notify_information *pnotify;
                 __u32 data_offset = 0;
-                if (pSMBr->ByteCount > sizeof(struct file_notify_information)) {
+                if (get_bcc_le(buf) > sizeof(struct file_notify_information)) {
                         data_offset = le32_to_cpu(pSMBr->DataOffset);
 
                         pnotify = (struct file_notify_information *)
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 16765703131b..f6728eb6f4b9 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -219,12 +219,12 @@ static void unicode_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
                 bcc_ptr++;
         } */
         /* copy user */
-        if (ses->userName == NULL) {
+        if (ses->user_name == NULL) {
                 /* null user mount */
                 *bcc_ptr = 0;
                 *(bcc_ptr+1) = 0;
         } else {
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
+                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->user_name,
                                           MAX_USERNAME_SIZE, nls_cp);
         }
         bcc_ptr += 2 * bytes_ret;
@@ -244,12 +244,11 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
         /* copy user */
         /* BB what about null user mounts - check that we do this BB */
         /* copy user */
-        if (ses->userName == NULL) {
-                /* BB what about null user mounts - check that we do this BB */
-        } else {
-                strncpy(bcc_ptr, ses->userName, MAX_USERNAME_SIZE);
-        }
-        bcc_ptr += strnlen(ses->userName, MAX_USERNAME_SIZE);
+        if (ses->user_name != NULL)
+                strncpy(bcc_ptr, ses->user_name, MAX_USERNAME_SIZE);
+        /* else null user mount */
+
+        bcc_ptr += strnlen(ses->user_name, MAX_USERNAME_SIZE);
         *bcc_ptr = 0;
         bcc_ptr++; /* account for null termination */
 
@@ -405,8 +404,8 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
         /* BB spec says that if AvId field of MsvAvTimestamp is populated then
                 we must set the MIC field of the AUTHENTICATE_MESSAGE */
         ses->ntlmssp->server_flags = le32_to_cpu(pblob->NegotiateFlags);
-        tioffset = cpu_to_le16(pblob->TargetInfoArray.BufferOffset);
-        tilen = cpu_to_le16(pblob->TargetInfoArray.Length);
+        tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
+        tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
         if (tilen) {
                 ses->auth_key.response = kmalloc(tilen, GFP_KERNEL);
                 if (!ses->auth_key.response) {
@@ -523,14 +522,14 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 tmp += len;
         }
 
-        if (ses->userName == NULL) {
+        if (ses->user_name == NULL) {
                 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
                 sec_blob->UserName.Length = 0;
                 sec_blob->UserName.MaximumLength = 0;
                 tmp += 2;
         } else {
                 int len;
-                len = cifs_strtoUCS((__le16 *)tmp, ses->userName,
+                len = cifs_strtoUCS((__le16 *)tmp, ses->user_name,
                                     MAX_USERNAME_SIZE, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
                 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
diff --git a/fs/dcache.c b/fs/dcache.c
index ad25c4cec7d5..22a0ef41bad1 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -99,12 +99,9 @@ static struct kmem_cache *dentry_cache __read_mostly;
 static unsigned int d_hash_mask __read_mostly;
 static unsigned int d_hash_shift __read_mostly;
 
-struct dcache_hash_bucket {
-        struct hlist_bl_head head;
-};
-static struct dcache_hash_bucket *dentry_hashtable __read_mostly;
+static struct hlist_bl_head *dentry_hashtable __read_mostly;
 
-static inline struct dcache_hash_bucket *d_hash(struct dentry *parent,
+static inline struct hlist_bl_head *d_hash(struct dentry *parent,
                                         unsigned long hash)
 {
         hash += ((unsigned long) parent ^ GOLDEN_RATIO_PRIME) / L1_CACHE_BYTES;
@@ -112,16 +109,6 @@ static inline struct dcache_hash_bucket *d_hash(struct dentry *parent,
         return dentry_hashtable + (hash & D_HASHMASK);
 }
 
-static inline void spin_lock_bucket(struct dcache_hash_bucket *b)
-{
-        bit_spin_lock(0, (unsigned long *)&b->head.first);
-}
-
-static inline void spin_unlock_bucket(struct dcache_hash_bucket *b)
-{
-        __bit_spin_unlock(0, (unsigned long *)&b->head.first);
-}
-
 /* Statistics gathering. */
 struct dentry_stat_t dentry_stat = {
         .age_limit = 45,
@@ -167,8 +154,8 @@ static void d_free(struct dentry *dentry)
         if (dentry->d_op && dentry->d_op->d_release)
                 dentry->d_op->d_release(dentry);
 
-        /* if dentry was never inserted into hash, immediate free is OK */
-        if (hlist_bl_unhashed(&dentry->d_hash))
+        /* if dentry was never visible to RCU, immediate free is OK */
+        if (!(dentry->d_flags & DCACHE_RCUACCESS))
                 __d_free(&dentry->d_u.d_rcu);
         else
                 call_rcu(&dentry->d_u.d_rcu, __d_free);
@@ -330,28 +317,19 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)
  */
 void __d_drop(struct dentry *dentry)
 {
-        if (!(dentry->d_flags & DCACHE_UNHASHED)) {
-                if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED)) {
-                        bit_spin_lock(0,
-                                (unsigned long *)&dentry->d_sb->s_anon.first);
-                        dentry->d_flags |= DCACHE_UNHASHED;
-                        hlist_bl_del_init(&dentry->d_hash);
-                        __bit_spin_unlock(0,
-                                (unsigned long *)&dentry->d_sb->s_anon.first);
-                } else {
-                        struct dcache_hash_bucket *b;
+        if (!d_unhashed(dentry)) {
+                struct hlist_bl_head *b;
+                if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
+                        b = &dentry->d_sb->s_anon;
+                else
                         b = d_hash(dentry->d_parent, dentry->d_name.hash);
-                        spin_lock_bucket(b);
-                        /*
-                         * We may not actually need to put DCACHE_UNHASHED
-                         * manipulations under the hash lock, but follow
-                         * the principle of least surprise.
-                         */
-                        dentry->d_flags |= DCACHE_UNHASHED;
-                        hlist_bl_del_rcu(&dentry->d_hash);
-                        spin_unlock_bucket(b);
-                        dentry_rcuwalk_barrier(dentry);
-                }
+
+                hlist_bl_lock(b);
+                __hlist_bl_del(&dentry->d_hash);
+                dentry->d_hash.pprev = NULL;
+                hlist_bl_unlock(b);
+
+                dentry_rcuwalk_barrier(dentry);
         }
 }
 EXPORT_SYMBOL(__d_drop);
@@ -1304,7 +1282,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
         dname[name->len] = 0;
 
         dentry->d_count = 1;
-        dentry->d_flags = DCACHE_UNHASHED;
+        dentry->d_flags = 0;
         spin_lock_init(&dentry->d_lock);
         seqcount_init(&dentry->d_seq);
         dentry->d_inode = NULL;
@@ -1606,10 +1584,9 @@ struct dentry *d_obtain_alias(struct inode *inode)
         tmp->d_inode = inode;
         tmp->d_flags |= DCACHE_DISCONNECTED;
         list_add(&tmp->d_alias, &inode->i_dentry);
-        bit_spin_lock(0, (unsigned long *)&tmp->d_sb->s_anon.first);
-        tmp->d_flags &= ~DCACHE_UNHASHED;
+        hlist_bl_lock(&tmp->d_sb->s_anon);
         hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon);
-        __bit_spin_unlock(0, (unsigned long *)&tmp->d_sb->s_anon.first);
+        hlist_bl_unlock(&tmp->d_sb->s_anon);
         spin_unlock(&tmp->d_lock);
         spin_unlock(&inode->i_lock);
         security_d_instantiate(tmp, inode);
@@ -1789,7 +1766,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
         unsigned int len = name->len;
         unsigned int hash = name->hash;
         const unsigned char *str = name->name;
-        struct dcache_hash_bucket *b = d_hash(parent, hash);
+        struct hlist_bl_head *b = d_hash(parent, hash);
         struct hlist_bl_node *node;
         struct dentry *dentry;
 
@@ -1813,7 +1790,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
          *
          * See Documentation/filesystems/path-lookup.txt for more details.
          */
-        hlist_bl_for_each_entry_rcu(dentry, node, &b->head, d_hash) {
+        hlist_bl_for_each_entry_rcu(dentry, node, b, d_hash) {
                 struct inode *i;
                 const char *tname;
                 int tlen;
@@ -1908,7 +1885,7 @@ struct dentry *__d_lookup(struct dentry *parent, struct qstr *name)
         unsigned int len = name->len;
         unsigned int hash = name->hash;
         const unsigned char *str = name->name;
-        struct dcache_hash_bucket *b = d_hash(parent, hash);
+        struct hlist_bl_head *b = d_hash(parent, hash);
         struct hlist_bl_node *node;
         struct dentry *found = NULL;
         struct dentry *dentry;
@@ -1935,7 +1912,7 @@ struct dentry *__d_lookup(struct dentry *parent, struct qstr *name)
          */
         rcu_read_lock();
         
-        hlist_bl_for_each_entry_rcu(dentry, node, &b->head, d_hash) {
+        hlist_bl_for_each_entry_rcu(dentry, node, b, d_hash) {
                 const char *tname;
                 int tlen;
 
@@ -2086,13 +2063,13 @@ again:
 }
 EXPORT_SYMBOL(d_delete);
 
-static void __d_rehash(struct dentry * entry, struct dcache_hash_bucket *b)
+static void __d_rehash(struct dentry * entry, struct hlist_bl_head *b)
 {
         BUG_ON(!d_unhashed(entry));
-        spin_lock_bucket(b);
-        entry->d_flags &= ~DCACHE_UNHASHED;
-        hlist_bl_add_head_rcu(&entry->d_hash, &b->head);
-        spin_unlock_bucket(b);
+        hlist_bl_lock(b);
+        entry->d_flags |= DCACHE_RCUACCESS;
+        hlist_bl_add_head_rcu(&entry->d_hash, b);
+        hlist_bl_unlock(b);
 }
 
 static void _d_rehash(struct dentry * entry)
@@ -2131,7 +2108,7 @@ EXPORT_SYMBOL(d_rehash);
  */
 void dentry_update_name_case(struct dentry *dentry, struct qstr *name)
 {
-        BUG_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
+        BUG_ON(!mutex_is_locked(&dentry->d_parent->d_inode->i_mutex));
         BUG_ON(dentry->d_name.len != name->len); /* d_lookup gives this */
 
         spin_lock(&dentry->d_lock);
@@ -3025,7 +3002,7 @@ static void __init dcache_init_early(void)
 
         dentry_hashtable =
                 alloc_large_system_hash("Dentry cache",
-                                        sizeof(struct dcache_hash_bucket),
+                                        sizeof(struct hlist_bl_head),
                                         dhash_entries,
                                         13,
                                         HASH_EARLY,
@@ -3034,7 +3011,7 @@ static void __init dcache_init_early(void)
                                         0);
 
         for (loop = 0; loop < (1 << d_hash_shift); loop++)
-                INIT_HLIST_BL_HEAD(&dentry_hashtable[loop].head);
+                INIT_HLIST_BL_HEAD(dentry_hashtable + loop);
 }
 
 static void __init dcache_init(void)
@@ -3057,7 +3034,7 @@ static void __init dcache_init(void)
 
         dentry_hashtable =
                 alloc_large_system_hash("Dentry cache",
-                                        sizeof(struct dcache_hash_bucket),
+                                        sizeof(struct hlist_bl_head),
                                         dhash_entries,
                                         13,
                                         0,
@@ -3066,7 +3043,7 @@ static void __init dcache_init(void)
                                         0);
 
         for (loop = 0; loop < (1 << d_hash_shift); loop++)
-                INIT_HLIST_BL_HEAD(&dentry_hashtable[loop].head);
+                INIT_HLIST_BL_HEAD(dentry_hashtable + loop);
 }
 
 /* SLAB cache for __getname() consumers */
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index d2a70a4561f9..b8d5c8091024 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1452,6 +1452,25 @@ static void set_default_header_data(struct ecryptfs_crypt_stat *crypt_stat)
         crypt_stat->metadata_size = ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
 }
 
+void ecryptfs_i_size_init(const char *page_virt, struct inode *inode)
+{
+        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+        struct ecryptfs_crypt_stat *crypt_stat;
+        u64 file_size;
+
+        crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
+        mount_crypt_stat =
+                &ecryptfs_superblock_to_private(inode->i_sb)->mount_crypt_stat;
+        if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
+                file_size = i_size_read(ecryptfs_inode_to_lower(inode));
+                if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
+                        file_size += crypt_stat->metadata_size;
+        } else
+                file_size = get_unaligned_be64(page_virt);
+        i_size_write(inode, (loff_t)file_size);
+        crypt_stat->flags |= ECRYPTFS_I_SIZE_INITIALIZED;
+}
+
 /**
  * ecryptfs_read_headers_virt
  * @page_virt: The virtual address into which to read the headers
@@ -1482,6 +1501,8 @@ static int ecryptfs_read_headers_virt(char *page_virt,
                 rc = -EINVAL;
                 goto out;
         }
+        if (!(crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED))
+                ecryptfs_i_size_init(page_virt, ecryptfs_dentry->d_inode);
         offset += MAGIC_ECRYPTFS_MARKER_SIZE_BYTES;
         rc = ecryptfs_process_flags(crypt_stat, (page_virt + offset),
                                     &bytes_read);
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index bd3cafd0949d..e70282775e2c 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -269,6 +269,7 @@ struct ecryptfs_crypt_stat {
 #define ECRYPTFS_ENCFN_USE_MOUNT_FNEK 0x00000800
 #define ECRYPTFS_ENCFN_USE_FEK        0x00001000
 #define ECRYPTFS_UNLINK_SIGS          0x00002000
+#define ECRYPTFS_I_SIZE_INITIALIZED   0x00004000
         u32 flags;
         unsigned int file_version;
         size_t iv_bytes;
@@ -295,6 +296,8 @@ struct ecryptfs_crypt_stat {
 struct ecryptfs_inode_info {
         struct inode vfs_inode;
         struct inode *wii_inode;
+        struct mutex lower_file_mutex;
+        atomic_t lower_file_count;
         struct file *lower_file;
         struct ecryptfs_crypt_stat crypt_stat;
 };
@@ -626,6 +629,7 @@ struct ecryptfs_open_req {
 int ecryptfs_interpose(struct dentry *hidden_dentry,
                        struct dentry *this_dentry, struct super_block *sb,
                        u32 flags);
+void ecryptfs_i_size_init(const char *page_virt, struct inode *inode);
 int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                                         struct dentry *lower_dentry,
                                         struct inode *ecryptfs_dir_inode);
@@ -757,7 +761,8 @@ int ecryptfs_privileged_open(struct file **lower_file,
                              struct dentry *lower_dentry,
                              struct vfsmount *lower_mnt,
                              const struct cred *cred);
-int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry);
+int ecryptfs_get_lower_file(struct dentry *ecryptfs_dentry);
+void ecryptfs_put_lower_file(struct inode *inode);
 int
 ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes,
                              size_t *packet_size,
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index cedc913d11ba..566e5472f78c 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -191,10 +191,10 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                                       | ECRYPTFS_ENCRYPTED);
         }
         mutex_unlock(&crypt_stat->cs_mutex);
-        rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
+        rc = ecryptfs_get_lower_file(ecryptfs_dentry);
         if (rc) {
                 printk(KERN_ERR "%s: Error attempting to initialize "
-                        "the persistent file for the dentry with name "
+                        "the lower file for the dentry with name "
                         "[%s]; rc = [%d]\n", __func__,
                         ecryptfs_dentry->d_name.name, rc);
                 goto out_free;
@@ -202,9 +202,9 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
         if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
             == O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
                 rc = -EPERM;
-                printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs "
+                printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
                        "file must hence be opened RO\n", __func__);
-                goto out_free;
+                goto out_put;
         }
         ecryptfs_set_file_lower(
                 file, ecryptfs_inode_to_private(inode)->lower_file);
@@ -232,10 +232,11 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                                        "Plaintext passthrough mode is not "
                                        "enabled; returning -EIO\n");
                                 mutex_unlock(&crypt_stat->cs_mutex);
-                                goto out_free;
+                                goto out_put;
                         }
                         rc = 0;
-                        crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
+                        crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
+                                               | ECRYPTFS_ENCRYPTED);
                         mutex_unlock(&crypt_stat->cs_mutex);
                         goto out;
                 }
@@ -245,6 +246,8 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                         "[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
                         (unsigned long long)i_size_read(inode));
         goto out;
+out_put:
+        ecryptfs_put_lower_file(inode);
 out_free:
         kmem_cache_free(ecryptfs_file_info_cache,
                         ecryptfs_file_to_private(file));
@@ -254,17 +257,13 @@ out:
 
 static int ecryptfs_flush(struct file *file, fl_owner_t td)
 {
-        int rc = 0;
-        struct file *lower_file = NULL;
-
-        lower_file = ecryptfs_file_to_lower(file);
-        if (lower_file->f_op && lower_file->f_op->flush)
-                rc = lower_file->f_op->flush(lower_file, td);
-        return rc;
+        return file->f_mode & FMODE_WRITE
+               ? filemap_write_and_wait(file->f_mapping) : 0;
 }
 
 static int ecryptfs_release(struct inode *inode, struct file *file)
 {
+        ecryptfs_put_lower_file(inode);
         kmem_cache_free(ecryptfs_file_info_cache,
                         ecryptfs_file_to_private(file));
         return 0;
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index f99051b7adab..4d4cc6a90cd5 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -168,19 +168,18 @@ static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
                                 "context; rc = [%d]\n", rc);
                 goto out;
         }
-        rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
+        rc = ecryptfs_get_lower_file(ecryptfs_dentry);
         if (rc) {
                 printk(KERN_ERR "%s: Error attempting to initialize "
-                        "the persistent file for the dentry with name "
+                        "the lower file for the dentry with name "
                         "[%s]; rc = [%d]\n", __func__,
                         ecryptfs_dentry->d_name.name, rc);
                 goto out;
         }
         rc = ecryptfs_write_metadata(ecryptfs_dentry);
-        if (rc) {
+        if (rc)
                 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
-                goto out;
-        }
+        ecryptfs_put_lower_file(ecryptfs_dentry->d_inode);
 out:
         return rc;
 }
@@ -226,11 +225,9 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
         struct dentry *lower_dir_dentry;
         struct vfsmount *lower_mnt;
         struct inode *lower_inode;
-        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
         struct ecryptfs_crypt_stat *crypt_stat;
         char *page_virt = NULL;
-        u64 file_size;
-        int rc = 0;
+        int put_lower = 0, rc = 0;
 
         lower_dir_dentry = lower_dentry->d_parent;
         lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(
@@ -277,14 +274,15 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                 rc = -ENOMEM;
                 goto out;
         }
-        rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
+        rc = ecryptfs_get_lower_file(ecryptfs_dentry);
         if (rc) {
                 printk(KERN_ERR "%s: Error attempting to initialize "
-                        "the persistent file for the dentry with name "
+                        "the lower file for the dentry with name "
                         "[%s]; rc = [%d]\n", __func__,
                         ecryptfs_dentry->d_name.name, rc);
                 goto out_free_kmem;
         }
+        put_lower = 1;
         crypt_stat = &ecryptfs_inode_to_private(
                                         ecryptfs_dentry->d_inode)->crypt_stat;
         /* TODO: lock for crypt_stat comparison */
@@ -302,18 +300,7 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                 }
                 crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
         }
-        mount_crypt_stat = &ecryptfs_superblock_to_private(
-                ecryptfs_dentry->d_sb)->mount_crypt_stat;
-        if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
-                if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
-                        file_size = (crypt_stat->metadata_size
-                                     + i_size_read(lower_dentry->d_inode));
-                else
-                        file_size = i_size_read(lower_dentry->d_inode);
-        } else {
-                file_size = get_unaligned_be64(page_virt);
-        }
-        i_size_write(ecryptfs_dentry->d_inode, (loff_t)file_size);
+        ecryptfs_i_size_init(page_virt, ecryptfs_dentry->d_inode);
 out_free_kmem:
         kmem_cache_free(ecryptfs_header_cache_2, page_virt);
         goto out;
@@ -322,6 +309,8 @@ out_put:
         mntput(lower_mnt);
         d_drop(ecryptfs_dentry);
 out:
+        if (put_lower)
+                ecryptfs_put_lower_file(ecryptfs_dentry->d_inode);
         return rc;
 }
 
@@ -538,8 +527,6 @@ static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
         dget(lower_dentry);
         rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry);
         dput(lower_dentry);
-        if (!rc)
-                d_delete(lower_dentry);
         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
         dir->i_nlink = lower_dir_dentry->d_inode->i_nlink;
         unlock_dir(lower_dir_dentry);
@@ -610,8 +597,8 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
 out_lock:
         unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
-        dput(lower_new_dentry->d_parent);
-        dput(lower_old_dentry->d_parent);
+        dput(lower_new_dir_dentry);
+        dput(lower_old_dir_dentry);
         dput(lower_new_dentry);
         dput(lower_old_dentry);
         return rc;
@@ -759,8 +746,11 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
 
         if (unlikely((ia->ia_size == i_size))) {
                 lower_ia->ia_valid &= ~ATTR_SIZE;
-                goto out;
+                return 0;
         }
+        rc = ecryptfs_get_lower_file(dentry);
+        if (rc)
+                return rc;
         crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
         /* Switch on growing or shrinking file */
         if (ia->ia_size > i_size) {
@@ -838,6 +828,7 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
                         lower_ia->ia_valid &= ~ATTR_SIZE;
         }
 out:
+        ecryptfs_put_lower_file(inode);
         return rc;
 }
 
@@ -913,7 +904,13 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
 
                 mount_crypt_stat = &ecryptfs_superblock_to_private(
                         dentry->d_sb)->mount_crypt_stat;
+                rc = ecryptfs_get_lower_file(dentry);
+                if (rc) {
+                        mutex_unlock(&crypt_stat->cs_mutex);
+                        goto out;
+                }
                 rc = ecryptfs_read_metadata(dentry);
+                ecryptfs_put_lower_file(inode);
                 if (rc) {
                         if (!(mount_crypt_stat->flags
                               & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
@@ -927,10 +924,17 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
                                 goto out;
                         }
                         rc = 0;
-                        crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
+                        crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
+                                               | ECRYPTFS_ENCRYPTED);
                 }
         }
         mutex_unlock(&crypt_stat->cs_mutex);
+        if (S_ISREG(inode->i_mode)) {
+                rc = filemap_write_and_wait(inode->i_mapping);
+                if (rc)
+                        goto out;
+                fsstack_copy_attr_all(inode, lower_inode);
+        }
         memcpy(&lower_ia, ia, sizeof(lower_ia));
         if (ia->ia_valid & ATTR_FILE)
                 lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index 0851ab6980f5..69f994a7d524 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -44,7 +44,7 @@ static struct task_struct *ecryptfs_kthread;
  * @ignored: ignored
  *
  * The eCryptfs kernel thread that has the responsibility of getting
- * the lower persistent file with RW permissions.
+ * the lower file with RW permissions.
  *
  * Returns zero on success; non-zero otherwise
  */
@@ -141,8 +141,8 @@ int ecryptfs_privileged_open(struct file **lower_file,
         int rc = 0;
 
         /* Corresponding dput() and mntput() are done when the
-         * persistent file is fput() when the eCryptfs inode is
-         * destroyed. */
+         * lower file is fput() when all eCryptfs files for the inode are
+         * released. */
         dget(lower_dentry);
         mntget(lower_mnt);
         flags |= IS_RDONLY(lower_dentry->d_inode) ? O_RDONLY : O_RDWR;
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index fdb2eb0ad09e..89b93389af8e 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -96,7 +96,7 @@ void __ecryptfs_printk(const char *fmt, ...)
 }
 
 /**
- * ecryptfs_init_persistent_file
+ * ecryptfs_init_lower_file
  * @ecryptfs_dentry: Fully initialized eCryptfs dentry object, with
  *                   the lower dentry and the lower mount set
  *
@@ -104,42 +104,70 @@ void __ecryptfs_printk(const char *fmt, ...)
  * inode. All I/O operations to the lower inode occur through that
  * file. When the first eCryptfs dentry that interposes with the first
  * lower dentry for that inode is created, this function creates the
- * persistent file struct and associates it with the eCryptfs
- * inode. When the eCryptfs inode is destroyed, the file is closed.
+ * lower file struct and associates it with the eCryptfs
+ * inode. When all eCryptfs files associated with the inode are released, the
+ * file is closed.
  *
- * The persistent file will be opened with read/write permissions, if
+ * The lower file will be opened with read/write permissions, if
  * possible. Otherwise, it is opened read-only.
  *
- * This function does nothing if a lower persistent file is already
+ * This function does nothing if a lower file is already
  * associated with the eCryptfs inode.
  *
  * Returns zero on success; non-zero otherwise
  */
-int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
+static int ecryptfs_init_lower_file(struct dentry *dentry,
+                                    struct file **lower_file)
 {
         const struct cred *cred = current_cred();
-        struct ecryptfs_inode_info *inode_info =
-                ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
-        int rc = 0;
+        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
+        struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
+        int rc;
 
-        if (!inode_info->lower_file) {
-                struct dentry *lower_dentry;
-                struct vfsmount *lower_mnt =
-                        ecryptfs_dentry_to_lower_mnt(ecryptfs_dentry);
+        rc = ecryptfs_privileged_open(lower_file, lower_dentry, lower_mnt,
+                                      cred);
+        if (rc) {
+                printk(KERN_ERR "Error opening lower file "
+                       "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
+                       "rc = [%d]\n", lower_dentry, lower_mnt, rc);
+                (*lower_file) = NULL;
+        }
+        return rc;
+}
 
-                lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
-                rc = ecryptfs_privileged_open(&inode_info->lower_file,
-                                              lower_dentry, lower_mnt, cred);
-                if (rc) {
-                        printk(KERN_ERR "Error opening lower persistent file "
-                               "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
-                               "rc = [%d]\n", lower_dentry, lower_mnt, rc);
-                        inode_info->lower_file = NULL;
-                }
+int ecryptfs_get_lower_file(struct dentry *dentry)
+{
+        struct ecryptfs_inode_info *inode_info =
+                ecryptfs_inode_to_private(dentry->d_inode);
+        int count, rc = 0;
+
+        mutex_lock(&inode_info->lower_file_mutex);
+        count = atomic_inc_return(&inode_info->lower_file_count);
+        if (WARN_ON_ONCE(count < 1))
+                rc = -EINVAL;
+        else if (count == 1) {
+                rc = ecryptfs_init_lower_file(dentry,
+                                              &inode_info->lower_file);
+                if (rc)
+                        atomic_set(&inode_info->lower_file_count, 0);
         }
+        mutex_unlock(&inode_info->lower_file_mutex);
         return rc;
 }
 
+void ecryptfs_put_lower_file(struct inode *inode)
+{
+        struct ecryptfs_inode_info *inode_info;
+
+        inode_info = ecryptfs_inode_to_private(inode);
+        if (atomic_dec_and_mutex_lock(&inode_info->lower_file_count,
+                                      &inode_info->lower_file_mutex)) {
+                fput(inode_info->lower_file);
+                inode_info->lower_file = NULL;
+                mutex_unlock(&inode_info->lower_file_mutex);
+        }
+}
+
 static struct inode *ecryptfs_get_inode(struct inode *lower_inode,
                        struct super_block *sb)
 {
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index bacc882e1ae4..245b517bf1b6 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -55,6 +55,8 @@ static struct inode *ecryptfs_alloc_inode(struct super_block *sb)
         if (unlikely(!inode_info))
                 goto out;
         ecryptfs_init_crypt_stat(&inode_info->crypt_stat);
+        mutex_init(&inode_info->lower_file_mutex);
+        atomic_set(&inode_info->lower_file_count, 0);
         inode_info->lower_file = NULL;
         inode = &inode_info->vfs_inode;
 out:
@@ -77,8 +79,7 @@ static void ecryptfs_i_callback(struct rcu_head *head)
  *
  * This is used during the final destruction of the inode.  All
  * allocation of memory related to the inode, including allocated
- * memory in the crypt_stat struct, will be released here. This
- * function also fput()'s the persistent file for the lower inode.
+ * memory in the crypt_stat struct, will be released here.
  * There should be no chance that this deallocation will be missed.
  */
 static void ecryptfs_destroy_inode(struct inode *inode)
@@ -86,16 +87,7 @@ static void ecryptfs_destroy_inode(struct inode *inode)
         struct ecryptfs_inode_info *inode_info;
 
         inode_info = ecryptfs_inode_to_private(inode);
-        if (inode_info->lower_file) {
-                struct dentry *lower_dentry =
-                        inode_info->lower_file->f_dentry;
-
-                BUG_ON(!lower_dentry);
-                if (lower_dentry->d_inode) {
-                        fput(inode_info->lower_file);
-                        inode_info->lower_file = NULL;
-                }
-        }
+        BUG_ON(inode_info->lower_file);
         ecryptfs_destroy_crypt_stat(&inode_info->crypt_stat);
         call_rcu(&inode->i_rcu, ecryptfs_i_callback);
 }
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index e25e99bf7ee1..d0f53538a57f 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -86,8 +86,8 @@
 
 #ifdef CONFIG_QUOTA
 /* Amount of blocks needed for quota update - we know that the structure was
- * allocated so we need to update only inode+data */
-#define EXT4_QUOTA_TRANS_BLOCKS(sb) (test_opt(sb, QUOTA) ? 2 : 0)
+ * allocated so we need to update only data block */
+#define EXT4_QUOTA_TRANS_BLOCKS(sb) (test_opt(sb, QUOTA) ? 1 : 0)
 /* Amount of blocks needed for quota insert/delete - we do some block writes
  * but inode, sb and group updates are done only once */
 #define EXT4_QUOTA_INIT_BLOCKS(sb) (test_opt(sb, QUOTA) ? (DQUOT_INIT_ALLOC*\
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 4673bc05274f..e9473cbe80df 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -125,9 +125,11 @@ extern int ext4_flush_completed_IO(struct inode *inode)
  * the parent directory's parent as well, and so on recursively, if
  * they are also freshly created.
  */
-static void ext4_sync_parent(struct inode *inode)
+static int ext4_sync_parent(struct inode *inode)
 {
+        struct writeback_control wbc;
         struct dentry *dentry = NULL;
+        int ret = 0;
 
         while (inode && ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
                 ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY);
@@ -136,8 +138,17 @@ static void ext4_sync_parent(struct inode *inode)
                 if (!dentry || !dentry->d_parent || !dentry->d_parent->d_inode)
                         break;
                 inode = dentry->d_parent->d_inode;
-                sync_mapping_buffers(inode->i_mapping);
+                ret = sync_mapping_buffers(inode->i_mapping);
+                if (ret)
+                        break;
+                memset(&wbc, 0, sizeof(wbc));
+                wbc.sync_mode = WB_SYNC_ALL;
+                wbc.nr_to_write = 0;         /* only write out the inode */
+                ret = sync_inode(inode, &wbc);
+                if (ret)
+                        break;
         }
+        return ret;
 }
 
 /*
@@ -176,7 +187,7 @@ int ext4_sync_file(struct file *file, int datasync)
         if (!journal) {
                 ret = generic_file_fsync(file, datasync);
                 if (!ret && !list_empty(&inode->i_dentry))
-                        ext4_sync_parent(inode);
+                        ret = ext4_sync_parent(inode);
                 goto out;
         }
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ad8e303c0d29..f2fa5e8a582c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2502,6 +2502,7 @@ static int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
                  * for partial write.
                  */
                 set_buffer_new(bh);
+                set_buffer_mapped(bh);
         }
         return 0;
 }
@@ -4429,8 +4430,8 @@ void ext4_truncate(struct inode *inode)
         Indirect chain[4];
         Indirect *partial;
         __le32 nr = 0;
-        int n;
-        ext4_lblk_t last_block;
+        int n = 0;
+        ext4_lblk_t last_block, max_block;
         unsigned blocksize = inode->i_sb->s_blocksize;
 
         trace_ext4_truncate_enter(inode);
@@ -4455,14 +4456,18 @@ void ext4_truncate(struct inode *inode)
 
         last_block = (inode->i_size + blocksize-1)
                                         >> EXT4_BLOCK_SIZE_BITS(inode->i_sb);
+        max_block = (EXT4_SB(inode->i_sb)->s_bitmap_maxbytes + blocksize-1)
+                                        >> EXT4_BLOCK_SIZE_BITS(inode->i_sb);
 
         if (inode->i_size & (blocksize - 1))
                 if (ext4_block_truncate_page(handle, mapping, inode->i_size))
                         goto out_stop;
 
-        n = ext4_block_to_path(inode, last_block, offsets, NULL);
-        if (n == 0)
-                goto out_stop;  /* error */
+        if (last_block != max_block) {
+                n = ext4_block_to_path(inode, last_block, offsets, NULL);
+                if (n == 0)
+                        goto out_stop;  /* error */
+        }
 
         /*
          * OK.  This truncate is going to happen.  We add the inode to the
@@ -4493,7 +4498,13 @@ void ext4_truncate(struct inode *inode)
          */
         ei->i_disksize = inode->i_size;
 
-        if (n == 1) {           /* direct blocks */
+        if (last_block == max_block) {
+                /*
+                 * It is unnecessary to free any data blocks if last_block is
+                 * equal to the indirect block limit.
+                 */
+                goto out_unlock;
+        } else if (n == 1) {            /* direct blocks */
                 ext4_free_data(handle, inode, NULL, i_data+offsets[0],
                                i_data + EXT4_NDIR_BLOCKS);
                 goto do_indirects;
@@ -4553,6 +4564,7 @@ do_indirects:
                 ;
         }
 
+out_unlock:
         up_write(&ei->i_data_sem);
         inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
@@ -5398,13 +5410,12 @@ static int ext4_indirect_trans_blocks(struct inode *inode, int nrblocks,
         /* if nrblocks are contiguous */
         if (chunk) {
                 /*
-                 * With N contiguous data blocks, it need at most
-                 * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) indirect blocks
-                 * 2 dindirect blocks
-                 * 1 tindirect block
+                 * With N contiguous data blocks, we need at most
+                 * N/EXT4_ADDR_PER_BLOCK(inode->i_sb) + 1 indirect blocks,
+                 * 2 dindirect blocks, and 1 tindirect block
                  */
-                indirects = nrblocks / EXT4_ADDR_PER_BLOCK(inode->i_sb);
-                return indirects + 3;
+                return DIV_ROUND_UP(nrblocks,
+                                    EXT4_ADDR_PER_BLOCK(inode->i_sb)) + 4;
         }
         /*
          * if nrblocks are not contiguous, worse case, each block touch
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 056474b7b8e0..8553dfb310af 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -242,27 +242,44 @@ static void ext4_put_nojournal(handle_t *handle)
  * journal_end calls result in the superblock being marked dirty, so
  * that sync() will call the filesystem's write_super callback if
  * appropriate.
+ *
+ * To avoid j_barrier hold in userspace when a user calls freeze(),
+ * ext4 prevents a new handle from being started by s_frozen, which
+ * is in an upper layer.
  */
 handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
 {
         journal_t *journal;
+        handle_t  *handle;
 
         if (sb->s_flags & MS_RDONLY)
                 return ERR_PTR(-EROFS);
 
-        vfs_check_frozen(sb, SB_FREEZE_TRANS);
-        /* Special case here: if the journal has aborted behind our
-         * backs (eg. EIO in the commit thread), then we still need to
-         * take the FS itself readonly cleanly. */
         journal = EXT4_SB(sb)->s_journal;
-        if (journal) {
-                if (is_journal_aborted(journal)) {
-                        ext4_abort(sb, "Detected aborted journal");
-                        return ERR_PTR(-EROFS);
-                }
-                return jbd2_journal_start(journal, nblocks);
+        handle = ext4_journal_current_handle();
+
+        /*
+         * If a handle has been started, it should be allowed to
+         * finish, otherwise deadlock could happen between freeze
+         * and others(e.g. truncate) due to the restart of the
+         * journal handle if the filesystem is forzen and active
+         * handles are not stopped.
+         */
+        if (!handle)
+                vfs_check_frozen(sb, SB_FREEZE_TRANS);
+
+        if (!journal)
+                return ext4_get_nojournal();
+        /*
+         * Special case here: if the journal has aborted behind our
+         * backs (eg. EIO in the commit thread), then we still need to
+         * take the FS itself readonly cleanly.
+         */
+        if (is_journal_aborted(journal)) {
+                ext4_abort(sb, "Detected aborted journal");
+                return ERR_PTR(-EROFS);
         }
-        return ext4_get_nojournal();
+        return jbd2_journal_start(journal, nblocks);
 }
 
 /*
@@ -2975,6 +2992,12 @@ static int ext4_register_li_request(struct super_block *sb,
         mutex_unlock(&ext4_li_info->li_list_mtx);
 
         sbi->s_li_request = elr;
+        /*
+         * set elr to NULL here since it has been inserted to
+         * the request_list and the removal and free of it is
+         * handled by ext4_clear_request_list from now on.
+         */
+        elr = NULL;
 
         if (!(ext4_li_info->li_state & EXT4_LAZYINIT_RUNNING)) {
                 ret = ext4_run_lazyinit_thread();
@@ -3385,6 +3408,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         get_random_bytes(&sbi->s_next_generation, sizeof(u32));
         spin_lock_init(&sbi->s_next_gen_lock);
 
+        init_timer(&sbi->s_err_report);
+        sbi->s_err_report.function = print_daily_error_info;
+        sbi->s_err_report.data = (unsigned long) sb;
+
         err = percpu_counter_init(&sbi->s_freeblocks_counter,
                         ext4_count_free_blocks(sb));
         if (!err) {
@@ -3646,9 +3673,6 @@ no_journal:
                  "Opts: %s%s%s", descr, sbi->s_es->s_mount_opts,
                  *sbi->s_es->s_mount_opts ? "; " : "", orig_data);
 
-        init_timer(&sbi->s_err_report);
-        sbi->s_err_report.function = print_daily_error_info;
-        sbi->s_err_report.data = (unsigned long) sb;
         if (es->s_error_count)
                 mod_timer(&sbi->s_err_report, jiffies + 300*HZ); /* 5 minutes */
 
@@ -3672,6 +3696,7 @@ failed_mount_wq:
                 sbi->s_journal = NULL;
         }
 failed_mount3:
+        del_timer(&sbi->s_err_report);
         if (sbi->s_flex_groups) {
                 if (is_vmalloc_addr(sbi->s_flex_groups))
                         vfree(sbi->s_flex_groups);
@@ -4138,6 +4163,11 @@ static int ext4_sync_fs(struct super_block *sb, int wait)
 /*
  * LVM calls this function before a (read-only) snapshot is created.  This
  * gives us a chance to flush the journal completely and mark the fs clean.
+ *
+ * Note that only this function cannot bring a filesystem to be in a clean
+ * state independently, because ext4 prevents a new handle from being started
+ * by @sb->s_frozen, which stays in an upper layer.  It thus needs help from
+ * the upper layer.
  */
 static int ext4_freeze(struct super_block *sb)
 {
@@ -4614,11 +4644,24 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
 
 static int ext4_quota_off(struct super_block *sb, int type)
 {
+        struct inode *inode = sb_dqopt(sb)->files[type];
+        handle_t *handle;
+
         /* Force all delayed allocation blocks to be allocated.
          * Caller already holds s_umount sem */
         if (test_opt(sb, DELALLOC))
                 sync_filesystem(sb);
 
+        /* Update modification times of quota files when userspace can
+         * start looking at them */
+        handle = ext4_journal_start(inode, 1);
+        if (IS_ERR(handle))
+                goto out;
+        inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+        ext4_mark_inode_dirty(handle, inode);
+        ext4_journal_stop(handle);
+
+out:
         return dquot_quota_off(sb, type);
 }
 
@@ -4714,9 +4757,8 @@ out:
         if (inode->i_size < off + len) {
                 i_size_write(inode, off + len);
                 EXT4_I(inode)->i_disksize = inode->i_size;
+                ext4_mark_inode_dirty(handle, inode);
         }
-        inode->i_mtime = inode->i_ctime = CURRENT_TIME;
-        ext4_mark_inode_dirty(handle, inode);
         mutex_unlock(&inode->i_mutex);
         return len;
 }
diff --git a/fs/fhandle.c b/fs/fhandle.c
index bf93ad2bee07..6b088641f5bf 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -7,6 +7,7 @@
 #include <linux/exportfs.h>
 #include <linux/fs_struct.h>
 #include <linux/fsnotify.h>
+#include <linux/personality.h>
 #include <asm/uaccess.h>
 #include "internal.h"
 
diff --git a/fs/file.c b/fs/file.c
index 0be344755c02..4c6992d8f3ba 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -9,6 +9,7 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
+#include <linux/mmzone.h>
 #include <linux/time.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -39,14 +40,17 @@ int sysctl_nr_open_max = 1024 * 1024; /* raised later */
  */
 static DEFINE_PER_CPU(struct fdtable_defer, fdtable_defer_list);
 
-static inline void *alloc_fdmem(unsigned int size)
+static void *alloc_fdmem(unsigned int size)
 {
-        void *data;
-
-        data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
-        if (data != NULL)
-                return data;
-
+        /*
+         * Very large allocations can stress page reclaim, so fall back to
+         * vmalloc() if the allocation size will be considered "large" by the VM.
+         */
+        if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
+                void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
+                if (data != NULL)
+                        return data;
+        }
         return vmalloc(size);
 }
 
diff --git a/fs/filesystems.c b/fs/filesystems.c
index 751d6b255a12..0845f84f2a5f 100644
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -110,14 +110,13 @@ int unregister_filesystem(struct file_system_type * fs)
                         *tmp = fs->next;
                         fs->next = NULL;
                         write_unlock(&file_systems_lock);
+                        synchronize_rcu();
                         return 0;
                 }
                 tmp = &(*tmp)->next;
         }
         write_unlock(&file_systems_lock);
 
-        synchronize_rcu();
-
         return -EINVAL;
 }
 
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index c71995b111bf..0f5c4f9d5d62 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -884,8 +884,8 @@ static int gfs2_write_end(struct file *file, struct address_space *mapping,
         }
 
         brelse(dibh);
-        gfs2_trans_end(sdp);
 failed:
+        gfs2_trans_end(sdp);
         if (al) {
                 gfs2_inplace_release(ip);
                 gfs2_quota_unlock(ip);
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index 5c356d09c321..f789c5732b7c 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -1506,7 +1506,7 @@ struct inode *gfs2_dir_search(struct inode *dir, const struct qstr *name)
                 inode = gfs2_inode_lookup(dir->i_sb, 
                                 be16_to_cpu(dent->de_type),
                                 be64_to_cpu(dent->de_inum.no_addr),
-                                be64_to_cpu(dent->de_inum.no_formal_ino));
+                                be64_to_cpu(dent->de_inum.no_formal_ino), 0);
                 brelse(bh);
                 return inode;
         }
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index b2682e073eee..e48310885c48 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -617,18 +617,51 @@ static ssize_t gfs2_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
         return generic_file_aio_write(iocb, iov, nr_segs, pos);
 }
 
-static void empty_write_end(struct page *page, unsigned from,
-                           unsigned to)
+static int empty_write_end(struct page *page, unsigned from,
+                           unsigned to, int mode)
 {
-        struct gfs2_inode *ip = GFS2_I(page->mapping->host);
+        struct inode *inode = page->mapping->host;
+        struct gfs2_inode *ip = GFS2_I(inode);
+        struct buffer_head *bh;
+        unsigned offset, blksize = 1 << inode->i_blkbits;
+        pgoff_t end_index = i_size_read(inode) >> PAGE_CACHE_SHIFT;
 
         zero_user(page, from, to-from);
         mark_page_accessed(page);
 
-        if (!gfs2_is_writeback(ip))
-                gfs2_page_add_databufs(ip, page, from, to);
+        if (page->index < end_index || !(mode & FALLOC_FL_KEEP_SIZE)) {
+                if (!gfs2_is_writeback(ip))
+                        gfs2_page_add_databufs(ip, page, from, to);
+
+                block_commit_write(page, from, to);
+                return 0;
+        }
+
+        offset = 0;
+        bh = page_buffers(page);
+        while (offset < to) {
+                if (offset >= from) {
+                        set_buffer_uptodate(bh);
+                        mark_buffer_dirty(bh);
+                        clear_buffer_new(bh);
+                        write_dirty_buffer(bh, WRITE);
+                }
+                offset += blksize;
+                bh = bh->b_this_page;
+        }
 
-        block_commit_write(page, from, to);
+        offset = 0;
+        bh = page_buffers(page);
+        while (offset < to) {
+                if (offset >= from) {
+                        wait_on_buffer(bh);
+                        if (!buffer_uptodate(bh))
+                                return -EIO;
+                }
+                offset += blksize;
+                bh = bh->b_this_page;
+        }
+        return 0;
 }
 
 static int needs_empty_write(sector_t block, struct inode *inode)
@@ -643,7 +676,8 @@ static int needs_empty_write(sector_t block, struct inode *inode)
         return !buffer_mapped(&bh_map);
 }
 
-static int write_empty_blocks(struct page *page, unsigned from, unsigned to)
+static int write_empty_blocks(struct page *page, unsigned from, unsigned to,
+                              int mode)
 {
         struct inode *inode = page->mapping->host;
         unsigned start, end, next, blksize;
@@ -668,7 +702,9 @@ static int write_empty_blocks(struct page *page, unsigned from, unsigned to)
                                                           gfs2_block_map);
                                 if (unlikely(ret))
                                         return ret;
-                                empty_write_end(page, start, end);
+                                ret = empty_write_end(page, start, end, mode);
+                                if (unlikely(ret))
+                                        return ret;
                                 end = 0;
                         }
                         start = next;
@@ -682,7 +718,9 @@ static int write_empty_blocks(struct page *page, unsigned from, unsigned to)
                 ret = __block_write_begin(page, start, end - start, gfs2_block_map);
                 if (unlikely(ret))
                         return ret;
-                empty_write_end(page, start, end);
+                ret = empty_write_end(page, start, end, mode);
+                if (unlikely(ret))
+                        return ret;
         }
 
         return 0;
@@ -731,7 +769,7 @@ static int fallocate_chunk(struct inode *inode, loff_t offset, loff_t len,
 
                 if (curr == end)
                         to = end_offset;
-                error = write_empty_blocks(page, from, to);
+                error = write_empty_blocks(page, from, to, mode);
                 if (!error && offset + to > inode->i_size &&
                     !(mode & FALLOC_FL_KEEP_SIZE)) {
                         i_size_write(inode, offset + to);
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index f07643e21bfa..7a4fb630a320 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -93,14 +93,12 @@ static unsigned int gl_hash(const struct gfs2_sbd *sdp,
 
 static inline void spin_lock_bucket(unsigned int hash)
 {
-        struct hlist_bl_head *bl = &gl_hash_table[hash];
-        bit_spin_lock(0, (unsigned long *)bl);
+        hlist_bl_lock(&gl_hash_table[hash]);
 }
 
 static inline void spin_unlock_bucket(unsigned int hash)
 {
-        struct hlist_bl_head *bl = &gl_hash_table[hash];
-        __bit_spin_unlock(0, (unsigned long *)bl);
+        hlist_bl_unlock(&gl_hash_table[hash]);
 }
 
 static void gfs2_glock_dealloc(struct rcu_head *rcu)
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 3754e3cbf02b..25eeb2bcee47 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -385,6 +385,10 @@ static int trans_go_demote_ok(const struct gfs2_glock *gl)
 static void iopen_go_callback(struct gfs2_glock *gl)
 {
         struct gfs2_inode *ip = (struct gfs2_inode *)gl->gl_object;
+        struct gfs2_sbd *sdp = gl->gl_sbd;
+
+        if (sdp->sd_vfs->s_flags & MS_RDONLY)
+                return;
 
         if (gl->gl_demote_state == LM_ST_UNLOCKED &&
             gl->gl_state == LM_ST_SHARED && ip) {
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 97d54a28776a..9134dcb89479 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -40,37 +40,61 @@ struct gfs2_inum_range_host {
         u64 ir_length;
 };
 
+struct gfs2_skip_data {
+        u64 no_addr;
+        int skipped;
+        int non_block;
+};
+
 static int iget_test(struct inode *inode, void *opaque)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
-        u64 *no_addr = opaque;
+        struct gfs2_skip_data *data = opaque;
 
-        if (ip->i_no_addr == *no_addr)
+        if (ip->i_no_addr == data->no_addr) {
+                if (data->non_block &&
+                    inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE)) {
+                        data->skipped = 1;
+                        return 0;
+                }
                 return 1;
-
+        }
         return 0;
 }
 
 static int iget_set(struct inode *inode, void *opaque)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
-        u64 *no_addr = opaque;
+        struct gfs2_skip_data *data = opaque;
 
-        inode->i_ino = (unsigned long)*no_addr;
-        ip->i_no_addr = *no_addr;
+        if (data->skipped)
+                return -ENOENT;
+        inode->i_ino = (unsigned long)(data->no_addr);
+        ip->i_no_addr = data->no_addr;
         return 0;
 }
 
 struct inode *gfs2_ilookup(struct super_block *sb, u64 no_addr)
 {
         unsigned long hash = (unsigned long)no_addr;
-        return ilookup5(sb, hash, iget_test, &no_addr);
+        struct gfs2_skip_data data;
+
+        data.no_addr = no_addr;
+        data.skipped = 0;
+        data.non_block = 0;
+        return ilookup5(sb, hash, iget_test, &data);
 }
 
-static struct inode *gfs2_iget(struct super_block *sb, u64 no_addr)
+static struct inode *gfs2_iget(struct super_block *sb, u64 no_addr,
+                               int non_block)
 {
+        struct gfs2_skip_data data;
         unsigned long hash = (unsigned long)no_addr;
-        return iget5_locked(sb, hash, iget_test, iget_set, &no_addr);
+
+        data.no_addr = no_addr;
+        data.skipped = 0;
+        data.non_block = non_block;
+        return iget5_locked(sb, hash, iget_test, iget_set, &data);
 }
 
 /**
@@ -111,19 +135,20 @@ static void gfs2_set_iop(struct inode *inode)
  * @sb: The super block
  * @no_addr: The inode number
  * @type: The type of the inode
+ * non_block: Can we block on inodes that are being freed?
  *
  * Returns: A VFS inode, or an error
  */
 
 struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned int type,
-                                u64 no_addr, u64 no_formal_ino)
+                                u64 no_addr, u64 no_formal_ino, int non_block)
 {
         struct inode *inode;
         struct gfs2_inode *ip;
         struct gfs2_glock *io_gl = NULL;
         int error;
 
-        inode = gfs2_iget(sb, no_addr);
+        inode = gfs2_iget(sb, no_addr, non_block);
         ip = GFS2_I(inode);
 
         if (!inode)
@@ -185,11 +210,12 @@ struct inode *gfs2_lookup_by_inum(struct gfs2_sbd *sdp, u64 no_addr,
 {
         struct super_block *sb = sdp->sd_vfs;
         struct gfs2_holder i_gh;
-        struct inode *inode;
+        struct inode *inode = NULL;
         int error;
 
+        /* Must not read in block until block type is verified */
         error = gfs2_glock_nq_num(sdp, no_addr, &gfs2_inode_glops,
-                                  LM_ST_SHARED, LM_FLAG_ANY, &i_gh);
+                                  LM_ST_EXCLUSIVE, GL_SKIP, &i_gh);
         if (error)
                 return ERR_PTR(error);
 
@@ -197,7 +223,7 @@ struct inode *gfs2_lookup_by_inum(struct gfs2_sbd *sdp, u64 no_addr,
         if (error)
                 goto fail;
 
-        inode = gfs2_inode_lookup(sb, DT_UNKNOWN, no_addr, 0);
+        inode = gfs2_inode_lookup(sb, DT_UNKNOWN, no_addr, 0, 1);
         if (IS_ERR(inode))
                 goto fail;
 
@@ -843,7 +869,7 @@ struct inode *gfs2_createi(struct gfs2_holder *ghs, const struct qstr *name,
                 goto fail_gunlock2;
 
         inode = gfs2_inode_lookup(dir->i_sb, IF2DT(mode), inum.no_addr,
-                                  inum.no_formal_ino);
+                                  inum.no_formal_ino, 0);
         if (IS_ERR(inode))
                 goto fail_gunlock2;
 
diff --git a/fs/gfs2/inode.h b/fs/gfs2/inode.h
index 3e00a66e7cbd..099ca305e518 100644
--- a/fs/gfs2/inode.h
+++ b/fs/gfs2/inode.h
@@ -97,7 +97,8 @@ err:
 }
 
 extern struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned type, 
-                                       u64 no_addr, u64 no_formal_ino);
+                                       u64 no_addr, u64 no_formal_ino,
+                                       int non_block);
 extern struct inode *gfs2_lookup_by_inum(struct gfs2_sbd *sdp, u64 no_addr,
                                          u64 *no_formal_ino,
                                          unsigned int blktype);
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 42ef24355afb..d3c69eb91c74 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -430,7 +430,7 @@ static int gfs2_lookup_root(struct super_block *sb, struct dentry **dptr,
         struct dentry *dentry;
         struct inode *inode;
 
-        inode = gfs2_inode_lookup(sb, DT_DIR, no_addr, 0);
+        inode = gfs2_inode_lookup(sb, DT_DIR, no_addr, 0, 0);
         if (IS_ERR(inode)) {
                 fs_err(sdp, "can't read in %s inode: %ld\n", name, PTR_ERR(inode));
                 return PTR_ERR(inode);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index cf930cd9664a..6fcae8469f6d 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -945,7 +945,7 @@ static void try_rgrp_unlink(struct gfs2_rgrpd *rgd, u64 *last_unlinked, u64 skip
                 /* rgblk_search can return a block < goal, so we need to
                    keep it marching forward. */
                 no_addr = block + rgd->rd_data0;
-                goal++;
+                goal = max(block + 1, goal + 1);
                 if (*last_unlinked != NO_BLOCK && no_addr <= *last_unlinked)
                         continue;
                 if (no_addr == skip)
@@ -971,7 +971,7 @@ static void try_rgrp_unlink(struct gfs2_rgrpd *rgd, u64 *last_unlinked, u64 skip
                         found++;
 
                 /* Limit reclaim to sensible number of tasks */
-                if (found > 2*NR_CPUS)
+                if (found > NR_CPUS)
                         return;
         }
 
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index a4e23d68a398..b9f28e66dad1 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1318,15 +1318,17 @@ static int gfs2_show_options(struct seq_file *s, struct vfsmount *mnt)
 
 static void gfs2_evict_inode(struct inode *inode)
 {
-        struct gfs2_sbd *sdp = inode->i_sb->s_fs_info;
+        struct super_block *sb = inode->i_sb;
+        struct gfs2_sbd *sdp = sb->s_fs_info;
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_holder gh;
         int error;
 
-        if (inode->i_nlink)
+        if (inode->i_nlink || (sb->s_flags & MS_RDONLY))
                 goto out;
 
-        error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
+        /* Must not read inode block until block type has been verified */
+        error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, GL_SKIP, &gh);
         if (unlikely(error)) {
                 gfs2_glock_dq_uninit(&ip->i_iopen_gh);
                 goto out;
@@ -1336,6 +1338,12 @@ static void gfs2_evict_inode(struct inode *inode)
         if (error)
                 goto out_truncate;
 
+        if (test_bit(GIF_INVALID, &ip->i_flags)) {
+                error = gfs2_inode_refresh(ip);
+                if (error)
+                        goto out_truncate;
+        }
+
         ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
         gfs2_glock_dq_wait(&ip->i_iopen_gh);
         gfs2_holder_reinit(LM_ST_EXCLUSIVE, LM_FLAG_TRY_1CB | GL_NOCACHE, &ip->i_iopen_gh);
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 20af62f4304b..6e28000a4b21 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -105,6 +105,8 @@ static int journal_submit_commit_record(journal_t *journal,
         int ret;
         struct timespec now = current_kernel_time();
 
+        *cbh = NULL;
+
         if (is_journal_aborted(journal))
                 return 0;
 
@@ -806,7 +808,7 @@ wait_for_iobuf:
                 if (err)
                         __jbd2_journal_abort_hard(journal);
         }
-        if (!err && !is_journal_aborted(journal))
+        if (cbh)
                 err = journal_wait_on_commit_record(journal, cbh);
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
                                       JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index aba8ebaec25c..e0ec3db1c395 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2413,10 +2413,12 @@ const char *jbd2_dev_to_name(dev_t device)
         new_dev = kmalloc(sizeof(struct devname_cache), GFP_KERNEL);
         if (!new_dev)
                 return "NODEV-ALLOCFAILURE"; /* Something non-NULL */
+        bd = bdget(device);
         spin_lock(&devname_cache_lock);
         if (devcache[i]) {
                 if (devcache[i]->device == device) {
                         kfree(new_dev);
+                        bdput(bd);
                         ret = devcache[i]->devname;
                         spin_unlock(&devname_cache_lock);
                         return ret;
@@ -2425,7 +2427,6 @@ const char *jbd2_dev_to_name(dev_t device)
         }
         devcache[i] = new_dev;
         devcache[i]->device = device;
-        bd = bdget(device);
         if (bd) {
                 bdevname(bd, devcache[i]->devname);
                 bdput(bd);
diff --git a/fs/namei.c b/fs/namei.c
index e6cd6113872c..54fc993e3027 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -697,6 +697,7 @@ static __always_inline void set_root_rcu(struct nameidata *nd)
                 do {
                         seq = read_seqcount_begin(&fs->seq);
                         nd->root = fs->root;
+                        nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
                 } while (read_seqcount_retry(&fs->seq, seq));
         }
 }
diff --git a/fs/namespace.c b/fs/namespace.c
index 7dba2ed03429..d99bcf59e4c2 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1030,18 +1030,6 @@ const struct seq_operations mounts_op = {
         .show   = show_vfsmnt
 };
 
-static int uuid_is_nil(u8 *uuid)
-{
-        int i;
-        u8  *cp = (u8 *)uuid;
-
-        for (i = 0; i < 16; i++) {
-                if (*cp++)
-                        return 0;
-        }
-        return 1;
-}
-
 static int show_mountinfo(struct seq_file *m, void *v)
 {
         struct proc_mounts *p = m->private;
@@ -1085,10 +1073,6 @@ static int show_mountinfo(struct seq_file *m, void *v)
         if (IS_MNT_UNBINDABLE(mnt))
                 seq_puts(m, " unbindable");
 
-        if (!uuid_is_nil(mnt->mnt_sb->s_uuid))
-                /* print the uuid */
-                seq_printf(m, " uuid:%pU", mnt->mnt_sb->s_uuid);
-
         /* Filesystem specific data */
         seq_puts(m, " - ");
         show_type(m, sb);
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 89fc160fd5b0..1f063bacd285 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -119,7 +119,7 @@ Elong:
 }
 
 #ifdef CONFIG_NFS_V4
-static rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors, struct inode *inode)
+static rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors)
 {
         struct gss_api_mech *mech;
         struct xdr_netobj oid;
@@ -166,7 +166,7 @@ static int nfs_negotiate_security(const struct dentry *parent,
                 }
                 flavors = page_address(page);
                 ret = secinfo(parent->d_inode, &dentry->d_name, flavors);
-                *flavor = nfs_find_best_sec(flavors, dentry->d_inode);
+                *flavor = nfs_find_best_sec(flavors);
                 put_page(page);
         }
 
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index e1c261ddd65d..c4a69833dd0d 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -47,6 +47,7 @@ enum nfs4_client_state {
         NFS4CLNT_LAYOUTRECALL,
         NFS4CLNT_SESSION_RESET,
         NFS4CLNT_RECALL_SLOT,
+        NFS4CLNT_LEASE_CONFIRM,
 };
 
 enum nfs4_session_state {
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 9bf41eab3e46..69c0f3c5ee7a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -46,6 +46,7 @@
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
 #include <linux/nfs_page.h>
+#include <linux/nfs_mount.h>
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/module.h>
@@ -443,8 +444,8 @@ static int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *
         if (res->sr_status == 1)
                 res->sr_status = NFS_OK;
 
-        /* -ERESTARTSYS can result in skipping nfs41_sequence_setup */
-        if (!res->sr_slot)
+        /* don't increment the sequence number if the task wasn't sent */
+        if (!RPC_WAS_SENT(task))
                 goto out;
 
         /* Check the SEQUENCE operation status */
@@ -2185,9 +2186,14 @@ static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
         struct nfs4_exception exception = { };
         int err;
         do {
-                err = nfs4_handle_exception(server,
-                                _nfs4_lookup_root(server, fhandle, info),
-                                &exception);
+                err = _nfs4_lookup_root(server, fhandle, info);
+                switch (err) {
+                case 0:
+                case -NFS4ERR_WRONGSEC:
+                        break;
+                default:
+                        err = nfs4_handle_exception(server, err, &exception);
+                }
         } while (exception.retry);
         return err;
 }
@@ -2208,25 +2214,47 @@ out:
         return ret;
 }
 
-/*
- * get the file handle for the "/" directory on the server
- */
-static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
+static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
                               struct nfs_fsinfo *info)
 {
         int i, len, status = 0;
-        rpc_authflavor_t flav_array[NFS_MAX_SECFLAVORS + 2];
+        rpc_authflavor_t flav_array[NFS_MAX_SECFLAVORS];
 
-        flav_array[0] = RPC_AUTH_UNIX;
-        len = gss_mech_list_pseudoflavors(&flav_array[1]);
-        flav_array[1+len] = RPC_AUTH_NULL;
-        len += 2;
+        len = gss_mech_list_pseudoflavors(&flav_array[0]);
+        flav_array[len] = RPC_AUTH_NULL;
+        len += 1;
 
         for (i = 0; i < len; i++) {
                 status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]);
-                if (status != -EPERM)
-                        break;
+                if (status == -NFS4ERR_WRONGSEC || status == -EACCES)
+                        continue;
+                break;
         }
+        /*
+         * -EACCESS could mean that the user doesn't have correct permissions
+         * to access the mount.  It could also mean that we tried to mount
+         * with a gss auth flavor, but rpc.gssd isn't running.  Either way,
+         * existing mount programs don't handle -EACCES very well so it should
+         * be mapped to -EPERM instead.
+         */
+        if (status == -EACCES)
+                status = -EPERM;
+        return status;
+}
+
+/*
+ * get the file handle for the "/" directory on the server
+ */
+static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
+                              struct nfs_fsinfo *info)
+{
+        int status = nfs4_lookup_root(server, fhandle, info);
+        if ((status == -NFS4ERR_WRONGSEC) && !(server->flags & NFS_MOUNT_SECFLAVOUR))
+                /*
+                 * A status of -NFS4ERR_WRONGSEC will be mapped to -EPERM
+                 * by nfs4_map_errors() as this function exits.
+                 */
+                status = nfs4_find_root_sec(server, fhandle, info);
         if (status == 0)
                 status = nfs4_server_capabilities(server, fhandle);
         if (status == 0)
@@ -3723,21 +3751,20 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program,
                                 sizeof(setclientid.sc_uaddr), "%s.%u.%u",
                                 clp->cl_ipaddr, port >> 8, port & 255);
 
-                status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+                status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
                 if (status != -NFS4ERR_CLID_INUSE)
                         break;
-                if (signalled())
+                if (loop != 0) {
+                        ++clp->cl_id_uniquifier;
                         break;
-                if (loop++ & 1)
-                        ssleep(clp->cl_lease_time / HZ + 1);
-                else
-                        if (++clp->cl_id_uniquifier == 0)
-                                break;
+                }
+                ++loop;
+                ssleep(clp->cl_lease_time / HZ + 1);
         }
         return status;
 }
 
-static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
+int nfs4_proc_setclientid_confirm(struct nfs_client *clp,
                 struct nfs4_setclientid_res *arg,
                 struct rpc_cred *cred)
 {
@@ -3752,7 +3779,7 @@ static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
         int status;
 
         now = jiffies;
-        status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         if (status == 0) {
                 spin_lock(&clp->cl_lock);
                 clp->cl_lease_time = fsinfo.lease_time * HZ;
@@ -3762,26 +3789,6 @@ static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
         return status;
 }
 
-int nfs4_proc_setclientid_confirm(struct nfs_client *clp,
-                struct nfs4_setclientid_res *arg,
-                struct rpc_cred *cred)
-{
-        long timeout = 0;
-        int err;
-        do {
-                err = _nfs4_proc_setclientid_confirm(clp, arg, cred);
-                switch (err) {
-                        case 0:
-                                return err;
-                        case -NFS4ERR_RESOURCE:
-                                /* The IBM lawyers misread another document! */
-                        case -NFS4ERR_DELAY:
-                                err = nfs4_delay(clp->cl_rpcclient, &timeout);
-                }
-        } while (err == 0);
-        return err;
-}
-
 struct nfs4_delegreturndata {
         struct nfs4_delegreturnargs args;
         struct nfs4_delegreturnres res;
@@ -4786,7 +4793,7 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                                 init_utsname()->domainname,
                                 clp->cl_rpcclient->cl_auth->au_flavor);
 
-        status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         if (!status)
                 status = nfs4_check_cl_exchange_flags(clp->cl_exchange_flags);
         dprintk("<-- %s status= %d\n", __func__, status);
@@ -4869,7 +4876,8 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
                 .rpc_client = clp->cl_rpcclient,
                 .rpc_message = &msg,
                 .callback_ops = &nfs4_get_lease_time_ops,
-                .callback_data = &data
+                .callback_data = &data,
+                .flags = RPC_TASK_TIMEOUT,
         };
         int status;
 
@@ -5171,7 +5179,7 @@ static int _nfs4_proc_create_session(struct nfs_client *clp)
         nfs4_init_channel_attrs(&args);
         args.flags = (SESSION4_PERSIST | SESSION4_BACK_CHAN);
 
-        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
 
         if (!status)
                 /* Verify the session's negotiated channel_attrs values */
@@ -5194,20 +5202,10 @@ int nfs4_proc_create_session(struct nfs_client *clp)
         int status;
         unsigned *ptr;
         struct nfs4_session *session = clp->cl_session;
-        long timeout = 0;
-        int err;
 
         dprintk("--> %s clp=%p session=%p\n", __func__, clp, session);
 
-        do {
-                status = _nfs4_proc_create_session(clp);
-                if (status == -NFS4ERR_DELAY) {
-                        err = nfs4_delay(clp->cl_rpcclient, &timeout);
-                        if (err)
-                                status = err;
-                }
-        } while (status == -NFS4ERR_DELAY);
-
+        status = _nfs4_proc_create_session(clp);
         if (status)
                 goto out;
 
@@ -5248,7 +5246,7 @@ int nfs4_proc_destroy_session(struct nfs4_session *session)
         msg.rpc_argp = session;
         msg.rpc_resp = NULL;
         msg.rpc_cred = NULL;
-        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
 
         if (status)
                 printk(KERN_WARNING
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index a6804f704d9d..036f5adc9e1f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -64,10 +64,15 @@ static LIST_HEAD(nfs4_clientid_list);
 
 int nfs4_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
 {
-        struct nfs4_setclientid_res clid;
+        struct nfs4_setclientid_res clid = {
+                .clientid = clp->cl_clientid,
+                .confirm = clp->cl_confirm,
+        };
         unsigned short port;
         int status;
 
+        if (test_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state))
+                goto do_confirm;
         port = nfs_callback_tcpport;
         if (clp->cl_addr.ss_family == AF_INET6)
                 port = nfs_callback_tcpport6;
@@ -75,10 +80,14 @@ int nfs4_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
         status = nfs4_proc_setclientid(clp, NFS4_CALLBACK, port, cred, &clid);
         if (status != 0)
                 goto out;
+        clp->cl_clientid = clid.clientid;
+        clp->cl_confirm = clid.confirm;
+        set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+do_confirm:
         status = nfs4_proc_setclientid_confirm(clp, &clid, cred);
         if (status != 0)
                 goto out;
-        clp->cl_clientid = clid.clientid;
+        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
         nfs4_schedule_state_renewal(clp);
 out:
         return status;
@@ -230,13 +239,18 @@ int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
 {
         int status;
 
+        if (test_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state))
+                goto do_confirm;
         nfs4_begin_drain_session(clp);
         status = nfs4_proc_exchange_id(clp, cred);
         if (status != 0)
                 goto out;
+        set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+do_confirm:
         status = nfs4_proc_create_session(clp);
         if (status != 0)
                 goto out;
+        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
         nfs41_setup_state_renewal(clp);
         nfs_mark_client_ready(clp, NFS_CS_READY);
 out:
@@ -1584,20 +1598,23 @@ static int nfs4_recall_slot(struct nfs_client *clp) { return 0; }
  */
 static void nfs4_set_lease_expired(struct nfs_client *clp, int status)
 {
-        if (nfs4_has_session(clp)) {
-                switch (status) {
-                case -NFS4ERR_DELAY:
-                case -NFS4ERR_CLID_INUSE:
-                case -EAGAIN:
-                        break;
+        switch (status) {
+        case -NFS4ERR_CLID_INUSE:
+        case -NFS4ERR_STALE_CLIENTID:
+                clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+                break;
+        case -NFS4ERR_DELAY:
+        case -ETIMEDOUT:
+        case -EAGAIN:
+                ssleep(1);
+                break;
 
-                case -EKEYEXPIRED:
-                        nfs4_warn_keyexpired(clp->cl_hostname);
-                case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
-                                         * in nfs4_exchange_id */
-                default:
-                        return;
-                }
+        case -EKEYEXPIRED:
+                nfs4_warn_keyexpired(clp->cl_hostname);
+        case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
+                                 * in nfs4_exchange_id */
+        default:
+                return;
         }
         set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
 }
@@ -1607,7 +1624,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
         int status = 0;
 
         /* Ensure exclusive access to NFSv4 state */
-        for(;;) {
+        do {
                 if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) {
                         /* We're going to have to re-establish a clientid */
                         status = nfs4_reclaim_lease(clp);
@@ -1691,7 +1708,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
                         break;
                 if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
                         break;
-        }
+        } while (atomic_read(&clp->cl_count) > 1);
         return;
 out_error:
         printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index dddfb5795d7b..c3ccd2c46834 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1452,26 +1452,25 @@ static void encode_read(struct xdr_stream *xdr, const struct nfs_readargs *args,
 
 static void encode_readdir(struct xdr_stream *xdr, const struct nfs4_readdir_arg *readdir, struct rpc_rqst *req, struct compound_hdr *hdr)
 {
-        uint32_t attrs[2] = {0, 0};
+        uint32_t attrs[2] = {
+                FATTR4_WORD0_RDATTR_ERROR,
+                FATTR4_WORD1_MOUNTED_ON_FILEID,
+        };
         uint32_t dircount = readdir->count >> 1;
         __be32 *p;
 
         if (readdir->plus) {
                 attrs[0] |= FATTR4_WORD0_TYPE|FATTR4_WORD0_CHANGE|FATTR4_WORD0_SIZE|
-                        FATTR4_WORD0_FSID|FATTR4_WORD0_FILEHANDLE;
+                        FATTR4_WORD0_FSID|FATTR4_WORD0_FILEHANDLE|FATTR4_WORD0_FILEID;
                 attrs[1] |= FATTR4_WORD1_MODE|FATTR4_WORD1_NUMLINKS|FATTR4_WORD1_OWNER|
                         FATTR4_WORD1_OWNER_GROUP|FATTR4_WORD1_RAWDEV|
                         FATTR4_WORD1_SPACE_USED|FATTR4_WORD1_TIME_ACCESS|
                         FATTR4_WORD1_TIME_METADATA|FATTR4_WORD1_TIME_MODIFY;
                 dircount >>= 1;
         }
-        attrs[0] |= FATTR4_WORD0_RDATTR_ERROR|FATTR4_WORD0_FILEID;
-        attrs[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
-        /* Switch to mounted_on_fileid if the server supports it */
-        if (readdir->bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
-                attrs[0] &= ~FATTR4_WORD0_FILEID;
-        else
-                attrs[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
+        /* Use mounted_on_fileid only if the server supports it */
+        if (!(readdir->bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID))
+                attrs[0] |= FATTR4_WORD0_FILEID;
 
         p = reserve_space(xdr, 12+NFS4_VERIFIER_SIZE+20);
         *p++ = cpu_to_be32(OP_READDIR);
@@ -3140,7 +3139,7 @@ static int decode_attr_mounted_on_fileid(struct xdr_stream *xdr, uint32_t *bitma
                         goto out_overflow;
                 xdr_decode_hyper(p, fileid);
                 bitmap[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
-                ret = NFS_ATTR_FATTR_FILEID;
+                ret = NFS_ATTR_FATTR_MOUNTED_ON_FILEID;
         }
         dprintk("%s: fileid=%Lu\n", __func__, (unsigned long long)*fileid);
         return ret;
@@ -4002,7 +4001,6 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
 {
         int status;
         umode_t fmode = 0;
-        uint64_t fileid;
         uint32_t type;
 
         status = decode_attr_type(xdr, bitmap, &type);
@@ -4101,13 +4099,10 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
                 goto xdr_error;
         fattr->valid |= status;
 
-        status = decode_attr_mounted_on_fileid(xdr, bitmap, &fileid);
+        status = decode_attr_mounted_on_fileid(xdr, bitmap, &fattr->mounted_on_fileid);
         if (status < 0)
                 goto xdr_error;
-        if (status != 0 && !(fattr->valid & status)) {
-                fattr->fileid = fileid;
-                fattr->valid |= status;
-        }
+        fattr->valid |= status;
 
 xdr_error:
         dprintk("%s: xdr returned %d\n", __func__, -status);
@@ -4838,17 +4833,21 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
         struct nfs4_secinfo_flavor *sec_flavor;
         int status;
         __be32 *p;
-        int i;
+        int i, num_flavors;
 
         status = decode_op_hdr(xdr, OP_SECINFO);
+        if (status)
+                goto out;
         p = xdr_inline_decode(xdr, 4);
         if (unlikely(!p))
                 goto out_overflow;
-        res->flavors->num_flavors = be32_to_cpup(p);
 
-        for (i = 0; i < res->flavors->num_flavors; i++) {
+        res->flavors->num_flavors = 0;
+        num_flavors = be32_to_cpup(p);
+
+        for (i = 0; i < num_flavors; i++) {
                 sec_flavor = &res->flavors->flavors[i];
-                if ((char *)&sec_flavor[1] - (char *)res > PAGE_SIZE)
+                if ((char *)&sec_flavor[1] - (char *)res->flavors > PAGE_SIZE)
                         break;
 
                 p = xdr_inline_decode(xdr, 4);
@@ -4857,13 +4856,15 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
                 sec_flavor->flavor = be32_to_cpup(p);
 
                 if (sec_flavor->flavor == RPC_AUTH_GSS) {
-                        if (decode_secinfo_gss(xdr, sec_flavor))
-                                break;
+                        status = decode_secinfo_gss(xdr, sec_flavor);
+                        if (status)
+                                goto out;
                 }
+                res->flavors->num_flavors++;
         }
 
-        return 0;
-
+out:
+        return status;
 out_overflow:
         print_overflow_msg(__func__, xdr);
         return -EIO;
@@ -6408,7 +6409,9 @@ int nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
         if (decode_getfattr_attrs(xdr, bitmap, entry->fattr, entry->fh,
                                         entry->server, 1) < 0)
                 goto out_overflow;
-        if (entry->fattr->valid & NFS_ATTR_FATTR_FILEID)
+        if (entry->fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID)
+                entry->ino = entry->fattr->mounted_on_fileid;
+        else if (entry->fattr->valid & NFS_ATTR_FATTR_FILEID)
                 entry->ino = entry->fattr->fileid;
 
         entry->d_type = DT_UNKNOWN;
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index d9ab97269ce6..ff681ab65d31 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1004,6 +1004,7 @@ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
 {
         struct nfs_inode *nfsi = NFS_I(wdata->inode);
         loff_t end_pos = wdata->args.offset + wdata->res.count;
+        bool mark_as_dirty = false;
 
         spin_lock(&nfsi->vfs_inode.i_lock);
         if (!test_and_set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) {
@@ -1011,13 +1012,18 @@ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
                 get_lseg(wdata->lseg);
                 wdata->lseg->pls_lc_cred =
                         get_rpccred(wdata->args.context->state->owner->so_cred);
-                mark_inode_dirty_sync(wdata->inode);
+                mark_as_dirty = true;
                 dprintk("%s: Set layoutcommit for inode %lu ",
                         __func__, wdata->inode->i_ino);
         }
         if (end_pos > wdata->lseg->pls_end_pos)
                 wdata->lseg->pls_end_pos = end_pos;
         spin_unlock(&nfsi->vfs_inode.i_lock);
+
+        /* if pnfs_layoutcommit_inode() runs between inode locks, the next one
+         * will be a noop because NFS_INO_LAYOUTCOMMIT will not be set */
+        if (mark_as_dirty)
+                mark_inode_dirty_sync(wdata->inode);
 }
 EXPORT_SYMBOL_GPL(pnfs_set_layoutcommit);
 
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2b8e9a5e366a..e288f06d3fa7 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1004,6 +1004,7 @@ static int nfs_parse_security_flavors(char *value,
                 return 0;
         }
 
+        mnt->flags |= NFS_MOUNT_SECFLAVOUR;
         mnt->auth_flavor_len = 1;
         return 1;
 }
@@ -1976,6 +1977,15 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
         if (error < 0)
                 goto out;
 
+        /*
+         * noac is a special case. It implies -o sync, but that's not
+         * necessarily reflected in the mtab options. do_remount_sb
+         * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the
+         * remount options, so we have to explicitly reset it.
+         */
+        if (data->flags & NFS_MOUNT_NOAC)
+                *flags |= MS_SYNCHRONOUS;
+
         /* compare new mount options with old ones */
         error = nfs_compare_remount_data(nfss, data);
 out:
@@ -2235,8 +2245,7 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
         if (!s->s_root) {
                 /* initial superblock/root creation */
                 nfs_fill_super(s, data);
-                nfs_fscache_get_super_cookie(
-                        s, data ? data->fscache_uniq : NULL, NULL);
+                nfs_fscache_get_super_cookie(s, data->fscache_uniq, NULL);
         }
 
         mntroot = nfs_get_root(s, mntfh, dev_name);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index af0c6279a4a7..3bd5d7e80f6c 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -542,11 +542,15 @@ nfs_scan_commit(struct inode *inode, struct list_head *dst, pgoff_t idx_start, u
         if (!nfs_need_commit(nfsi))
                 return 0;
 
+        spin_lock(&inode->i_lock);
         ret = nfs_scan_list(nfsi, dst, idx_start, npages, NFS_PAGE_TAG_COMMIT);
         if (ret > 0)
                 nfsi->ncommit -= ret;
+        spin_unlock(&inode->i_lock);
+
         if (nfs_need_commit(NFS_I(inode)))
                 __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+
         return ret;
 }
 #else
@@ -676,7 +680,6 @@ static int nfs_writepage_setup(struct nfs_open_context *ctx, struct page *page,
         req = nfs_setup_write_request(ctx, page, offset, count);
         if (IS_ERR(req))
                 return PTR_ERR(req);
-        nfs_mark_request_dirty(req);
         /* Update file length */
         nfs_grow_file(page, offset, count);
         nfs_mark_uptodate(page, req->wb_pgbase, req->wb_bytes);
@@ -1414,8 +1417,7 @@ static void nfs_commit_done(struct rpc_task *task, void *calldata)
                                 task->tk_pid, task->tk_status);
 
         /* Call the NFS version-specific code */
-        if (NFS_PROTO(data->inode)->commit_done(task, data) != 0)
-                return;
+        NFS_PROTO(data->inode)->commit_done(task, data);
 }
 
 void nfs_commit_release_pages(struct nfs_write_data *data)
@@ -1483,9 +1485,7 @@ int nfs_commit_inode(struct inode *inode, int how)
         res = nfs_commit_set_lock(NFS_I(inode), may_wait);
         if (res <= 0)
                 goto out_mark_dirty;
-        spin_lock(&inode->i_lock);
         res = nfs_scan_commit(inode, &head, 0, 0);
-        spin_unlock(&inode->i_lock);
         if (res) {
                 int error;
 
diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
index 0c6d81670137..7c831a2731fa 100644
--- a/fs/nfsd/lockd.c
+++ b/fs/nfsd/lockd.c
@@ -38,7 +38,6 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp)
         exp_readlock();
         nfserr = nfsd_open(rqstp, &fh, S_IFREG, NFSD_MAY_LOCK, filp);
         fh_put(&fh);
-        rqstp->rq_client = NULL;
         exp_readunlock();
         /* We return nlm error codes as nlm doesn't know
          * about nfsd, but nfsd does know about nlm..
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 4b36ec3eb8ea..4cf04e11c66c 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -258,6 +258,7 @@ static void nfs4_put_deleg_lease(struct nfs4_file *fp)
         if (atomic_dec_and_test(&fp->fi_delegees)) {
                 vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
                 fp->fi_lease = NULL;
+                fput(fp->fi_deleg_file);
                 fp->fi_deleg_file = NULL;
         }
 }
@@ -397,9 +398,12 @@ static void unhash_generic_stateid(struct nfs4_stateid *stp)
 
 static void free_generic_stateid(struct nfs4_stateid *stp)
 {
-        int oflag = nfs4_access_bmap_to_omode(stp);
+        int oflag;
 
-        nfs4_file_put_access(stp->st_file, oflag);
+        if (stp->st_access_bmap) {
+                oflag = nfs4_access_bmap_to_omode(stp);
+                nfs4_file_put_access(stp->st_file, oflag);
+        }
         put_nfs4_file(stp->st_file);
         kmem_cache_free(stateid_slab, stp);
 }
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 2e1cebde90df..129f3c9f62d5 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1363,7 +1363,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 goto out;
         if (!(iap->ia_valid & ATTR_MODE))
                 iap->ia_mode = 0;
-        err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
+        err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
         if (err)
                 goto out;
 
@@ -1385,6 +1385,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (IS_ERR(dchild))
                 goto out_nfserr;
 
+        /* If file doesn't exist, check for permissions to create one */
+        if (!dchild->d_inode) {
+                err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
+                if (err)
+                        goto out;
+        }
+
         err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
         if (err)
                 goto out;
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index b68f87a83924..938387a10d5d 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -1019,7 +1019,7 @@ struct ocfs2_xattr_entry {
         __le16  xe_name_offset;  /* byte offset from the 1st entry in the
                                     local xattr storage(inode, xattr block or
                                     xattr bucket). */
-        __u8    xe_name_len;     /* xattr name len, does't include prefix. */
+        __u8    xe_name_len;     /* xattr name len, doesn't include prefix. */
         __u8    xe_type;         /* the low 7 bits indicate the name prefix
                                   * type and the highest bit indicates whether
                                   * the EA is stored in the local storage. */
diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
index b10e3540d5b7..ce4f62440425 100644
--- a/fs/partitions/ldm.c
+++ b/fs/partitions/ldm.c
@@ -1299,6 +1299,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
 
         BUG_ON (!data || !frags);
 
+        if (size < 2 * VBLK_SIZE_HEAD) {
+                ldm_error("Value of size is to small.");
+                return false;
+        }
+
         group = get_unaligned_be32(data + 0x08);
         rec   = get_unaligned_be16(data + 0x0C);
         num   = get_unaligned_be16(data + 0x0E);
@@ -1306,6 +1311,10 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
                 ldm_error ("A VBLK claims to have %d parts.", num);
                 return false;
         }
+        if (rec >= num) {
+                ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
+                return false;
+        }
 
         list_for_each (item, frags) {
                 f = list_entry (item, struct frag, list);
@@ -1334,10 +1343,9 @@ found:
 
         f->map |= (1 << rec);
 
-        if (num > 0) {
-                data += VBLK_SIZE_HEAD;
-                size -= VBLK_SIZE_HEAD;
-        }
+        data += VBLK_SIZE_HEAD;
+        size -= VBLK_SIZE_HEAD;
+
         memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
 
         return true;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index dd6628d3ba42..dfa532730e55 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3124,11 +3124,16 @@ static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldi
 /* for the /proc/ directory itself, after non-process stuff has been done */
 int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
 {
-        unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
-        struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
+        unsigned int nr;
+        struct task_struct *reaper;
         struct tgid_iter iter;
         struct pid_namespace *ns;
 
+        if (filp->f_pos >= PID_MAX_LIMIT + TGID_OFFSET)
+                goto out_no_task;
+        nr = filp->f_pos - FIRST_PROCESS_ENTRY;
+
+        reaper = get_proc_task(filp->f_path.dentry->d_inode);
         if (!reaper)
                 goto out_no_task;
 
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index 9eead2c796b7..fbb0b478a346 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -112,6 +112,7 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
                 SetPageDirty(page);
 
                 unlock_page(page);
+                put_page(page);
         }
 
         return 0;
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 919f0de29d8f..e6493cac193d 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -23,6 +23,12 @@
 #ifndef __UBIFS_DEBUG_H__
 #define __UBIFS_DEBUG_H__
 
+/* Checking helper functions */
+typedef int (*dbg_leaf_callback)(struct ubifs_info *c,
+                                 struct ubifs_zbranch *zbr, void *priv);
+typedef int (*dbg_znode_callback)(struct ubifs_info *c,
+                                  struct ubifs_znode *znode, void *priv);
+
 #ifdef CONFIG_UBIFS_FS_DEBUG
 
 /**
@@ -270,11 +276,6 @@ void dbg_dump_tnc(struct ubifs_info *c);
 void dbg_dump_index(struct ubifs_info *c);
 void dbg_dump_lpt_lebs(const struct ubifs_info *c);
 
-/* Checking helper functions */
-typedef int (*dbg_leaf_callback)(struct ubifs_info *c,
-                                 struct ubifs_zbranch *zbr, void *priv);
-typedef int (*dbg_znode_callback)(struct ubifs_info *c,
-                                  struct ubifs_znode *znode, void *priv);
 int dbg_walk_index(struct ubifs_info *c, dbg_leaf_callback leaf_cb,
                    dbg_znode_callback znode_cb, void *priv);
 
@@ -295,7 +296,6 @@ int dbg_check_idx_size(struct ubifs_info *c, long long idx_size);
 int dbg_check_filesystem(struct ubifs_info *c);
 void dbg_check_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat,
                     int add_pos);
-int dbg_check_lprops(struct ubifs_info *c);
 int dbg_check_lpt_nodes(struct ubifs_info *c, struct ubifs_cnode *cnode,
                         int row, int col);
 int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
@@ -401,58 +401,94 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c);
 #define DBGKEY(key)  ((char *)(key))
 #define DBGKEY1(key) ((char *)(key))
 
-#define ubifs_debugging_init(c)                0
-#define ubifs_debugging_exit(c)                ({})
-
-#define dbg_ntype(type)                        ""
-#define dbg_cstate(cmt_state)                  ""
-#define dbg_jhead(jhead)                       ""
-#define dbg_get_key_dump(c, key)               ({})
-#define dbg_dump_inode(c, inode)               ({})
-#define dbg_dump_node(c, node)                 ({})
-#define dbg_dump_lpt_node(c, node, lnum, offs) ({})
-#define dbg_dump_budget_req(req)               ({})
-#define dbg_dump_lstats(lst)                   ({})
-#define dbg_dump_budg(c)                       ({})
-#define dbg_dump_lprop(c, lp)                  ({})
-#define dbg_dump_lprops(c)                     ({})
-#define dbg_dump_lpt_info(c)                   ({})
-#define dbg_dump_leb(c, lnum)                  ({})
-#define dbg_dump_znode(c, znode)               ({})
-#define dbg_dump_heap(c, heap, cat)            ({})
-#define dbg_dump_pnode(c, pnode, parent, iip)  ({})
-#define dbg_dump_tnc(c)                        ({})
-#define dbg_dump_index(c)                      ({})
-#define dbg_dump_lpt_lebs(c)                   ({})
-
-#define dbg_walk_index(c, leaf_cb, znode_cb, priv) 0
-#define dbg_old_index_check_init(c, zroot)         0
-#define dbg_save_space_info(c)                     ({})
-#define dbg_check_space_info(c)                    0
-#define dbg_check_old_index(c, zroot)              0
-#define dbg_check_cats(c)                          0
-#define dbg_check_ltab(c)                          0
-#define dbg_chk_lpt_free_spc(c)                    0
-#define dbg_chk_lpt_sz(c, action, len)             0
-#define dbg_check_synced_i_size(inode)             0
-#define dbg_check_dir_size(c, dir)                 0
-#define dbg_check_tnc(c, x)                        0
-#define dbg_check_idx_size(c, idx_size)            0
-#define dbg_check_filesystem(c)                    0
-#define dbg_check_heap(c, heap, cat, add_pos)      ({})
-#define dbg_check_lprops(c)                        0
-#define dbg_check_lpt_nodes(c, cnode, row, col)    0
-#define dbg_check_inode_size(c, inode, size)       0
-#define dbg_check_data_nodes_order(c, head)        0
-#define dbg_check_nondata_nodes_order(c, head)     0
-#define dbg_force_in_the_gaps_enabled              0
-#define dbg_force_in_the_gaps()                    0
-#define dbg_failure_mode                           0
-
-#define dbg_debugfs_init()                         0
-#define dbg_debugfs_exit()
-#define dbg_debugfs_init_fs(c)                     0
-#define dbg_debugfs_exit_fs(c)                     0
+static inline int ubifs_debugging_init(struct ubifs_info *c)      { return 0; }
+static inline void ubifs_debugging_exit(struct ubifs_info *c)     { return; }
+static inline const char *dbg_ntype(int type)                     { return ""; }
+static inline const char *dbg_cstate(int cmt_state)               { return ""; }
+static inline const char *dbg_jhead(int jhead)                    { return ""; }
+static inline const char *
+dbg_get_key_dump(const struct ubifs_info *c,
+                 const union ubifs_key *key)                      { return ""; }
+static inline void dbg_dump_inode(const struct ubifs_info *c,
+                                  const struct inode *inode)      { return; }
+static inline void dbg_dump_node(const struct ubifs_info *c,
+                                 const void *node)                { return; }
+static inline void dbg_dump_lpt_node(const struct ubifs_info *c,
+                                     void *node, int lnum,
+                                     int offs)                    { return; }
+static inline void
+dbg_dump_budget_req(const struct ubifs_budget_req *req)           { return; }
+static inline void
+dbg_dump_lstats(const struct ubifs_lp_stats *lst)                 { return; }
+static inline void dbg_dump_budg(struct ubifs_info *c)            { return; }
+static inline void dbg_dump_lprop(const struct ubifs_info *c,
+                                  const struct ubifs_lprops *lp)  { return; }
+static inline void dbg_dump_lprops(struct ubifs_info *c)          { return; }
+static inline void dbg_dump_lpt_info(struct ubifs_info *c)        { return; }
+static inline void dbg_dump_leb(const struct ubifs_info *c,
+                                int lnum)                         { return; }
+static inline void
+dbg_dump_znode(const struct ubifs_info *c,
+               const struct ubifs_znode *znode)                   { return; }
+static inline void dbg_dump_heap(struct ubifs_info *c,
+                                 struct ubifs_lpt_heap *heap,
+                                 int cat)                         { return; }
+static inline void dbg_dump_pnode(struct ubifs_info *c,
+                                  struct ubifs_pnode *pnode,
+                                  struct ubifs_nnode *parent,
+                                  int iip)                        { return; }
+static inline void dbg_dump_tnc(struct ubifs_info *c)             { return; }
+static inline void dbg_dump_index(struct ubifs_info *c)           { return; }
+static inline void dbg_dump_lpt_lebs(const struct ubifs_info *c)  { return; }
+
+static inline int dbg_walk_index(struct ubifs_info *c,
+                                 dbg_leaf_callback leaf_cb,
+                                 dbg_znode_callback znode_cb,
+                                 void *priv)                      { return 0; }
+static inline void dbg_save_space_info(struct ubifs_info *c)      { return; }
+static inline int dbg_check_space_info(struct ubifs_info *c)      { return 0; }
+static inline int dbg_check_lprops(struct ubifs_info *c)          { return 0; }
+static inline int
+dbg_old_index_check_init(struct ubifs_info *c,
+                         struct ubifs_zbranch *zroot)             { return 0; }
+static inline int
+dbg_check_old_index(struct ubifs_info *c,
+                    struct ubifs_zbranch *zroot)                  { return 0; }
+static inline int dbg_check_cats(struct ubifs_info *c)            { return 0; }
+static inline int dbg_check_ltab(struct ubifs_info *c)            { return 0; }
+static inline int dbg_chk_lpt_free_spc(struct ubifs_info *c)      { return 0; }
+static inline int dbg_chk_lpt_sz(struct ubifs_info *c,
+                                 int action, int len)             { return 0; }
+static inline int dbg_check_synced_i_size(struct inode *inode)    { return 0; }
+static inline int dbg_check_dir_size(struct ubifs_info *c,
+                                     const struct inode *dir)     { return 0; }
+static inline int dbg_check_tnc(struct ubifs_info *c, int extra)  { return 0; }
+static inline int dbg_check_idx_size(struct ubifs_info *c,
+                                     long long idx_size)          { return 0; }
+static inline int dbg_check_filesystem(struct ubifs_info *c)      { return 0; }
+static inline void dbg_check_heap(struct ubifs_info *c,
+                                  struct ubifs_lpt_heap *heap,
+                                  int cat, int add_pos)           { return; }
+static inline int dbg_check_lpt_nodes(struct ubifs_info *c,
+        struct ubifs_cnode *cnode, int row, int col)              { return 0; }
+static inline int dbg_check_inode_size(struct ubifs_info *c,
+                                       const struct inode *inode,
+                                       loff_t size)               { return 0; }
+static inline int
+dbg_check_data_nodes_order(struct ubifs_info *c,
+                           struct list_head *head)                { return 0; }
+static inline int
+dbg_check_nondata_nodes_order(struct ubifs_info *c,
+                              struct list_head *head)             { return 0; }
+
+static inline int dbg_force_in_the_gaps(void)                     { return 0; }
+#define dbg_force_in_the_gaps_enabled 0
+#define dbg_failure_mode              0
+
+static inline int dbg_debugfs_init(void)                          { return 0; }
+static inline void dbg_debugfs_exit(void)                         { return; }
+static inline int dbg_debugfs_init_fs(struct ubifs_info *c)       { return 0; }
+static inline int dbg_debugfs_exit_fs(struct ubifs_info *c)       { return 0; }
 
 #endif /* !CONFIG_UBIFS_FS_DEBUG */
 #endif /* !__UBIFS_DEBUG_H__ */
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 28be1e6a65e8..b286db79c686 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -1312,6 +1312,9 @@ int ubifs_fsync(struct file *file, int datasync)
 
         dbg_gen("syncing inode %lu", inode->i_ino);
 
+        if (inode->i_sb->s_flags & MS_RDONLY)
+                return 0;
+
         /*
          * VFS has already synchronized dirty pages for this inode. Synchronize
          * the inode unless this is a 'datasync()' call.
diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c
index 4d0cb1241460..40fa780ebea7 100644
--- a/fs/ubifs/log.c
+++ b/fs/ubifs/log.c
@@ -175,26 +175,6 @@ void ubifs_add_bud(struct ubifs_info *c, struct ubifs_bud *bud)
 }
 
 /**
- * ubifs_create_buds_lists - create journal head buds lists for remount rw.
- * @c: UBIFS file-system description object
- */
-void ubifs_create_buds_lists(struct ubifs_info *c)
-{
-        struct rb_node *p;
-
-        spin_lock(&c->buds_lock);
-        p = rb_first(&c->buds);
-        while (p) {
-                struct ubifs_bud *bud = rb_entry(p, struct ubifs_bud, rb);
-                struct ubifs_jhead *jhead = &c->jheads[bud->jhead];
-
-                list_add_tail(&bud->list, &jhead->buds_list);
-                p = rb_next(p);
-        }
-        spin_unlock(&c->buds_lock);
-}
-
-/**
  * ubifs_add_bud_to_log - add a new bud to the log.
  * @c: UBIFS file-system description object
  * @jhead: journal head the bud belongs to
diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
index 936f2cbfe6b6..3dbad6fbd1eb 100644
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -317,6 +317,32 @@ int ubifs_recover_master_node(struct ubifs_info *c)
                         goto out_free;
                 }
                 memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ);
+
+                /*
+                 * We had to recover the master node, which means there was an
+                 * unclean reboot. However, it is possible that the master node
+                 * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set.
+                 * E.g., consider the following chain of events:
+                 *
+                 * 1. UBIFS was cleanly unmounted, so the master node is clean
+                 * 2. UBIFS is being mounted R/W and starts changing the master
+                 *    node in the first (%UBIFS_MST_LNUM). A power cut happens,
+                 *    so this LEB ends up with some amount of garbage at the
+                 *    end.
+                 * 3. UBIFS is being mounted R/O. We reach this place and
+                 *    recover the master node from the second LEB
+                 *    (%UBIFS_MST_LNUM + 1). But we cannot update the media
+                 *    because we are being mounted R/O. We have to defer the
+                 *    operation.
+                 * 4. However, this master node (@c->mst_node) is marked as
+                 *    clean (since the step 1). And if we just return, the
+                 *    mount code will be confused and won't recover the master
+                 *    node when it is re-mounter R/W later.
+                 *
+                 *    Thus, to force the recovery by marking the master node as
+                 *    dirty.
+                 */
+                c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
         } else {
                 /* Write the recovered master node */
                 c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1;
diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
index eed0fcff8d73..d3d6d365bfc1 100644
--- a/fs/ubifs/replay.c
+++ b/fs/ubifs/replay.c
@@ -59,6 +59,7 @@ enum {
  * @new_size: truncation new size
  * @free: amount of free space in a bud
  * @dirty: amount of dirty space in a bud from padding and deletion nodes
+ * @jhead: journal head number of the bud
  *
  * UBIFS journal replay must compare node sequence numbers, which means it must
  * build a tree of node information to insert into the TNC.
@@ -80,6 +81,7 @@ struct replay_entry {
                 struct {
                         int free;
                         int dirty;
+                        int jhead;
                 };
         };
 };
@@ -159,6 +161,11 @@ static int set_bud_lprops(struct ubifs_info *c, struct replay_entry *r)
                 err = PTR_ERR(lp);
                 goto out;
         }
+
+        /* Make sure the journal head points to the latest bud */
+        err = ubifs_wbuf_seek_nolock(&c->jheads[r->jhead].wbuf, r->lnum,
+                                     c->leb_size - r->free, UBI_SHORTTERM);
+
 out:
         ubifs_release_lprops(c);
         return err;
@@ -627,10 +634,6 @@ static int replay_bud(struct ubifs_info *c, int lnum, int offs, int jhead,
         ubifs_assert(sleb->endpt - offs >= used);
         ubifs_assert(sleb->endpt % c->min_io_size == 0);
 
-        if (sleb->endpt + c->min_io_size <= c->leb_size && !c->ro_mount)
-                err = ubifs_wbuf_seek_nolock(&c->jheads[jhead].wbuf, lnum,
-                                             sleb->endpt, UBI_SHORTTERM);
-
         *dirty = sleb->endpt - offs - used;
         *free = c->leb_size - sleb->endpt;
 
@@ -653,12 +656,14 @@ out_dump:
  * @sqnum: sequence number
  * @free: amount of free space in bud
  * @dirty: amount of dirty space from padding and deletion nodes
+ * @jhead: journal head number for the bud
  *
  * This function inserts a reference node to the replay tree and returns zero
  * in case of success or a negative error code in case of failure.
  */
 static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
-                           unsigned long long sqnum, int free, int dirty)
+                           unsigned long long sqnum, int free, int dirty,
+                           int jhead)
 {
         struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
         struct replay_entry *r;
@@ -688,6 +693,7 @@ static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
         r->flags = REPLAY_REF;
         r->free = free;
         r->dirty = dirty;
+        r->jhead = jhead;
 
         rb_link_node(&r->rb, parent, p);
         rb_insert_color(&r->rb, &c->replay_tree);
@@ -712,7 +718,7 @@ static int replay_buds(struct ubifs_info *c)
                 if (err)
                         return err;
                 err = insert_ref_node(c, b->bud->lnum, b->bud->start, b->sqnum,
-                                      free, dirty);
+                                      free, dirty, b->bud->jhead);
                 if (err)
                         return err;
         }
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index c75f6133206c..04ad07f4fcc3 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1257,12 +1257,12 @@ static int mount_ubifs(struct ubifs_info *c)
                 goto out_free;
         }
 
+        err = alloc_wbufs(c);
+        if (err)
+                goto out_cbuf;
+
         sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num, c->vi.vol_id);
         if (!c->ro_mount) {
-                err = alloc_wbufs(c);
-                if (err)
-                        goto out_cbuf;
-
                 /* Create background thread */
                 c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
                 if (IS_ERR(c->bgt)) {
@@ -1631,12 +1631,6 @@ static int ubifs_remount_rw(struct ubifs_info *c)
         if (err)
                 goto out;
 
-        err = alloc_wbufs(c);
-        if (err)
-                goto out;
-
-        ubifs_create_buds_lists(c);
-
         /* Create background thread */
         c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
         if (IS_ERR(c->bgt)) {
@@ -1671,14 +1665,25 @@ static int ubifs_remount_rw(struct ubifs_info *c)
         if (err)
                 goto out;
 
+        dbg_gen("re-mounted read-write");
+        c->remounting_rw = 0;
+
         if (c->need_recovery) {
                 c->need_recovery = 0;
                 ubifs_msg("deferred recovery completed");
+        } else {
+                /*
+                 * Do not run the debugging space check if the were doing
+                 * recovery, because when we saved the information we had the
+                 * file-system in a state where the TNC and lprops has been
+                 * modified in memory, but all the I/O operations (including a
+                 * commit) were deferred. So the file-system was in
+                 * "non-committed" state. Now the file-system is in committed
+                 * state, and of course the amount of free space will change
+                 * because, for example, the old index size was imprecise.
+                 */
+                err = dbg_check_space_info(c);
         }
-
-        dbg_gen("re-mounted read-write");
-        c->remounting_rw = 0;
-        err = dbg_check_space_info(c);
         mutex_unlock(&c->umount_mutex);
         return err;
 
@@ -1733,7 +1738,6 @@ static void ubifs_remount_ro(struct ubifs_info *c)
         if (err)
                 ubifs_ro_mode(c, err);
 
-        free_wbufs(c);
         vfree(c->orph_buf);
         c->orph_buf = NULL;
         kfree(c->write_reserve_buf);
@@ -1761,10 +1765,12 @@ static void ubifs_put_super(struct super_block *sb)
          * of the media. For example, there will be dirty inodes if we failed
          * to write them back because of I/O errors.
          */
-        ubifs_assert(atomic_long_read(&c->dirty_pg_cnt) == 0);
-        ubifs_assert(c->budg_idx_growth == 0);
-        ubifs_assert(c->budg_dd_growth == 0);
-        ubifs_assert(c->budg_data_growth == 0);
+        if (!c->ro_error) {
+                ubifs_assert(atomic_long_read(&c->dirty_pg_cnt) == 0);
+                ubifs_assert(c->budg_idx_growth == 0);
+                ubifs_assert(c->budg_dd_growth == 0);
+                ubifs_assert(c->budg_data_growth == 0);
+        }
 
         /*
          * The 'c->umount_lock' prevents races between UBIFS memory shrinker
diff --git a/fs/xattr.c b/fs/xattr.c
index a19acdb81cd1..f1ef94974dea 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -666,7 +666,7 @@ generic_setxattr(struct dentry *dentry, const char *name, const void *value, siz
         handler = xattr_resolve_name(dentry->d_sb->s_xattr, &name);
         if (!handler)
                 return -EOPNOTSUPP;
-        return handler->set(dentry, name, value, size, 0, handler->flags);
+        return handler->set(dentry, name, value, size, flags, handler->flags);
 }
 
 /*
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 5ea402023ebd..9ef9ed2cfe2e 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -293,7 +293,6 @@ xfs_buf_allocate_memory(
         size_t                  nbytes, offset;
         gfp_t                   gfp_mask = xb_to_gfp(flags);
         unsigned short          page_count, i;
-        pgoff_t                 first;
         xfs_off_t               end;
         int                     error;
 
@@ -333,7 +332,6 @@ use_alloc_page:
                 return error;
 
         offset = bp->b_offset;
-        first = bp->b_file_offset >> PAGE_SHIFT;
         bp->b_flags |= _XBF_PAGES;
 
         for (i = 0; i < bp->b_page_count; i++) {
@@ -657,8 +655,6 @@ xfs_buf_readahead(
         xfs_off_t               ioff,
         size_t                  isize)
 {
-        struct backing_dev_info *bdi;
-
         if (bdi_read_congested(target->bt_bdi))
                 return;
 
@@ -919,8 +915,6 @@ xfs_buf_lock(
 
         if (atomic_read(&bp->b_pin_count) && (bp->b_flags & XBF_STALE))
                 xfs_log_force(bp->b_target->bt_mount, 0);
-        if (atomic_read(&bp->b_io_remaining))
-                blk_flush_plug(current);
         down(&bp->b_sema);
         XB_SET_OWNER(bp);
 
@@ -1309,8 +1303,6 @@ xfs_buf_iowait(
 {
         trace_xfs_buf_iowait(bp, _RET_IP_);
 
-        if (atomic_read(&bp->b_io_remaining))
-                blk_flush_plug(current);
         wait_for_completion(&bp->b_iowait);
 
         trace_xfs_buf_iowait_done(bp, _RET_IP_);
@@ -1747,8 +1739,8 @@ xfsbufd(
         do {
                 long    age = xfs_buf_age_centisecs * msecs_to_jiffies(10);
                 long    tout = xfs_buf_timer_centisecs * msecs_to_jiffies(10);
-                int     count = 0;
                 struct list_head tmp;
+                struct blk_plug plug;
 
                 if (unlikely(freezing(current))) {
                         set_bit(XBT_FORCE_SLEEP, &target->bt_flags);
@@ -1764,16 +1756,15 @@ xfsbufd(
 
                 xfs_buf_delwri_split(target, &tmp, age);
                 list_sort(NULL, &tmp, xfs_buf_cmp);
+
+                blk_start_plug(&plug);
                 while (!list_empty(&tmp)) {
                         struct xfs_buf *bp;
                         bp = list_first_entry(&tmp, struct xfs_buf, b_list);
                         list_del_init(&bp->b_list);
                         xfs_bdstrat_cb(bp);
-                        count++;
                 }
-                if (count)
-                        blk_flush_plug(current);
-
+                blk_finish_plug(&plug);
         } while (!kthread_should_stop());
 
         return 0;
@@ -1793,6 +1784,7 @@ xfs_flush_buftarg(
         int             pincount = 0;
         LIST_HEAD(tmp_list);
         LIST_HEAD(wait_list);
+        struct blk_plug plug;
 
         xfs_buf_runall_queues(xfsconvertd_workqueue);
         xfs_buf_runall_queues(xfsdatad_workqueue);
@@ -1807,6 +1799,8 @@ xfs_flush_buftarg(
          * we do that after issuing all the IO.
          */
         list_sort(NULL, &tmp_list, xfs_buf_cmp);
+
+        blk_start_plug(&plug);
         while (!list_empty(&tmp_list)) {
                 bp = list_first_entry(&tmp_list, struct xfs_buf, b_list);
                 ASSERT(target == bp->b_target);
@@ -1817,10 +1811,10 @@ xfs_flush_buftarg(
                 }
                 xfs_bdstrat_cb(bp);
         }
+        blk_finish_plug(&plug);
 
         if (wait) {
-                /* Expedite and wait for IO to complete. */
-                blk_flush_plug(current);
+                /* Wait for IO to complete. */
                 while (!list_empty(&wait_list)) {
                         bp = list_first_entry(&wait_list, struct xfs_buf, b_list);
 
diff --git a/fs/xfs/linux-2.6/xfs_message.c b/fs/xfs/linux-2.6/xfs_message.c
index 508e06fd7d1e..9f76cceb678d 100644
--- a/fs/xfs/linux-2.6/xfs_message.c
+++ b/fs/xfs/linux-2.6/xfs_message.c
@@ -28,53 +28,49 @@
 /*
  * XFS logging functions
  */
-static int
+static void
 __xfs_printk(
         const char              *level,
         const struct xfs_mount  *mp,
         struct va_format        *vaf)
 {
-        if (mp && mp->m_fsname)
-                return printk("%sXFS (%s): %pV\n", level, mp->m_fsname, vaf);
-        return printk("%sXFS: %pV\n", level, vaf);
+        if (mp && mp->m_fsname) {
+                printk("%sXFS (%s): %pV\n", level, mp->m_fsname, vaf);
+                return;
+        }
+        printk("%sXFS: %pV\n", level, vaf);
 }
 
-int xfs_printk(
+void xfs_printk(
         const char              *level,
         const struct xfs_mount  *mp,
         const char              *fmt, ...)
 {
         struct va_format        vaf;
         va_list                 args;
-        int                      r;
 
         va_start(args, fmt);
 
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        r = __xfs_printk(level, mp, &vaf);
+        __xfs_printk(level, mp, &vaf);
         va_end(args);
-
-        return r;
 }
 
 #define define_xfs_printk_level(func, kern_level)               \
-int func(const struct xfs_mount *mp, const char *fmt, ...)      \
+void func(const struct xfs_mount *mp, const char *fmt, ...)     \
 {                                                               \
         struct va_format        vaf;                            \
         va_list                 args;                           \
-        int                     r;                              \
                                                                 \
         va_start(args, fmt);                                    \
                                                                 \
         vaf.fmt = fmt;                                          \
         vaf.va = &args;                                         \
                                                                 \
-        r = __xfs_printk(kern_level, mp, &vaf);                 \
+        __xfs_printk(kern_level, mp, &vaf);                     \
         va_end(args);                                           \
-                                                                \
-        return r;                                               \
 }                                                               \
 
 define_xfs_printk_level(xfs_emerg, KERN_EMERG);
@@ -88,7 +84,7 @@ define_xfs_printk_level(xfs_info, KERN_INFO);
 define_xfs_printk_level(xfs_debug, KERN_DEBUG);
 #endif
 
-int
+void
 xfs_alert_tag(
         const struct xfs_mount  *mp,
         int                     panic_tag,
@@ -97,7 +93,6 @@ xfs_alert_tag(
         struct va_format        vaf;
         va_list                 args;
         int                     do_panic = 0;
-        int                     r;
 
         if (xfs_panic_mask && (xfs_panic_mask & panic_tag)) {
                 xfs_printk(KERN_ALERT, mp,
@@ -110,12 +105,10 @@ xfs_alert_tag(
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        r = __xfs_printk(KERN_ALERT, mp, &vaf);
+        __xfs_printk(KERN_ALERT, mp, &vaf);
         va_end(args);
 
         BUG_ON(do_panic);
-
-        return r;
 }
 
 void
diff --git a/fs/xfs/linux-2.6/xfs_message.h b/fs/xfs/linux-2.6/xfs_message.h
index e77ffa16745b..f1b3fc1b6c4e 100644
--- a/fs/xfs/linux-2.6/xfs_message.h
+++ b/fs/xfs/linux-2.6/xfs_message.h
@@ -3,32 +3,34 @@
 
 struct xfs_mount;
 
-extern int xfs_printk(const char *level, const struct xfs_mount *mp,
+extern void xfs_printk(const char *level, const struct xfs_mount *mp,
                       const char *fmt, ...)
         __attribute__ ((format (printf, 3, 4)));
-extern int xfs_emerg(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_emerg(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_alert(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_alert(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_alert_tag(const struct xfs_mount *mp, int tag,
+extern void xfs_alert_tag(const struct xfs_mount *mp, int tag,
                          const char *fmt, ...)
         __attribute__ ((format (printf, 3, 4)));
-extern int xfs_crit(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_crit(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_err(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_err(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_warn(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_warn(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_notice(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_notice(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
-extern int xfs_info(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_info(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
 
 #ifdef DEBUG
-extern int xfs_debug(const struct xfs_mount *mp, const char *fmt, ...)
+extern void xfs_debug(const struct xfs_mount *mp, const char *fmt, ...)
         __attribute__ ((format (printf, 2, 3)));
 #else
-#define xfs_debug(mp, fmt, ...) (0)
+static inline void xfs_debug(const struct xfs_mount *mp, const char *fmt, ...)
+{
+}
 #endif
 
 extern void assfail(char *expr, char *f, int l);
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 1ba5c451da36..b38e58d02299 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -816,75 +816,6 @@ xfs_setup_devices(
         return 0;
 }
 
-/*
- * XFS AIL push thread support
- */
-void
-xfsaild_wakeup(
-        struct xfs_ail          *ailp,
-        xfs_lsn_t               threshold_lsn)
-{
-        /* only ever move the target forwards */
-        if (XFS_LSN_CMP(threshold_lsn, ailp->xa_target) > 0) {
-                ailp->xa_target = threshold_lsn;
-                wake_up_process(ailp->xa_task);
-        }
-}
-
-STATIC int
-xfsaild(
-        void    *data)
-{
-        struct xfs_ail  *ailp = data;
-        xfs_lsn_t       last_pushed_lsn = 0;
-        long            tout = 0; /* milliseconds */
-
-        while (!kthread_should_stop()) {
-                /*
-                 * for short sleeps indicating congestion, don't allow us to
-                 * get woken early. Otherwise all we do is bang on the AIL lock
-                 * without making progress.
-                 */
-                if (tout && tout <= 20)
-                        __set_current_state(TASK_KILLABLE);
-                else
-                        __set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(tout ?
-                                 msecs_to_jiffies(tout) : MAX_SCHEDULE_TIMEOUT);
-
-                /* swsusp */
-                try_to_freeze();
-
-                ASSERT(ailp->xa_mount->m_log);
-                if (XFS_FORCED_SHUTDOWN(ailp->xa_mount))
-                        continue;
-
-                tout = xfsaild_push(ailp, &last_pushed_lsn);
-        }
-
-        return 0;
-}       /* xfsaild */
-
-int
-xfsaild_start(
-        struct xfs_ail  *ailp)
-{
-        ailp->xa_target = 0;
-        ailp->xa_task = kthread_run(xfsaild, ailp, "xfsaild/%s",
-                                    ailp->xa_mount->m_fsname);
-        if (IS_ERR(ailp->xa_task))
-                return -PTR_ERR(ailp->xa_task);
-        return 0;
-}
-
-void
-xfsaild_stop(
-        struct xfs_ail  *ailp)
-{
-        kthread_stop(ailp->xa_task);
-}
-
-
 /* Catch misguided souls that try to use this interface on XFS */
 STATIC struct inode *
 xfs_fs_alloc_inode(
@@ -1191,22 +1122,12 @@ xfs_fs_sync_fs(
                 return -error;
 
         if (laptop_mode) {
-                int     prev_sync_seq = mp->m_sync_seq;
-
                 /*
                  * The disk must be active because we're syncing.
                  * We schedule xfssyncd now (now that the disk is
                  * active) instead of later (when it might not be).
                  */
-                wake_up_process(mp->m_sync_task);
-                /*
-                 * We have to wait for the sync iteration to complete.
-                 * If we don't, the disk activity caused by the sync
-                 * will come after the sync is completed, and that
-                 * triggers another sync from laptop mode.
-                 */
-                wait_event(mp->m_wait_single_sync_task,
-                                mp->m_sync_seq != prev_sync_seq);
+                flush_delayed_work_sync(&mp->m_sync_work);
         }
 
         return 0;
@@ -1490,9 +1411,6 @@ xfs_fs_fill_super(
         spin_lock_init(&mp->m_sb_lock);
         mutex_init(&mp->m_growlock);
         atomic_set(&mp->m_active_trans, 0);
-        INIT_LIST_HEAD(&mp->m_sync_list);
-        spin_lock_init(&mp->m_sync_lock);
-        init_waitqueue_head(&mp->m_wait_single_sync_task);
 
         mp->m_super = sb;
         sb->s_fs_info = mp;
@@ -1799,6 +1717,38 @@ xfs_destroy_zones(void)
 }
 
 STATIC int __init
+xfs_init_workqueues(void)
+{
+        /*
+         * max_active is set to 8 to give enough concurency to allow
+         * multiple work operations on each CPU to run. This allows multiple
+         * filesystems to be running sync work concurrently, and scales with
+         * the number of CPUs in the system.
+         */
+        xfs_syncd_wq = alloc_workqueue("xfssyncd", WQ_CPU_INTENSIVE, 8);
+        if (!xfs_syncd_wq)
+                goto out;
+
+        xfs_ail_wq = alloc_workqueue("xfsail", WQ_CPU_INTENSIVE, 8);
+        if (!xfs_ail_wq)
+                goto out_destroy_syncd;
+
+        return 0;
+
+out_destroy_syncd:
+        destroy_workqueue(xfs_syncd_wq);
+out:
+        return -ENOMEM;
+}
+
+STATIC void
+xfs_destroy_workqueues(void)
+{
+        destroy_workqueue(xfs_ail_wq);
+        destroy_workqueue(xfs_syncd_wq);
+}
+
+STATIC int __init
 init_xfs_fs(void)
 {
         int                     error;
@@ -1813,10 +1763,14 @@ init_xfs_fs(void)
         if (error)
                 goto out;
 
-        error = xfs_mru_cache_init();
+        error = xfs_init_workqueues();
         if (error)
                 goto out_destroy_zones;
 
+        error = xfs_mru_cache_init();
+        if (error)
+                goto out_destroy_wq;
+
         error = xfs_filestream_init();
         if (error)
                 goto out_mru_cache_uninit;
@@ -1833,6 +1787,10 @@ init_xfs_fs(void)
         if (error)
                 goto out_cleanup_procfs;
 
+        error = xfs_init_workqueues();
+        if (error)
+                goto out_sysctl_unregister;
+
         vfs_initquota();
 
         error = register_filesystem(&xfs_fs_type);
@@ -1850,6 +1808,8 @@ init_xfs_fs(void)
         xfs_filestream_uninit();
  out_mru_cache_uninit:
         xfs_mru_cache_uninit();
+ out_destroy_wq:
+        xfs_destroy_workqueues();
  out_destroy_zones:
         xfs_destroy_zones();
  out:
@@ -1866,6 +1826,7 @@ exit_xfs_fs(void)
         xfs_buf_terminate();
         xfs_filestream_uninit();
         xfs_mru_cache_uninit();
+        xfs_destroy_workqueues();
         xfs_destroy_zones();
 }
 
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 9cf35a688f53..e4f9c1b0836c 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -22,6 +22,7 @@
 #include "xfs_log.h"
 #include "xfs_inum.h"
 #include "xfs_trans.h"
+#include "xfs_trans_priv.h"
 #include "xfs_sb.h"
 #include "xfs_ag.h"
 #include "xfs_mount.h"
@@ -39,6 +40,8 @@
 #include <linux/kthread.h>
 #include <linux/freezer.h>
 
+struct workqueue_struct *xfs_syncd_wq;  /* sync workqueue */
+
 /*
  * The inode lookup is done in batches to keep the amount of lock traffic and
  * radix tree lookups to a minimum. The batch size is a trade off between
@@ -431,62 +434,12 @@ xfs_quiesce_attr(
         xfs_unmountfs_writesb(mp);
 }
 
-/*
- * Enqueue a work item to be picked up by the vfs xfssyncd thread.
- * Doing this has two advantages:
- * - It saves on stack space, which is tight in certain situations
- * - It can be used (with care) as a mechanism to avoid deadlocks.
- * Flushing while allocating in a full filesystem requires both.
- */
-STATIC void
-xfs_syncd_queue_work(
-        struct xfs_mount *mp,
-        void            *data,
-        void            (*syncer)(struct xfs_mount *, void *),
-        struct completion *completion)
-{
-        struct xfs_sync_work *work;
-
-        work = kmem_alloc(sizeof(struct xfs_sync_work), KM_SLEEP);
-        INIT_LIST_HEAD(&work->w_list);
-        work->w_syncer = syncer;
-        work->w_data = data;
-        work->w_mount = mp;
-        work->w_completion = completion;
-        spin_lock(&mp->m_sync_lock);
-        list_add_tail(&work->w_list, &mp->m_sync_list);
-        spin_unlock(&mp->m_sync_lock);
-        wake_up_process(mp->m_sync_task);
-}
-
-/*
- * Flush delayed allocate data, attempting to free up reserved space
- * from existing allocations.  At this point a new allocation attempt
- * has failed with ENOSPC and we are in the process of scratching our
- * heads, looking about for more room...
- */
-STATIC void
-xfs_flush_inodes_work(
-        struct xfs_mount *mp,
-        void            *arg)
-{
-        struct inode    *inode = arg;
-        xfs_sync_data(mp, SYNC_TRYLOCK);
-        xfs_sync_data(mp, SYNC_TRYLOCK | SYNC_WAIT);
-        iput(inode);
-}
-
-void
-xfs_flush_inodes(
-        xfs_inode_t     *ip)
+static void
+xfs_syncd_queue_sync(
+        struct xfs_mount        *mp)
 {
-        struct inode    *inode = VFS_I(ip);
-        DECLARE_COMPLETION_ONSTACK(completion);
-
-        igrab(inode);
-        xfs_syncd_queue_work(ip->i_mount, inode, xfs_flush_inodes_work, &completion);
-        wait_for_completion(&completion);
-        xfs_log_force(ip->i_mount, XFS_LOG_SYNC);
+        queue_delayed_work(xfs_syncd_wq, &mp->m_sync_work,
+                                msecs_to_jiffies(xfs_syncd_centisecs * 10));
 }
 
 /*
@@ -496,9 +449,10 @@ xfs_flush_inodes(
  */
 STATIC void
 xfs_sync_worker(
-        struct xfs_mount *mp,
-        void            *unused)
+        struct work_struct *work)
 {
+        struct xfs_mount *mp = container_of(to_delayed_work(work),
+                                        struct xfs_mount, m_sync_work);
         int             error;
 
         if (!(mp->m_flags & XFS_MOUNT_RDONLY)) {
@@ -508,73 +462,106 @@ xfs_sync_worker(
                         error = xfs_fs_log_dummy(mp);
                 else
                         xfs_log_force(mp, 0);
-                xfs_reclaim_inodes(mp, 0);
                 error = xfs_qm_sync(mp, SYNC_TRYLOCK);
+
+                /* start pushing all the metadata that is currently dirty */
+                xfs_ail_push_all(mp->m_ail);
         }
-        mp->m_sync_seq++;
-        wake_up(&mp->m_wait_single_sync_task);
+
+        /* queue us up again */
+        xfs_syncd_queue_sync(mp);
 }
 
-STATIC int
-xfssyncd(
-        void                    *arg)
+/*
+ * Queue a new inode reclaim pass if there are reclaimable inodes and there
+ * isn't a reclaim pass already in progress. By default it runs every 5s based
+ * on the xfs syncd work default of 30s. Perhaps this should have it's own
+ * tunable, but that can be done if this method proves to be ineffective or too
+ * aggressive.
+ */
+static void
+xfs_syncd_queue_reclaim(
+        struct xfs_mount        *mp)
 {
-        struct xfs_mount        *mp = arg;
-        long                    timeleft;
-        xfs_sync_work_t         *work, *n;
-        LIST_HEAD               (tmp);
-
-        set_freezable();
-        timeleft = xfs_syncd_centisecs * msecs_to_jiffies(10);
-        for (;;) {
-                if (list_empty(&mp->m_sync_list))
-                        timeleft = schedule_timeout_interruptible(timeleft);
-                /* swsusp */
-                try_to_freeze();
-                if (kthread_should_stop() && list_empty(&mp->m_sync_list))
-                        break;
 
-                spin_lock(&mp->m_sync_lock);
-                /*
-                 * We can get woken by laptop mode, to do a sync -
-                 * that's the (only!) case where the list would be
-                 * empty with time remaining.
-                 */
-                if (!timeleft || list_empty(&mp->m_sync_list)) {
-                        if (!timeleft)
-                                timeleft = xfs_syncd_centisecs *
-                                                        msecs_to_jiffies(10);
-                        INIT_LIST_HEAD(&mp->m_sync_work.w_list);
-                        list_add_tail(&mp->m_sync_work.w_list,
-                                        &mp->m_sync_list);
-                }
-                list_splice_init(&mp->m_sync_list, &tmp);
-                spin_unlock(&mp->m_sync_lock);
+        /*
+         * We can have inodes enter reclaim after we've shut down the syncd
+         * workqueue during unmount, so don't allow reclaim work to be queued
+         * during unmount.
+         */
+        if (!(mp->m_super->s_flags & MS_ACTIVE))
+                return;
 
-                list_for_each_entry_safe(work, n, &tmp, w_list) {
-                        (*work->w_syncer)(mp, work->w_data);
-                        list_del(&work->w_list);
-                        if (work == &mp->m_sync_work)
-                                continue;
-                        if (work->w_completion)
-                                complete(work->w_completion);
-                        kmem_free(work);
-                }
+        rcu_read_lock();
+        if (radix_tree_tagged(&mp->m_perag_tree, XFS_ICI_RECLAIM_TAG)) {
+                queue_delayed_work(xfs_syncd_wq, &mp->m_reclaim_work,
+                        msecs_to_jiffies(xfs_syncd_centisecs / 6 * 10));
         }
+        rcu_read_unlock();
+}
 
-        return 0;
+/*
+ * This is a fast pass over the inode cache to try to get reclaim moving on as
+ * many inodes as possible in a short period of time. It kicks itself every few
+ * seconds, as well as being kicked by the inode cache shrinker when memory
+ * goes low. It scans as quickly as possible avoiding locked inodes or those
+ * already being flushed, and once done schedules a future pass.
+ */
+STATIC void
+xfs_reclaim_worker(
+        struct work_struct *work)
+{
+        struct xfs_mount *mp = container_of(to_delayed_work(work),
+                                        struct xfs_mount, m_reclaim_work);
+
+        xfs_reclaim_inodes(mp, SYNC_TRYLOCK);
+        xfs_syncd_queue_reclaim(mp);
+}
+
+/*
+ * Flush delayed allocate data, attempting to free up reserved space
+ * from existing allocations.  At this point a new allocation attempt
+ * has failed with ENOSPC and we are in the process of scratching our
+ * heads, looking about for more room.
+ *
+ * Queue a new data flush if there isn't one already in progress and
+ * wait for completion of the flush. This means that we only ever have one
+ * inode flush in progress no matter how many ENOSPC events are occurring and
+ * so will prevent the system from bogging down due to every concurrent
+ * ENOSPC event scanning all the active inodes in the system for writeback.
+ */
+void
+xfs_flush_inodes(
+        struct xfs_inode        *ip)
+{
+        struct xfs_mount        *mp = ip->i_mount;
+
+        queue_work(xfs_syncd_wq, &mp->m_flush_work);
+        flush_work_sync(&mp->m_flush_work);
+}
+
+STATIC void
+xfs_flush_worker(
+        struct work_struct *work)
+{
+        struct xfs_mount *mp = container_of(work,
+                                        struct xfs_mount, m_flush_work);
+
+        xfs_sync_data(mp, SYNC_TRYLOCK);
+        xfs_sync_data(mp, SYNC_TRYLOCK | SYNC_WAIT);
 }
 
 int
 xfs_syncd_init(
         struct xfs_mount        *mp)
 {
-        mp->m_sync_work.w_syncer = xfs_sync_worker;
-        mp->m_sync_work.w_mount = mp;
-        mp->m_sync_work.w_completion = NULL;
-        mp->m_sync_task = kthread_run(xfssyncd, mp, "xfssyncd/%s", mp->m_fsname);
-        if (IS_ERR(mp->m_sync_task))
-                return -PTR_ERR(mp->m_sync_task);
+        INIT_WORK(&mp->m_flush_work, xfs_flush_worker);
+        INIT_DELAYED_WORK(&mp->m_sync_work, xfs_sync_worker);
+        INIT_DELAYED_WORK(&mp->m_reclaim_work, xfs_reclaim_worker);
+
+        xfs_syncd_queue_sync(mp);
+        xfs_syncd_queue_reclaim(mp);
+
         return 0;
 }
 
@@ -582,7 +569,9 @@ void
 xfs_syncd_stop(
         struct xfs_mount        *mp)
 {
-        kthread_stop(mp->m_sync_task);
+        cancel_delayed_work_sync(&mp->m_sync_work);
+        cancel_delayed_work_sync(&mp->m_reclaim_work);
+        cancel_work_sync(&mp->m_flush_work);
 }
 
 void
@@ -601,6 +590,10 @@ __xfs_inode_set_reclaim_tag(
                                 XFS_INO_TO_AGNO(ip->i_mount, ip->i_ino),
                                 XFS_ICI_RECLAIM_TAG);
                 spin_unlock(&ip->i_mount->m_perag_lock);
+
+                /* schedule periodic background inode reclaim */
+                xfs_syncd_queue_reclaim(ip->i_mount);
+
                 trace_xfs_perag_set_reclaim(ip->i_mount, pag->pag_agno,
                                                         -1, _RET_IP_);
         }
@@ -1017,7 +1010,13 @@ xfs_reclaim_inodes(
 }
 
 /*
- * Shrinker infrastructure.
+ * Inode cache shrinker.
+ *
+ * When called we make sure that there is a background (fast) inode reclaim in
+ * progress, while we will throttle the speed of reclaim via doiing synchronous
+ * reclaim of inodes. That means if we come across dirty inodes, we wait for
+ * them to be cleaned, which we hope will not be very long due to the
+ * background walker having already kicked the IO off on those dirty inodes.
  */
 static int
 xfs_reclaim_inode_shrink(
@@ -1032,10 +1031,15 @@ xfs_reclaim_inode_shrink(
 
         mp = container_of(shrink, struct xfs_mount, m_inode_shrink);
         if (nr_to_scan) {
+                /* kick background reclaimer and push the AIL */
+                xfs_syncd_queue_reclaim(mp);
+                xfs_ail_push_all(mp->m_ail);
+
                 if (!(gfp_mask & __GFP_FS))
                         return -1;
 
-                xfs_reclaim_inodes_ag(mp, SYNC_TRYLOCK, &nr_to_scan);
+                xfs_reclaim_inodes_ag(mp, SYNC_TRYLOCK | SYNC_WAIT,
+                                        &nr_to_scan);
                 /* terminate if we don't exhaust the scan */
                 if (nr_to_scan > 0)
                         return -1;
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
index 32ba6628290c..e3a6ad27415f 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/linux-2.6/xfs_sync.h
@@ -32,6 +32,8 @@ typedef struct xfs_sync_work {
 #define SYNC_WAIT               0x0001  /* wait for i/o to complete */
 #define SYNC_TRYLOCK            0x0002  /* only try to lock inodes */
 
+extern struct workqueue_struct  *xfs_syncd_wq;  /* sync workqueue */
+
 int xfs_syncd_init(struct xfs_mount *mp);
 void xfs_syncd_stop(struct xfs_mount *mp);
 
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 254ee062bd7d..69228aa8605a 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -461,12 +461,10 @@ xfs_qm_dqflush_all(
         struct xfs_quotainfo    *q = mp->m_quotainfo;
         int                     recl;
         struct xfs_dquot        *dqp;
-        int                     niters;
         int                     error;
 
         if (!q)
                 return 0;
-        niters = 0;
 again:
         mutex_lock(&q->qi_dqlist_lock);
         list_for_each_entry(dqp, &q->qi_dqlist, q_mplist) {
@@ -1314,14 +1312,9 @@ xfs_qm_dqiter_bufs(
 {
         xfs_buf_t       *bp;
         int             error;
-        int             notcommitted;
-        int             incr;
         int             type;
 
         ASSERT(blkcnt > 0);
-        notcommitted = 0;
-        incr = (blkcnt > XFS_QM_MAX_DQCLUSTER_LOGSZ) ?
-                XFS_QM_MAX_DQCLUSTER_LOGSZ : blkcnt;
         type = flags & XFS_QMOPT_UQUOTA ? XFS_DQ_USER :
                 (flags & XFS_QMOPT_PQUOTA ? XFS_DQ_PROJ : XFS_DQ_GROUP);
         error = 0;
diff --git a/fs/xfs/quota/xfs_qm.h b/fs/xfs/quota/xfs_qm.h
index c9446f1c726d..567b29b9f1b3 100644
--- a/fs/xfs/quota/xfs_qm.h
+++ b/fs/xfs/quota/xfs_qm.h
@@ -65,11 +65,6 @@ extern kmem_zone_t	*qm_dqtrxzone;
  * block in the dquot/xqm code.
  */
 #define XFS_DQUOT_CLUSTER_SIZE_FSB      (xfs_filblks_t)1
-/*
- * When doing a quotacheck, we log dquot clusters of this many FSBs at most
- * in a single transaction. We don't want to ask for too huge a log reservation.
- */
-#define XFS_QM_MAX_DQCLUSTER_LOGSZ      3
 
 typedef xfs_dqhash_t    xfs_dqlist_t;
 
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 0d62a07b7fd8..2dadb15d5ca9 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -313,14 +313,12 @@ xfs_qm_scall_quotaon(
 {
         int             error;
         uint            qf;
-        uint            accflags;
         __int64_t       sbflags;
 
         flags &= (XFS_ALL_QUOTA_ACCT | XFS_ALL_QUOTA_ENFD);
         /*
          * Switching on quota accounting must be done at mount time.
          */
-        accflags = flags & XFS_ALL_QUOTA_ACCT;
         flags &= ~(XFS_ALL_QUOTA_ACCT);
 
         sbflags = 0;
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 4bc3c649aee4..27d64d752eab 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -2395,17 +2395,33 @@ xfs_free_extent(
         memset(&args, 0, sizeof(xfs_alloc_arg_t));
         args.tp = tp;
         args.mp = tp->t_mountp;
+
+        /*
+         * validate that the block number is legal - the enables us to detect
+         * and handle a silent filesystem corruption rather than crashing.
+         */
         args.agno = XFS_FSB_TO_AGNO(args.mp, bno);
-        ASSERT(args.agno < args.mp->m_sb.sb_agcount);
+        if (args.agno >= args.mp->m_sb.sb_agcount)
+                return EFSCORRUPTED;
+
         args.agbno = XFS_FSB_TO_AGBNO(args.mp, bno);
+        if (args.agbno >= args.mp->m_sb.sb_agblocks)
+                return EFSCORRUPTED;
+
         args.pag = xfs_perag_get(args.mp, args.agno);
-        if ((error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING)))
+        ASSERT(args.pag);
+
+        error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING);
+        if (error)
                 goto error0;
-#ifdef DEBUG
-        ASSERT(args.agbp != NULL);
-        ASSERT((args.agbno + len) <=
-                be32_to_cpu(XFS_BUF_TO_AGF(args.agbp)->agf_length));
-#endif
+
+        /* validate the extent size is legal now we have the agf locked */
+        if (args.agbno + len >
+                        be32_to_cpu(XFS_BUF_TO_AGF(args.agbp)->agf_length)) {
+                error = EFSCORRUPTED;
+                goto error0;
+        }
+
         error = xfs_free_ag_extent(tp, args.agbp, args.agno, args.agbno, len, 0);
 error0:
         xfs_perag_put(args.pag);
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 46cc40131d4a..576fdfe81d60 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -198,6 +198,41 @@ xfs_inode_item_size(
 }
 
 /*
+ * xfs_inode_item_format_extents - convert in-core extents to on-disk form
+ *
+ * For either the data or attr fork in extent format, we need to endian convert
+ * the in-core extent as we place them into the on-disk inode. In this case, we
+ * need to do this conversion before we write the extents into the log. Because
+ * we don't have the disk inode to write into here, we allocate a buffer and
+ * format the extents into it via xfs_iextents_copy(). We free the buffer in
+ * the unlock routine after the copy for the log has been made.
+ *
+ * In the case of the data fork, the in-core and on-disk fork sizes can be
+ * different due to delayed allocation extents. We only log on-disk extents
+ * here, so always use the physical fork size to determine the size of the
+ * buffer we need to allocate.
+ */
+STATIC void
+xfs_inode_item_format_extents(
+        struct xfs_inode        *ip,
+        struct xfs_log_iovec    *vecp,
+        int                     whichfork,
+        int                     type)
+{
+        xfs_bmbt_rec_t          *ext_buffer;
+
+        ext_buffer = kmem_alloc(XFS_IFORK_SIZE(ip, whichfork), KM_SLEEP);
+        if (whichfork == XFS_DATA_FORK)
+                ip->i_itemp->ili_extents_buf = ext_buffer;
+        else
+                ip->i_itemp->ili_aextents_buf = ext_buffer;
+
+        vecp->i_addr = ext_buffer;
+        vecp->i_len = xfs_iextents_copy(ip, ext_buffer, whichfork);
+        vecp->i_type = type;
+}
+
+/*
  * This is called to fill in the vector of log iovecs for the
  * given inode log item.  It fills the first item with an inode
  * log format structure, the second with the on-disk inode structure,
@@ -213,7 +248,6 @@ xfs_inode_item_format(
         struct xfs_inode        *ip = iip->ili_inode;
         uint                    nvecs;
         size_t                  data_bytes;
-        xfs_bmbt_rec_t          *ext_buffer;
         xfs_mount_t             *mp;
 
         vecp->i_addr = &iip->ili_format;
@@ -320,22 +354,8 @@ xfs_inode_item_format(
                         } else
 #endif
                         {
-                                /*
-                                 * There are delayed allocation extents
-                                 * in the inode, or we need to convert
-                                 * the extents to on disk format.
-                                 * Use xfs_iextents_copy()
-                                 * to copy only the real extents into
-                                 * a separate buffer.  We'll free the
-                                 * buffer in the unlock routine.
-                                 */
-                                ext_buffer = kmem_alloc(ip->i_df.if_bytes,
-                                        KM_SLEEP);
-                                iip->ili_extents_buf = ext_buffer;
-                                vecp->i_addr = ext_buffer;
-                                vecp->i_len = xfs_iextents_copy(ip, ext_buffer,
-                                                XFS_DATA_FORK);
-                                vecp->i_type = XLOG_REG_TYPE_IEXT;
+                                xfs_inode_item_format_extents(ip, vecp,
+                                        XFS_DATA_FORK, XLOG_REG_TYPE_IEXT);
                         }
                         ASSERT(vecp->i_len <= ip->i_df.if_bytes);
                         iip->ili_format.ilf_dsize = vecp->i_len;
@@ -445,19 +465,12 @@ xfs_inode_item_format(
                          */
                         vecp->i_addr = ip->i_afp->if_u1.if_extents;
                         vecp->i_len = ip->i_afp->if_bytes;
+                        vecp->i_type = XLOG_REG_TYPE_IATTR_EXT;
 #else
                         ASSERT(iip->ili_aextents_buf == NULL);
-                        /*
-                         * Need to endian flip before logging
-                         */
-                        ext_buffer = kmem_alloc(ip->i_afp->if_bytes,
-                                KM_SLEEP);
-                        iip->ili_aextents_buf = ext_buffer;
-                        vecp->i_addr = ext_buffer;
-                        vecp->i_len = xfs_iextents_copy(ip, ext_buffer,
-                                        XFS_ATTR_FORK);
+                        xfs_inode_item_format_extents(ip, vecp,
+                                        XFS_ATTR_FORK, XLOG_REG_TYPE_IATTR_EXT);
 #endif
-                        vecp->i_type = XLOG_REG_TYPE_IATTR_EXT;
                         iip->ili_format.ilf_asize = vecp->i_len;
                         vecp++;
                         nvecs++;
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index dc1882adaf54..751e94fe1f77 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -204,7 +204,6 @@ xfs_bulkstat(
         xfs_agi_t               *agi;   /* agi header data */
         xfs_agino_t             agino;  /* inode # in allocation group */
         xfs_agnumber_t          agno;   /* allocation group number */
-        xfs_daddr_t             bno;    /* inode cluster start daddr */
         int                     chunkidx; /* current index into inode chunk */
         int                     clustidx; /* current index into inode cluster */
         xfs_btree_cur_t         *cur;   /* btree cursor for ialloc btree */
@@ -463,7 +462,6 @@ xfs_bulkstat(
                                                  mp->m_sb.sb_inopblog);
                                 }
                                 ino = XFS_AGINO_TO_INO(mp, agno, agino);
-                                bno = XFS_AGB_TO_DADDR(mp, agno, agbno);
                                 /*
                                  * Skip if this inode is free.
                                  */
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 25efa9b8a602..b612ce4520ae 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -761,7 +761,7 @@ xfs_log_need_covered(xfs_mount_t *mp)
                 break;
         case XLOG_STATE_COVER_NEED:
         case XLOG_STATE_COVER_NEED2:
-                if (!xfs_trans_ail_tail(log->l_ailp) &&
+                if (!xfs_ail_min_lsn(log->l_ailp) &&
                     xlog_iclogs_empty(log)) {
                         if (log->l_covered_state == XLOG_STATE_COVER_NEED)
                                 log->l_covered_state = XLOG_STATE_COVER_DONE;
@@ -801,7 +801,7 @@ xlog_assign_tail_lsn(
         xfs_lsn_t               tail_lsn;
         struct log              *log = mp->m_log;
 
-        tail_lsn = xfs_trans_ail_tail(mp->m_ail);
+        tail_lsn = xfs_ail_min_lsn(mp->m_ail);
         if (!tail_lsn)
                 tail_lsn = atomic64_read(&log->l_last_sync_lsn);
 
@@ -1239,7 +1239,7 @@ xlog_grant_push_ail(
          * the filesystem is shutting down.
          */
         if (!XLOG_FORCED_SHUTDOWN(log))
-                xfs_trans_ail_push(log->l_ailp, threshold_lsn);
+                xfs_ail_push(log->l_ailp, threshold_lsn);
 }
 
 /*
@@ -3407,6 +3407,17 @@ xlog_verify_dest_ptr(
                 xfs_emerg(log->l_mp, "%s: invalid ptr", __func__);
 }
 
+/*
+ * Check to make sure the grant write head didn't just over lap the tail.  If
+ * the cycles are the same, we can't be overlapping.  Otherwise, make sure that
+ * the cycles differ by exactly one and check the byte count.
+ *
+ * This check is run unlocked, so can give false positives. Rather than assert
+ * on failures, use a warn-once flag and a panic tag to allow the admin to
+ * determine if they want to panic the machine when such an error occurs. For
+ * debug kernels this will have the same effect as using an assert but, unlinke
+ * an assert, it can be turned off at runtime.
+ */
 STATIC void
 xlog_verify_grant_tail(
         struct log      *log)
@@ -3414,17 +3425,22 @@ xlog_verify_grant_tail(
         int             tail_cycle, tail_blocks;
         int             cycle, space;
 
-        /*
-         * Check to make sure the grant write head didn't just over lap the
-         * tail.  If the cycles are the same, we can't be overlapping.
-         * Otherwise, make sure that the cycles differ by exactly one and
-         * check the byte count.
-         */
         xlog_crack_grant_head(&log->l_grant_write_head, &cycle, &space);
         xlog_crack_atomic_lsn(&log->l_tail_lsn, &tail_cycle, &tail_blocks);
         if (tail_cycle != cycle) {
-                ASSERT(cycle - 1 == tail_cycle);
-                ASSERT(space <= BBTOB(tail_blocks));
+                if (cycle - 1 != tail_cycle &&
+                    !(log->l_flags & XLOG_TAIL_WARN)) {
+                        xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
+                                "%s: cycle - 1 != tail_cycle", __func__);
+                        log->l_flags |= XLOG_TAIL_WARN;
+                }
+
+                if (space > BBTOB(tail_blocks) &&
+                    !(log->l_flags & XLOG_TAIL_WARN)) {
+                        xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
+                                "%s: space > BBTOB(tail_blocks)", __func__);
+                        log->l_flags |= XLOG_TAIL_WARN;
+                }
         }
 }
 
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index ffae692c9832..5864850e9e34 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -144,6 +144,7 @@ static inline uint xlog_get_client_id(__be32 i)
 #define XLOG_RECOVERY_NEEDED    0x4     /* log was recovered */
 #define XLOG_IO_ERROR           0x8     /* log hit an I/O error, and being
                                            shutdown */
+#define XLOG_TAIL_WARN          0x10    /* log tail verify warning issued */
 
 #ifdef __KERNEL__
 /*
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index a62e8971539d..19af0ab0d0c6 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -203,12 +203,9 @@ typedef struct xfs_mount {
         struct mutex            m_icsb_mutex;   /* balancer sync lock */
 #endif
         struct xfs_mru_cache    *m_filestream;  /* per-mount filestream data */
-        struct task_struct      *m_sync_task;   /* generalised sync thread */
-        xfs_sync_work_t         m_sync_work;    /* work item for VFS_SYNC */
-        struct list_head        m_sync_list;    /* sync thread work item list */
-        spinlock_t              m_sync_lock;    /* work item list lock */
-        int                     m_sync_seq;     /* sync thread generation no. */
-        wait_queue_head_t       m_wait_single_sync_task;
+        struct delayed_work     m_sync_work;    /* background sync work */
+        struct delayed_work     m_reclaim_work; /* background inode reclaim */
+        struct work_struct      m_flush_work;   /* background inode flush */
         __int64_t               m_update_flags; /* sb flags we need to update
                                                    on the next remount,rw */
         struct shrinker         m_inode_shrink; /* inode reclaim shrinker */
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index 12aff9584e29..acdb92f14d51 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -28,74 +28,138 @@
 #include "xfs_trans_priv.h"
 #include "xfs_error.h"
 
-STATIC void xfs_ail_splice(struct xfs_ail *, struct list_head *, xfs_lsn_t);
-STATIC void xfs_ail_delete(struct xfs_ail *, xfs_log_item_t *);
-STATIC xfs_log_item_t * xfs_ail_min(struct xfs_ail *);
-STATIC xfs_log_item_t * xfs_ail_next(struct xfs_ail *, xfs_log_item_t *);
+struct workqueue_struct *xfs_ail_wq;    /* AIL workqueue */
 
 #ifdef DEBUG
-STATIC void xfs_ail_check(struct xfs_ail *, xfs_log_item_t *);
-#else
+/*
+ * Check that the list is sorted as it should be.
+ */
+STATIC void
+xfs_ail_check(
+        struct xfs_ail  *ailp,
+        xfs_log_item_t  *lip)
+{
+        xfs_log_item_t  *prev_lip;
+
+        if (list_empty(&ailp->xa_ail))
+                return;
+
+        /*
+         * Check the next and previous entries are valid.
+         */
+        ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
+        prev_lip = list_entry(lip->li_ail.prev, xfs_log_item_t, li_ail);
+        if (&prev_lip->li_ail != &ailp->xa_ail)
+                ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
+
+        prev_lip = list_entry(lip->li_ail.next, xfs_log_item_t, li_ail);
+        if (&prev_lip->li_ail != &ailp->xa_ail)
+                ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) >= 0);
+
+
+#ifdef XFS_TRANS_DEBUG
+        /*
+         * Walk the list checking lsn ordering, and that every entry has the
+         * XFS_LI_IN_AIL flag set. This is really expensive, so only do it
+         * when specifically debugging the transaction subsystem.
+         */
+        prev_lip = list_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
+        list_for_each_entry(lip, &ailp->xa_ail, li_ail) {
+                if (&prev_lip->li_ail != &ailp->xa_ail)
+                        ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
+                ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
+                prev_lip = lip;
+        }
+#endif /* XFS_TRANS_DEBUG */
+}
+#else /* !DEBUG */
 #define xfs_ail_check(a,l)
 #endif /* DEBUG */
 
+/*
+ * Return a pointer to the first item in the AIL.  If the AIL is empty, then
+ * return NULL.
+ */
+static xfs_log_item_t *
+xfs_ail_min(
+        struct xfs_ail  *ailp)
+{
+        if (list_empty(&ailp->xa_ail))
+                return NULL;
+
+        return list_first_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
+}
+
+ /*
+ * Return a pointer to the last item in the AIL.  If the AIL is empty, then
+ * return NULL.
+ */
+static xfs_log_item_t *
+xfs_ail_max(
+        struct xfs_ail  *ailp)
+{
+        if (list_empty(&ailp->xa_ail))
+                return NULL;
+
+        return list_entry(ailp->xa_ail.prev, xfs_log_item_t, li_ail);
+}
+
+/*
+ * Return a pointer to the item which follows the given item in the AIL.  If
+ * the given item is the last item in the list, then return NULL.
+ */
+static xfs_log_item_t *
+xfs_ail_next(
+        struct xfs_ail  *ailp,
+        xfs_log_item_t  *lip)
+{
+        if (lip->li_ail.next == &ailp->xa_ail)
+                return NULL;
+
+        return list_first_entry(&lip->li_ail, xfs_log_item_t, li_ail);
+}
 
 /*
- * This is called by the log manager code to determine the LSN
- * of the tail of the log.  This is exactly the LSN of the first
- * item in the AIL.  If the AIL is empty, then this function
- * returns 0.
+ * This is called by the log manager code to determine the LSN of the tail of
+ * the log.  This is exactly the LSN of the first item in the AIL.  If the AIL
+ * is empty, then this function returns 0.
  *
- * We need the AIL lock in order to get a coherent read of the
- * lsn of the last item in the AIL.
+ * We need the AIL lock in order to get a coherent read of the lsn of the last
+ * item in the AIL.
  */
 xfs_lsn_t
-xfs_trans_ail_tail(
+xfs_ail_min_lsn(
         struct xfs_ail  *ailp)
 {
-        xfs_lsn_t       lsn;
+        xfs_lsn_t       lsn = 0;
         xfs_log_item_t  *lip;
 
         spin_lock(&ailp->xa_lock);
         lip = xfs_ail_min(ailp);
-        if (lip == NULL) {
-                lsn = (xfs_lsn_t)0;
-        } else {
+        if (lip)
                 lsn = lip->li_lsn;
-        }
         spin_unlock(&ailp->xa_lock);
 
         return lsn;
 }
 
 /*
- * xfs_trans_push_ail
- *
- * This routine is called to move the tail of the AIL forward.  It does this by
- * trying to flush items in the AIL whose lsns are below the given
- * threshold_lsn.
- *
- * the push is run asynchronously in a separate thread, so we return the tail
- * of the log right now instead of the tail after the push. This means we will
- * either continue right away, or we will sleep waiting on the async thread to
- * do its work.
- *
- * We do this unlocked - we only need to know whether there is anything in the
- * AIL at the time we are called. We don't need to access the contents of
- * any of the objects, so the lock is not needed.
+ * Return the maximum lsn held in the AIL, or zero if the AIL is empty.
  */
-void
-xfs_trans_ail_push(
-        struct xfs_ail  *ailp,
-        xfs_lsn_t       threshold_lsn)
+static xfs_lsn_t
+xfs_ail_max_lsn(
+        struct xfs_ail  *ailp)
 {
-        xfs_log_item_t  *lip;
+        xfs_lsn_t       lsn = 0;
+        xfs_log_item_t  *lip;
 
-        lip = xfs_ail_min(ailp);
-        if (lip && !XFS_FORCED_SHUTDOWN(ailp->xa_mount)) {
-                if (XFS_LSN_CMP(threshold_lsn, ailp->xa_target) > 0)
-                        xfsaild_wakeup(ailp, threshold_lsn);
-        }
+        spin_lock(&ailp->xa_lock);
+        lip = xfs_ail_max(ailp);
+        if (lip)
+                lsn = lip->li_lsn;
+        spin_unlock(&ailp->xa_lock);
+
+        return lsn;
 }
 
 /*
@@ -236,16 +300,57 @@ out:
 }
 
 /*
- * xfsaild_push does the work of pushing on the AIL.  Returning a timeout of
- * zero indicates that the caller should sleep until woken.
+ * splice the log item list into the AIL at the given LSN.
  */
-long
-xfsaild_push(
-        struct xfs_ail  *ailp,
-        xfs_lsn_t       *last_lsn)
+static void
+xfs_ail_splice(
+        struct xfs_ail  *ailp,
+        struct list_head *list,
+        xfs_lsn_t       lsn)
 {
-        long            tout = 0;
-        xfs_lsn_t       last_pushed_lsn = *last_lsn;
+        xfs_log_item_t  *next_lip;
+
+        /* If the list is empty, just insert the item.  */
+        if (list_empty(&ailp->xa_ail)) {
+                list_splice(list, &ailp->xa_ail);
+                return;
+        }
+
+        list_for_each_entry_reverse(next_lip, &ailp->xa_ail, li_ail) {
+                if (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0)
+                        break;
+        }
+
+        ASSERT(&next_lip->li_ail == &ailp->xa_ail ||
+               XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0);
+
+        list_splice_init(list, &next_lip->li_ail);
+}
+
+/*
+ * Delete the given item from the AIL.  Return a pointer to the item.
+ */
+static void
+xfs_ail_delete(
+        struct xfs_ail  *ailp,
+        xfs_log_item_t  *lip)
+{
+        xfs_ail_check(ailp, lip);
+        list_del(&lip->li_ail);
+        xfs_trans_ail_cursor_clear(ailp, lip);
+}
+
+/*
+ * xfs_ail_worker does the work of pushing on the AIL. It will requeue itself
+ * to run at a later time if there is more work to do to complete the push.
+ */
+STATIC void
+xfs_ail_worker(
+        struct work_struct *work)
+{
+        struct xfs_ail  *ailp = container_of(to_delayed_work(work),
+                                        struct xfs_ail, xa_work);
+        long            tout;
         xfs_lsn_t       target =  ailp->xa_target;
         xfs_lsn_t       lsn;
         xfs_log_item_t  *lip;
@@ -256,15 +361,15 @@ xfsaild_push(
 
         spin_lock(&ailp->xa_lock);
         xfs_trans_ail_cursor_init(ailp, cur);
-        lip = xfs_trans_ail_cursor_first(ailp, cur, *last_lsn);
+        lip = xfs_trans_ail_cursor_first(ailp, cur, ailp->xa_last_pushed_lsn);
         if (!lip || XFS_FORCED_SHUTDOWN(mp)) {
                 /*
                  * AIL is empty or our push has reached the end.
                  */
                 xfs_trans_ail_cursor_done(ailp, cur);
                 spin_unlock(&ailp->xa_lock);
-                *last_lsn = 0;
-                return tout;
+                ailp->xa_last_pushed_lsn = 0;
+                return;
         }
 
         XFS_STATS_INC(xs_push_ail);
@@ -301,13 +406,13 @@ xfsaild_push(
                 case XFS_ITEM_SUCCESS:
                         XFS_STATS_INC(xs_push_ail_success);
                         IOP_PUSH(lip);
-                        last_pushed_lsn = lsn;
+                        ailp->xa_last_pushed_lsn = lsn;
                         break;
 
                 case XFS_ITEM_PUSHBUF:
                         XFS_STATS_INC(xs_push_ail_pushbuf);
                         IOP_PUSHBUF(lip);
-                        last_pushed_lsn = lsn;
+                        ailp->xa_last_pushed_lsn = lsn;
                         push_xfsbufd = 1;
                         break;
 
@@ -319,7 +424,7 @@ xfsaild_push(
 
                 case XFS_ITEM_LOCKED:
                         XFS_STATS_INC(xs_push_ail_locked);
-                        last_pushed_lsn = lsn;
+                        ailp->xa_last_pushed_lsn = lsn;
                         stuck++;
                         break;
 
@@ -374,9 +479,23 @@ xfsaild_push(
                 wake_up_process(mp->m_ddev_targp->bt_task);
         }
 
+        /* assume we have more work to do in a short while */
+        tout = 10;
         if (!count) {
                 /* We're past our target or empty, so idle */
-                last_pushed_lsn = 0;
+                ailp->xa_last_pushed_lsn = 0;
+
+                /*
+                 * Check for an updated push target before clearing the
+                 * XFS_AIL_PUSHING_BIT. If the target changed, we've got more
+                 * work to do. Wait a bit longer before starting that work.
+                 */
+                smp_rmb();
+                if (ailp->xa_target == target) {
+                        clear_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags);
+                        return;
+                }
+                tout = 50;
         } else if (XFS_LSN_CMP(lsn, target) >= 0) {
                 /*
                  * We reached the target so wait a bit longer for I/O to
@@ -384,7 +503,7 @@ xfsaild_push(
                  * start the next scan from the start of the AIL.
                  */
                 tout = 50;
-                last_pushed_lsn = 0;
+                ailp->xa_last_pushed_lsn = 0;
         } else if ((stuck * 100) / count > 90) {
                 /*
                  * Either there is a lot of contention on the AIL or we
@@ -396,14 +515,61 @@ xfsaild_push(
                  * continuing from where we were.
                  */
                 tout = 20;
-        } else {
-                /* more to do, but wait a short while before continuing */
-                tout = 10;
         }
-        *last_lsn = last_pushed_lsn;
-        return tout;
+
+        /* There is more to do, requeue us.  */
+        queue_delayed_work(xfs_syncd_wq, &ailp->xa_work,
+                                        msecs_to_jiffies(tout));
+}
+
+/*
+ * This routine is called to move the tail of the AIL forward.  It does this by
+ * trying to flush items in the AIL whose lsns are below the given
+ * threshold_lsn.
+ *
+ * The push is run asynchronously in a workqueue, which means the caller needs
+ * to handle waiting on the async flush for space to become available.
+ * We don't want to interrupt any push that is in progress, hence we only queue
+ * work if we set the pushing bit approriately.
+ *
+ * We do this unlocked - we only need to know whether there is anything in the
+ * AIL at the time we are called. We don't need to access the contents of
+ * any of the objects, so the lock is not needed.
+ */
+void
+xfs_ail_push(
+        struct xfs_ail  *ailp,
+        xfs_lsn_t       threshold_lsn)
+{
+        xfs_log_item_t  *lip;
+
+        lip = xfs_ail_min(ailp);
+        if (!lip || XFS_FORCED_SHUTDOWN(ailp->xa_mount) ||
+            XFS_LSN_CMP(threshold_lsn, ailp->xa_target) <= 0)
+                return;
+
+        /*
+         * Ensure that the new target is noticed in push code before it clears
+         * the XFS_AIL_PUSHING_BIT.
+         */
+        smp_wmb();
+        ailp->xa_target = threshold_lsn;
+        if (!test_and_set_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags))
+                queue_delayed_work(xfs_syncd_wq, &ailp->xa_work, 0);
 }
 
+/*
+ * Push out all items in the AIL immediately
+ */
+void
+xfs_ail_push_all(
+        struct xfs_ail  *ailp)
+{
+        xfs_lsn_t       threshold_lsn = xfs_ail_max_lsn(ailp);
+
+        if (threshold_lsn)
+                xfs_ail_push(ailp, threshold_lsn);
+}
 
 /*
  * This is to be called when an item is unlocked that may have
@@ -615,7 +781,6 @@ xfs_trans_ail_init(
         xfs_mount_t     *mp)
 {
         struct xfs_ail  *ailp;
-        int             error;
 
         ailp = kmem_zalloc(sizeof(struct xfs_ail), KM_MAYFAIL);
         if (!ailp)
@@ -624,15 +789,9 @@ xfs_trans_ail_init(
         ailp->xa_mount = mp;
         INIT_LIST_HEAD(&ailp->xa_ail);
         spin_lock_init(&ailp->xa_lock);
-        error = xfsaild_start(ailp);
-        if (error)
-                goto out_free_ailp;
+        INIT_DELAYED_WORK(&ailp->xa_work, xfs_ail_worker);
         mp->m_ail = ailp;
         return 0;
-
-out_free_ailp:
-        kmem_free(ailp);
-        return error;
 }
 
 void
@@ -641,124 +800,6 @@ xfs_trans_ail_destroy(
 {
         struct xfs_ail  *ailp = mp->m_ail;
 
-        xfsaild_stop(ailp);
+        cancel_delayed_work_sync(&ailp->xa_work);
         kmem_free(ailp);
 }
-
-/*
- * splice the log item list into the AIL at the given LSN.
- */
-STATIC void
-xfs_ail_splice(
-        struct xfs_ail  *ailp,
-        struct list_head *list,
-        xfs_lsn_t       lsn)
-{
-        xfs_log_item_t  *next_lip;
-
-        /*
-         * If the list is empty, just insert the item.
-         */
-        if (list_empty(&ailp->xa_ail)) {
-                list_splice(list, &ailp->xa_ail);
-                return;
-        }
-
-        list_for_each_entry_reverse(next_lip, &ailp->xa_ail, li_ail) {
-                if (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0)
-                        break;
-        }
-
-        ASSERT((&next_lip->li_ail == &ailp->xa_ail) ||
-               (XFS_LSN_CMP(next_lip->li_lsn, lsn) <= 0));
-
-        list_splice_init(list, &next_lip->li_ail);
-        return;
-}
-
-/*
- * Delete the given item from the AIL.  Return a pointer to the item.
- */
-STATIC void
-xfs_ail_delete(
-        struct xfs_ail  *ailp,
-        xfs_log_item_t  *lip)
-{
-        xfs_ail_check(ailp, lip);
-        list_del(&lip->li_ail);
-        xfs_trans_ail_cursor_clear(ailp, lip);
-}
-
-/*
- * Return a pointer to the first item in the AIL.
- * If the AIL is empty, then return NULL.
- */
-STATIC xfs_log_item_t *
-xfs_ail_min(
-        struct xfs_ail  *ailp)
-{
-        if (list_empty(&ailp->xa_ail))
-                return NULL;
-
-        return list_first_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
-}
-
-/*
- * Return a pointer to the item which follows
- * the given item in the AIL.  If the given item
- * is the last item in the list, then return NULL.
- */
-STATIC xfs_log_item_t *
-xfs_ail_next(
-        struct xfs_ail  *ailp,
-        xfs_log_item_t  *lip)
-{
-        if (lip->li_ail.next == &ailp->xa_ail)
-                return NULL;
-
-        return list_first_entry(&lip->li_ail, xfs_log_item_t, li_ail);
-}
-
-#ifdef DEBUG
-/*
- * Check that the list is sorted as it should be.
- */
-STATIC void
-xfs_ail_check(
-        struct xfs_ail  *ailp,
-        xfs_log_item_t  *lip)
-{
-        xfs_log_item_t  *prev_lip;
-
-        if (list_empty(&ailp->xa_ail))
-                return;
-
-        /*
-         * Check the next and previous entries are valid.
-         */
-        ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
-        prev_lip = list_entry(lip->li_ail.prev, xfs_log_item_t, li_ail);
-        if (&prev_lip->li_ail != &ailp->xa_ail)
-                ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
-
-        prev_lip = list_entry(lip->li_ail.next, xfs_log_item_t, li_ail);
-        if (&prev_lip->li_ail != &ailp->xa_ail)
-                ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) >= 0);
-
-
-#ifdef XFS_TRANS_DEBUG
-        /*
-         * Walk the list checking lsn ordering, and that every entry has the
-         * XFS_LI_IN_AIL flag set. This is really expensive, so only do it
-         * when specifically debugging the transaction subsystem.
-         */
-        prev_lip = list_entry(&ailp->xa_ail, xfs_log_item_t, li_ail);
-        list_for_each_entry(lip, &ailp->xa_ail, li_ail) {
-                if (&prev_lip->li_ail != &ailp->xa_ail)
-                        ASSERT(XFS_LSN_CMP(prev_lip->li_lsn, lip->li_lsn) <= 0);
-                ASSERT((lip->li_flags & XFS_LI_IN_AIL) != 0);
-                prev_lip = lip;
-        }
-#endif /* XFS_TRANS_DEBUG */
-}
-#endif /* DEBUG */
diff --git a/fs/xfs/xfs_trans_priv.h b/fs/xfs/xfs_trans_priv.h
index 35162c238fa3..6b164e9e9a1f 100644
--- a/fs/xfs/xfs_trans_priv.h
+++ b/fs/xfs/xfs_trans_priv.h
@@ -65,16 +65,22 @@ struct xfs_ail_cursor {
 struct xfs_ail {
         struct xfs_mount        *xa_mount;
         struct list_head        xa_ail;
-        uint                    xa_gen;
-        struct task_struct      *xa_task;
         xfs_lsn_t               xa_target;
         struct xfs_ail_cursor   xa_cursors;
         spinlock_t              xa_lock;
+        struct delayed_work     xa_work;
+        xfs_lsn_t               xa_last_pushed_lsn;
+        unsigned long           xa_flags;
 };
 
+#define XFS_AIL_PUSHING_BIT     0
+
 /*
  * From xfs_trans_ail.c
  */
+
+extern struct workqueue_struct  *xfs_ail_wq;    /* AIL workqueue */
+
 void    xfs_trans_ail_update_bulk(struct xfs_ail *ailp,
                                 struct xfs_log_item **log_items, int nr_items,
                                 xfs_lsn_t lsn) __releases(ailp->xa_lock);
@@ -98,12 +104,13 @@ xfs_trans_ail_delete(
         xfs_trans_ail_delete_bulk(ailp, &lip, 1);
 }
 
-void                    xfs_trans_ail_push(struct xfs_ail *, xfs_lsn_t);
+void                    xfs_ail_push(struct xfs_ail *, xfs_lsn_t);
+void                    xfs_ail_push_all(struct xfs_ail *);
+xfs_lsn_t               xfs_ail_min_lsn(struct xfs_ail *ailp);
+
 void                    xfs_trans_unlocked_item(struct xfs_ail *,
                                         xfs_log_item_t *);
 
-xfs_lsn_t               xfs_trans_ail_tail(struct xfs_ail *ailp);
-
 struct xfs_log_item     *xfs_trans_ail_cursor_first(struct xfs_ail *ailp,
                                         struct xfs_ail_cursor *cur,
                                         xfs_lsn_t lsn);
@@ -112,11 +119,6 @@ struct xfs_log_item	*xfs_trans_ail_cursor_next(struct xfs_ail *ailp,
 void                    xfs_trans_ail_cursor_done(struct xfs_ail *ailp,
                                         struct xfs_ail_cursor *cur);
 
-long    xfsaild_push(struct xfs_ail *, xfs_lsn_t *);
-void    xfsaild_wakeup(struct xfs_ail *, xfs_lsn_t);
-int     xfsaild_start(struct xfs_ail *);
-void    xfsaild_stop(struct xfs_ail *);
-
 #if BITS_PER_LONG != 64
 static inline void
 xfs_trans_ail_copy_lsn(
diff --git a/include/drm/drm_fb_helper.h b/include/drm/drm_fb_helper.h
index f22e7fe4b6db..ade09d7b4271 100644
--- a/include/drm/drm_fb_helper.h
+++ b/include/drm/drm_fb_helper.h
@@ -118,6 +118,7 @@ int drm_fb_helper_setcolreg(unsigned regno,
                             unsigned transp,
                             struct fb_info *info);
 
+bool drm_fb_helper_restore_fbdev_mode(struct drm_fb_helper *fb_helper);
 void drm_fb_helper_restore(void);
 void drm_fb_helper_fill_var(struct fb_info *info, struct drm_fb_helper *fb_helper,
                             uint32_t fb_width, uint32_t fb_height);
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index 3bce1a4fc305..7aa5dddb2098 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -909,6 +909,7 @@ struct drm_radeon_cs {
 #define RADEON_INFO_WANT_CMASK          0x08 /* get access to CMASK on r300 */
 #define RADEON_INFO_CLOCK_CRYSTAL_FREQ  0x09 /* clock crystal frequency */
 #define RADEON_INFO_NUM_BACKENDS        0x0a /* DB/backends for r600+ - need for OQ */
+#define RADEON_INFO_NUM_TILE_PIPES      0x0b /* tile pipes for r600+ */
 
 struct drm_radeon_info {
         uint32_t                request;
diff --git a/include/linux/bit_spinlock.h b/include/linux/bit_spinlock.h
index e612575a2596..b4326bfa684f 100644
--- a/include/linux/bit_spinlock.h
+++ b/include/linux/bit_spinlock.h
@@ -23,11 +23,11 @@ static inline void bit_spin_lock(int bitnum, unsigned long *addr)
         preempt_disable();
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
         while (unlikely(test_and_set_bit_lock(bitnum, addr))) {
-                while (test_bit(bitnum, addr)) {
-                        preempt_enable();
+                preempt_enable();
+                do {
                         cpu_relax();
-                        preempt_disable();
-                }
+                } while (test_bit(bitnum, addr));
+                preempt_disable();
         }
 #endif
         __acquire(bitlock);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 32176cc8e715..2ad95fa1d130 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -388,20 +388,19 @@ struct request_queue
 #define QUEUE_FLAG_SYNCFULL     3       /* read queue has been filled */
 #define QUEUE_FLAG_ASYNCFULL    4       /* write queue has been filled */
 #define QUEUE_FLAG_DEAD         5       /* queue being torn down */
-#define QUEUE_FLAG_REENTER      6       /* Re-entrancy avoidance */
-#define QUEUE_FLAG_ELVSWITCH    7       /* don't use elevator, just do FIFO */
-#define QUEUE_FLAG_BIDI         8       /* queue supports bidi requests */
-#define QUEUE_FLAG_NOMERGES     9       /* disable merge attempts */
-#define QUEUE_FLAG_SAME_COMP   10       /* force complete on same CPU */
-#define QUEUE_FLAG_FAIL_IO     11       /* fake timeout */
-#define QUEUE_FLAG_STACKABLE   12       /* supports request stacking */
-#define QUEUE_FLAG_NONROT      13       /* non-rotational device (SSD) */
+#define QUEUE_FLAG_ELVSWITCH    6       /* don't use elevator, just do FIFO */
+#define QUEUE_FLAG_BIDI         7       /* queue supports bidi requests */
+#define QUEUE_FLAG_NOMERGES     8       /* disable merge attempts */
+#define QUEUE_FLAG_SAME_COMP    9       /* force complete on same CPU */
+#define QUEUE_FLAG_FAIL_IO     10       /* fake timeout */
+#define QUEUE_FLAG_STACKABLE   11       /* supports request stacking */
+#define QUEUE_FLAG_NONROT      12       /* non-rotational device (SSD) */
 #define QUEUE_FLAG_VIRT        QUEUE_FLAG_NONROT /* paravirt device */
-#define QUEUE_FLAG_IO_STAT     15       /* do IO stats */
-#define QUEUE_FLAG_DISCARD     16       /* supports DISCARD */
-#define QUEUE_FLAG_NOXMERGES   17       /* No extended merges */
-#define QUEUE_FLAG_ADD_RANDOM  18       /* Contributes to random pool */
-#define QUEUE_FLAG_SECDISCARD  19       /* supports SECDISCARD */
+#define QUEUE_FLAG_IO_STAT     13       /* do IO stats */
+#define QUEUE_FLAG_DISCARD     14       /* supports DISCARD */
+#define QUEUE_FLAG_NOXMERGES   15       /* No extended merges */
+#define QUEUE_FLAG_ADD_RANDOM  16       /* Contributes to random pool */
+#define QUEUE_FLAG_SECDISCARD  17       /* supports SECDISCARD */
 
 #define QUEUE_FLAG_DEFAULT      ((1 << QUEUE_FLAG_IO_STAT) |            \
                                  (1 << QUEUE_FLAG_STACKABLE)    |       \
@@ -697,8 +696,9 @@ extern void blk_start_queue(struct request_queue *q);
 extern void blk_stop_queue(struct request_queue *q);
 extern void blk_sync_queue(struct request_queue *q);
 extern void __blk_stop_queue(struct request_queue *q);
-extern void __blk_run_queue(struct request_queue *q, bool force_kblockd);
+extern void __blk_run_queue(struct request_queue *q);
 extern void blk_run_queue(struct request_queue *);
+extern void blk_run_queue_async(struct request_queue *q);
 extern int blk_rq_map_user(struct request_queue *, struct request *,
                            struct rq_map_data *, void __user *, unsigned long,
                            gfp_t);
@@ -857,26 +857,39 @@ extern void blk_put_queue(struct request_queue *);
 struct blk_plug {
         unsigned long magic;
         struct list_head list;
+        struct list_head cb_list;
         unsigned int should_sort;
 };
+struct blk_plug_cb {
+        struct list_head list;
+        void (*callback)(struct blk_plug_cb *);
+};
 
 extern void blk_start_plug(struct blk_plug *);
 extern void blk_finish_plug(struct blk_plug *);
-extern void __blk_flush_plug(struct task_struct *, struct blk_plug *);
+extern void blk_flush_plug_list(struct blk_plug *, bool);
 
 static inline void blk_flush_plug(struct task_struct *tsk)
 {
         struct blk_plug *plug = tsk->plug;
 
-        if (unlikely(plug))
-                __blk_flush_plug(tsk, plug);
+        if (plug)
+                blk_flush_plug_list(plug, false);
+}
+
+static inline void blk_schedule_flush_plug(struct task_struct *tsk)
+{
+        struct blk_plug *plug = tsk->plug;
+
+        if (plug)
+                blk_flush_plug_list(plug, true);
 }
 
 static inline bool blk_needs_flush_plug(struct task_struct *tsk)
 {
         struct blk_plug *plug = tsk->plug;
 
-        return plug && !list_empty(&plug->list);
+        return plug && (!list_empty(&plug->list) || !list_empty(&plug->cb_list));
 }
 
 /*
@@ -1314,6 +1327,11 @@ static inline void blk_flush_plug(struct task_struct *task)
 {
 }
 
+static inline void blk_schedule_flush_plug(struct task_struct *task)
+{
+}
+
+
 static inline bool blk_needs_flush_plug(struct task_struct *tsk)
 {
         return false;
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index f2afed4fa945..19d90a55541d 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -197,7 +197,7 @@ struct dentry_operations {
       * typically using d_splice_alias. */
 
 #define DCACHE_REFERENCED       0x0008  /* Recently used, don't discard. */
-#define DCACHE_UNHASHED         0x0010  
+#define DCACHE_RCUACCESS        0x0010  /* Entry has ever been RCU-visible */
 #define DCACHE_INOTIFY_PARENT_WATCHED 0x0020
      /* Parent inode is watched by inotify */
 
@@ -384,7 +384,7 @@ extern struct dentry *dget_parent(struct dentry *dentry);
  
 static inline int d_unhashed(struct dentry *dentry)
 {
-        return (dentry->d_flags & DCACHE_UNHASHED);
+        return hlist_bl_unhashed(&dentry->d_hash);
 }
 
 static inline int d_unlinked(struct dentry *dentry)
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index e2768834f397..32a4423710f5 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -197,7 +197,6 @@ struct dm_target {
 struct dm_target_callbacks {
         struct list_head list;
         int (*congested_fn) (struct dm_target_callbacks *, int);
-        void (*unplug_fn)(struct dm_target_callbacks *);
 };
 
 int dm_register_target(struct target_type *t);
diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index df29c8fde36b..8847c8c29791 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -117,7 +117,7 @@ static inline void vma_adjust_trans_huge(struct vm_area_struct *vma,
                                          unsigned long end,
                                          long adjust_next)
 {
-        if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
+        if (!vma->anon_vma || vma->vm_ops)
                 return;
         __vma_adjust_trans_huge(vma, start, end, adjust_next);
 }
diff --git a/include/linux/input.h b/include/linux/input.h
index f3a7794a18c4..771d6d85667d 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -167,6 +167,7 @@ struct input_keymap_entry {
 #define SYN_REPORT              0
 #define SYN_CONFIG              1
 #define SYN_MT_REPORT           2
+#define SYN_DROPPED             3
 
 /*
  * Keys and buttons
@@ -553,8 +554,8 @@ struct input_keymap_entry {
 #define KEY_DVD                 0x185   /* Media Select DVD */
 #define KEY_AUX                 0x186
 #define KEY_MP3                 0x187
-#define KEY_AUDIO               0x188
-#define KEY_VIDEO               0x189
+#define KEY_AUDIO               0x188   /* AL Audio Browser */
+#define KEY_VIDEO               0x189   /* AL Movie Browser */
 #define KEY_DIRECTORY           0x18a
 #define KEY_LIST                0x18b
 #define KEY_MEMO                0x18c   /* Media Select Messages */
@@ -603,8 +604,9 @@ struct input_keymap_entry {
 #define KEY_FRAMEFORWARD        0x1b5
 #define KEY_CONTEXT_MENU        0x1b6   /* GenDesc - system context menu */
 #define KEY_MEDIA_REPEAT        0x1b7   /* Consumer - transport control */
-#define KEY_10CHANNELSUP        0x1b8   /* 10 channels up (10+) */
-#define KEY_10CHANNELSDOWN      0x1b9   /* 10 channels down (10-) */
+#define KEY_10CHANNELSUP        0x1b8   /* 10 channels up (10+) */
+#define KEY_10CHANNELSDOWN      0x1b9   /* 10 channels down (10-) */
+#define KEY_IMAGES              0x1ba   /* AL Image Browser */
 
 #define KEY_DEL_EOL             0x1c0
 #define KEY_DEL_EOS             0x1c1
diff --git a/include/linux/input/mt.h b/include/linux/input/mt.h
index b3ac06a4435d..318bb82325a6 100644
--- a/include/linux/input/mt.h
+++ b/include/linux/input/mt.h
@@ -48,6 +48,12 @@ static inline void input_mt_slot(struct input_dev *dev, int slot)
         input_event(dev, EV_ABS, ABS_MT_SLOT, slot);
 }
 
+static inline bool input_is_mt_axis(int axis)
+{
+        return axis == ABS_MT_SLOT ||
+                (axis >= ABS_MT_FIRST && axis <= ABS_MT_LAST);
+}
+
 void input_mt_report_slot_state(struct input_dev *dev,
                                 unsigned int tool_type, bool active);
 
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 7f675aa81d87..04f32a3eb26b 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -137,8 +137,6 @@ enum {
         ATA_DFLAG_ACPI_PENDING  = (1 << 5), /* ACPI resume action pending */
         ATA_DFLAG_ACPI_FAILED   = (1 << 6), /* ACPI on devcfg has failed */
         ATA_DFLAG_AN            = (1 << 7), /* AN configured */
-        ATA_DFLAG_HIPM          = (1 << 8), /* device supports HIPM */
-        ATA_DFLAG_DIPM          = (1 << 9), /* device supports DIPM */
         ATA_DFLAG_DMADIR        = (1 << 10), /* device requires DMADIR */
         ATA_DFLAG_CFG_MASK      = (1 << 12) - 1,
 
@@ -198,6 +196,7 @@ enum {
                                               * management */
         ATA_FLAG_SW_ACTIVITY    = (1 << 22), /* driver supports sw activity
                                               * led */
+        ATA_FLAG_NO_DIPM        = (1 << 23), /* host not happy with DIPM */
 
         /* bits 24:31 of ap->flags are reserved for LLD specific flags */
 
diff --git a/include/linux/list_bl.h b/include/linux/list_bl.h
index 5bad17d1acde..31f9d75adc5b 100644
--- a/include/linux/list_bl.h
+++ b/include/linux/list_bl.h
@@ -2,6 +2,7 @@
 #define _LINUX_LIST_BL_H
 
 #include <linux/list.h>
+#include <linux/bit_spinlock.h>
 
 /*
  * Special version of lists, where head of the list has a lock in the lowest
@@ -114,6 +115,16 @@ static inline void hlist_bl_del_init(struct hlist_bl_node *n)
         }
 }
 
+static inline void hlist_bl_lock(struct hlist_bl_head *b)
+{
+        bit_spin_lock(0, (unsigned long *)b);
+}
+
+static inline void hlist_bl_unlock(struct hlist_bl_head *b)
+{
+        __bit_spin_unlock(0, (unsigned long *)b);
+}
+
 /**
  * hlist_bl_for_each_entry      - iterate over list of given type
  * @tpos:       the type * to use as a loop cursor.
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 5a5ce7055839..5e9840f50980 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -216,7 +216,7 @@ static inline void mem_cgroup_del_lru_list(struct page *page, int lru)
         return ;
 }
 
-static inline inline void mem_cgroup_rotate_reclaimable_page(struct page *page)
+static inline void mem_cgroup_rotate_reclaimable_page(struct page *page)
 {
         return ;
 }
diff --git a/include/linux/mfd/core.h b/include/linux/mfd/core.h
index ad1b19aa6508..aef23309a742 100644
--- a/include/linux/mfd/core.h
+++ b/include/linux/mfd/core.h
@@ -86,16 +86,25 @@ extern int mfd_clone_cell(const char *cell, const char **clones,
  */
 static inline const struct mfd_cell *mfd_get_cell(struct platform_device *pdev)
 {
-        return pdev->dev.platform_data;
+        return pdev->mfd_cell;
 }
 
 /*
  * Given a platform device that's been created by mfd_add_devices(), fetch
  * the .mfd_data entry from the mfd_cell that created it.
+ * Otherwise just return the platform_data pointer.
+ * This maintains compatibility with platform drivers whose devices aren't
+ * created by the mfd layer, and expect platform_data to contain what would've
+ * otherwise been in mfd_data.
  */
 static inline void *mfd_get_data(struct platform_device *pdev)
 {
-        return mfd_get_cell(pdev)->mfd_data;
+        const struct mfd_cell *cell = mfd_get_cell(pdev);
+
+        if (cell)
+                return cell->mfd_data;
+        else
+                return pdev->dev.platform_data;
 }
 
 extern int mfd_add_devices(struct device *parent, int id,
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 692dbae6ffa7..2348db26bc3d 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -137,7 +137,8 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_RandomReadHint(v)            ((v)->vm_flags & VM_RAND_READ)
 
 /*
- * special vmas that are non-mergable, non-mlock()able
+ * Special vmas that are non-mergable, non-mlock()able.
+ * Note: mm/huge_memory.c VM_NO_THP depends on this definition.
  */
 #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
 
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 216cea5db0aa..87694ca86914 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -47,6 +47,7 @@ struct nfs_client {
 
 #ifdef CONFIG_NFS_V4
         u64                     cl_clientid;    /* constant */
+        nfs4_verifier           cl_confirm;     /* Clientid verifier */
         unsigned long           cl_state;
 
         spinlock_t              cl_lock;
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 78b101e487ea..890dce242639 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -50,6 +50,7 @@ struct nfs_fattr {
         } du;
         struct nfs_fsid         fsid;
         __u64                   fileid;
+        __u64                   mounted_on_fileid;
         struct timespec         atime;
         struct timespec         mtime;
         struct timespec         ctime;
@@ -83,6 +84,7 @@ struct nfs_fattr {
 #define NFS_ATTR_FATTR_PRECHANGE        (1U << 18)
 #define NFS_ATTR_FATTR_V4_REFERRAL      (1U << 19)      /* NFSv4 referral */
 #define NFS_ATTR_FATTR_MOUNTPOINT       (1U << 20)      /* Treat as mountpoint */
+#define NFS_ATTR_FATTR_MOUNTED_ON_FILEID                (1U << 21)
 
 #define NFS_ATTR_FATTR (NFS_ATTR_FATTR_TYPE \
                 | NFS_ATTR_FATTR_MODE \
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 4e2c9150a785..8abe8d78c4bf 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2477,15 +2477,12 @@
 #define PCI_DEVICE_ID_INTEL_82840_HB    0x1a21
 #define PCI_DEVICE_ID_INTEL_82845_HB    0x1a30
 #define PCI_DEVICE_ID_INTEL_IOAT        0x1a38
-#define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS   0x1c22
 #define PCI_DEVICE_ID_INTEL_COUGARPOINT_LPC_MIN 0x1c41
 #define PCI_DEVICE_ID_INTEL_COUGARPOINT_LPC_MAX 0x1c5f
-#define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS      0x1d22
 #define PCI_DEVICE_ID_INTEL_PATSBURG_LPC_0      0x1d40
 #define PCI_DEVICE_ID_INTEL_PATSBURG_LPC_1      0x1d41
 #define PCI_DEVICE_ID_INTEL_DH89XXCC_LPC_MIN    0x2310
 #define PCI_DEVICE_ID_INTEL_DH89XXCC_LPC_MAX    0x231f
-#define PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS      0x2330
 #define PCI_DEVICE_ID_INTEL_82801AA_0   0x2410
 #define PCI_DEVICE_ID_INTEL_82801AA_1   0x2411
 #define PCI_DEVICE_ID_INTEL_82801AA_3   0x2413
@@ -2696,7 +2693,6 @@
 #define PCI_DEVICE_ID_INTEL_ICH10_5     0x3a60
 #define PCI_DEVICE_ID_INTEL_5_3400_SERIES_LPC_MIN       0x3b00
 #define PCI_DEVICE_ID_INTEL_5_3400_SERIES_LPC_MAX       0x3b1f
-#define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
 #define PCI_DEVICE_ID_INTEL_IOAT_SNB    0x402f
 #define PCI_DEVICE_ID_INTEL_5100_16     0x65f0
 #define PCI_DEVICE_ID_INTEL_5100_21     0x65f5
diff --git a/include/linux/pid.h b/include/linux/pid.h
index 31afb7ecbe1f..cdced84261d7 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -117,7 +117,7 @@ extern struct pid *find_vpid(int nr);
  */
 extern struct pid *find_get_pid(int nr);
 extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
-int next_pidmap(struct pid_namespace *pid_ns, int last);
+int next_pidmap(struct pid_namespace *pid_ns, unsigned int last);
 
 extern struct pid *alloc_pid(struct pid_namespace *ns);
 extern void free_pid(struct pid *pid);
diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
index d96db9825708..744942c95fec 100644
--- a/include/linux/platform_device.h
+++ b/include/linux/platform_device.h
@@ -14,6 +14,8 @@
 #include <linux/device.h>
 #include <linux/mod_devicetable.h>
 
+struct mfd_cell;
+
 struct platform_device {
         const char      * name;
         int             id;
@@ -23,6 +25,9 @@ struct platform_device {
 
         const struct platform_device_id *id_entry;
 
+        /* MFD cell pointer */
+        struct mfd_cell *mfd_cell;
+
         /* arch specific additions */
         struct pdev_archdata    archdata;
 };
diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h
index 369e19d3750b..7f1183dcd119 100644
--- a/include/linux/posix-clock.h
+++ b/include/linux/posix-clock.h
@@ -24,6 +24,7 @@
 #include <linux/fs.h>
 #include <linux/poll.h>
 #include <linux/posix-timers.h>
+#include <linux/rwsem.h>
 
 struct posix_clock;
 
@@ -104,7 +105,7 @@ struct posix_clock_operations {
  * @ops:     Functional interface to the clock
  * @cdev:    Character device instance for this clock
  * @kref:    Reference count.
- * @mutex:   Protects the 'zombie' field from concurrent access.
+ * @rwsem:   Protects the 'zombie' field from concurrent access.
  * @zombie:  If 'zombie' is true, then the hardware has disappeared.
  * @release: A function to free the structure when the reference count reaches
  *           zero. May be NULL if structure is statically allocated.
@@ -117,7 +118,7 @@ struct posix_clock {
         struct posix_clock_operations ops;
         struct cdev cdev;
         struct kref kref;
-        struct mutex mutex;
+        struct rw_semaphore rwsem;
         bool zombie;
         void (*release)(struct posix_clock *clk);
 };
diff --git a/include/linux/rio.h b/include/linux/rio.h
index 4e37a7cfa726..4d50611112ba 100644
--- a/include/linux/rio.h
+++ b/include/linux/rio.h
@@ -396,7 +396,7 @@ union rio_pw_msg {
 };
 
 /* Architecture and hardware-specific functions */
-extern void rio_register_mport(struct rio_mport *);
+extern int rio_register_mport(struct rio_mport *);
 extern int rio_open_inb_mbox(struct rio_mport *, void *, int, int);
 extern void rio_close_inb_mbox(struct rio_mport *, int);
 extern int rio_open_outb_mbox(struct rio_mport *, void *, int, int);
diff --git a/include/linux/rio_ids.h b/include/linux/rio_ids.h
index 7410d3365e2a..0cee0152aca9 100644
--- a/include/linux/rio_ids.h
+++ b/include/linux/rio_ids.h
@@ -35,6 +35,7 @@
 #define RIO_DID_IDTCPS6Q                0x035f
 #define RIO_DID_IDTCPS10Q               0x035e
 #define RIO_DID_IDTCPS1848              0x0374
+#define RIO_DID_IDTCPS1432              0x0375
 #define RIO_DID_IDTCPS1616              0x0379
 #define RIO_DID_IDTVPS1616              0x0377
 #define RIO_DID_IDTSPS1616              0x0378
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index 2ca7e8a78060..877ece45426f 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -228,6 +228,8 @@ extern int rtc_read_alarm(struct rtc_device *rtc,
                         struct rtc_wkalrm *alrm);
 extern int rtc_set_alarm(struct rtc_device *rtc,
                                 struct rtc_wkalrm *alrm);
+extern int rtc_initialize_alarm(struct rtc_device *rtc,
+                                struct rtc_wkalrm *alrm);
 extern void rtc_update_irq(struct rtc_device *rtc,
                         unsigned long num, unsigned long events);
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4ec2c027e92c..18d63cea2848 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1254,6 +1254,9 @@ struct task_struct {
 #endif
 
         struct mm_struct *mm, *active_mm;
+#ifdef CONFIG_COMPAT_BRK
+        unsigned brk_randomized:1;
+#endif
 #if defined(SPLIT_RSS_COUNTING)
         struct task_rss_stat    rss_stat;
 #endif
diff --git a/include/linux/security.h b/include/linux/security.h
index ca02f1716736..8ce59ef3e5af 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1456,7 +1456,7 @@ struct security_operations {
                              struct inode *new_dir, struct dentry *new_dentry);
         int (*inode_readlink) (struct dentry *dentry);
         int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
-        int (*inode_permission) (struct inode *inode, int mask);
+        int (*inode_permission) (struct inode *inode, int mask, unsigned flags);
         int (*inode_setattr)    (struct dentry *dentry, struct iattr *attr);
         int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry);
         int (*inode_setxattr) (struct dentry *dentry, const char *name,
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index d81db8012c63..f73c482ec9c6 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -127,13 +127,16 @@ struct rpc_task_setup {
 #define RPC_TASK_KILLED         0x0100          /* task was killed */
 #define RPC_TASK_SOFT           0x0200          /* Use soft timeouts */
 #define RPC_TASK_SOFTCONN       0x0400          /* Fail if can't connect */
+#define RPC_TASK_SENT           0x0800          /* message was sent */
+#define RPC_TASK_TIMEOUT        0x1000          /* fail with ETIMEDOUT on timeout */
 
 #define RPC_IS_ASYNC(t)         ((t)->tk_flags & RPC_TASK_ASYNC)
 #define RPC_IS_SWAPPER(t)       ((t)->tk_flags & RPC_TASK_SWAPPER)
 #define RPC_DO_ROOTOVERRIDE(t)  ((t)->tk_flags & RPC_TASK_ROOTCREDS)
 #define RPC_ASSASSINATED(t)     ((t)->tk_flags & RPC_TASK_KILLED)
-#define RPC_IS_SOFT(t)          ((t)->tk_flags & RPC_TASK_SOFT)
+#define RPC_IS_SOFT(t)          ((t)->tk_flags & (RPC_TASK_SOFT|RPC_TASK_TIMEOUT))
 #define RPC_IS_SOFTCONN(t)      ((t)->tk_flags & RPC_TASK_SOFTCONN)
+#define RPC_WAS_SENT(t)         ((t)->tk_flags & RPC_TASK_SENT)
 
 #define RPC_TASK_RUNNING        0
 #define RPC_TASK_QUEUED         1
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 5a89e3612875..083ffea7ba18 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -249,6 +249,8 @@ extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
 extern int hibernate(void);
 extern bool system_entering_hibernation(void);
 #else /* CONFIG_HIBERNATION */
+static inline void register_nosave_region(unsigned long b, unsigned long e) {}
+static inline void register_nosave_region_late(unsigned long b, unsigned long e) {}
 static inline int swsusp_page_is_forbidden(struct page *p) { return 0; }
 static inline void swsusp_set_page_free(struct page *p) {}
 static inline void swsusp_unset_page_free(struct page *p) {}
@@ -297,14 +299,7 @@ static inline bool pm_wakeup_pending(void) { return false; }
 
 extern struct mutex pm_mutex;
 
-#ifndef CONFIG_HIBERNATION
-static inline void register_nosave_region(unsigned long b, unsigned long e)
-{
-}
-static inline void register_nosave_region_late(unsigned long b, unsigned long e)
-{
-}
-
+#ifndef CONFIG_HIBERNATE_CALLBACKS
 static inline void lock_system_sleep(void) {}
 static inline void unlock_system_sleep(void) {}
 
diff --git a/include/linux/v4l2-mediabus.h b/include/linux/v4l2-mediabus.h
index 7054a7a8065e..de5c15921025 100644
--- a/include/linux/v4l2-mediabus.h
+++ b/include/linux/v4l2-mediabus.h
@@ -47,7 +47,7 @@ enum v4l2_mbus_pixelcode {
         V4L2_MBUS_FMT_RGB565_2X8_BE = 0x1007,
         V4L2_MBUS_FMT_RGB565_2X8_LE = 0x1008,
 
-        /* YUV (including grey) - next is 0x2013 */
+        /* YUV (including grey) - next is 0x2014 */
         V4L2_MBUS_FMT_Y8_1X8 = 0x2001,
         V4L2_MBUS_FMT_UYVY8_1_5X8 = 0x2002,
         V4L2_MBUS_FMT_VYUY8_1_5X8 = 0x2003,
@@ -60,6 +60,7 @@ enum v4l2_mbus_pixelcode {
         V4L2_MBUS_FMT_Y10_1X10 = 0x200a,
         V4L2_MBUS_FMT_YUYV10_2X10 = 0x200b,
         V4L2_MBUS_FMT_YVYU10_2X10 = 0x200c,
+        V4L2_MBUS_FMT_Y12_1X12 = 0x2013,
         V4L2_MBUS_FMT_UYVY8_1X16 = 0x200f,
         V4L2_MBUS_FMT_VYUY8_1X16 = 0x2010,
         V4L2_MBUS_FMT_YUYV8_1X16 = 0x2011,
@@ -67,9 +68,11 @@ enum v4l2_mbus_pixelcode {
         V4L2_MBUS_FMT_YUYV10_1X20 = 0x200d,
         V4L2_MBUS_FMT_YVYU10_1X20 = 0x200e,
 
-        /* Bayer - next is 0x3013 */
+        /* Bayer - next is 0x3015 */
         V4L2_MBUS_FMT_SBGGR8_1X8 = 0x3001,
+        V4L2_MBUS_FMT_SGBRG8_1X8 = 0x3013,
         V4L2_MBUS_FMT_SGRBG8_1X8 = 0x3002,
+        V4L2_MBUS_FMT_SRGGB8_1X8 = 0x3014,
         V4L2_MBUS_FMT_SBGGR10_DPCM8_1X8 = 0x300b,
         V4L2_MBUS_FMT_SGBRG10_DPCM8_1X8 = 0x300c,
         V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8 = 0x3009,
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index aa6c393b7ae9..be82c8ead1af 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -308,6 +308,7 @@ struct v4l2_pix_format {
 #define V4L2_PIX_FMT_Y4      v4l2_fourcc('Y', '0', '4', ' ') /*  4  Greyscale     */
 #define V4L2_PIX_FMT_Y6      v4l2_fourcc('Y', '0', '6', ' ') /*  6  Greyscale     */
 #define V4L2_PIX_FMT_Y10     v4l2_fourcc('Y', '1', '0', ' ') /* 10  Greyscale     */
+#define V4L2_PIX_FMT_Y12     v4l2_fourcc('Y', '1', '2', ' ') /* 12  Greyscale     */
 #define V4L2_PIX_FMT_Y16     v4l2_fourcc('Y', '1', '6', ' ') /* 16  Greyscale     */
 
 /* Palette formats */
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 461c0119664f..2b3831b58aa4 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -58,6 +58,13 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
                 UNEVICTABLE_PGCLEARED,  /* on COW, page truncate */
                 UNEVICTABLE_PGSTRANDED, /* unable to isolate on unlock */
                 UNEVICTABLE_MLOCKFREED,
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+                THP_FAULT_ALLOC,
+                THP_FAULT_FALLBACK,
+                THP_COLLAPSE_ALLOC,
+                THP_COLLAPSE_ALLOC_FAILED,
+                THP_SPLIT,
+#endif
                 NR_VM_EVENT_ITEMS
 };
 
diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
index bd102cf509ac..d61febfb1668 100644
--- a/include/media/v4l2-device.h
+++ b/include/media/v4l2-device.h
@@ -163,7 +163,7 @@ v4l2_device_register_subdev_nodes(struct v4l2_device *v4l2_dev);
 ({                                                                      \
         struct v4l2_subdev *__sd;                                       \
         __v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd, cond, o, \
-                                                f, args...);            \
+                                                f , ##args);            \
 })
 
 /* Call the specified callback for all subdevs matching grp_id (if 0, then
diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index cdf2e8ac4309..d2df55b0c213 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -139,8 +139,6 @@ do { \
  */
 
 enum p9_msg_t {
-        P9_TSYNCFS = 0,
-        P9_RSYNCFS,
         P9_TLERROR = 6,
         P9_RLERROR,
         P9_TSTATFS = 8,
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index 85c1413f054d..051a99f79769 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -218,8 +218,8 @@ void p9_client_disconnect(struct p9_client *clnt);
 void p9_client_begin_disconnect(struct p9_client *clnt);
 struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
                                         char *uname, u32 n_uname, char *aname);
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
-                                                                int clone);
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
+                char **wnames, int clone);
 int p9_client_open(struct p9_fid *fid, int mode);
 int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
                                                         char *extension);
@@ -230,7 +230,6 @@ int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
                 gid_t gid, struct p9_qid *qid);
 int p9_client_clunk(struct p9_fid *fid);
 int p9_client_fsync(struct p9_fid *fid, int datasync);
-int p9_client_sync_fs(struct p9_fid *fid);
 int p9_client_remove(struct p9_fid *fid);
 int p9_client_read(struct p9_fid *fid, char *data, char __user *udata,
                                                         u64 offset, u32 count);
diff --git a/include/trace/events/block.h b/include/trace/events/block.h
index 78f18adb49c8..bf366547da25 100644
--- a/include/trace/events/block.h
+++ b/include/trace/events/block.h
@@ -401,9 +401,9 @@ TRACE_EVENT(block_plug,
 
 DECLARE_EVENT_CLASS(block_unplug,
 
-        TP_PROTO(struct request_queue *q),
+        TP_PROTO(struct request_queue *q, unsigned int depth, bool explicit),
 
-        TP_ARGS(q),
+        TP_ARGS(q, depth, explicit),
 
         TP_STRUCT__entry(
                 __field( int,           nr_rq                   )
@@ -411,7 +411,7 @@ DECLARE_EVENT_CLASS(block_unplug,
         ),
 
         TP_fast_assign(
-                __entry->nr_rq  = q->rq.count[READ] + q->rq.count[WRITE];
+                __entry->nr_rq = depth;
                 memcpy(__entry->comm, current->comm, TASK_COMM_LEN);
         ),
 
@@ -419,31 +419,19 @@ DECLARE_EVENT_CLASS(block_unplug,
 );
 
 /**
- * block_unplug_timer - timed release of operations requests in queue to device driver
- * @q: request queue to unplug
- *
- * Unplug the request queue @q because a timer expired and allow block
- * operation requests to be sent to the device driver.
- */
-DEFINE_EVENT(block_unplug, block_unplug_timer,
-
-        TP_PROTO(struct request_queue *q),
-
-        TP_ARGS(q)
-);
-
-/**
- * block_unplug_io - release of operations requests in request queue
+ * block_unplug - release of operations requests in request queue
  * @q: request queue to unplug
+ * @depth: number of requests just added to the queue
+ * @explicit: whether this was an explicit unplug, or one from schedule()
  *
  * Unplug request queue @q because device driver is scheduled to work
  * on elements in the request queue.
  */
-DEFINE_EVENT(block_unplug, block_unplug_io,
+DEFINE_EVENT(block_unplug, block_unplug,
 
-        TP_PROTO(struct request_queue *q),
+        TP_PROTO(struct request_queue *q, unsigned int depth, bool explicit),
 
-        TP_ARGS(q)
+        TP_ARGS(q, depth, explicit)
 );
 
 /**
diff --git a/init/Kconfig b/init/Kconfig
index 56240e724d9a..d886b1e9278e 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -924,14 +924,6 @@ menuconfig EXPERT
           environments which can tolerate a "non-standard" kernel.
           Only use this if you really know what you are doing.
 
-config EMBEDDED
-        bool "Embedded system"
-        select EXPERT
-        help
-          This option should be enabled if compiling the kernel for
-          an embedded system so certain expert options are available
-          for configuration.
-
 config UID16
         bool "Enable 16-bit UID system calls" if EXPERT
         depends on ARM || BLACKFIN || CRIS || FRV || H8300 || X86_32 || M68K || (S390 && !64BIT) || SUPERH || SPARC32 || (SPARC64 && COMPAT) || UML || (X86_64 && IA32_EMULATION)
@@ -1104,6 +1096,14 @@ config AIO
           by some high performance threaded applications. Disabling
           this option saves about 7k.
 
+config EMBEDDED
+        bool "Embedded system"
+        select EXPERT
+        help
+          This option should be enabled if compiling the kernel for
+          an embedded system so certain expert options are available
+          for configuration.
+
 config HAVE_PERF_EVENTS
         bool
         help
@@ -1226,6 +1226,7 @@ config SLAB
           per cpu and per node queues.
 
 config SLUB
+        depends on BROKEN || NUMA || !DISCONTIGMEM
         bool "SLUB (Unqueued Allocator)"
         help
            SLUB is a slab allocator that minimizes cache line usage
diff --git a/kernel/futex.c b/kernel/futex.c
index dfb924ffe65b..fe28dc282eae 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1886,7 +1886,7 @@ retry:
         restart->futex.val = val;
         restart->futex.time = abs_time->tv64;
         restart->futex.bitset = bitset;
-        restart->futex.flags = flags;
+        restart->futex.flags = flags | FLAGS_HAS_TIMEOUT;
 
         ret = -ERESTART_RESTARTBLOCK;
 
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 9017478c5d4c..87fdb3f8db14 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -81,7 +81,11 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
         }
 };
 
-static int hrtimer_clock_to_base_table[MAX_CLOCKS];
+static int hrtimer_clock_to_base_table[MAX_CLOCKS] = {
+        [CLOCK_REALTIME]        = HRTIMER_BASE_REALTIME,
+        [CLOCK_MONOTONIC]       = HRTIMER_BASE_MONOTONIC,
+        [CLOCK_BOOTTIME]        = HRTIMER_BASE_BOOTTIME,
+};
 
 static inline int hrtimer_clockid_to_base(clockid_t clock_id)
 {
@@ -1722,10 +1726,6 @@ static struct notifier_block __cpuinitdata hrtimers_nb = {
 
 void __init hrtimers_init(void)
 {
-        hrtimer_clock_to_base_table[CLOCK_REALTIME] = HRTIMER_BASE_REALTIME;
-        hrtimer_clock_to_base_table[CLOCK_MONOTONIC] = HRTIMER_BASE_MONOTONIC;
-        hrtimer_clock_to_base_table[CLOCK_BOOTTIME] = HRTIMER_BASE_BOOTTIME;
-
         hrtimer_cpu_notify(&hrtimers_nb, (unsigned long)CPU_UP_PREPARE,
                           (void *)(long)smp_processor_id());
         register_cpu_notifier(&hrtimers_nb);
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 55936f9cb251..87b77de03dd3 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -33,6 +33,7 @@
 #include <linux/vmalloc.h>
 #include <linux/swap.h>
 #include <linux/kmsg_dump.h>
+#include <linux/syscore_ops.h>
 
 #include <asm/page.h>
 #include <asm/uaccess.h>
@@ -1532,6 +1533,11 @@ int kernel_kexec(void)
                 local_irq_disable();
                 /* Suspend system devices */
                 error = sysdev_suspend(PMSG_FREEZE);
+                if (!error) {
+                        error = syscore_suspend();
+                        if (error)
+                                sysdev_resume();
+                }
                 if (error)
                         goto Enable_irqs;
         } else
@@ -1546,6 +1552,7 @@ int kernel_kexec(void)
 
 #ifdef CONFIG_KEXEC_JUMP
         if (kexec_image->preserve_context) {
+                syscore_resume();
                 sysdev_resume();
  Enable_irqs:
                 local_irq_enable();
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 27960f114efd..8e81a9860a0d 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -364,6 +364,7 @@ void perf_cgroup_switch(struct task_struct *task, int mode)
                         }
 
                         if (mode & PERF_CGROUP_SWIN) {
+                                WARN_ON_ONCE(cpuctx->cgrp);
                                 /* set cgrp before ctxsw in to
                                  * allow event_filter_match() to not
                                  * have to pass task around
@@ -2423,6 +2424,14 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx)
         if (!ctx || !ctx->nr_events)
                 goto out;
 
+        /*
+         * We must ctxsw out cgroup events to avoid conflict
+         * when invoking perf_task_event_sched_in() later on
+         * in this function. Otherwise we end up trying to
+         * ctxswin cgroup events which are already scheduled
+         * in.
+         */
+        perf_cgroup_sched_out(current);
         task_ctx_sched_out(ctx, EVENT_ALL);
 
         raw_spin_lock(&ctx->lock);
@@ -2447,6 +2456,9 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx)
 
         raw_spin_unlock(&ctx->lock);
 
+        /*
+         * Also calls ctxswin for cgroup events, if any:
+         */
         perf_event_context_sched_in(ctx, ctx->task);
 out:
         local_irq_restore(flags);
diff --git a/kernel/pid.c b/kernel/pid.c
index 02f221274265..57a8346a270e 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -217,11 +217,14 @@ static int alloc_pidmap(struct pid_namespace *pid_ns)
         return -1;
 }
 
-int next_pidmap(struct pid_namespace *pid_ns, int last)
+int next_pidmap(struct pid_namespace *pid_ns, unsigned int last)
 {
         int offset;
         struct pidmap *map, *end;
 
+        if (last >= PID_MAX_LIMIT)
+                return -1;
+
         offset = (last + 1) & BITS_PER_PAGE_MASK;
         map = &pid_ns->pidmap[(last + 1)/BITS_PER_PAGE];
         end = &pid_ns->pidmap[PIDMAP_ENTRIES];
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 4603f08dc47b..6de9a8fc3417 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -18,9 +18,13 @@ config SUSPEND_FREEZER
 
           Turning OFF this setting is NOT recommended! If in doubt, say Y.
 
+config HIBERNATE_CALLBACKS
+        bool
+
 config HIBERNATION
         bool "Hibernation (aka 'suspend to disk')"
         depends on SWAP && ARCH_HIBERNATION_POSSIBLE
+        select HIBERNATE_CALLBACKS
         select LZO_COMPRESS
         select LZO_DECOMPRESS
         ---help---
@@ -85,7 +89,7 @@ config PM_STD_PARTITION
 
 config PM_SLEEP
         def_bool y
-        depends on SUSPEND || HIBERNATION || XEN_SAVE_RESTORE
+        depends on SUSPEND || HIBERNATE_CALLBACKS
 
 config PM_SLEEP_SMP
         def_bool y
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index aeabd26e3342..50aae660174d 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -273,8 +273,11 @@ static int create_image(int platform_mode)
         local_irq_disable();
 
         error = sysdev_suspend(PMSG_FREEZE);
-        if (!error)
+        if (!error) {
                 error = syscore_suspend();
+                if (error)
+                        sysdev_resume();
+        }
         if (error) {
                 printk(KERN_ERR "PM: Some system devices failed to power down, "
                         "aborting hibernation\n");
@@ -407,8 +410,11 @@ static int resume_target_kernel(bool platform_mode)
         local_irq_disable();
 
         error = sysdev_suspend(PMSG_QUIESCE);
-        if (!error)
+        if (!error) {
                 error = syscore_suspend();
+                if (error)
+                        sysdev_resume();
+        }
         if (error)
                 goto Enable_irqs;
 
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 2814c32aed51..8935369d503a 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -164,8 +164,11 @@ static int suspend_enter(suspend_state_t state)
         BUG_ON(!irqs_disabled());
 
         error = sysdev_suspend(PMSG_SUSPEND);
-        if (!error)
+        if (!error) {
                 error = syscore_suspend();
+                if (error)
+                        sysdev_resume();
+        }
         if (!error) {
                 if (!(suspend_test(TEST_CORE) || pm_wakeup_pending())) {
                         error = suspend_ops->enter(state);
diff --git a/kernel/sched.c b/kernel/sched.c
index 48013633d792..312f8b95c2d4 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4111,20 +4111,20 @@ need_resched:
                                         try_to_wake_up_local(to_wakeup);
                         }
                         deactivate_task(rq, prev, DEQUEUE_SLEEP);
+
+                        /*
+                         * If we are going to sleep and we have plugged IO queued, make
+                         * sure to submit it to avoid deadlocks.
+                         */
+                        if (blk_needs_flush_plug(prev)) {
+                                raw_spin_unlock(&rq->lock);
+                                blk_schedule_flush_plug(prev);
+                                raw_spin_lock(&rq->lock);
+                        }
                 }
                 switch_count = &prev->nvcsw;
         }
 
-        /*
-         * If we are going to sleep and we have plugged IO queued, make
-         * sure to submit it to avoid deadlocks.
-         */
-        if (prev->state != TASK_RUNNING && blk_needs_flush_plug(prev)) {
-                raw_spin_unlock(&rq->lock);
-                blk_flush_plug(prev);
-                raw_spin_lock(&rq->lock);
-        }
-
         pre_schedule(rq, prev);
 
         if (unlikely(!rq->nr_running))
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 7f00772e57c9..6fa833ab2cb8 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -2104,21 +2104,20 @@ balance_tasks(struct rq *this_rq, int this_cpu, struct rq *busiest,
               enum cpu_idle_type idle, int *all_pinned,
               int *this_best_prio, struct cfs_rq *busiest_cfs_rq)
 {
-        int loops = 0, pulled = 0, pinned = 0;
+        int loops = 0, pulled = 0;
         long rem_load_move = max_load_move;
         struct task_struct *p, *n;
 
         if (max_load_move == 0)
                 goto out;
 
-        pinned = 1;
-
         list_for_each_entry_safe(p, n, &busiest_cfs_rq->tasks, se.group_node) {
                 if (loops++ > sysctl_sched_nr_migrate)
                         break;
 
                 if ((p->se.load.weight >> 1) > rem_load_move ||
-                    !can_migrate_task(p, busiest, this_cpu, sd, idle, &pinned))
+                    !can_migrate_task(p, busiest, this_cpu, sd, idle,
+                                      all_pinned))
                         continue;
 
                 pull_task(busiest, p, this_rq, this_cpu);
@@ -2153,9 +2152,6 @@ out:
          */
         schedstat_add(sd, lb_gained[idle], pulled);
 
-        if (all_pinned)
-                *all_pinned = pinned;
-
         return max_load_move - rem_load_move;
 }
 
@@ -3127,6 +3123,8 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
         if (!sds.busiest || sds.busiest_nr_running == 0)
                 goto out_balanced;
 
+        sds.avg_load = (SCHED_LOAD_SCALE * sds.total_load) / sds.total_pwr;
+
         /*
          * If the busiest group is imbalanced the below checks don't
          * work because they assumes all things are equal, which typically
@@ -3151,7 +3149,6 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
          * Don't pull any tasks if this group is already above the domain
          * average load.
          */
-        sds.avg_load = (SCHED_LOAD_SCALE * sds.total_load) / sds.total_pwr;
         if (sds.this_load >= sds.avg_load)
                 goto out_balanced;
 
@@ -3340,6 +3337,7 @@ redo:
                  * still unbalanced. ld_moved simply stays zero, so it is
                  * correctly treated as an imbalance.
                  */
+                all_pinned = 1;
                 local_irq_save(flags);
                 double_rq_lock(this_rq, busiest);
                 ld_moved = move_tasks(this_rq, this_cpu, busiest,
diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index 25028dd4fa18..c340ca658f37 100644
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -19,7 +19,6 @@
  */
 #include <linux/device.h>
 #include <linux/file.h>
-#include <linux/mutex.h>
 #include <linux/posix-clock.h>
 #include <linux/slab.h>
 #include <linux/syscalls.h>
@@ -34,19 +33,19 @@ static struct posix_clock *get_posix_clock(struct file *fp)
 {
         struct posix_clock *clk = fp->private_data;
 
-        mutex_lock(&clk->mutex);
+        down_read(&clk->rwsem);
 
         if (!clk->zombie)
                 return clk;
 
-        mutex_unlock(&clk->mutex);
+        up_read(&clk->rwsem);
 
         return NULL;
 }
 
 static void put_posix_clock(struct posix_clock *clk)
 {
-        mutex_unlock(&clk->mutex);
+        up_read(&clk->rwsem);
 }
 
 static ssize_t posix_clock_read(struct file *fp, char __user *buf,
@@ -156,7 +155,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
         struct posix_clock *clk =
                 container_of(inode->i_cdev, struct posix_clock, cdev);
 
-        mutex_lock(&clk->mutex);
+        down_read(&clk->rwsem);
 
         if (clk->zombie) {
                 err = -ENODEV;
@@ -172,7 +171,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
                 fp->private_data = clk;
         }
 out:
-        mutex_unlock(&clk->mutex);
+        up_read(&clk->rwsem);
         return err;
 }
 
@@ -211,25 +210,20 @@ int posix_clock_register(struct posix_clock *clk, dev_t devid)
         int err;
 
         kref_init(&clk->kref);
-        mutex_init(&clk->mutex);
+        init_rwsem(&clk->rwsem);
 
         cdev_init(&clk->cdev, &posix_clock_file_operations);
         clk->cdev.owner = clk->ops.owner;
         err = cdev_add(&clk->cdev, devid, 1);
-        if (err)
-                goto no_cdev;
 
         return err;
-no_cdev:
-        mutex_destroy(&clk->mutex);
-        return err;
 }
 EXPORT_SYMBOL_GPL(posix_clock_register);
 
 static void delete_clock(struct kref *kref)
 {
         struct posix_clock *clk = container_of(kref, struct posix_clock, kref);
-        mutex_destroy(&clk->mutex);
+
         if (clk->release)
                 clk->release(clk);
 }
@@ -238,9 +232,9 @@ void posix_clock_unregister(struct posix_clock *clk)
 {
         cdev_del(&clk->cdev);
 
-        mutex_lock(&clk->mutex);
+        down_write(&clk->rwsem);
         clk->zombie = true;
-        mutex_unlock(&clk->mutex);
+        up_write(&clk->rwsem);
 
         kref_put(&clk->kref, delete_clock);
 }
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 61d7d59f4a1a..2ad39e556cb4 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -141,7 +141,7 @@ if FTRACE
 config FUNCTION_TRACER
         bool "Kernel Function Tracer"
         depends on HAVE_FUNCTION_TRACER
-        select FRAME_POINTER if !ARM_UNWIND && !S390
+        select FRAME_POINTER if !ARM_UNWIND && !S390 && !MICROBLAZE
         select KALLSYMS
         select GENERIC_TRACER
         select CONTEXT_SWITCH_TRACER
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 7aa40f8e182d..6957aa298dfa 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -850,29 +850,21 @@ static void blk_add_trace_plug(void *ignore, struct request_queue *q)
                 __blk_add_trace(bt, 0, 0, 0, BLK_TA_PLUG, 0, 0, NULL);
 }
 
-static void blk_add_trace_unplug_io(void *ignore, struct request_queue *q)
+static void blk_add_trace_unplug(void *ignore, struct request_queue *q,
+                                    unsigned int depth, bool explicit)
 {
         struct blk_trace *bt = q->blk_trace;
 
         if (bt) {
-                unsigned int pdu = q->rq.count[READ] + q->rq.count[WRITE];
-                __be64 rpdu = cpu_to_be64(pdu);
+                __be64 rpdu = cpu_to_be64(depth);
+                u32 what;
 
-                __blk_add_trace(bt, 0, 0, 0, BLK_TA_UNPLUG_IO, 0,
-                                sizeof(rpdu), &rpdu);
-        }
-}
-
-static void blk_add_trace_unplug_timer(void *ignore, struct request_queue *q)
-{
-        struct blk_trace *bt = q->blk_trace;
-
-        if (bt) {
-                unsigned int pdu = q->rq.count[READ] + q->rq.count[WRITE];
-                __be64 rpdu = cpu_to_be64(pdu);
+                if (explicit)
+                        what = BLK_TA_UNPLUG_IO;
+                else
+                        what = BLK_TA_UNPLUG_TIMER;
 
-                __blk_add_trace(bt, 0, 0, 0, BLK_TA_UNPLUG_TIMER, 0,
-                                sizeof(rpdu), &rpdu);
+                __blk_add_trace(bt, 0, 0, 0, what, 0, sizeof(rpdu), &rpdu);
         }
 }
 
@@ -1015,9 +1007,7 @@ static void blk_register_tracepoints(void)
         WARN_ON(ret);
         ret = register_trace_block_plug(blk_add_trace_plug, NULL);
         WARN_ON(ret);
-        ret = register_trace_block_unplug_timer(blk_add_trace_unplug_timer, NULL);
-        WARN_ON(ret);
-        ret = register_trace_block_unplug_io(blk_add_trace_unplug_io, NULL);
+        ret = register_trace_block_unplug(blk_add_trace_unplug, NULL);
         WARN_ON(ret);
         ret = register_trace_block_split(blk_add_trace_split, NULL);
         WARN_ON(ret);
@@ -1032,8 +1022,7 @@ static void blk_unregister_tracepoints(void)
         unregister_trace_block_rq_remap(blk_add_trace_rq_remap, NULL);
         unregister_trace_block_bio_remap(blk_add_trace_bio_remap, NULL);
         unregister_trace_block_split(blk_add_trace_split, NULL);
-        unregister_trace_block_unplug_io(blk_add_trace_unplug_io, NULL);
-        unregister_trace_block_unplug_timer(blk_add_trace_unplug_timer, NULL);
+        unregister_trace_block_unplug(blk_add_trace_unplug, NULL);
         unregister_trace_block_plug(blk_add_trace_plug, NULL);
         unregister_trace_block_sleeprq(blk_add_trace_sleeprq, NULL);
         unregister_trace_block_getrq(blk_add_trace_getrq, NULL);
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 140dce750450..14733d4d156b 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -430,9 +430,12 @@ static int watchdog_enable(int cpu)
                 p = kthread_create(watchdog, (void *)(unsigned long)cpu, "watchdog/%d", cpu);
                 if (IS_ERR(p)) {
                         printk(KERN_ERR "softlockup watchdog for %i failed\n", cpu);
-                        if (!err)
+                        if (!err) {
                                 /* if hardlockup hasn't already set this */
                                 err = PTR_ERR(p);
+                                /* and disable the perf event */
+                                watchdog_nmi_disable(cpu);
+                        }
                         goto out;
                 }
                 kthread_bind(p, cpu);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 8859a41806dd..e3378e8d3a5c 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1291,8 +1291,14 @@ __acquires(&gcwq->lock)
                         return true;
                 spin_unlock_irq(&gcwq->lock);
 
-                /* CPU has come up in between, retry migration */
+                /*
+                 * We've raced with CPU hot[un]plug.  Give it a breather
+                 * and retry migration.  cond_resched() is required here;
+                 * otherwise, we might deadlock against cpu_stop trying to
+                 * bring down the CPU on non-preemptive kernel.
+                 */
                 cpu_relax();
+                cond_resched();
         }
 }
 
diff --git a/lib/kstrtox.c b/lib/kstrtox.c
index 05672e819f8c..a235f3cc471c 100644
--- a/lib/kstrtox.c
+++ b/lib/kstrtox.c
@@ -49,12 +49,9 @@ static int _kstrtoull(const char *s, unsigned int base, unsigned long long *res)
                         val = *s - '0';
                 else if ('a' <= _tolower(*s) && _tolower(*s) <= 'f')
                         val = _tolower(*s) - 'a' + 10;
-                else if (*s == '\n') {
-                        if (*(s + 1) == '\0')
-                                break;
-                        else
-                                return -EINVAL;
-                } else
+                else if (*s == '\n' && *(s + 1) == '\0')
+                        break;
+                else
                         return -EINVAL;
 
                 if (val >= base)
diff --git a/lib/test-kstrtox.c b/lib/test-kstrtox.c
index 325c2f9ecebd..d55769d63cb8 100644
--- a/lib/test-kstrtox.c
+++ b/lib/test-kstrtox.c
@@ -315,12 +315,12 @@ static void __init test_kstrtou64_ok(void)
                 {"65537",       10,     65537},
                 {"2147483646",  10,     2147483646},
                 {"2147483647",  10,     2147483647},
-                {"2147483648",  10,     2147483648},
-                {"2147483649",  10,     2147483649},
-                {"4294967294",  10,     4294967294},
-                {"4294967295",  10,     4294967295},
-                {"4294967296",  10,     4294967296},
-                {"4294967297",  10,     4294967297},
+                {"2147483648",  10,     2147483648ULL},
+                {"2147483649",  10,     2147483649ULL},
+                {"4294967294",  10,     4294967294ULL},
+                {"4294967295",  10,     4294967295ULL},
+                {"4294967296",  10,     4294967296ULL},
+                {"4294967297",  10,     4294967297ULL},
                 {"9223372036854775806", 10,     9223372036854775806ULL},
                 {"9223372036854775807", 10,     9223372036854775807ULL},
                 {"9223372036854775808", 10,     9223372036854775808ULL},
@@ -369,12 +369,12 @@ static void __init test_kstrtos64_ok(void)
                 {"65537",       10,     65537},
                 {"2147483646",  10,     2147483646},
                 {"2147483647",  10,     2147483647},
-                {"2147483648",  10,     2147483648},
-                {"2147483649",  10,     2147483649},
-                {"4294967294",  10,     4294967294},
-                {"4294967295",  10,     4294967295},
-                {"4294967296",  10,     4294967296},
-                {"4294967297",  10,     4294967297},
+                {"2147483648",  10,     2147483648LL},
+                {"2147483649",  10,     2147483649LL},
+                {"4294967294",  10,     4294967294LL},
+                {"4294967295",  10,     4294967295LL},
+                {"4294967296",  10,     4294967296LL},
+                {"4294967297",  10,     4294967297LL},
                 {"9223372036854775806", 10,     9223372036854775806LL},
                 {"9223372036854775807", 10,     9223372036854775807LL},
         };
@@ -418,10 +418,10 @@ static void __init test_kstrtou32_ok(void)
                 {"65537",       10,     65537},
                 {"2147483646",  10,     2147483646},
                 {"2147483647",  10,     2147483647},
-                {"2147483648",  10,     2147483648},
-                {"2147483649",  10,     2147483649},
-                {"4294967294",  10,     4294967294},
-                {"4294967295",  10,     4294967295},
+                {"2147483648",  10,     2147483648U},
+                {"2147483649",  10,     2147483649U},
+                {"4294967294",  10,     4294967294U},
+                {"4294967295",  10,     4294967295U},
         };
         TEST_OK(kstrtou32, u32, "%u", test_u32_ok);
 }
diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c
index ea5fa4fe9d67..a6cdc969ea42 100644
--- a/lib/xz/xz_dec_lzma2.c
+++ b/lib/xz/xz_dec_lzma2.c
@@ -969,6 +969,9 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
                          */
                         tmp = b->in[b->in_pos++];
 
+                        if (tmp == 0x00)
+                                return XZ_STREAM_END;
+
                         if (tmp >= 0xE0 || tmp == 0x01) {
                                 s->lzma2.need_props = true;
                                 s->lzma2.need_dict_reset = false;
@@ -1001,9 +1004,6 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
                                                 lzma_reset(s);
                                 }
                         } else {
-                                if (tmp == 0x00)
-                                        return XZ_STREAM_END;
-
                                 if (tmp > 0x02)
                                         return XZ_DATA_ERROR;
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 0a619e0e2e0b..83326ad66d9b 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -244,24 +244,28 @@ static ssize_t single_flag_show(struct kobject *kobj,
                                 struct kobj_attribute *attr, char *buf,
                                 enum transparent_hugepage_flag flag)
 {
-        if (test_bit(flag, &transparent_hugepage_flags))
-                return sprintf(buf, "[yes] no\n");
-        else
-                return sprintf(buf, "yes [no]\n");
+        return sprintf(buf, "%d\n",
+                       !!test_bit(flag, &transparent_hugepage_flags));
 }
+
 static ssize_t single_flag_store(struct kobject *kobj,
                                  struct kobj_attribute *attr,
                                  const char *buf, size_t count,
                                  enum transparent_hugepage_flag flag)
 {
-        if (!memcmp("yes", buf,
-                    min(sizeof("yes")-1, count))) {
+        unsigned long value;
+        int ret;
+
+        ret = kstrtoul(buf, 10, &value);
+        if (ret < 0)
+                return ret;
+        if (value > 1)
+                return -EINVAL;
+
+        if (value)
                 set_bit(flag, &transparent_hugepage_flags);
-        } else if (!memcmp("no", buf,
-                           min(sizeof("no")-1, count))) {
+        else
                 clear_bit(flag, &transparent_hugepage_flags);
-        } else
-                return -EINVAL;
 
         return count;
 }
@@ -680,8 +684,11 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
                         return VM_FAULT_OOM;
                 page = alloc_hugepage_vma(transparent_hugepage_defrag(vma),
                                           vma, haddr, numa_node_id(), 0);
-                if (unlikely(!page))
+                if (unlikely(!page)) {
+                        count_vm_event(THP_FAULT_FALLBACK);
                         goto out;
+                }
+                count_vm_event(THP_FAULT_ALLOC);
                 if (unlikely(mem_cgroup_newpage_charge(page, mm, GFP_KERNEL))) {
                         put_page(page);
                         goto out;
@@ -909,11 +916,13 @@ int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 new_page = NULL;
 
         if (unlikely(!new_page)) {
+                count_vm_event(THP_FAULT_FALLBACK);
                 ret = do_huge_pmd_wp_page_fallback(mm, vma, address,
                                                    pmd, orig_pmd, page, haddr);
                 put_page(page);
                 goto out;
         }
+        count_vm_event(THP_FAULT_ALLOC);
 
         if (unlikely(mem_cgroup_newpage_charge(new_page, mm, GFP_KERNEL))) {
                 put_page(new_page);
@@ -1390,6 +1399,7 @@ int split_huge_page(struct page *page)
 
         BUG_ON(!PageSwapBacked(page));
         __split_huge_page(page, anon_vma);
+        count_vm_event(THP_SPLIT);
 
         BUG_ON(PageCompound(page));
 out_unlock:
@@ -1398,6 +1408,9 @@ out:
         return ret;
 }
 
+#define VM_NO_THP (VM_SPECIAL|VM_INSERTPAGE|VM_MIXEDMAP|VM_SAO| \
+                   VM_HUGETLB|VM_SHARED|VM_MAYSHARE)
+
 int hugepage_madvise(struct vm_area_struct *vma,
                      unsigned long *vm_flags, int advice)
 {
@@ -1406,11 +1419,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_HUGEPAGE |
-                                 VM_SHARED   | VM_MAYSHARE   |
-                                 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
-                                 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
-                                 VM_MIXEDMAP | VM_SAO))
+                if (*vm_flags & (VM_HUGEPAGE | VM_NO_THP))
                         return -EINVAL;
                 *vm_flags &= ~VM_NOHUGEPAGE;
                 *vm_flags |= VM_HUGEPAGE;
@@ -1426,11 +1435,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_NOHUGEPAGE |
-                                 VM_SHARED   | VM_MAYSHARE   |
-                                 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
-                                 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
-                                 VM_MIXEDMAP | VM_SAO))
+                if (*vm_flags & (VM_NOHUGEPAGE | VM_NO_THP))
                         return -EINVAL;
                 *vm_flags &= ~VM_HUGEPAGE;
                 *vm_flags |= VM_NOHUGEPAGE;
@@ -1564,10 +1569,14 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
                  * page fault if needed.
                  */
                 return 0;
-        if (vma->vm_file || vma->vm_ops)
+        if (vma->vm_ops)
                 /* khugepaged not yet working on file or special mappings */
                 return 0;
-        VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+        /*
+         * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
+         * true too, verify it here.
+         */
+        VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
         hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
         hend = vma->vm_end & HPAGE_PMD_MASK;
         if (hstart < hend)
@@ -1784,9 +1793,11 @@ static void collapse_huge_page(struct mm_struct *mm,
                                       node, __GFP_OTHER_NODE);
         if (unlikely(!new_page)) {
                 up_read(&mm->mmap_sem);
+                count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
                 *hpage = ERR_PTR(-ENOMEM);
                 return;
         }
+        count_vm_event(THP_COLLAPSE_ALLOC);
         if (unlikely(mem_cgroup_newpage_charge(new_page, mm, GFP_KERNEL))) {
                 up_read(&mm->mmap_sem);
                 put_page(new_page);
@@ -1816,12 +1827,15 @@ static void collapse_huge_page(struct mm_struct *mm,
             (vma->vm_flags & VM_NOHUGEPAGE))
                 goto out;
 
-        /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
-        if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
+        if (!vma->anon_vma || vma->vm_ops)
                 goto out;
         if (is_vma_temporary_stack(vma))
                 goto out;
-        VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+        /*
+         * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
+         * true too, verify it here.
+         */
+        VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
 
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
@@ -2054,13 +2068,16 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
                         progress++;
                         continue;
                 }
-                /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
-                if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
+                if (!vma->anon_vma || vma->vm_ops)
                         goto skip;
                 if (is_vma_temporary_stack(vma))
                         goto skip;
-
-                VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+                /*
+                 * If is_pfn_mapping() is true is_learn_pfn_mapping()
+                 * must be true too, verify it here.
+                 */
+                VM_BUG_ON(is_linear_pfn_mapping(vma) ||
+                          vma->vm_flags & VM_NO_THP);
 
                 hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
                 hend = vma->vm_end & HPAGE_PMD_MASK;
@@ -2151,8 +2168,11 @@ static void khugepaged_do_scan(struct page **hpage)
 #ifndef CONFIG_NUMA
                 if (!*hpage) {
                         *hpage = alloc_hugepage(khugepaged_defrag());
-                        if (unlikely(!*hpage))
+                        if (unlikely(!*hpage)) {
+                                count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
                                 break;
+                        }
+                        count_vm_event(THP_COLLAPSE_ALLOC);
                 }
 #else
                 if (IS_ERR(*hpage))
@@ -2192,8 +2212,11 @@ static struct page *khugepaged_alloc_hugepage(void)
 
         do {
                 hpage = alloc_hugepage(khugepaged_defrag());
-                if (!hpage)
+                if (!hpage) {
+                        count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
                         khugepaged_alloc_sleep();
+                } else
+                        count_vm_event(THP_COLLAPSE_ALLOC);
         } while (unlikely(!hpage) &&
                  likely(khugepaged_enabled()));
         return hpage;
@@ -2210,8 +2233,11 @@ static void khugepaged_loop(void)
         while (likely(khugepaged_enabled())) {
 #ifndef CONFIG_NUMA
                 hpage = khugepaged_alloc_hugepage();
-                if (unlikely(!hpage))
+                if (unlikely(!hpage)) {
+                        count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
                         break;
+                }
+                count_vm_event(THP_COLLAPSE_ALLOC);
 #else
                 if (IS_ERR(hpage)) {
                         khugepaged_alloc_sleep();
diff --git a/mm/memory.c b/mm/memory.c
index 9da8cab1b1b0..607098d47e74 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1410,6 +1410,13 @@ no_page_table:
         return page;
 }
 
+static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
+{
+        return (vma->vm_flags & VM_GROWSDOWN) &&
+                (vma->vm_start == addr) &&
+                !vma_stack_continue(vma->vm_prev, addr);
+}
+
 /**
  * __get_user_pages() - pin user pages in memory
  * @tsk:        task_struct of target task
@@ -1488,7 +1495,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                 vma = find_extend_vma(mm, start);
                 if (!vma && in_gate_area(mm, start)) {
                         unsigned long pg = start & PAGE_MASK;
-                        struct vm_area_struct *gate_vma = get_gate_vma(mm);
                         pgd_t *pgd;
                         pud_t *pud;
                         pmd_t *pmd;
@@ -1513,10 +1519,11 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 pte_unmap(pte);
                                 return i ? : -EFAULT;
                         }
+                        vma = get_gate_vma(mm);
                         if (pages) {
                                 struct page *page;
 
-                                page = vm_normal_page(gate_vma, start, *pte);
+                                page = vm_normal_page(vma, start, *pte);
                                 if (!page) {
                                         if (!(gup_flags & FOLL_DUMP) &&
                                              is_zero_pfn(pte_pfn(*pte)))
@@ -1530,12 +1537,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 get_page(page);
                         }
                         pte_unmap(pte);
-                        if (vmas)
-                                vmas[i] = gate_vma;
-                        i++;
-                        start += PAGE_SIZE;
-                        nr_pages--;
-                        continue;
+                        goto next_page;
                 }
 
                 if (!vma ||
@@ -1549,6 +1551,13 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                         continue;
                 }
 
+                /*
+                 * If we don't actually want the page itself,
+                 * and it's the stack guard page, just skip it.
+                 */
+                if (!pages && stack_guard_page(vma, start))
+                        goto next_page;
+
                 do {
                         struct page *page;
                         unsigned int foll_flags = gup_flags;
@@ -1631,6 +1640,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 flush_anon_page(vma, page, start);
                                 flush_dcache_page(page);
                         }
+next_page:
                         if (vmas)
                                 vmas[i] = vma;
                         i++;
@@ -3386,7 +3396,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
          * run pte_offset_map on the pmd, if an huge pmd could
          * materialize from under us from a different thread.
          */
-        if (unlikely(__pte_alloc(mm, vma, pmd, address)))
+        if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
                 return VM_FAULT_OOM;
         /* if an huge pmd materialized from under us just retry later */
         if (unlikely(pmd_trans_huge(*pmd)))
@@ -3678,7 +3688,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
                          */
 #ifdef CONFIG_HAVE_IOREMAP_PROT
                         vma = find_vma(mm, addr);
-                        if (!vma)
+                        if (!vma || vma->vm_start > addr)
                                 break;
                         if (vma->vm_ops && vma->vm_ops->access)
                                 ret = vma->vm_ops->access(vma, addr, buf,
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index a2acaf820fe5..9ca1d604f7cd 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -375,7 +375,7 @@ void online_page(struct page *page)
 #endif
 
 #ifdef CONFIG_FLATMEM
-        max_mapnr = max(page_to_pfn(page), max_mapnr);
+        max_mapnr = max(pfn, max_mapnr);
 #endif
 
         ClearPageReserved(page);
diff --git a/mm/mlock.c b/mm/mlock.c
index 2689a08c79af..6b55e3efe0df 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -135,13 +135,6 @@ void munlock_vma_page(struct page *page)
         }
 }
 
-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
-{
-        return (vma->vm_flags & VM_GROWSDOWN) &&
-                (vma->vm_start == addr) &&
-                !vma_stack_continue(vma->vm_prev, addr);
-}
-
 /**
  * __mlock_vma_pages_range() -  mlock a range of pages in the vma.
  * @vma:   target vma
@@ -188,12 +181,6 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         if (vma->vm_flags & VM_LOCKED)
                 gup_flags |= FOLL_MLOCK;
 
-        /* We don't try to access the guard page of a stack vma */
-        if (stack_guard_page(vma, start)) {
-                addr += PAGE_SIZE;
-                nr_pages--;
-        }
-
         return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
                                 NULL, NULL, nonblocking);
 }
diff --git a/mm/mmap.c b/mm/mmap.c
index 2ec8eb5a9cdd..e27e0cf0de03 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -259,7 +259,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
          * randomize_va_space to 2, which will still cause mm->start_brk
          * to be arbitrarily shifted
          */
-        if (mm->start_brk > PAGE_ALIGN(mm->end_data))
+        if (current->brk_randomized)
                 min_brk = mm->start_brk;
         else
                 min_brk = mm->end_data;
@@ -1814,11 +1814,14 @@ static int expand_downwards(struct vm_area_struct *vma,
                 size = vma->vm_end - address;
                 grow = (vma->vm_start - address) >> PAGE_SHIFT;
 
-                error = acct_stack_growth(vma, size, grow);
-                if (!error) {
-                        vma->vm_start = address;
-                        vma->vm_pgoff -= grow;
-                        perf_event_mmap(vma);
+                error = -ENOMEM;
+                if (grow <= vma->vm_pgoff) {
+                        error = acct_stack_growth(vma, size, grow);
+                        if (!error) {
+                                vma->vm_start = address;
+                                vma->vm_pgoff -= grow;
+                                perf_event_mmap(vma);
+                        }
                 }
         }
         vma_unlock_anon_vma(vma);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 6a819d1b2c7d..f52e85c80e8d 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -84,24 +84,6 @@ static bool has_intersects_mems_allowed(struct task_struct *tsk,
 #endif /* CONFIG_NUMA */
 
 /*
- * If this is a system OOM (not a memcg OOM) and the task selected to be
- * killed is not already running at high (RT) priorities, speed up the
- * recovery by boosting the dying task to the lowest FIFO priority.
- * That helps with the recovery and avoids interfering with RT tasks.
- */
-static void boost_dying_task_prio(struct task_struct *p,
-                                  struct mem_cgroup *mem)
-{
-        struct sched_param param = { .sched_priority = 1 };
-
-        if (mem)
-                return;
-
-        if (!rt_task(p))
-                sched_setscheduler_nocheck(p, SCHED_FIFO, &param);
-}
-
-/*
  * The process p may have detached its own ->mm while exiting or through
  * use_mm(), but one or more of its subthreads may still have a valid
  * pointer.  Return p, or any of its subthreads with a valid ->mm, with
@@ -190,10 +172,13 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
 
         /*
          * The baseline for the badness score is the proportion of RAM that each
-         * task's rss and swap space use.
+         * task's rss, pagetable and swap space use.
          */
-        points = (get_mm_rss(p->mm) + get_mm_counter(p->mm, MM_SWAPENTS)) * 1000 /
-                        totalpages;
+        points = get_mm_rss(p->mm) + p->mm->nr_ptes;
+        points += get_mm_counter(p->mm, MM_SWAPENTS);
+
+        points *= 1000;
+        points /= totalpages;
         task_unlock(p);
 
         /*
@@ -452,13 +437,6 @@ static int oom_kill_task(struct task_struct *p, struct mem_cgroup *mem)
         set_tsk_thread_flag(p, TIF_MEMDIE);
         force_sig(SIGKILL, p);
 
-        /*
-         * We give our sacrificial lamb high priority and access to
-         * all the memory it needs. That way it should be able to
-         * exit() and clear out its resources quickly...
-         */
-        boost_dying_task_prio(p, mem);
-
         return 0;
 }
 #undef K
@@ -482,7 +460,6 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
          */
         if (p->flags & PF_EXITING) {
                 set_tsk_thread_flag(p, TIF_MEMDIE);
-                boost_dying_task_prio(p, mem);
                 return 0;
         }
 
@@ -556,7 +533,6 @@ void mem_cgroup_out_of_memory(struct mem_cgroup *mem, gfp_t gfp_mask)
          */
         if (fatal_signal_pending(current)) {
                 set_thread_flag(TIF_MEMDIE);
-                boost_dying_task_prio(current, NULL);
                 return;
         }
 
@@ -712,7 +688,6 @@ void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask,
          */
         if (fatal_signal_pending(current)) {
                 set_thread_flag(TIF_MEMDIE);
-                boost_dying_task_prio(current, NULL);
                 return;
         }
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 2747f5e5abc1..9f8a97b9a350 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3176,7 +3176,7 @@ static __init_refok int __build_all_zonelists(void *data)
  * Called with zonelists_mutex held always
  * unless system_state == SYSTEM_BOOTING.
  */
-void build_all_zonelists(void *data)
+void __ref build_all_zonelists(void *data)
 {
         set_zonelist_order();
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 58da7c150ba6..8fa27e4e582a 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -421,7 +421,8 @@ static swp_entry_t *shmem_swp_alloc(struct shmem_inode_info *info, unsigned long
                  * a waste to allocate index if we cannot allocate data.
                  */
                 if (sbinfo->max_blocks) {
-                        if (percpu_counter_compare(&sbinfo->used_blocks, (sbinfo->max_blocks - 1)) > 0)
+                        if (percpu_counter_compare(&sbinfo->used_blocks,
+                                                sbinfo->max_blocks - 1) >= 0)
                                 return ERR_PTR(-ENOSPC);
                         percpu_counter_inc(&sbinfo->used_blocks);
                         spin_lock(&inode->i_lock);
@@ -1397,7 +1398,8 @@ repeat:
                 shmem_swp_unmap(entry);
                 sbinfo = SHMEM_SB(inode->i_sb);
                 if (sbinfo->max_blocks) {
-                        if ((percpu_counter_compare(&sbinfo->used_blocks, sbinfo->max_blocks) > 0) ||
+                        if (percpu_counter_compare(&sbinfo->used_blocks,
+                                                sbinfo->max_blocks) >= 0 ||
                             shmem_acct_block(info->flags)) {
                                 spin_unlock(&info->lock);
                                 error = -ENOSPC;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index c7f5a6d4b75b..f6b435c80079 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -41,6 +41,7 @@
 #include <linux/memcontrol.h>
 #include <linux/delayacct.h>
 #include <linux/sysctl.h>
+#include <linux/oom.h>
 
 #include <asm/tlbflush.h>
 #include <asm/div64.h>
@@ -1988,17 +1989,12 @@ static bool zone_reclaimable(struct zone *zone)
         return zone->pages_scanned < zone_reclaimable_pages(zone) * 6;
 }
 
-/*
- * As hibernation is going on, kswapd is freezed so that it can't mark
- * the zone into all_unreclaimable. It can't handle OOM during hibernation.
- * So let's check zone's unreclaimable in direct reclaim as well as kswapd.
- */
+/* All zones in zonelist are unreclaimable? */
 static bool all_unreclaimable(struct zonelist *zonelist,
                 struct scan_control *sc)
 {
         struct zoneref *z;
         struct zone *zone;
-        bool all_unreclaimable = true;
 
         for_each_zone_zonelist_nodemask(zone, z, zonelist,
                         gfp_zone(sc->gfp_mask), sc->nodemask) {
@@ -2006,13 +2002,11 @@ static bool all_unreclaimable(struct zonelist *zonelist,
                         continue;
                 if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
                         continue;
-                if (zone_reclaimable(zone)) {
-                        all_unreclaimable = false;
-                        break;
-                }
+                if (!zone->all_unreclaimable)
+                        return false;
         }
 
-        return all_unreclaimable;
+        return true;
 }
 
 /*
@@ -2108,6 +2102,14 @@ out:
         if (sc->nr_reclaimed)
                 return sc->nr_reclaimed;
 
+        /*
+         * As hibernation is going on, kswapd is freezed so that it can't mark
+         * the zone into all_unreclaimable. Thus bypassing all_unreclaimable
+         * check.
+         */
+        if (oom_killer_disabled)
+                return 0;
+
         /* top priority shrink_zones still had more to do? don't OOM, then */
         if (scanning_global_lru(sc) && !all_unreclaimable(zonelist, sc))
                 return 1;
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 772b39b87d95..897ea9e88238 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -321,9 +321,12 @@ static inline void mod_state(struct zone *zone,
                 /*
                  * The fetching of the stat_threshold is racy. We may apply
                  * a counter threshold to the wrong the cpu if we get
-                 * rescheduled while executing here. However, the following
-                 * will apply the threshold again and therefore bring the
-                 * counter under the threshold.
+                 * rescheduled while executing here. However, the next
+                 * counter update will apply the threshold again and
+                 * therefore bring the counter under the threshold again.
+                 *
+                 * Most of the time the thresholds are the same anyways
+                 * for all cpus in a zone.
                  */
                 t = this_cpu_read(pcp->stat_threshold);
 
@@ -945,7 +948,16 @@ static const char * const vmstat_text[] = {
         "unevictable_pgs_cleared",
         "unevictable_pgs_stranded",
         "unevictable_pgs_mlockfreed",
+
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        "thp_fault_alloc",
+        "thp_fault_fallback",
+        "thp_collapse_alloc",
+        "thp_collapse_alloc_failed",
+        "thp_split",
 #endif
+
+#endif /* CONFIG_VM_EVENTS_COUNTERS */
 };
 
 static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat,
diff --git a/net/9p/client.c b/net/9p/client.c
index 48b8e084e710..77367745be9b 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -929,15 +929,15 @@ error:
 }
 EXPORT_SYMBOL(p9_client_attach);
 
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
-        int clone)
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
+                char **wnames, int clone)
 {
         int err;
         struct p9_client *clnt;
         struct p9_fid *fid;
         struct p9_qid *wqids;
         struct p9_req_t *req;
-        int16_t nwqids, count;
+        uint16_t nwqids, count;
 
         err = 0;
         wqids = NULL;
@@ -955,7 +955,7 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
                 fid = oldfid;
 
 
-        P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %d wname[0] %s\n",
+        P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %ud wname[0] %s\n",
                 oldfid->fid, fid->fid, nwname, wnames ? wnames[0] : NULL);
 
         req = p9_client_rpc(clnt, P9_TWALK, "ddT", oldfid->fid, fid->fid,
@@ -1220,27 +1220,6 @@ error:
 }
 EXPORT_SYMBOL(p9_client_fsync);
 
-int p9_client_sync_fs(struct p9_fid *fid)
-{
-        int err = 0;
-        struct p9_req_t *req;
-        struct p9_client *clnt;
-
-        P9_DPRINTK(P9_DEBUG_9P, ">>> TSYNC_FS fid %d\n", fid->fid);
-
-        clnt = fid->clnt;
-        req = p9_client_rpc(clnt, P9_TSYNCFS, "d", fid->fid);
-        if (IS_ERR(req)) {
-                err = PTR_ERR(req);
-                goto error;
-        }
-        P9_DPRINTK(P9_DEBUG_9P, "<<< RSYNCFS fid %d\n", fid->fid);
-        p9_free_req(clnt, req);
-error:
-        return err;
-}
-EXPORT_SYMBOL(p9_client_sync_fs);
-
 int p9_client_clunk(struct p9_fid *fid)
 {
         int err;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 8a4084fa8b5a..b58a501cf3d1 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -265,7 +265,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                         }
                         break;
                 case 'T':{
-                                int16_t *nwname = va_arg(ap, int16_t *);
+                                uint16_t *nwname = va_arg(ap, uint16_t *);
                                 char ***wnames = va_arg(ap, char ***);
 
                                 errcode = p9pdu_readf(pdu, proto_version,
@@ -468,7 +468,8 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                 case 'E':{
                                  int32_t cnt = va_arg(ap, int32_t);
                                  const char *k = va_arg(ap, const void *);
-                                 const char *u = va_arg(ap, const void *);
+                                 const char __user *u = va_arg(ap,
+                                                        const void __user *);
                                  errcode = p9pdu_writef(pdu, proto_version, "d",
                                                  cnt);
                                  if (!errcode && pdu_write_urw(pdu, k, u, cnt))
@@ -495,7 +496,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                         }
                         break;
                 case 'T':{
-                                int16_t nwname = va_arg(ap, int);
+                                uint16_t nwname = va_arg(ap, int);
                                 const char **wnames = va_arg(ap, const char **);
 
                                 errcode = p9pdu_writef(pdu, proto_version, "w",
diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
index d47880e971dd..e883172f9aa2 100644
--- a/net/9p/trans_common.c
+++ b/net/9p/trans_common.c
@@ -66,7 +66,7 @@ p9_payload_gup(struct p9_req_t *req, size_t *pdata_off, int *pdata_len,
         uint32_t pdata_mapped_pages;
         struct trans_rpage_info  *rpinfo;
 
-        *pdata_off = (size_t)req->tc->pubuf & (PAGE_SIZE-1);
+        *pdata_off = (__force size_t)req->tc->pubuf & (PAGE_SIZE-1);
 
         if (*pdata_off)
                 first_page_bytes = min(((size_t)PAGE_SIZE - *pdata_off),
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index e8f046b07182..244e70742183 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -326,8 +326,11 @@ req_retry_pinned:
                         outp = pack_sg_list_p(chan->sg, out, VIRTQUEUE_NUM,
                                         pdata_off, rpinfo->rp_data, pdata_len);
                 } else {
-                        char *pbuf = req->tc->pubuf ? req->tc->pubuf :
-                                                                req->tc->pkbuf;
+                        char *pbuf;
+                        if (req->tc->pubuf)
+                                pbuf = (__force char *) req->tc->pubuf;
+                        else
+                                pbuf = req->tc->pkbuf;
                         outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
                                         req->tc->pbuf_size);
                 }
@@ -352,8 +355,12 @@ req_retry_pinned:
                         in = pack_sg_list_p(chan->sg, out+inp, VIRTQUEUE_NUM,
                                         pdata_off, rpinfo->rp_data, pdata_len);
                 } else {
-                        char *pbuf = req->tc->pubuf ? req->tc->pubuf :
-                                                                req->tc->pkbuf;
+                        char *pbuf;
+                        if (req->tc->pubuf)
+                                pbuf = (__force char *) req->tc->pubuf;
+                        else
+                                pbuf = req->tc->pkbuf;
+
                         in = pack_sg_list(chan->sg, out+inp, VIRTQUEUE_NUM,
                                         pbuf, req->tc->pbuf_size);
                 }
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 50af02737a3d..5a80f41c0cba 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -579,9 +579,15 @@ static void __kick_osd_requests(struct ceph_osd_client *osdc,
 
         list_for_each_entry_safe(req, nreq, &osd->o_linger_requests,
                                  r_linger_osd) {
-                __unregister_linger_request(osdc, req);
+                /*
+                 * reregister request prior to unregistering linger so
+                 * that r_osd is preserved.
+                 */
+                BUG_ON(!list_empty(&req->r_req_lru_item));
                 __register_request(osdc, req);
-                list_move(&req->r_req_lru_item, &osdc->req_unsent);
+                list_add(&req->r_req_lru_item, &osdc->req_unsent);
+                list_add(&req->r_osd_item, &req->r_osd->o_requests);
+                __unregister_linger_request(osdc, req);
                 dout("requeued lingering %p tid %llu osd%d\n", req, req->r_tid,
                      osd->o_osd);
         }
@@ -798,7 +804,7 @@ static void __register_request(struct ceph_osd_client *osdc,
         req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
         INIT_LIST_HEAD(&req->r_req_lru_item);
 
-        dout("register_request %p tid %lld\n", req, req->r_tid);
+        dout("__register_request %p tid %lld\n", req, req->r_tid);
         __insert_request(osdc, req);
         ceph_osdc_get_request(req);
         osdc->num_requests++;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index fce9bd3bd3fe..5c04f3e42704 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -667,7 +667,7 @@ MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("L2TP over IP");
 MODULE_VERSION("1.0");
 
-/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
+/* Use the value of SOCK_DGRAM (2) directory, because __stringify doesn't like
  * enums
  */
 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index dff27d5e22fd..61b1f5ada96a 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -554,7 +554,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
         memcpy(&ssf->ssf_info, &chunk->sinfo, sizeof(struct sctp_sndrcvinfo));
 
         /* Per TSVWG discussion with Randy. Allow the application to
-         * resemble a fragmented message.
+         * reassemble a fragmented message.
          */
         ssf->ssf_info.sinfo_flags = chunk->chunk_hdr->flags;
 
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index 8873fd8ddacd..b2198e65d8bb 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -18,14 +18,13 @@ config SUNRPC_XPRT_RDMA
           If unsure, say N.
 
 config RPCSEC_GSS_KRB5
-        tristate
+        tristate "Secure RPC: Kerberos V mechanism"
         depends on SUNRPC && CRYPTO
-        prompt "Secure RPC: Kerberos V mechanism" if !(NFS_V4 || NFSD_V4)
+        depends on CRYPTO_MD5 && CRYPTO_DES && CRYPTO_CBC && CRYPTO_CTS
+        depends on CRYPTO_ECB && CRYPTO_HMAC && CRYPTO_SHA1 && CRYPTO_AES
+        depends on CRYPTO_ARC4
         default y
         select SUNRPC_GSS
-        select CRYPTO_MD5
-        select CRYPTO_DES
-        select CRYPTO_CBC
         help
           Choose Y here to enable Secure RPC using the Kerberos version 5
           GSS-API mechanism (RFC 1964).
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index f3914d0c5079..339ba64cce1e 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -520,7 +520,7 @@ gss_refresh_upcall(struct rpc_task *task)
                 warn_gssd();
                 task->tk_timeout = 15*HZ;
                 rpc_sleep_on(&pipe_version_rpc_waitqueue, task, NULL);
-                return 0;
+                return -EAGAIN;
         }
         if (IS_ERR(gss_msg)) {
                 err = PTR_ERR(gss_msg);
@@ -563,10 +563,12 @@ retry:
         if (PTR_ERR(gss_msg) == -EAGAIN) {
                 err = wait_event_interruptible_timeout(pipe_version_waitqueue,
                                 pipe_version >= 0, 15*HZ);
+                if (pipe_version < 0) {
+                        warn_gssd();
+                        err = -EACCES;
+                }
                 if (err)
                         goto out;
-                if (pipe_version < 0)
-                        warn_gssd();
                 goto retry;
         }
         if (IS_ERR(gss_msg)) {
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index e7a96e478f63..8d83f9d48713 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1508,7 +1508,10 @@ call_timeout(struct rpc_task *task)
                 if (clnt->cl_chatty)
                         printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
                                 clnt->cl_protname, clnt->cl_server);
-                rpc_exit(task, -EIO);
+                if (task->tk_flags & RPC_TASK_TIMEOUT)
+                        rpc_exit(task, -ETIMEDOUT);
+                else
+                        rpc_exit(task, -EIO);
                 return;
         }
 
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 9494c3767356..ce5eb68a9664 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -906,6 +906,7 @@ void xprt_transmit(struct rpc_task *task)
         }
 
         dprintk("RPC: %5u xmit complete\n", task->tk_pid);
+        task->tk_flags |= RPC_TASK_SENT;
         spin_lock_bh(&xprt->transport_lock);
 
         xprt->ops->set_retrans_timeout(task);
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 659326c3e895..006ad817cd5f 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -332,7 +332,7 @@ static int conf_choice(struct menu *menu)
                 }
                 if (!child)
                         continue;
-                if (line[strlen(line) - 1] == '?') {
+                if (line[0] && line[strlen(line) - 1] == '?') {
                         print_help(child);
                         continue;
                 }
diff --git a/security/capability.c b/security/capability.c
index 2984ea4f776f..bbb51156261b 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -181,7 +181,7 @@ static int cap_inode_follow_link(struct dentry *dentry,
         return 0;
 }
 
-static int cap_inode_permission(struct inode *inode, int mask)
+static int cap_inode_permission(struct inode *inode, int mask, unsigned flags)
 {
         return 0;
 }
diff --git a/security/security.c b/security/security.c
index 101142369db4..4ba6d4cc061f 100644
--- a/security/security.c
+++ b/security/security.c
@@ -518,16 +518,14 @@ int security_inode_permission(struct inode *inode, int mask)
 {
         if (unlikely(IS_PRIVATE(inode)))
                 return 0;
-        return security_ops->inode_permission(inode, mask);
+        return security_ops->inode_permission(inode, mask, 0);
 }
 
 int security_inode_exec_permission(struct inode *inode, unsigned int flags)
 {
         if (unlikely(IS_PRIVATE(inode)))
                 return 0;
-        if (flags)
-                return -ECHILD;
-        return security_ops->inode_permission(inode, MAY_EXEC);
+        return security_ops->inode_permission(inode, MAY_EXEC, flags);
 }
 
 int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 9da6420e2056..1d027e29ce8d 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -471,6 +471,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
  * @avd: access vector decisions
  * @result: result from avc_has_perm_noaudit
  * @a:  auxiliary audit data
+ * @flags: VFS walk flags
  *
  * Audit the granting or denial of permissions in accordance
  * with the policy.  This function is typically called by
@@ -481,9 +482,10 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
  * be performed under a lock, to allow the lock to be released
  * before calling the auditing code.
  */
-void avc_audit(u32 ssid, u32 tsid,
+int avc_audit(u32 ssid, u32 tsid,
                u16 tclass, u32 requested,
-               struct av_decision *avd, int result, struct common_audit_data *a)
+               struct av_decision *avd, int result, struct common_audit_data *a,
+               unsigned flags)
 {
         struct common_audit_data stack_data;
         u32 denied, audited;
@@ -515,11 +517,24 @@ void avc_audit(u32 ssid, u32 tsid,
         else
                 audited = requested & avd->auditallow;
         if (!audited)
-                return;
+                return 0;
+
         if (!a) {
                 a = &stack_data;
                 COMMON_AUDIT_DATA_INIT(a, NONE);
         }
+
+        /*
+         * When in a RCU walk do the audit on the RCU retry.  This is because
+         * the collection of the dname in an inode audit message is not RCU
+         * safe.  Note this may drop some audits when the situation changes
+         * during retry. However this is logically just as if the operation
+         * happened a little later.
+         */
+        if ((a->type == LSM_AUDIT_DATA_FS) &&
+            (flags & IPERM_FLAG_RCU))
+                return -ECHILD;
+
         a->selinux_audit_data.tclass = tclass;
         a->selinux_audit_data.requested = requested;
         a->selinux_audit_data.ssid = ssid;
@@ -529,6 +544,7 @@ void avc_audit(u32 ssid, u32 tsid,
         a->lsm_pre_audit = avc_audit_pre_callback;
         a->lsm_post_audit = avc_audit_post_callback;
         common_lsm_audit(a);
+        return 0;
 }
 
 /**
@@ -793,6 +809,7 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
  * @tclass: target security class
  * @requested: requested permissions, interpreted based on @tclass
  * @auditdata: auxiliary audit data
+ * @flags: VFS walk flags
  *
  * Check the AVC to determine whether the @requested permissions are granted
  * for the SID pair (@ssid, @tsid), interpreting the permissions
@@ -802,14 +819,19 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
  * permissions are granted, -%EACCES if any permissions are denied, or
  * another -errno upon other errors.
  */
-int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
-                 u32 requested, struct common_audit_data *auditdata)
+int avc_has_perm_flags(u32 ssid, u32 tsid, u16 tclass,
+                       u32 requested, struct common_audit_data *auditdata,
+                       unsigned flags)
 {
         struct av_decision avd;
-        int rc;
+        int rc, rc2;
 
         rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd);
-        avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata);
+
+        rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata,
+                        flags);
+        if (rc2)
+                return rc2;
         return rc;
 }
 
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f9c3764e4859..f7cf0ea6faea 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1446,8 +1446,11 @@ static int task_has_capability(struct task_struct *tsk,
         }
 
         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
-        if (audit == SECURITY_CAP_AUDIT)
-                avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
+        if (audit == SECURITY_CAP_AUDIT) {
+                int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
+                if (rc2)
+                        return rc2;
+        }
         return rc;
 }
 
@@ -1467,7 +1470,8 @@ static int task_has_system(struct task_struct *tsk,
 static int inode_has_perm(const struct cred *cred,
                           struct inode *inode,
                           u32 perms,
-                          struct common_audit_data *adp)
+                          struct common_audit_data *adp,
+                          unsigned flags)
 {
         struct inode_security_struct *isec;
         struct common_audit_data ad;
@@ -1487,7 +1491,7 @@ static int inode_has_perm(const struct cred *cred,
                 ad.u.fs.inode = inode;
         }
 
-        return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
+        return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
 }
 
 /* Same as inode_has_perm, but pass explicit audit data containing
@@ -1504,7 +1508,7 @@ static inline int dentry_has_perm(const struct cred *cred,
         COMMON_AUDIT_DATA_INIT(&ad, FS);
         ad.u.fs.path.mnt = mnt;
         ad.u.fs.path.dentry = dentry;
-        return inode_has_perm(cred, inode, av, &ad);
+        return inode_has_perm(cred, inode, av, &ad, 0);
 }
 
 /* Check whether a task can use an open file descriptor to
@@ -1540,7 +1544,7 @@ static int file_has_perm(const struct cred *cred,
         /* av is zero if only checking access to the descriptor. */
         rc = 0;
         if (av)
-                rc = inode_has_perm(cred, inode, av, &ad);
+                rc = inode_has_perm(cred, inode, av, &ad, 0);
 
 out:
         return rc;
@@ -2103,7 +2107,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                         file = file_priv->file;
                         inode = file->f_path.dentry->d_inode;
                         if (inode_has_perm(cred, inode,
-                                           FILE__READ | FILE__WRITE, NULL)) {
+                                           FILE__READ | FILE__WRITE, NULL, 0)) {
                                 drop_tty = 1;
                         }
                 }
@@ -2635,7 +2639,7 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *na
         return dentry_has_perm(cred, NULL, dentry, FILE__READ);
 }
 
-static int selinux_inode_permission(struct inode *inode, int mask)
+static int selinux_inode_permission(struct inode *inode, int mask, unsigned flags)
 {
         const struct cred *cred = current_cred();
         struct common_audit_data ad;
@@ -2657,7 +2661,7 @@ static int selinux_inode_permission(struct inode *inode, int mask)
 
         perms = file_mask_to_av(inode->i_mode, mask);
 
-        return inode_has_perm(cred, inode, perms, &ad);
+        return inode_has_perm(cred, inode, perms, &ad, flags);
 }
 
 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
@@ -3205,7 +3209,7 @@ static int selinux_dentry_open(struct file *file, const struct cred *cred)
          * new inode label or new policy.
          * This check is not redundant - do not remove.
          */
-        return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
+        return inode_has_perm(cred, inode, open_file_to_av(file), NULL, 0);
 }
 
 /* task security operations */
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index 5615081b73ec..e77b2ac2908b 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -54,11 +54,11 @@ struct avc_cache_stats {
 
 void __init avc_init(void);
 
-void avc_audit(u32 ssid, u32 tsid,
+int avc_audit(u32 ssid, u32 tsid,
                u16 tclass, u32 requested,
                struct av_decision *avd,
                int result,
-               struct common_audit_data *a);
+              struct common_audit_data *a, unsigned flags);
 
 #define AVC_STRICT 1 /* Ignore permissive mode. */
 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
@@ -66,9 +66,17 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
                          unsigned flags,
                          struct av_decision *avd);
 
-int avc_has_perm(u32 ssid, u32 tsid,
-                 u16 tclass, u32 requested,
-                 struct common_audit_data *auditdata);
+int avc_has_perm_flags(u32 ssid, u32 tsid,
+                       u16 tclass, u32 requested,
+                       struct common_audit_data *auditdata,
+                       unsigned);
+
+static inline int avc_has_perm(u32 ssid, u32 tsid,
+                               u16 tclass, u32 requested,
+                               struct common_audit_data *auditdata)
+{
+        return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
+}
 
 u32 avc_policy_seqno(void);
 
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index c6f8fcadae07..400a5d5cde61 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -686,7 +686,7 @@ static int smack_inode_rename(struct inode *old_inode,
  *
  * Returns 0 if access is permitted, -EACCES otherwise
  */
-static int smack_inode_permission(struct inode *inode, int mask)
+static int smack_inode_permission(struct inode *inode, int mask, unsigned flags)
 {
         struct smk_audit_info ad;
 
@@ -696,6 +696,10 @@ static int smack_inode_permission(struct inode *inode, int mask)
          */
         if (mask == 0)
                 return 0;
+
+        /* May be droppable after audit */
+        if (flags & IPERM_FLAG_RCU)
+                return -ECHILD;
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
         smk_ad_setfield_u_fs_inode(&ad, inode);
         return smk_curacc(smk_of_inode(inode), mask, &ad);
diff --git a/sound/aoa/codecs/tas.c b/sound/aoa/codecs/tas.c
index 58804c7acfcf..fd2188c3df2b 100644
--- a/sound/aoa/codecs/tas.c
+++ b/sound/aoa/codecs/tas.c
@@ -170,7 +170,7 @@ static void tas_set_volume(struct tas *tas)
         /* analysing the volume and mixer tables shows
          * that they are similar enough when we shift
          * the mixer table down by 4 bits. The error
-         * is minuscule, in just one item the error
+         * is miniscule, in just one item the error
          * is 1, at a value of 0x07f17b (mixer table
          * value is 0x07f17a) */
         tmp = tas_gaintable[left];
diff --git a/sound/pci/au88x0/au88x0_pcm.c b/sound/pci/au88x0/au88x0_pcm.c
index 33f0ba5559a7..62e959120c44 100644
--- a/sound/pci/au88x0/au88x0_pcm.c
+++ b/sound/pci/au88x0/au88x0_pcm.c
@@ -44,10 +44,10 @@ static struct snd_pcm_hardware snd_vortex_playback_hw_adb = {
         .channels_min = 1,
         .channels_max = 2,
         .buffer_bytes_max = 0x10000,
-        .period_bytes_min = 0x1,
+        .period_bytes_min = 0x20,
         .period_bytes_max = 0x1000,
         .periods_min = 2,
-        .periods_max = 32,
+        .periods_max = 1024,
 };
 
 #ifndef CHIP_AU8820
@@ -140,6 +140,9 @@ static int snd_vortex_pcm_open(struct snd_pcm_substream *substream)
                                         SNDRV_PCM_HW_PARAM_PERIOD_BYTES)) < 0)
                 return err;
 
+        snd_pcm_hw_constraint_step(runtime, 0,
+                                        SNDRV_PCM_HW_PARAM_BUFFER_BYTES, 64);
+
         if (VORTEX_PCM_TYPE(substream->pcm) != VORTEX_PCM_WT) {
 #ifndef CHIP_AU8820
                 if (VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_A3D) {
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 430f41db6044..759ade12e758 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -937,6 +937,7 @@ void snd_hda_shutup_pins(struct hda_codec *codec)
 }
 EXPORT_SYMBOL_HDA(snd_hda_shutup_pins);
 
+#ifdef SND_HDA_NEEDS_RESUME
 /* Restore the pin controls cleared previously via snd_hda_shutup_pins() */
 static void restore_shutup_pins(struct hda_codec *codec)
 {
@@ -953,6 +954,7 @@ static void restore_shutup_pins(struct hda_codec *codec)
         }
         codec->pins_shutup = 0;
 }
+#endif
 
 static void init_hda_cache(struct hda_cache_rec *cache,
                            unsigned int record_size);
@@ -1329,6 +1331,7 @@ static void purify_inactive_streams(struct hda_codec *codec)
         }
 }
 
+#ifdef SND_HDA_NEEDS_RESUME
 /* clean up all streams; called from suspend */
 static void hda_cleanup_all_streams(struct hda_codec *codec)
 {
@@ -1340,6 +1343,7 @@ static void hda_cleanup_all_streams(struct hda_codec *codec)
                         really_cleanup_stream(codec, p);
         }
 }
+#endif
 
 /*
  * amp access functions
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 52928d9a72da..c82979a8cd09 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1704,11 +1704,11 @@ static void alc_apply_fixup(struct hda_codec *codec, int action)
                                    codec->chip_name, fix->type);
                         break;
                 }
-                if (!fix[id].chained)
+                if (!fix->chained)
                         break;
                 if (++depth > 10)
                         break;
-                id = fix[id].chain_id;
+                id = fix->chain_id;
         }
 }
 
@@ -5645,6 +5645,7 @@ static void fillup_priv_adc_nids(struct hda_codec *codec, hda_nid_t *nids,
 static struct snd_pci_quirk beep_white_list[] = {
         SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1),
         SND_PCI_QUIRK(0x1043, 0x83ce, "EeePC", 1),
+        SND_PCI_QUIRK(0x1043, 0x831a, "EeePC", 1),
         SND_PCI_QUIRK(0x8086, 0xd613, "Intel", 1),
         {}
 };
@@ -9863,6 +9864,7 @@ static struct snd_pci_quirk alc882_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC883_LAPTOP_EAPD),
         SND_PCI_QUIRK(0x10f1, 0x2350, "TYAN-S2350", ALC888_6ST_DELL),
         SND_PCI_QUIRK(0x108e, 0x534d, NULL, ALC883_3ST_6ch),
+        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P35 DS3R", ALC882_6ST_DIG),
 
         SND_PCI_QUIRK(0x1462, 0x0349, "MSI", ALC883_TARGA_2ch_DIG),
         SND_PCI_QUIRK(0x1462, 0x040d, "MSI", ALC883_TARGA_2ch_DIG),
@@ -10699,7 +10701,6 @@ enum {
         PINFIX_LENOVO_Y530,
         PINFIX_PB_M5210,
         PINFIX_ACER_ASPIRE_7736,
-        PINFIX_GIGABYTE_880GM,
 };
 
 static const struct alc_fixup alc882_fixups[] = {
@@ -10731,13 +10732,6 @@ static const struct alc_fixup alc882_fixups[] = {
                 .type = ALC_FIXUP_SKU,
                 .v.sku = ALC_FIXUP_SKU_IGNORE,
         },
-        [PINFIX_GIGABYTE_880GM] = {
-                .type = ALC_FIXUP_PINS,
-                .v.pins = (const struct alc_pincfg[]) {
-                        { 0x14, 0x1114410 }, /* set as speaker */
-                        { }
-                }
-        },
 };
 
 static struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -10745,7 +10739,6 @@ static struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", PINFIX_LENOVO_Y530),
         SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", PINFIX_ABIT_AW9D_MAX),
         SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", PINFIX_ACER_ASPIRE_7736),
-        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", PINFIX_GIGABYTE_880GM),
         {}
 };
 
@@ -14868,6 +14861,23 @@ static void alc269_fixup_hweq(struct hda_codec *codec,
         alc_write_coef_idx(codec, 0x1e, coef | 0x80);
 }
 
+static void alc271_fixup_dmic(struct hda_codec *codec,
+                              const struct alc_fixup *fix, int action)
+{
+        static struct hda_verb verbs[] = {
+                {0x20, AC_VERB_SET_COEF_INDEX, 0x0d},
+                {0x20, AC_VERB_SET_PROC_COEF, 0x4000},
+                {}
+        };
+        unsigned int cfg;
+
+        if (strcmp(codec->chip_name, "ALC271X"))
+                return;
+        cfg = snd_hda_codec_get_pincfg(codec, 0x12);
+        if (get_defcfg_connect(cfg) == AC_JACK_PORT_FIXED)
+                snd_hda_sequence_write(codec, verbs);
+}
+
 enum {
         ALC269_FIXUP_SONY_VAIO,
         ALC275_FIXUP_SONY_VAIO_GPIO2,
@@ -14876,6 +14886,7 @@ enum {
         ALC269_FIXUP_ASUS_G73JW,
         ALC269_FIXUP_LENOVO_EAPD,
         ALC275_FIXUP_SONY_HWEQ,
+        ALC271_FIXUP_DMIC,
 };
 
 static const struct alc_fixup alc269_fixups[] = {
@@ -14929,7 +14940,11 @@ static const struct alc_fixup alc269_fixups[] = {
                 .v.func = alc269_fixup_hweq,
                 .chained = true,
                 .chain_id = ALC275_FIXUP_SONY_VAIO_GPIO2
-        }
+        },
+        [ALC271_FIXUP_DMIC] = {
+                .type = ALC_FIXUP_FUNC,
+                .v.func = alc271_fixup_dmic,
+        },
 };
 
 static struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -14938,6 +14953,7 @@ static struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
         SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+        SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
@@ -18782,6 +18798,8 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
                       ALC662_3ST_6ch_DIG),
         SND_PCI_QUIRK(0x1179, 0xff6e, "Toshiba NB20x", ALC662_AUTO),
         SND_PCI_QUIRK(0x144d, 0xca00, "Samsung NC10", ALC272_SAMSUNG_NC10),
+        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte 945GCM-S2L",
+                      ALC662_3ST_6ch_DIG),
         SND_PCI_QUIRK(0x152d, 0x2304, "Quanta WH1", ALC663_ASUS_H13),
         SND_PCI_QUIRK(0x1565, 0x820f, "Biostar TA780G M2+", ALC662_3ST_6ch_DIG),
         SND_PCI_QUIRK(0x1631, 0xc10c, "PB RS65", ALC663_ASUS_M51VA),
@@ -19455,7 +19473,7 @@ enum {
         ALC662_FIXUP_IDEAPAD,
         ALC272_FIXUP_MARIO,
         ALC662_FIXUP_CZC_P10T,
-        ALC662_FIXUP_GIGABYTE,
+        ALC662_FIXUP_SKU_IGNORE,
 };
 
 static const struct alc_fixup alc662_fixups[] = {
@@ -19484,20 +19502,17 @@ static const struct alc_fixup alc662_fixups[] = {
                         {}
                 }
         },
-        [ALC662_FIXUP_GIGABYTE] = {
-                .type = ALC_FIXUP_PINS,
-                .v.pins = (const struct alc_pincfg[]) {
-                        { 0x14, 0x1114410 }, /* set as speaker */
-                        { }
-                }
+        [ALC662_FIXUP_SKU_IGNORE] = {
+                .type = ALC_FIXUP_SKU,
+                .v.sku = ALC_FIXUP_SKU_IGNORE,
         },
 };
 
 static struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
+        SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
         SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
-        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", ALC662_FIXUP_GIGABYTE),
         SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 1371b57c11e8..0997031c48d2 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -1292,14 +1292,18 @@ static void notify_aa_path_ctls(struct hda_codec *codec)
 {
         int i;
         struct snd_ctl_elem_id id;
-        const char *labels[] = {"Mic", "Front Mic", "Line"};
+        const char *labels[] = {"Mic", "Front Mic", "Line", "Rear Mic"};
+        struct snd_kcontrol *ctl;
 
         memset(&id, 0, sizeof(id));
         id.iface = SNDRV_CTL_ELEM_IFACE_MIXER;
         for (i = 0; i < ARRAY_SIZE(labels); i++) {
                 sprintf(id.name, "%s Playback Volume", labels[i]);
-                snd_ctl_notify(codec->bus->card, SNDRV_CTL_EVENT_MASK_VALUE,
-                               &id);
+                ctl = snd_hda_find_mixer_ctl(codec, id.name);
+                if (ctl)
+                        snd_ctl_notify(codec->bus->card,
+                                        SNDRV_CTL_EVENT_MASK_VALUE,
+                                        &ctl->id);
         }
 }
 
diff --git a/sound/soc/codecs/jz4740.c b/sound/soc/codecs/jz4740.c
index f7cd346fd727..f5ccdbf7ebc6 100644
--- a/sound/soc/codecs/jz4740.c
+++ b/sound/soc/codecs/jz4740.c
@@ -308,8 +308,6 @@ static int jz4740_codec_dev_probe(struct snd_soc_codec *codec)
         snd_soc_dapm_add_routes(dapm, jz4740_codec_dapm_routes,
                 ARRAY_SIZE(jz4740_codec_dapm_routes));
 
-        snd_soc_dapm_new_widgets(codec);
-
         jz4740_codec_set_bias_level(codec, SND_SOC_BIAS_STANDBY);
 
         return 0;
diff --git a/sound/soc/codecs/sn95031.c b/sound/soc/codecs/sn95031.c
index a54d2a5b28f6..4d9fb279e146 100644
--- a/sound/soc/codecs/sn95031.c
+++ b/sound/soc/codecs/sn95031.c
@@ -927,7 +927,7 @@ static struct platform_driver sn95031_codec_driver = {
                 .owner          = THIS_MODULE,
         },
         .probe          = sn95031_device_probe,
-        .remove         = sn95031_device_remove,
+        .remove         = __devexit_p(sn95031_device_remove),
 };
 
 static int __init sn95031_init(void)
diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
index ae1cadfae84c..f52b623bb692 100644
--- a/sound/soc/codecs/wm8903.c
+++ b/sound/soc/codecs/wm8903.c
@@ -247,8 +247,6 @@ static int wm8903_volatile_register(struct snd_soc_codec *codec, unsigned int re
         case WM8903_REVISION_NUMBER:
         case WM8903_INTERRUPT_STATUS_1:
         case WM8903_WRITE_SEQUENCER_4:
-        case WM8903_POWER_MANAGEMENT_3:
-        case WM8903_POWER_MANAGEMENT_2:
         case WM8903_DC_SERVO_READBACK_1:
         case WM8903_DC_SERVO_READBACK_2:
         case WM8903_DC_SERVO_READBACK_3:
@@ -875,34 +873,40 @@ SND_SOC_DAPM_MIXER("Left Speaker Mixer", WM8903_POWER_MANAGEMENT_4, 1, 0,
 SND_SOC_DAPM_MIXER("Right Speaker Mixer", WM8903_POWER_MANAGEMENT_4, 0, 0,
                    right_speaker_mixer, ARRAY_SIZE(right_speaker_mixer)),
 
-SND_SOC_DAPM_PGA_S("Left Headphone Output PGA", 0, WM8903_ANALOGUE_HP_0,
-                   4, 0, NULL, 0),
-SND_SOC_DAPM_PGA_S("Right Headphone Output PGA", 0, WM8903_ANALOGUE_HP_0,
+SND_SOC_DAPM_PGA_S("Left Headphone Output PGA", 0, WM8903_POWER_MANAGEMENT_2,
+                   1, 0, NULL, 0),
+SND_SOC_DAPM_PGA_S("Right Headphone Output PGA", 0, WM8903_POWER_MANAGEMENT_2,
                    0, 0, NULL, 0),
 
-SND_SOC_DAPM_PGA_S("Left Line Output PGA", 0, WM8903_ANALOGUE_LINEOUT_0, 4, 0,
+SND_SOC_DAPM_PGA_S("Left Line Output PGA", 0, WM8903_POWER_MANAGEMENT_3, 1, 0,
                    NULL, 0),
-SND_SOC_DAPM_PGA_S("Right Line Output PGA", 0, WM8903_ANALOGUE_LINEOUT_0, 0, 0,
+SND_SOC_DAPM_PGA_S("Right Line Output PGA", 0, WM8903_POWER_MANAGEMENT_3, 0, 0,
                    NULL, 0),
 
 SND_SOC_DAPM_PGA_S("HPL_RMV_SHORT", 4, WM8903_ANALOGUE_HP_0, 7, 0, NULL, 0),
 SND_SOC_DAPM_PGA_S("HPL_ENA_OUTP", 3, WM8903_ANALOGUE_HP_0, 6, 0, NULL, 0),
-SND_SOC_DAPM_PGA_S("HPL_ENA_DLY", 1, WM8903_ANALOGUE_HP_0, 5, 0, NULL, 0),
+SND_SOC_DAPM_PGA_S("HPL_ENA_DLY", 2, WM8903_ANALOGUE_HP_0, 5, 0, NULL, 0),
+SND_SOC_DAPM_PGA_S("HPL_ENA", 1, WM8903_ANALOGUE_HP_0, 4, 0, NULL, 0),
 SND_SOC_DAPM_PGA_S("HPR_RMV_SHORT", 4, WM8903_ANALOGUE_HP_0, 3, 0, NULL, 0),
 SND_SOC_DAPM_PGA_S("HPR_ENA_OUTP", 3, WM8903_ANALOGUE_HP_0, 2, 0, NULL, 0),
-SND_SOC_DAPM_PGA_S("HPR_ENA_DLY", 1, WM8903_ANALOGUE_HP_0, 1, 0, NULL, 0),
+SND_SOC_DAPM_PGA_S("HPR_ENA_DLY", 2, WM8903_ANALOGUE_HP_0, 1, 0, NULL, 0),
+SND_SOC_DAPM_PGA_S("HPR_ENA", 1, WM8903_ANALOGUE_HP_0, 0, 0, NULL, 0),
 
 SND_SOC_DAPM_PGA_S("LINEOUTL_RMV_SHORT", 4, WM8903_ANALOGUE_LINEOUT_0, 7, 0,
                    NULL, 0),
 SND_SOC_DAPM_PGA_S("LINEOUTL_ENA_OUTP", 3, WM8903_ANALOGUE_LINEOUT_0, 6, 0,
                    NULL, 0),
-SND_SOC_DAPM_PGA_S("LINEOUTL_ENA_DLY", 1, WM8903_ANALOGUE_LINEOUT_0, 5, 0,
+SND_SOC_DAPM_PGA_S("LINEOUTL_ENA_DLY", 2, WM8903_ANALOGUE_LINEOUT_0, 5, 0,
+                   NULL, 0),
+SND_SOC_DAPM_PGA_S("LINEOUTL_ENA", 1, WM8903_ANALOGUE_LINEOUT_0, 4, 0,
                    NULL, 0),
 SND_SOC_DAPM_PGA_S("LINEOUTR_RMV_SHORT", 4, WM8903_ANALOGUE_LINEOUT_0, 3, 0,
                    NULL, 0),
 SND_SOC_DAPM_PGA_S("LINEOUTR_ENA_OUTP", 3, WM8903_ANALOGUE_LINEOUT_0, 2, 0,
                    NULL, 0),
-SND_SOC_DAPM_PGA_S("LINEOUTR_ENA_DLY", 1, WM8903_ANALOGUE_LINEOUT_0, 1, 0,
+SND_SOC_DAPM_PGA_S("LINEOUTR_ENA_DLY", 2, WM8903_ANALOGUE_LINEOUT_0, 1, 0,
+                   NULL, 0),
+SND_SOC_DAPM_PGA_S("LINEOUTR_ENA", 1, WM8903_ANALOGUE_LINEOUT_0, 0, 0,
                    NULL, 0),
 
 SND_SOC_DAPM_SUPPLY("DCS Master", WM8903_DC_SERVO_0, 4, 0, NULL, 0),
@@ -1037,10 +1041,14 @@ static const struct snd_soc_dapm_route intercon[] = {
         { "Left Speaker PGA", NULL, "Left Speaker Mixer" },
         { "Right Speaker PGA", NULL, "Right Speaker Mixer" },
 
-        { "HPL_ENA_DLY", NULL, "Left Headphone Output PGA" },
-        { "HPR_ENA_DLY", NULL, "Right Headphone Output PGA" },
-        { "LINEOUTL_ENA_DLY", NULL, "Left Line Output PGA" },
-        { "LINEOUTR_ENA_DLY", NULL, "Right Line Output PGA" },
+        { "HPL_ENA", NULL, "Left Headphone Output PGA" },
+        { "HPR_ENA", NULL, "Right Headphone Output PGA" },
+        { "HPL_ENA_DLY", NULL, "HPL_ENA" },
+        { "HPR_ENA_DLY", NULL, "HPR_ENA" },
+        { "LINEOUTL_ENA", NULL, "Left Line Output PGA" },
+        { "LINEOUTR_ENA", NULL, "Right Line Output PGA" },
+        { "LINEOUTL_ENA_DLY", NULL, "LINEOUTL_ENA" },
+        { "LINEOUTR_ENA_DLY", NULL, "LINEOUTR_ENA" },
 
         { "HPL_DCS", NULL, "DCS Master" },
         { "HPR_DCS", NULL, "DCS Master" },
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 3290333b2bb9..84e1bd1d2822 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3261,20 +3261,36 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
         wm8994_set_bias_level(codec, SND_SOC_BIAS_STANDBY);
 
         /* Latch volume updates (right only; we always do left then right). */
+        snd_soc_update_bits(codec, WM8994_AIF1_DAC1_LEFT_VOLUME,
+                            WM8994_AIF1DAC1_VU, WM8994_AIF1DAC1_VU);
         snd_soc_update_bits(codec, WM8994_AIF1_DAC1_RIGHT_VOLUME,
                             WM8994_AIF1DAC1_VU, WM8994_AIF1DAC1_VU);
+        snd_soc_update_bits(codec, WM8994_AIF1_DAC2_LEFT_VOLUME,
+                            WM8994_AIF1DAC2_VU, WM8994_AIF1DAC2_VU);
         snd_soc_update_bits(codec, WM8994_AIF1_DAC2_RIGHT_VOLUME,
                             WM8994_AIF1DAC2_VU, WM8994_AIF1DAC2_VU);
+        snd_soc_update_bits(codec, WM8994_AIF2_DAC_LEFT_VOLUME,
+                            WM8994_AIF2DAC_VU, WM8994_AIF2DAC_VU);
         snd_soc_update_bits(codec, WM8994_AIF2_DAC_RIGHT_VOLUME,
                             WM8994_AIF2DAC_VU, WM8994_AIF2DAC_VU);
+        snd_soc_update_bits(codec, WM8994_AIF1_ADC1_LEFT_VOLUME,
+                            WM8994_AIF1ADC1_VU, WM8994_AIF1ADC1_VU);
         snd_soc_update_bits(codec, WM8994_AIF1_ADC1_RIGHT_VOLUME,
                             WM8994_AIF1ADC1_VU, WM8994_AIF1ADC1_VU);
+        snd_soc_update_bits(codec, WM8994_AIF1_ADC2_LEFT_VOLUME,
+                            WM8994_AIF1ADC2_VU, WM8994_AIF1ADC2_VU);
         snd_soc_update_bits(codec, WM8994_AIF1_ADC2_RIGHT_VOLUME,
                             WM8994_AIF1ADC2_VU, WM8994_AIF1ADC2_VU);
+        snd_soc_update_bits(codec, WM8994_AIF2_ADC_LEFT_VOLUME,
+                            WM8994_AIF2ADC_VU, WM8994_AIF1ADC2_VU);
         snd_soc_update_bits(codec, WM8994_AIF2_ADC_RIGHT_VOLUME,
                             WM8994_AIF2ADC_VU, WM8994_AIF1ADC2_VU);
+        snd_soc_update_bits(codec, WM8994_DAC1_LEFT_VOLUME,
+                            WM8994_DAC1_VU, WM8994_DAC1_VU);
         snd_soc_update_bits(codec, WM8994_DAC1_RIGHT_VOLUME,
                             WM8994_DAC1_VU, WM8994_DAC1_VU);
+        snd_soc_update_bits(codec, WM8994_DAC2_LEFT_VOLUME,
+                            WM8994_DAC2_VU, WM8994_DAC2_VU);
         snd_soc_update_bits(codec, WM8994_DAC2_RIGHT_VOLUME,
                             WM8994_DAC2_VU, WM8994_DAC2_VU);
 
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index 7b6b3c18e299..4005e9af5d61 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -740,12 +740,12 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
 
         { "SPKL", "Input Switch", "MIXINL" },
         { "SPKL", "IN1LP Switch", "IN1LP" },
-        { "SPKL", "Output Switch", "Left Output Mixer" },
+        { "SPKL", "Output Switch", "Left Output PGA" },
         { "SPKL", NULL, "TOCLK" },
 
         { "SPKR", "Input Switch", "MIXINR" },
         { "SPKR", "IN1RP Switch", "IN1RP" },
-        { "SPKR", "Output Switch", "Right Output Mixer" },
+        { "SPKR", "Output Switch", "Right Output PGA" },
         { "SPKR", NULL, "TOCLK" },
 
         { "SPKL Boost", "Direct Voice Switch", "Direct Voice" },
@@ -767,8 +767,8 @@ static const struct snd_soc_dapm_route analogue_routes[] = {
         { "SPKOUTRP", NULL, "SPKR Driver" },
         { "SPKOUTRN", NULL, "SPKR Driver" },
 
-        { "Left Headphone Mux", "Mixer", "Left Output Mixer" },
-        { "Right Headphone Mux", "Mixer", "Right Output Mixer" },
+        { "Left Headphone Mux", "Mixer", "Left Output PGA" },
+        { "Right Headphone Mux", "Mixer", "Right Output PGA" },
 
         { "Headphone PGA", NULL, "Left Headphone Mux" },
         { "Headphone PGA", NULL, "Right Headphone Mux" },
diff --git a/sound/soc/mid-x86/sst_platform.c b/sound/soc/mid-x86/sst_platform.c
index b2e9198a983a..d567c322a2fb 100644
--- a/sound/soc/mid-x86/sst_platform.c
+++ b/sound/soc/mid-x86/sst_platform.c
@@ -116,18 +116,20 @@ struct snd_soc_dai_driver sst_platform_dai[] = {
 static inline void sst_set_stream_status(struct sst_runtime_stream *stream,
                                         int state)
 {
-        spin_lock(&stream->status_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&stream->status_lock, flags);
         stream->stream_status = state;
-        spin_unlock(&stream->status_lock);
+        spin_unlock_irqrestore(&stream->status_lock, flags);
 }
 
 static inline int sst_get_stream_status(struct sst_runtime_stream *stream)
 {
         int state;
+        unsigned long flags;
 
-        spin_lock(&stream->status_lock);
+        spin_lock_irqsave(&stream->status_lock, flags);
         state = stream->stream_status;
-        spin_unlock(&stream->status_lock);
+        spin_unlock_irqrestore(&stream->status_lock, flags);
         return state;
 }
 
diff --git a/sound/soc/samsung/pcm.c b/sound/soc/samsung/pcm.c
index 38aac7d57a59..9c7e8b48aed6 100644
--- a/sound/soc/samsung/pcm.c
+++ b/sound/soc/samsung/pcm.c
@@ -350,8 +350,8 @@ static int s3c_pcm_set_fmt(struct snd_soc_dai *cpu_dai,
         ctl = readl(regs + S3C_PCM_CTL);
 
         switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
-        case SND_SOC_DAIFMT_NB_NF:
-                /* Nothing to do, NB_NF by default */
+        case SND_SOC_DAIFMT_IB_NF:
+                /* Nothing to do, IB_NF by default */
                 break;
         default:
                 dev_err(pcm->dev, "Unsupported clock inversion!\n");
diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
index 0c9997e2d8c0..23c0e83d4c19 100644
--- a/sound/soc/sh/fsi.c
+++ b/sound/soc/sh/fsi.c
@@ -1200,10 +1200,11 @@ static int fsi_probe(struct platform_device *pdev)
         master->fsib.master     = master;
 
         pm_runtime_enable(&pdev->dev);
-        pm_runtime_resume(&pdev->dev);
         dev_set_drvdata(&pdev->dev, master);
 
+        pm_runtime_get_sync(&pdev->dev);
         fsi_soft_all_reset(master);
+        pm_runtime_put_sync(&pdev->dev);
 
         ret = request_irq(irq, &fsi_interrupt, IRQF_DISABLED,
                           id_entry->name, master);
@@ -1218,8 +1219,17 @@ static int fsi_probe(struct platform_device *pdev)
                 goto exit_free_irq;
         }
 
-        return snd_soc_register_dais(&pdev->dev, fsi_soc_dai, ARRAY_SIZE(fsi_soc_dai));
+        ret = snd_soc_register_dais(&pdev->dev, fsi_soc_dai,
+                                    ARRAY_SIZE(fsi_soc_dai));
+        if (ret < 0) {
+                dev_err(&pdev->dev, "cannot snd dai register\n");
+                goto exit_snd_soc;
+        }
+
+        return ret;
 
+exit_snd_soc:
+        snd_soc_unregister_platform(&pdev->dev);
 exit_free_irq:
         free_irq(irq, master);
 exit_iounmap:
@@ -1238,12 +1248,11 @@ static int fsi_remove(struct platform_device *pdev)
 
         master = dev_get_drvdata(&pdev->dev);
 
-        snd_soc_unregister_dais(&pdev->dev, ARRAY_SIZE(fsi_soc_dai));
-        snd_soc_unregister_platform(&pdev->dev);
-
+        free_irq(master->irq, master);
         pm_runtime_disable(&pdev->dev);
 
-        free_irq(master->irq, master);
+        snd_soc_unregister_dais(&pdev->dev, ARRAY_SIZE(fsi_soc_dai));
+        snd_soc_unregister_platform(&pdev->dev);
 
         iounmap(master->base);
         kfree(master);
@@ -1321,3 +1330,4 @@ module_exit(fsi_mobile_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("SuperH onchip FSI audio driver");
 MODULE_AUTHOR("Kuninori Morimoto <morimoto.kuninori@renesas.com>");
+MODULE_ALIAS("platform:fsi-pcm-audio");
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index b76b74db0968..d8562ce4de7a 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -629,6 +629,7 @@ static int soc_pcm_open(struct snd_pcm_substream *substream)
                         runtime->hw.rates |= codec_dai_drv->capture.rates;
         }
 
+        ret = -EINVAL;
         snd_pcm_limit_hw_rates(runtime);
         if (!runtime->hw.rates) {
                 printk(KERN_ERR "asoc: %s <-> %s No matching rates\n",
@@ -640,7 +641,8 @@ static int soc_pcm_open(struct snd_pcm_substream *substream)
                         codec_dai->name, cpu_dai->name);
                 goto config_err;
         }
-        if (!runtime->hw.channels_min || !runtime->hw.channels_max) {
+        if (!runtime->hw.channels_min || !runtime->hw.channels_max ||
+            runtime->hw.channels_min > runtime->hw.channels_max) {
                 printk(KERN_ERR "asoc: %s <-> %s No matching channels\n",
                                 codec_dai->name, cpu_dai->name);
                 goto config_err;
@@ -2060,6 +2062,7 @@ const struct dev_pm_ops snd_soc_pm_ops = {
         .resume = snd_soc_resume,
         .poweroff = snd_soc_poweroff,
 };
+EXPORT_SYMBOL_GPL(snd_soc_pm_ops);
 
 /* ASoC platform driver */
 static struct platform_driver soc_driver = {
diff --git a/sound/soc/tegra/harmony.c b/sound/soc/tegra/harmony.c
index 8585957477eb..556a57133925 100644
--- a/sound/soc/tegra/harmony.c
+++ b/sound/soc/tegra/harmony.c
@@ -370,6 +370,7 @@ static struct platform_driver tegra_snd_harmony_driver = {
         .driver = {
                 .name = DRV_NAME,
                 .owner = THIS_MODULE,
+                .pm = &snd_soc_pm_ops,
         },
         .probe = tegra_snd_harmony_probe,
         .remove = __devexit_p(tegra_snd_harmony_remove),
diff --git a/sound/usb/format.c b/sound/usb/format.c
index 5b792d2c8061..f079b5e2ab28 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -176,9 +176,11 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
                         if (!rate)
                                 continue;
                         /* C-Media CM6501 mislabels its 96 kHz altsetting */
+                        /* Terratec Aureon 7.1 USB C-Media 6206, too */
                         if (rate == 48000 && nr_rates == 1 &&
                             (chip->usb_id == USB_ID(0x0d8c, 0x0201) ||
-                             chip->usb_id == USB_ID(0x0d8c, 0x0102)) &&
+                             chip->usb_id == USB_ID(0x0d8c, 0x0102) ||
+                             chip->usb_id == USB_ID(0x0ccd, 0x00b1)) &&
                             fp->altsetting == 5 && fp->maxpacksize == 392)
                                 rate = 96000;
                         /* Creative VF0470 Live Cam reports 16 kHz instead of 8kHz */
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index ec07e62e53f3..1b94ec3a3368 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -533,6 +533,7 @@ int snd_usb_apply_boot_quirk(struct usb_device *dev,
 
         case USB_ID(0x0d8c, 0x0102):
                 /* C-Media CM6206 / CM106-Like Sound Device */
+        case USB_ID(0x0ccd, 0x00b1): /* Terratec Aureon 7.1 USB */
                 return snd_usb_cm6206_boot_quirk(dev);
 
         case USB_ID(0x133e, 0x0815):
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 17d1dcb3c667..416538248a4b 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -163,6 +163,7 @@ static void config_attr(struct perf_evsel *evsel, struct perf_evlist *evlist)
         struct perf_event_attr *attr = &evsel->attr;
         int track = !evsel->idx; /* only the first counter needs these */
 
+        attr->inherit           = !no_inherit;
         attr->read_format       = PERF_FORMAT_TOTAL_TIME_ENABLED |
                                   PERF_FORMAT_TOTAL_TIME_RUNNING |
                                   PERF_FORMAT_ID;
@@ -251,6 +252,9 @@ static void open_counters(struct perf_evlist *evlist)
 {
         struct perf_evsel *pos;
 
+        if (evlist->cpus->map[0] < 0)
+                no_inherit = true;
+
         list_for_each_entry(pos, &evlist->entries, node) {
                 struct perf_event_attr *attr = &pos->attr;
                 /*
@@ -271,8 +275,7 @@ static void open_counters(struct perf_evlist *evlist)
 retry_sample_id:
                 attr->sample_id_all = sample_id_all_avail ? 1 : 0;
 try_again:
-                if (perf_evsel__open(pos, evlist->cpus, evlist->threads, group,
-                                     !no_inherit) < 0) {
+                if (perf_evsel__open(pos, evlist->cpus, evlist->threads, group) < 0) {
                         int err = errno;
 
                         if (err == EPERM || err == EACCES) {
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index e2109f9b43eb..03f0e45f1479 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -167,16 +167,17 @@ static int create_perf_stat_counter(struct perf_evsel *evsel)
                 attr->read_format = PERF_FORMAT_TOTAL_TIME_ENABLED |
                                     PERF_FORMAT_TOTAL_TIME_RUNNING;
 
+        attr->inherit = !no_inherit;
+
         if (system_wide)
-                return perf_evsel__open_per_cpu(evsel, evsel_list->cpus, false, false);
+                return perf_evsel__open_per_cpu(evsel, evsel_list->cpus, false);
 
-        attr->inherit = !no_inherit;
         if (target_pid == -1 && target_tid == -1) {
                 attr->disabled = 1;
                 attr->enable_on_exec = 1;
         }
 
-        return perf_evsel__open_per_thread(evsel, evsel_list->threads, false, false);
+        return perf_evsel__open_per_thread(evsel, evsel_list->threads, false);
 }
 
 /*
diff --git a/tools/perf/builtin-test.c b/tools/perf/builtin-test.c
index 1b2106c58f66..11e3c8458362 100644
--- a/tools/perf/builtin-test.c
+++ b/tools/perf/builtin-test.c
@@ -290,7 +290,7 @@ static int test__open_syscall_event(void)
                 goto out_thread_map_delete;
         }
 
-        if (perf_evsel__open_per_thread(evsel, threads, false, false) < 0) {
+        if (perf_evsel__open_per_thread(evsel, threads, false) < 0) {
                 pr_debug("failed to open counter: %s, "
                          "tweak /proc/sys/kernel/perf_event_paranoid?\n",
                          strerror(errno));
@@ -303,7 +303,7 @@ static int test__open_syscall_event(void)
         }
 
         if (perf_evsel__read_on_cpu(evsel, 0, 0) < 0) {
-                pr_debug("perf_evsel__open_read_on_cpu\n");
+                pr_debug("perf_evsel__read_on_cpu\n");
                 goto out_close_fd;
         }
 
@@ -365,7 +365,7 @@ static int test__open_syscall_event_on_all_cpus(void)
                 goto out_thread_map_delete;
         }
 
-        if (perf_evsel__open(evsel, cpus, threads, false, false) < 0) {
+        if (perf_evsel__open(evsel, cpus, threads, false) < 0) {
                 pr_debug("failed to open counter: %s, "
                          "tweak /proc/sys/kernel/perf_event_paranoid?\n",
                          strerror(errno));
@@ -418,7 +418,7 @@ static int test__open_syscall_event_on_all_cpus(void)
                         continue;
 
                 if (perf_evsel__read_on_cpu(evsel, cpu, 0) < 0) {
-                        pr_debug("perf_evsel__open_read_on_cpu\n");
+                        pr_debug("perf_evsel__read_on_cpu\n");
                         err = -1;
                         break;
                 }
@@ -529,7 +529,7 @@ static int test__basic_mmap(void)
 
                 perf_evlist__add(evlist, evsels[i]);
 
-                if (perf_evsel__open(evsels[i], cpus, threads, false, false) < 0) {
+                if (perf_evsel__open(evsels[i], cpus, threads, false) < 0) {
                         pr_debug("failed to open counter: %s, "
                                  "tweak /proc/sys/kernel/perf_event_paranoid?\n",
                                  strerror(errno));
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index fc1273e976c5..7e3d6e310bf8 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -845,9 +845,10 @@ static void start_counters(struct perf_evlist *evlist)
                 }
 
                 attr->mmap = 1;
+                attr->inherit = inherit;
 try_again:
                 if (perf_evsel__open(counter, top.evlist->cpus,
-                                     top.evlist->threads, group, inherit) < 0) {
+                                     top.evlist->threads, group) < 0) {
                         int err = errno;
 
                         if (err == EPERM || err == EACCES) {
diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c
index 9fea75535221..96bee5c46008 100644
--- a/tools/perf/util/cgroup.c
+++ b/tools/perf/util/cgroup.c
@@ -13,7 +13,7 @@ cgroupfs_find_mountpoint(char *buf, size_t maxlen)
 {
         FILE *fp;
         char mountpoint[MAX_PATH+1], tokens[MAX_PATH+1], type[MAX_PATH+1];
-        char *token, *saved_ptr;
+        char *token, *saved_ptr = NULL;
         int found = 0;
 
         fp = fopen("/proc/mounts", "r");
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index d852cefa20de..45da8d186b49 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -12,6 +12,7 @@
 #include "evlist.h"
 #include "evsel.h"
 #include "util.h"
+#include "debug.h"
 
 #include <sys/mman.h>
 
@@ -250,15 +251,19 @@ int perf_evlist__alloc_mmap(struct perf_evlist *evlist)
         return evlist->mmap != NULL ? 0 : -ENOMEM;
 }
 
-static int __perf_evlist__mmap(struct perf_evlist *evlist, int cpu, int prot,
-                               int mask, int fd)
+static int __perf_evlist__mmap(struct perf_evlist *evlist, struct perf_evsel *evsel,
+                               int cpu, int prot, int mask, int fd)
 {
         evlist->mmap[cpu].prev = 0;
         evlist->mmap[cpu].mask = mask;
         evlist->mmap[cpu].base = mmap(NULL, evlist->mmap_len, prot,
                                       MAP_SHARED, fd, 0);
-        if (evlist->mmap[cpu].base == MAP_FAILED)
+        if (evlist->mmap[cpu].base == MAP_FAILED) {
+                if (evlist->cpus->map[cpu] == -1 && evsel->attr.inherit)
+                        ui__warning("Inherit is not allowed on per-task "
+                                    "events using mmap.\n");
                 return -1;
+        }
 
         perf_evlist__add_pollfd(evlist, fd);
         return 0;
@@ -312,7 +317,8 @@ int perf_evlist__mmap(struct perf_evlist *evlist, int pages, bool overwrite)
                                         if (ioctl(fd, PERF_EVENT_IOC_SET_OUTPUT,
                                                   FD(first_evsel, cpu, 0)) != 0)
                                                 goto out_unmap;
-                                } else if (__perf_evlist__mmap(evlist, cpu, prot, mask, fd) < 0)
+                                } else if (__perf_evlist__mmap(evlist, evsel, cpu,
+                                                               prot, mask, fd) < 0)
                                         goto out_unmap;
 
                                 if ((evsel->attr.read_format & PERF_FORMAT_ID) &&
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 662596afd7f1..d6fd59beb860 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -175,7 +175,7 @@ int __perf_evsel__read(struct perf_evsel *evsel,
 }
 
 static int __perf_evsel__open(struct perf_evsel *evsel, struct cpu_map *cpus,
-                              struct thread_map *threads, bool group, bool inherit)
+                              struct thread_map *threads, bool group)
 {
         int cpu, thread;
         unsigned long flags = 0;
@@ -192,19 +192,6 @@ static int __perf_evsel__open(struct perf_evsel *evsel, struct cpu_map *cpus,
 
         for (cpu = 0; cpu < cpus->nr; cpu++) {
                 int group_fd = -1;
-                /*
-                 * Don't allow mmap() of inherited per-task counters. This
-                 * would create a performance issue due to all children writing
-                 * to the same buffer.
-                 *
-                 * FIXME:
-                 * Proper fix is not to pass 'inherit' to perf_evsel__open*,
-                 * but a 'flags' parameter, with 'group' folded there as well,
-                 * then introduce a PERF_O_{MMAP,GROUP,INHERIT} enum, and if
-                 * O_MMAP is set, emit a warning if cpu < 0 and O_INHERIT is
-                 * set. Lets go for the minimal fix first tho.
-                 */
-                evsel->attr.inherit = (cpus->map[cpu] >= 0) && inherit;
 
                 for (thread = 0; thread < threads->nr; thread++) {
 
@@ -253,7 +240,7 @@ static struct {
 };
 
 int perf_evsel__open(struct perf_evsel *evsel, struct cpu_map *cpus,
-                     struct thread_map *threads, bool group, bool inherit)
+                     struct thread_map *threads, bool group)
 {
         if (cpus == NULL) {
                 /* Work around old compiler warnings about strict aliasing */
@@ -263,19 +250,19 @@ int perf_evsel__open(struct perf_evsel *evsel, struct cpu_map *cpus,
         if (threads == NULL)
                 threads = &empty_thread_map.map;
 
-        return __perf_evsel__open(evsel, cpus, threads, group, inherit);
+        return __perf_evsel__open(evsel, cpus, threads, group);
 }
 
 int perf_evsel__open_per_cpu(struct perf_evsel *evsel,
-                             struct cpu_map *cpus, bool group, bool inherit)
+                             struct cpu_map *cpus, bool group)
 {
-        return __perf_evsel__open(evsel, cpus, &empty_thread_map.map, group, inherit);
+        return __perf_evsel__open(evsel, cpus, &empty_thread_map.map, group);
 }
 
 int perf_evsel__open_per_thread(struct perf_evsel *evsel,
-                                struct thread_map *threads, bool group, bool inherit)
+                                struct thread_map *threads, bool group)
 {
-        return __perf_evsel__open(evsel, &empty_cpu_map.map, threads, group, inherit);
+        return __perf_evsel__open(evsel, &empty_cpu_map.map, threads, group);
 }
 
 static int perf_event__parse_id_sample(const union perf_event *event, u64 type,
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index 6710ab538342..f79bb2c09a6c 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -81,11 +81,11 @@ void perf_evsel__free_id(struct perf_evsel *evsel);
 void perf_evsel__close_fd(struct perf_evsel *evsel, int ncpus, int nthreads);
 
 int perf_evsel__open_per_cpu(struct perf_evsel *evsel,
-                             struct cpu_map *cpus, bool group, bool inherit);
+                             struct cpu_map *cpus, bool group);
 int perf_evsel__open_per_thread(struct perf_evsel *evsel,
-                                struct thread_map *threads, bool group, bool inherit);
+                                struct thread_map *threads, bool group);
 int perf_evsel__open(struct perf_evsel *evsel, struct cpu_map *cpus,
-                     struct thread_map *threads, bool group, bool inherit);
+                     struct thread_map *threads, bool group);
 
 #define perf_evsel__match(evsel, t, c)          \
         (evsel->attr.type == PERF_TYPE_##t &&   \
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index a9f2d7e1204d..f5e38451fdc5 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -498,11 +498,11 @@ static PyObject *pyrf_evsel__open(struct pyrf_evsel *pevsel,
         struct cpu_map *cpus = NULL;
         struct thread_map *threads = NULL;
         PyObject *pcpus = NULL, *pthreads = NULL;
-        int group = 0, overwrite = 0;
-        static char *kwlist[] = {"cpus", "threads", "group", "overwrite", NULL, NULL};
+        int group = 0, inherit = 0;
+        static char *kwlist[] = {"cpus", "threads", "group", "inherit", NULL, NULL};
 
         if (!PyArg_ParseTupleAndKeywords(args, kwargs, "|OOii", kwlist,
-                                         &pcpus, &pthreads, &group, &overwrite))
+                                         &pcpus, &pthreads, &group, &inherit))
                 return NULL;
 
         if (pthreads != NULL)
@@ -511,7 +511,8 @@ static PyObject *pyrf_evsel__open(struct pyrf_evsel *pevsel,
         if (pcpus != NULL)
                 cpus = ((struct pyrf_cpu_map *)pcpus)->cpus;
 
-        if (perf_evsel__open(evsel, cpus, threads, group, overwrite) < 0) {
+        evsel->attr.inherit = inherit;
+        if (perf_evsel__open(evsel, cpus, threads, group) < 0) {
                 PyErr_SetFromErrno(PyExc_OSError);
                 return NULL;
         }
diff --git a/tools/perf/util/ui/browsers/annotate.c b/tools/perf/util/ui/browsers/annotate.c
index 8c17a8730e4a..15633d608133 100644
--- a/tools/perf/util/ui/browsers/annotate.c
+++ b/tools/perf/util/ui/browsers/annotate.c
@@ -256,10 +256,9 @@ int symbol__tui_annotate(struct symbol *sym, struct map *map, int evidx,
                          int refresh)
 {
         struct objdump_line *pos, *n;
-        struct annotation *notes = symbol__annotation(sym);
+        struct annotation *notes;
         struct annotate_browser browser = {
                 .b = {
-                        .entries = &notes->src->source,
                         .refresh = ui_browser__list_head_refresh,
                         .seek    = ui_browser__list_head_seek,
                         .write   = annotate_browser__write,
@@ -281,6 +280,8 @@ int symbol__tui_annotate(struct symbol *sym, struct map *map, int evidx,
 
         ui_helpline__push("Press <- or ESC to exit");
 
+        notes = symbol__annotation(sym);
+
         list_for_each_entry(pos, &notes->src->source, node) {
                 struct objdump_line_rb_node *rbpos;
                 size_t line_len = strlen(pos->line);
@@ -291,6 +292,7 @@ int symbol__tui_annotate(struct symbol *sym, struct map *map, int evidx,
                 rbpos->idx = browser.b.nr_entries++;
         }
 
+        browser.b.entries = &notes->src->source,
         browser.b.width += 18; /* Percentage */
         ret = annotate_browser__run(&browser, evidx, refresh);
         list_for_each_entry_safe(pos, n, &notes->src->source, node) {
diff --git a/tools/perf/util/ui/browsers/hists.c b/tools/perf/util/ui/browsers/hists.c
index 798efdca3ead..5d767c622dfc 100644
--- a/tools/perf/util/ui/browsers/hists.c
+++ b/tools/perf/util/ui/browsers/hists.c
@@ -851,7 +851,7 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel,
                         goto out_free_stack;
                 case 'a':
                         if (browser->selection == NULL ||
-                            browser->selection->map == NULL ||
+                            browser->selection->sym == NULL ||
                             browser->selection->map->dso->annotate_warned)
                                 continue;
                         goto do_annotate;