682 files changed, 10656 insertions, 6309 deletions

diff --git a/CREDITS b/CREDITS
index 2b88fb37ad50..e76d300e9fe4 100644
--- a/CREDITS
+++ b/CREDITS
@@ -1856,7 +1856,7 @@ E: rfkoenig@immd4.informatik.uni-erlangen.de
 D: The Linux Support Team Erlangen
 
 N: Andreas Koensgen
-E: ajk@iehk.rwth-aachen.de
+E: ajk@comnets.uni-bremen.de
 D: 6pack driver for AX.25
 
 N: Harald Koerfgen
diff --git a/Documentation/RCU/rculist_nulls.txt b/Documentation/RCU/rculist_nulls.txt
index 93cb28d05dcd..18f9651ff23d 100644
--- a/Documentation/RCU/rculist_nulls.txt
+++ b/Documentation/RCU/rculist_nulls.txt
@@ -83,11 +83,12 @@ not detect it missed following items in original chain.
 obj = kmem_cache_alloc(...);
 lock_chain(); // typically a spin_lock()
 obj->key = key;
-atomic_inc(&obj->refcnt);
 /*
  * we need to make sure obj->key is updated before obj->next
+ * or obj->refcnt
  */
 smp_wmb();
+atomic_set(&obj->refcnt, 1);
 hlist_add_head_rcu(&obj->obj_node, list);
 unlock_chain(); // typically a spin_unlock()
 
@@ -159,6 +160,10 @@ out:
 obj = kmem_cache_alloc(cachep);
 lock_chain(); // typically a spin_lock()
 obj->key = key;
+/*
+ * changes to obj->key must be visible before refcnt one
+ */
+smp_wmb();
 atomic_set(&obj->refcnt, 1);
 /*
  * insert obj in RCU way (readers might be traversing chain)
diff --git a/Documentation/connector/cn_test.c b/Documentation/connector/cn_test.c
index f688eba87704..6a5be5d5c8e4 100644
--- a/Documentation/connector/cn_test.c
+++ b/Documentation/connector/cn_test.c
@@ -1,7 +1,7 @@
 /*
  *      cn_test.c
  * 
- * 2004-2005 Copyright (c) Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * 2004+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
  * All rights reserved.
  * 
  * This program is free software; you can redistribute it and/or modify
@@ -194,5 +194,5 @@ module_init(cn_test_init);
 module_exit(cn_test_fini);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Connector's test module");
diff --git a/Documentation/connector/ucon.c b/Documentation/connector/ucon.c
index d738cde2a8d5..c5092ad0ce4b 100644
--- a/Documentation/connector/ucon.c
+++ b/Documentation/connector/ucon.c
@@ -1,7 +1,7 @@
 /*
  *      ucon.c
  *
- * Copyright (c) 2004+ Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004+ Evgeniy Polyakov <zbr@ioremap.net>
  *
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/Documentation/driver-model/driver.txt b/Documentation/driver-model/driver.txt
index 82132169d47a..60120fb3b961 100644
--- a/Documentation/driver-model/driver.txt
+++ b/Documentation/driver-model/driver.txt
@@ -207,8 +207,8 @@ Attributes
 ~~~~~~~~~~
 struct driver_attribute {
         struct attribute        attr;
-        ssize_t (*show)(struct device_driver *, char * buf, size_t count, loff_t off);
-        ssize_t (*store)(struct device_driver *, const char * buf, size_t count, loff_t off);
+        ssize_t (*show)(struct device_driver *driver, char *buf);
+        ssize_t (*store)(struct device_driver *, const char * buf, size_t count);
 };
 
 Device drivers can export attributes via their sysfs directories. 
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index d77fbd8b79ac..dd1a6d4bb747 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1720,8 +1720,8 @@ and is between 256 and 4096 characters. It is defined in the file
         oprofile.cpu_type=      Force an oprofile cpu type
                         This might be useful if you have an older oprofile
                         userland or if you want common events.
-                        Format: { archperfmon }
-                        archperfmon: [X86] Force use of architectural
+                        Format: { arch_perfmon }
+                        arch_perfmon: [X86] Force use of architectural
                                 perfmon on Intel CPUs instead of the
                                 CPU specific event set.
 
diff --git a/Documentation/networking/6pack.txt b/Documentation/networking/6pack.txt
index d0777a1200e1..8f339428fdf4 100644
--- a/Documentation/networking/6pack.txt
+++ b/Documentation/networking/6pack.txt
@@ -1,7 +1,7 @@
 This is the 6pack-mini-HOWTO, written by
 
 Andreas Könsgen DG3KQ
-Internet: ajk@iehk.rwth-aachen.de
+Internet: ajk@comnets.uni-bremen.de
 AMPR-net: dg3kq@db0pra.ampr.org
 AX.25:    dg3kq@db0ach.#nrw.deu.eu
 
diff --git a/Documentation/scheduler/sched-rt-group.txt b/Documentation/scheduler/sched-rt-group.txt
index 1df7f9cdab05..86eabe6c3419 100644
--- a/Documentation/scheduler/sched-rt-group.txt
+++ b/Documentation/scheduler/sched-rt-group.txt
@@ -73,7 +73,7 @@ The remaining CPU time will be used for user input and other tasks. Because
 realtime tasks have explicitly allocated the CPU time they need to perform
 their tasks, buffer underruns in the graphics or audio can be eliminated.
 
-NOTE: the above example is not fully implemented as of yet (2.6.25). We still
+NOTE: the above example is not fully implemented yet. We still
 lack an EDF scheduler to make non-uniform periods usable.
 
 
@@ -140,14 +140,15 @@ The other option is:
 
 .o CONFIG_CGROUP_SCHED (aka "Basis for grouping tasks" = "Control groups")
 
-This uses the /cgroup virtual file system and "/cgroup/<cgroup>/cpu.rt_runtime_us"
-to control the CPU time reserved for each control group instead.
+This uses the /cgroup virtual file system and
+"/cgroup/<cgroup>/cpu.rt_runtime_us" to control the CPU time reserved for each
+control group instead.
 
 For more information on working with control groups, you should read
 Documentation/cgroups/cgroups.txt as well.
 
-Group settings are checked against the following limits in order to keep the configuration
-schedulable:
+Group settings are checked against the following limits in order to keep the
+configuration schedulable:
 
    \Sum_{i} runtime_{i} / global_period <= global_runtime / global_period
 
@@ -189,7 +190,7 @@ Implementing SCHED_EDF might take a while to complete. Priority Inheritance is
 the biggest challenge as the current linux PI infrastructure is geared towards
 the limited static priority levels 0-99. With deadline scheduling you need to
 do deadline inheritance (since priority is inversely proportional to the
-deadline delta (deadline - now).
+deadline delta (deadline - now)).
 
 This means the whole PI machinery will have to be reworked - and that is one of
 the most complex pieces of code we have.
diff --git a/Documentation/x86/00-INDEX b/Documentation/x86/00-INDEX
index dbe3377754af..f37b46d34861 100644
--- a/Documentation/x86/00-INDEX
+++ b/Documentation/x86/00-INDEX
@@ -2,3 +2,5 @@
         - this file
 mtrr.txt
         - how to use x86 Memory Type Range Registers to increase performance
+exception-tables.txt
+        - why and how Linux kernel uses exception tables on x86
diff --git a/Documentation/exception.txt b/Documentation/x86/exception-tables.txt
index 2d5aded64247..32901aa36f0a 100644
--- a/Documentation/exception.txt
+++ b/Documentation/x86/exception-tables.txt
@@ -1,123 +1,123 @@
-     Kernel level exception handling in Linux 2.1.8
+     Kernel level exception handling in Linux
   Commentary by Joerg Pommnitz <joerg@raleigh.ibm.com>
 
-When a process runs in kernel mode, it often has to access user 
-mode memory whose address has been passed by an untrusted program. 
+When a process runs in kernel mode, it often has to access user
+mode memory whose address has been passed by an untrusted program.
 To protect itself the kernel has to verify this address.
 
-In older versions of Linux this was done with the 
-int verify_area(int type, const void * addr, unsigned long size) 
+In older versions of Linux this was done with the
+int verify_area(int type, const void * addr, unsigned long size)
 function (which has since been replaced by access_ok()).
 
-This function verified that the memory area starting at address 
+This function verified that the memory area starting at address
 'addr' and of size 'size' was accessible for the operation specified
-in type (read or write). To do this, verify_read had to look up the 
-virtual memory area (vma) that contained the address addr. In the 
-normal case (correctly working program), this test was successful. 
+in type (read or write). To do this, verify_read had to look up the
+virtual memory area (vma) that contained the address addr. In the
+normal case (correctly working program), this test was successful.
 It only failed for a few buggy programs. In some kernel profiling
 tests, this normally unneeded verification used up a considerable
 amount of time.
 
-To overcome this situation, Linus decided to let the virtual memory 
+To overcome this situation, Linus decided to let the virtual memory
 hardware present in every Linux-capable CPU handle this test.
 
 How does this work?
 
-Whenever the kernel tries to access an address that is currently not 
-accessible, the CPU generates a page fault exception and calls the 
-page fault handler 
+Whenever the kernel tries to access an address that is currently not
+accessible, the CPU generates a page fault exception and calls the
+page fault handler
 
 void do_page_fault(struct pt_regs *regs, unsigned long error_code)
 
-in arch/i386/mm/fault.c. The parameters on the stack are set up by 
-the low level assembly glue in arch/i386/kernel/entry.S. The parameter
-regs is a pointer to the saved registers on the stack, error_code 
+in arch/x86/mm/fault.c. The parameters on the stack are set up by
+the low level assembly glue in arch/x86/kernel/entry_32.S. The parameter
+regs is a pointer to the saved registers on the stack, error_code
 contains a reason code for the exception.
 
-do_page_fault first obtains the unaccessible address from the CPU 
-control register CR2. If the address is within the virtual address 
-space of the process, the fault probably occurred, because the page 
-was not swapped in, write protected or something similar. However, 
-we are interested in the other case: the address is not valid, there 
-is no vma that contains this address. In this case, the kernel jumps 
-to the bad_area label. 
-
-There it uses the address of the instruction that caused the exception 
-(i.e. regs->eip) to find an address where the execution can continue 
-(fixup). If this search is successful, the fault handler modifies the 
-return address (again regs->eip) and returns. The execution will 
+do_page_fault first obtains the unaccessible address from the CPU
+control register CR2. If the address is within the virtual address
+space of the process, the fault probably occurred, because the page
+was not swapped in, write protected or something similar. However,
+we are interested in the other case: the address is not valid, there
+is no vma that contains this address. In this case, the kernel jumps
+to the bad_area label.
+
+There it uses the address of the instruction that caused the exception
+(i.e. regs->eip) to find an address where the execution can continue
+(fixup). If this search is successful, the fault handler modifies the
+return address (again regs->eip) and returns. The execution will
 continue at the address in fixup.
 
 Where does fixup point to?
 
-Since we jump to the contents of fixup, fixup obviously points 
-to executable code. This code is hidden inside the user access macros. 
-I have picked the get_user macro defined in include/asm/uaccess.h as an
-example. The definition is somewhat hard to follow, so let's peek at 
+Since we jump to the contents of fixup, fixup obviously points
+to executable code. This code is hidden inside the user access macros.
+I have picked the get_user macro defined in arch/x86/include/asm/uaccess.h
+as an example. The definition is somewhat hard to follow, so let's peek at
 the code generated by the preprocessor and the compiler. I selected
-the get_user call in drivers/char/console.c for a detailed examination.
+the get_user call in drivers/char/sysrq.c for a detailed examination.
 
-The original code in console.c line 1405:
+The original code in sysrq.c line 587:
         get_user(c, buf);
 
 The preprocessor output (edited to become somewhat readable):
 
 (
-  {        
-    long __gu_err = - 14 , __gu_val = 0;        
-    const __typeof__(*( (  buf ) )) *__gu_addr = ((buf));        
-    if (((((0 + current_set[0])->tss.segment) == 0x18 )  || 
-       (((sizeof(*(buf))) <= 0xC0000000UL) && 
-       ((unsigned long)(__gu_addr ) <= 0xC0000000UL - (sizeof(*(buf)))))))        
+  {
+    long __gu_err = - 14 , __gu_val = 0;
+    const __typeof__(*( (  buf ) )) *__gu_addr = ((buf));
+    if (((((0 + current_set[0])->tss.segment) == 0x18 )  ||
+       (((sizeof(*(buf))) <= 0xC0000000UL) &&
+       ((unsigned long)(__gu_addr ) <= 0xC0000000UL - (sizeof(*(buf)))))))
       do {
-        __gu_err  = 0;        
-        switch ((sizeof(*(buf)))) {        
-          case 1: 
-            __asm__ __volatile__(        
-              "1:      mov" "b" " %2,%" "b" "1\n"        
-              "2:\n"        
-              ".section .fixup,\"ax\"\n"        
-              "3:      movl %3,%0\n"        
-              "        xor" "b" " %" "b" "1,%" "b" "1\n"        
-              "        jmp 2b\n"        
-              ".section __ex_table,\"a\"\n"        
-              "        .align 4\n"        
-              "        .long 1b,3b\n"        
+        __gu_err  = 0;
+        switch ((sizeof(*(buf)))) {
+          case 1:
+            __asm__ __volatile__(
+              "1:      mov" "b" " %2,%" "b" "1\n"
+              "2:\n"
+              ".section .fixup,\"ax\"\n"
+              "3:      movl %3,%0\n"
+              "        xor" "b" " %" "b" "1,%" "b" "1\n"
+              "        jmp 2b\n"
+              ".section __ex_table,\"a\"\n"
+              "        .align 4\n"
+              "        .long 1b,3b\n"
               ".text"        : "=r"(__gu_err), "=q" (__gu_val): "m"((*(struct __large_struct *)
-                            (   __gu_addr   )) ), "i"(- 14 ), "0"(  __gu_err  )) ; 
-              break;        
-          case 2: 
+                            (   __gu_addr   )) ), "i"(- 14 ), "0"(  __gu_err  )) ;
+              break;
+          case 2:
             __asm__ __volatile__(
-              "1:      mov" "w" " %2,%" "w" "1\n"        
-              "2:\n"        
-              ".section .fixup,\"ax\"\n"        
-              "3:      movl %3,%0\n"        
-              "        xor" "w" " %" "w" "1,%" "w" "1\n"        
-              "        jmp 2b\n"        
-              ".section __ex_table,\"a\"\n"        
-              "        .align 4\n"        
-              "        .long 1b,3b\n"        
+              "1:      mov" "w" " %2,%" "w" "1\n"
+              "2:\n"
+              ".section .fixup,\"ax\"\n"
+              "3:      movl %3,%0\n"
+              "        xor" "w" " %" "w" "1,%" "w" "1\n"
+              "        jmp 2b\n"
+              ".section __ex_table,\"a\"\n"
+              "        .align 4\n"
+              "        .long 1b,3b\n"
               ".text"        : "=r"(__gu_err), "=r" (__gu_val) : "m"((*(struct __large_struct *)
-                            (   __gu_addr   )) ), "i"(- 14 ), "0"(  __gu_err  )); 
-              break;        
-          case 4: 
-            __asm__ __volatile__(        
-              "1:      mov" "l" " %2,%" "" "1\n"        
-              "2:\n"        
-              ".section .fixup,\"ax\"\n"        
-              "3:      movl %3,%0\n"        
-              "        xor" "l" " %" "" "1,%" "" "1\n"        
-              "        jmp 2b\n"        
-              ".section __ex_table,\"a\"\n"        
-              "        .align 4\n"        "        .long 1b,3b\n"        
+                            (   __gu_addr   )) ), "i"(- 14 ), "0"(  __gu_err  ));
+              break;
+          case 4:
+            __asm__ __volatile__(
+              "1:      mov" "l" " %2,%" "" "1\n"
+              "2:\n"
+              ".section .fixup,\"ax\"\n"
+              "3:      movl %3,%0\n"
+              "        xor" "l" " %" "" "1,%" "" "1\n"
+              "        jmp 2b\n"
+              ".section __ex_table,\"a\"\n"
+              "        .align 4\n"        "        .long 1b,3b\n"
               ".text"        : "=r"(__gu_err), "=r" (__gu_val) : "m"((*(struct __large_struct *)
-                            (   __gu_addr   )) ), "i"(- 14 ), "0"(__gu_err)); 
-              break;        
-          default: 
-            (__gu_val) = __get_user_bad();        
-        }        
-      } while (0) ;        
-    ((c)) = (__typeof__(*((buf))))__gu_val;        
+                            (   __gu_addr   )) ), "i"(- 14 ), "0"(__gu_err));
+              break;
+          default:
+            (__gu_val) = __get_user_bad();
+        }
+      } while (0) ;
+    ((c)) = (__typeof__(*((buf))))__gu_val;
     __gu_err;
   }
 );
@@ -127,12 +127,12 @@ see what code gcc generates:
 
  >         xorl %edx,%edx
  >         movl current_set,%eax
- >         cmpl $24,788(%eax)        
- >         je .L1424        
+ >         cmpl $24,788(%eax)
+ >         je .L1424
  >         cmpl $-1073741825,64(%esp)
- >         ja .L1423                
+ >         ja .L1423
  > .L1424:
- >         movl %edx,%eax                        
+ >         movl %edx,%eax
  >         movl 64(%esp),%ebx
  > #APP
  > 1:      movb (%ebx),%dl                /* this is the actual user access */
@@ -149,17 +149,17 @@ see what code gcc generates:
  > .L1423:
  >         movzbl %dl,%esi
 
-The optimizer does a good job and gives us something we can actually 
-understand. Can we? The actual user access is quite obvious. Thanks 
-to the unified address space we can just access the address in user 
+The optimizer does a good job and gives us something we can actually
+understand. Can we? The actual user access is quite obvious. Thanks
+to the unified address space we can just access the address in user
 memory. But what does the .section stuff do?????
 
 To understand this we have to look at the final kernel:
 
  > objdump --section-headers vmlinux
- > 
+ >
  > vmlinux:     file format elf32-i386
- > 
+ >
  > Sections:
  > Idx Name          Size      VMA       LMA       File off  Algn
  >   0 .text         00098f40  c0100000  c0100000  00001000  2**4
@@ -198,18 +198,18 @@ final kernel executable:
 
 The whole user memory access is reduced to 10 x86 machine instructions.
 The instructions bracketed in the .section directives are no longer
-in the normal execution path. They are located in a different section 
+in the normal execution path. They are located in a different section
 of the executable file:
 
  > objdump --disassemble --section=.fixup vmlinux
- > 
+ >
  > c0199ff5 <.fixup+10b5> movl   $0xfffffff2,%eax
  > c0199ffa <.fixup+10ba> xorb   %dl,%dl
  > c0199ffc <.fixup+10bc> jmp    c017e7a7 <do_con_write+e3>
 
 And finally:
  > objdump --full-contents --section=__ex_table vmlinux
- > 
+ >
  >  c01aa7c4 93c017c0 e09f19c0 97c017c0 99c017c0  ................
  >  c01aa7d4 f6c217c0 e99f19c0 a5e717c0 f59f19c0  ................
  >  c01aa7e4 080a18c0 01a019c0 0a0a18c0 04a019c0  ................
@@ -235,8 +235,8 @@ sections in the ELF object file. So the instructions
 ended up in the .fixup section of the object file and the addresses
         .long 1b,3b
 ended up in the __ex_table section of the object file. 1b and 3b
-are local labels. The local label 1b (1b stands for next label 1 
-backward) is the address of the instruction that might fault, i.e. 
+are local labels. The local label 1b (1b stands for next label 1
+backward) is the address of the instruction that might fault, i.e.
 in our case the address of the label 1 is c017e7a5:
 the original assembly code: > 1:      movb (%ebx),%dl
 and linked in vmlinux     : > c017e7a5 <do_con_write+e1> movb   (%ebx),%dl
@@ -254,7 +254,7 @@ The assembly code
 becomes the value pair
  >  c01aa7d4 c017c2f6 c0199fe9 c017e7a5 c0199ff5  ................
                                ^this is ^this is
-                               1b       3b 
+                               1b       3b
 c017e7a5,c0199ff5 in the exception table of the kernel.
 
 So, what actually happens if a fault from kernel mode with no suitable
@@ -266,9 +266,9 @@ vma occurs?
 3.) CPU calls do_page_fault
 4.) do page fault calls search_exception_table (regs->eip == c017e7a5);
 5.) search_exception_table looks up the address c017e7a5 in the
-    exception table (i.e. the contents of the ELF section __ex_table) 
+    exception table (i.e. the contents of the ELF section __ex_table)
     and returns the address of the associated fault handle code c0199ff5.
-6.) do_page_fault modifies its own return address to point to the fault 
+6.) do_page_fault modifies its own return address to point to the fault
     handle code and returns.
 7.) execution continues in the fault handling code.
 8.) 8a) EAX becomes -EFAULT (== -14)
diff --git a/MAINTAINERS b/MAINTAINERS
index e4b1a3d596cc..ebc269152faf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -150,7 +150,7 @@ F:	drivers/scsi/53c700*
 
 6PACK NETWORK DRIVER FOR AX.25
 P:      Andreas Koensgen
-M:      ajk@iehk.rwth-aachen.de
+M:      ajk@comnets.uni-bremen.de
 L:      linux-hams@vger.kernel.org
 S:      Maintained
 F:      drivers/net/hamradio/6pack.c
@@ -1612,6 +1612,13 @@ S:	Supported
 F:      fs/configfs/
 F:      include/linux/configfs.h
 
+CONNECTOR
+P:      Evgeniy Polyakov
+M:      zbr@ioremap.net
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/connector/
+
 CONTROL GROUPS (CGROUPS)
 P:      Paul Menage
 M:      menage@google.com
@@ -3287,11 +3294,11 @@ F:	include/linux/ivtv*
 
 JFS FILESYSTEM
 P:      Dave Kleikamp
-M:      shaggy@austin.ibm.com
+M:      shaggy@linux.vnet.ibm.com
 L:      jfs-discussion@lists.sourceforge.net
 W:      http://jfs.sourceforge.net/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6.git
-S:      Supported
+S:      Maintained
 F:      Documentation/filesystems/jfs.txt
 F:      fs/jfs/
 
@@ -4089,6 +4096,7 @@ L:	netfilter@vger.kernel.org
 L:      coreteam@netfilter.org
 W:      http://www.netfilter.org/
 W:      http://www.iptables.org/
+T:      git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.git
 S:      Supported
 F:      include/linux/netfilter*
 F:      include/linux/netfilter/
@@ -4407,7 +4415,7 @@ W:	http://www.nongnu.org/orinoco/
 S:      Maintained
 F:      drivers/net/wireless/orinoco/
 
-OSD LIBRARY
+OSD LIBRARY and FILESYSTEM
 P:      Boaz Harrosh
 M:      bharrosh@panasas.com
 P:      Benny Halevy
@@ -4416,6 +4424,9 @@ L:	osd-dev@open-osd.org
 W:      http://open-osd.org
 T:      git git://git.open-osd.org/open-osd.git
 S:      Maintained
+F:      drivers/scsi/osd/
+F:      drivers/include/scsi/osd_*
+F:      fs/exofs/
 
 P54 WIRELESS DRIVER
 P:      Michael Wu
@@ -5583,7 +5594,6 @@ S:	Odd Fixes
 F:      drivers/net/starfire*
 
 STARMODE RADIO IP (STRIP) PROTOCOL DRIVER
-W:      http://mosquitonet.Stanford.EDU/strip.html
 S:      Orphan
 F:      drivers/net/wireless/strip.c
 F:      include/linux/if_strip.h
@@ -5851,7 +5861,7 @@ UBI FILE SYSTEM (UBIFS)
 P:      Artem Bityutskiy
 M:      dedekind@infradead.org
 P:      Adrian Hunter
-M:      ext-adrian.hunter@nokia.com
+M:      adrian.hunter@nokia.com
 L:      linux-mtd@lists.infradead.org
 T:      git git://git.infradead.org/ubifs-2.6.git
 W:      http://www.linux-mtd.infradead.org/doc/ubifs.html
diff --git a/Makefile b/Makefile
index 0aeec59c1f0a..79957b338770 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 31
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Man-Eating Seals of Antiquity
 
 # *DOCUMENTATION*
@@ -343,7 +343,8 @@ KBUILD_CPPFLAGS := -D__KERNEL__
 KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
                    -fno-strict-aliasing -fno-common \
                    -Werror-implicit-function-declaration \
-                   -Wno-format-security
+                   -Wno-format-security \
+                   -fno-delete-null-pointer-checks
 KBUILD_AFLAGS   := -D__ASSEMBLY__
 
 # Read KERNELRELEASE from include/config/kernel.release (if it exists)
@@ -565,7 +566,7 @@ KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
 KBUILD_CFLAGS += $(call cc-option,-Wno-pointer-sign,)
 
 # disable invalid "can't wrap" optimizations for signed / pointers
-KBUILD_CFLAGS   += $(call cc-option,-fwrapv)
+KBUILD_CFLAGS   += $(call cc-option,-fno-strict-overflow)
 
 # revert to pre-gcc-4.4 behaviour of .eh_frame
 KBUILD_CFLAGS   += $(call cc-option,-fno-dwarf2-cfi-asm)
diff --git a/arch/alpha/include/asm/thread_info.h b/arch/alpha/include/asm/thread_info.h
index d069526bd767..60c83abfde70 100644
--- a/arch/alpha/include/asm/thread_info.h
+++ b/arch/alpha/include/asm/thread_info.h
@@ -37,6 +37,7 @@ struct thread_info {
         .task           = &tsk,                 \
         .exec_domain    = &default_exec_domain, \
         .addr_limit     = KERNEL_DS,            \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
         },                                      \
diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
index 1e9ad52c460e..e072041d19f8 100644
--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -8,7 +8,6 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
diff --git a/arch/arm/configs/u300_defconfig b/arch/arm/configs/u300_defconfig
index 4762d9001298..7d61ae6e75da 100644
--- a/arch/arm/configs/u300_defconfig
+++ b/arch/arm/configs/u300_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.31-rc1
-# Thu Jul  2 00:16:59 2009
+# Linux kernel version: 2.6.31-rc3
+# Thu Jul 16 23:36:10 2009
 #
 CONFIG_ARM=y
 CONFIG_SYS_SUPPORTS_APM_EMULATION=y
@@ -9,7 +9,6 @@ CONFIG_GENERIC_GPIO=y
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_MMU=y
-CONFIG_HAVE_TCM=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_HAVE_LATENCYTOP_SUPPORT=y
@@ -113,7 +112,7 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_BLOCK=y
-CONFIG_LBDAF=y
+# CONFIG_LBDAF is not set
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -542,13 +541,14 @@ CONFIG_INPUT_EVDEV=y
 #
 CONFIG_INPUT_KEYBOARD=y
 # CONFIG_KEYBOARD_ATKBD is not set
-# CONFIG_KEYBOARD_SUNKBD is not set
 # CONFIG_KEYBOARD_LKKBD is not set
-# CONFIG_KEYBOARD_XTKBD is not set
+# CONFIG_KEYBOARD_GPIO is not set
+# CONFIG_KEYBOARD_MATRIX is not set
+# CONFIG_KEYBOARD_LM8323 is not set
 # CONFIG_KEYBOARD_NEWTON is not set
 # CONFIG_KEYBOARD_STOWAWAY is not set
-# CONFIG_KEYBOARD_LM8323 is not set
-# CONFIG_KEYBOARD_GPIO is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_INPUT_JOYSTICK is not set
 # CONFIG_INPUT_TABLET is not set
@@ -911,7 +911,6 @@ CONFIG_REGULATOR=y
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
-# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
 CONFIG_FILE_LOCKING=y
@@ -1122,7 +1121,6 @@ CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC32 is not set
 # CONFIG_CRC7 is not set
 # CONFIG_LIBCRC32C is not set
-CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
 CONFIG_HAS_DMA=y
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 4f8848260ee2..73394e50cbca 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -73,7 +73,7 @@ struct thread_info {
         .task           = &tsk,                                         \
         .exec_domain    = &default_exec_domain,                         \
         .flags          = 0,                                            \
-        .preempt_count  = 1,                                            \
+        .preempt_count  = INIT_PREEMPT_COUNT,                           \
         .addr_limit     = KERNEL_DS,                                    \
         .cpu_domain     = domain_val(DOMAIN_USER, DOMAIN_MANAGER) |     \
                           domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) |   \
diff --git a/arch/arm/mach-ep93xx/dma-m2p.c b/arch/arm/mach-ep93xx/dma-m2p.c
index a2df5bb7dff0..dbcac9c40a28 100644
--- a/arch/arm/mach-ep93xx/dma-m2p.c
+++ b/arch/arm/mach-ep93xx/dma-m2p.c
@@ -33,6 +33,7 @@
 #include <linux/err.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
+#include <linux/io.h>
 
 #include <mach/dma.h>
 #include <mach/hardware.h>
diff --git a/arch/arm/mach-kirkwood/mpp.h b/arch/arm/mach-kirkwood/mpp.h
index e021a80c2caf..bc74278ed311 100644
--- a/arch/arm/mach-kirkwood/mpp.h
+++ b/arch/arm/mach-kirkwood/mpp.h
@@ -289,7 +289,7 @@
 
 #define MPP48_GPIO              MPP( 48, 0x0, 1, 1, 0,   0,   0,   1    )
 #define MPP48_TSMP12            MPP( 48, 0x1, 1, 1, 0,   0,   0,   1    )
-#define MPP48_TDM_DTX           MPP( 48. 0x2, 0, 1, 0,   0,   0,   1    )
+#define MPP48_TDM_DTX           MPP( 48, 0x2, 0, 1, 0,   0,   0,   1    )
 
 #define MPP49_GPIO              MPP( 49, 0x0, 1, 1, 0,   0,   0,   1    )
 #define MPP49_TSMP9             MPP( 49, 0x1, 1, 1, 0,   0,   0,   1    )
diff --git a/arch/arm/mach-mx3/Kconfig b/arch/arm/mach-mx3/Kconfig
index 17a21a291e2f..851f2458bf65 100644
--- a/arch/arm/mach-mx3/Kconfig
+++ b/arch/arm/mach-mx3/Kconfig
@@ -36,6 +36,14 @@ config MACH_PCM037
           Include support for Phytec pcm037 platform. This includes
           specific configurations for the board and its peripherals.
 
+config MACH_PCM037_EET
+        bool "Support pcm037 EET board extensions"
+        depends on MACH_PCM037
+        help
+          Add support for PCM037 EET baseboard extensions. If you are using the
+          OLED display with EET, use "video=mx3fb:CMEL-OLED" kernel
+          command-line parameter.
+
 config MACH_MX31LITE
         bool "Support MX31 LITEKIT (LogicPD)"
         select ARCH_MX31
diff --git a/arch/arm/mach-mx3/Makefile b/arch/arm/mach-mx3/Makefile
index 0322696bd11a..6b9775471be6 100644
--- a/arch/arm/mach-mx3/Makefile
+++ b/arch/arm/mach-mx3/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_MACH_MX31ADS)	+= mx31ads.o
 obj-$(CONFIG_MACH_MX31LILLY)    += mx31lilly.o mx31lilly-db.o
 obj-$(CONFIG_MACH_MX31LITE)     += mx31lite.o
 obj-$(CONFIG_MACH_PCM037)       += pcm037.o
+obj-$(CONFIG_MACH_PCM037_EET)   += pcm037_eet.o
 obj-$(CONFIG_MACH_MX31_3DS)     += mx31pdk.o
 obj-$(CONFIG_MACH_MX31MOBOARD)  += mx31moboard.o mx31moboard-devboard.o \
                                    mx31moboard-marxbot.o
diff --git a/arch/arm/mach-mx3/armadillo5x0.c b/arch/arm/mach-mx3/armadillo5x0.c
index 541181090b37..ee331fd6b1bd 100644
--- a/arch/arm/mach-mx3/armadillo5x0.c
+++ b/arch/arm/mach-mx3/armadillo5x0.c
@@ -31,6 +31,8 @@
 #include <linux/smsc911x.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
+#include <linux/mtd/physmap.h>
+#include <linux/io.h>
 
 #include <mach/hardware.h>
 #include <asm/mach-types.h>
@@ -46,8 +48,10 @@
 #include <mach/mmc.h>
 #include <mach/ipu.h>
 #include <mach/mx3fb.h>
+#include <mach/mxc_nand.h>
 
 #include "devices.h"
+#include "crm_regs.h"
 
 static int armadillo5x0_pins[] = {
         /* UART1 */
@@ -93,7 +97,56 @@ static int armadillo5x0_pins[] = {
         MX31_PIN_FPSHIFT__FPSHIFT,
         MX31_PIN_DRDY0__DRDY0,
         IOMUX_MODE(MX31_PIN_LCS1, IOMUX_CONFIG_GPIO), /*ADV7125_PSAVE*/
+};
 
+/*
+ * NAND Flash
+ */
+static struct mxc_nand_platform_data armadillo5x0_nand_flash_pdata = {
+        .width          = 1,
+        .hw_ecc         = 1,
+};
+
+/*
+ * MTD NOR Flash
+ */
+static struct mtd_partition armadillo5x0_nor_flash_partitions[] = {
+        {
+                .name           = "nor.bootloader",
+                .offset         = 0x00000000,
+                .size           = 4*32*1024,
+        }, {
+                .name           = "nor.kernel",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = 16*128*1024,
+        }, {
+                .name           = "nor.userland",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = 110*128*1024,
+        }, {
+                .name           = "nor.config",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = 1*128*1024,
+        },
+};
+
+static struct physmap_flash_data armadillo5x0_nor_flash_pdata = {
+        .width          = 2,
+        .parts          = armadillo5x0_nor_flash_partitions,
+        .nr_parts       = ARRAY_SIZE(armadillo5x0_nor_flash_partitions),
+};
+
+static struct resource armadillo5x0_nor_flash_resource = {
+        .flags          = IORESOURCE_MEM,
+        .start          = CS0_BASE_ADDR,
+        .end            = CS0_BASE_ADDR + SZ_64M - 1,
+};
+
+static struct platform_device armadillo5x0_nor_flash = {
+        .name                   = "physmap-flash",
+        .id                     = -1,
+        .num_resources          = 1,
+        .resource               = &armadillo5x0_nor_flash_resource,
 };
 
 /*
@@ -272,6 +325,16 @@ static void __init armadillo5x0_init(void)
         /* Register FB */
         mxc_register_device(&mx3_ipu, &mx3_ipu_data);
         mxc_register_device(&mx3_fb, &mx3fb_pdata);
+
+        /* Register NOR Flash */
+        mxc_register_device(&armadillo5x0_nor_flash,
+                            &armadillo5x0_nor_flash_pdata);
+
+        /* Register NAND Flash */
+        mxc_register_device(&mxc_nand_device, &armadillo5x0_nand_flash_pdata);
+
+        /* set NAND page size to 2k if not configured via boot mode pins */
+        __raw_writel(__raw_readl(MXC_CCM_RCSR) | (1 << 30), MXC_CCM_RCSR);
 }
 
 static void __init armadillo5x0_timer_init(void)
diff --git a/arch/arm/mach-mx3/devices.c b/arch/arm/mach-mx3/devices.c
index d927eddcad46..9e87e08fb121 100644
--- a/arch/arm/mach-mx3/devices.c
+++ b/arch/arm/mach-mx3/devices.c
@@ -22,7 +22,6 @@
 #include <linux/platform_device.h>
 #include <linux/serial.h>
 #include <linux/gpio.h>
-#include <linux/dma-mapping.h>
 #include <mach/hardware.h>
 #include <mach/irqs.h>
 #include <mach/common.h>
diff --git a/arch/arm/mach-mx3/pcm037.c b/arch/arm/mach-mx3/pcm037.c
index c6f61a1f06c8..840cfda341d0 100644
--- a/arch/arm/mach-mx3/pcm037.c
+++ b/arch/arm/mach-mx3/pcm037.c
@@ -18,7 +18,7 @@
 
 #include <linux/types.h>
 #include <linux/init.h>
-
+#include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
 #include <linux/mtd/physmap.h>
 #include <linux/mtd/plat-ram.h>
@@ -33,29 +33,67 @@
 #include <linux/irq.h>
 #include <linux/fsl_devices.h>
 
-#include <mach/hardware.h>
+#include <media/soc_camera.h>
+
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/time.h>
 #include <asm/mach/map.h>
+#include <mach/board-pcm037.h>
 #include <mach/common.h>
+#include <mach/hardware.h>
+#include <mach/i2c.h>
 #include <mach/imx-uart.h>
 #include <mach/iomux-mx3.h>
 #include <mach/ipu.h>
-#include <mach/board-pcm037.h>
+#include <mach/mmc.h>
+#include <mach/mx3_camera.h>
 #include <mach/mx3fb.h>
 #include <mach/mxc_nand.h>
-#include <mach/mmc.h>
-#ifdef CONFIG_I2C_IMX
-#include <mach/i2c.h>
-#endif
 
 #include "devices.h"
+#include "pcm037.h"
+
+static enum pcm037_board_variant pcm037_instance = PCM037_PCM970;
+
+static int __init pcm037_variant_setup(char *str)
+{
+        if (!strcmp("eet", str))
+                pcm037_instance = PCM037_EET;
+        else if (strcmp("pcm970", str))
+                pr_warning("Unknown pcm037 baseboard variant %s\n", str);
+
+        return 1;
+}
+
+/* Supported values: "pcm970" (default) and "eet" */
+__setup("pcm037_variant=", pcm037_variant_setup);
+
+enum pcm037_board_variant pcm037_variant(void)
+{
+        return pcm037_instance;
+}
+
+/* UART1 with RTS/CTS handshake signals */
+static unsigned int pcm037_uart1_handshake_pins[] = {
+        MX31_PIN_CTS1__CTS1,
+        MX31_PIN_RTS1__RTS1,
+        MX31_PIN_TXD1__TXD1,
+        MX31_PIN_RXD1__RXD1,
+};
+
+/* UART1 without RTS/CTS handshake signals */
+static unsigned int pcm037_uart1_pins[] = {
+        MX31_PIN_TXD1__TXD1,
+        MX31_PIN_RXD1__RXD1,
+};
 
 static unsigned int pcm037_pins[] = {
         /* I2C */
         MX31_PIN_CSPI2_MOSI__SCL,
         MX31_PIN_CSPI2_MISO__SDA,
+        MX31_PIN_CSPI2_SS2__I2C3_SDA,
+        MX31_PIN_CSPI2_SCLK__I2C3_SCL,
         /* SDHC1 */
         MX31_PIN_SD1_DATA3__SD1_DATA3,
         MX31_PIN_SD1_DATA2__SD1_DATA2,
@@ -73,11 +111,6 @@ static unsigned int pcm037_pins[] = {
         MX31_PIN_CSPI1_SS0__SS0,
         MX31_PIN_CSPI1_SS1__SS1,
         MX31_PIN_CSPI1_SS2__SS2,
-        /* UART1 */
-        MX31_PIN_CTS1__CTS1,
-        MX31_PIN_RTS1__RTS1,
-        MX31_PIN_TXD1__TXD1,
-        MX31_PIN_RXD1__RXD1,
         /* UART2 */
         MX31_PIN_TXD2__TXD2,
         MX31_PIN_RXD2__RXD2,
@@ -120,6 +153,22 @@ static unsigned int pcm037_pins[] = {
         MX31_PIN_D3_SPL__D3_SPL,
         MX31_PIN_D3_CLS__D3_CLS,
         MX31_PIN_LCS0__GPI03_23,
+        /* CSI */
+        IOMUX_MODE(MX31_PIN_CSI_D5, IOMUX_CONFIG_GPIO),
+        MX31_PIN_CSI_D6__CSI_D6,
+        MX31_PIN_CSI_D7__CSI_D7,
+        MX31_PIN_CSI_D8__CSI_D8,
+        MX31_PIN_CSI_D9__CSI_D9,
+        MX31_PIN_CSI_D10__CSI_D10,
+        MX31_PIN_CSI_D11__CSI_D11,
+        MX31_PIN_CSI_D12__CSI_D12,
+        MX31_PIN_CSI_D13__CSI_D13,
+        MX31_PIN_CSI_D14__CSI_D14,
+        MX31_PIN_CSI_D15__CSI_D15,
+        MX31_PIN_CSI_HSYNC__CSI_HSYNC,
+        MX31_PIN_CSI_MCLK__CSI_MCLK,
+        MX31_PIN_CSI_PIXCLK__CSI_PIXCLK,
+        MX31_PIN_CSI_VSYNC__CSI_VSYNC,
 };
 
 static struct physmap_flash_data pcm037_flash_data = {
@@ -250,19 +299,43 @@ static struct mxc_nand_platform_data pcm037_nand_board_info = {
         .hw_ecc = 1,
 };
 
-#ifdef CONFIG_I2C_IMX
 static struct imxi2c_platform_data pcm037_i2c_1_data = {
         .bitrate = 100000,
 };
 
+static struct imxi2c_platform_data pcm037_i2c_2_data = {
+        .bitrate = 20000,
+};
+
 static struct at24_platform_data board_eeprom = {
         .byte_len = 4096,
         .page_size = 32,
         .flags = AT24_FLAG_ADDR16,
 };
 
+static int pcm037_camera_power(struct device *dev, int on)
+{
+        /* disable or enable the camera in X7 or X8 PCM970 connector */
+        gpio_set_value(IOMUX_TO_GPIO(MX31_PIN_CSI_D5), !on);
+        return 0;
+}
+
+static struct i2c_board_info pcm037_i2c_2_devices[] = {
+        {
+                I2C_BOARD_INFO("mt9t031", 0x5d),
+        },
+};
+
+static struct soc_camera_link iclink = {
+        .bus_id         = 0,            /* Must match with the camera ID */
+        .power          = pcm037_camera_power,
+        .board_info     = &pcm037_i2c_2_devices[0],
+        .i2c_adapter_id = 2,
+        .module_name    = "mt9t031",
+};
+
 static struct i2c_board_info pcm037_i2c_devices[] = {
-       {
+        {
                 I2C_BOARD_INFO("at24", 0x52), /* E0=0, E1=1, E2=0 */
                 .platform_data = &board_eeprom,
         }, {
@@ -270,7 +343,14 @@ static struct i2c_board_info pcm037_i2c_devices[] = {
                 .type = "pcf8563",
         }
 };
-#endif
+
+static struct platform_device pcm037_camera = {
+        .name   = "soc-camera-pdrv",
+        .id     = 0,
+        .dev    = {
+                .platform_data = &iclink,
+        },
+};
 
 /* Not connected by default */
 #ifdef PCM970_SDHC_RW_SWITCH
@@ -334,9 +414,41 @@ static struct imxmmc_platform_data sdhc_pdata = {
         .exit = pcm970_sdhc1_exit,
 };
 
+struct mx3_camera_pdata camera_pdata = {
+        .dma_dev        = &mx3_ipu.dev,
+        .flags          = MX3_CAMERA_DATAWIDTH_8 | MX3_CAMERA_DATAWIDTH_10,
+        .mclk_10khz     = 2000,
+};
+
+static int __init pcm037_camera_alloc_dma(const size_t buf_size)
+{
+        dma_addr_t dma_handle;
+        void *buf;
+        int dma;
+
+        if (buf_size < 2 * 1024 * 1024)
+                return -EINVAL;
+
+        buf = dma_alloc_coherent(NULL, buf_size, &dma_handle, GFP_KERNEL);
+        if (!buf) {
+                pr_err("%s: cannot allocate camera buffer-memory\n", __func__);
+                return -ENOMEM;
+        }
+
+        memset(buf, 0, buf_size);
+
+        dma = dma_declare_coherent_memory(&mx3_camera.dev,
+                                        dma_handle, dma_handle, buf_size,
+                                        DMA_MEMORY_MAP | DMA_MEMORY_EXCLUSIVE);
+
+        /* The way we call dma_declare_coherent_memory only a malloc can fail */
+        return dma & DMA_MEMORY_MAP ? 0 : -ENOMEM;
+}
+
 static struct platform_device *devices[] __initdata = {
         &pcm037_flash,
         &pcm037_sram_device,
+        &pcm037_camera,
 };
 
 static struct ipu_platform_data mx3_ipu_data = {
@@ -377,6 +489,22 @@ static const struct fb_videomode fb_modedb[] = {
                 .sync           = FB_SYNC_VERT_HIGH_ACT | FB_SYNC_OE_ACT_HIGH,
                 .vmode          = FB_VMODE_NONINTERLACED,
                 .flag           = 0,
+        }, {
+                /* 240x320 @ 60 Hz */
+                .name           = "CMEL-OLED",
+                .refresh        = 60,
+                .xres           = 240,
+                .yres           = 320,
+                .pixclock       = 185925,
+                .left_margin    = 9,
+                .right_margin   = 16,
+                .upper_margin   = 7,
+                .lower_margin   = 9,
+                .hsync_len      = 1,
+                .vsync_len      = 1,
+                .sync           = FB_SYNC_OE_ACT_HIGH | FB_SYNC_CLK_INVERT,
+                .vmode          = FB_VMODE_NONINTERLACED,
+                .flag           = 0,
         },
 };
 
@@ -397,6 +525,14 @@ static void __init mxc_board_init(void)
         mxc_iomux_setup_multiple_pins(pcm037_pins, ARRAY_SIZE(pcm037_pins),
                         "pcm037");
 
+        if (pcm037_variant() == PCM037_EET)
+                mxc_iomux_setup_multiple_pins(pcm037_uart1_pins,
+                        ARRAY_SIZE(pcm037_uart1_pins), "pcm037_uart1");
+        else
+                mxc_iomux_setup_multiple_pins(pcm037_uart1_handshake_pins,
+                        ARRAY_SIZE(pcm037_uart1_handshake_pins),
+                        "pcm037_uart1");
+
         platform_add_devices(devices, ARRAY_SIZE(devices));
 
         mxc_register_device(&mxc_uart_device0, &uart_pdata);
@@ -415,18 +551,30 @@ static void __init mxc_board_init(void)
         }
 
 
-#ifdef CONFIG_I2C_IMX
+        /* I2C adapters and devices */
         i2c_register_board_info(1, pcm037_i2c_devices,
                         ARRAY_SIZE(pcm037_i2c_devices));
 
         mxc_register_device(&mxc_i2c_device1, &pcm037_i2c_1_data);
-#endif
+        mxc_register_device(&mxc_i2c_device2, &pcm037_i2c_2_data);
+
         mxc_register_device(&mxc_nand_device, &pcm037_nand_board_info);
         mxc_register_device(&mxcsdhc_device0, &sdhc_pdata);
         mxc_register_device(&mx3_ipu, &mx3_ipu_data);
         mxc_register_device(&mx3_fb, &mx3fb_pdata);
         if (!gpio_usbotg_hs_activate())
                 mxc_register_device(&mxc_otg_udc_device, &usb_pdata);
+
+        /* CSI */
+        /* Camera power: default - off */
+        ret = gpio_request(IOMUX_TO_GPIO(MX31_PIN_CSI_D5), "mt9t031-power");
+        if (!ret)
+                gpio_direction_output(IOMUX_TO_GPIO(MX31_PIN_CSI_D5), 1);
+        else
+                iclink.power = NULL;
+
+        if (!pcm037_camera_alloc_dma(4 * 1024 * 1024))
+                mxc_register_device(&mx3_camera, &camera_pdata);
 }
 
 static void __init pcm037_timer_init(void)
@@ -448,4 +596,3 @@ MACHINE_START(PCM037, "Phytec Phycore pcm037")
         .init_machine   = mxc_board_init,
         .timer          = &pcm037_timer,
 MACHINE_END
-
diff --git a/arch/arm/mach-mx3/pcm037.h b/arch/arm/mach-mx3/pcm037.h
new file mode 100644
index 000000000000..d6929721a5fd
--- /dev/null
+++ b/arch/arm/mach-mx3/pcm037.h
@@ -0,0 +1,11 @@
+#ifndef __PCM037_H__
+#define __PCM037_H__
+
+enum pcm037_board_variant {
+        PCM037_PCM970,
+        PCM037_EET,
+};
+
+extern enum pcm037_board_variant pcm037_variant(void);
+
+#endif
diff --git a/arch/arm/mach-mx3/pcm037_eet.c b/arch/arm/mach-mx3/pcm037_eet.c
new file mode 100644
index 000000000000..fe52fb1bb8b7
--- /dev/null
+++ b/arch/arm/mach-mx3/pcm037_eet.c
@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2009
+ * Guennadi Liakhovetski, DENX Software Engineering, <lg@denx.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/gpio.h>
+#include <linux/gpio_keys.h>
+#include <linux/input.h>
+#include <linux/platform_device.h>
+#include <linux/spi/spi.h>
+
+#include <mach/common.h>
+#if defined(CONFIG_SPI_IMX) || defined(CONFIG_SPI_IMX_MODULE)
+#include <mach/spi.h>
+#endif
+#include <mach/iomux-mx3.h>
+
+#include <asm/mach-types.h>
+
+#include "pcm037.h"
+#include "devices.h"
+
+static unsigned int pcm037_eet_pins[] = {
+        /* SPI #1 */
+        MX31_PIN_CSPI1_MISO__MISO,
+        MX31_PIN_CSPI1_MOSI__MOSI,
+        MX31_PIN_CSPI1_SCLK__SCLK,
+        MX31_PIN_CSPI1_SPI_RDY__SPI_RDY,
+        MX31_PIN_CSPI1_SS0__SS0,
+        MX31_PIN_CSPI1_SS1__SS1,
+        MX31_PIN_CSPI1_SS2__SS2,
+
+        /* Reserve and hardwire GPIO 57 high - S6E63D6 chipselect */
+        IOMUX_MODE(MX31_PIN_KEY_COL7, IOMUX_CONFIG_GPIO),
+        /* GPIO keys */
+        IOMUX_MODE(MX31_PIN_GPIO1_0,    IOMUX_CONFIG_GPIO), /* 0 */
+        IOMUX_MODE(MX31_PIN_GPIO1_1,    IOMUX_CONFIG_GPIO), /* 1 */
+        IOMUX_MODE(MX31_PIN_GPIO1_2,    IOMUX_CONFIG_GPIO), /* 2 */
+        IOMUX_MODE(MX31_PIN_GPIO1_3,    IOMUX_CONFIG_GPIO), /* 3 */
+        IOMUX_MODE(MX31_PIN_SVEN0,      IOMUX_CONFIG_GPIO), /* 32 */
+        IOMUX_MODE(MX31_PIN_STX0,       IOMUX_CONFIG_GPIO), /* 33 */
+        IOMUX_MODE(MX31_PIN_SRX0,       IOMUX_CONFIG_GPIO), /* 34 */
+        IOMUX_MODE(MX31_PIN_SIMPD0,     IOMUX_CONFIG_GPIO), /* 35 */
+        IOMUX_MODE(MX31_PIN_RTS1,       IOMUX_CONFIG_GPIO), /* 38 */
+        IOMUX_MODE(MX31_PIN_CTS1,       IOMUX_CONFIG_GPIO), /* 39 */
+        IOMUX_MODE(MX31_PIN_KEY_ROW4,   IOMUX_CONFIG_GPIO), /* 50 */
+        IOMUX_MODE(MX31_PIN_KEY_ROW5,   IOMUX_CONFIG_GPIO), /* 51 */
+        IOMUX_MODE(MX31_PIN_KEY_ROW6,   IOMUX_CONFIG_GPIO), /* 52 */
+        IOMUX_MODE(MX31_PIN_KEY_ROW7,   IOMUX_CONFIG_GPIO), /* 53 */
+
+        /* LEDs */
+        IOMUX_MODE(MX31_PIN_DTR_DTE1,   IOMUX_CONFIG_GPIO), /* 44 */
+        IOMUX_MODE(MX31_PIN_DSR_DTE1,   IOMUX_CONFIG_GPIO), /* 45 */
+        IOMUX_MODE(MX31_PIN_KEY_COL5,   IOMUX_CONFIG_GPIO), /* 55 */
+        IOMUX_MODE(MX31_PIN_KEY_COL6,   IOMUX_CONFIG_GPIO), /* 56 */
+};
+
+/* SPI */
+static struct spi_board_info pcm037_spi_dev[] = {
+        {
+                .modalias       = "dac124s085",
+                .max_speed_hz   = 400000,
+                .bus_num        = 0,
+                .chip_select    = 0,            /* Index in pcm037_spi1_cs[] */
+                .mode           = SPI_CPHA,
+        },
+};
+
+/* Platform Data for MXC CSPI */
+#if defined(CONFIG_SPI_IMX) || defined(CONFIG_SPI_IMX_MODULE)
+static int pcm037_spi1_cs[] = {MXC_SPI_CS(1), IOMUX_TO_GPIO(MX31_PIN_KEY_COL7)};
+
+struct spi_imx_master pcm037_spi1_master = {
+        .chipselect = pcm037_spi1_cs,
+        .num_chipselect = ARRAY_SIZE(pcm037_spi1_cs),
+};
+#endif
+
+/* GPIO-keys input device */
+static struct gpio_keys_button pcm037_gpio_keys[] = {
+        {
+                .type   = EV_KEY,
+                .code   = KEY_L,
+                .gpio   = 0,
+                .desc   = "Wheel Manual",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = KEY_A,
+                .gpio   = 1,
+                .desc   = "Wheel AF",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = KEY_V,
+                .gpio   = 2,
+                .desc   = "Wheel View",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = KEY_M,
+                .gpio   = 3,
+                .desc   = "Wheel Menu",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = KEY_UP,
+                .gpio   = 32,
+                .desc   = "Nav Pad Up",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = KEY_RIGHT,
+                .gpio   = 33,
+                .desc   = "Nav Pad Right",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = KEY_DOWN,
+                .gpio   = 34,
+                .desc   = "Nav Pad Down",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = KEY_LEFT,
+                .gpio   = 35,
+                .desc   = "Nav Pad Left",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = KEY_ENTER,
+                .gpio   = 38,
+                .desc   = "Nav Pad Ok",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = KEY_O,
+                .gpio   = 39,
+                .desc   = "Wheel Off",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = BTN_FORWARD,
+                .gpio   = 50,
+                .desc   = "Focus Forward",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = BTN_BACK,
+                .gpio   = 51,
+                .desc   = "Focus Backward",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = BTN_MIDDLE,
+                .gpio   = 52,
+                .desc   = "Release Half",
+                .wakeup = 0,
+        }, {
+                .type   = EV_KEY,
+                .code   = BTN_EXTRA,
+                .gpio   = 53,
+                .desc   = "Release Full",
+                .wakeup = 0,
+        },
+};
+
+static struct gpio_keys_platform_data pcm037_gpio_keys_platform_data = {
+        .buttons        = pcm037_gpio_keys,
+        .nbuttons       = ARRAY_SIZE(pcm037_gpio_keys),
+        .rep            = 0, /* No auto-repeat */
+};
+
+static struct platform_device pcm037_gpio_keys_device = {
+        .name   = "gpio-keys",
+        .id     = -1,
+        .dev    = {
+                .platform_data  = &pcm037_gpio_keys_platform_data,
+        },
+};
+
+static int eet_init_devices(void)
+{
+        if (!machine_is_pcm037() || pcm037_variant() != PCM037_EET)
+                return 0;
+
+        mxc_iomux_setup_multiple_pins(pcm037_eet_pins,
+                                ARRAY_SIZE(pcm037_eet_pins), "pcm037_eet");
+
+        /* SPI */
+        spi_register_board_info(pcm037_spi_dev, ARRAY_SIZE(pcm037_spi_dev));
+#if defined(CONFIG_SPI_IMX) || defined(CONFIG_SPI_IMX_MODULE)
+        mxc_register_device(&mxc_spi_device0, &pcm037_spi1_master);
+#endif
+
+        platform_device_register(&pcm037_gpio_keys_device);
+
+        return 0;
+}
+
+late_initcall(eet_init_devices);
diff --git a/arch/arm/mach-pxa/include/mach/mfp-pxa300.h b/arch/arm/mach-pxa/include/mach/mfp-pxa300.h
index ae8441192ef0..7139e0dc26d1 100644
--- a/arch/arm/mach-pxa/include/mach/mfp-pxa300.h
+++ b/arch/arm/mach-pxa/include/mach/mfp-pxa300.h
@@ -567,9 +567,9 @@
 #define GPIO37_ULPI_DATA_OUT_7  MFP_CFG(GPIO37, AF3)
 #define GPIO33_ULPI_OTG_INTR    MFP_CFG(GPIO33, AF1)
 
-#define ULPI_DIR        MFP_CFG_DRV(ULPI_DIR, MFP_AF0, MFP_DS01X)
-#define ULPI_NXT        MFP_CFG_DRV(ULPI_NXT, MFP_AF0, MFP_DS01X)
-#define ULPI_STP        MFP_CFG_DRV(ULPI_STP, MFP_AF0, MFP_DS01X)
+#define ULPI_DIR        MFP_CFG_DRV(ULPI_DIR, AF0, DS01X)
+#define ULPI_NXT        MFP_CFG_DRV(ULPI_NXT, AF0, DS01X)
+#define ULPI_STP        MFP_CFG_DRV(ULPI_STP, AF0, DS01X)
 #endif /* CONFIG_CPU_PXA310 */
 
 #endif /* __ASM_ARCH_MFP_PXA300_H */
diff --git a/arch/arm/mach-pxa/pxa3xx.c b/arch/arm/mach-pxa/pxa3xx.c
index 6f678d93bf4e..09b7b1a10cad 100644
--- a/arch/arm/mach-pxa/pxa3xx.c
+++ b/arch/arm/mach-pxa/pxa3xx.c
@@ -250,7 +250,7 @@ static DEFINE_PXA3_CKEN(pxa3xx_mmc2, MMC2, 19500000, 0);
 static struct clk_lookup pxa3xx_clkregs[] = {
         INIT_CLKREG(&clk_pxa3xx_pout, NULL, "CLK_POUT"),
         /* Power I2C clock is always on */
-        INIT_CLKREG(&clk_dummy, "pxa2xx-i2c.1", NULL),
+        INIT_CLKREG(&clk_dummy, "pxa3xx-pwri2c.1", NULL),
         INIT_CLKREG(&clk_pxa3xx_lcd, "pxa2xx-fb", NULL),
         INIT_CLKREG(&clk_pxa3xx_camera, NULL, "CAMCLK"),
         INIT_CLKREG(&clk_pxa3xx_ac97, NULL, "AC97CLK"),
diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c
index 9ea9c05093cd..facbd49eec67 100644
--- a/arch/arm/mach-realview/core.c
+++ b/arch/arm/mach-realview/core.c
@@ -208,8 +208,7 @@ struct platform_device realview_i2c_device = {
 
 static struct i2c_board_info realview_i2c_board_info[] = {
         {
-                I2C_BOARD_INFO("rtc-ds1307", 0xd0 >> 1),
-                .type = "ds1338",
+                I2C_BOARD_INFO("ds1338", 0xd0 >> 1),
         },
 };
 
diff --git a/arch/arm/mach-u300/core.c b/arch/arm/mach-u300/core.c
index 89b3ccf35e1b..7936085dd758 100644
--- a/arch/arm/mach-u300/core.c
+++ b/arch/arm/mach-u300/core.c
@@ -455,8 +455,8 @@ void __init u300_init_irq(void)
         for (i = 0; i < NR_IRQS; i++)
                 set_bit(i, (unsigned long *) &mask[0]);
         u300_enable_intcon_clock();
-        vic_init((void __iomem *) U300_INTCON0_VBASE, 0, mask[0], 0);
-        vic_init((void __iomem *) U300_INTCON1_VBASE, 32, mask[1], 0);
+        vic_init((void __iomem *) U300_INTCON0_VBASE, 0, mask[0], mask[0]);
+        vic_init((void __iomem *) U300_INTCON1_VBASE, 32, mask[1], mask[1]);
 }
 
 
diff --git a/arch/arm/mach-versatile/core.c b/arch/arm/mach-versatile/core.c
index 69214fc8bd19..31093af7d052 100644
--- a/arch/arm/mach-versatile/core.c
+++ b/arch/arm/mach-versatile/core.c
@@ -342,8 +342,7 @@ static struct platform_device versatile_i2c_device = {
 
 static struct i2c_board_info versatile_i2c_board_info[] = {
         {
-                I2C_BOARD_INFO("rtc-ds1307", 0xd0 >> 1),
-                .type = "ds1338",
+                I2C_BOARD_INFO("ds1338", 0xd0 >> 1),
         },
 };
 
diff --git a/arch/arm/plat-mxc/include/mach/iomux-mx3.h b/arch/arm/plat-mxc/include/mach/iomux-mx3.h
index 27f8d1b2bc6b..2eb182f73876 100644
--- a/arch/arm/plat-mxc/include/mach/iomux-mx3.h
+++ b/arch/arm/plat-mxc/include/mach/iomux-mx3.h
@@ -602,6 +602,8 @@ enum iomux_pins {
 #define MX31_PIN_I2C_DAT__SDA           IOMUX_MODE(MX31_PIN_I2C_DAT, IOMUX_CONFIG_FUNC)
 #define MX31_PIN_DCD_DTE1__I2C2_SDA     IOMUX_MODE(MX31_PIN_DCD_DTE1, IOMUX_CONFIG_ALT2)
 #define MX31_PIN_RI_DTE1__I2C2_SCL      IOMUX_MODE(MX31_PIN_RI_DTE1, IOMUX_CONFIG_ALT2)
+#define MX31_PIN_CSPI2_SS2__I2C3_SDA    IOMUX_MODE(MX31_PIN_CSPI2_SS2, IOMUX_CONFIG_ALT1)
+#define MX31_PIN_CSPI2_SCLK__I2C3_SCL   IOMUX_MODE(MX31_PIN_CSPI2_SCLK, IOMUX_CONFIG_ALT1)
 #define MX31_PIN_CSI_D4__CSI_D4         IOMUX_MODE(MX31_PIN_CSI_D4, IOMUX_CONFIG_FUNC)
 #define MX31_PIN_CSI_D5__CSI_D5         IOMUX_MODE(MX31_PIN_CSI_D5, IOMUX_CONFIG_FUNC)
 #define MX31_PIN_CSI_D6__CSI_D6         IOMUX_MODE(MX31_PIN_CSI_D6, IOMUX_CONFIG_FUNC)
diff --git a/arch/arm/plat-pxa/gpio.c b/arch/arm/plat-pxa/gpio.c
index abc79d44acaa..98548c6903a0 100644
--- a/arch/arm/plat-pxa/gpio.c
+++ b/arch/arm/plat-pxa/gpio.c
@@ -16,7 +16,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/sysdev.h>
-#include <linux/bootmem.h>
+#include <linux/slab.h>
 
 #include <mach/gpio.h>
 
@@ -112,17 +112,12 @@ static int __init pxa_init_gpio_chip(int gpio_end)
         int i, gpio, nbanks = gpio_to_bank(gpio_end) + 1;
         struct pxa_gpio_chip *chips;
 
-        /* this is early, we have to use bootmem allocator, and we really
-         * want this to be allocated dynamically for different 'gpio_end'
-         */
-        chips = alloc_bootmem_low(nbanks * sizeof(struct pxa_gpio_chip));
+        chips = kzalloc(nbanks * sizeof(struct pxa_gpio_chip), GFP_KERNEL);
         if (chips == NULL) {
                 pr_err("%s: failed to allocate GPIO chips\n", __func__);
                 return -ENOMEM;
         }
 
-        memset(chips, 0, nbanks * sizeof(struct pxa_gpio_chip));
-
         for (i = 0, gpio = 0; i < nbanks; i++, gpio += 32) {
                 struct gpio_chip *c = &chips[i].chip;
 
diff --git a/arch/avr32/include/asm/thread_info.h b/arch/avr32/include/asm/thread_info.h
index 4442f8d2d423..fc42de5ca209 100644
--- a/arch/avr32/include/asm/thread_info.h
+++ b/arch/avr32/include/asm/thread_info.h
@@ -40,7 +40,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain,                         \
         .flags          = 0,                                            \
         .cpu            = 0,                                            \
-        .preempt_count  = 1,                                            \
+        .preempt_count  = INIT_PREEMPT_COUNT,                           \
         .restart_block  = {                                             \
                 .fn     = do_no_restart_syscall                         \
         }                                                               \
diff --git a/arch/blackfin/include/asm/context.S b/arch/blackfin/include/asm/context.S
index 16561ab18b38..f8a664f022b1 100644
--- a/arch/blackfin/include/asm/context.S
+++ b/arch/blackfin/include/asm/context.S
@@ -223,9 +223,10 @@
         [--sp] = RETN;
         [--sp] = RETE;
         [--sp] = SEQSTAT;
-#ifdef CONFIG_KGDB
-        r1.l = lo(IPEND);
-        r1.h = hi(IPEND);
+#ifdef CONFIG_DEBUG_KERNEL
+        p1.l = lo(IPEND);
+        p1.h = hi(IPEND);
+        r1 = [p1];
         [--sp] = r1;
 #else
         [--sp] = r0;    /* Skip IPEND as well. */
diff --git a/arch/blackfin/include/asm/cpu.h b/arch/blackfin/include/asm/cpu.h
index 565b8136855e..fadfa82f93b2 100644
--- a/arch/blackfin/include/asm/cpu.h
+++ b/arch/blackfin/include/asm/cpu.h
@@ -32,7 +32,6 @@ struct blackfin_cpudata {
         struct task_struct *idle;
         unsigned int imemctl;
         unsigned int dmemctl;
-        unsigned long loops_per_jiffy;
         unsigned long dcache_invld_count;
         unsigned long icache_invld_count;
 };
diff --git a/arch/blackfin/include/asm/hardirq.h b/arch/blackfin/include/asm/hardirq.h
index cbd52f86bb9f..0b78b873df51 100644
--- a/arch/blackfin/include/asm/hardirq.h
+++ b/arch/blackfin/include/asm/hardirq.h
@@ -6,6 +6,9 @@
 extern void ack_bad_irq(unsigned int irq);
 #define ack_bad_irq ack_bad_irq
 
+/* Define until common code gets sane defaults */
+#define HARDIRQ_BITS 9
+
 #include <asm-generic/hardirq.h>
 
 #endif
diff --git a/arch/blackfin/include/asm/processor.h b/arch/blackfin/include/asm/processor.h
index d0be99be8308..a36ad8dac068 100644
--- a/arch/blackfin/include/asm/processor.h
+++ b/arch/blackfin/include/asm/processor.h
@@ -105,23 +105,16 @@ static inline uint32_t __pure bfin_revid(void)
         /* Always use CHIPID, to work around ANOMALY_05000234 */
         uint32_t revid = (bfin_read_CHIPID() & CHIPID_VERSION) >> 28;
 
-#ifdef CONFIG_BF52x
-        /* ANOMALY_05000357
+#ifdef _BOOTROM_GET_DXE_ADDRESS_TWI
+        /*
+         * ANOMALY_05000364
          * Incorrect Revision Number in DSPID Register
          */
-        if (revid == 0)
-                switch (bfin_read16(_BOOTROM_GET_DXE_ADDRESS_TWI)) {
-                case 0x0010:
-                        revid = 0;
-                        break;
-                case 0x2796:
-                        revid = 1;
-                        break;
-                default:
-                        revid = 0xFFFF;
-                        break;
-                }
+        if (ANOMALY_05000364 &&
+            bfin_read16(_BOOTROM_GET_DXE_ADDRESS_TWI) == 0x2796)
+                revid = 1;
 #endif
+
         return revid;
 }
 
diff --git a/arch/blackfin/include/asm/thread_info.h b/arch/blackfin/include/asm/thread_info.h
index 2920087516f2..2bbfdd950afc 100644
--- a/arch/blackfin/include/asm/thread_info.h
+++ b/arch/blackfin/include/asm/thread_info.h
@@ -77,7 +77,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .restart_block  = {                     \
                 .fn = do_no_restart_syscall,    \
         },                                      \
diff --git a/arch/blackfin/kernel/bfin_dma_5xx.c b/arch/blackfin/kernel/bfin_dma_5xx.c
index e0bf8cc06907..9f9b82816652 100644
--- a/arch/blackfin/kernel/bfin_dma_5xx.c
+++ b/arch/blackfin/kernel/bfin_dma_5xx.c
@@ -253,32 +253,31 @@ void __init early_dma_memcpy(void *pdst, const void *psrc, size_t size)
         BUG_ON(src % 4);
         BUG_ON(size % 4);
 
-        /* Force a sync in case a previous config reset on this channel
-         * occurred.  This is needed so subsequent writes to DMA registers
-         * are not spuriously lost/corrupted.
-         */
-        __builtin_bfin_ssync();
-
         src_ch = 0;
         /* Find an avalible memDMA channel */
         while (1) {
-                if (!src_ch || src_ch == (struct dma_register *)MDMA_S1_NEXT_DESC_PTR) {
-                        dst_ch = (struct dma_register *)MDMA_D0_NEXT_DESC_PTR;
-                        src_ch = (struct dma_register *)MDMA_S0_NEXT_DESC_PTR;
-                } else {
+                if (src_ch == (struct dma_register *)MDMA_S0_NEXT_DESC_PTR) {
                         dst_ch = (struct dma_register *)MDMA_D1_NEXT_DESC_PTR;
                         src_ch = (struct dma_register *)MDMA_S1_NEXT_DESC_PTR;
+                } else {
+                        dst_ch = (struct dma_register *)MDMA_D0_NEXT_DESC_PTR;
+                        src_ch = (struct dma_register *)MDMA_S0_NEXT_DESC_PTR;
                 }
 
-                if (!bfin_read16(&src_ch->cfg)) {
+                if (!bfin_read16(&src_ch->cfg))
+                        break;
+                else if (bfin_read16(&dst_ch->irq_status) & DMA_DONE) {
+                        bfin_write16(&src_ch->cfg, 0);
                         break;
-                } else {
-                        if (bfin_read16(&src_ch->irq_status) & DMA_DONE)
-                                bfin_write16(&src_ch->cfg, 0);
                 }
-
         }
 
+        /* Force a sync in case a previous config reset on this channel
+         * occurred.  This is needed so subsequent writes to DMA registers
+         * are not spuriously lost/corrupted.
+         */
+        __builtin_bfin_ssync();
+
         /* Destination */
         bfin_write32(&dst_ch->start_addr, dst);
         bfin_write16(&dst_ch->x_count, size >> 2);
diff --git a/arch/blackfin/kernel/bfin_gpio.c b/arch/blackfin/kernel/bfin_gpio.c
index beffa00a93c3..6b9446271371 100644
--- a/arch/blackfin/kernel/bfin_gpio.c
+++ b/arch/blackfin/kernel/bfin_gpio.c
@@ -686,14 +686,12 @@ void bfin_gpio_pm_hibernate_restore(void)
                 *port_fer[bank] = gpio_bank_saved[bank].fer;
 #endif
                 gpio_array[bank]->inen  = gpio_bank_saved[bank].inen;
+                gpio_array[bank]->data_set = gpio_bank_saved[bank].data
+                                                & gpio_bank_saved[bank].dir;
                 gpio_array[bank]->dir   = gpio_bank_saved[bank].dir;
                 gpio_array[bank]->polar = gpio_bank_saved[bank].polar;
                 gpio_array[bank]->edge  = gpio_bank_saved[bank].edge;
                 gpio_array[bank]->both  = gpio_bank_saved[bank].both;
-
-                gpio_array[bank]->data_set = gpio_bank_saved[bank].data
-                                                | gpio_bank_saved[bank].dir;
-
                 gpio_array[bank]->maska = gpio_bank_saved[bank].maska;
         }
         AWA_DUMMY_READ(maska);
diff --git a/arch/blackfin/kernel/cplb-nompu/cplbinit.c b/arch/blackfin/kernel/cplb-nompu/cplbinit.c
index d6c067782e63..685f160a5a36 100644
--- a/arch/blackfin/kernel/cplb-nompu/cplbinit.c
+++ b/arch/blackfin/kernel/cplb-nompu/cplbinit.c
@@ -72,13 +72,24 @@ void __init generate_cplb_tables_cpu(unsigned int cpu)
         }
 
         /* Cover L1 memory.  One 4M area for code and data each is enough.  */
-        if (L1_DATA_A_LENGTH || L1_DATA_B_LENGTH) {
-                d_tbl[i_d].addr = L1_DATA_A_START;
-                d_tbl[i_d++].data = L1_DMEMORY | PAGE_SIZE_4MB;
+        if (cpu == 0) {
+                if (L1_DATA_A_LENGTH || L1_DATA_B_LENGTH) {
+                        d_tbl[i_d].addr = L1_DATA_A_START;
+                        d_tbl[i_d++].data = L1_DMEMORY | PAGE_SIZE_4MB;
+                }
+                i_tbl[i_i].addr = L1_CODE_START;
+                i_tbl[i_i++].data = L1_IMEMORY | PAGE_SIZE_4MB;
         }
-        i_tbl[i_i].addr = L1_CODE_START;
-        i_tbl[i_i++].data = L1_IMEMORY | PAGE_SIZE_4MB;
-
+#ifdef CONFIG_SMP
+        else {
+                if (L1_DATA_A_LENGTH || L1_DATA_B_LENGTH) {
+                        d_tbl[i_d].addr = COREB_L1_DATA_A_START;
+                        d_tbl[i_d++].data = L1_DMEMORY | PAGE_SIZE_4MB;
+                }
+                i_tbl[i_i].addr = COREB_L1_CODE_START;
+                i_tbl[i_i++].data = L1_IMEMORY | PAGE_SIZE_4MB;
+        }
+#endif
         first_switched_dcplb = i_d;
         first_switched_icplb = i_i;
 
diff --git a/arch/blackfin/kernel/process.c b/arch/blackfin/kernel/process.c
index 79cad0ac5892..9da36bab7ccb 100644
--- a/arch/blackfin/kernel/process.c
+++ b/arch/blackfin/kernel/process.c
@@ -361,7 +361,7 @@ static inline
 int in_mem_const(unsigned long addr, unsigned long size,
                  unsigned long const_addr, unsigned long const_size)
 {
-        return in_mem_const_off(addr, 0, size, const_addr, const_size);
+        return in_mem_const_off(addr, size, 0, const_addr, const_size);
 }
 #define IN_ASYNC(bnum, bctlnum) \
 ({ \
@@ -390,13 +390,13 @@ int bfin_mem_access_type(unsigned long addr, unsigned long size)
         if (in_mem_const(addr, size, L1_DATA_B_START, L1_DATA_B_LENGTH))
                 return cpu == 0 ? BFIN_MEM_ACCESS_CORE : BFIN_MEM_ACCESS_IDMA;
 #ifdef COREB_L1_CODE_START
-        if (in_mem_const(addr, size, COREB_L1_CODE_START, L1_CODE_LENGTH))
+        if (in_mem_const(addr, size, COREB_L1_CODE_START, COREB_L1_CODE_LENGTH))
                 return cpu == 1 ? BFIN_MEM_ACCESS_ITEST : BFIN_MEM_ACCESS_IDMA;
         if (in_mem_const(addr, size, COREB_L1_SCRATCH_START, L1_SCRATCH_LENGTH))
                 return cpu == 1 ? BFIN_MEM_ACCESS_CORE_ONLY : -EFAULT;
-        if (in_mem_const(addr, size, COREB_L1_DATA_A_START, L1_DATA_A_LENGTH))
+        if (in_mem_const(addr, size, COREB_L1_DATA_A_START, COREB_L1_DATA_A_LENGTH))
                 return cpu == 1 ? BFIN_MEM_ACCESS_CORE : BFIN_MEM_ACCESS_IDMA;
-        if (in_mem_const(addr, size, COREB_L1_DATA_B_START, L1_DATA_B_LENGTH))
+        if (in_mem_const(addr, size, COREB_L1_DATA_B_START, COREB_L1_DATA_B_LENGTH))
                 return cpu == 1 ? BFIN_MEM_ACCESS_CORE : BFIN_MEM_ACCESS_IDMA;
 #endif
         if (in_mem_const(addr, size, L2_START, L2_LENGTH))
@@ -472,13 +472,13 @@ int _access_ok(unsigned long addr, unsigned long size)
         if (in_mem_const_off(addr, size, _ebss_b_l1 - _sdata_b_l1, L1_DATA_B_START, L1_DATA_B_LENGTH))
                 return 1;
 #ifdef COREB_L1_CODE_START
-        if (in_mem_const(addr, size, COREB_L1_CODE_START, L1_CODE_LENGTH))
+        if (in_mem_const(addr, size, COREB_L1_CODE_START, COREB_L1_CODE_LENGTH))
                 return 1;
         if (in_mem_const(addr, size, COREB_L1_SCRATCH_START, L1_SCRATCH_LENGTH))
                 return 1;
-        if (in_mem_const(addr, size, COREB_L1_DATA_A_START, L1_DATA_A_LENGTH))
+        if (in_mem_const(addr, size, COREB_L1_DATA_A_START, COREB_L1_DATA_A_LENGTH))
                 return 1;
-        if (in_mem_const(addr, size, COREB_L1_DATA_B_START, L1_DATA_B_LENGTH))
+        if (in_mem_const(addr, size, COREB_L1_DATA_B_START, COREB_L1_DATA_B_LENGTH))
                 return 1;
 #endif
         if (in_mem_const_off(addr, size, _ebss_l2 - _stext_l2, L2_START, L2_LENGTH))
diff --git a/arch/blackfin/kernel/ptrace.c b/arch/blackfin/kernel/ptrace.c
index d76618db50df..6a387eec6b65 100644
--- a/arch/blackfin/kernel/ptrace.c
+++ b/arch/blackfin/kernel/ptrace.c
@@ -31,7 +31,6 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
diff --git a/arch/blackfin/kernel/setup.c b/arch/blackfin/kernel/setup.c
index 6136c33e919f..6225edae488e 100644
--- a/arch/blackfin/kernel/setup.c
+++ b/arch/blackfin/kernel/setup.c
@@ -168,7 +168,6 @@ void __cpuinit bfin_setup_cpudata(unsigned int cpu)
         struct blackfin_cpudata *cpudata = &per_cpu(cpu_data, cpu);
 
         cpudata->idle = current;
-        cpudata->loops_per_jiffy = loops_per_jiffy;
         cpudata->imemctl = bfin_read_IMEM_CONTROL();
         cpudata->dmemctl = bfin_read_DMEM_CONTROL();
 }
@@ -568,17 +567,23 @@ static __init void memory_setup(void)
 #  endif                                /* ANOMALY_05000263 */
 # endif                         /* CONFIG_ROMFS_FS */
 
-        memory_end -= mtd_size;
-
-        if (mtd_size == 0) {
-                console_init();
-                panic("Don't boot kernel without rootfs attached.");
+        /* Since the default MTD_UCLINUX has no magic number, we just blindly
+         * read 8 past the end of the kernel's image, and look at it.
+         * When no image is attached, mtd_size is set to a random number
+         * Do some basic sanity checks before operating on things
+         */
+        if (mtd_size == 0 || memory_end <= mtd_size) {
+                pr_emerg("Could not find valid ram mtd attached.\n");
+        } else {
+                memory_end -= mtd_size;
+
+                /* Relocate MTD image to the top of memory after the uncached memory area */
+                uclinux_ram_map.phys = memory_mtd_start = memory_end;
+                uclinux_ram_map.size = mtd_size;
+                pr_info("Found mtd parition at 0x%p, (len=0x%lx), moving to 0x%p\n",
+                        _end, mtd_size, (void *)memory_mtd_start);
+                dma_memcpy((void *)uclinux_ram_map.phys, _end, uclinux_ram_map.size);
         }
-
-        /* Relocate MTD image to the top of memory after the uncached memory area */
-        uclinux_ram_map.phys = memory_mtd_start = memory_end;
-        uclinux_ram_map.size = mtd_size;
-        dma_memcpy((void *)uclinux_ram_map.phys, _end, uclinux_ram_map.size);
 #endif                          /* CONFIG_MTD_UCLINUX */
 
 #if (defined(CONFIG_BFIN_EXTMEM_ICACHEABLE) && ANOMALY_05000263)
@@ -868,13 +873,6 @@ void __init setup_arch(char **cmdline_p)
         else
                 printk(KERN_CONT "and Disabled\n");
 
-#if defined(CONFIG_CHR_DEV_FLASH) || defined(CONFIG_BLK_DEV_FLASH)
-        /* we need to initialize the Flashrom device here since we might
-         * do things with flash early on in the boot
-         */
-        flash_probe();
-#endif
-
         printk(KERN_INFO "Boot Mode: %i\n", bfin_read_SYSCR() & 0xF);
 
         /* Newer parts mirror SWRST bits in SYSCR */
@@ -938,10 +936,6 @@ void __init setup_arch(char **cmdline_p)
                                CPU, bfin_revid());
         }
 
-        /* We can't run on BF548-0.1 due to ANOMALY 05000448 */
-        if (bfin_cpuid() == 0x27de && bfin_revid() == 1)
-                panic("You can't run on this processor due to 05000448");
-
         printk(KERN_INFO "Blackfin Linux support by http://blackfin.uclinux.org/\n");
 
         printk(KERN_INFO "Processor Speed: %lu MHz core clock and %lu MHz System Clock\n",
@@ -1164,9 +1158,9 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                 sclk/1000000, sclk%1000000);
         seq_printf(m, "bogomips\t: %lu.%02lu\n"
                 "Calibration\t: %lu loops\n",
-                (cpudata->loops_per_jiffy * HZ) / 500000,
-                ((cpudata->loops_per_jiffy * HZ) / 5000) % 100,
-                (cpudata->loops_per_jiffy * HZ));
+                (loops_per_jiffy * HZ) / 500000,
+                ((loops_per_jiffy * HZ) / 5000) % 100,
+                (loops_per_jiffy * HZ));
 
         /* Check Cache configutation */
         switch (cpudata->dmemctl & (1 << DMC0_P | 1 << DMC1_P)) {
diff --git a/arch/blackfin/kernel/sys_bfin.c b/arch/blackfin/kernel/sys_bfin.c
index a8f1329c15a4..3da60fb13ce4 100644
--- a/arch/blackfin/kernel/sys_bfin.c
+++ b/arch/blackfin/kernel/sys_bfin.c
@@ -29,7 +29,6 @@
  * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/sem.h>
 #include <linux/msg.h>
diff --git a/arch/blackfin/kernel/traps.c b/arch/blackfin/kernel/traps.c
index 8a1caf2bb5b9..bf2b2d1f8ae5 100644
--- a/arch/blackfin/kernel/traps.c
+++ b/arch/blackfin/kernel/traps.c
@@ -570,11 +570,12 @@ asmlinkage void trap_c(struct pt_regs *fp)
         if (kernel_mode_regs(fp) || (current && !current->mm)) {
                 console_verbose();
                 oops_in_progress = 1;
-                if (strerror)
-                        verbose_printk(strerror);
         }
 
         if (sig != SIGTRAP) {
+                if (strerror)
+                        verbose_printk(strerror);
+
                 dump_bfin_process(fp);
                 dump_bfin_mem(fp);
                 show_regs(fp);
@@ -619,7 +620,9 @@ asmlinkage void trap_c(struct pt_regs *fp)
                 force_sig_info(sig, &info, current);
         }
 
-        if (ANOMALY_05000461 && trapnr == VEC_HWERR && !access_ok(VERIFY_READ, fp->pc, 8))
+        if ((ANOMALY_05000461 && trapnr == VEC_HWERR && !access_ok(VERIFY_READ, fp->pc, 8)) ||
+            (ANOMALY_05000281 && trapnr == VEC_HWERR) ||
+            (ANOMALY_05000189 && (trapnr == VEC_CPLB_I_VL || trapnr == VEC_CPLB_VL)))
                 fp->pc = SAFE_USER_INSTRUCTION;
 
  traps_done:
diff --git a/arch/blackfin/lib/lshrdi3.c b/arch/blackfin/lib/lshrdi3.c
index 84b9c5592220..e57bf6fbdf3f 100644
--- a/arch/blackfin/lib/lshrdi3.c
+++ b/arch/blackfin/lib/lshrdi3.c
@@ -27,21 +27,7 @@
  * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-#define BITS_PER_UNIT 8
-
-typedef int SItype __attribute__ ((mode(SI)));
-typedef unsigned int USItype __attribute__ ((mode(SI)));
-typedef int DItype __attribute__ ((mode(DI)));
-typedef int word_type __attribute__ ((mode(__word__)));
-
-struct DIstruct {
-        SItype high, low;
-};
-
-typedef union {
-        struct DIstruct s;
-        DItype ll;
-} DIunion;
+#include "gcclib.h"
 
 #ifdef CONFIG_ARITHMETIC_OPS_L1
 DItype __lshrdi3(DItype u, word_type b)__attribute__((l1_text));
diff --git a/arch/blackfin/mach-bf518/boards/ezbrd.c b/arch/blackfin/mach-bf518/boards/ezbrd.c
index d9791106be9f..809be268e42d 100644
--- a/arch/blackfin/mach-bf518/boards/ezbrd.c
+++ b/arch/blackfin/mach-bf518/boards/ezbrd.c
@@ -534,7 +534,7 @@ static struct platform_device i2c_bfin_twi_device = {
 #endif
 
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
-#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
+#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_BFIN_TWI_LCD_MODULE)
         {
                 I2C_BOARD_INFO("pcf8574_lcd", 0x22),
         },
diff --git a/arch/blackfin/mach-bf518/include/mach/anomaly.h b/arch/blackfin/mach-bf518/include/mach/anomaly.h
index 426e064062a0..753ed810e1c6 100644
--- a/arch/blackfin/mach-bf518/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf518/include/mach/anomaly.h
@@ -82,6 +82,7 @@
 #define ANOMALY_05000179 (0)
 #define ANOMALY_05000182 (0)
 #define ANOMALY_05000183 (0)
+#define ANOMALY_05000189 (0)
 #define ANOMALY_05000198 (0)
 #define ANOMALY_05000202 (0)
 #define ANOMALY_05000215 (0)
@@ -117,6 +118,7 @@
 #define ANOMALY_05000357 (0)
 #define ANOMALY_05000362 (1)
 #define ANOMALY_05000363 (0)
+#define ANOMALY_05000364 (0)
 #define ANOMALY_05000371 (0)
 #define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (0)
diff --git a/arch/blackfin/mach-bf518/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf518/include/mach/bfin_serial_5xx.h
index 0fb2ce5d840e..dbade93395eb 100644
--- a/arch/blackfin/mach-bf518/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf518/include/mach/bfin_serial_5xx.h
@@ -53,7 +53,7 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
 
-#define UART_GET_CTS(x) (!gpio_get_value(x->cts_pin))
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
 #define UART_DISABLE_RTS(x) gpio_set_value(x->rts_pin, 1)
 #define UART_ENABLE_RTS(x) gpio_set_value(x->rts_pin, 0)
 #define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
diff --git a/arch/blackfin/mach-bf527/boards/cm_bf527.c b/arch/blackfin/mach-bf527/boards/cm_bf527.c
index f4867ce0c618..b09484f538f4 100644
--- a/arch/blackfin/mach-bf527/boards/cm_bf527.c
+++ b/arch/blackfin/mach-bf527/boards/cm_bf527.c
@@ -793,7 +793,7 @@ static struct platform_device i2c_bfin_twi_device = {
 #endif
 
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
-#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
+#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_BFIN_TWI_LCD_MODULE)
         {
                 I2C_BOARD_INFO("pcf8574_lcd", 0x22),
                 .type = "pcf8574_lcd",
diff --git a/arch/blackfin/mach-bf527/boards/ezbrd.c b/arch/blackfin/mach-bf527/boards/ezbrd.c
index b2f30f06b73e..2ad68cd10ae6 100644
--- a/arch/blackfin/mach-bf527/boards/ezbrd.c
+++ b/arch/blackfin/mach-bf527/boards/ezbrd.c
@@ -591,7 +591,7 @@ static struct platform_device i2c_bfin_twi_device = {
 #endif
 
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
-#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
+#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_BFIN_TWI_LCD_MODULE)
         {
                 I2C_BOARD_INFO("pcf8574_lcd", 0x22),
         },
diff --git a/arch/blackfin/mach-bf527/boards/ezkit.c b/arch/blackfin/mach-bf527/boards/ezkit.c
index 799a1d1fa890..75e563d3f9d4 100644
--- a/arch/blackfin/mach-bf527/boards/ezkit.c
+++ b/arch/blackfin/mach-bf527/boards/ezkit.c
@@ -858,7 +858,7 @@ static struct platform_device i2c_bfin_twi_device = {
 #endif
 
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
-#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
+#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_BFIN_TWI_LCD_MODULE)
         {
                 I2C_BOARD_INFO("pcf8574_lcd", 0x22),
         },
diff --git a/arch/blackfin/mach-bf527/include/mach/anomaly.h b/arch/blackfin/mach-bf527/include/mach/anomaly.h
index 0d63f7406168..c438ca89d8c9 100644
--- a/arch/blackfin/mach-bf527/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf527/include/mach/anomaly.h
@@ -176,6 +176,8 @@
 #define ANOMALY_05000443 (1)
 /* The WURESET Bit in the SYSCR Register is not Functional */
 #define ANOMALY_05000445 (1)
+/* USB DMA Short Packet Data Corruption */
+#define ANOMALY_05000450 (1)
 /* BCODE_QUICKBOOT, BCODE_ALLBOOT, and BCODE_FULLBOOT Settings in SYSCR Register Not Functional */
 #define ANOMALY_05000451 (1)
 /* Incorrect Default Hysteresis Setting for RESET, NMI, and BMODE Signals */
@@ -201,6 +203,7 @@
 #define ANOMALY_05000179 (0)
 #define ANOMALY_05000182 (0)
 #define ANOMALY_05000183 (0)
+#define ANOMALY_05000189 (0)
 #define ANOMALY_05000198 (0)
 #define ANOMALY_05000202 (0)
 #define ANOMALY_05000215 (0)
@@ -238,6 +241,5 @@
 #define ANOMALY_05000412 (0)
 #define ANOMALY_05000447 (0)
 #define ANOMALY_05000448 (0)
-#define ANOMALY_05000450 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h
index a625659dd67f..ebd6cebc1fbc 100644
--- a/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h
@@ -53,7 +53,7 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
 
-#define UART_GET_CTS(x) (!gpio_get_value(x->cts_pin))
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
 #define UART_DISABLE_RTS(x) gpio_set_value(x->rts_pin, 1)
 #define UART_ENABLE_RTS(x) gpio_set_value(x->rts_pin, 0)
 #define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
diff --git a/arch/blackfin/mach-bf533/boards/stamp.c b/arch/blackfin/mach-bf533/boards/stamp.c
index a68ade8a3ca2..3d743ccaff6a 100644
--- a/arch/blackfin/mach-bf533/boards/stamp.c
+++ b/arch/blackfin/mach-bf533/boards/stamp.c
@@ -453,7 +453,7 @@ static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
                 .irq = 39,
         },
 #endif
-#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
+#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_BFIN_TWI_LCD_MODULE)
         {
                 I2C_BOARD_INFO("pcf8574_lcd", 0x22),
         },
diff --git a/arch/blackfin/mach-bf533/include/mach/anomaly.h b/arch/blackfin/mach-bf533/include/mach/anomaly.h
index 70a0ad69c610..cd83db2fb1a1 100644
--- a/arch/blackfin/mach-bf533/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf533/include/mach/anomaly.h
@@ -335,6 +335,7 @@
 #define ANOMALY_05000323 (0)
 #define ANOMALY_05000353 (1)
 #define ANOMALY_05000362 (1)
+#define ANOMALY_05000364 (0)
 #define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (1)
 #define ANOMALY_05000389 (0)
diff --git a/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h
index a3789d7ccf8c..4062e24e759b 100644
--- a/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h
@@ -53,7 +53,7 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
 
-#define UART_GET_CTS(x) (!gpio_get_value(x->cts_pin))
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
 #define UART_DISABLE_RTS(x) gpio_set_value(x->rts_pin, 1)
 #define UART_ENABLE_RTS(x) gpio_set_value(x->rts_pin, 0)
 #define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
diff --git a/arch/blackfin/mach-bf537/boards/stamp.c b/arch/blackfin/mach-bf537/boards/stamp.c
index c1f76dd2c4ed..bd656907b8c0 100644
--- a/arch/blackfin/mach-bf537/boards/stamp.c
+++ b/arch/blackfin/mach-bf537/boards/stamp.c
@@ -1313,10 +1313,10 @@ static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
 #if defined(CONFIG_JOYSTICK_AD7142) || defined(CONFIG_JOYSTICK_AD7142_MODULE)
         {
                 I2C_BOARD_INFO("ad7142_joystick", 0x2C),
-                .irq = IRQ_PF5,
+                .irq = IRQ_PG5,
         },
 #endif
-#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
+#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_BFIN_TWI_LCD_MODULE)
         {
                 I2C_BOARD_INFO("pcf8574_lcd", 0x22),
         },
diff --git a/arch/blackfin/mach-bf537/include/mach/anomaly.h b/arch/blackfin/mach-bf537/include/mach/anomaly.h
index 57c128cc3b64..e66aa131f517 100644
--- a/arch/blackfin/mach-bf537/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf537/include/mach/anomaly.h
@@ -167,6 +167,7 @@
 #define ANOMALY_05000179 (0)
 #define ANOMALY_05000182 (0)
 #define ANOMALY_05000183 (0)
+#define ANOMALY_05000189 (0)
 #define ANOMALY_05000198 (0)
 #define ANOMALY_05000202 (0)
 #define ANOMALY_05000215 (0)
@@ -186,6 +187,7 @@
 #define ANOMALY_05000353 (1)
 #define ANOMALY_05000362 (1)
 #define ANOMALY_05000363 (0)
+#define ANOMALY_05000364 (0)
 #define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (1)
 #define ANOMALY_05000389 (0)
diff --git a/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h
index b86662fb9de7..e95d54f9af6c 100644
--- a/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h
@@ -53,7 +53,7 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
 
-#define UART_GET_CTS(x) (!gpio_get_value(x->cts_pin))
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
 #define UART_DISABLE_RTS(x) gpio_set_value(x->rts_pin, 1)
 #define UART_ENABLE_RTS(x) gpio_set_value(x->rts_pin, 0)
 #define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
diff --git a/arch/blackfin/mach-bf538/include/mach/anomaly.h b/arch/blackfin/mach-bf538/include/mach/anomaly.h
index c97acdf85cd3..451cf8a82a42 100644
--- a/arch/blackfin/mach-bf538/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf538/include/mach/anomaly.h
@@ -137,6 +137,7 @@
 #define ANOMALY_05000158 (0)
 #define ANOMALY_05000171 (0)
 #define ANOMALY_05000182 (0)
+#define ANOMALY_05000189 (0)
 #define ANOMALY_05000198 (0)
 #define ANOMALY_05000202 (0)
 #define ANOMALY_05000215 (0)
@@ -160,6 +161,7 @@
 #define ANOMALY_05000353 (1)
 #define ANOMALY_05000362 (1)
 #define ANOMALY_05000363 (0)
+#define ANOMALY_05000364 (0)
 #define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (1)
 #define ANOMALY_05000389 (0)
diff --git a/arch/blackfin/mach-bf538/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf538/include/mach/bfin_serial_5xx.h
index c536551eb4b8..999f239fe1a6 100644
--- a/arch/blackfin/mach-bf538/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf538/include/mach/bfin_serial_5xx.h
@@ -53,7 +53,7 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
 
-#define UART_GET_CTS(x) (!gpio_get_value(x->cts_pin))
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
 #define UART_DISABLE_RTS(x) gpio_set_value(x->rts_pin, 1)
 #define UART_ENABLE_RTS(x) gpio_set_value(x->rts_pin, 0)
 #define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
diff --git a/arch/blackfin/mach-bf548/boards/ezkit.c b/arch/blackfin/mach-bf548/boards/ezkit.c
index 81f5b95cc361..dc0dd9b2bcef 100644
--- a/arch/blackfin/mach-bf548/boards/ezkit.c
+++ b/arch/blackfin/mach-bf548/boards/ezkit.c
@@ -864,7 +864,7 @@ static struct i2c_board_info __initdata bfin_i2c_board_info0[] = {
 
 #if !defined(CONFIG_BF542)      /* The BF542 only has 1 TWI */
 static struct i2c_board_info __initdata bfin_i2c_board_info1[] = {
-#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
+#if defined(CONFIG_BFIN_TWI_LCD) || defined(CONFIG_BFIN_TWI_LCD_MODULE)
         {
                 I2C_BOARD_INFO("pcf8574_lcd", 0x22),
         },
diff --git a/arch/blackfin/mach-bf548/include/mach/anomaly.h b/arch/blackfin/mach-bf548/include/mach/anomaly.h
index 18a4cd24f673..cd040fe0bc5c 100644
--- a/arch/blackfin/mach-bf548/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf548/include/mach/anomaly.h
@@ -195,6 +195,7 @@
 #define ANOMALY_05000179 (0)
 #define ANOMALY_05000182 (0)
 #define ANOMALY_05000183 (0)
+#define ANOMALY_05000189 (0)
 #define ANOMALY_05000198 (0)
 #define ANOMALY_05000202 (0)
 #define ANOMALY_05000215 (0)
@@ -226,6 +227,7 @@
 #define ANOMALY_05000323 (0)
 #define ANOMALY_05000362 (1)
 #define ANOMALY_05000363 (0)
+#define ANOMALY_05000364 (0)
 #define ANOMALY_05000380 (0)
 #define ANOMALY_05000400 (0)
 #define ANOMALY_05000412 (0)
diff --git a/arch/blackfin/mach-bf561/include/mach/anomaly.h b/arch/blackfin/mach-bf561/include/mach/anomaly.h
index 94b8e277f09d..a5312b2d267e 100644
--- a/arch/blackfin/mach-bf561/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf561/include/mach/anomaly.h
@@ -288,6 +288,7 @@
 #define ANOMALY_05000273 (0)
 #define ANOMALY_05000311 (0)
 #define ANOMALY_05000353 (1)
+#define ANOMALY_05000364 (0)
 #define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (1)
 #define ANOMALY_05000389 (0)
diff --git a/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h
index a1b50878553f..fd5e8878b8c4 100644
--- a/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h
@@ -53,7 +53,7 @@
 #define UART_SET_DLAB(uart)     do { UART_PUT_LCR(uart, UART_GET_LCR(uart) | DLAB); SSYNC(); } while (0)
 #define UART_CLEAR_DLAB(uart)   do { UART_PUT_LCR(uart, UART_GET_LCR(uart) & ~DLAB); SSYNC(); } while (0)
 
-#define UART_GET_CTS(x) (!gpio_get_value(x->cts_pin))
+#define UART_GET_CTS(x) gpio_get_value(x->cts_pin)
 #define UART_DISABLE_RTS(x) gpio_set_value(x->rts_pin, 1)
 #define UART_ENABLE_RTS(x) gpio_set_value(x->rts_pin, 0)
 #define UART_ENABLE_INTS(x, v) UART_PUT_IER(x, v)
diff --git a/arch/blackfin/mach-bf561/include/mach/mem_map.h b/arch/blackfin/mach-bf561/include/mach/mem_map.h
index a63e15c86d90..5b96ea549a04 100644
--- a/arch/blackfin/mach-bf561/include/mach/mem_map.h
+++ b/arch/blackfin/mach-bf561/include/mach/mem_map.h
@@ -37,7 +37,6 @@
 
 /* Memory Map for ADSP-BF561 processors */
 
-#ifdef CONFIG_BF561
 #define COREA_L1_CODE_START       0xFFA00000
 #define COREA_L1_DATA_A_START     0xFF800000
 #define COREA_L1_DATA_B_START     0xFF900000
@@ -74,6 +73,28 @@
 #define BFIN_DCACHESIZE (0*1024)
 #define BFIN_DSUPBANKS  0
 #endif /*CONFIG_BFIN_DCACHE*/
+
+/*
+ * If we are in SMP mode, then the cache settings of Core B will match
+ * the settings of Core A.  If we aren't, then we assume Core B is not
+ * using any cache.  This allows the rest of the kernel to work with
+ * the core in either mode as we are only loading user code into it and
+ * it is the user's problem to make sure they aren't doing something
+ * stupid there.
+ *
+ * Note that we treat the L1 code region as a contiguous blob to make
+ * the rest of the kernel simpler.  Easier to check one region than a
+ * bunch of small ones.  Again, possible misbehavior here is the fault
+ * of the user -- don't try to use memory that doesn't exist.
+ */
+#ifdef CONFIG_SMP
+# define COREB_L1_CODE_LENGTH     L1_CODE_LENGTH
+# define COREB_L1_DATA_A_LENGTH   L1_DATA_A_LENGTH
+# define COREB_L1_DATA_B_LENGTH   L1_DATA_B_LENGTH
+#else
+# define COREB_L1_CODE_LENGTH     0x14000
+# define COREB_L1_DATA_A_LENGTH   0x8000
+# define COREB_L1_DATA_B_LENGTH   0x8000
 #endif
 
 /* Level 2 Memory */
diff --git a/arch/blackfin/mach-common/entry.S b/arch/blackfin/mach-common/entry.S
index 5a4e7c7fd92c..fb1795d5be2a 100644
--- a/arch/blackfin/mach-common/entry.S
+++ b/arch/blackfin/mach-common/entry.S
@@ -218,7 +218,7 @@ ENTRY(_ex_single_step)
         /* Single stepping only a single instruction, so clear the trace
          * bit here.  */
         r7 = syscfg;
-        bitclr (r7, 0);
+        bitclr (r7, SYSCFG_SSSTEP_P);
         syscfg = R7;
         jump _ex_trap_c;
 
@@ -251,7 +251,7 @@ ENTRY(_ex_single_step)
         if !cc jump _bfin_return_from_exception;
 
         r7 = syscfg;
-        bitclr (r7, 0);
+        bitclr (r7, SYSCFG_SSSTEP_P);   /* Turn off single step */
         syscfg = R7;
 
         /* Fall through to _bfin_return_from_exception.  */
@@ -342,9 +342,11 @@ ENTRY(_ex_trap_c)
         r6 = retx;
         [p5 + PDA_RETX] = r6;
 #endif
+        /* Save the state of single stepping */
         r6 = SYSCFG;
         [p5 + PDA_SYSCFG] = r6;
-        BITCLR(r6, 0);
+        /* Clear it while we handle the exception in IRQ5 mode */
+        BITCLR(r6, SYSCFG_SSSTEP_P);
         SYSCFG = r6;
 
         /* Disable all interrupts, but make sure level 5 is enabled so
@@ -367,7 +369,7 @@ ENDPROC(_ex_trap_c)
  * exception. This is a unrecoverable event, so crash.
  * Note: this cannot be ENTRY() as we jump here with "if cc jump" ...
  */
-_double_fault:
+ENTRY(_double_fault)
         /* Turn caches & protection off, to ensure we don't get any more
          * double exceptions
          */
@@ -872,7 +874,7 @@ ENTRY(_ret_from_exception)
         raise 15;               /* raise evt15 to do signal or reschedule */
 4:
         r0 = syscfg;
-        bitclr(r0, 0);
+        bitclr(r0, SYSCFG_SSSTEP_P);            /* Turn off single step */
         syscfg = r0;
 5:
         rts;
diff --git a/arch/blackfin/mach-common/smp.c b/arch/blackfin/mach-common/smp.c
index 61840059dfac..349ee3f5466a 100644
--- a/arch/blackfin/mach-common/smp.c
+++ b/arch/blackfin/mach-common/smp.c
@@ -211,6 +211,8 @@ int smp_call_function(void (*func)(void *info), void *info, int wait)
                 return 0;
 
         msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
+        if (!msg)
+                return -ENOMEM;
         INIT_LIST_HEAD(&msg->list);
         msg->call_struct.func = func;
         msg->call_struct.info = info;
@@ -252,6 +254,8 @@ int smp_call_function_single(int cpuid, void (*func) (void *info), void *info,
         cpu_set(cpu, callmap);
 
         msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
+        if (!msg)
+                return -ENOMEM;
         INIT_LIST_HEAD(&msg->list);
         msg->call_struct.func = func;
         msg->call_struct.info = info;
@@ -287,6 +291,8 @@ void smp_send_reschedule(int cpu)
                 return;
 
         msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
+        if (!msg)
+                return;
         memset(msg, 0, sizeof(msg));
         INIT_LIST_HEAD(&msg->list);
         msg->type = BFIN_IPI_RESCHEDULE;
@@ -314,6 +320,8 @@ void smp_send_stop(void)
                 return;
 
         msg = kmalloc(sizeof(*msg), GFP_ATOMIC);
+        if (!msg)
+                return;
         memset(msg, 0, sizeof(msg));
         INIT_LIST_HEAD(&msg->list);
         msg->type = BFIN_IPI_CPU_STOP;
@@ -450,7 +458,7 @@ void __init smp_cpus_done(unsigned int max_cpus)
         unsigned int cpu;
 
         for_each_online_cpu(cpu)
-                bogosum += per_cpu(cpu_data, cpu).loops_per_jiffy;
+                bogosum += loops_per_jiffy;
 
         printk(KERN_INFO "SMP: Total of %d processors activated "
                "(%lu.%02lu BogoMIPS).\n",
diff --git a/arch/cris/include/asm/thread_info.h b/arch/cris/include/asm/thread_info.h
index bc5b2935ca53..c3aade36c330 100644
--- a/arch/cris/include/asm/thread_info.h
+++ b/arch/cris/include/asm/thread_info.h
@@ -50,8 +50,6 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #ifndef __ASSEMBLY__
 #define INIT_THREAD_INFO(tsk)                           \
@@ -60,7 +58,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain,         \
         .flags          = 0,                            \
         .cpu            = 0,                            \
-        .preempt_count  = 1,                            \
+        .preempt_count  = INIT_PREEMPT_COUNT,           \
         .addr_limit     = KERNEL_DS,                    \
         .restart_block = {                              \
                        .fn = do_no_restart_syscall,     \
diff --git a/arch/cris/kernel/sys_cris.c b/arch/cris/kernel/sys_cris.c
index a79fbd87021b..2ad962c7e88e 100644
--- a/arch/cris/kernel/sys_cris.c
+++ b/arch/cris/kernel/sys_cris.c
@@ -15,7 +15,6 @@
 #include <linux/mm.h>
 #include <linux/fs.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/sem.h>
 #include <linux/msg.h>
 #include <linux/shm.h>
diff --git a/arch/frv/include/asm/thread_info.h b/arch/frv/include/asm/thread_info.h
index e8a5ed7be021..e608e056bb53 100644
--- a/arch/frv/include/asm/thread_info.h
+++ b/arch/frv/include/asm/thread_info.h
@@ -56,8 +56,6 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #ifndef __ASSEMBLY__
 
@@ -67,7 +65,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .addr_limit     = KERNEL_DS,            \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
diff --git a/arch/h8300/include/asm/thread_info.h b/arch/h8300/include/asm/thread_info.h
index 700014d2155f..8bbc8b0ee45d 100644
--- a/arch/h8300/include/asm/thread_info.h
+++ b/arch/h8300/include/asm/thread_info.h
@@ -36,7 +36,7 @@ struct thread_info {
         .exec_domain =  &default_exec_domain,   \
         .flags =        0,                      \
         .cpu =          0,                      \
-        .preempt_count = 1,                     \
+        .preempt_count = INIT_PREEMPT_COUNT,    \
         .restart_block  = {                     \
                 .fn = do_no_restart_syscall,    \
         },                                      \
diff --git a/arch/ia64/include/asm/fpu.h b/arch/ia64/include/asm/fpu.h
index 0c26157cffa5..b6395ad1500a 100644
--- a/arch/ia64/include/asm/fpu.h
+++ b/arch/ia64/include/asm/fpu.h
@@ -6,6 +6,8 @@
  *      David Mosberger-Tang <davidm@hpl.hp.com>
  */
 
+#include <linux/types.h>
+
 /* floating point status register: */
 #define FPSR_TRAP_VD    (1 << 0)        /* invalid op trap disabled */
 #define FPSR_TRAP_DD    (1 << 1)        /* denormal trap disabled */
diff --git a/arch/ia64/include/asm/thread_info.h b/arch/ia64/include/asm/thread_info.h
index ae6922626bf4..8ce2e388e37c 100644
--- a/arch/ia64/include/asm/thread_info.h
+++ b/arch/ia64/include/asm/thread_info.h
@@ -48,7 +48,7 @@ struct thread_info {
         .flags          = 0,                    \
         .cpu            = 0,                    \
         .addr_limit     = KERNEL_DS,            \
-        .preempt_count  = 0,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
         },                                      \
diff --git a/arch/ia64/include/asm/xen/hypervisor.h b/arch/ia64/include/asm/xen/hypervisor.h
index e425227a418e..88afb54501e4 100644
--- a/arch/ia64/include/asm/xen/hypervisor.h
+++ b/arch/ia64/include/asm/xen/hypervisor.h
@@ -33,6 +33,7 @@
 #ifndef _ASM_IA64_XEN_HYPERVISOR_H
 #define _ASM_IA64_XEN_HYPERVISOR_H
 
+#include <linux/err.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/version.h>      /* to compile feature.c */
 #include <xen/features.h>               /* to comiple xen-netfront.c */
diff --git a/arch/ia64/kernel/dma-mapping.c b/arch/ia64/kernel/dma-mapping.c
index 086a2aeb0404..39a3cd0a4173 100644
--- a/arch/ia64/kernel/dma-mapping.c
+++ b/arch/ia64/kernel/dma-mapping.c
@@ -6,6 +6,14 @@ int iommu_detected __read_mostly;
 struct dma_map_ops *dma_ops;
 EXPORT_SYMBOL(dma_ops);
 
+#define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
+
+static int __init dma_init(void)
+{
+       dma_debug_init(PREALLOC_DMA_DEBUG_ENTRIES);
+}
+fs_initcall(dma_init);
+
 struct dma_map_ops *dma_get_ops(struct device *dev)
 {
         return dma_ops;
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index 92c9689b7d97..9daa87fdb018 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -15,7 +15,6 @@
 #include <linux/mm.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
-#include <linux/smp_lock.h>
 #include <linux/user.h>
 #include <linux/security.h>
 #include <linux/audit.h>
diff --git a/arch/m32r/include/asm/thread_info.h b/arch/m32r/include/asm/thread_info.h
index 8589d462df27..07bb5bd00e2a 100644
--- a/arch/m32r/include/asm/thread_info.h
+++ b/arch/m32r/include/asm/thread_info.h
@@ -57,8 +57,6 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #ifndef __ASSEMBLY__
 
@@ -68,7 +66,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .addr_limit     = KERNEL_DS,            \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
diff --git a/arch/m32r/kernel/ptrace.c b/arch/m32r/kernel/ptrace.c
index bf0abe9e1f73..98b8feb12ed8 100644
--- a/arch/m32r/kernel/ptrace.c
+++ b/arch/m32r/kernel/ptrace.c
@@ -19,7 +19,6 @@
 #include <linux/mm.h>
 #include <linux/err.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
diff --git a/arch/m68k/include/asm/thread_info_mm.h b/arch/m68k/include/asm/thread_info_mm.h
index af0fda46e94b..6ea5c33b3c56 100644
--- a/arch/m68k/include/asm/thread_info_mm.h
+++ b/arch/m68k/include/asm/thread_info_mm.h
@@ -19,6 +19,7 @@ struct thread_info {
 {                                               \
         .task           = &tsk,                 \
         .exec_domain    = &default_exec_domain, \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
         },                                      \
diff --git a/arch/m68k/include/asm/thread_info_no.h b/arch/m68k/include/asm/thread_info_no.h
index 82529f424ea3..c2bde5e24b0b 100644
--- a/arch/m68k/include/asm/thread_info_no.h
+++ b/arch/m68k/include/asm/thread_info_no.h
@@ -49,6 +49,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .restart_block  = {                     \
                 .fn = do_no_restart_syscall,    \
         },                                      \
diff --git a/arch/microblaze/include/asm/thread_info.h b/arch/microblaze/include/asm/thread_info.h
index 7fac44498445..6e92885d381a 100644
--- a/arch/microblaze/include/asm/thread_info.h
+++ b/arch/microblaze/include/asm/thread_info.h
@@ -75,8 +75,6 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #define INIT_THREAD_INFO(tsk)                   \
 {                                               \
@@ -84,7 +82,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .addr_limit     = KERNEL_DS,            \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index b86aa623e36d..53ff39af6a5c 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -27,7 +27,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
-#include <linux/smp_lock.h>
 #include <linux/ptrace.h>
 #include <linux/signal.h>
 
diff --git a/arch/microblaze/kernel/signal.c b/arch/microblaze/kernel/signal.c
index 493819c25fba..1c80e4fc40ce 100644
--- a/arch/microblaze/kernel/signal.c
+++ b/arch/microblaze/kernel/signal.c
@@ -21,7 +21,6 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
 #include <linux/errno.h>
diff --git a/arch/microblaze/kernel/sys_microblaze.c b/arch/microblaze/kernel/sys_microblaze.c
index 8c9ebac5da10..e000bce09b2b 100644
--- a/arch/microblaze/kernel/sys_microblaze.c
+++ b/arch/microblaze/kernel/sys_microblaze.c
@@ -15,7 +15,6 @@
 #include <linux/errno.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/syscalls.h>
 #include <linux/sem.h>
 #include <linux/msg.h>
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
index 143a48136a4b..f9df720d2e40 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -39,8 +39,6 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #define INIT_THREAD_INFO(tsk)                   \
 {                                               \
@@ -48,7 +46,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = _TIF_FIXADE,          \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .addr_limit     = KERNEL_DS,            \
         .restart_block  = {                     \
                 .fn = do_no_restart_syscall,    \
diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c
index c4f9ac17474a..32644b4a0714 100644
--- a/arch/mips/kernel/ptrace32.c
+++ b/arch/mips/kernel/ptrace32.c
@@ -22,7 +22,6 @@
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/user.h>
 #include <linux/security.h>
 
diff --git a/arch/mips/mm/hugetlbpage.c b/arch/mips/mm/hugetlbpage.c
index 471c09aa1614..8c2834f5919d 100644
--- a/arch/mips/mm/hugetlbpage.c
+++ b/arch/mips/mm/hugetlbpage.c
@@ -16,7 +16,6 @@
 #include <linux/mm.h>
 #include <linux/hugetlb.h>
 #include <linux/pagemap.h>
-#include <linux/smp_lock.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/sysctl.h>
diff --git a/arch/mn10300/include/asm/thread_info.h b/arch/mn10300/include/asm/thread_info.h
index 78a3881f3c12..58d64f8b2cc3 100644
--- a/arch/mn10300/include/asm/thread_info.h
+++ b/arch/mn10300/include/asm/thread_info.h
@@ -65,8 +65,6 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #ifndef __ASSEMBLY__
 
@@ -76,7 +74,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .addr_limit     = KERNEL_DS,            \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
diff --git a/arch/mn10300/kernel/ptrace.c b/arch/mn10300/kernel/ptrace.c
index e143339ad28e..cf847dabc1bd 100644
--- a/arch/mn10300/kernel/ptrace.c
+++ b/arch/mn10300/kernel/ptrace.c
@@ -13,7 +13,6 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
diff --git a/arch/mn10300/kernel/signal.c b/arch/mn10300/kernel/signal.c
index 9f7572a0f578..feb2f2e810db 100644
--- a/arch/mn10300/kernel/signal.c
+++ b/arch/mn10300/kernel/signal.c
@@ -12,7 +12,6 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
 #include <linux/errno.h>
diff --git a/arch/mn10300/kernel/sys_mn10300.c b/arch/mn10300/kernel/sys_mn10300.c
index bca5a84dc72c..3e52a1054327 100644
--- a/arch/mn10300/kernel/sys_mn10300.c
+++ b/arch/mn10300/kernel/sys_mn10300.c
@@ -13,7 +13,6 @@
 #include <linux/syscalls.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/sem.h>
 #include <linux/msg.h>
 #include <linux/shm.h>
@@ -21,7 +20,6 @@
 #include <linux/mman.h>
 #include <linux/file.h>
 #include <linux/utsname.h>
-#include <linux/syscalls.h>
 #include <linux/tty.h>
 
 #include <asm/uaccess.h>
diff --git a/arch/mn10300/kernel/traps.c b/arch/mn10300/kernel/traps.c
index 0dfdc5001124..91365adba4f5 100644
--- a/arch/mn10300/kernel/traps.c
+++ b/arch/mn10300/kernel/traps.c
@@ -17,7 +17,6 @@
 #include <linux/timer.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/spinlock.h>
diff --git a/arch/mn10300/kernel/vmlinux.lds.S b/arch/mn10300/kernel/vmlinux.lds.S
index c96ba3da95ac..f4aa07934654 100644
--- a/arch/mn10300/kernel/vmlinux.lds.S
+++ b/arch/mn10300/kernel/vmlinux.lds.S
@@ -107,7 +107,7 @@ SECTIONS
   __init_end = .;
   /* freed after init ends here */
 
-  BSS(4)
+  BSS_SECTION(0, PAGE_SIZE, 4)
 
   _end = . ;
 
diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c
index a62e1e138bc1..53bb17d0f068 100644
--- a/arch/mn10300/mm/fault.c
+++ b/arch/mn10300/mm/fault.c
@@ -20,7 +20,6 @@
 #include <linux/mman.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
 #include <linux/vt_kern.h>              /* For unblank_screen() */
diff --git a/arch/mn10300/mm/misalignment.c b/arch/mn10300/mm/misalignment.c
index 94c4a4358065..30016251f658 100644
--- a/arch/mn10300/mm/misalignment.c
+++ b/arch/mn10300/mm/misalignment.c
@@ -17,7 +17,6 @@
 #include <linux/timer.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/spinlock.h>
diff --git a/arch/parisc/include/asm/thread_info.h b/arch/parisc/include/asm/thread_info.h
index 0407959da489..4ce0edfbe969 100644
--- a/arch/parisc/include/asm/thread_info.h
+++ b/arch/parisc/include/asm/thread_info.h
@@ -23,7 +23,7 @@ struct thread_info {
         .flags          = 0,                    \
         .cpu            = 0,                    \
         .addr_limit     = KERNEL_DS,            \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .restart_block  = {                     \
                 .fn = do_no_restart_syscall     \
         }                                       \
diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
index 9aba5a38a7c4..c8b329255678 100644
--- a/arch/powerpc/include/asm/thread_info.h
+++ b/arch/powerpc/include/asm/thread_info.h
@@ -46,15 +46,13 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #define INIT_THREAD_INFO(tsk)                   \
 {                                               \
         .task =         &tsk,                   \
         .exec_domain =  &default_exec_domain,   \
         .cpu =          0,                      \
-        .preempt_count = 1,                     \
+        .preempt_count = INIT_PREEMPT_COUNT,    \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
         },                                      \
diff --git a/arch/powerpc/kernel/power7-pmu.c b/arch/powerpc/kernel/power7-pmu.c
index 5d755ef7ac8f..5a9f5cbd40a4 100644
--- a/arch/powerpc/kernel/power7-pmu.c
+++ b/arch/powerpc/kernel/power7-pmu.c
@@ -358,6 +358,7 @@ static struct power_pmu power7_pmu = {
         .get_constraint         = power7_get_constraint,
         .get_alternatives       = power7_get_alternatives,
         .disable_pmc            = power7_disable_pmc,
+        .flags                  = PPMU_ALT_SIPR,
         .n_generic              = ARRAY_SIZE(power7_generic_events),
         .generic_events         = power7_generic_events,
         .cache_events           = &power7_cache_events,
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 9fa2c7dcd05a..ef149880c145 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -736,15 +736,16 @@ void user_disable_single_step(struct task_struct *task)
 {
         struct pt_regs *regs = task->thread.regs;
 
-
-#if defined(CONFIG_BOOKE)
-        /* If DAC then do not single step, skip */
-        if (task->thread.dabr)
-                return;
-#endif
-
         if (regs != NULL) {
-#if defined(CONFIG_40x) || defined(CONFIG_BOOKE)
+#if defined(CONFIG_BOOKE)
+                /* If DAC don't clear DBCRO_IDM or MSR_DE */
+                if (task->thread.dabr)
+                        task->thread.dbcr0 &= ~(DBCR0_IC | DBCR0_BT);
+                else {
+                        task->thread.dbcr0 &= ~(DBCR0_IC | DBCR0_BT | DBCR0_IDM);
+                        regs->msr &= ~MSR_DE;
+                }
+#elif defined(CONFIG_40x)
                 task->thread.dbcr0 &= ~(DBCR0_IC | DBCR0_BT | DBCR0_IDM);
                 regs->msr &= ~MSR_DE;
 #else
diff --git a/arch/powerpc/kernel/ptrace32.c b/arch/powerpc/kernel/ptrace32.c
index 297632cba047..8a6daf4129f6 100644
--- a/arch/powerpc/kernel/ptrace32.c
+++ b/arch/powerpc/kernel/ptrace32.c
@@ -21,7 +21,6 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/regset.h>
diff --git a/arch/powerpc/kernel/vector.S b/arch/powerpc/kernel/vector.S
index ef36cbbc5882..ea4d64644d02 100644
--- a/arch/powerpc/kernel/vector.S
+++ b/arch/powerpc/kernel/vector.S
@@ -80,10 +80,10 @@ _GLOBAL(load_up_altivec)
         mtvscr  vr0
         REST_32VRS(0,r4,r5)
 #ifndef CONFIG_SMP
-        /* Update last_task_used_math to 'current' */
+        /* Update last_task_used_altivec to 'current' */
         subi    r4,r5,THREAD            /* Back to 'current' */
         fromreal(r4)
-        PPC_STL r4,ADDROFF(last_task_used_math)(r3)
+        PPC_STL r4,ADDROFF(last_task_used_altivec)(r3)
 #endif /* CONFIG_SMP */
         /* restore registers and return */
         blr
@@ -172,7 +172,7 @@ _GLOBAL(load_up_vsx)
         oris    r12,r12,MSR_VSX@h
         std     r12,_MSR(r1)
 #ifndef CONFIG_SMP
-        /* Update last_task_used_math to 'current' */
+        /* Update last_task_used_vsx to 'current' */
         ld      r4,PACACURRENT(r13)
         std     r4,0(r3)
 #endif /* CONFIG_SMP */
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index e577839f3073..2ae5d72f47ed 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -95,6 +95,11 @@ config S390
         select HAVE_ARCH_TRACEHOOK
         select INIT_ALL_POSSIBLE
         select HAVE_PERF_COUNTERS
+        select GENERIC_ATOMIC64 if !64BIT
+
+config SCHED_OMIT_FRAME_POINTER
+        bool
+        default y
 
 source "init/Kconfig"
 
@@ -116,6 +121,9 @@ config 32BIT
         bool
         default y if !64BIT
 
+config KTIME_SCALAR
+        def_bool 32BIT
+
 config SMP
         bool "Symmetric multi-processing support"
         ---help---
diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
index fca9dffcc669..c7d0abfb0f00 100644
--- a/arch/s390/include/asm/atomic.h
+++ b/arch/s390/include/asm/atomic.h
@@ -268,7 +268,12 @@ static __inline__ int atomic64_add_unless(atomic64_t *v,
 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
 
 #undef __CSG_LOOP
-#endif
+
+#else /* __s390x__ */
+
+#include <asm-generic/atomic64.h>
+
+#endif /* __s390x__ */
 
 #define smp_mb__before_atomic_dec()     smp_mb()
 #define smp_mb__after_atomic_dec()      smp_mb()
diff --git a/arch/s390/include/asm/perf_counter.h b/arch/s390/include/asm/perf_counter.h
index a7205a3828cb..7015188c2cc2 100644
--- a/arch/s390/include/asm/perf_counter.h
+++ b/arch/s390/include/asm/perf_counter.h
@@ -6,3 +6,5 @@
 
 static inline void set_perf_counter_pending(void) {}
 static inline void clear_perf_counter_pending(void) {}
+
+#define PERF_COUNTER_INDEX_OFFSET 0
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index 925bcc649035..ba1cab9fc1f9 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -61,7 +61,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .restart_block  = {                     \
                 .fn = do_no_restart_syscall,    \
         },                                      \
diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
index d2f270c995d9..db943a7ec513 100644
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -15,7 +15,6 @@
 #include <linux/timer.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index b8bf4b140065..371a2d88f4ac 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -70,6 +70,7 @@ struct shutdown_action {
         char *name;
         void (*fn) (struct shutdown_trigger *trigger);
         int (*init) (void);
+        int init_rc;
 };
 
 static char *ipl_type_str(enum ipl_type type)
@@ -1486,11 +1487,13 @@ static int set_trigger(const char *buf, struct shutdown_trigger *trigger,
         int i;
 
         for (i = 0; i < SHUTDOWN_ACTIONS_COUNT; i++) {
-                if (!shutdown_actions_list[i])
-                        continue;
                 if (sysfs_streq(buf, shutdown_actions_list[i]->name)) {
-                        trigger->action = shutdown_actions_list[i];
-                        return len;
+                        if (shutdown_actions_list[i]->init_rc) {
+                                return shutdown_actions_list[i]->init_rc;
+                        } else {
+                                trigger->action = shutdown_actions_list[i];
+                                return len;
+                        }
                 }
         }
         return -EINVAL;
@@ -1640,8 +1643,8 @@ static void __init shutdown_actions_init(void)
         for (i = 0; i < SHUTDOWN_ACTIONS_COUNT; i++) {
                 if (!shutdown_actions_list[i]->init)
                         continue;
-                if (shutdown_actions_list[i]->init())
-                        shutdown_actions_list[i] = NULL;
+                shutdown_actions_list[i]->init_rc =
+                        shutdown_actions_list[i]->init();
         }
 }
 
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 490b39934d65..43acd73105b7 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -26,7 +26,6 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
diff --git a/arch/s390/lib/Makefile b/arch/s390/lib/Makefile
index ab6735df2d21..97975ec7a274 100644
--- a/arch/s390/lib/Makefile
+++ b/arch/s390/lib/Makefile
@@ -3,6 +3,6 @@
 #
 
 lib-y += delay.o string.o uaccess_std.o uaccess_pt.o
-obj-$(CONFIG_32BIT) += div64.o qrnnd.o
+obj-$(CONFIG_32BIT) += div64.o qrnnd.o ucmpdi2.o
 lib-$(CONFIG_64BIT) += uaccess_mvcos.o
 lib-$(CONFIG_SMP) += spinlock.o
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index 3f5f680726ed..97c1eca83cc2 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -36,9 +36,11 @@ static void __udelay_disabled(unsigned long usecs)
         cr0 = (cr0_saved & 0xffff00e0) | 0x00000800;
         __ctl_load(cr0 , 0, 0);
         mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT;
+        lockdep_off();
         trace_hardirqs_on();
         __load_psw_mask(mask);
         local_irq_disable();
+        lockdep_on();
         __ctl_load(cr0_saved, 0, 0);
         local_tick_enable(clock_saved);
         set_clock_comparator(S390_lowcore.clock_comparator);
diff --git a/arch/s390/lib/ucmpdi2.c b/arch/s390/lib/ucmpdi2.c
new file mode 100644
index 000000000000..3e05ff532582
--- /dev/null
+++ b/arch/s390/lib/ucmpdi2.c
@@ -0,0 +1,26 @@
+#include <linux/module.h>
+
+union ull_union {
+        unsigned long long ull;
+        struct {
+                unsigned int high;
+                unsigned int low;
+        } ui;
+};
+
+int __ucmpdi2(unsigned long long a, unsigned long long b)
+{
+        union ull_union au = {.ull = a};
+        union ull_union bu = {.ull = b};
+
+        if (au.ui.high < bu.ui.high)
+                return 0;
+        else if (au.ui.high > bu.ui.high)
+                return 2;
+        if (au.ui.low < bu.ui.low)
+                return 0;
+        else if (au.ui.low > bu.ui.low)
+                return 2;
+        return 1;
+}
+EXPORT_SYMBOL(__ucmpdi2);
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 74eb26bf1970..e5e119fe03b2 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -22,7 +22,6 @@
 #include <linux/compat.h>
 #include <linux/smp.h>
 #include <linux/kdebug.h>
-#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/module.h>
diff --git a/arch/sh/include/asm/thread_info.h b/arch/sh/include/asm/thread_info.h
index f09ac4806294..d570ac2e5cb9 100644
--- a/arch/sh/include/asm/thread_info.h
+++ b/arch/sh/include/asm/thread_info.h
@@ -51,7 +51,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .addr_limit     = KERNEL_DS,            \
         .restart_block  = {                     \
                 .fn = do_no_restart_syscall,    \
diff --git a/arch/sh/mm/tlb-sh3.c b/arch/sh/mm/tlb-sh3.c
index 7fbfd5a11ffa..17cb7c3adf22 100644
--- a/arch/sh/mm/tlb-sh3.c
+++ b/arch/sh/mm/tlb-sh3.c
@@ -18,7 +18,6 @@
 #include <linux/mman.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/interrupt.h>
 
 #include <asm/system.h>
diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
index 0f7b0e5fb1c7..844d73a0340c 100644
--- a/arch/sparc/include/asm/thread_info_32.h
+++ b/arch/sparc/include/asm/thread_info_32.h
@@ -54,8 +54,6 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #define INIT_THREAD_INFO(tsk)                           \
 {                                                       \
@@ -64,7 +62,7 @@ struct thread_info {
         .exec_domain    =       &default_exec_domain,   \
         .flags          =       0,                      \
         .cpu            =       0,                      \
-        .preempt_count  =       1,                      \
+        .preempt_count  =       INIT_PREEMPT_COUNT,     \
         .restart_block  = {                             \
                 .fn     =       do_no_restart_syscall,  \
         },                                              \
diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
index 65865726b283..1b45a7bbe407 100644
--- a/arch/sparc/include/asm/thread_info_64.h
+++ b/arch/sparc/include/asm/thread_info_64.h
@@ -125,8 +125,6 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #ifndef __ASSEMBLY__
 
@@ -135,7 +133,7 @@ struct thread_info {
         .task           =       &tsk,                   \
         .flags          = ((unsigned long)ASI_P) << TI_FLAG_CURRENT_DS_SHIFT,   \
         .exec_domain    =       &default_exec_domain,   \
-        .preempt_count  =       1,                      \
+        .preempt_count  =       INIT_PREEMPT_COUNT,     \
         .restart_block  = {                             \
                 .fn     =       do_no_restart_syscall,  \
         },                                              \
diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c
index 8ce6285a06d5..7e3dfd9bb97e 100644
--- a/arch/sparc/kernel/ptrace_32.c
+++ b/arch/sparc/kernel/ptrace_32.c
@@ -16,7 +16,6 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/security.h>
 #include <linux/signal.h>
 #include <linux/regset.h>
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index a941c610e7ce..4ae91dc2feb9 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -17,7 +17,6 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/security.h>
 #include <linux/seccomp.h>
 #include <linux/audit.h>
diff --git a/arch/sparc/kernel/time_64.c b/arch/sparc/kernel/time_64.c
index 5c12e79b4bdf..da1218e8ee87 100644
--- a/arch/sparc/kernel/time_64.c
+++ b/arch/sparc/kernel/time_64.c
@@ -11,7 +11,6 @@
 #include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/sched.h>
-#include <linux/smp_lock.h>
 #include <linux/kernel.h>
 #include <linux/param.h>
 #include <linux/string.h>
diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
index 358283341b47..c0490c7bbde0 100644
--- a/arch/sparc/kernel/traps_32.c
+++ b/arch/sparc/kernel/traps_32.c
@@ -13,7 +13,6 @@
 #include <linux/kernel.h>
 #include <linux/signal.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/kdebug.h>
 
 #include <asm/delay.h>
diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c
index 753d128ed158..c28c71449a6c 100644
--- a/arch/sparc/kernel/vio.c
+++ b/arch/sparc/kernel/vio.c
@@ -224,7 +224,12 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp,
         if (!strcmp(type, "domain-services-port"))
                 bus_id_name = "ds";
 
-        if (strlen(bus_id_name) >= BUS_ID_SIZE - 4) {
+        /*
+         * 20 char is the old driver-core name size limit, which is no more.
+         * This check can probably be removed after review and possible
+         * adaption of the vio users name length handling.
+         */
+        if (strlen(bus_id_name) >= 20 - 4) {
                 printk(KERN_ERR "VIO: bus_id_name [%s] is too long.\n",
                        bus_id_name);
                 return NULL;
diff --git a/arch/um/include/asm/thread_info.h b/arch/um/include/asm/thread_info.h
index 62274ab9471f..fd911f855367 100644
--- a/arch/um/include/asm/thread_info.h
+++ b/arch/um/include/asm/thread_info.h
@@ -32,7 +32,7 @@ struct thread_info {
         .exec_domain =  &default_exec_domain,   \
         .flags =                0,              \
         .cpu =          0,                      \
-        .preempt_count =        1,              \
+        .preempt_count = INIT_PREEMPT_COUNT,    \
         .addr_limit =   KERNEL_DS,              \
         .restart_block =  {                     \
                 .fn =  do_no_restart_syscall,   \
diff --git a/arch/x86/include/asm/atomic_32.h b/arch/x86/include/asm/atomic_32.h
index 2503d4e64c2a..dc5a667ff791 100644
--- a/arch/x86/include/asm/atomic_32.h
+++ b/arch/x86/include/asm/atomic_32.h
@@ -19,7 +19,10 @@
  *
  * Atomically reads the value of @v.
  */
-#define atomic_read(v)          ((v)->counter)
+static inline int atomic_read(const atomic_t *v)
+{
+        return v->counter;
+}
 
 /**
  * atomic_set - set atomic variable
@@ -28,7 +31,10 @@
  *
  * Atomically sets the value of @v to @i.
  */
-#define atomic_set(v, i)        (((v)->counter) = (i))
+static inline void atomic_set(atomic_t *v, int i)
+{
+        v->counter = i;
+}
 
 /**
  * atomic_add - add integer to atomic variable
@@ -200,8 +206,15 @@ static inline int atomic_sub_return(int i, atomic_t *v)
         return atomic_add_return(-i, v);
 }
 
-#define atomic_cmpxchg(v, old, new) (cmpxchg(&((v)->counter), (old), (new)))
-#define atomic_xchg(v, new) (xchg(&((v)->counter), (new)))
+static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
+{
+        return cmpxchg(&v->counter, old, new);
+}
+
+static inline int atomic_xchg(atomic_t *v, int new)
+{
+        return xchg(&v->counter, new);
+}
 
 /**
  * atomic_add_unless - add unless the number is already a given value
@@ -250,45 +263,12 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
 /* An 64bit atomic type */
 
 typedef struct {
-        unsigned long long counter;
+        u64 __aligned(8) counter;
 } atomic64_t;
 
 #define ATOMIC64_INIT(val)      { (val) }
 
-/**
- * atomic64_read - read atomic64 variable
- * @ptr: pointer of type atomic64_t
- *
- * Atomically reads the value of @v.
- * Doesn't imply a read memory barrier.
- */
-#define __atomic64_read(ptr)            ((ptr)->counter)
-
-static inline unsigned long long
-cmpxchg8b(unsigned long long *ptr, unsigned long long old, unsigned long long new)
-{
-        asm volatile(
-
-                LOCK_PREFIX "cmpxchg8b (%[ptr])\n"
-
-                     :          "=A" (old)
-
-                     : [ptr]    "D" (ptr),
-                                "A" (old),
-                                "b" (ll_low(new)),
-                                "c" (ll_high(new))
-
-                     : "memory");
-
-        return old;
-}
-
-static inline unsigned long long
-atomic64_cmpxchg(atomic64_t *ptr, unsigned long long old_val,
-                 unsigned long long new_val)
-{
-        return cmpxchg8b(&ptr->counter, old_val, new_val);
-}
+extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
 
 /**
  * atomic64_xchg - xchg atomic64 variable
@@ -298,18 +278,7 @@ atomic64_cmpxchg(atomic64_t *ptr, unsigned long long old_val,
  * Atomically xchgs the value of @ptr to @new_val and returns
  * the old value.
  */
-
-static inline unsigned long long
-atomic64_xchg(atomic64_t *ptr, unsigned long long new_val)
-{
-        unsigned long long old_val;
-
-        do {
-                old_val = atomic_read(ptr);
-        } while (atomic64_cmpxchg(ptr, old_val, new_val) != old_val);
-
-        return old_val;
-}
+extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
 
 /**
  * atomic64_set - set atomic64 variable
@@ -318,10 +287,7 @@ atomic64_xchg(atomic64_t *ptr, unsigned long long new_val)
  *
  * Atomically sets the value of @ptr to @new_val.
  */
-static inline void atomic64_set(atomic64_t *ptr, unsigned long long new_val)
-{
-        atomic64_xchg(ptr, new_val);
-}
+extern void atomic64_set(atomic64_t *ptr, u64 new_val);
 
 /**
  * atomic64_read - read atomic64 variable
@@ -329,17 +295,30 @@ static inline void atomic64_set(atomic64_t *ptr, unsigned long long new_val)
  *
  * Atomically reads the value of @ptr and returns it.
  */
-static inline unsigned long long atomic64_read(atomic64_t *ptr)
+static inline u64 atomic64_read(atomic64_t *ptr)
 {
-        unsigned long long curr_val;
-
-        do {
-                curr_val = __atomic64_read(ptr);
-        } while (atomic64_cmpxchg(ptr, curr_val, curr_val) != curr_val);
-
-        return curr_val;
+        u64 res;
+
+        /*
+         * Note, we inline this atomic64_t primitive because
+         * it only clobbers EAX/EDX and leaves the others
+         * untouched. We also (somewhat subtly) rely on the
+         * fact that cmpxchg8b returns the current 64-bit value
+         * of the memory location we are touching:
+         */
+        asm volatile(
+                "mov %%ebx, %%eax\n\t"
+                "mov %%ecx, %%edx\n\t"
+                LOCK_PREFIX "cmpxchg8b %1\n"
+                        : "=&A" (res)
+                        : "m" (*ptr)
+                );
+
+        return res;
 }
 
+extern u64 atomic64_read(atomic64_t *ptr);
+
 /**
  * atomic64_add_return - add and return
  * @delta: integer value to add
@@ -347,34 +326,14 @@ static inline unsigned long long atomic64_read(atomic64_t *ptr)
  *
  * Atomically adds @delta to @ptr and returns @delta + *@ptr
  */
-static inline unsigned long long
-atomic64_add_return(unsigned long long delta, atomic64_t *ptr)
-{
-        unsigned long long old_val, new_val;
-
-        do {
-                old_val = atomic_read(ptr);
-                new_val = old_val + delta;
-
-        } while (atomic64_cmpxchg(ptr, old_val, new_val) != old_val);
-
-        return new_val;
-}
-
-static inline long atomic64_sub_return(unsigned long long delta, atomic64_t *ptr)
-{
-        return atomic64_add_return(-delta, ptr);
-}
+extern u64 atomic64_add_return(u64 delta, atomic64_t *ptr);
 
-static inline long atomic64_inc_return(atomic64_t *ptr)
-{
-        return atomic64_add_return(1, ptr);
-}
-
-static inline long atomic64_dec_return(atomic64_t *ptr)
-{
-        return atomic64_sub_return(1, ptr);
-}
+/*
+ * Other variants with different arithmetic operators:
+ */
+extern u64 atomic64_sub_return(u64 delta, atomic64_t *ptr);
+extern u64 atomic64_inc_return(atomic64_t *ptr);
+extern u64 atomic64_dec_return(atomic64_t *ptr);
 
 /**
  * atomic64_add - add integer to atomic64 variable
@@ -383,10 +342,7 @@ static inline long atomic64_dec_return(atomic64_t *ptr)
  *
  * Atomically adds @delta to @ptr.
  */
-static inline void atomic64_add(unsigned long long delta, atomic64_t *ptr)
-{
-        atomic64_add_return(delta, ptr);
-}
+extern void atomic64_add(u64 delta, atomic64_t *ptr);
 
 /**
  * atomic64_sub - subtract the atomic64 variable
@@ -395,10 +351,7 @@ static inline void atomic64_add(unsigned long long delta, atomic64_t *ptr)
  *
  * Atomically subtracts @delta from @ptr.
  */
-static inline void atomic64_sub(unsigned long long delta, atomic64_t *ptr)
-{
-        atomic64_add(-delta, ptr);
-}
+extern void atomic64_sub(u64 delta, atomic64_t *ptr);
 
 /**
  * atomic64_sub_and_test - subtract value from variable and test result
@@ -409,13 +362,7 @@ static inline void atomic64_sub(unsigned long long delta, atomic64_t *ptr)
  * true if the result is zero, or false for all
  * other cases.
  */
-static inline int
-atomic64_sub_and_test(unsigned long long delta, atomic64_t *ptr)
-{
-        unsigned long long old_val = atomic64_sub_return(delta, ptr);
-
-        return old_val == 0;
-}
+extern int atomic64_sub_and_test(u64 delta, atomic64_t *ptr);
 
 /**
  * atomic64_inc - increment atomic64 variable
@@ -423,10 +370,7 @@ atomic64_sub_and_test(unsigned long long delta, atomic64_t *ptr)
  *
  * Atomically increments @ptr by 1.
  */
-static inline void atomic64_inc(atomic64_t *ptr)
-{
-        atomic64_add(1, ptr);
-}
+extern void atomic64_inc(atomic64_t *ptr);
 
 /**
  * atomic64_dec - decrement atomic64 variable
@@ -434,10 +378,7 @@ static inline void atomic64_inc(atomic64_t *ptr)
  *
  * Atomically decrements @ptr by 1.
  */
-static inline void atomic64_dec(atomic64_t *ptr)
-{
-        atomic64_sub(1, ptr);
-}
+extern void atomic64_dec(atomic64_t *ptr);
 
 /**
  * atomic64_dec_and_test - decrement and test
@@ -447,10 +388,7 @@ static inline void atomic64_dec(atomic64_t *ptr)
  * returns true if the result is 0, or false for all other
  * cases.
  */
-static inline int atomic64_dec_and_test(atomic64_t *ptr)
-{
-        return atomic64_sub_and_test(1, ptr);
-}
+extern int atomic64_dec_and_test(atomic64_t *ptr);
 
 /**
  * atomic64_inc_and_test - increment and test
@@ -460,10 +398,7 @@ static inline int atomic64_dec_and_test(atomic64_t *ptr)
  * and returns true if the result is zero, or false for all
  * other cases.
  */
-static inline int atomic64_inc_and_test(atomic64_t *ptr)
-{
-        return atomic64_sub_and_test(-1, ptr);
-}
+extern int atomic64_inc_and_test(atomic64_t *ptr);
 
 /**
  * atomic64_add_negative - add and test if negative
@@ -474,13 +409,7 @@ static inline int atomic64_inc_and_test(atomic64_t *ptr)
  * if the result is negative, or false when
  * result is greater than or equal to zero.
  */
-static inline int
-atomic64_add_negative(unsigned long long delta, atomic64_t *ptr)
-{
-        long long old_val = atomic64_add_return(delta, ptr);
-
-        return old_val < 0;
-}
+extern int atomic64_add_negative(u64 delta, atomic64_t *ptr);
 
 #include <asm-generic/atomic-long.h>
 #endif /* _ASM_X86_ATOMIC_32_H */
diff --git a/arch/x86/include/asm/atomic_64.h b/arch/x86/include/asm/atomic_64.h
index 0d6360220007..d605dc268e79 100644
--- a/arch/x86/include/asm/atomic_64.h
+++ b/arch/x86/include/asm/atomic_64.h
@@ -18,7 +18,10 @@
  *
  * Atomically reads the value of @v.
  */
-#define atomic_read(v)          ((v)->counter)
+static inline int atomic_read(const atomic_t *v)
+{
+        return v->counter;
+}
 
 /**
  * atomic_set - set atomic variable
@@ -27,7 +30,10 @@
  *
  * Atomically sets the value of @v to @i.
  */
-#define atomic_set(v, i)                (((v)->counter) = (i))
+static inline void atomic_set(atomic_t *v, int i)
+{
+        v->counter = i;
+}
 
 /**
  * atomic_add - add integer to atomic variable
@@ -192,7 +198,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
  * Atomically reads the value of @v.
  * Doesn't imply a read memory barrier.
  */
-#define atomic64_read(v)                ((v)->counter)
+static inline long atomic64_read(const atomic64_t *v)
+{
+        return v->counter;
+}
 
 /**
  * atomic64_set - set atomic64 variable
@@ -201,7 +210,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
  *
  * Atomically sets the value of @v to @i.
  */
-#define atomic64_set(v, i)              (((v)->counter) = (i))
+static inline void atomic64_set(atomic64_t *v, long i)
+{
+        v->counter = i;
+}
 
 /**
  * atomic64_add - add integer to atomic64 variable
@@ -355,11 +367,25 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
 #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
 #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
 
-#define atomic64_cmpxchg(v, old, new) (cmpxchg(&((v)->counter), (old), (new)))
-#define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
+static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
+{
+        return cmpxchg(&v->counter, old, new);
+}
+
+static inline long atomic64_xchg(atomic64_t *v, long new)
+{
+        return xchg(&v->counter, new);
+}
 
-#define atomic_cmpxchg(v, old, new) (cmpxchg(&((v)->counter), (old), (new)))
-#define atomic_xchg(v, new) (xchg(&((v)->counter), (new)))
+static inline long atomic_cmpxchg(atomic_t *v, int old, int new)
+{
+        return cmpxchg(&v->counter, old, new);
+}
+
+static inline long atomic_xchg(atomic_t *v, int new)
+{
+        return xchg(&v->counter, new);
+}
 
 /**
  * atomic_add_unless - add unless the number is a given value
diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h
index daf866ed0612..330ee807f89e 100644
--- a/arch/x86/include/asm/io_apic.h
+++ b/arch/x86/include/asm/io_apic.h
@@ -161,6 +161,7 @@ extern int io_apic_set_pci_routing(struct device *dev, int irq,
                  struct io_apic_irq_attr *irq_attr);
 extern int (*ioapic_renumber_irq)(int ioapic, int irq);
 extern void ioapic_init_mappings(void);
+extern void ioapic_insert_resources(void);
 
 extern struct IO_APIC_route_entry **alloc_ioapic_entries(void);
 extern void free_ioapic_entries(struct IO_APIC_route_entry **ioapic_entries);
@@ -180,6 +181,7 @@ extern void ioapic_write_entry(int apic, int pin,
 #define io_apic_assign_pci_irqs 0
 static const int timer_through_8259 = 0;
 static inline void ioapic_init_mappings(void)   { }
+static inline void ioapic_insert_resources(void) { }
 
 static inline void probe_nr_irqs_gsi(void)      { }
 #endif
diff --git a/arch/x86/include/asm/lguest_hcall.h b/arch/x86/include/asm/lguest_hcall.h
index d31c4a684078..33600a66755f 100644
--- a/arch/x86/include/asm/lguest_hcall.h
+++ b/arch/x86/include/asm/lguest_hcall.h
@@ -30,7 +30,7 @@
 #include <asm/hw_irq.h>
 #include <asm/kvm_para.h>
 
-/*G:031 But first, how does our Guest contact the Host to ask for privileged
+/*G:030 But first, how does our Guest contact the Host to ask for privileged
  * operations?  There are two ways: the direct way is to make a "hypercall",
  * to make requests of the Host Itself.
  *
diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
index f517944b2b17..cf86a5e73815 100644
--- a/arch/x86/include/asm/stacktrace.h
+++ b/arch/x86/include/asm/stacktrace.h
@@ -3,6 +3,8 @@
 
 extern int kstack_depth_to_print;
 
+int x86_is_stack_id(int id, char *name);
+
 /* Generic stack tracer with callbacks */
 
 struct stacktrace_ops {
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index b0783520988b..fad7d40b75f8 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -49,7 +49,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .addr_limit     = KERNEL_DS,            \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
diff --git a/arch/x86/kernel/apic/es7000_32.c b/arch/x86/kernel/apic/es7000_32.c
index 69328ac8de9c..8952a5890281 100644
--- a/arch/x86/kernel/apic/es7000_32.c
+++ b/arch/x86/kernel/apic/es7000_32.c
@@ -652,7 +652,8 @@ static int es7000_mps_oem_check_cluster(struct mpc_table *mpc, char *oem,
         return ret && es7000_apic_is_cluster();
 }
 
-struct apic apic_es7000_cluster = {
+/* We've been warned by a false positive warning.Use __refdata to keep calm. */
+struct apic __refdata apic_es7000_cluster = {
 
         .name                           = "es7000",
         .probe                          = probe_es7000,
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 90b5e6efa938..2284a4812b68 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -4181,28 +4181,20 @@ fake_ioapic_page:
         }
 }
 
-static int __init ioapic_insert_resources(void)
+void __init ioapic_insert_resources(void)
 {
         int i;
         struct resource *r = ioapic_resources;
 
         if (!r) {
-                if (nr_ioapics > 0) {
+                if (nr_ioapics > 0)
                         printk(KERN_ERR
                                 "IO APIC resources couldn't be allocated.\n");
-                        return -1;
-                }
-                return 0;
+                return;
         }
 
         for (i = 0; i < nr_ioapics; i++) {
                 insert_resource(&iomem_resource, r);
                 r++;
         }
-
-        return 0;
 }
-
-/* Insert the IO APIC resources after PCI initialization has occured to handle
- * IO APICS that are mapped in on a BAR in PCI space. */
-late_initcall(ioapic_insert_resources);
diff --git a/arch/x86/kernel/apic/numaq_32.c b/arch/x86/kernel/apic/numaq_32.c
index 533e59c6fc82..ca96e68f0d23 100644
--- a/arch/x86/kernel/apic/numaq_32.c
+++ b/arch/x86/kernel/apic/numaq_32.c
@@ -493,7 +493,8 @@ static void numaq_setup_portio_remap(void)
                 (u_long) xquad_portio, (u_long) num_quads*XQUAD_PORTIO_QUAD);
 }
 
-struct apic apic_numaq = {
+/* Use __refdata to keep false positive warning calm.   */
+struct apic __refdata apic_numaq = {
 
         .name                           = "NUMAQ",
         .probe                          = probe_numaq,
diff --git a/arch/x86/kernel/cpu/perf_counter.c b/arch/x86/kernel/cpu/perf_counter.c
index d4cf4ce19aac..36c3dc7b8991 100644
--- a/arch/x86/kernel/cpu/perf_counter.c
+++ b/arch/x86/kernel/cpu/perf_counter.c
@@ -1561,6 +1561,7 @@ void callchain_store(struct perf_callchain_entry *entry, u64 ip)
 
 static DEFINE_PER_CPU(struct perf_callchain_entry, irq_entry);
 static DEFINE_PER_CPU(struct perf_callchain_entry, nmi_entry);
+static DEFINE_PER_CPU(int, in_nmi_frame);
 
 
 static void
@@ -1576,7 +1577,9 @@ static void backtrace_warning(void *data, char *msg)
 
 static int backtrace_stack(void *data, char *name)
 {
-        /* Process all stacks: */
+        per_cpu(in_nmi_frame, smp_processor_id()) =
+                        x86_is_stack_id(NMI_STACK, name);
+
         return 0;
 }
 
@@ -1584,6 +1587,9 @@ static void backtrace_address(void *data, unsigned long addr, int reliable)
 {
         struct perf_callchain_entry *entry = data;
 
+        if (per_cpu(in_nmi_frame, smp_processor_id()))
+                return;
+
         if (reliable)
                 callchain_store(entry, addr);
 }
diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
index d593cd1f58dc..bca5fba91c9e 100644
--- a/arch/x86/kernel/dumpstack_32.c
+++ b/arch/x86/kernel/dumpstack_32.c
@@ -19,6 +19,12 @@
 
 #include "dumpstack.h"
 
+/* Just a stub for now */
+int x86_is_stack_id(int id, char *name)
+{
+        return 0;
+}
+
 void dump_trace(struct task_struct *task, struct pt_regs *regs,
                 unsigned long *stack, unsigned long bp,
                 const struct stacktrace_ops *ops, void *data)
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index d35db5993fd6..54b0a3276766 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -19,10 +19,8 @@
 
 #include "dumpstack.h"
 
-static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
-                                        unsigned *usedp, char **idp)
-{
-        static char ids[][8] = {
+
+static char x86_stack_ids[][8] = {
                 [DEBUG_STACK - 1] = "#DB",
                 [NMI_STACK - 1] = "NMI",
                 [DOUBLEFAULT_STACK - 1] = "#DF",
@@ -33,6 +31,15 @@ static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
                         N_EXCEPTION_STACKS + DEBUG_STKSZ / EXCEPTION_STKSZ - 2] = "#DB[?]"
 #endif
         };
+
+int x86_is_stack_id(int id, char *name)
+{
+        return x86_stack_ids[id - 1] == name;
+}
+
+static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
+                                        unsigned *usedp, char **idp)
+{
         unsigned k;
 
         /*
@@ -61,7 +68,7 @@ static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
                         if (*usedp & (1U << k))
                                 break;
                         *usedp |= 1U << k;
-                        *idp = ids[k];
+                        *idp = x86_stack_ids[k];
                         return (unsigned long *)end;
                 }
                 /*
@@ -81,12 +88,13 @@ static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
                         do {
                                 ++j;
                                 end -= EXCEPTION_STKSZ;
-                                ids[j][4] = '1' + (j - N_EXCEPTION_STACKS);
+                                x86_stack_ids[j][4] = '1' +
+                                                (j - N_EXCEPTION_STACKS);
                         } while (stack < end - EXCEPTION_STKSZ);
                         if (*usedp & (1U << j))
                                 break;
                         *usedp |= 1U << j;
-                        *idp = ids[j];
+                        *idp = x86_stack_ids[j];
                         return (unsigned long *)end;
                 }
 #endif
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
index 4f9c55f3a7c0..03801f2f761f 100644
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -60,7 +60,7 @@ static inline u64 scale_delta(u64 delta, u32 mul_frac, int shift)
                 "adc  %5,%%edx ; "
                 : "=A" (product), "=r" (tmp1), "=r" (tmp2)
                 : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
-#elif __x86_64__
+#elif defined(__x86_64__)
         __asm__ (
                 "mul %%rdx ; shrd $32,%%rdx,%%rax"
                 : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 7bc65f0f62c4..f2bf1f73d468 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -379,6 +379,11 @@ static void lguest_cpuid(unsigned int *ax, unsigned int *bx,
 
         native_cpuid(ax, bx, cx, dx);
         switch (function) {
+        case 0: /* ID and highest CPUID.  Futureproof a little by sticking to
+                 * older ones. */
+                if (*ax > 5)
+                        *ax = 5;
+                break;
         case 1: /* Basic feature request. */
                 /* We only allow kernel to see SSE3, CMPXCHG16B and SSSE3 */
                 *cx &= 0x00002201;
@@ -1079,7 +1084,7 @@ static unsigned lguest_patch(u8 type, u16 clobber, void *ibuf,
         return insn_len;
 }
 
-/*G:030 Once we get to lguest_init(), we know we're a Guest.  The various
+/*G:029 Once we get to lguest_init(), we know we're a Guest.  The various
  * pv_ops structures in the kernel provide points for (almost) every routine we
  * have to override to avoid privileged instructions. */
 __init void lguest_init(void)
diff --git a/arch/x86/lib/Makefile b/arch/x86/lib/Makefile
index f9d35632666b..07c31899c9c2 100644
--- a/arch/x86/lib/Makefile
+++ b/arch/x86/lib/Makefile
@@ -10,6 +10,7 @@ lib-y += usercopy_$(BITS).o getuser.o putuser.o
 lib-y += memcpy_$(BITS).o
 
 ifeq ($(CONFIG_X86_32),y)
+        obj-y += atomic64_32.o
         lib-y += checksum_32.o
         lib-y += strstr_32.o
         lib-y += semaphore_32.o string_32.o
diff --git a/arch/x86/lib/atomic64_32.c b/arch/x86/lib/atomic64_32.c
new file mode 100644
index 000000000000..824fa0be55a3
--- /dev/null
+++ b/arch/x86/lib/atomic64_32.c
@@ -0,0 +1,230 @@
+#include <linux/compiler.h>
+#include <linux/module.h>
+#include <linux/types.h>
+
+#include <asm/processor.h>
+#include <asm/cmpxchg.h>
+#include <asm/atomic.h>
+
+static noinline u64 cmpxchg8b(u64 *ptr, u64 old, u64 new)
+{
+        u32 low = new;
+        u32 high = new >> 32;
+
+        asm volatile(
+                LOCK_PREFIX "cmpxchg8b %1\n"
+                     : "+A" (old), "+m" (*ptr)
+                     :  "b" (low),  "c" (high)
+                     );
+        return old;
+}
+
+u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val)
+{
+        return cmpxchg8b(&ptr->counter, old_val, new_val);
+}
+EXPORT_SYMBOL(atomic64_cmpxchg);
+
+/**
+ * atomic64_xchg - xchg atomic64 variable
+ * @ptr:      pointer to type atomic64_t
+ * @new_val:  value to assign
+ *
+ * Atomically xchgs the value of @ptr to @new_val and returns
+ * the old value.
+ */
+u64 atomic64_xchg(atomic64_t *ptr, u64 new_val)
+{
+        /*
+         * Try first with a (possibly incorrect) assumption about
+         * what we have there. We'll do two loops most likely,
+         * but we'll get an ownership MESI transaction straight away
+         * instead of a read transaction followed by a
+         * flush-for-ownership transaction:
+         */
+        u64 old_val, real_val = 0;
+
+        do {
+                old_val = real_val;
+
+                real_val = atomic64_cmpxchg(ptr, old_val, new_val);
+
+        } while (real_val != old_val);
+
+        return old_val;
+}
+EXPORT_SYMBOL(atomic64_xchg);
+
+/**
+ * atomic64_set - set atomic64 variable
+ * @ptr:      pointer to type atomic64_t
+ * @new_val:  value to assign
+ *
+ * Atomically sets the value of @ptr to @new_val.
+ */
+void atomic64_set(atomic64_t *ptr, u64 new_val)
+{
+        atomic64_xchg(ptr, new_val);
+}
+EXPORT_SYMBOL(atomic64_set);
+
+/**
+EXPORT_SYMBOL(atomic64_read);
+ * atomic64_add_return - add and return
+ * @delta: integer value to add
+ * @ptr:   pointer to type atomic64_t
+ *
+ * Atomically adds @delta to @ptr and returns @delta + *@ptr
+ */
+noinline u64 atomic64_add_return(u64 delta, atomic64_t *ptr)
+{
+        /*
+         * Try first with a (possibly incorrect) assumption about
+         * what we have there. We'll do two loops most likely,
+         * but we'll get an ownership MESI transaction straight away
+         * instead of a read transaction followed by a
+         * flush-for-ownership transaction:
+         */
+        u64 old_val, new_val, real_val = 0;
+
+        do {
+                old_val = real_val;
+                new_val = old_val + delta;
+
+                real_val = atomic64_cmpxchg(ptr, old_val, new_val);
+
+        } while (real_val != old_val);
+
+        return new_val;
+}
+EXPORT_SYMBOL(atomic64_add_return);
+
+u64 atomic64_sub_return(u64 delta, atomic64_t *ptr)
+{
+        return atomic64_add_return(-delta, ptr);
+}
+EXPORT_SYMBOL(atomic64_sub_return);
+
+u64 atomic64_inc_return(atomic64_t *ptr)
+{
+        return atomic64_add_return(1, ptr);
+}
+EXPORT_SYMBOL(atomic64_inc_return);
+
+u64 atomic64_dec_return(atomic64_t *ptr)
+{
+        return atomic64_sub_return(1, ptr);
+}
+EXPORT_SYMBOL(atomic64_dec_return);
+
+/**
+ * atomic64_add - add integer to atomic64 variable
+ * @delta: integer value to add
+ * @ptr:   pointer to type atomic64_t
+ *
+ * Atomically adds @delta to @ptr.
+ */
+void atomic64_add(u64 delta, atomic64_t *ptr)
+{
+        atomic64_add_return(delta, ptr);
+}
+EXPORT_SYMBOL(atomic64_add);
+
+/**
+ * atomic64_sub - subtract the atomic64 variable
+ * @delta: integer value to subtract
+ * @ptr:   pointer to type atomic64_t
+ *
+ * Atomically subtracts @delta from @ptr.
+ */
+void atomic64_sub(u64 delta, atomic64_t *ptr)
+{
+        atomic64_add(-delta, ptr);
+}
+EXPORT_SYMBOL(atomic64_sub);
+
+/**
+ * atomic64_sub_and_test - subtract value from variable and test result
+ * @delta: integer value to subtract
+ * @ptr:   pointer to type atomic64_t
+ *
+ * Atomically subtracts @delta from @ptr and returns
+ * true if the result is zero, or false for all
+ * other cases.
+ */
+int atomic64_sub_and_test(u64 delta, atomic64_t *ptr)
+{
+        u64 new_val = atomic64_sub_return(delta, ptr);
+
+        return new_val == 0;
+}
+EXPORT_SYMBOL(atomic64_sub_and_test);
+
+/**
+ * atomic64_inc - increment atomic64 variable
+ * @ptr: pointer to type atomic64_t
+ *
+ * Atomically increments @ptr by 1.
+ */
+void atomic64_inc(atomic64_t *ptr)
+{
+        atomic64_add(1, ptr);
+}
+EXPORT_SYMBOL(atomic64_inc);
+
+/**
+ * atomic64_dec - decrement atomic64 variable
+ * @ptr: pointer to type atomic64_t
+ *
+ * Atomically decrements @ptr by 1.
+ */
+void atomic64_dec(atomic64_t *ptr)
+{
+        atomic64_sub(1, ptr);
+}
+EXPORT_SYMBOL(atomic64_dec);
+
+/**
+ * atomic64_dec_and_test - decrement and test
+ * @ptr: pointer to type atomic64_t
+ *
+ * Atomically decrements @ptr by 1 and
+ * returns true if the result is 0, or false for all other
+ * cases.
+ */
+int atomic64_dec_and_test(atomic64_t *ptr)
+{
+        return atomic64_sub_and_test(1, ptr);
+}
+EXPORT_SYMBOL(atomic64_dec_and_test);
+
+/**
+ * atomic64_inc_and_test - increment and test
+ * @ptr: pointer to type atomic64_t
+ *
+ * Atomically increments @ptr by 1
+ * and returns true if the result is zero, or false for all
+ * other cases.
+ */
+int atomic64_inc_and_test(atomic64_t *ptr)
+{
+        return atomic64_sub_and_test(-1, ptr);
+}
+EXPORT_SYMBOL(atomic64_inc_and_test);
+
+/**
+ * atomic64_add_negative - add and test if negative
+ * @delta: integer value to add
+ * @ptr:   pointer to type atomic64_t
+ *
+ * Atomically adds @delta to @ptr and returns true
+ * if the result is negative, or false when
+ * result is greater than or equal to zero.
+ */
+int atomic64_add_negative(u64 delta, atomic64_t *ptr)
+{
+        s64 new_val = atomic64_add_return(delta, ptr);
+
+        return new_val < 0;
+}
+EXPORT_SYMBOL(atomic64_add_negative);
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 85307cc6e45f..bfae139182ff 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -697,7 +697,7 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code,
         if (!printk_ratelimit())
                 return;
 
-        printk(KERN_CONT "%s%s[%d]: segfault at %lx ip %p sp %p error %lx",
+        printk("%s%s[%d]: segfault at %lx ip %p sp %p error %lx",
                 task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
                 tsk->comm, task_pid_nr(tsk), address,
                 (void *)regs->ip, (void *)regs->sp, error_code);
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index b07dd8d0b321..89b9a5cd63da 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -390,7 +390,7 @@ static int __init p4_init(char **cpu_type)
 static int force_arch_perfmon;
 static int force_cpu_type(const char *str, struct kernel_param *kp)
 {
-        if (!strcmp(str, "archperfmon")) {
+        if (!strcmp(str, "arch_perfmon")) {
                 force_arch_perfmon = 1;
                 printk(KERN_INFO "oprofile: forcing architectural perfmon\n");
         }
diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
index 0fb56db16d18..52e62e57fedd 100644
--- a/arch/x86/pci/i386.c
+++ b/arch/x86/pci/i386.c
@@ -35,6 +35,7 @@
 #include <asm/pat.h>
 #include <asm/e820.h>
 #include <asm/pci_x86.h>
+#include <asm/io_apic.h>
 
 
 static int
@@ -227,6 +228,12 @@ void __init pcibios_resource_survey(void)
         pcibios_allocate_resources(1);
 
         e820_reserve_resources_late();
+        /*
+         * Insert the IO APIC resources after PCI initialization has
+         * occured to handle IO APICS that are mapped in on a BAR in
+         * PCI space, but before trying to assign unassigned pci res.
+         */
+        ioapic_insert_resources();
 }
 
 /**
diff --git a/arch/xtensa/include/asm/thread_info.h b/arch/xtensa/include/asm/thread_info.h
index 0f4fe1faf9ba..13165641cc51 100644
--- a/arch/xtensa/include/asm/thread_info.h
+++ b/arch/xtensa/include/asm/thread_info.h
@@ -80,8 +80,6 @@ struct thread_info {
 
 /*
  * macros/functions for gaining access to the thread information structure
- *
- * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 
 #ifndef __ASSEMBLY__
@@ -92,7 +90,7 @@ struct thread_info {
         .exec_domain    = &default_exec_domain, \
         .flags          = 0,                    \
         .cpu            = 0,                    \
-        .preempt_count  = 1,                    \
+        .preempt_count  = INIT_PREEMPT_COUNT,   \
         .addr_limit     = KERNEL_DS,            \
         .restart_block = {                      \
                 .fn = do_no_restart_syscall,    \
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 15a23031833f..336eb1ed73cc 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -513,6 +513,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x502a), board_ahci }, /* Tolapai */
         { PCI_VDEVICE(INTEL, 0x502b), board_ahci }, /* Tolapai */
         { PCI_VDEVICE(INTEL, 0x3a05), board_ahci }, /* ICH10 */
+        { PCI_VDEVICE(INTEL, 0x3a22), board_ahci }, /* ICH10 */
         { PCI_VDEVICE(INTEL, 0x3a25), board_ahci }, /* ICH10 */
         { PCI_VDEVICE(INTEL, 0x3b24), board_ahci }, /* PCH RAID */
         { PCI_VDEVICE(INTEL, 0x3b25), board_ahci }, /* PCH RAID */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 045a486a09ea..2c6aedaef718 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3392,17 +3392,27 @@ int ata_down_xfermask_limit(struct ata_device *dev, unsigned int sel)
 
 static int ata_dev_set_mode(struct ata_device *dev)
 {
+        struct ata_port *ap = dev->link->ap;
         struct ata_eh_context *ehc = &dev->link->eh_context;
+        const bool nosetxfer = dev->horkage & ATA_HORKAGE_NOSETXFER;
         const char *dev_err_whine = "";
         int ign_dev_err = 0;
-        unsigned int err_mask;
+        unsigned int err_mask = 0;
         int rc;
 
         dev->flags &= ~ATA_DFLAG_PIO;
         if (dev->xfer_shift == ATA_SHIFT_PIO)
                 dev->flags |= ATA_DFLAG_PIO;
 
-        err_mask = ata_dev_set_xfermode(dev);
+        if (nosetxfer && ap->flags & ATA_FLAG_SATA && ata_id_is_sata(dev->id))
+                dev_err_whine = " (SET_XFERMODE skipped)";
+        else {
+                if (nosetxfer)
+                        ata_dev_printk(dev, KERN_WARNING,
+                                       "NOSETXFER but PATA detected - can't "
+                                       "skip SETXFER, might malfunction\n");
+                err_mask = ata_dev_set_xfermode(dev);
+        }
 
         if (err_mask & ~AC_ERR_DEV)
                 goto fail;
@@ -4297,6 +4307,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         /* Devices which aren't very happy with higher link speeds */
         { "WD My Book",                 NULL,   ATA_HORKAGE_1_5_GBPS, },
 
+        /*
+         * Devices which choke on SETXFER.  Applies only if both the
+         * device and controller are SATA.
+         */
+        { "PIONEER DVD-RW  DVRTD08",    "1.00", ATA_HORKAGE_NOSETXFER },
+
         /* End Marker */
         { }
 };
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index fa22f94ca415..1a07c061f644 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2517,6 +2517,10 @@ int ata_eh_reset(struct ata_link *link, int classify,
 
                         ata_eh_about_to_do(link, NULL, ATA_EH_RESET);
                         rc = ata_do_reset(link, reset, classes, deadline, true);
+                        if (rc) {
+                                failed_link = link;
+                                goto fail;
+                        }
                 }
         } else {
                 if (verbose)
diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
index 4b27617be26d..8561a9f195c1 100644
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -312,11 +312,12 @@ err_ide_ioremap:
 static int __devexit pata_at91_remove(struct platform_device *pdev)
 {
         struct ata_host *host = dev_get_drvdata(&pdev->dev);
-        struct at91_ide_info *info = host->private_data;
+        struct at91_ide_info *info;
         struct device *dev = &pdev->dev;
 
         if (!host)
                 return 0;
+        info = host->private_data;
 
         ata_host_detach(host);
 
diff --git a/drivers/base/devres.c b/drivers/base/devres.c
index e8beb8e5b626..05dd307e8f02 100644
--- a/drivers/base/devres.c
+++ b/drivers/base/devres.c
@@ -428,6 +428,9 @@ int devres_release_all(struct device *dev)
 {
         unsigned long flags;
 
+        /* Looks like an uninitialized device structure */
+        if (WARN_ON(dev->devres_head.next == NULL))
+                return -ENODEV;
         spin_lock_irqsave(&dev->devres_lock, flags);
         return release_nodes(dev, dev->devres_head.next, &dev->devres_head,
                              flags);
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index fc466531260e..f285f441fab9 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -217,8 +217,10 @@ firmware_data_read(struct kobject *kobj, struct bin_attribute *bin_attr,
                 ret_count = -ENODEV;
                 goto out;
         }
-        if (offset > fw->size)
-                return 0;
+        if (offset > fw->size) {
+                ret_count = 0;
+                goto out;
+        }
         if (count > fw->size - offset)
                 count = fw->size - offset;
 
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 668dc234b8e2..1e6b7c14f697 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -36,6 +36,7 @@
 #include <linux/ioport.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/proc_fs.h>
 #include <linux/reboot.h>
 #include <linux/spinlock.h>
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index bb72ada9f074..1d886e079c58 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -298,6 +298,22 @@ config BLK_DEV_NBD
 
           If unsure, say N.
 
+config BLK_DEV_OSD
+        tristate "OSD object-as-blkdev support"
+        depends on SCSI_OSD_ULD
+        ---help---
+          Saying Y or M here will allow the exporting of a single SCSI
+          OSD (object-based storage) object as a Linux block device.
+
+          For example, if you create a 2G object on an OSD device,
+          you can then use this module to present that 2G object as
+          a Linux block device.
+
+          To compile this driver as a module, choose M here: the
+          module will be called osdblk.
+
+          If unsure, say N.
+
 config BLK_DEV_SX8
         tristate "Promise SATA SX8 support"
         depends on PCI
diff --git a/drivers/block/Makefile b/drivers/block/Makefile
index 7755a5e2a85e..cdaa3f8fddf0 100644
--- a/drivers/block/Makefile
+++ b/drivers/block/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_XILINX_SYSACE)	+= xsysace.o
 obj-$(CONFIG_CDROM_PKTCDVD)     += pktcdvd.o
 obj-$(CONFIG_MG_DISK)           += mg_disk.o
 obj-$(CONFIG_SUNVDC)            += sunvdc.o
+obj-$(CONFIG_BLK_DEV_OSD)       += osdblk.o
 
 obj-$(CONFIG_BLK_DEV_UMEM)      += umem.o
 obj-$(CONFIG_BLK_DEV_NBD)       += nbd.o
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 65a0655e7fc8..a52cc7fe45ea 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -26,6 +26,7 @@
 #include <linux/pci.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/delay.h>
 #include <linux/major.h>
 #include <linux/fs.h>
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 801f4ab83302..5757188cd1fb 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -61,7 +61,6 @@
 #include <linux/blkdev.h>
 #include <linux/blkpg.h>
 #include <linux/init.h>
-#include <linux/smp_lock.h>
 #include <linux/swap.h>
 #include <linux/slab.h>
 #include <linux/loop.h>
diff --git a/drivers/block/osdblk.c b/drivers/block/osdblk.c
new file mode 100644
index 000000000000..13c1aee6aa3f
--- /dev/null
+++ b/drivers/block/osdblk.c
@@ -0,0 +1,701 @@
+
+/*
+   osdblk.c -- Export a single SCSI OSD object as a Linux block device
+
+
+   Copyright 2009 Red Hat, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+
+   Instructions for use
+   --------------------
+
+   1) Map a Linux block device to an existing OSD object.
+
+      In this example, we will use partition id 1234, object id 5678,
+      OSD device /dev/osd1.
+
+      $ echo "1234 5678 /dev/osd1" > /sys/class/osdblk/add
+
+
+   2) List all active blkdev<->object mappings.
+
+      In this example, we have performed step #1 twice, creating two blkdevs,
+      mapped to two separate OSD objects.
+
+      $ cat /sys/class/osdblk/list
+      0 174 1234 5678 /dev/osd1
+      1 179 1994 897123 /dev/osd0
+
+      The columns, in order, are:
+      - blkdev unique id
+      - blkdev assigned major
+      - OSD object partition id
+      - OSD object id
+      - OSD device
+
+
+   3) Remove an active blkdev<->object mapping.
+
+      In this example, we remove the mapping with blkdev unique id 1.
+
+      $ echo 1 > /sys/class/osdblk/remove
+
+
+   NOTE:  The actual creation and deletion of OSD objects is outside the scope
+   of this driver.
+
+ */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <scsi/osd_initiator.h>
+#include <scsi/osd_attributes.h>
+#include <scsi/osd_sec.h>
+#include <scsi/scsi_device.h>
+
+#define DRV_NAME "osdblk"
+#define PFX DRV_NAME ": "
+
+/* #define _OSDBLK_DEBUG */
+#ifdef _OSDBLK_DEBUG
+#define OSDBLK_DEBUG(fmt, a...) \
+        printk(KERN_NOTICE "osdblk @%s:%d: " fmt, __func__, __LINE__, ##a)
+#else
+#define OSDBLK_DEBUG(fmt, a...) \
+        do { if (0) printk(fmt, ##a); } while (0)
+#endif
+
+MODULE_AUTHOR("Jeff Garzik <jeff@garzik.org>");
+MODULE_DESCRIPTION("block device inside an OSD object osdblk.ko");
+MODULE_LICENSE("GPL");
+
+struct osdblk_device;
+
+enum {
+        OSDBLK_MINORS_PER_MAJOR = 256,          /* max minors per blkdev */
+        OSDBLK_MAX_REQ          = 32,           /* max parallel requests */
+        OSDBLK_OP_TIMEOUT       = 4 * 60,       /* sync OSD req timeout */
+};
+
+struct osdblk_request {
+        struct request          *rq;            /* blk layer request */
+        struct bio              *bio;           /* cloned bio */
+        struct osdblk_device    *osdev;         /* associated blkdev */
+};
+
+struct osdblk_device {
+        int                     id;             /* blkdev unique id */
+
+        int                     major;          /* blkdev assigned major */
+        struct gendisk          *disk;          /* blkdev's gendisk and rq */
+        struct request_queue    *q;
+
+        struct osd_dev          *osd;           /* associated OSD */
+
+        char                    name[32];       /* blkdev name, e.g. osdblk34 */
+
+        spinlock_t              lock;           /* queue lock */
+
+        struct osd_obj_id       obj;            /* OSD partition, obj id */
+        uint8_t                 obj_cred[OSD_CAP_LEN]; /* OSD cred */
+
+        struct osdblk_request   req[OSDBLK_MAX_REQ]; /* request table */
+
+        struct list_head        node;
+
+        char                    osd_path[0];    /* OSD device path */
+};
+
+static struct class *class_osdblk;              /* /sys/class/osdblk */
+static DEFINE_MUTEX(ctl_mutex); /* Serialize open/close/setup/teardown */
+static LIST_HEAD(osdblkdev_list);
+
+static struct block_device_operations osdblk_bd_ops = {
+        .owner          = THIS_MODULE,
+};
+
+static const struct osd_attr g_attr_logical_length = ATTR_DEF(
+        OSD_APAGE_OBJECT_INFORMATION, OSD_ATTR_OI_LOGICAL_LENGTH, 8);
+
+static void osdblk_make_credential(u8 cred_a[OSD_CAP_LEN],
+                                   const struct osd_obj_id *obj)
+{
+        osd_sec_init_nosec_doall_caps(cred_a, obj, false, true);
+}
+
+/* copied from exofs; move to libosd? */
+/*
+ * Perform a synchronous OSD operation.  copied from exofs; move to libosd?
+ */
+static int osd_sync_op(struct osd_request *or, int timeout, uint8_t *credential)
+{
+        int ret;
+
+        or->timeout = timeout;
+        ret = osd_finalize_request(or, 0, credential, NULL);
+        if (ret)
+                return ret;
+
+        ret = osd_execute_request(or);
+
+        /* osd_req_decode_sense(or, ret); */
+        return ret;
+}
+
+/*
+ * Perform an asynchronous OSD operation.  copied from exofs; move to libosd?
+ */
+static int osd_async_op(struct osd_request *or, osd_req_done_fn *async_done,
+                   void *caller_context, u8 *cred)
+{
+        int ret;
+
+        ret = osd_finalize_request(or, 0, cred, NULL);
+        if (ret)
+                return ret;
+
+        ret = osd_execute_request_async(or, async_done, caller_context);
+
+        return ret;
+}
+
+/* copied from exofs; move to libosd? */
+static int extract_attr_from_req(struct osd_request *or, struct osd_attr *attr)
+{
+        struct osd_attr cur_attr = {.attr_page = 0}; /* start with zeros */
+        void *iter = NULL;
+        int nelem;
+
+        do {
+                nelem = 1;
+                osd_req_decode_get_attr_list(or, &cur_attr, &nelem, &iter);
+                if ((cur_attr.attr_page == attr->attr_page) &&
+                    (cur_attr.attr_id == attr->attr_id)) {
+                        attr->len = cur_attr.len;
+                        attr->val_ptr = cur_attr.val_ptr;
+                        return 0;
+                }
+        } while (iter);
+
+        return -EIO;
+}
+
+static int osdblk_get_obj_size(struct osdblk_device *osdev, u64 *size_out)
+{
+        struct osd_request *or;
+        struct osd_attr attr;
+        int ret;
+
+        /* start request */
+        or = osd_start_request(osdev->osd, GFP_KERNEL);
+        if (!or)
+                return -ENOMEM;
+
+        /* create a get-attributes(length) request */
+        osd_req_get_attributes(or, &osdev->obj);
+
+        osd_req_add_get_attr_list(or, &g_attr_logical_length, 1);
+
+        /* execute op synchronously */
+        ret = osd_sync_op(or, OSDBLK_OP_TIMEOUT, osdev->obj_cred);
+        if (ret)
+                goto out;
+
+        /* extract length from returned attribute info */
+        attr = g_attr_logical_length;
+        ret = extract_attr_from_req(or, &attr);
+        if (ret)
+                goto out;
+
+        *size_out = get_unaligned_be64(attr.val_ptr);
+
+out:
+        osd_end_request(or);
+        return ret;
+
+}
+
+static void osdblk_osd_complete(struct osd_request *or, void *private)
+{
+        struct osdblk_request *orq = private;
+        struct osd_sense_info osi;
+        int ret = osd_req_decode_sense(or, &osi);
+
+        if (ret) {
+                ret = -EIO;
+                OSDBLK_DEBUG("osdblk_osd_complete with err=%d\n", ret);
+        }
+
+        /* complete OSD request */
+        osd_end_request(or);
+
+        /* complete request passed to osdblk by block layer */
+        __blk_end_request_all(orq->rq, ret);
+}
+
+static void bio_chain_put(struct bio *chain)
+{
+        struct bio *tmp;
+
+        while (chain) {
+                tmp = chain;
+                chain = chain->bi_next;
+
+                bio_put(tmp);
+        }
+}
+
+static struct bio *bio_chain_clone(struct bio *old_chain, gfp_t gfpmask)
+{
+        struct bio *tmp, *new_chain = NULL, *tail = NULL;
+
+        while (old_chain) {
+                tmp = bio_kmalloc(gfpmask, old_chain->bi_max_vecs);
+                if (!tmp)
+                        goto err_out;
+
+                __bio_clone(tmp, old_chain);
+                tmp->bi_bdev = NULL;
+                gfpmask &= ~__GFP_WAIT;
+                tmp->bi_next = NULL;
+
+                if (!new_chain)
+                        new_chain = tail = tmp;
+                else {
+                        tail->bi_next = tmp;
+                        tail = tmp;
+                }
+
+                old_chain = old_chain->bi_next;
+        }
+
+        return new_chain;
+
+err_out:
+        OSDBLK_DEBUG("bio_chain_clone with err\n");
+        bio_chain_put(new_chain);
+        return NULL;
+}
+
+static void osdblk_rq_fn(struct request_queue *q)
+{
+        struct osdblk_device *osdev = q->queuedata;
+
+        while (1) {
+                struct request *rq;
+                struct osdblk_request *orq;
+                struct osd_request *or;
+                struct bio *bio;
+                bool do_write, do_flush;
+
+                /* peek at request from block layer */
+                rq = blk_fetch_request(q);
+                if (!rq)
+                        break;
+
+                /* filter out block requests we don't understand */
+                if (!blk_fs_request(rq) && !blk_barrier_rq(rq)) {
+                        blk_end_request_all(rq, 0);
+                        continue;
+                }
+
+                /* deduce our operation (read, write, flush) */
+                /* I wish the block layer simplified cmd_type/cmd_flags/cmd[]
+                 * into a clearly defined set of RPC commands:
+                 * read, write, flush, scsi command, power mgmt req,
+                 * driver-specific, etc.
+                 */
+
+                do_flush = (rq->special == (void *) 0xdeadbeefUL);
+                do_write = (rq_data_dir(rq) == WRITE);
+
+                if (!do_flush) { /* osd_flush does not use a bio */
+                        /* a bio clone to be passed down to OSD request */
+                        bio = bio_chain_clone(rq->bio, GFP_ATOMIC);
+                        if (!bio)
+                                break;
+                } else
+                        bio = NULL;
+
+                /* alloc internal OSD request, for OSD command execution */
+                or = osd_start_request(osdev->osd, GFP_ATOMIC);
+                if (!or) {
+                        bio_chain_put(bio);
+                        OSDBLK_DEBUG("osd_start_request with err\n");
+                        break;
+                }
+
+                orq = &osdev->req[rq->tag];
+                orq->rq = rq;
+                orq->bio = bio;
+                orq->osdev = osdev;
+
+                /* init OSD command: flush, write or read */
+                if (do_flush)
+                        osd_req_flush_object(or, &osdev->obj,
+                                             OSD_CDB_FLUSH_ALL, 0, 0);
+                else if (do_write)
+                        osd_req_write(or, &osdev->obj, blk_rq_pos(rq) * 512ULL,
+                                      bio, blk_rq_bytes(rq));
+                else
+                        osd_req_read(or, &osdev->obj, blk_rq_pos(rq) * 512ULL,
+                                     bio, blk_rq_bytes(rq));
+
+                OSDBLK_DEBUG("%s 0x%x bytes at 0x%llx\n",
+                        do_flush ? "flush" : do_write ?
+                                "write" : "read", blk_rq_bytes(rq),
+                        blk_rq_pos(rq) * 512ULL);
+
+                /* begin OSD command execution */
+                if (osd_async_op(or, osdblk_osd_complete, orq,
+                                 osdev->obj_cred)) {
+                        osd_end_request(or);
+                        blk_requeue_request(q, rq);
+                        bio_chain_put(bio);
+                        OSDBLK_DEBUG("osd_execute_request_async with err\n");
+                        break;
+                }
+
+                /* remove the special 'flush' marker, now that the command
+                 * is executing
+                 */
+                rq->special = NULL;
+        }
+}
+
+static void osdblk_prepare_flush(struct request_queue *q, struct request *rq)
+{
+        /* add driver-specific marker, to indicate that this request
+         * is a flush command
+         */
+        rq->special = (void *) 0xdeadbeefUL;
+}
+
+static void osdblk_free_disk(struct osdblk_device *osdev)
+{
+        struct gendisk *disk = osdev->disk;
+
+        if (!disk)
+                return;
+
+        if (disk->flags & GENHD_FL_UP)
+                del_gendisk(disk);
+        if (disk->queue)
+                blk_cleanup_queue(disk->queue);
+        put_disk(disk);
+}
+
+static int osdblk_init_disk(struct osdblk_device *osdev)
+{
+        struct gendisk *disk;
+        struct request_queue *q;
+        int rc;
+        u64 obj_size = 0;
+
+        /* contact OSD, request size info about the object being mapped */
+        rc = osdblk_get_obj_size(osdev, &obj_size);
+        if (rc)
+                return rc;
+
+        /* create gendisk info */
+        disk = alloc_disk(OSDBLK_MINORS_PER_MAJOR);
+        if (!disk)
+                return -ENOMEM;
+
+        sprintf(disk->disk_name, DRV_NAME "%d", osdev->id);
+        disk->major = osdev->major;
+        disk->first_minor = 0;
+        disk->fops = &osdblk_bd_ops;
+        disk->private_data = osdev;
+
+        /* init rq */
+        q = blk_init_queue(osdblk_rq_fn, &osdev->lock);
+        if (!q) {
+                put_disk(disk);
+                return -ENOMEM;
+        }
+
+        /* switch queue to TCQ mode; allocate tag map */
+        rc = blk_queue_init_tags(q, OSDBLK_MAX_REQ, NULL);
+        if (rc) {
+                blk_cleanup_queue(q);
+                put_disk(disk);
+                return rc;
+        }
+
+        /* Set our limits to the lower device limits, because osdblk cannot
+         * sleep when allocating a lower-request and therefore cannot be
+         * bouncing.
+         */
+        blk_queue_stack_limits(q, osd_request_queue(osdev->osd));
+
+        blk_queue_prep_rq(q, blk_queue_start_tag);
+        blk_queue_ordered(q, QUEUE_ORDERED_DRAIN_FLUSH, osdblk_prepare_flush);
+
+        disk->queue = q;
+
+        q->queuedata = osdev;
+
+        osdev->disk = disk;
+        osdev->q = q;
+
+        /* finally, announce the disk to the world */
+        set_capacity(disk, obj_size / 512ULL);
+        add_disk(disk);
+
+        printk(KERN_INFO "%s: Added of size 0x%llx\n",
+                disk->disk_name, (unsigned long long)obj_size);
+
+        return 0;
+}
+
+/********************************************************************
+ * /sys/class/osdblk/
+ *                   add        map OSD object to blkdev
+ *                   remove     unmap OSD object
+ *                   list       show mappings
+ *******************************************************************/
+
+static void class_osdblk_release(struct class *cls)
+{
+        kfree(cls);
+}
+
+static ssize_t class_osdblk_list(struct class *c, char *data)
+{
+        int n = 0;
+        struct list_head *tmp;
+
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        list_for_each(tmp, &osdblkdev_list) {
+                struct osdblk_device *osdev;
+
+                osdev = list_entry(tmp, struct osdblk_device, node);
+
+                n += sprintf(data+n, "%d %d %llu %llu %s\n",
+                        osdev->id,
+                        osdev->major,
+                        osdev->obj.partition,
+                        osdev->obj.id,
+                        osdev->osd_path);
+        }
+
+        mutex_unlock(&ctl_mutex);
+        return n;
+}
+
+static ssize_t class_osdblk_add(struct class *c, const char *buf, size_t count)
+{
+        struct osdblk_device *osdev;
+        ssize_t rc;
+        int irc, new_id = 0;
+        struct list_head *tmp;
+
+        if (!try_module_get(THIS_MODULE))
+                return -ENODEV;
+
+        /* new osdblk_device object */
+        osdev = kzalloc(sizeof(*osdev) + strlen(buf) + 1, GFP_KERNEL);
+        if (!osdev) {
+                rc = -ENOMEM;
+                goto err_out_mod;
+        }
+
+        /* static osdblk_device initialization */
+        spin_lock_init(&osdev->lock);
+        INIT_LIST_HEAD(&osdev->node);
+
+        /* generate unique id: find highest unique id, add one */
+
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        list_for_each(tmp, &osdblkdev_list) {
+                struct osdblk_device *osdev;
+
+                osdev = list_entry(tmp, struct osdblk_device, node);
+                if (osdev->id > new_id)
+                        new_id = osdev->id + 1;
+        }
+
+        osdev->id = new_id;
+
+        /* add to global list */
+        list_add_tail(&osdev->node, &osdblkdev_list);
+
+        mutex_unlock(&ctl_mutex);
+
+        /* parse add command */
+        if (sscanf(buf, "%llu %llu %s", &osdev->obj.partition, &osdev->obj.id,
+                   osdev->osd_path) != 3) {
+                rc = -EINVAL;
+                goto err_out_slot;
+        }
+
+        /* initialize rest of new object */
+        sprintf(osdev->name, DRV_NAME "%d", osdev->id);
+
+        /* contact requested OSD */
+        osdev->osd = osduld_path_lookup(osdev->osd_path);
+        if (IS_ERR(osdev->osd)) {
+                rc = PTR_ERR(osdev->osd);
+                goto err_out_slot;
+        }
+
+        /* build OSD credential */
+        osdblk_make_credential(osdev->obj_cred, &osdev->obj);
+
+        /* register our block device */
+        irc = register_blkdev(0, osdev->name);
+        if (irc < 0) {
+                rc = irc;
+                goto err_out_osd;
+        }
+
+        osdev->major = irc;
+
+        /* set up and announce blkdev mapping */
+        rc = osdblk_init_disk(osdev);
+        if (rc)
+                goto err_out_blkdev;
+
+        return count;
+
+err_out_blkdev:
+        unregister_blkdev(osdev->major, osdev->name);
+err_out_osd:
+        osduld_put_device(osdev->osd);
+err_out_slot:
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+        list_del_init(&osdev->node);
+        mutex_unlock(&ctl_mutex);
+
+        kfree(osdev);
+err_out_mod:
+        OSDBLK_DEBUG("Error adding device %s\n", buf);
+        module_put(THIS_MODULE);
+        return rc;
+}
+
+static ssize_t class_osdblk_remove(struct class *c, const char *buf,
+                                        size_t count)
+{
+        struct osdblk_device *osdev = NULL;
+        int target_id, rc;
+        unsigned long ul;
+        struct list_head *tmp;
+
+        rc = strict_strtoul(buf, 10, &ul);
+        if (rc)
+                return rc;
+
+        /* convert to int; abort if we lost anything in the conversion */
+        target_id = (int) ul;
+        if (target_id != ul)
+                return -EINVAL;
+
+        /* remove object from list immediately */
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        list_for_each(tmp, &osdblkdev_list) {
+                osdev = list_entry(tmp, struct osdblk_device, node);
+                if (osdev->id == target_id) {
+                        list_del_init(&osdev->node);
+                        break;
+                }
+                osdev = NULL;
+        }
+
+        mutex_unlock(&ctl_mutex);
+
+        if (!osdev)
+                return -ENOENT;
+
+        /* clean up and free blkdev and associated OSD connection */
+        osdblk_free_disk(osdev);
+        unregister_blkdev(osdev->major, osdev->name);
+        osduld_put_device(osdev->osd);
+        kfree(osdev);
+
+        /* release module ref */
+        module_put(THIS_MODULE);
+
+        return count;
+}
+
+static struct class_attribute class_osdblk_attrs[] = {
+        __ATTR(add,     0200, NULL, class_osdblk_add),
+        __ATTR(remove,  0200, NULL, class_osdblk_remove),
+        __ATTR(list,    0444, class_osdblk_list, NULL),
+        __ATTR_NULL
+};
+
+static int osdblk_sysfs_init(void)
+{
+        int ret = 0;
+
+        /*
+         * create control files in sysfs
+         * /sys/class/osdblk/...
+         */
+        class_osdblk = kzalloc(sizeof(*class_osdblk), GFP_KERNEL);
+        if (!class_osdblk)
+                return -ENOMEM;
+
+        class_osdblk->name = DRV_NAME;
+        class_osdblk->owner = THIS_MODULE;
+        class_osdblk->class_release = class_osdblk_release;
+        class_osdblk->class_attrs = class_osdblk_attrs;
+
+        ret = class_register(class_osdblk);
+        if (ret) {
+                kfree(class_osdblk);
+                class_osdblk = NULL;
+                printk(PFX "failed to create class osdblk\n");
+                return ret;
+        }
+
+        return 0;
+}
+
+static void osdblk_sysfs_cleanup(void)
+{
+        if (class_osdblk)
+                class_destroy(class_osdblk);
+        class_osdblk = NULL;
+}
+
+static int __init osdblk_init(void)
+{
+        int rc;
+
+        rc = osdblk_sysfs_init();
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static void __exit osdblk_exit(void)
+{
+        osdblk_sysfs_cleanup();
+}
+
+module_init(osdblk_init);
+module_exit(osdblk_exit);
+
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 024f2d292581..aa1a3d5a3e2b 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -213,7 +213,7 @@ static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
          * Only allow the generic SCSI ioctls if the host can support it.
          */
         if (!virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_SCSI))
-                return -ENOIOCTLCMD;
+                return -ENOTTY;
 
         return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
 }
@@ -360,6 +360,9 @@ static int __devinit virtblk_probe(struct virtio_device *vdev)
         blk_queue_max_phys_segments(vblk->disk->queue, vblk->sg_elems-2);
         blk_queue_max_hw_segments(vblk->disk->queue, vblk->sg_elems-2);
 
+        /* No need to bounce any requests */
+        blk_queue_bounce_limit(vblk->disk->queue, BLK_BOUNCE_ANY);
+
         /* No real sector limit. */
         blk_queue_max_sectors(vblk->disk->queue, -1U);
 
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index 1df9dda2e377..d5cde6d86f89 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -28,7 +28,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/sched.h>
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 72429b6b2fa8..6c32fbf07164 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -81,6 +81,7 @@ static char *serial_version = "4.30";
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/bitops.h>
 
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index f3366d3f06cf..2dafc2da0648 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -633,6 +633,7 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/serial.h>
+#include <linux/smp_lock.h>
 #include <linux/major.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index abef1f7d84fe..ff647ca1c489 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -36,6 +36,7 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
 #include <linux/uaccess.h>
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 94e7e3c8c05a..d97779ef72cb 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -552,7 +552,7 @@ static int hvc_chars_in_buffer(struct tty_struct *tty)
         struct hvc_struct *hp = tty->driver_data;
 
         if (!hp)
-                return -1;
+                return 0;
         return hp->n_outbuf;
 }
 
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 621d1184673c..4f1f4cd670da 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -122,6 +122,7 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/serial.h>
+#include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/timer.h>
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 0c999f5bb3db..ab2f3349c5c4 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -20,6 +20,7 @@
 
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 65b6ff2442c6..dd0083bbb64a 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -34,6 +34,7 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/major.h>
+#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 52d953eb30c3..dbf8d52f31d0 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -23,6 +23,7 @@
 #include <linux/errno.h>
 #include <linux/signal.h>
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
diff --git a/drivers/char/n_hdlc.c b/drivers/char/n_hdlc.c
index 1c43c8cdee25..c68118efad84 100644
--- a/drivers/char/n_hdlc.c
+++ b/drivers/char/n_hdlc.c
@@ -97,6 +97,7 @@
 #include <linux/slab.h>
 #include <linux/tty.h>
 #include <linux/errno.h>
+#include <linux/smp_lock.h>
 #include <linux/string.h>       /* used in new tty drivers */
 #include <linux/signal.h>       /* used in new tty drivers */
 #include <linux/if.h>
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 2e99158ebb8a..6934025a1ac1 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -58,6 +58,7 @@
 #include <linux/ioport.h>
 #include <linux/in.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/tty.h>
 #include <linux/errno.h>
 #include <linux/string.h>       /* used in new tty drivers */
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index 94a5d5020abc..ff47907ff1bf 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -1331,9 +1331,6 @@ handle_newline:
 
 static void n_tty_write_wakeup(struct tty_struct *tty)
 {
-        /* Write out any echoed characters that are still pending */
-        process_echoes(tty);
-
         if (tty->fasync && test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags))
                 kill_fasync(&tty->fasync, SIGIO, POLL_OUT);
 }
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index 574f1c79b6e6..ec58d8c387ff 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -828,7 +828,7 @@ static int receive_data(enum port_type index, struct nozomi *dc)
         struct port *port = &dc->port[index];
         void __iomem *addr = port->dl_addr[port->toggle_dl];
         struct tty_struct *tty = tty_port_tty_get(&port->port);
-        int i;
+        int i, ret;
 
         if (unlikely(!tty)) {
                 DBG1("tty not open for port: %d?", index);
@@ -844,12 +844,14 @@ static int receive_data(enum port_type index, struct nozomi *dc)
 
                 /* disable interrupt in downlink... */
                 disable_transmit_dl(index, dc);
-                return 0;
+                ret = 0;
+                goto put;
         }
 
         if (unlikely(size == 0)) {
                 dev_err(&dc->pdev->dev, "size == 0?\n");
-                return 1;
+                ret = 1;
+                goto put;
         }
 
         tty_buffer_request_room(tty, size);
@@ -871,8 +873,10 @@ static int receive_data(enum port_type index, struct nozomi *dc)
         }
 
         set_bit(index, &dc->flip);
+        ret = 1;
+put:
         tty_kref_put(tty);
-        return 1;
+        return ret;
 }
 
 /* Debug for interrupts */
@@ -1862,16 +1866,14 @@ static s32 ntty_chars_in_buffer(struct tty_struct *tty)
 {
         struct port *port = tty->driver_data;
         struct nozomi *dc = get_dc_by_tty(tty);
-        s32 rval;
+        s32 rval = 0;
 
         if (unlikely(!dc || !port)) {
-                rval = -ENODEV;
                 goto exit_in_buffer;
         }
 
         if (unlikely(!port->port.count)) {
                 dev_err(&dc->pdev->dev, "No tty open?\n");
-                rval = -ENODEV;
                 goto exit_in_buffer;
         }
 
diff --git a/drivers/char/pcmcia/ipwireless/tty.c b/drivers/char/pcmcia/ipwireless/tty.c
index 569f2f7743a7..674b3ab3587d 100644
--- a/drivers/char/pcmcia/ipwireless/tty.c
+++ b/drivers/char/pcmcia/ipwireless/tty.c
@@ -320,10 +320,10 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
         struct ipw_tty *tty = linux_tty->driver_data;
 
         if (!tty)
-                return -ENODEV;
+                return 0;
 
         if (!tty->open_count)
-                return -EINVAL;
+                return 0;
 
         return tty->tx_bytes_queued;
 }
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 9d1b4f548f67..6e6942c45f5b 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -22,6 +22,7 @@
 #include <linux/major.h>
 #include <linux/mm.h>
 #include <linux/init.h>
+#include <linux/smp_lock.h>
 #include <linux/sysctl.h>
 #include <linux/device.h>
 #include <linux/uaccess.h>
diff --git a/drivers/char/rio/rio_linux.c b/drivers/char/rio/rio_linux.c
index ce81da5b2da9..d58c2eb07f07 100644
--- a/drivers/char/rio/rio_linux.c
+++ b/drivers/char/rio/rio_linux.c
@@ -44,6 +44,7 @@
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/miscdevice.h>
 #include <linux/init.h>
 
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 217660451237..171711acf5cd 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -47,6 +47,7 @@
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/tty_flip.h>
+#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
 
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index 63d5b628477a..0e29a23ec4c5 100644
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -73,6 +73,7 @@
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
 #include <linux/serial.h>
+#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index f1f24f0ee26f..51e7a46787be 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -52,6 +52,7 @@
 #include <linux/interrupt.h>
 #include <linux/serial.h>
 #include <linux/serialP.h>
+#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index e72be4190a44..268e17f9ec3f 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -87,6 +87,7 @@
 #include <linux/tty_flip.h>
 #include <linux/mm.h>
 #include <linux/serial.h>
+#include <linux/smp_lock.h>
 #include <linux/fcntl.h>
 #include <linux/major.h>
 #include <linux/delay.h>
@@ -1808,10 +1809,10 @@ static int sx_tiocmset(struct tty_struct *tty, struct file *file,
                 if (clear & TIOCM_DTR)
                         port->MSVR &= ~MSVR_DTR;
         }
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_CAR, port_No(port));
         sx_out(bp, CD186x_MSVR, port->MSVR);
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         spin_unlock_irqrestore(&port->lock, flags);
         func_exit();
         return 0;
@@ -1832,11 +1833,11 @@ static int sx_send_break(struct tty_struct *tty, int length)
         port->break_length = SPECIALIX_TPS / HZ * length;
         port->COR2 |= COR2_ETC;
         port->IER  |= IER_TXRDY;
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_CAR, port_No(port));
         sx_out(bp, CD186x_COR2, port->COR2);
         sx_out(bp, CD186x_IER, port->IER);
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         spin_unlock_irqrestore(&port->lock, flags);
         sx_wait_CCR(bp);
         spin_lock_irqsave(&bp->lock, flags);
@@ -2022,9 +2023,9 @@ static void sx_unthrottle(struct tty_struct *tty)
         if (sx_crtscts(tty))
                 port->MSVR |= MSVR_DTR;
         /* Else clause: see remark in "sx_throttle"... */
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_CAR, port_No(port));
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         if (I_IXOFF(tty)) {
                 spin_unlock_irqrestore(&port->lock, flags);
                 sx_wait_CCR(bp);
@@ -2034,9 +2035,9 @@ static void sx_unthrottle(struct tty_struct *tty)
                 sx_wait_CCR(bp);
                 spin_lock_irqsave(&port->lock, flags);
         }
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_MSVR, port->MSVR);
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         spin_unlock_irqrestore(&port->lock, flags);
 
         func_exit();
@@ -2060,10 +2061,10 @@ static void sx_stop(struct tty_struct *tty)
 
         spin_lock_irqsave(&port->lock, flags);
         port->IER &= ~IER_TXRDY;
-        spin_lock_irqsave(&bp->lock, flags);
+        spin_lock(&bp->lock);
         sx_out(bp, CD186x_CAR, port_No(port));
         sx_out(bp, CD186x_IER, port->IER);
-        spin_unlock_irqrestore(&bp->lock, flags);
+        spin_unlock(&bp->lock);
         spin_unlock_irqrestore(&port->lock, flags);
 
         func_exit();
@@ -2088,10 +2089,10 @@ static void sx_start(struct tty_struct *tty)
         spin_lock_irqsave(&port->lock, flags);
         if (port->xmit_cnt && port->xmit_buf && !(port->IER & IER_TXRDY)) {
                 port->IER |= IER_TXRDY;
-                spin_lock_irqsave(&bp->lock, flags);
+                spin_lock(&bp->lock);
                 sx_out(bp, CD186x_CAR, port_No(port));
                 sx_out(bp, CD186x_IER, port->IER);
-                spin_unlock_irqrestore(&bp->lock, flags);
+                spin_unlock(&bp->lock);
         }
         spin_unlock_irqrestore(&port->lock, flags);
 
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 518f2a25d91e..a81ec4fcf6ff 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -216,6 +216,7 @@
 #include <linux/eisa.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/miscdevice.h>
 #include <linux/bitops.h>
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index afded3a2379c..813552f14884 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -81,6 +81,7 @@
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/delay.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index a2e67e6df3a1..91f20a92fddf 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -62,6 +62,7 @@
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
 #include <linux/init.h>
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index 6f727e3c53ad..8d4a2a8a0a70 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -52,6 +52,7 @@
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
 #include <linux/init.h>
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index ccdd828adcef..b0603b2e5684 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -26,7 +26,6 @@
 #include <linux/poll.h>
 #include <linux/mutex.h>
 #include <linux/spinlock.h>
-#include <linux/smp_lock.h>
 
 #include "tpm.h"
 
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index b24f6c6a1ea3..ad6ba4ed2808 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -21,7 +21,6 @@
 #include <linux/module.h>
 #include <linux/bitops.h>
 #include <linux/mutex.h>
-#include <linux/smp_lock.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index 913aa8d3f1c5..acd76b767d4c 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -21,7 +21,6 @@
 #include <linux/proc_fs.h>
 #include <linux/init.h>
 #include <linux/module.h>
-#include <linux/smp_lock.h>
 #include <linux/device.h>
 #include <linux/wait.h>
 #include <linux/bitops.h>
@@ -791,17 +790,20 @@ void tty_ldisc_hangup(struct tty_struct *tty)
          * N_TTY.
          */
         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
-                /* Avoid racing set_ldisc */
+                /* Avoid racing set_ldisc or tty_ldisc_release */
                 mutex_lock(&tty->ldisc_mutex);
-                /* Switch back to N_TTY */
-                tty_ldisc_halt(tty);
-                tty_ldisc_wait_idle(tty);
-                tty_ldisc_reinit(tty);
-                /* At this point we have a closed ldisc and we want to
-                   reopen it. We could defer this to the next open but
-                   it means auditing a lot of other paths so this is a FIXME */
-                WARN_ON(tty_ldisc_open(tty, tty->ldisc));
-                tty_ldisc_enable(tty);
+                if (tty->ldisc) {       /* Not yet closed */
+                        /* Switch back to N_TTY */
+                        tty_ldisc_halt(tty);
+                        tty_ldisc_wait_idle(tty);
+                        tty_ldisc_reinit(tty);
+                        /* At this point we have a closed ldisc and we want to
+                           reopen it. We could defer this to the next open but
+                           it means auditing a lot of other paths so this is
+                           a FIXME */
+                        WARN_ON(tty_ldisc_open(tty, tty->ldisc));
+                        tty_ldisc_enable(tty);
+                }
                 mutex_unlock(&tty->ldisc_mutex);
                 tty_reset_termios(tty);
         }
@@ -866,6 +868,7 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
 
         tty_ldisc_wait_idle(tty);
 
+        mutex_lock(&tty->ldisc_mutex);
         /*
          * Now kill off the ldisc
          */
@@ -876,6 +879,7 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
 
         /* Ensure the next open requests the N_TTY ldisc */
         tty_set_termios_ldisc(tty, N_TTY);
+        mutex_unlock(&tty->ldisc_mutex);
 
         /* This will need doing differently if we need to lock */
         if (o_tty)
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index 4e862a75f7ff..9769b1149f76 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -267,7 +267,7 @@ int tty_port_block_til_ready(struct tty_port *port,
         if (retval == 0)
                 port->flags |= ASYNC_NORMAL_ACTIVE;
         spin_unlock_irqrestore(&port->lock, flags);
-        return 0;
+        return retval;
         
 }
 EXPORT_SYMBOL(tty_port_block_til_ready);
diff --git a/drivers/char/vc_screen.c b/drivers/char/vc_screen.c
index d94d25c12aa8..c1791a63d99d 100644
--- a/drivers/char/vc_screen.c
+++ b/drivers/char/vc_screen.c
@@ -495,11 +495,15 @@ void vcs_remove_sysfs(int index)
 
 int __init vcs_init(void)
 {
+        unsigned int i;
+
         if (register_chrdev(VCS_MAJOR, "vcs", &vcs_fops))
                 panic("unable to get major %d for vcs device", VCS_MAJOR);
         vc_class = class_create(THIS_MODULE, "vc");
 
         device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 0), NULL, "vcs");
         device_create(vc_class, NULL, MKDEV(VCS_MAJOR, 128), NULL, "vcsa");
+        for (i = 0; i < MIN_NR_CONSOLES; i++)
+                vcs_make_sysfs(i);
         return 0;
 }
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index d9113b4c76e3..404f4c1ee431 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -89,6 +89,7 @@
 #include <linux/mutex.h>
 #include <linux/vt_kern.h>
 #include <linux/selection.h>
+#include <linux/smp_lock.h>
 #include <linux/tiocl.h>
 #include <linux/kbd_kern.h>
 #include <linux/consolemap.h>
@@ -769,14 +770,12 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
             visual_init(vc, currcons, 1);
             if (!*vc->vc_uni_pagedir_loc)
                 con_set_default_unimap(vc);
-            if (!vc->vc_kmalloced)
-                vc->vc_screenbuf = kmalloc(vc->vc_screenbuf_size, GFP_KERNEL);
+            vc->vc_screenbuf = kmalloc(vc->vc_screenbuf_size, GFP_KERNEL);
             if (!vc->vc_screenbuf) {
                 kfree(vc);
                 vc_cons[currcons].d = NULL;
                 return -ENOMEM;
             }
-            vc->vc_kmalloced = 1;
             vc_init(vc, vc->vc_rows, vc->vc_cols, 1);
             vcs_make_sysfs(currcons);
             atomic_notifier_call_chain(&vt_notifier_list, VT_ALLOCATE, &param);
@@ -912,10 +911,8 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
         if (new_scr_end > new_origin)
                 scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
                             new_scr_end - new_origin);
-        if (vc->vc_kmalloced)
-                kfree(vc->vc_screenbuf);
+        kfree(vc->vc_screenbuf);
         vc->vc_screenbuf = newscreen;
-        vc->vc_kmalloced = 1;
         vc->vc_screenbuf_size = new_screen_size;
         set_origin(vc);
 
@@ -994,8 +991,7 @@ void vc_deallocate(unsigned int currcons)
                 vc->vc_sw->con_deinit(vc);
                 put_pid(vc->vt_pid);
                 module_put(vc->vc_sw->owner);
-                if (vc->vc_kmalloced)
-                        kfree(vc->vc_screenbuf);
+                kfree(vc->vc_screenbuf);
                 if (currcons >= MIN_NR_CONSOLES)
                         kfree(vc);
                 vc_cons[currcons].d = NULL;
@@ -2880,7 +2876,6 @@ static int __init con_init(void)
                 INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
                 visual_init(vc, currcons, 1);
                 vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
-                vc->vc_kmalloced = 0;
                 vc_init(vc, vc->vc_rows, vc->vc_cols,
                         currcons || !vc->vc_sw->con_save_screen);
         }
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 7539bed0f7e0..95189f288f8c 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -25,6 +25,7 @@
 #include <linux/console.h>
 #include <linux/consolemap.h>
 #include <linux/signal.h>
+#include <linux/smp_lock.h>
 #include <linux/timex.h>
 
 #include <asm/io.h>
diff --git a/drivers/connector/cn_queue.c b/drivers/connector/cn_queue.c
index c769ef269fb5..408c2af25d50 100644
--- a/drivers/connector/cn_queue.c
+++ b/drivers/connector/cn_queue.c
@@ -1,7 +1,7 @@
 /*
  *      cn_queue.c
  *
- * 2004-2005 Copyright (c) Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * 2004+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index fd336c5a9057..08b2500f21ec 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -1,7 +1,7 @@
 /*
  *      connector.c
  *
- * 2004-2005 Copyright (c) Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * 2004+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -33,7 +33,7 @@
 #include <net/sock.h>
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Generic userspace <-> kernelspace connector.");
 
 static u32 cn_idx = CN_IDX_CONNECTOR;
diff --git a/drivers/gpio/vr41xx_giu.c b/drivers/gpio/vr41xx_giu.c
index b70e06133e78..b16c9a8c03f5 100644
--- a/drivers/gpio/vr41xx_giu.c
+++ b/drivers/gpio/vr41xx_giu.c
@@ -29,7 +29,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
 
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index a6f73f1e99d9..3da9cfa31848 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -1090,6 +1090,8 @@ int drm_helper_resume_force_mode(struct drm_device *dev)
                 if (ret == false)
                         DRM_ERROR("failed to set mode on crtc %p\n", crtc);
         }
+        /* disable the unused connectors while restoring the modesetting */
+        drm_helper_disable_unused_functions(dev);
         return 0;
 }
 EXPORT_SYMBOL(drm_helper_resume_force_mode);
diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index 2960b6d73456..9903f270e440 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -101,6 +101,10 @@ int drm_debugfs_create_files(struct drm_info_list *files, int count,
                         continue;
 
                 tmp = kmalloc(sizeof(struct drm_info_node), GFP_KERNEL);
+                if (tmp == NULL) {
+                        ret = -1;
+                        goto fail;
+                }
                 ent = debugfs_create_file(files[i].name, S_IFREG | S_IRUGO,
                                           root, tmp, &drm_debugfs_fops);
                 if (!ent) {
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 8104ecaea26f..ffe8f4394d50 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -134,26 +134,29 @@ drm_gem_object_alloc(struct drm_device *dev, size_t size)
         BUG_ON((size & (PAGE_SIZE - 1)) != 0);
 
         obj = kzalloc(sizeof(*obj), GFP_KERNEL);
+        if (!obj)
+                goto free;
 
         obj->dev = dev;
         obj->filp = shmem_file_setup("drm mm object", size, VM_NORESERVE);
-        if (IS_ERR(obj->filp)) {
-                kfree(obj);
-                return NULL;
-        }
+        if (IS_ERR(obj->filp))
+                goto free;
 
         kref_init(&obj->refcount);
         kref_init(&obj->handlecount);
         obj->size = size;
         if (dev->driver->gem_init_object != NULL &&
             dev->driver->gem_init_object(obj) != 0) {
-                fput(obj->filp);
-                kfree(obj);
-                return NULL;
+                goto fput;
         }
         atomic_inc(&dev->object_count);
         atomic_add(obj->size, &dev->object_memory);
         return obj;
+fput:
+        fput(obj->filp);
+free:
+        kfree(obj);
+        return NULL;
 }
 EXPORT_SYMBOL(drm_gem_object_alloc);
 
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index 155a5bbce680..55bb8a82d612 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -489,7 +489,7 @@ int drm_put_minor(struct drm_minor **minor_p)
  */
 void drm_put_dev(struct drm_device *dev)
 {
-        struct drm_driver *driver = dev->driver;
+        struct drm_driver *driver;
         struct drm_map_list *r_list, *list_temp;
 
         DRM_DEBUG("\n");
@@ -498,6 +498,7 @@ void drm_put_dev(struct drm_device *dev)
                 DRM_ERROR("cleanup called no dev\n");
                 return;
         }
+        driver = dev->driver;
 
         drm_vblank_cleanup(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index f112c769d533..8c4783180bf6 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -846,7 +846,7 @@ static int i915_set_status_page(struct drm_device *dev, void *data,
                 return 0;
         }
 
-        printk(KERN_DEBUG "set status page addr 0x%08x\n", (u32)hws->addr);
+        DRM_DEBUG("set status page addr 0x%08x\n", (u32)hws->addr);
 
         dev_priv->status_gfx_addr = hws->addr & (0x1ffff<<12);
 
@@ -885,8 +885,8 @@ static int i915_set_status_page(struct drm_device *dev, void *data,
  * some RAM for the framebuffer at early boot.  This code figures out
  * how much was set aside so we can use it for our own purposes.
  */
-static int i915_probe_agp(struct drm_device *dev, unsigned long *aperture_size,
-                          unsigned long *preallocated_size)
+static int i915_probe_agp(struct drm_device *dev, uint32_t *aperture_size,
+                          uint32_t *preallocated_size)
 {
         struct pci_dev *bridge_dev;
         u16 tmp = 0;
@@ -984,10 +984,11 @@ static int i915_probe_agp(struct drm_device *dev, unsigned long *aperture_size,
         return 0;
 }
 
-static int i915_load_modeset_init(struct drm_device *dev)
+static int i915_load_modeset_init(struct drm_device *dev,
+                                  unsigned long prealloc_size,
+                                  unsigned long agp_size)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        unsigned long agp_size, prealloc_size;
         int fb_bar = IS_I9XX(dev) ? 2 : 0;
         int ret = 0;
 
@@ -1002,10 +1003,6 @@ static int i915_load_modeset_init(struct drm_device *dev)
         if (IS_I965G(dev) || IS_G33(dev))
                 dev_priv->cursor_needs_physical = false;
 
-        ret = i915_probe_agp(dev, &agp_size, &prealloc_size);
-        if (ret)
-                goto out;
-
         /* Basic memrange allocator for stolen space (aka vram) */
         drm_mm_init(&dev_priv->vram, 0, prealloc_size);
 
@@ -1082,6 +1079,44 @@ void i915_master_destroy(struct drm_device *dev, struct drm_master *master)
         master->driver_priv = NULL;
 }
 
+static void i915_get_mem_freq(struct drm_device *dev)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        u32 tmp;
+
+        if (!IS_IGD(dev))
+                return;
+
+        tmp = I915_READ(CLKCFG);
+
+        switch (tmp & CLKCFG_FSB_MASK) {
+        case CLKCFG_FSB_533:
+                dev_priv->fsb_freq = 533; /* 133*4 */
+                break;
+        case CLKCFG_FSB_800:
+                dev_priv->fsb_freq = 800; /* 200*4 */
+                break;
+        case CLKCFG_FSB_667:
+                dev_priv->fsb_freq =  667; /* 167*4 */
+                break;
+        case CLKCFG_FSB_400:
+                dev_priv->fsb_freq = 400; /* 100*4 */
+                break;
+        }
+
+        switch (tmp & CLKCFG_MEM_MASK) {
+        case CLKCFG_MEM_533:
+                dev_priv->mem_freq = 533;
+                break;
+        case CLKCFG_MEM_667:
+                dev_priv->mem_freq = 667;
+                break;
+        case CLKCFG_MEM_800:
+                dev_priv->mem_freq = 800;
+                break;
+        }
+}
+
 /**
  * i915_driver_load - setup chip and create an initial config
  * @dev: DRM device
@@ -1098,6 +1133,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         struct drm_i915_private *dev_priv = dev->dev_private;
         resource_size_t base, size;
         int ret = 0, mmio_bar = IS_I9XX(dev) ? 0 : 1;
+        uint32_t agp_size, prealloc_size;
 
         /* i915 has 4 more counters */
         dev->counters += 4;
@@ -1146,9 +1182,22 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                          "performance may suffer.\n");
         }
 
+        ret = i915_probe_agp(dev, &agp_size, &prealloc_size);
+        if (ret)
+                goto out_iomapfree;
+
         /* enable GEM by default */
         dev_priv->has_gem = 1;
 
+        if (prealloc_size > agp_size * 3 / 4) {
+                DRM_ERROR("Detected broken video BIOS with %d/%dkB of video "
+                          "memory stolen.\n",
+                          prealloc_size / 1024, agp_size / 1024);
+                DRM_ERROR("Disabling GEM. (try reducing stolen memory or "
+                          "updating the BIOS to fix).\n");
+                dev_priv->has_gem = 0;
+        }
+
         dev->driver->get_vblank_counter = i915_get_vblank_counter;
         dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */
         if (IS_G4X(dev) || IS_IGDNG(dev)) {
@@ -1165,6 +1214,8 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                         goto out_iomapfree;
         }
 
+        i915_get_mem_freq(dev);
+
         /* On the 945G/GM, the chipset reports the MSI capability on the
          * integrated graphics even though the support isn't actually there
          * according to the published specs.  It doesn't appear to function
@@ -1180,6 +1231,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                 pci_enable_msi(dev->pdev);
 
         spin_lock_init(&dev_priv->user_irq_lock);
+        spin_lock_init(&dev_priv->error_lock);
         dev_priv->user_irq_refcount = 0;
 
         ret = drm_vblank_init(dev, I915_NUM_PIPE);
@@ -1190,7 +1242,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         }
 
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                ret = i915_load_modeset_init(dev);
+                ret = i915_load_modeset_init(dev, prealloc_size, agp_size);
                 if (ret < 0) {
                         DRM_ERROR("failed to init modeset\n");
                         goto out_rmmap;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index e3cb4025e323..fc4b68aa2d05 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -35,6 +35,7 @@
 
 #include "drm_pciids.h"
 #include <linux/console.h>
+#include "drm_crtc_helper.h"
 
 static unsigned int i915_modeset = -1;
 module_param_named(modeset, i915_modeset, int, 0400);
@@ -57,8 +58,8 @@ static int i915_suspend(struct drm_device *dev, pm_message_t state)
         struct drm_i915_private *dev_priv = dev->dev_private;
 
         if (!dev || !dev_priv) {
-                printk(KERN_ERR "dev: %p, dev_priv: %p\n", dev, dev_priv);
-                printk(KERN_ERR "DRM not initialized, aborting suspend.\n");
+                DRM_ERROR("dev: %p, dev_priv: %p\n", dev, dev_priv);
+                DRM_ERROR("DRM not initialized, aborting suspend.\n");
                 return -ENODEV;
         }
 
@@ -115,6 +116,10 @@ static int i915_resume(struct drm_device *dev)
 
                 drm_irq_install(dev);
         }
+        if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+                /* Resume the modeset for every activated CRTC */
+                drm_helper_resume_force_mode(dev);
+        }
 
         return ret;
 }
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index bb4c2d387b6c..d08752875885 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -133,6 +133,22 @@ struct sdvo_device_mapping {
         u8 initialized;
 };
 
+struct drm_i915_error_state {
+        u32 eir;
+        u32 pgtbl_er;
+        u32 pipeastat;
+        u32 pipebstat;
+        u32 ipeir;
+        u32 ipehr;
+        u32 instdone;
+        u32 acthd;
+        u32 instpm;
+        u32 instps;
+        u32 instdone1;
+        u32 seqno;
+        struct timeval time;
+};
+
 typedef struct drm_i915_private {
         struct drm_device *dev;
 
@@ -209,6 +225,11 @@ typedef struct drm_i915_private {
         int fence_reg_start; /* 4 if userland hasn't ioctl'd us yet */
         int num_fence_regs; /* 8 on pre-965, 16 otherwise */
 
+        unsigned int fsb_freq, mem_freq;
+
+        spinlock_t error_lock;
+        struct drm_i915_error_state *first_error;
+
         /* Register state */
         u8 saveLBB;
         u32 saveDSPACNTR;
@@ -468,9 +489,6 @@ struct drm_i915_gem_object {
          */
         int fence_reg;
 
-        /** Boolean whether this object has a valid gtt offset. */
-        int gtt_bound;
-
         /** How many users have pinned this object in GTT space */
         int pin_count;
 
@@ -655,6 +673,7 @@ void i915_gem_free_object(struct drm_gem_object *obj);
 int i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment);
 void i915_gem_object_unpin(struct drm_gem_object *obj);
 int i915_gem_object_unbind(struct drm_gem_object *obj);
+void i915_gem_release_mmap(struct drm_gem_object *obj);
 void i915_gem_lastclose(struct drm_device *dev);
 uint32_t i915_get_gem_seqno(struct drm_device *dev);
 int i915_gem_object_get_fence_reg(struct drm_gem_object *obj);
@@ -870,6 +889,8 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 #define SUPPORTS_INTEGRATED_HDMI(dev)   (IS_G4X(dev) || IS_IGDNG(dev))
 #define SUPPORTS_INTEGRATED_DP(dev)     (IS_G4X(dev) || IS_IGDNG(dev))
 #define I915_HAS_HOTPLUG(dev) (IS_I945G(dev) || IS_I945GM(dev) || IS_I965G(dev))
+/* dsparb controlled by hw only */
+#define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IGDNG(dev))
 
 #define PRIMARY_RINGBUFFER_SIZE         (128*1024)
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 876b65cb7629..5bf420378b6d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1252,6 +1252,31 @@ out_free_list:
         return ret;
 }
 
+/**
+ * i915_gem_release_mmap - remove physical page mappings
+ * @obj: obj in question
+ *
+ * Preserve the reservation of the mmaping with the DRM core code, but
+ * relinquish ownership of the pages back to the system.
+ *
+ * It is vital that we remove the page mapping if we have mapped a tiled
+ * object through the GTT and then lose the fence register due to
+ * resource pressure. Similarly if the object has been moved out of the
+ * aperture, than pages mapped into userspace must be revoked. Removing the
+ * mapping will then trigger a page fault on the next user access, allowing
+ * fixup by i915_gem_fault().
+ */
+void
+i915_gem_release_mmap(struct drm_gem_object *obj)
+{
+        struct drm_device *dev = obj->dev;
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+
+        if (dev->dev_mapping)
+                unmap_mapping_range(dev->dev_mapping,
+                                    obj_priv->mmap_offset, obj->size, 1);
+}
+
 static void
 i915_gem_free_mmap_offset(struct drm_gem_object *obj)
 {
@@ -1861,7 +1886,6 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
-        loff_t offset;
         int ret = 0;
 
 #if WATCH_BUF
@@ -1898,9 +1922,7 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
         BUG_ON(obj_priv->active);
 
         /* blow away mappings if mapped through GTT */
-        offset = ((loff_t) obj->map_list.hash.key) << PAGE_SHIFT;
-        if (dev->dev_mapping)
-                unmap_mapping_range(dev->dev_mapping, offset, obj->size, 1);
+        i915_gem_release_mmap(obj);
 
         if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
                 i915_gem_clear_fence_reg(obj);
@@ -2222,7 +2244,6 @@ try_again:
         /* None available, try to steal one or wait for a user to finish */
         if (i == dev_priv->num_fence_regs) {
                 uint32_t seqno = dev_priv->mm.next_gem_seqno;
-                loff_t offset;
 
                 if (avail == 0)
                         return -ENOSPC;
@@ -2274,10 +2295,7 @@ try_again:
                  * Zap this virtual mapping so we can set up a fence again
                  * for this object next time we need it.
                  */
-                offset = ((loff_t) reg->obj->map_list.hash.key) << PAGE_SHIFT;
-                if (dev->dev_mapping)
-                        unmap_mapping_range(dev->dev_mapping, offset,
-                                            reg->obj->size, 1);
+                i915_gem_release_mmap(reg->obj);
                 old_obj_priv->fence_reg = I915_FENCE_REG_NONE;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_debugfs.c b/drivers/gpu/drm/i915/i915_gem_debugfs.c
index 28146e405e87..9a44bfcb8139 100644
--- a/drivers/gpu/drm/i915/i915_gem_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_gem_debugfs.c
@@ -75,11 +75,10 @@ static int i915_gem_object_list_info(struct seq_file *m, void *data)
         case ACTIVE_LIST:
                 seq_printf(m, "Active:\n");
                 lock = &dev_priv->mm.active_list_lock;
-                spin_lock(lock);
                 head = &dev_priv->mm.active_list;
                 break;
         case INACTIVE_LIST:
-                seq_printf(m, "Inctive:\n");
+                seq_printf(m, "Inactive:\n");
                 head = &dev_priv->mm.inactive_list;
                 break;
         case FLUSHING_LIST:
@@ -91,6 +90,8 @@ static int i915_gem_object_list_info(struct seq_file *m, void *data)
                 return 0;
         }
 
+        if (lock)
+                spin_lock(lock);
         list_for_each_entry(obj_priv, head, list)
         {
                 struct drm_gem_object *obj = obj_priv->obj;
@@ -104,7 +105,10 @@ static int i915_gem_object_list_info(struct seq_file *m, void *data)
                 if (obj->name)
                         seq_printf(m, " (name: %d)", obj->name);
                 if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
-                        seq_printf(m, " (fence: %d)\n", obj_priv->fence_reg);
+                        seq_printf(m, " (fence: %d)", obj_priv->fence_reg);
+                if (obj_priv->gtt_space != NULL)
+                        seq_printf(m, " (gtt_offset: %08x)", obj_priv->gtt_offset);
+
                 seq_printf(m, "\n");
         }
 
@@ -323,6 +327,39 @@ static int i915_ringbuffer_info(struct seq_file *m, void *data)
         return 0;
 }
 
+static int i915_error_state(struct seq_file *m, void *unused)
+{
+        struct drm_info_node *node = (struct drm_info_node *) m->private;
+        struct drm_device *dev = node->minor->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_error_state *error;
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev_priv->error_lock, flags);
+        if (!dev_priv->first_error) {
+                seq_printf(m, "no error state collected\n");
+                goto out;
+        }
+
+        error = dev_priv->first_error;
+
+        seq_printf(m, "EIR: 0x%08x\n", error->eir);
+        seq_printf(m, "  PGTBL_ER: 0x%08x\n", error->pgtbl_er);
+        seq_printf(m, "  INSTPM: 0x%08x\n", error->instpm);
+        seq_printf(m, "  IPEIR: 0x%08x\n", error->ipeir);
+        seq_printf(m, "  IPEHR: 0x%08x\n", error->ipehr);
+        seq_printf(m, "  INSTDONE: 0x%08x\n", error->instdone);
+        seq_printf(m, "  ACTHD: 0x%08x\n", error->acthd);
+        if (IS_I965G(dev)) {
+                seq_printf(m, "  INSTPS: 0x%08x\n", error->instps);
+                seq_printf(m, "  INSTDONE1: 0x%08x\n", error->instdone1);
+        }
+
+out:
+        spin_unlock_irqrestore(&dev_priv->error_lock, flags);
+
+        return 0;
+}
 
 static struct drm_info_list i915_gem_debugfs_list[] = {
         {"i915_gem_active", i915_gem_object_list_info, 0, (void *) ACTIVE_LIST},
@@ -336,6 +373,7 @@ static struct drm_info_list i915_gem_debugfs_list[] = {
         {"i915_ringbuffer_data", i915_ringbuffer_data, 0},
         {"i915_ringbuffer_info", i915_ringbuffer_info, 0},
         {"i915_batchbuffers", i915_batchbuffer_info, 0},
+        {"i915_error_state", i915_error_state, 0},
 };
 #define I915_GEM_DEBUGFS_ENTRIES ARRAY_SIZE(i915_gem_debugfs_list)
 
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index daeae62e1c28..a2d527b22ec4 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -521,6 +521,12 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                         goto err;
                 }
 
+                /* If we've changed tiling, GTT-mappings of the object
+                 * need to re-fault to ensure that the correct fence register
+                 * setup is in place.
+                 */
+                i915_gem_release_mmap(obj);
+
                 obj_priv->tiling_mode = args->tiling_mode;
                 obj_priv->stride = args->stride;
         }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 228546f6eaa4..7ba23a69a0c0 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -26,6 +26,7 @@
  *
  */
 
+#include <linux/sysrq.h>
 #include "drmP.h"
 #include "drm.h"
 #include "i915_drm.h"
@@ -41,9 +42,10 @@
  * we leave them always unmasked in IMR and then control enabling them through
  * PIPESTAT alone.
  */
-#define I915_INTERRUPT_ENABLE_FIX (I915_ASLE_INTERRUPT | \
-                                   I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |  \
-                                   I915_DISPLAY_PIPE_B_EVENT_INTERRUPT)
+#define I915_INTERRUPT_ENABLE_FIX (I915_ASLE_INTERRUPT |                 \
+                                   I915_DISPLAY_PIPE_A_EVENT_INTERRUPT | \
+                                   I915_DISPLAY_PIPE_B_EVENT_INTERRUPT | \
+                                   I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT)
 
 /** Interrupts that we mask and unmask at runtime. */
 #define I915_INTERRUPT_ENABLE_VAR (I915_USER_INTERRUPT)
@@ -288,6 +290,47 @@ irqreturn_t igdng_irq_handler(struct drm_device *dev)
         return ret;
 }
 
+static void i915_capture_error_state(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_i915_error_state *error;
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev_priv->error_lock, flags);
+        if (dev_priv->first_error)
+                goto out;
+
+        error = kmalloc(sizeof(*error), GFP_ATOMIC);
+        if (!error) {
+                DRM_DEBUG("out ot memory, not capturing error state\n");
+                goto out;
+        }
+
+        error->eir = I915_READ(EIR);
+        error->pgtbl_er = I915_READ(PGTBL_ER);
+        error->pipeastat = I915_READ(PIPEASTAT);
+        error->pipebstat = I915_READ(PIPEBSTAT);
+        error->instpm = I915_READ(INSTPM);
+        if (!IS_I965G(dev)) {
+                error->ipeir = I915_READ(IPEIR);
+                error->ipehr = I915_READ(IPEHR);
+                error->instdone = I915_READ(INSTDONE);
+                error->acthd = I915_READ(ACTHD);
+        } else {
+                error->ipeir = I915_READ(IPEIR_I965);
+                error->ipehr = I915_READ(IPEHR_I965);
+                error->instdone = I915_READ(INSTDONE_I965);
+                error->instps = I915_READ(INSTPS);
+                error->instdone1 = I915_READ(INSTDONE1);
+                error->acthd = I915_READ(ACTHD_I965);
+        }
+
+        dev_priv->first_error = error;
+
+out:
+        spin_unlock_irqrestore(&dev_priv->error_lock, flags);
+}
+
 irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 {
         struct drm_device *dev = (struct drm_device *) arg;
@@ -333,11 +376,15 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                  * Clear the PIPE(A|B)STAT regs before the IIR
                  */
                 if (pipea_stats & 0x8000ffff) {
+                        if (pipea_stats &  PIPE_FIFO_UNDERRUN_STATUS)
+                                DRM_DEBUG("pipe a underrun\n");
                         I915_WRITE(PIPEASTAT, pipea_stats);
                         irq_received = 1;
                 }
 
                 if (pipeb_stats & 0x8000ffff) {
+                        if (pipeb_stats &  PIPE_FIFO_UNDERRUN_STATUS)
+                                DRM_DEBUG("pipe b underrun\n");
                         I915_WRITE(PIPEBSTAT, pipeb_stats);
                         irq_received = 1;
                 }
@@ -362,6 +409,80 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                         I915_READ(PORT_HOTPLUG_STAT);
                 }
 
+                if (iir & I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT) {
+                        u32 eir = I915_READ(EIR);
+
+                        i915_capture_error_state(dev);
+
+                        printk(KERN_ERR "render error detected, EIR: 0x%08x\n",
+                               eir);
+                        if (eir & I915_ERROR_PAGE_TABLE) {
+                                u32 pgtbl_err = I915_READ(PGTBL_ER);
+                                printk(KERN_ERR "page table error\n");
+                                printk(KERN_ERR "  PGTBL_ER: 0x%08x\n",
+                                       pgtbl_err);
+                                I915_WRITE(PGTBL_ER, pgtbl_err);
+                                (void)I915_READ(PGTBL_ER);
+                        }
+                        if (eir & I915_ERROR_MEMORY_REFRESH) {
+                                printk(KERN_ERR "memory refresh error\n");
+                                printk(KERN_ERR "PIPEASTAT: 0x%08x\n",
+                                       pipea_stats);
+                                printk(KERN_ERR "PIPEBSTAT: 0x%08x\n",
+                                       pipeb_stats);
+                                /* pipestat has already been acked */
+                        }
+                        if (eir & I915_ERROR_INSTRUCTION) {
+                                printk(KERN_ERR "instruction error\n");
+                                printk(KERN_ERR "  INSTPM: 0x%08x\n",
+                                       I915_READ(INSTPM));
+                                if (!IS_I965G(dev)) {
+                                        u32 ipeir = I915_READ(IPEIR);
+
+                                        printk(KERN_ERR "  IPEIR: 0x%08x\n",
+                                               I915_READ(IPEIR));
+                                        printk(KERN_ERR "  IPEHR: 0x%08x\n",
+                                                   I915_READ(IPEHR));
+                                        printk(KERN_ERR "  INSTDONE: 0x%08x\n",
+                                                   I915_READ(INSTDONE));
+                                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
+                                                   I915_READ(ACTHD));
+                                        I915_WRITE(IPEIR, ipeir);
+                                        (void)I915_READ(IPEIR);
+                                } else {
+                                        u32 ipeir = I915_READ(IPEIR_I965);
+
+                                        printk(KERN_ERR "  IPEIR: 0x%08x\n",
+                                               I915_READ(IPEIR_I965));
+                                        printk(KERN_ERR "  IPEHR: 0x%08x\n",
+                                               I915_READ(IPEHR_I965));
+                                        printk(KERN_ERR "  INSTDONE: 0x%08x\n",
+                                               I915_READ(INSTDONE_I965));
+                                        printk(KERN_ERR "  INSTPS: 0x%08x\n",
+                                               I915_READ(INSTPS));
+                                        printk(KERN_ERR "  INSTDONE1: 0x%08x\n",
+                                               I915_READ(INSTDONE1));
+                                        printk(KERN_ERR "  ACTHD: 0x%08x\n",
+                                               I915_READ(ACTHD_I965));
+                                        I915_WRITE(IPEIR_I965, ipeir);
+                                        (void)I915_READ(IPEIR_I965);
+                                }
+                        }
+
+                        I915_WRITE(EIR, eir);
+                        (void)I915_READ(EIR);
+                        eir = I915_READ(EIR);
+                        if (eir) {
+                                /*
+                                 * some errors might have become stuck,
+                                 * mask them.
+                                 */
+                                DRM_ERROR("EIR stuck: 0x%08x, masking\n", eir);
+                                I915_WRITE(EMR, I915_READ(EMR) | eir);
+                                I915_WRITE(IIR, I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT);
+                        }
+                }
+
                 I915_WRITE(IIR, iir);
                 new_iir = I915_READ(IIR); /* Flush posted writes */
 
@@ -732,6 +853,7 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         u32 enable_mask = I915_INTERRUPT_ENABLE_FIX | I915_INTERRUPT_ENABLE_VAR;
+        u32 error_mask;
 
         DRM_INIT_WAITQUEUE(&dev_priv->irq_queue);
 
@@ -768,6 +890,21 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
                 i915_enable_irq(dev_priv, I915_DISPLAY_PORT_INTERRUPT);
         }
 
+        /*
+         * Enable some error detection, note the instruction error mask
+         * bit is reserved, so we leave it masked.
+         */
+        if (IS_G4X(dev)) {
+                error_mask = ~(GM45_ERROR_PAGE_TABLE |
+                               GM45_ERROR_MEM_PRIV |
+                               GM45_ERROR_CP_PRIV |
+                               I915_ERROR_MEMORY_REFRESH);
+        } else {
+                error_mask = ~(I915_ERROR_PAGE_TABLE |
+                               I915_ERROR_MEMORY_REFRESH);
+        }
+        I915_WRITE(EMR, error_mask);
+
         /* Disable pipe interrupt enables, clear pending pipe status */
         I915_WRITE(PIPEASTAT, I915_READ(PIPEASTAT) & 0x8000ffff);
         I915_WRITE(PIPEBSTAT, I915_READ(PIPEBSTAT) & 0x8000ffff);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 88bf7521405f..6c0858484094 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -206,6 +206,7 @@
 /*
  * Instruction and interrupt control regs
  */
+#define PGTBL_ER        0x02024
 #define PRB0_TAIL       0x02030
 #define PRB0_HEAD       0x02034
 #define PRB0_START      0x02038
@@ -226,11 +227,18 @@
 #define PRB1_HEAD       0x02044 /* 915+ only */
 #define PRB1_START      0x02048 /* 915+ only */
 #define PRB1_CTL        0x0204c /* 915+ only */
+#define IPEIR_I965      0x02064
+#define IPEHR_I965      0x02068
+#define INSTDONE_I965   0x0206c
+#define INSTPS          0x02070 /* 965+ only */
+#define INSTDONE1       0x0207c /* 965+ only */
 #define ACTHD_I965      0x02074
 #define HWS_PGA         0x02080
 #define HWS_ADDRESS_MASK        0xfffff000
 #define HWS_START_ADDRESS_SHIFT 4
 #define IPEIR           0x02088
+#define IPEHR           0x0208c
+#define INSTDONE        0x02090
 #define NOPID           0x02094
 #define HWSTAM          0x02098
 #define SCPD0           0x0209c /* 915+ only */
@@ -258,10 +266,22 @@
 #define EIR             0x020b0
 #define EMR             0x020b4
 #define ESR             0x020b8
+#define   GM45_ERROR_PAGE_TABLE                         (1<<5)
+#define   GM45_ERROR_MEM_PRIV                           (1<<4)
+#define   I915_ERROR_PAGE_TABLE                         (1<<4)
+#define   GM45_ERROR_CP_PRIV                            (1<<3)
+#define   I915_ERROR_MEMORY_REFRESH                     (1<<1)
+#define   I915_ERROR_INSTRUCTION                        (1<<0)
 #define INSTPM          0x020c0
 #define ACTHD           0x020c8
 #define FW_BLC          0x020d8
+#define FW_BLC2         0x020dc
 #define FW_BLC_SELF     0x020e0 /* 915+ only */
+#define   FW_BLC_SELF_EN (1<<15)
+#define MM_BURST_LENGTH     0x00700000
+#define MM_FIFO_WATERMARK   0x0001F000
+#define LM_BURST_LENGTH     0x00000700
+#define LM_FIFO_WATERMARK   0x0000001F
 #define MI_ARB_STATE    0x020e4 /* 915+ only */
 #define CACHE_MODE_0    0x02120 /* 915+ only */
 #define   CM0_MASK_SHIFT          16
@@ -571,17 +591,21 @@
 
 /* Clocking configuration register */
 #define CLKCFG                  0x10c00
-#define CLKCFG_FSB_400                                  (0 << 0)        /* hrawclk 100 */
+#define CLKCFG_FSB_400                                  (5 << 0)        /* hrawclk 100 */
 #define CLKCFG_FSB_533                                  (1 << 0)        /* hrawclk 133 */
 #define CLKCFG_FSB_667                                  (3 << 0)        /* hrawclk 166 */
 #define CLKCFG_FSB_800                                  (2 << 0)        /* hrawclk 200 */
 #define CLKCFG_FSB_1067                                 (6 << 0)        /* hrawclk 266 */
 #define CLKCFG_FSB_1333                                 (7 << 0)        /* hrawclk 333 */
-/* this is a guess, could be 5 as well */
+/* Note, below two are guess */
 #define CLKCFG_FSB_1600                                 (4 << 0)        /* hrawclk 400 */
-#define CLKCFG_FSB_1600_ALT                             (5 << 0)        /* hrawclk 400 */
+#define CLKCFG_FSB_1600_ALT                             (0 << 0)        /* hrawclk 400 */
 #define CLKCFG_FSB_MASK                                 (7 << 0)
- 
+#define CLKCFG_MEM_533                                  (1 << 4)
+#define CLKCFG_MEM_667                                  (2 << 4)
+#define CLKCFG_MEM_800                                  (3 << 4)
+#define CLKCFG_MEM_MASK                                 (7 << 4)
+
 /** GM965 GM45 render standby register */
 #define MCHBAR_RENDER_STANDBY   0x111B8
 
@@ -1581,6 +1605,34 @@
 #define   DSPARB_CSTART_SHIFT   7
 #define   DSPARB_BSTART_MASK    (0x7f)
 #define   DSPARB_BSTART_SHIFT   0
+#define   DSPARB_BEND_SHIFT     9 /* on 855 */
+#define   DSPARB_AEND_SHIFT     0
+
+#define DSPFW1                  0x70034
+#define DSPFW2                  0x70038
+#define DSPFW3                  0x7003c
+#define   IGD_SELF_REFRESH_EN   (1<<30)
+
+/* FIFO watermark sizes etc */
+#define I915_FIFO_LINE_SIZE     64
+#define I830_FIFO_LINE_SIZE     32
+#define I945_FIFO_SIZE          127 /* 945 & 965 */
+#define I915_FIFO_SIZE          95
+#define I855GM_FIFO_SIZE        255
+#define I830_FIFO_SIZE          95
+#define I915_MAX_WM             0x3f
+
+#define IGD_DISPLAY_FIFO        512 /* in 64byte unit */
+#define IGD_FIFO_LINE_SIZE      64
+#define IGD_MAX_WM              0x1ff
+#define IGD_DFT_WM              0x3f
+#define IGD_DFT_HPLLOFF_WM      0
+#define IGD_GUARD_WM            10
+#define IGD_CURSOR_FIFO         64
+#define IGD_CURSOR_MAX_WM       0x3f
+#define IGD_CURSOR_DFT_WM       0
+#define IGD_CURSOR_GUARD_WM     5
+
 /*
  * The two pipe frame counter registers are not synchronized, so
  * reading a stable value is somewhat tricky. The following code
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 8d8e083d14ab..9e1d16e5c3ea 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -222,23 +222,12 @@ static void i915_restore_vga(struct drm_device *dev)
         I915_WRITE8(VGA_DACMASK, dev_priv->saveDACMASK);
 }
 
-int i915_save_state(struct drm_device *dev)
+static void i915_save_modeset_reg(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        int i;
-
-        pci_read_config_byte(dev->pdev, LBB, &dev_priv->saveLBB);
-
-        /* Render Standby */
-        if (IS_I965G(dev) && IS_MOBILE(dev))
-                dev_priv->saveRENDERSTANDBY = I915_READ(MCHBAR_RENDER_STANDBY);
-
-        /* Hardware status page */
-        dev_priv->saveHWS = I915_READ(HWS_PGA);
-
-        /* Display arbitration control */
-        dev_priv->saveDSPARB = I915_READ(DSPARB);
 
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                return;
         /* Pipe & plane A info */
         dev_priv->savePIPEACONF = I915_READ(PIPEACONF);
         dev_priv->savePIPEASRC = I915_READ(PIPEASRC);
@@ -294,7 +283,122 @@ int i915_save_state(struct drm_device *dev)
         }
         i915_save_palette(dev, PIPE_B);
         dev_priv->savePIPEBSTAT = I915_READ(PIPEBSTAT);
+        return;
+}
+static void i915_restore_modeset_reg(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                return;
+
+        /* Pipe & plane A info */
+        /* Prime the clock */
+        if (dev_priv->saveDPLL_A & DPLL_VCO_ENABLE) {
+                I915_WRITE(DPLL_A, dev_priv->saveDPLL_A &
+                           ~DPLL_VCO_ENABLE);
+                DRM_UDELAY(150);
+        }
+        I915_WRITE(FPA0, dev_priv->saveFPA0);
+        I915_WRITE(FPA1, dev_priv->saveFPA1);
+        /* Actually enable it */
+        I915_WRITE(DPLL_A, dev_priv->saveDPLL_A);
+        DRM_UDELAY(150);
+        if (IS_I965G(dev))
+                I915_WRITE(DPLL_A_MD, dev_priv->saveDPLL_A_MD);
+        DRM_UDELAY(150);
+
+        /* Restore mode */
+        I915_WRITE(HTOTAL_A, dev_priv->saveHTOTAL_A);
+        I915_WRITE(HBLANK_A, dev_priv->saveHBLANK_A);
+        I915_WRITE(HSYNC_A, dev_priv->saveHSYNC_A);
+        I915_WRITE(VTOTAL_A, dev_priv->saveVTOTAL_A);
+        I915_WRITE(VBLANK_A, dev_priv->saveVBLANK_A);
+        I915_WRITE(VSYNC_A, dev_priv->saveVSYNC_A);
+        I915_WRITE(BCLRPAT_A, dev_priv->saveBCLRPAT_A);
+
+        /* Restore plane info */
+        I915_WRITE(DSPASIZE, dev_priv->saveDSPASIZE);
+        I915_WRITE(DSPAPOS, dev_priv->saveDSPAPOS);
+        I915_WRITE(PIPEASRC, dev_priv->savePIPEASRC);
+        I915_WRITE(DSPAADDR, dev_priv->saveDSPAADDR);
+        I915_WRITE(DSPASTRIDE, dev_priv->saveDSPASTRIDE);
+        if (IS_I965G(dev)) {
+                I915_WRITE(DSPASURF, dev_priv->saveDSPASURF);
+                I915_WRITE(DSPATILEOFF, dev_priv->saveDSPATILEOFF);
+        }
+
+        I915_WRITE(PIPEACONF, dev_priv->savePIPEACONF);
+
+        i915_restore_palette(dev, PIPE_A);
+        /* Enable the plane */
+        I915_WRITE(DSPACNTR, dev_priv->saveDSPACNTR);
+        I915_WRITE(DSPAADDR, I915_READ(DSPAADDR));
+
+        /* Pipe & plane B info */
+        if (dev_priv->saveDPLL_B & DPLL_VCO_ENABLE) {
+                I915_WRITE(DPLL_B, dev_priv->saveDPLL_B &
+                           ~DPLL_VCO_ENABLE);
+                DRM_UDELAY(150);
+        }
+        I915_WRITE(FPB0, dev_priv->saveFPB0);
+        I915_WRITE(FPB1, dev_priv->saveFPB1);
+        /* Actually enable it */
+        I915_WRITE(DPLL_B, dev_priv->saveDPLL_B);
+        DRM_UDELAY(150);
+        if (IS_I965G(dev))
+                I915_WRITE(DPLL_B_MD, dev_priv->saveDPLL_B_MD);
+        DRM_UDELAY(150);
+
+        /* Restore mode */
+        I915_WRITE(HTOTAL_B, dev_priv->saveHTOTAL_B);
+        I915_WRITE(HBLANK_B, dev_priv->saveHBLANK_B);
+        I915_WRITE(HSYNC_B, dev_priv->saveHSYNC_B);
+        I915_WRITE(VTOTAL_B, dev_priv->saveVTOTAL_B);
+        I915_WRITE(VBLANK_B, dev_priv->saveVBLANK_B);
+        I915_WRITE(VSYNC_B, dev_priv->saveVSYNC_B);
+        I915_WRITE(BCLRPAT_B, dev_priv->saveBCLRPAT_B);
+
+        /* Restore plane info */
+        I915_WRITE(DSPBSIZE, dev_priv->saveDSPBSIZE);
+        I915_WRITE(DSPBPOS, dev_priv->saveDSPBPOS);
+        I915_WRITE(PIPEBSRC, dev_priv->savePIPEBSRC);
+        I915_WRITE(DSPBADDR, dev_priv->saveDSPBADDR);
+        I915_WRITE(DSPBSTRIDE, dev_priv->saveDSPBSTRIDE);
+        if (IS_I965G(dev)) {
+                I915_WRITE(DSPBSURF, dev_priv->saveDSPBSURF);
+                I915_WRITE(DSPBTILEOFF, dev_priv->saveDSPBTILEOFF);
+        }
+
+        I915_WRITE(PIPEBCONF, dev_priv->savePIPEBCONF);
+
+        i915_restore_palette(dev, PIPE_B);
+        /* Enable the plane */
+        I915_WRITE(DSPBCNTR, dev_priv->saveDSPBCNTR);
+        I915_WRITE(DSPBADDR, I915_READ(DSPBADDR));
 
+        return;
+}
+int i915_save_state(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        int i;
+
+        pci_read_config_byte(dev->pdev, LBB, &dev_priv->saveLBB);
+
+        /* Render Standby */
+        if (IS_I965G(dev) && IS_MOBILE(dev))
+                dev_priv->saveRENDERSTANDBY = I915_READ(MCHBAR_RENDER_STANDBY);
+
+        /* Hardware status page */
+        dev_priv->saveHWS = I915_READ(HWS_PGA);
+
+        /* Display arbitration control */
+        dev_priv->saveDSPARB = I915_READ(DSPARB);
+
+        /* This is only meaningful in non-KMS mode */
+        /* Don't save them in KMS mode */
+        i915_save_modeset_reg(dev);
         /* Cursor state */
         dev_priv->saveCURACNTR = I915_READ(CURACNTR);
         dev_priv->saveCURAPOS = I915_READ(CURAPOS);
@@ -430,92 +534,9 @@ int i915_restore_state(struct drm_device *dev)
                 I915_WRITE(PIPEA_DP_LINK_N, dev_priv->savePIPEA_DP_LINK_N);
                 I915_WRITE(PIPEB_DP_LINK_N, dev_priv->savePIPEB_DP_LINK_N);
         }
-        
-        /* Pipe & plane A info */
-        /* Prime the clock */
-        if (dev_priv->saveDPLL_A & DPLL_VCO_ENABLE) {
-                I915_WRITE(DPLL_A, dev_priv->saveDPLL_A &
-                           ~DPLL_VCO_ENABLE);
-                DRM_UDELAY(150);
-        }
-        I915_WRITE(FPA0, dev_priv->saveFPA0);
-        I915_WRITE(FPA1, dev_priv->saveFPA1);
-        /* Actually enable it */
-        I915_WRITE(DPLL_A, dev_priv->saveDPLL_A);
-        DRM_UDELAY(150);
-        if (IS_I965G(dev))
-                I915_WRITE(DPLL_A_MD, dev_priv->saveDPLL_A_MD);
-        DRM_UDELAY(150);
-
-        /* Restore mode */
-        I915_WRITE(HTOTAL_A, dev_priv->saveHTOTAL_A);
-        I915_WRITE(HBLANK_A, dev_priv->saveHBLANK_A);
-        I915_WRITE(HSYNC_A, dev_priv->saveHSYNC_A);
-        I915_WRITE(VTOTAL_A, dev_priv->saveVTOTAL_A);
-        I915_WRITE(VBLANK_A, dev_priv->saveVBLANK_A);
-        I915_WRITE(VSYNC_A, dev_priv->saveVSYNC_A);
-        I915_WRITE(BCLRPAT_A, dev_priv->saveBCLRPAT_A);
-
-        /* Restore plane info */
-        I915_WRITE(DSPASIZE, dev_priv->saveDSPASIZE);
-        I915_WRITE(DSPAPOS, dev_priv->saveDSPAPOS);
-        I915_WRITE(PIPEASRC, dev_priv->savePIPEASRC);
-        I915_WRITE(DSPAADDR, dev_priv->saveDSPAADDR);
-        I915_WRITE(DSPASTRIDE, dev_priv->saveDSPASTRIDE);
-        if (IS_I965G(dev)) {
-                I915_WRITE(DSPASURF, dev_priv->saveDSPASURF);
-                I915_WRITE(DSPATILEOFF, dev_priv->saveDSPATILEOFF);
-        }
-
-        I915_WRITE(PIPEACONF, dev_priv->savePIPEACONF);
-
-        i915_restore_palette(dev, PIPE_A);
-        /* Enable the plane */
-        I915_WRITE(DSPACNTR, dev_priv->saveDSPACNTR);
-        I915_WRITE(DSPAADDR, I915_READ(DSPAADDR));
-
-        /* Pipe & plane B info */
-        if (dev_priv->saveDPLL_B & DPLL_VCO_ENABLE) {
-                I915_WRITE(DPLL_B, dev_priv->saveDPLL_B &
-                           ~DPLL_VCO_ENABLE);
-                DRM_UDELAY(150);
-        }
-        I915_WRITE(FPB0, dev_priv->saveFPB0);
-        I915_WRITE(FPB1, dev_priv->saveFPB1);
-        /* Actually enable it */
-        I915_WRITE(DPLL_B, dev_priv->saveDPLL_B);
-        DRM_UDELAY(150);
-        if (IS_I965G(dev))
-                I915_WRITE(DPLL_B_MD, dev_priv->saveDPLL_B_MD);
-        DRM_UDELAY(150);
-
-        /* Restore mode */
-        I915_WRITE(HTOTAL_B, dev_priv->saveHTOTAL_B);
-        I915_WRITE(HBLANK_B, dev_priv->saveHBLANK_B);
-        I915_WRITE(HSYNC_B, dev_priv->saveHSYNC_B);
-        I915_WRITE(VTOTAL_B, dev_priv->saveVTOTAL_B);
-        I915_WRITE(VBLANK_B, dev_priv->saveVBLANK_B);
-        I915_WRITE(VSYNC_B, dev_priv->saveVSYNC_B);
-        I915_WRITE(BCLRPAT_B, dev_priv->saveBCLRPAT_B);
-
-        /* Restore plane info */
-        I915_WRITE(DSPBSIZE, dev_priv->saveDSPBSIZE);
-        I915_WRITE(DSPBPOS, dev_priv->saveDSPBPOS);
-        I915_WRITE(PIPEBSRC, dev_priv->savePIPEBSRC);
-        I915_WRITE(DSPBADDR, dev_priv->saveDSPBADDR);
-        I915_WRITE(DSPBSTRIDE, dev_priv->saveDSPBSTRIDE);
-        if (IS_I965G(dev)) {
-                I915_WRITE(DSPBSURF, dev_priv->saveDSPBSURF);
-                I915_WRITE(DSPBTILEOFF, dev_priv->saveDSPBTILEOFF);
-        }
-
-        I915_WRITE(PIPEBCONF, dev_priv->savePIPEBCONF);
-
-        i915_restore_palette(dev, PIPE_B);
-        /* Enable the plane */
-        I915_WRITE(DSPBCNTR, dev_priv->saveDSPBCNTR);
-        I915_WRITE(DSPBADDR, I915_READ(DSPBADDR));
-
+        /* This is only meaningful in non-KMS mode */
+        /* Don't restore them in KMS mode */
+        i915_restore_modeset_reg(dev);
         /* Cursor state */
         I915_WRITE(CURAPOS, dev_priv->saveCURAPOS);
         I915_WRITE(CURACNTR, dev_priv->saveCURACNTR);
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 716409a57244..7cc447191028 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -97,6 +97,7 @@ static void
 parse_lfp_panel_data(struct drm_i915_private *dev_priv,
                             struct bdb_header *bdb)
 {
+        struct drm_device *dev = dev_priv->dev;
         struct bdb_lvds_options *lvds_options;
         struct bdb_lvds_lfp_data *lvds_lfp_data;
         struct bdb_lvds_lfp_data_ptrs *lvds_lfp_data_ptrs;
@@ -132,7 +133,14 @@ parse_lfp_panel_data(struct drm_i915_private *dev_priv,
         entry = (struct bdb_lvds_lfp_data_entry *)
                 ((uint8_t *)lvds_lfp_data->data + (lfp_data_size *
                                                    lvds_options->panel_type));
-        dvo_timing = &entry->dvo_timing;
+
+        /* On IGDNG mobile, LVDS data block removes panel fitting registers.
+           So dec 2 dword from dvo_timing offset */
+        if (IS_IGDNG(dev))
+                dvo_timing = (struct lvds_dvo_timing *)
+                                        ((u8 *)&entry->dvo_timing - 8);
+        else
+                dvo_timing = &entry->dvo_timing;
 
         panel_fixed_mode = kzalloc(sizeof(*panel_fixed_mode), GFP_KERNEL);
 
@@ -195,10 +203,12 @@ parse_general_features(struct drm_i915_private *dev_priv,
                 dev_priv->lvds_use_ssc = general->enable_ssc;
 
                 if (dev_priv->lvds_use_ssc) {
-                  if (IS_I855(dev_priv->dev))
-                    dev_priv->lvds_ssc_freq = general->ssc_freq ? 66 : 48;
-                  else
-                    dev_priv->lvds_ssc_freq = general->ssc_freq ? 100 : 96;
+                        if (IS_I85X(dev_priv->dev))
+                                dev_priv->lvds_ssc_freq =
+                                        general->ssc_freq ? 66 : 48;
+                        else
+                                dev_priv->lvds_ssc_freq =
+                                        general->ssc_freq ? 100 : 96;
                 }
         }
 }
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 6de97fc66029..d6a1a6e5539a 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -46,7 +46,7 @@ static void intel_crt_dpms(struct drm_encoder *encoder, int mode)
 
         temp = I915_READ(reg);
         temp &= ~(ADPA_HSYNC_CNTL_DISABLE | ADPA_VSYNC_CNTL_DISABLE);
-        temp |= ADPA_DAC_ENABLE;
+        temp &= ~ADPA_DAC_ENABLE;
 
         switch(mode) {
         case DRM_MODE_DPMS_ON:
@@ -428,8 +428,34 @@ static void intel_crt_destroy(struct drm_connector *connector)
 
 static int intel_crt_get_modes(struct drm_connector *connector)
 {
+        int ret;
         struct intel_output *intel_output = to_intel_output(connector);
-        return intel_ddc_get_modes(intel_output);
+        struct i2c_adapter *ddcbus;
+        struct drm_device *dev = connector->dev;
+
+
+        ret = intel_ddc_get_modes(intel_output);
+        if (ret || !IS_G4X(dev))
+                goto end;
+
+        ddcbus = intel_output->ddc_bus;
+        /* Try to probe digital port for output in DVI-I -> VGA mode. */
+        intel_output->ddc_bus =
+                intel_i2c_create(connector->dev, GPIOD, "CRTDDC_D");
+
+        if (!intel_output->ddc_bus) {
+                intel_output->ddc_bus = ddcbus;
+                dev_printk(KERN_ERR, &connector->dev->pdev->dev,
+                           "DDC bus registration failed for CRTDDC_D.\n");
+                goto end;
+        }
+        /* Try to get modes by GPIOD port */
+        ret = intel_ddc_get_modes(intel_output);
+        intel_i2c_destroy(ddcbus);
+
+end:
+        return ret;
+
 }
 
 static int intel_crt_set_property(struct drm_connector *connector,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 73e7b9cecac8..508838ee31e0 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -25,6 +25,7 @@
  */
 
 #include <linux/i2c.h>
+#include <linux/kernel.h>
 #include "drmP.h"
 #include "intel_drv.h"
 #include "i915_drm.h"
@@ -34,6 +35,7 @@
 #include "drm_crtc_helper.h"
 
 bool intel_pipe_has_type (struct drm_crtc *crtc, int type);
+static void intel_update_watermarks(struct drm_device *dev);
 
 typedef struct {
     /* given values */
@@ -814,24 +816,21 @@ intel_find_pll_g4x_dp(const intel_limit_t *limit, struct drm_crtc *crtc,
 {
     intel_clock_t clock;
     if (target < 200000) {
-        clock.dot = 161670;
-        clock.p = 20;
         clock.p1 = 2;
         clock.p2 = 10;
-        clock.n = 0x01;
-        clock.m = 97;
-        clock.m1 = 0x10;
-        clock.m2 = 0x05;
+        clock.n = 2;
+        clock.m1 = 23;
+        clock.m2 = 8;
     } else {
-        clock.dot = 270000;
-        clock.p = 10;
         clock.p1 = 1;
         clock.p2 = 10;
-        clock.n = 0x02;
-        clock.m = 108;
-        clock.m1 = 0x12;
-        clock.m2 = 0x06;
+        clock.n = 1;
+        clock.m1 = 14;
+        clock.m2 = 2;
     }
+    clock.m = 5 * (clock.m1 + 2) + (clock.m2 + 2);
+    clock.p = (clock.p1 * clock.p2);
+    clock.dot = 96000 * clock.m / (clock.n + 2) / clock.p;
     memcpy(best_clock, &clock, sizeof(intel_clock_t));
     return true;
 }
@@ -1005,7 +1004,7 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         int pipe = intel_crtc->pipe;
-        int plane = intel_crtc->pipe;
+        int plane = intel_crtc->plane;
         int pch_dpll_reg = (pipe == 0) ? PCH_DPLL_A : PCH_DPLL_B;
         int pipeconf_reg = (pipe == 0) ? PIPEACONF : PIPEBCONF;
         int dspcntr_reg = (plane == 0) ? DSPACNTR : DSPBCNTR;
@@ -1335,8 +1334,10 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
 
                 /* Give the overlay scaler a chance to enable if it's on this pipe */
                 //intel_crtc_dpms_video(crtc, true); TODO
+                intel_update_watermarks(dev);
         break;
         case DRM_MODE_DPMS_OFF:
+                intel_update_watermarks(dev);
                 /* Give the overlay scaler a chance to disable if it's on this pipe */
                 //intel_crtc_dpms_video(crtc, FALSE); TODO
 
@@ -1515,7 +1516,6 @@ static int intel_get_core_clock_speed(struct drm_device *dev)
         return 0; /* Silence gcc warning */
 }
 
-
 /**
  * Return the pipe currently connected to the panel fitter,
  * or -1 if the panel fitter is not present or not in use
@@ -1574,7 +1574,7 @@ igdng_compute_m_n(int bytes_per_pixel, int nlanes,
 
         temp = (u64) DATA_N * pixel_clock;
         temp = div_u64(temp, link_clock);
-        m_n->gmch_m = (temp * bytes_per_pixel) / nlanes;
+        m_n->gmch_m = div_u64(temp * bytes_per_pixel, nlanes);
         m_n->gmch_n = DATA_N;
         fdi_reduce_ratio(&m_n->gmch_m, &m_n->gmch_n);
 
@@ -1585,6 +1585,420 @@ igdng_compute_m_n(int bytes_per_pixel, int nlanes,
 }
 
 
+struct intel_watermark_params {
+        unsigned long fifo_size;
+        unsigned long max_wm;
+        unsigned long default_wm;
+        unsigned long guard_size;
+        unsigned long cacheline_size;
+};
+
+/* IGD has different values for various configs */
+static struct intel_watermark_params igd_display_wm = {
+        IGD_DISPLAY_FIFO,
+        IGD_MAX_WM,
+        IGD_DFT_WM,
+        IGD_GUARD_WM,
+        IGD_FIFO_LINE_SIZE
+};
+static struct intel_watermark_params igd_display_hplloff_wm = {
+        IGD_DISPLAY_FIFO,
+        IGD_MAX_WM,
+        IGD_DFT_HPLLOFF_WM,
+        IGD_GUARD_WM,
+        IGD_FIFO_LINE_SIZE
+};
+static struct intel_watermark_params igd_cursor_wm = {
+        IGD_CURSOR_FIFO,
+        IGD_CURSOR_MAX_WM,
+        IGD_CURSOR_DFT_WM,
+        IGD_CURSOR_GUARD_WM,
+        IGD_FIFO_LINE_SIZE,
+};
+static struct intel_watermark_params igd_cursor_hplloff_wm = {
+        IGD_CURSOR_FIFO,
+        IGD_CURSOR_MAX_WM,
+        IGD_CURSOR_DFT_WM,
+        IGD_CURSOR_GUARD_WM,
+        IGD_FIFO_LINE_SIZE
+};
+static struct intel_watermark_params i945_wm_info = {
+        I915_FIFO_LINE_SIZE,
+        I915_MAX_WM,
+        1,
+        0,
+        IGD_FIFO_LINE_SIZE
+};
+static struct intel_watermark_params i915_wm_info = {
+        I945_FIFO_SIZE,
+        I915_MAX_WM,
+        1,
+        0,
+        I915_FIFO_LINE_SIZE
+};
+static struct intel_watermark_params i855_wm_info = {
+        I855GM_FIFO_SIZE,
+        I915_MAX_WM,
+        1,
+        0,
+        I830_FIFO_LINE_SIZE
+};
+static struct intel_watermark_params i830_wm_info = {
+        I830_FIFO_SIZE,
+        I915_MAX_WM,
+        1,
+        0,
+        I830_FIFO_LINE_SIZE
+};
+
+static unsigned long intel_calculate_wm(unsigned long clock_in_khz,
+                                        struct intel_watermark_params *wm,
+                                        int pixel_size,
+                                        unsigned long latency_ns)
+{
+        unsigned long bytes_required, wm_size;
+
+        bytes_required = (clock_in_khz * pixel_size * latency_ns) / 1000000;
+        bytes_required /= wm->cacheline_size;
+        wm_size = wm->fifo_size - bytes_required - wm->guard_size;
+
+        if (wm_size > wm->max_wm)
+                wm_size = wm->max_wm;
+        if (wm_size == 0)
+                wm_size = wm->default_wm;
+        return wm_size;
+}
+
+struct cxsr_latency {
+        int is_desktop;
+        unsigned long fsb_freq;
+        unsigned long mem_freq;
+        unsigned long display_sr;
+        unsigned long display_hpll_disable;
+        unsigned long cursor_sr;
+        unsigned long cursor_hpll_disable;
+};
+
+static struct cxsr_latency cxsr_latency_table[] = {
+        {1, 800, 400, 3382, 33382, 3983, 33983},    /* DDR2-400 SC */
+        {1, 800, 667, 3354, 33354, 3807, 33807},    /* DDR2-667 SC */
+        {1, 800, 800, 3347, 33347, 3763, 33763},    /* DDR2-800 SC */
+
+        {1, 667, 400, 3400, 33400, 4021, 34021},    /* DDR2-400 SC */
+        {1, 667, 667, 3372, 33372, 3845, 33845},    /* DDR2-667 SC */
+        {1, 667, 800, 3386, 33386, 3822, 33822},    /* DDR2-800 SC */
+
+        {1, 400, 400, 3472, 33472, 4173, 34173},    /* DDR2-400 SC */
+        {1, 400, 667, 3443, 33443, 3996, 33996},    /* DDR2-667 SC */
+        {1, 400, 800, 3430, 33430, 3946, 33946},    /* DDR2-800 SC */
+
+        {0, 800, 400, 3438, 33438, 4065, 34065},    /* DDR2-400 SC */
+        {0, 800, 667, 3410, 33410, 3889, 33889},    /* DDR2-667 SC */
+        {0, 800, 800, 3403, 33403, 3845, 33845},    /* DDR2-800 SC */
+
+        {0, 667, 400, 3456, 33456, 4103, 34106},    /* DDR2-400 SC */
+        {0, 667, 667, 3428, 33428, 3927, 33927},    /* DDR2-667 SC */
+        {0, 667, 800, 3443, 33443, 3905, 33905},    /* DDR2-800 SC */
+
+        {0, 400, 400, 3528, 33528, 4255, 34255},    /* DDR2-400 SC */
+        {0, 400, 667, 3500, 33500, 4079, 34079},    /* DDR2-667 SC */
+        {0, 400, 800, 3487, 33487, 4029, 34029},    /* DDR2-800 SC */
+};
+
+static struct cxsr_latency *intel_get_cxsr_latency(int is_desktop, int fsb,
+                                                   int mem)
+{
+        int i;
+        struct cxsr_latency *latency;
+
+        if (fsb == 0 || mem == 0)
+                return NULL;
+
+        for (i = 0; i < ARRAY_SIZE(cxsr_latency_table); i++) {
+                latency = &cxsr_latency_table[i];
+                if (is_desktop == latency->is_desktop &&
+                        fsb == latency->fsb_freq && mem == latency->mem_freq)
+                        break;
+        }
+        if (i >= ARRAY_SIZE(cxsr_latency_table)) {
+                DRM_DEBUG("Unknown FSB/MEM found, disable CxSR\n");
+                return NULL;
+        }
+        return latency;
+}
+
+static void igd_disable_cxsr(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 reg;
+
+        /* deactivate cxsr */
+        reg = I915_READ(DSPFW3);
+        reg &= ~(IGD_SELF_REFRESH_EN);
+        I915_WRITE(DSPFW3, reg);
+        DRM_INFO("Big FIFO is disabled\n");
+}
+
+static void igd_enable_cxsr(struct drm_device *dev, unsigned long clock,
+                            int pixel_size)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 reg;
+        unsigned long wm;
+        struct cxsr_latency *latency;
+
+        latency = intel_get_cxsr_latency(IS_IGDG(dev), dev_priv->fsb_freq,
+                dev_priv->mem_freq);
+        if (!latency) {
+                DRM_DEBUG("Unknown FSB/MEM found, disable CxSR\n");
+                igd_disable_cxsr(dev);
+                return;
+        }
+
+        /* Display SR */
+        wm = intel_calculate_wm(clock, &igd_display_wm, pixel_size,
+                                latency->display_sr);
+        reg = I915_READ(DSPFW1);
+        reg &= 0x7fffff;
+        reg |= wm << 23;
+        I915_WRITE(DSPFW1, reg);
+        DRM_DEBUG("DSPFW1 register is %x\n", reg);
+
+        /* cursor SR */
+        wm = intel_calculate_wm(clock, &igd_cursor_wm, pixel_size,
+                                latency->cursor_sr);
+        reg = I915_READ(DSPFW3);
+        reg &= ~(0x3f << 24);
+        reg |= (wm & 0x3f) << 24;
+        I915_WRITE(DSPFW3, reg);
+
+        /* Display HPLL off SR */
+        wm = intel_calculate_wm(clock, &igd_display_hplloff_wm,
+                latency->display_hpll_disable, I915_FIFO_LINE_SIZE);
+        reg = I915_READ(DSPFW3);
+        reg &= 0xfffffe00;
+        reg |= wm & 0x1ff;
+        I915_WRITE(DSPFW3, reg);
+
+        /* cursor HPLL off SR */
+        wm = intel_calculate_wm(clock, &igd_cursor_hplloff_wm, pixel_size,
+                                latency->cursor_hpll_disable);
+        reg = I915_READ(DSPFW3);
+        reg &= ~(0x3f << 16);
+        reg |= (wm & 0x3f) << 16;
+        I915_WRITE(DSPFW3, reg);
+        DRM_DEBUG("DSPFW3 register is %x\n", reg);
+
+        /* activate cxsr */
+        reg = I915_READ(DSPFW3);
+        reg |= IGD_SELF_REFRESH_EN;
+        I915_WRITE(DSPFW3, reg);
+
+        DRM_INFO("Big FIFO is enabled\n");
+
+        return;
+}
+
+const static int latency_ns = 5000; /* default for non-igd platforms */
+
+
+static void i965_update_wm(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        DRM_DEBUG("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR 8\n");
+
+        /* 965 has limitations... */
+        I915_WRITE(DSPFW1, (8 << 16) | (8 << 8) | (8 << 0));
+        I915_WRITE(DSPFW2, (8 << 8) | (8 << 0));
+}
+
+static void i9xx_update_wm(struct drm_device *dev, int planea_clock,
+                           int planeb_clock, int sr_hdisplay, int pixel_size)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        uint32_t fwater_lo = I915_READ(FW_BLC) & MM_FIFO_WATERMARK;
+        uint32_t fwater_hi = I915_READ(FW_BLC2) & LM_FIFO_WATERMARK;
+        int bsize, asize, cwm, bwm = 1, awm = 1, srwm = 1;
+        uint32_t dsparb = I915_READ(DSPARB);
+        int planea_entries, planeb_entries;
+        struct intel_watermark_params *wm_params;
+        unsigned long line_time_us;
+        int sr_clock, sr_entries = 0;
+
+        if (IS_I965GM(dev) || IS_I945GM(dev))
+                wm_params = &i945_wm_info;
+        else if (IS_I9XX(dev))
+                wm_params = &i915_wm_info;
+        else
+                wm_params = &i855_wm_info;
+
+        planea_entries = intel_calculate_wm(planea_clock, wm_params,
+                                            pixel_size, latency_ns);
+        planeb_entries = intel_calculate_wm(planeb_clock, wm_params,
+                                            pixel_size, latency_ns);
+
+        DRM_DEBUG("FIFO entries - A: %d, B: %d\n", planea_entries,
+                  planeb_entries);
+
+        if (IS_I9XX(dev)) {
+                asize = dsparb & 0x7f;
+                bsize = (dsparb >> DSPARB_CSTART_SHIFT) & 0x7f;
+        } else {
+                asize = dsparb & 0x1ff;
+                bsize = (dsparb >> DSPARB_BEND_SHIFT) & 0x1ff;
+        }
+        DRM_DEBUG("FIFO size - A: %d, B: %d\n", asize, bsize);
+
+        /* Two extra entries for padding */
+        awm = asize - (planea_entries + 2);
+        bwm = bsize - (planeb_entries + 2);
+
+        /* Sanity check against potentially bad FIFO allocations */
+        if (awm <= 0) {
+                /* pipe is on but has too few FIFO entries */
+                if (planea_entries != 0)
+                        DRM_DEBUG("plane A needs more FIFO entries\n");
+                awm = 1;
+        }
+        if (bwm <= 0) {
+                if (planeb_entries != 0)
+                        DRM_DEBUG("plane B needs more FIFO entries\n");
+                bwm = 1;
+        }
+
+        /*
+         * Overlay gets an aggressive default since video jitter is bad.
+         */
+        cwm = 2;
+
+        /* Calc sr entries for one pipe configs */
+        if (!planea_clock || !planeb_clock) {
+                sr_clock = planea_clock ? planea_clock : planeb_clock;
+                line_time_us = (sr_hdisplay * 1000) / sr_clock;
+                sr_entries = (((latency_ns / line_time_us) + 1) * pixel_size *
+                              sr_hdisplay) / 1000;
+                sr_entries = roundup(sr_entries / wm_params->cacheline_size, 1);
+                if (sr_entries < wm_params->fifo_size)
+                        srwm = wm_params->fifo_size - sr_entries;
+        }
+
+        DRM_DEBUG("Setting FIFO watermarks - A: %d, B: %d, C: %d, SR %d\n",
+                  awm, bwm, cwm, srwm);
+
+        fwater_lo = fwater_lo | ((bwm & 0x3f) << 16) | (awm & 0x3f);
+        fwater_hi = fwater_hi | (cwm & 0x1f);
+
+        I915_WRITE(FW_BLC, fwater_lo);
+        I915_WRITE(FW_BLC2, fwater_hi);
+        if (IS_I9XX(dev))
+                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN | (srwm & 0x3f));
+}
+
+static void i830_update_wm(struct drm_device *dev, int planea_clock,
+                           int pixel_size)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        uint32_t dsparb = I915_READ(DSPARB);
+        uint32_t fwater_lo = I915_READ(FW_BLC) & MM_FIFO_WATERMARK;
+        unsigned int asize, awm;
+        int planea_entries;
+
+        planea_entries = intel_calculate_wm(planea_clock, &i830_wm_info,
+                                            pixel_size, latency_ns);
+
+        asize = dsparb & 0x7f;
+
+        awm = asize - planea_entries;
+
+        fwater_lo = fwater_lo | awm;
+
+        I915_WRITE(FW_BLC, fwater_lo);
+}
+
+/**
+ * intel_update_watermarks - update FIFO watermark values based on current modes
+ *
+ * Calculate watermark values for the various WM regs based on current mode
+ * and plane configuration.
+ *
+ * There are several cases to deal with here:
+ *   - normal (i.e. non-self-refresh)
+ *   - self-refresh (SR) mode
+ *   - lines are large relative to FIFO size (buffer can hold up to 2)
+ *   - lines are small relative to FIFO size (buffer can hold more than 2
+ *     lines), so need to account for TLB latency
+ *
+ *   The normal calculation is:
+ *     watermark = dotclock * bytes per pixel * latency
+ *   where latency is platform & configuration dependent (we assume pessimal
+ *   values here).
+ *
+ *   The SR calculation is:
+ *     watermark = (trunc(latency/line time)+1) * surface width *
+ *       bytes per pixel
+ *   where
+ *     line time = htotal / dotclock
+ *   and latency is assumed to be high, as above.
+ *
+ * The final value programmed to the register should always be rounded up,
+ * and include an extra 2 entries to account for clock crossings.
+ *
+ * We don't use the sprite, so we can ignore that.  And on Crestline we have
+ * to set the non-SR watermarks to 8.
+  */
+static void intel_update_watermarks(struct drm_device *dev)
+{
+        struct drm_crtc *crtc;
+        struct intel_crtc *intel_crtc;
+        int sr_hdisplay = 0;
+        unsigned long planea_clock = 0, planeb_clock = 0, sr_clock = 0;
+        int enabled = 0, pixel_size = 0;
+
+        if (DSPARB_HWCONTROL(dev))
+                return;
+
+        /* Get the clock config from both planes */
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                intel_crtc = to_intel_crtc(crtc);
+                if (crtc->enabled) {
+                        enabled++;
+                        if (intel_crtc->plane == 0) {
+                                DRM_DEBUG("plane A (pipe %d) clock: %d\n",
+                                          intel_crtc->pipe, crtc->mode.clock);
+                                planea_clock = crtc->mode.clock;
+                        } else {
+                                DRM_DEBUG("plane B (pipe %d) clock: %d\n",
+                                          intel_crtc->pipe, crtc->mode.clock);
+                                planeb_clock = crtc->mode.clock;
+                        }
+                        sr_hdisplay = crtc->mode.hdisplay;
+                        sr_clock = crtc->mode.clock;
+                        if (crtc->fb)
+                                pixel_size = crtc->fb->bits_per_pixel / 8;
+                        else
+                                pixel_size = 4; /* by default */
+                }
+        }
+
+        if (enabled <= 0)
+                return;
+
+        /* Single pipe configs can enable self refresh */
+        if (enabled == 1 && IS_IGD(dev))
+                igd_enable_cxsr(dev, sr_clock, pixel_size);
+        else if (IS_IGD(dev))
+                igd_disable_cxsr(dev);
+
+        if (IS_I965G(dev))
+                i965_update_wm(dev);
+        else if (IS_I9XX(dev) || IS_MOBILE(dev))
+                i9xx_update_wm(dev, planea_clock, planeb_clock, sr_hdisplay,
+                               pixel_size);
+        else
+                i830_update_wm(dev, planea_clock, pixel_size);
+}
+
 static int intel_crtc_mode_set(struct drm_crtc *crtc,
                                struct drm_display_mode *mode,
                                struct drm_display_mode *adjusted_mode,
@@ -1951,6 +2365,9 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 
         /* Flush the plane changes */
         ret = intel_pipe_set_base(crtc, x, y, old_fb);
+
+        intel_update_watermarks(dev);
+
         drm_vblank_post_modeset(dev, pipe);
 
         return ret;
@@ -2439,6 +2856,7 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
 
         drm_mode_crtc_set_gamma_size(&intel_crtc->base, 256);
         intel_crtc->pipe = pipe;
+        intel_crtc->plane = pipe;
         for (i = 0; i < 256; i++) {
                 intel_crtc->lut_r[i] = i;
                 intel_crtc->lut_g[i] = i;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 8f8d37d5663a..6770ae88370d 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -246,7 +246,7 @@ intel_dp_aux_ch(struct intel_output *intel_output,
         }
 
         if ((status & DP_AUX_CH_CTL_DONE) == 0) {
-                printk(KERN_ERR "dp_aux_ch not done status 0x%08x\n", status);
+                DRM_ERROR("dp_aux_ch not done status 0x%08x\n", status);
                 return -EBUSY;
         }
 
@@ -254,11 +254,14 @@ intel_dp_aux_ch(struct intel_output *intel_output,
          * Timeouts occur when the sink is not connected
          */
         if (status & DP_AUX_CH_CTL_RECEIVE_ERROR) {
-                printk(KERN_ERR "dp_aux_ch receive error status 0x%08x\n", status);
+                DRM_ERROR("dp_aux_ch receive error status 0x%08x\n", status);
                 return -EIO;
         }
+
+        /* Timeouts occur when the device isn't connected, so they're
+         * "normal" -- don't fill the kernel log with these */
         if (status & DP_AUX_CH_CTL_TIME_OUT_ERROR) {
-                printk(KERN_ERR "dp_aux_ch timeout status 0x%08x\n", status);
+                DRM_DEBUG("dp_aux_ch timeout status 0x%08x\n", status);
                 return -ETIMEDOUT;
         }
 
@@ -411,7 +414,7 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
                                 dp_priv->link_bw = bws[clock];
                                 dp_priv->lane_count = lane_count;
                                 adjusted_mode->clock = intel_dp_link_clock(dp_priv->link_bw);
-                                printk(KERN_ERR "link bw %02x lane count %d clock %d\n",
+                                DRM_DEBUG("Display port link bw %02x lane count %d clock %d\n",
                                        dp_priv->link_bw, dp_priv->lane_count,
                                        adjusted_mode->clock);
                                 return true;
diff --git a/drivers/gpu/drm/i915/intel_dp_i2c.c b/drivers/gpu/drm/i915/intel_dp_i2c.c
index 4e60f14b1a6d..a63b6f57d2d4 100644
--- a/drivers/gpu/drm/i915/intel_dp_i2c.c
+++ b/drivers/gpu/drm/i915/intel_dp_i2c.c
@@ -29,6 +29,7 @@
 #include <linux/sched.h>
 #include <linux/i2c.h>
 #include "intel_dp.h"
+#include "drmP.h"
 
 /* Run a single AUX_CH I2C transaction, writing/reading data as necessary */
 
@@ -84,7 +85,7 @@ i2c_algo_dp_aux_transaction(struct i2c_adapter *adapter, int mode,
                                            msg, msg_bytes,
                                            reply, reply_bytes);
                 if (ret < 0) {
-                        printk(KERN_ERR "aux_ch failed %d\n", ret);
+                        DRM_DEBUG("aux_ch failed %d\n", ret);
                         return ret;
                 }
                 switch (reply[0] & AUX_I2C_REPLY_MASK) {
@@ -94,14 +95,14 @@ i2c_algo_dp_aux_transaction(struct i2c_adapter *adapter, int mode,
                         }
                         return reply_bytes - 1;
                 case AUX_I2C_REPLY_NACK:
-                        printk(KERN_ERR "aux_ch nack\n");
+                        DRM_DEBUG("aux_ch nack\n");
                         return -EREMOTEIO;
                 case AUX_I2C_REPLY_DEFER:
-                        printk(KERN_ERR "aux_ch defer\n");
+                        DRM_DEBUG("aux_ch defer\n");
                         udelay(100);
                         break;
                 default:
-                        printk(KERN_ERR "aux_ch invalid reply 0x%02x\n", reply[0]);
+                        DRM_ERROR("aux_ch invalid reply 0x%02x\n", reply[0]);
                         return -EREMOTEIO;
                 }
         }
@@ -223,7 +224,7 @@ i2c_algo_dp_aux_xfer(struct i2c_adapter *adapter,
         if (ret >= 0)
                 ret = num;
         i2c_algo_dp_aux_stop(adapter, reading);
-        printk(KERN_ERR "dp_aux_xfer return %d\n", ret);
+        DRM_DEBUG("dp_aux_xfer return %d\n", ret);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 1af7d68e3807..1d30802e773e 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -453,7 +453,7 @@ static int intelfb_create(struct drm_device *dev, uint32_t fb_width,
         size = ALIGN(size, PAGE_SIZE);
         fbo = drm_gem_object_alloc(dev, size);
         if (!fbo) {
-                printk(KERN_ERR "failed to allocate framebuffer\n");
+                DRM_ERROR("failed to allocate framebuffer\n");
                 ret = -ENOMEM;
                 goto out;
         }
@@ -610,8 +610,8 @@ static int intelfb_create(struct drm_device *dev, uint32_t fb_width,
         par->dev = dev;
 
         /* To allow resizeing without swapping buffers */
-        printk("allocated %dx%d fb: 0x%08x, bo %p\n", intel_fb->base.width,
-               intel_fb->base.height, obj_priv->gtt_offset, fbo);
+        DRM_DEBUG("allocated %dx%d fb: 0x%08x, bo %p\n", intel_fb->base.width,
+                  intel_fb->base.height, obj_priv->gtt_offset, fbo);
 
         mutex_unlock(&dev->struct_mutex);
         return 0;
@@ -698,13 +698,13 @@ static int intelfb_multi_fb_probe_crtc(struct drm_device *dev, struct drm_crtc *
         } else
                 intelfb_set_par(info);
 
-        printk(KERN_INFO "fb%d: %s frame buffer device\n", info->node,
+        DRM_INFO("fb%d: %s frame buffer device\n", info->node,
                info->fix.id);
 
         /* Switch back to kernel console on panic */
         kernelfb_mode = *modeset;
         atomic_notifier_chain_register(&panic_notifier_list, &paniced);
-        printk(KERN_INFO "registered panic notifier\n");
+        DRM_DEBUG("registered panic notifier\n");
 
         return 0;
 }
@@ -852,13 +852,13 @@ static int intelfb_single_fb_probe(struct drm_device *dev)
         } else
                 intelfb_set_par(info);
 
-        printk(KERN_INFO "fb%d: %s frame buffer device\n", info->node,
+        DRM_INFO("fb%d: %s frame buffer device\n", info->node,
                info->fix.id);
 
         /* Switch back to kernel console on panic */
         kernelfb_mode = *modeset;
         atomic_notifier_chain_register(&panic_notifier_list, &paniced);
-        printk(KERN_INFO "registered panic notifier\n");
+        DRM_DEBUG("registered panic notifier\n");
 
         return 0;
 }
@@ -872,8 +872,8 @@ void intelfb_restore(void)
 {
         int ret;
         if ((ret = drm_crtc_helper_set_config(&kernelfb_mode)) != 0) {
-                printk(KERN_ERR "Failed to restore crtc configuration: %d\n",
-                       ret);
+                DRM_ERROR("Failed to restore crtc configuration: %d\n",
+                          ret);
         }
 }
 
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 9564ca44a977..9ab38efffecf 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -36,6 +36,7 @@
 #include "intel_drv.h"
 #include "i915_drm.h"
 #include "i915_drv.h"
+#include <linux/acpi.h>
 
 #define I915_LVDS "i915_lvds"
 
@@ -252,14 +253,14 @@ static bool intel_lvds_mode_fixup(struct drm_encoder *encoder,
 
         /* Should never happen!! */
         if (!IS_I965G(dev) && intel_crtc->pipe == 0) {
-                printk(KERN_ERR "Can't support LVDS on pipe A\n");
+                DRM_ERROR("Can't support LVDS on pipe A\n");
                 return false;
         }
 
         /* Should never happen!! */
         list_for_each_entry(tmp_encoder, &dev->mode_config.encoder_list, head) {
                 if (tmp_encoder != encoder && tmp_encoder->crtc == encoder->crtc) {
-                        printk(KERN_ERR "Can't enable LVDS and another "
+                        DRM_ERROR("Can't enable LVDS and another "
                                "encoder on the same pipe\n");
                         return false;
                 }
@@ -788,6 +789,65 @@ static const struct dmi_system_id intel_no_lvds[] = {
         { }     /* terminating entry */
 };
 
+#ifdef CONFIG_ACPI
+/*
+ * check_lid_device -- check whether @handle is an ACPI LID device.
+ * @handle: ACPI device handle
+ * @level : depth in the ACPI namespace tree
+ * @context: the number of LID device when we find the device
+ * @rv: a return value to fill if desired (Not use)
+ */
+static acpi_status
+check_lid_device(acpi_handle handle, u32 level, void *context,
+                        void **return_value)
+{
+        struct acpi_device *acpi_dev;
+        int *lid_present = context;
+
+        acpi_dev = NULL;
+        /* Get the acpi device for device handle */
+        if (acpi_bus_get_device(handle, &acpi_dev) || !acpi_dev) {
+                /* If there is no ACPI device for handle, return */
+                return AE_OK;
+        }
+
+        if (!strncmp(acpi_device_hid(acpi_dev), "PNP0C0D", 7))
+                *lid_present = 1;
+
+        return AE_OK;
+}
+
+/**
+ * check whether there exists the ACPI LID device by enumerating the ACPI
+ * device tree.
+ */
+static int intel_lid_present(void)
+{
+        int lid_present = 0;
+
+        if (acpi_disabled) {
+                /* If ACPI is disabled, there is no ACPI device tree to
+                 * check, so assume the LID device would have been present.
+                 */
+                return 1;
+        }
+
+        acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
+                                ACPI_UINT32_MAX,
+                                check_lid_device, &lid_present, NULL);
+
+        return lid_present;
+}
+#else
+static int intel_lid_present(void)
+{
+        /* In the absence of ACPI built in, assume that the LID device would
+         * have been present.
+         */
+        return 1;
+}
+#endif
+
 /**
  * intel_lvds_init - setup LVDS connectors on this device
  * @dev: drm device
@@ -811,6 +871,16 @@ void intel_lvds_init(struct drm_device *dev)
         if (dmi_check_system(intel_no_lvds))
                 return;
 
+        /* Assume that any device without an ACPI LID device also doesn't
+         * have an integrated LVDS.  We would be better off parsing the BIOS
+         * to get a reliable indicator, but that code isn't written yet.
+         *
+         * In the case of all-in-one desktops using LVDS that we've seen,
+         * they're using SDVO LVDS.
+         */
+        if (!intel_lid_present())
+                return;
+
         if (IS_IGDNG(dev)) {
                 if ((I915_READ(PCH_LVDS) & LVDS_DETECTED) == 0)
                         return;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index f03473779feb..4f0c30948bc4 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -68,12 +68,23 @@ struct intel_sdvo_priv {
          * This is set if we treat the device as HDMI, instead of DVI.
          */
         bool is_hdmi;
+
         /**
          * This is set if we detect output of sdvo device as LVDS.
          */
         bool is_lvds;
 
         /**
+         * This is sdvo flags for input timing.
+         */
+        uint8_t sdvo_flags;
+
+        /**
+         * This is sdvo fixed pannel mode pointer
+         */
+        struct drm_display_mode *sdvo_lvds_fixed_mode;
+
+        /**
          * Returned SDTV resolutions allowed for the current format, if the
          * device reported it.
          */
@@ -592,6 +603,7 @@ intel_sdvo_create_preferred_input_timing(struct intel_output *output,
                                          uint16_t height)
 {
         struct intel_sdvo_preferred_input_timing_args args;
+        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
         uint8_t status;
 
         memset(&args, 0, sizeof(args));
@@ -599,7 +611,12 @@ intel_sdvo_create_preferred_input_timing(struct intel_output *output,
         args.width = width;
         args.height = height;
         args.interlace = 0;
-        args.scaled = 0;
+
+        if (sdvo_priv->is_lvds &&
+           (sdvo_priv->sdvo_lvds_fixed_mode->hdisplay != width ||
+            sdvo_priv->sdvo_lvds_fixed_mode->vdisplay != height))
+                args.scaled = 1;
+
         intel_sdvo_write_cmd(output, SDVO_CMD_CREATE_PREFERRED_INPUT_TIMING,
                              &args, sizeof(args));
         status = intel_sdvo_read_response(output, NULL, 0);
@@ -944,12 +961,7 @@ static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
         struct intel_output *output = enc_to_intel_output(encoder);
         struct intel_sdvo_priv *dev_priv = output->dev_priv;
 
-        if (!dev_priv->is_tv) {
-                /* Make the CRTC code factor in the SDVO pixel multiplier.  The
-                 * SDVO device will be told of the multiplier during mode_set.
-                 */
-                adjusted_mode->clock *= intel_sdvo_get_pixel_multiplier(mode);
-        } else {
+        if (dev_priv->is_tv) {
                 struct intel_sdvo_dtd output_dtd;
                 bool success;
 
@@ -980,6 +992,47 @@ static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
                         intel_sdvo_get_preferred_input_timing(output,
                                                              &input_dtd);
                         intel_sdvo_get_mode_from_dtd(adjusted_mode, &input_dtd);
+                        dev_priv->sdvo_flags = input_dtd.part2.sdvo_flags;
+
+                        drm_mode_set_crtcinfo(adjusted_mode, 0);
+
+                        mode->clock = adjusted_mode->clock;
+
+                        adjusted_mode->clock *=
+                                intel_sdvo_get_pixel_multiplier(mode);
+                } else {
+                        return false;
+                }
+        } else if (dev_priv->is_lvds) {
+                struct intel_sdvo_dtd output_dtd;
+                bool success;
+
+                drm_mode_set_crtcinfo(dev_priv->sdvo_lvds_fixed_mode, 0);
+                /* Set output timings */
+                intel_sdvo_get_dtd_from_mode(&output_dtd,
+                                dev_priv->sdvo_lvds_fixed_mode);
+
+                intel_sdvo_set_target_output(output,
+                                             dev_priv->controlled_output);
+                intel_sdvo_set_output_timing(output, &output_dtd);
+
+                /* Set the input timing to the screen. Assume always input 0. */
+                intel_sdvo_set_target_input(output, true, false);
+
+
+                success = intel_sdvo_create_preferred_input_timing(
+                                output,
+                                mode->clock / 10,
+                                mode->hdisplay,
+                                mode->vdisplay);
+
+                if (success) {
+                        struct intel_sdvo_dtd input_dtd;
+
+                        intel_sdvo_get_preferred_input_timing(output,
+                                                             &input_dtd);
+                        intel_sdvo_get_mode_from_dtd(adjusted_mode, &input_dtd);
+                        dev_priv->sdvo_flags = input_dtd.part2.sdvo_flags;
 
                         drm_mode_set_crtcinfo(adjusted_mode, 0);
 
@@ -990,6 +1043,12 @@ static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
                 } else {
                         return false;
                 }
+
+        } else {
+                /* Make the CRTC code factor in the SDVO pixel multiplier.  The
+                 * SDVO device will be told of the multiplier during mode_set.
+                 */
+                adjusted_mode->clock *= intel_sdvo_get_pixel_multiplier(mode);
         }
         return true;
 }
@@ -1033,15 +1092,16 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
 
         /* We have tried to get input timing in mode_fixup, and filled into
            adjusted_mode */
-        if (sdvo_priv->is_tv)
+        if (sdvo_priv->is_tv || sdvo_priv->is_lvds) {
                 intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode);
-        else
+                input_dtd.part2.sdvo_flags = sdvo_priv->sdvo_flags;
+        } else
                 intel_sdvo_get_dtd_from_mode(&input_dtd, mode);
 
         /* If it's a TV, we already set the output timing in mode_fixup.
          * Otherwise, the output timing is equal to the input timing.
          */
-        if (!sdvo_priv->is_tv) {
+        if (!sdvo_priv->is_tv && !sdvo_priv->is_lvds) {
                 /* Set the output timing to the screen */
                 intel_sdvo_set_target_output(output,
                                              sdvo_priv->controlled_output);
@@ -1116,6 +1176,8 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
                 sdvox |= (sdvo_pixel_multiply - 1) << SDVO_PORT_MULTIPLY_SHIFT;
         }
 
+        if (sdvo_priv->sdvo_flags & SDVO_NEED_TO_STALL)
+                sdvox |= SDVO_STALL_SELECT;
         intel_sdvo_write_sdvox(output, sdvox);
 }
 
@@ -1276,6 +1338,17 @@ static int intel_sdvo_mode_valid(struct drm_connector *connector,
         if (sdvo_priv->pixel_clock_max < mode->clock)
                 return MODE_CLOCK_HIGH;
 
+        if (sdvo_priv->is_lvds == true) {
+                if (sdvo_priv->sdvo_lvds_fixed_mode == NULL)
+                        return MODE_PANEL;
+
+                if (mode->hdisplay > sdvo_priv->sdvo_lvds_fixed_mode->hdisplay)
+                        return MODE_PANEL;
+
+                if (mode->vdisplay > sdvo_priv->sdvo_lvds_fixed_mode->vdisplay)
+                        return MODE_PANEL;
+        }
+
         return MODE_OK;
 }
 
@@ -1549,6 +1622,8 @@ static void intel_sdvo_get_lvds_modes(struct drm_connector *connector)
 {
         struct intel_output *intel_output = to_intel_output(connector);
         struct drm_i915_private *dev_priv = connector->dev->dev_private;
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct drm_display_mode *newmode;
 
         /*
          * Attempt to get the mode list from DDC.
@@ -1557,11 +1632,10 @@ static void intel_sdvo_get_lvds_modes(struct drm_connector *connector)
          */
         intel_ddc_get_modes(intel_output);
         if (list_empty(&connector->probed_modes) == false)
-                return;
+                goto end;
 
         /* Fetch modes from VBT */
         if (dev_priv->sdvo_lvds_vbt_mode != NULL) {
-                struct drm_display_mode *newmode;
                 newmode = drm_mode_duplicate(connector->dev,
                                              dev_priv->sdvo_lvds_vbt_mode);
                 if (newmode != NULL) {
@@ -1571,6 +1645,16 @@ static void intel_sdvo_get_lvds_modes(struct drm_connector *connector)
                         drm_mode_probed_add(connector, newmode);
                 }
         }
+
+end:
+        list_for_each_entry(newmode, &connector->probed_modes, head) {
+                if (newmode->type & DRM_MODE_TYPE_PREFERRED) {
+                        sdvo_priv->sdvo_lvds_fixed_mode =
+                                drm_mode_duplicate(connector->dev, newmode);
+                        break;
+                }
+        }
+
 }
 
 static int intel_sdvo_get_modes(struct drm_connector *connector)
@@ -1593,14 +1677,20 @@ static int intel_sdvo_get_modes(struct drm_connector *connector)
 static void intel_sdvo_destroy(struct drm_connector *connector)
 {
         struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
 
         if (intel_output->i2c_bus)
                 intel_i2c_destroy(intel_output->i2c_bus);
         if (intel_output->ddc_bus)
                 intel_i2c_destroy(intel_output->ddc_bus);
 
+        if (sdvo_priv->sdvo_lvds_fixed_mode != NULL)
+                drm_mode_destroy(connector->dev,
+                                 sdvo_priv->sdvo_lvds_fixed_mode);
+
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
+
         kfree(intel_output);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_sdvo_regs.h b/drivers/gpu/drm/i915/intel_sdvo_regs.h
index 193938b7d7f9..ba5cdf8ae40b 100644
--- a/drivers/gpu/drm/i915/intel_sdvo_regs.h
+++ b/drivers/gpu/drm/i915/intel_sdvo_regs.h
@@ -715,6 +715,7 @@ struct intel_sdvo_enhancements_arg {
   #define SDVO_HBUF_TX_ONCE     (2 << 6)
   #define SDVO_HBUF_TX_VSYNC    (3 << 6)
 #define SDVO_CMD_GET_AUDIO_TX_INFO      0x9c
+#define SDVO_NEED_TO_STALL  (1 << 7)
 
 struct intel_sdvo_encode{
     u8 dvi_rev;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 40b75032ea47..fe949a12fe40 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -327,7 +327,7 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
                 goto out_unref;
 
         kmap_offset = dev_offset - bo->vm_node->start;
-        if (unlikely(kmap_offset) >= bo->num_pages) {
+        if (unlikely(kmap_offset >= bo->num_pages)) {
                 ret = -EFBIG;
                 goto out_unref;
         }
@@ -401,7 +401,7 @@ ssize_t ttm_bo_fbdev_io(struct ttm_buffer_object *bo, const char __user *wbuf,
         bool dummy;
 
         kmap_offset = (*f_pos >> PAGE_SHIFT);
-        if (unlikely(kmap_offset) >= bo->num_pages)
+        if (unlikely(kmap_offset >= bo->num_pages))
                 return -EFBIG;
 
         page_offset = *f_pos & ~PAGE_MASK;
diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
index c248c1d37268..5935b8842e86 100644
--- a/drivers/gpu/drm/via/via_irq.c
+++ b/drivers/gpu/drm/via/via_irq.c
@@ -183,7 +183,7 @@ int via_enable_vblank(struct drm_device *dev, int crtc)
         }
 
         status = VIA_READ(VIA_REG_INTERRUPT);
-        VIA_WRITE(VIA_REG_INTERRUPT, status & VIA_IRQ_VBLANK_ENABLE);
+        VIA_WRITE(VIA_REG_INTERRUPT, status | VIA_IRQ_VBLANK_ENABLE);
 
         VIA_WRITE8(0x83d4, 0x11);
         VIA_WRITE8(0x83d5, VIA_READ8(0x83d5) | 0x30);
@@ -194,6 +194,10 @@ int via_enable_vblank(struct drm_device *dev, int crtc)
 void via_disable_vblank(struct drm_device *dev, int crtc)
 {
         drm_via_private_t *dev_priv = dev->dev_private;
+        u32 status;
+
+        status = VIA_READ(VIA_REG_INTERRUPT);
+        VIA_WRITE(VIA_REG_INTERRUPT, status & ~VIA_IRQ_VBLANK_ENABLE);
 
         VIA_WRITE8(0x83d4, 0x11);
         VIA_WRITE8(0x83d5, VIA_READ8(0x83d5) & ~0x30);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f2c21d5d24e8..5eb10c2ce665 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1075,14 +1075,16 @@ EXPORT_SYMBOL_GPL(hid_report_raw_event);
  */
 int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int interrupt)
 {
-        struct hid_report_enum *report_enum = hid->report_enum + type;
-        struct hid_driver *hdrv = hid->driver;
+        struct hid_report_enum *report_enum;
+        struct hid_driver *hdrv;
         struct hid_report *report;
         unsigned int i;
         int ret;
 
         if (!hid || !hid->driver)
                 return -ENODEV;
+        report_enum = hid->report_enum + type;
+        hdrv = hid->driver;
 
         if (!size) {
                 dbg_hid("empty report\n");
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 76c4bbe9dccb..3c1fcb7640ab 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -22,7 +22,6 @@
 #include <linux/list.h>
 #include <linux/mm.h>
 #include <linux/mutex.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <asm/unaligned.h>
 #include <asm/byteorder.h>
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 9e9421525fb9..215b2addddbb 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -527,8 +527,10 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
                         goto goodreturn;
 
                 case HIDIOCGCOLLECTIONINDEX:
+                        i = field->usage[uref->usage_index].collection_index;
+                        unlock_kernel();
                         kfree(uref_multi);
-                        return field->usage[uref->usage_index].collection_index;
+                        return i;
                 case HIDIOCGUSAGES:
                         for (i = 0; i < uref_multi->num_values; i++)
                                 uref_multi->values[i] =
diff --git a/drivers/hwmon/abituguru3.c b/drivers/hwmon/abituguru3.c
index ad2b3431b725..7d3f15d32fdf 100644
--- a/drivers/hwmon/abituguru3.c
+++ b/drivers/hwmon/abituguru3.c
@@ -357,7 +357,7 @@ static const struct abituguru3_motherboard_info abituguru3_motherboards[] = {
                 { "AUX5 Fan",           39, 2, 60, 1, 0 },
                 { NULL, 0, 0, 0, 0, 0 } }
         },
-        { 0x0014, NULL /* Abit AB9 Pro, need DMI string */, {
+        { 0x0014, "AB9", /* + AB9 Pro */ {
                 { "CPU Core",            0, 0, 10, 1, 0 },
                 { "DDR",                 1, 0, 10, 1, 0 },
                 { "DDR VTT",             2, 0, 10, 1, 0 },
@@ -455,7 +455,7 @@ static const struct abituguru3_motherboard_info abituguru3_motherboards[] = {
                 { "AUX3 FAN",           37, 2, 60, 1, 0 },
                 { NULL, 0, 0, 0, 0, 0 } }
         },
-        { 0x0018, NULL /* Unknown, need DMI string */, {
+        { 0x0018, "AB9 QuadGT", {
                 { "CPU Core",            0, 0, 10, 1, 0 },
                 { "DDR2",                1, 0, 20, 1, 0 },
                 { "DDR2 VTT",            2, 0, 10, 1, 0 },
@@ -564,7 +564,7 @@ static const struct abituguru3_motherboard_info abituguru3_motherboards[] = {
                 { "AUX3 Fan",           36, 2, 60, 1, 0 },
                 { NULL, 0, 0, 0, 0, 0 } }
         },
-        { 0x001C, NULL /* Unknown, need DMI string */, {
+        { 0x001C, "IX38 QuadGT", {
                 { "CPU Core",            0, 0, 10, 1, 0 },
                 { "DDR2",                1, 0, 20, 1, 0 },
                 { "DDR2 VTT",            2, 0, 10, 1, 0 },
diff --git a/drivers/hwmon/max6650.c b/drivers/hwmon/max6650.c
index 86142a858238..58f66be61b1f 100644
--- a/drivers/hwmon/max6650.c
+++ b/drivers/hwmon/max6650.c
@@ -418,6 +418,7 @@ static ssize_t set_div(struct device *dev, struct device_attribute *devattr,
                 data->count = 3;
                 break;
         default:
+                mutex_unlock(&data->update_lock);
                 dev_err(&client->dev,
                         "illegal value for fan divider (%d)\n", div);
                 return -EINVAL;
diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
index 56cd6004da36..6290a259456e 100644
--- a/drivers/hwmon/sht15.c
+++ b/drivers/hwmon/sht15.c
@@ -257,7 +257,7 @@ static inline int sht15_update_single_val(struct sht15_data *data,
                                  (data->flag == SHT15_READING_NOTHING),
                                  msecs_to_jiffies(timeout_msecs));
         if (ret == 0) {/* timeout occurred */
-                disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));;
+                disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
                 sht15_connection_reset(data);
                 return -ETIME;
         }
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 3fae3a91ce5b..c89687a10835 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -187,6 +187,11 @@ static int i2c_davinci_init(struct davinci_i2c_dev *dev)
         davinci_i2c_write_reg(dev, DAVINCI_I2C_CLKH_REG, clkh);
         davinci_i2c_write_reg(dev, DAVINCI_I2C_CLKL_REG, clkl);
 
+        /* Respond at reserved "SMBus Host" slave address" (and zero);
+         * we seem to have no option to not respond...
+         */
+        davinci_i2c_write_reg(dev, DAVINCI_I2C_OAR_REG, 0x08);
+
         dev_dbg(dev->dev, "input_clock = %d, CLK = %d\n", input_clock, clk);
         dev_dbg(dev->dev, "PSC  = %d\n",
                 davinci_i2c_read_reg(dev, DAVINCI_I2C_PSC_REG));
@@ -387,7 +392,7 @@ static void terminate_write(struct davinci_i2c_dev *dev)
         davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
 
         if (!dev->terminate)
-                dev_err(dev->dev, "TDR IRQ while no data to send\n");
+                dev_dbg(dev->dev, "TDR IRQ while no data to send\n");
 }
 
 /*
@@ -473,9 +478,14 @@ static irqreturn_t i2c_davinci_isr(int this_irq, void *dev_id)
                         break;
 
                 case DAVINCI_I2C_IVR_AAS:
-                        dev_warn(dev->dev, "Address as slave interrupt\n");
-                }/* switch */
-        }/* while */
+                        dev_dbg(dev->dev, "Address as slave interrupt\n");
+                        break;
+
+                default:
+                        dev_warn(dev->dev, "Unrecognized irq stat %d\n", stat);
+                        break;
+                }
+        }
 
         return count ? IRQ_HANDLED : IRQ_NONE;
 }
@@ -505,7 +515,7 @@ static int davinci_i2c_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        ioarea = request_mem_region(mem->start, (mem->end - mem->start) + 1,
+        ioarea = request_mem_region(mem->start, resource_size(mem),
                                     pdev->name);
         if (!ioarea) {
                 dev_err(&pdev->dev, "I2C region already claimed\n");
@@ -523,7 +533,7 @@ static int davinci_i2c_probe(struct platform_device *pdev)
         dev->irq = irq->start;
         platform_set_drvdata(pdev, dev);
 
-        dev->clk = clk_get(&pdev->dev, "I2CCLK");
+        dev->clk = clk_get(&pdev->dev, NULL);
         if (IS_ERR(dev->clk)) {
                 r = -ENODEV;
                 goto err_free_mem;
@@ -568,7 +578,7 @@ err_free_mem:
         put_device(&pdev->dev);
         kfree(dev);
 err_release_region:
-        release_mem_region(mem->start, (mem->end - mem->start) + 1);
+        release_mem_region(mem->start, resource_size(mem));
 
         return r;
 }
@@ -591,7 +601,7 @@ static int davinci_i2c_remove(struct platform_device *pdev)
         kfree(dev);
 
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        release_mem_region(mem->start, (mem->end - mem->start) + 1);
+        release_mem_region(mem->start, resource_size(mem));
         return 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index ad8d2010c921..fdd83277c8a8 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -806,7 +806,7 @@ omap_i2c_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        ioarea = request_mem_region(mem->start, (mem->end - mem->start) + 1,
+        ioarea = request_mem_region(mem->start, resource_size(mem),
                         pdev->name);
         if (!ioarea) {
                 dev_err(&pdev->dev, "I2C region already claimed\n");
@@ -905,7 +905,7 @@ err_free_mem:
         platform_set_drvdata(pdev, NULL);
         kfree(dev);
 err_release_region:
-        release_mem_region(mem->start, (mem->end - mem->start) + 1);
+        release_mem_region(mem->start, resource_size(mem));
 
         return r;
 }
@@ -925,7 +925,7 @@ omap_i2c_remove(struct platform_device *pdev)
         iounmap(dev->base);
         kfree(dev);
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        release_mem_region(mem->start, (mem->end - mem->start) + 1);
+        release_mem_region(mem->start, resource_size(mem));
         return 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 1c01083b01b5..4f3d99cd1692 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -563,7 +563,7 @@ static int sh_mobile_i2c_probe(struct platform_device *dev)
                 goto err_irq;
         }
 
-        size = (res->end - res->start) + 1;
+        size = resource_size(res);
 
         pd->reg = ioremap(res->start, size);
         if (pd->reg == NULL) {
diff --git a/drivers/i2c/busses/i2c-simtec.c b/drivers/i2c/busses/i2c-simtec.c
index 042fda295f3a..6407f47bda82 100644
--- a/drivers/i2c/busses/i2c-simtec.c
+++ b/drivers/i2c/busses/i2c-simtec.c
@@ -92,7 +92,7 @@ static int simtec_i2c_probe(struct platform_device *dev)
                 goto err;
         }
 
-        size = (res->end-res->start)+1;
+        size = resource_size(res);
 
         pd->ioarea = request_mem_region(res->start, size, dev->name);
         if (pd->ioarea == NULL) {
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index 695181120cdb..7f878017b736 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -455,6 +455,7 @@ static void idedisk_prepare_flush(struct request_queue *q, struct request *rq)
 
         rq->cmd_type = REQ_TYPE_ATA_TASKFILE;
         rq->special = cmd;
+        cmd->rq = rq;
 }
 
 ide_devset_get(multcount, mult_count);
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 013dc595fab6..bc5fb12b913c 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -1064,6 +1064,7 @@ static int idetape_blkdev_ioctl(ide_drive_t *drive, unsigned int cmd,
                 tape->best_dsc_rw_freq = config.dsc_rw_frequency;
                 break;
         case 0x0350:
+                memset(&config, 0, sizeof(config));
                 config.dsc_rw_frequency = (int) tape->best_dsc_rw_freq;
                 config.nr_stages = 1;
                 if (copy_to_user(argp, &config, sizeof(config)))
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 114efd8dc8f5..1148140d08a1 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -608,8 +608,7 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                                                     p, compat_mode);
 
                         if (_IOC_NR(cmd) == _IOC_NR(EVIOCGNAME(0)))
-                                return str_to_user(dev_name(&evdev->dev),
-                                                   _IOC_SIZE(cmd), p);
+                                return str_to_user(dev->name, _IOC_SIZE(cmd), p);
 
                         if (_IOC_NR(cmd) == _IOC_NR(EVIOCGPHYS(0)))
                                 return str_to_user(dev->phys, _IOC_SIZE(cmd), p);
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 0e12f89276a3..4cfd084fa897 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -536,7 +536,7 @@ static int joydev_ioctl_common(struct joydev *joydev,
         default:
                 if ((cmd & ~IOCSIZE_MASK) == JSIOCGNAME(0)) {
                         int len;
-                        const char *name = dev_name(&dev->dev);
+                        const char *name = dev->name;
 
                         if (!name)
                                 return 0;
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index b868b8d5fbb3..f155ad8cdae7 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -470,20 +470,20 @@ static void xpad_irq_out(struct urb *urb)
         status = urb->status;
 
         switch (status) {
-                case 0:
+        case 0:
                 /* success */
-                break;
-                case -ECONNRESET:
-                case -ENOENT:
-                case -ESHUTDOWN:
-                        /* this urb is terminated, clean up */
-                        dbg("%s - urb shutting down with status: %d",
-                                __func__, status);
-                        return;
-                default:
-                        dbg("%s - nonzero urb status received: %d",
-                                __func__, status);
-                        goto exit;
+                return;
+
+        case -ECONNRESET:
+        case -ENOENT:
+        case -ESHUTDOWN:
+                /* this urb is terminated, clean up */
+                dbg("%s - urb shutting down with status: %d", __func__, status);
+                return;
+
+        default:
+                dbg("%s - nonzero urb status received: %d", __func__, status);
+                goto exit;
         }
 
 exit:
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index df3f8aa68115..95fe0452dae4 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -895,6 +895,13 @@ static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = {
 };
 
 /*
+ * Amilo Pi 3525 key release for Fn+Volume keys not working
+ */
+static unsigned int atkbd_amilo_pi3525_forced_release_keys[] = {
+        0x20, 0xa0, 0x2e, 0xae, 0x30, 0xb0, -1U
+};
+
+/*
  * Amilo Xi 3650 key release for light touch bar not working
  */
 static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
@@ -902,6 +909,13 @@ static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
 };
 
 /*
+ * Soltech TA12 system with broken key release on volume keys and mute key
+ */
+static unsigned int atkdb_soltech_ta12_forced_release_keys[] = {
+        0xa0, 0xae, 0xb0, -1U
+};
+
+/*
  * atkbd_set_keycode_table() initializes keyboard's keycode table
  * according to the selected scancode set
  */
@@ -1568,6 +1582,15 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                 .driver_data = atkbd_amilo_pa1510_forced_release_keys,
         },
         {
+                .ident = "Fujitsu Amilo Pi 3525",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pi 3525"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_amilo_pi3525_forced_release_keys,
+        },
+        {
                 .ident = "Fujitsu Amilo Xi 3650",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
@@ -1576,6 +1599,15 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                 .callback = atkbd_setup_forced_release,
                 .driver_data = atkbd_amilo_xi3650_forced_release_keys,
         },
+        {
+                .ident = "Soltech Corporation TA12",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Soltech Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TA12"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkdb_soltech_ta12_forced_release_keys,
+        },
         { }
 };
 
diff --git a/drivers/input/misc/pcspkr.c b/drivers/input/misc/pcspkr.c
index 6d67af5387ad..21cb755a54fb 100644
--- a/drivers/input/misc/pcspkr.c
+++ b/drivers/input/misc/pcspkr.c
@@ -114,7 +114,7 @@ static int __devexit pcspkr_remove(struct platform_device *dev)
         return 0;
 }
 
-static int pcspkr_suspend(struct platform_device *dev, pm_message_t state)
+static int pcspkr_suspend(struct device *dev)
 {
         pcspkr_event(NULL, EV_SND, SND_BELL, 0);
 
@@ -127,14 +127,18 @@ static void pcspkr_shutdown(struct platform_device *dev)
         pcspkr_event(NULL, EV_SND, SND_BELL, 0);
 }
 
+static struct dev_pm_ops pcspkr_pm_ops = {
+        .suspend = pcspkr_suspend,
+};
+
 static struct platform_driver pcspkr_platform_driver = {
         .driver         = {
                 .name   = "pcspkr",
                 .owner  = THIS_MODULE,
+                .pm     = &pcspkr_pm_ops,
         },
         .probe          = pcspkr_probe,
         .remove         = __devexit_p(pcspkr_remove),
-        .suspend        = pcspkr_suspend,
         .shutdown       = pcspkr_shutdown,
 };
 
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 7c8957dd22c0..26e17a9a22eb 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -646,6 +646,15 @@ static struct dmi_system_id dmi_ids[] __initdata = {
         },
         {
                 .callback = dmi_matched,
+                .ident = "Maxdata Pro 7000 DX",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "MAXDATA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Pro 7000"),
+                },
+                .driver_data = keymap_fs_amilo_pro_v2000
+        },
+        {
+                .callback = dmi_matched,
                 .ident = "Fujitsu N3510",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index 1ebfcab74662..8ff7e35c7069 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -408,6 +408,8 @@ static int if_write_room(struct tty_struct *tty)
         return retval;
 }
 
+/* FIXME: This function does not have error returns */
+
 static int if_chars_in_buffer(struct tty_struct *tty)
 {
         struct cardstate *cs;
diff --git a/drivers/isdn/hisax/hfc_usb.c b/drivers/isdn/hisax/hfc_usb.c
index 8df889b0c1a9..9de54202c90c 100644
--- a/drivers/isdn/hisax/hfc_usb.c
+++ b/drivers/isdn/hisax/hfc_usb.c
@@ -37,7 +37,6 @@
 #include <linux/kernel_stat.h>
 #include <linux/usb.h>
 #include <linux/kernel.h>
-#include <linux/smp_lock.h>
 #include <linux/sched.h>
 #include <linux/moduleparam.h>
 #include "hisax.h"
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index b4d4522e5071..2881a66c1aa9 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -13,6 +13,7 @@
 
 #include <linux/isdn.h>
 #include <linux/delay.h>
+#include <linux/smp_lock.h>
 #include "isdn_common.h"
 #include "isdn_tty.h"
 #ifdef CONFIG_ISDN_AUDIO
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index e2f45019ebf0..3e1532a180ff 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -17,6 +17,7 @@
 
 #include <linux/mISDNif.h>
 #include <linux/kthread.h>
+#include <linux/smp_lock.h>
 #include "core.h"
 
 static u_int    *debug;
diff --git a/drivers/lguest/lg.h b/drivers/lguest/lg.h
index 9c3138265f8e..01c591923793 100644
--- a/drivers/lguest/lg.h
+++ b/drivers/lguest/lg.h
@@ -38,8 +38,6 @@ struct lguest_pages
 #define CHANGED_GDT_TLS         4 /* Actually a subset of CHANGED_GDT */
 #define CHANGED_ALL             3
 
-struct lguest;
-
 struct lg_cpu {
         unsigned int id;
         struct lguest *lg;
diff --git a/drivers/media/dvb/bt8xx/dst_ca.c b/drivers/media/dvb/bt8xx/dst_ca.c
index 4601b059b2b2..0e246eaad05a 100644
--- a/drivers/media/dvb/bt8xx/dst_ca.c
+++ b/drivers/media/dvb/bt8xx/dst_ca.c
@@ -21,6 +21,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/dvb/ca.h>
 #include "dvbdev.h"
diff --git a/drivers/media/dvb/dvb-core/dvbdev.h b/drivers/media/dvb/dvb-core/dvbdev.h
index 79927305e84d..487919bea7ae 100644
--- a/drivers/media/dvb/dvb-core/dvbdev.h
+++ b/drivers/media/dvb/dvb-core/dvbdev.h
@@ -27,7 +27,6 @@
 #include <linux/poll.h>
 #include <linux/fs.h>
 #include <linux/list.h>
-#include <linux/smp_lock.h>
 
 #define DVB_MAJOR 212
 
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index d1d959ed37b7..8d65c652ba50 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -36,7 +36,6 @@
 #include <linux/fs.h>
 #include <linux/timer.h>
 #include <linux/poll.h>
-#include <linux/smp_lock.h>
 
 #include <linux/kernel.h>
 #include <linux/sched.h>
diff --git a/drivers/media/radio/radio-mr800.c b/drivers/media/radio/radio-mr800.c
index 837467f93805..575bf9d89419 100644
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -58,6 +58,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/input.h>
 #include <linux/videodev2.h>
 #include <media/v4l2-device.h>
diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c
index 46d216329611..e85f318b4d2b 100644
--- a/drivers/media/radio/radio-si470x.c
+++ b/drivers/media/radio/radio-si470x.c
@@ -127,6 +127,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/input.h>
 #include <linux/usb.h>
 #include <linux/hid.h>
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 5eb1464af670..d147d29bb0d3 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -41,6 +41,7 @@
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/interrupt.h>
 #include <linux/kdev_t.h>
 #include "bttvp.h"
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index 2943bfd32a94..428f0c45e6b7 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -31,6 +31,7 @@
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/firmware.h>
+#include <linux/smp_lock.h>
 #include <media/v4l2-common.h>
 #include <media/v4l2-ioctl.h>
 #include <media/cx2341x.h>
diff --git a/drivers/media/video/cx23885/cx23885-video.c b/drivers/media/video/cx23885/cx23885-video.c
index 70836af3ab48..5d6093336300 100644
--- a/drivers/media/video/cx23885/cx23885-video.c
+++ b/drivers/media/video/cx23885/cx23885-video.c
@@ -26,6 +26,7 @@
 #include <linux/kmod.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/kthread.h>
diff --git a/drivers/media/video/cx88/cx88-blackbird.c b/drivers/media/video/cx88/cx88-blackbird.c
index 44eacfb0d0d6..356d6896da3f 100644
--- a/drivers/media/video/cx88/cx88-blackbird.c
+++ b/drivers/media/video/cx88/cx88-blackbird.c
@@ -32,6 +32,7 @@
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/firmware.h>
+#include <linux/smp_lock.h>
 #include <media/v4l2-common.h>
 #include <media/v4l2-ioctl.h>
 #include <media/cx2341x.h>
diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
index b12770848c00..2bb54c3ef5cd 100644
--- a/drivers/media/video/cx88/cx88-video.c
+++ b/drivers/media/video/cx88/cx88-video.c
@@ -31,6 +31,7 @@
 #include <linux/kmod.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
diff --git a/drivers/media/video/dabusb.c b/drivers/media/video/dabusb.c
index ec2f45dde164..0664d111085f 100644
--- a/drivers/media/video/dabusb.c
+++ b/drivers/media/video/dabusb.c
@@ -32,6 +32,7 @@
 #include <linux/list.h>
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <asm/uaccess.h>
 #include <asm/atomic.h>
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index db25c3034c11..8d17cf613306 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -62,6 +62,7 @@
 #include <linux/module.h>
 #include <linux/poll.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #ifdef CONFIG_USB_PWC_INPUT_EVDEV
 #include <linux/usb/input.h>
 #endif
diff --git a/drivers/media/video/pwc/pwc.h b/drivers/media/video/pwc/pwc.h
index 0be6f814f539..0b658dee05a4 100644
--- a/drivers/media/video/pwc/pwc.h
+++ b/drivers/media/video/pwc/pwc.h
@@ -29,7 +29,6 @@
 #include <linux/usb.h>
 #include <linux/spinlock.h>
 #include <linux/wait.h>
-#include <linux/smp_lock.h>
 #include <linux/version.h>
 #include <linux/mutex.h>
 #include <linux/mm.h>
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index 6be845ccc7d7..9e3262c0ba37 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -48,6 +48,7 @@
 #include <linux/videodev2.h>
 #include <linux/version.h>
 #include <linux/mm.h>
+#include <linux/smp_lock.h>
 #include <media/videobuf-vmalloc.h>
 #include <media/v4l2-common.h>
 #include <media/v4l2-ioctl.h>
diff --git a/drivers/media/video/saa5246a.c b/drivers/media/video/saa5246a.c
index 155804b061e9..b624a4c01fdc 100644
--- a/drivers/media/video/saa5246a.c
+++ b/drivers/media/video/saa5246a.c
@@ -43,7 +43,6 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/i2c.h>
-#include <linux/smp_lock.h>
 #include <linux/mutex.h>
 #include <linux/videotext.h>
 #include <linux/videodev2.h>
diff --git a/drivers/media/video/saa5249.c b/drivers/media/video/saa5249.c
index 271d6e931b75..12835fb82c95 100644
--- a/drivers/media/video/saa5249.c
+++ b/drivers/media/video/saa5249.c
@@ -46,7 +46,6 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/i2c.h>
-#include <linux/smp_lock.h>
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/videotext.h>
diff --git a/drivers/media/video/saa7134/saa7134-empress.c b/drivers/media/video/saa7134/saa7134-empress.c
index add1757f8930..296788c3bf0e 100644
--- a/drivers/media/video/saa7134/saa7134-empress.c
+++ b/drivers/media/video/saa7134/saa7134-empress.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/delay.h>
 
 #include "saa7134-reg.h"
diff --git a/drivers/media/video/se401.c b/drivers/media/video/se401.c
index c8f05297d0f0..85ffc2cba039 100644
--- a/drivers/media/video/se401.c
+++ b/drivers/media/video/se401.c
@@ -31,6 +31,7 @@ static const char version[] = "0.24";
 #include <linux/init.h>
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/pagemap.h>
 #include <linux/usb.h>
 #include "se401.h"
diff --git a/drivers/media/video/stk-webcam.c b/drivers/media/video/stk-webcam.c
index 2e5937047278..4d6785e63455 100644
--- a/drivers/media/video/stk-webcam.c
+++ b/drivers/media/video/stk-webcam.c
@@ -27,6 +27,7 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 
 #include <linux/usb.h>
 #include <linux/mm.h>
diff --git a/drivers/media/video/stradis.c b/drivers/media/video/stradis.c
index 0eb313082c97..eaada39c76fd 100644
--- a/drivers/media/video/stradis.c
+++ b/drivers/media/video/stradis.c
@@ -26,6 +26,7 @@
 #include <linux/kernel.h>
 #include <linux/major.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/poll.h>
diff --git a/drivers/media/video/stv680.c b/drivers/media/video/stv680.c
index 75f286f7a2e9..8b4e7dafce7b 100644
--- a/drivers/media/video/stv680.c
+++ b/drivers/media/video/stv680.c
@@ -62,6 +62,7 @@
 #include <linux/init.h>
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/pagemap.h>
 #include <linux/errno.h>
 #include <linux/videodev.h>
diff --git a/drivers/media/video/usbvideo/vicam.c b/drivers/media/video/usbvideo/vicam.c
index 8d73979596f9..45fce39ec9ad 100644
--- a/drivers/media/video/usbvideo/vicam.c
+++ b/drivers/media/video/usbvideo/vicam.c
@@ -43,6 +43,7 @@
 #include <linux/vmalloc.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/mutex.h>
 #include <linux/firmware.h>
 #include <linux/ihex.h>
diff --git a/drivers/media/video/usbvision/usbvision-video.c b/drivers/media/video/usbvision/usbvision-video.c
index 90b58914f984..90d9b5c0e9a7 100644
--- a/drivers/media/video/usbvision/usbvision-video.c
+++ b/drivers/media/video/usbvision/usbvision-video.c
@@ -50,6 +50,7 @@
 #include <linux/list.h>
 #include <linux/timer.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/utsname.h>
 #include <linux/highmem.h>
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 31eac66411d7..a7f1b69a7dab 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -25,7 +25,6 @@
 #include <linux/init.h>
 #include <linux/kmod.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 
diff --git a/drivers/media/video/zoran/zoran_driver.c b/drivers/media/video/zoran/zoran_driver.c
index 3d7df32a3d87..bcdefb1bcb3d 100644
--- a/drivers/media/video/zoran/zoran_driver.c
+++ b/drivers/media/video/zoran/zoran_driver.c
@@ -49,6 +49,7 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/pci.h>
 #include <linux/vmalloc.h>
 #include <linux/wait.h>
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index fa2d93a9fb8d..aed609832bc2 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -29,7 +29,6 @@
 #include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/io.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
 #include <linux/miscdevice.h>
diff --git a/drivers/misc/sgi-gru/grukservices.c b/drivers/misc/sgi-gru/grukservices.c
index eedbf9c32760..79689b10f937 100644
--- a/drivers/misc/sgi-gru/grukservices.c
+++ b/drivers/misc/sgi-gru/grukservices.c
@@ -24,7 +24,6 @@
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
 #include <linux/miscdevice.h>
diff --git a/drivers/mmc/host/mvsdio.c b/drivers/mmc/host/mvsdio.c
index b56d72ff06e9..34e23489811a 100644
--- a/drivers/mmc/host/mvsdio.c
+++ b/drivers/mmc/host/mvsdio.c
@@ -384,7 +384,7 @@ static irqreturn_t mvsd_irq(int irq, void *dev)
                                 u16 val[2] = {0, 0};
                                 val[0] = mvsd_read(MVSD_FIFO);
                                 val[1] = mvsd_read(MVSD_FIFO);
-                                memcpy(p, &val, s);
+                                memcpy(p, ((void *)&val) + 4 - s, s);
                                 s = 0;
                                 intr_status = mvsd_read(MVSD_NOR_INTR_STATUS);
                         }
@@ -423,7 +423,7 @@ static irqreturn_t mvsd_irq(int irq, void *dev)
                 if (s < 4) {
                         if (s && (intr_status & MVSD_NOR_TX_AVAIL)) {
                                 u16 val[2] = {0, 0};
-                                memcpy(&val, p, s);
+                                memcpy(((void *)&val) + 4 - s, p, s);
                                 mvsd_write(MVSD_FIFO, val[0]);
                                 mvsd_write(MVSD_FIFO, val[1]);
                                 s = 0;
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index d7d7109ef47e..e55ac792d68c 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -168,12 +168,12 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
 
         if (data->flags & MMC_DATA_READ) {
                 host->dma_dir = DMA_FROM_DEVICE;
-                dcmd = DCMD_INCTRGADDR | DCMD_FLOWTRG;
+                dcmd = DCMD_INCTRGADDR | DCMD_FLOWSRC;
                 DRCMR(host->dma_drcmrtx) = 0;
                 DRCMR(host->dma_drcmrrx) = host->dma | DRCMR_MAPVLD;
         } else {
                 host->dma_dir = DMA_TO_DEVICE;
-                dcmd = DCMD_INCSRCADDR | DCMD_FLOWSRC;
+                dcmd = DCMD_INCSRCADDR | DCMD_FLOWTRG;
                 DRCMR(host->dma_drcmrrx) = 0;
                 DRCMR(host->dma_drcmrtx) = host->dma | DRCMR_MAPVLD;
         }
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 286ed594e5a0..e1f7d0a78b9d 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -657,6 +657,11 @@ static int io_init(struct ubi_device *ubi)
         if (ubi->mtd->block_isbad && ubi->mtd->block_markbad)
                 ubi->bad_allowed = 1;
 
+        if (ubi->mtd->type == MTD_NORFLASH) {
+                ubi_assert(ubi->mtd->writesize == 1);
+                ubi->nor_flash = 1;
+        }
+
         ubi->min_io_size = ubi->mtd->writesize;
         ubi->hdrs_min_io_size = ubi->mtd->writesize >> ubi->mtd->subpage_sft;
 
@@ -996,6 +1001,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
         ubi_msg("number of PEBs reserved for bad PEB handling: %d",
                 ubi->beb_rsvd_pebs);
         ubi_msg("max/mean erase counter: %d/%d", ubi->max_ec, ubi->mean_ec);
+        ubi_msg("image sequence number: %d", ubi->image_seq);
 
         /*
          * The below lock makes sure we do not race with 'ubi_thread()' which
diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
index c0ed60e8ade9..54b0186915fb 100644
--- a/drivers/mtd/ubi/debug.c
+++ b/drivers/mtd/ubi/debug.c
@@ -44,6 +44,8 @@ void ubi_dbg_dump_ec_hdr(const struct ubi_ec_hdr *ec_hdr)
                be32_to_cpu(ec_hdr->vid_hdr_offset));
         printk(KERN_DEBUG "\tdata_offset    %d\n",
                be32_to_cpu(ec_hdr->data_offset));
+        printk(KERN_DEBUG "\timage_seq      %d\n",
+               be32_to_cpu(ec_hdr->image_seq));
         printk(KERN_DEBUG "\thdr_crc        %#08x\n",
                be32_to_cpu(ec_hdr->hdr_crc));
         printk(KERN_DEBUG "erase counter header hexdump:\n");
diff --git a/drivers/mtd/ubi/debug.h b/drivers/mtd/ubi/debug.h
index 13777e5beac9..a4da7a09b949 100644
--- a/drivers/mtd/ubi/debug.h
+++ b/drivers/mtd/ubi/debug.h
@@ -93,6 +93,12 @@ void ubi_dbg_dump_mkvol_req(const struct ubi_mkvol_req *req);
 #define UBI_IO_DEBUG 0
 #endif
 
+#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
+int ubi_dbg_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len);
+#else
+#define ubi_dbg_check_all_ff(ubi, pnum, offset, len) 0
+#endif
+
 #ifdef CONFIG_MTD_UBI_DEBUG_DISABLE_BGT
 #define DBG_DISABLE_BGT 1
 #else
@@ -167,6 +173,7 @@ static inline int ubi_dbg_is_erase_failure(void)
 #define ubi_dbg_is_bitflip()       0
 #define ubi_dbg_is_write_failure() 0
 #define ubi_dbg_is_erase_failure() 0
+#define ubi_dbg_check_all_ff(ubi, pnum, offset, len) 0
 
 #endif /* !CONFIG_MTD_UBI_DEBUG */
 #endif /* !__UBI_DEBUG_H__ */
diff --git a/drivers/mtd/ubi/gluebi.c b/drivers/mtd/ubi/gluebi.c
index 95aaac03f938..b5e478fa2661 100644
--- a/drivers/mtd/ubi/gluebi.c
+++ b/drivers/mtd/ubi/gluebi.c
@@ -332,6 +332,7 @@ static int gluebi_create(struct ubi_device_info *di,
         }
 
         gluebi->vol_id = vi->vol_id;
+        gluebi->ubi_num = vi->ubi_num;
         mtd->type = MTD_UBIVOLUME;
         if (!di->ro_mode)
                 mtd->flags = MTD_WRITEABLE;
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index effaff28bab1..4cb69925d8d9 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -98,17 +98,12 @@ static int paranoid_check_ec_hdr(const struct ubi_device *ubi, int pnum,
 static int paranoid_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum);
 static int paranoid_check_vid_hdr(const struct ubi_device *ubi, int pnum,
                                   const struct ubi_vid_hdr *vid_hdr);
-static int paranoid_check_all_ff(struct ubi_device *ubi, int pnum, int offset,
-                                 int len);
-static int paranoid_check_empty(struct ubi_device *ubi, int pnum);
 #else
 #define paranoid_check_not_bad(ubi, pnum) 0
 #define paranoid_check_peb_ec_hdr(ubi, pnum)  0
 #define paranoid_check_ec_hdr(ubi, pnum, ec_hdr)  0
 #define paranoid_check_peb_vid_hdr(ubi, pnum) 0
 #define paranoid_check_vid_hdr(ubi, pnum, vid_hdr) 0
-#define paranoid_check_all_ff(ubi, pnum, offset, len) 0
-#define paranoid_check_empty(ubi, pnum) 0
 #endif
 
 /**
@@ -244,7 +239,7 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
                 return err > 0 ? -EINVAL : err;
 
         /* The area we are writing to has to contain all 0xFF bytes */
-        err = paranoid_check_all_ff(ubi, pnum, offset, len);
+        err = ubi_dbg_check_all_ff(ubi, pnum, offset, len);
         if (err)
                 return err > 0 ? -EINVAL : err;
 
@@ -271,8 +266,8 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
         addr = (loff_t)pnum * ubi->peb_size + offset;
         err = ubi->mtd->write(ubi->mtd, addr, len, &written, buf);
         if (err) {
-                ubi_err("error %d while writing %d bytes to PEB %d:%d, written"
-                        " %zd bytes", err, len, pnum, offset, written);
+                ubi_err("error %d while writing %d bytes to PEB %d:%d, written "
+                        "%zd bytes", err, len, pnum, offset, written);
                 ubi_dbg_dump_stack();
         } else
                 ubi_assert(written == len);
@@ -350,7 +345,7 @@ retry:
                 return -EIO;
         }
 
-        err = paranoid_check_all_ff(ubi, pnum, 0, ubi->peb_size);
+        err = ubi_dbg_check_all_ff(ubi, pnum, 0, ubi->peb_size);
         if (err)
                 return err > 0 ? -EINVAL : err;
 
@@ -459,6 +454,54 @@ out:
 }
 
 /**
+ * nor_erase_prepare - prepare a NOR flash PEB for erasure.
+ * @ubi: UBI device description object
+ * @pnum: physical eraseblock number to prepare
+ *
+ * NOR flash, or at least some of them, have peculiar embedded PEB erasure
+ * algorithm: the PEB is first filled with zeroes, then it is erased. And
+ * filling with zeroes starts from the end of the PEB. This was observed with
+ * Spansion S29GL512N NOR flash.
+ *
+ * This means that in case of a power cut we may end up with intact data at the
+ * beginning of the PEB, and all zeroes at the end of PEB. In other words, the
+ * EC and VID headers are OK, but a large chunk of data at the end of PEB is
+ * zeroed. This makes UBI mistakenly treat this PEB as used and associate it
+ * with an LEB, which leads to subsequent failures (e.g., UBIFS fails).
+ *
+ * This function is called before erasing NOR PEBs and it zeroes out EC and VID
+ * magic numbers in order to invalidate them and prevent the failures. Returns
+ * zero in case of success and a negative error code in case of failure.
+ */
+static int nor_erase_prepare(struct ubi_device *ubi, int pnum)
+{
+        int err;
+        size_t written;
+        loff_t addr;
+        uint32_t data = 0;
+
+        addr = (loff_t)pnum * ubi->peb_size;
+        err = ubi->mtd->write(ubi->mtd, addr, 4, &written, (void *)&data);
+        if (err) {
+                ubi_err("error %d while writing 4 bytes to PEB %d:%d, written "
+                        "%zd bytes", err, pnum, 0, written);
+                ubi_dbg_dump_stack();
+                return err;
+        }
+
+        addr += ubi->vid_hdr_aloffset;
+        err = ubi->mtd->write(ubi->mtd, addr, 4, &written, (void *)&data);
+        if (err) {
+                ubi_err("error %d while writing 4 bytes to PEB %d:%d, written "
+                        "%zd bytes", err, pnum, ubi->vid_hdr_aloffset, written);
+                ubi_dbg_dump_stack();
+                return err;
+        }
+
+        return 0;
+}
+
+/**
  * ubi_io_sync_erase - synchronously erase a physical eraseblock.
  * @ubi: UBI device description object
  * @pnum: physical eraseblock number to erase
@@ -489,6 +532,12 @@ int ubi_io_sync_erase(struct ubi_device *ubi, int pnum, int torture)
                 return -EROFS;
         }
 
+        if (ubi->nor_flash) {
+                err = nor_erase_prepare(ubi, pnum);
+                if (err)
+                        return err;
+        }
+
         if (torture) {
                 ret = torture_peb(ubi, pnum);
                 if (ret < 0)
@@ -672,11 +721,6 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
                 if (read_err != -EBADMSG &&
                     check_pattern(ec_hdr, 0xFF, UBI_EC_HDR_SIZE)) {
                         /* The physical eraseblock is supposedly empty */
-                        err = paranoid_check_all_ff(ubi, pnum, 0,
-                                                    ubi->peb_size);
-                        if (err)
-                                return err > 0 ? UBI_IO_BAD_EC_HDR : err;
-
                         if (verbose)
                                 ubi_warn("no EC header found at PEB %d, "
                                          "only 0xFF bytes", pnum);
@@ -752,6 +796,7 @@ int ubi_io_write_ec_hdr(struct ubi_device *ubi, int pnum,
         ec_hdr->version = UBI_VERSION;
         ec_hdr->vid_hdr_offset = cpu_to_be32(ubi->vid_hdr_offset);
         ec_hdr->data_offset = cpu_to_be32(ubi->leb_start);
+        ec_hdr->image_seq = cpu_to_be32(ubi->image_seq);
         crc = crc32(UBI_CRC32_INIT, ec_hdr, UBI_EC_HDR_SIZE_CRC);
         ec_hdr->hdr_crc = cpu_to_be32(crc);
 
@@ -947,15 +992,6 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
                 if (read_err != -EBADMSG &&
                     check_pattern(vid_hdr, 0xFF, UBI_VID_HDR_SIZE)) {
                         /* The physical eraseblock is supposedly free */
-
-                        /*
-                         * The below is just a paranoid check, it has to be
-                         * compiled out if paranoid checks are disabled.
-                         */
-                        err = paranoid_check_empty(ubi, pnum);
-                        if (err)
-                                return err > 0 ? UBI_IO_BAD_VID_HDR : err;
-
                         if (verbose)
                                 ubi_warn("no VID header found at PEB %d, "
                                          "only 0xFF bytes", pnum);
@@ -1229,7 +1265,7 @@ exit:
 }
 
 /**
- * paranoid_check_all_ff - check that a region of flash is empty.
+ * ubi_dbg_check_all_ff - check that a region of flash is empty.
  * @ubi: UBI device description object
  * @pnum: the physical eraseblock number to check
  * @offset: the starting offset within the physical eraseblock to check
@@ -1239,8 +1275,7 @@ exit:
  * @offset of the physical eraseblock @pnum, %1 if not, and a negative error
  * code if an error occurred.
  */
-static int paranoid_check_all_ff(struct ubi_device *ubi, int pnum, int offset,
-                                 int len)
+int ubi_dbg_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len)
 {
         size_t read;
         int err;
@@ -1276,74 +1311,4 @@ error:
         return err;
 }
 
-/**
- * paranoid_check_empty - whether a PEB is empty.
- * @ubi: UBI device description object
- * @pnum: the physical eraseblock number to check
- *
- * This function makes sure PEB @pnum is empty, which means it contains only
- * %0xFF data bytes. Returns zero if the PEB is empty, %1 if not, and a
- * negative error code in case of failure.
- *
- * Empty PEBs have the EC header, and do not have the VID header. The caller of
- * this function should have already made sure the PEB does not have the VID
- * header. However, this function re-checks that, because it is possible that
- * the header and data has already been written to the PEB.
- *
- * Let's consider a possible scenario. Suppose there are 2 tasks - A and B.
- * Task A is in 'wear_leveling_worker()'. It is reading VID header of PEB X to
- * find which LEB it corresponds to. PEB X is currently unmapped, and has no
- * VID header. Task B is trying to write to PEB X.
- *
- * Task A: in 'ubi_io_read_vid_hdr()': reads the VID header from PEB X. The
- *         read data contain all 0xFF bytes;
- * Task B: writes VID header and some data to PEB X;
- * Task A: assumes PEB X is empty, calls 'paranoid_check_empty()'. And if we
- *         do not re-read the VID header, and do not cancel the checking if it
- *         is there, we fail.
- */
-static int paranoid_check_empty(struct ubi_device *ubi, int pnum)
-{
-        int err, offs = ubi->vid_hdr_aloffset, len = ubi->vid_hdr_alsize;
-        size_t read;
-        uint32_t magic;
-        const struct ubi_vid_hdr *vid_hdr;
-
-        mutex_lock(&ubi->dbg_buf_mutex);
-        err = ubi->mtd->read(ubi->mtd, offs, len, &read, ubi->dbg_peb_buf);
-        if (err && err != -EUCLEAN) {
-                ubi_err("error %d while reading %d bytes from PEB %d:%d, "
-                        "read %zd bytes", err, len, pnum, offs, read);
-                goto error;
-        }
-
-        vid_hdr = ubi->dbg_peb_buf;
-        magic = be32_to_cpu(vid_hdr->magic);
-        if (magic == UBI_VID_HDR_MAGIC)
-                /* The PEB contains VID header, so it is not empty */
-                goto out;
-
-        err = check_pattern(ubi->dbg_peb_buf, 0xFF, len);
-        if (err == 0) {
-                ubi_err("flash region at PEB %d:%d, length %d does not "
-                        "contain all 0xFF bytes", pnum, offs, len);
-                goto fail;
-        }
-
-out:
-        mutex_unlock(&ubi->dbg_buf_mutex);
-        return 0;
-
-fail:
-        ubi_err("paranoid check failed for PEB %d", pnum);
-        ubi_msg("hex dump of the %d-%d region", offs, offs + len);
-        print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
-                       ubi->dbg_peb_buf, len, 1);
-        err = 1;
-error:
-        ubi_dbg_dump_stack();
-        mutex_unlock(&ubi->dbg_buf_mutex);
-        return err;
-}
-
 #endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index c3d653ba5ca0..a423131b6171 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -757,6 +757,8 @@ static int process_eb(struct ubi_device *ubi, struct ubi_scan_info *si,
         si->is_empty = 0;
 
         if (!ec_corr) {
+                int image_seq;
+
                 /* Make sure UBI version is OK */
                 if (ech->version != UBI_VERSION) {
                         ubi_err("this UBI version is %d, image version is %d",
@@ -778,6 +780,18 @@ static int process_eb(struct ubi_device *ubi, struct ubi_scan_info *si,
                         ubi_dbg_dump_ec_hdr(ech);
                         return -EINVAL;
                 }
+
+                image_seq = be32_to_cpu(ech->image_seq);
+                if (!si->image_seq_set) {
+                        ubi->image_seq = image_seq;
+                        si->image_seq_set = 1;
+                } else if (ubi->image_seq != image_seq) {
+                        ubi_err("bad image sequence number %d in PEB %d, "
+                                "expected %d", image_seq, pnum, ubi->image_seq);
+                        ubi_dbg_dump_ec_hdr(ech);
+                        return -EINVAL;
+                }
+
         }
 
         /* OK, we've done with the EC header, let's look at the VID header */
diff --git a/drivers/mtd/ubi/scan.h b/drivers/mtd/ubi/scan.h
index 61df208e2f20..1017cf12def5 100644
--- a/drivers/mtd/ubi/scan.h
+++ b/drivers/mtd/ubi/scan.h
@@ -102,6 +102,7 @@ struct ubi_scan_volume {
  * @mean_ec: mean erase counter value
  * @ec_sum: a temporary variable used when calculating @mean_ec
  * @ec_count: a temporary variable used when calculating @mean_ec
+ * @image_seq_set: indicates @ubi->image_seq is known
  *
  * This data structure contains the result of scanning and may be used by other
  * UBI sub-systems to build final UBI data structures, further error-recovery
@@ -124,6 +125,7 @@ struct ubi_scan_info {
         int mean_ec;
         uint64_t ec_sum;
         int ec_count;
+        int image_seq_set;
 };
 
 struct ubi_device;
diff --git a/drivers/mtd/ubi/ubi-media.h b/drivers/mtd/ubi/ubi-media.h
index 8419fdccc79c..503ea9b27309 100644
--- a/drivers/mtd/ubi/ubi-media.h
+++ b/drivers/mtd/ubi/ubi-media.h
@@ -129,6 +129,7 @@ enum {
  * @ec: the erase counter
  * @vid_hdr_offset: where the VID header starts
  * @data_offset: where the user data start
+ * @image_seq: image sequence number
  * @padding2: reserved for future, zeroes
  * @hdr_crc: erase counter header CRC checksum
  *
@@ -144,6 +145,14 @@ enum {
  * volume identifier header and user data, relative to the beginning of the
  * physical eraseblock. These values have to be the same for all physical
  * eraseblocks.
+ *
+ * The @image_seq field is used to validate a UBI image that has been prepared
+ * for a UBI device. The @image_seq value can be any value, but it must be the
+ * same on all eraseblocks. UBI will ensure that all new erase counter headers
+ * also contain this value, and will check the value when scanning at start-up.
+ * One way to make use of @image_seq is to increase its value by one every time
+ * an image is flashed over an existing image, then, if the flashing does not
+ * complete, UBI will detect the error when scanning.
  */
 struct ubi_ec_hdr {
         __be32  magic;
@@ -152,7 +161,8 @@ struct ubi_ec_hdr {
         __be64  ec; /* Warning: the current limit is 31-bit anyway! */
         __be32  vid_hdr_offset;
         __be32  data_offset;
-        __u8    padding2[36];
+        __be32  image_seq;
+        __u8    padding2[32];
         __be32  hdr_crc;
 } __attribute__ ((packed));
 
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index 28acd133c997..6a5fe9633783 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -301,6 +301,7 @@ struct ubi_wl_entry;
  *                @vol->readers, @vol->writers, @vol->exclusive,
  *                @vol->ref_count, @vol->mapping and @vol->eba_tbl.
  * @ref_count: count of references on the UBI device
+ * @image_seq: image sequence number recorded on EC headers
  *
  * @rsvd_pebs: count of reserved physical eraseblocks
  * @avail_pebs: count of available physical eraseblocks
@@ -372,6 +373,7 @@ struct ubi_wl_entry;
  * @vid_hdr_shift: contains @vid_hdr_offset - @vid_hdr_aloffset
  * @bad_allowed: whether the MTD device admits of bad physical eraseblocks or
  *               not
+ * @nor_flash: non-zero if working on top of NOR flash
  * @mtd: MTD device descriptor
  *
  * @peb_buf1: a buffer of PEB size used for different purposes
@@ -390,6 +392,7 @@ struct ubi_device {
         struct ubi_volume *volumes[UBI_MAX_VOLUMES+UBI_INT_VOL_COUNT];
         spinlock_t volumes_lock;
         int ref_count;
+        int image_seq;
 
         int rsvd_pebs;
         int avail_pebs;
@@ -452,7 +455,8 @@ struct ubi_device {
         int vid_hdr_offset;
         int vid_hdr_aloffset;
         int vid_hdr_shift;
-        int bad_allowed;
+        unsigned int bad_allowed:1;
+        unsigned int nor_flash:1;
         struct mtd_info *mtd;
 
         void *peb_buf1;
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 2b2472300610..600c7229d5cf 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -459,6 +459,14 @@ retry:
         dbg_wl("PEB %d EC %d", e->pnum, e->ec);
         prot_queue_add(ubi, e);
         spin_unlock(&ubi->wl_lock);
+
+        err = ubi_dbg_check_all_ff(ubi, e->pnum, ubi->vid_hdr_aloffset,
+                                   ubi->peb_size - ubi->vid_hdr_aloffset);
+        if (err) {
+                ubi_err("new PEB %d does not contain all 0xFF bytes", e->pnum);
+                return err > 0 ? -EINVAL : err;
+        }
+
         return e->pnum;
 }
 
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index 8ae72ec14456..0e2ba21d4441 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -908,6 +908,7 @@ static const struct net_device_ops rtl8139_netdev_ops = {
         .ndo_open               = rtl8139_open,
         .ndo_stop               = rtl8139_close,
         .ndo_get_stats          = rtl8139_get_stats,
+        .ndo_change_mtu         = eth_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = rtl8139_set_mac_address,
         .ndo_start_xmit         = rtl8139_start_xmit,
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index c155bd3ec9f1..b5a7513df4eb 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1729,6 +1729,12 @@ config KS8842
         help
           This platform driver is for Micrel KSZ8842 chip.
 
+config KS8851
+       tristate "Micrel KS8851 SPI"
+       depends on SPI
+       help
+         SPI driver for Micrel KS8851 SPI attached network chip.
+
 config VIA_RHINE
         tristate "VIA Rhine support"
         depends on NET_PCI && PCI
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 4b58a59f211b..ead8cab3cfe1 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -88,6 +88,7 @@ obj-$(CONFIG_SKGE) += skge.o
 obj-$(CONFIG_SKY2) += sky2.o
 obj-$(CONFIG_SKFP) += skfp/
 obj-$(CONFIG_KS8842)    += ks8842.o
+obj-$(CONFIG_KS8851)    += ks8851.o
 obj-$(CONFIG_VIA_RHINE) += via-rhine.o
 obj-$(CONFIG_VIA_VELOCITY) += via-velocity.o
 obj-$(CONFIG_ADAPTEC_STARFIRE) += starfire.o
diff --git a/drivers/net/arm/Kconfig b/drivers/net/arm/Kconfig
index 2895db13bfa4..c37ee9e6b67b 100644
--- a/drivers/net/arm/Kconfig
+++ b/drivers/net/arm/Kconfig
@@ -63,3 +63,11 @@ config IXP4XX_ETH
         help
           Say Y here if you want to use built-in Ethernet ports
           on IXP4xx processor.
+
+config W90P910_ETH
+        tristate "Nuvoton w90p910 Ethernet support"
+        depends on ARM && ARCH_W90X900
+        select PHYLIB
+        help
+          Say Y here if you want to use built-in Ethernet ports
+          on w90p910 processor.
diff --git a/drivers/net/arm/Makefile b/drivers/net/arm/Makefile
index 811a3ccd14c1..303171f589e6 100644
--- a/drivers/net/arm/Makefile
+++ b/drivers/net/arm/Makefile
@@ -11,3 +11,4 @@ obj-$(CONFIG_ARM_AT91_ETHER)	+= at91_ether.o
 obj-$(CONFIG_ARM_KS8695_ETHER)  += ks8695net.o
 obj-$(CONFIG_EP93XX_ETH)        += ep93xx_eth.o
 obj-$(CONFIG_IXP4XX_ETH)        += ixp4xx_eth.o
+obj-$(CONFIG_W90P910_ETH)       += w90p910_ether.o
diff --git a/drivers/net/arm/ixp4xx_eth.c b/drivers/net/arm/ixp4xx_eth.c
index 6f42ad728915..3fe09876e76d 100644
--- a/drivers/net/arm/ixp4xx_eth.c
+++ b/drivers/net/arm/ixp4xx_eth.c
@@ -1142,7 +1142,9 @@ static const struct net_device_ops ixp4xx_netdev_ops = {
         .ndo_start_xmit = eth_xmit,
         .ndo_set_multicast_list = eth_set_mcast_list,
         .ndo_do_ioctl = eth_ioctl,
-
+        .ndo_change_mtu = eth_change_mtu,
+        .ndo_set_mac_address = eth_mac_addr,
+        .ndo_validate_addr = eth_validate_addr,
 };
 
 static int __devinit eth_init_one(struct platform_device *pdev)
diff --git a/drivers/net/arm/w90p910_ether.c b/drivers/net/arm/w90p910_ether.c
new file mode 100644
index 000000000000..616fb7985a34
--- /dev/null
+++ b/drivers/net/arm/w90p910_ether.c
@@ -0,0 +1,1105 @@
+/*
+ * Copyright (c) 2008-2009 Nuvoton technology corporation.
+ *
+ * Wan ZongShun <mcuos.com@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation;version 2 of the License.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/mii.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/ethtool.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+
+#define DRV_MODULE_NAME         "w90p910-emc"
+#define DRV_MODULE_VERSION      "0.1"
+
+/* Ethernet MAC Registers */
+#define REG_CAMCMR              0x00
+#define REG_CAMEN               0x04
+#define REG_CAMM_BASE           0x08
+#define REG_CAML_BASE           0x0c
+#define REG_TXDLSA              0x88
+#define REG_RXDLSA              0x8C
+#define REG_MCMDR               0x90
+#define REG_MIID                0x94
+#define REG_MIIDA               0x98
+#define REG_FFTCR               0x9C
+#define REG_TSDR                0xa0
+#define REG_RSDR                0xa4
+#define REG_DMARFC              0xa8
+#define REG_MIEN                0xac
+#define REG_MISTA               0xb0
+#define REG_CTXDSA              0xcc
+#define REG_CTXBSA              0xd0
+#define REG_CRXDSA              0xd4
+#define REG_CRXBSA              0xd8
+
+/* mac controller bit */
+#define MCMDR_RXON              0x01
+#define MCMDR_ACP               (0x01 << 3)
+#define MCMDR_SPCRC             (0x01 << 5)
+#define MCMDR_TXON              (0x01 << 8)
+#define MCMDR_FDUP              (0x01 << 18)
+#define MCMDR_ENMDC             (0x01 << 19)
+#define MCMDR_OPMOD             (0x01 << 20)
+#define SWR                     (0x01 << 24)
+
+/* cam command regiser */
+#define CAMCMR_AUP              0x01
+#define CAMCMR_AMP              (0x01 << 1)
+#define CAMCMR_ABP              (0x01 << 2)
+#define CAMCMR_CCAM             (0x01 << 3)
+#define CAMCMR_ECMP             (0x01 << 4)
+#define CAM0EN                  0x01
+
+/* mac mii controller bit */
+#define MDCCR                   (0x0a << 20)
+#define PHYAD                   (0x01 << 8)
+#define PHYWR                   (0x01 << 16)
+#define PHYBUSY                 (0x01 << 17)
+#define PHYPRESP                (0x01 << 18)
+#define CAM_ENTRY_SIZE          0x08
+
+/* rx and tx status */
+#define TXDS_TXCP               (0x01 << 19)
+#define RXDS_CRCE               (0x01 << 17)
+#define RXDS_PTLE               (0x01 << 19)
+#define RXDS_RXGD               (0x01 << 20)
+#define RXDS_ALIE               (0x01 << 21)
+#define RXDS_RP                 (0x01 << 22)
+
+/* mac interrupt status*/
+#define MISTA_EXDEF             (0x01 << 19)
+#define MISTA_TXBERR            (0x01 << 24)
+#define MISTA_TDU               (0x01 << 23)
+#define MISTA_RDU               (0x01 << 10)
+#define MISTA_RXBERR            (0x01 << 11)
+
+#define ENSTART                 0x01
+#define ENRXINTR                0x01
+#define ENRXGD                  (0x01 << 4)
+#define ENRXBERR                (0x01 << 11)
+#define ENTXINTR                (0x01 << 16)
+#define ENTXCP                  (0x01 << 18)
+#define ENTXABT                 (0x01 << 21)
+#define ENTXBERR                (0x01 << 24)
+#define ENMDC                   (0x01 << 19)
+#define PHYBUSY                 (0x01 << 17)
+#define MDCCR_VAL               0xa00000
+
+/* rx and tx owner bit */
+#define RX_OWEN_DMA             (0x01 << 31)
+#define RX_OWEN_CPU             (~(0x03 << 30))
+#define TX_OWEN_DMA             (0x01 << 31)
+#define TX_OWEN_CPU             (~(0x01 << 31))
+
+/* tx frame desc controller bit */
+#define MACTXINTEN              0x04
+#define CRCMODE                 0x02
+#define PADDINGMODE             0x01
+
+/* fftcr controller bit */
+#define TXTHD                   (0x03 << 8)
+#define BLENGTH                 (0x01 << 20)
+
+/* global setting for driver */
+#define RX_DESC_SIZE            50
+#define TX_DESC_SIZE            10
+#define MAX_RBUFF_SZ            0x600
+#define MAX_TBUFF_SZ            0x600
+#define TX_TIMEOUT              50
+#define DELAY                   1000
+#define CAM0                    0x0
+
+static int w90p910_mdio_read(struct net_device *dev, int phy_id, int reg);
+
+struct w90p910_rxbd {
+        unsigned int sl;
+        unsigned int buffer;
+        unsigned int reserved;
+        unsigned int next;
+};
+
+struct w90p910_txbd {
+        unsigned int mode;
+        unsigned int buffer;
+        unsigned int sl;
+        unsigned int next;
+};
+
+struct recv_pdesc {
+        struct w90p910_rxbd desclist[RX_DESC_SIZE];
+        char recv_buf[RX_DESC_SIZE][MAX_RBUFF_SZ];
+};
+
+struct tran_pdesc {
+        struct w90p910_txbd desclist[TX_DESC_SIZE];
+        char tran_buf[RX_DESC_SIZE][MAX_TBUFF_SZ];
+};
+
+struct  w90p910_ether {
+        struct recv_pdesc *rdesc;
+        struct recv_pdesc *rdesc_phys;
+        struct tran_pdesc *tdesc;
+        struct tran_pdesc *tdesc_phys;
+        struct net_device_stats stats;
+        struct platform_device *pdev;
+        struct sk_buff *skb;
+        struct clk *clk;
+        struct clk *rmiiclk;
+        struct mii_if_info mii;
+        struct timer_list check_timer;
+        void __iomem *reg;
+        unsigned int rxirq;
+        unsigned int txirq;
+        unsigned int cur_tx;
+        unsigned int cur_rx;
+        unsigned int finish_tx;
+        unsigned int rx_packets;
+        unsigned int rx_bytes;
+        unsigned int start_tx_ptr;
+        unsigned int start_rx_ptr;
+        unsigned int linkflag;
+        spinlock_t lock;
+};
+
+static void update_linkspeed_register(struct net_device *dev,
+                                unsigned int speed, unsigned int duplex)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+
+        if (speed == SPEED_100) {
+                /* 100 full/half duplex */
+                if (duplex == DUPLEX_FULL) {
+                        val |= (MCMDR_OPMOD | MCMDR_FDUP);
+                } else {
+                        val |= MCMDR_OPMOD;
+                        val &= ~MCMDR_FDUP;
+                }
+        } else {
+                /* 10 full/half duplex */
+                if (duplex == DUPLEX_FULL) {
+                        val |= MCMDR_FDUP;
+                        val &= ~MCMDR_OPMOD;
+                } else {
+                        val &= ~(MCMDR_FDUP | MCMDR_OPMOD);
+                }
+        }
+
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void update_linkspeed(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct platform_device *pdev;
+        unsigned int bmsr, bmcr, lpa, speed, duplex;
+
+        pdev = ether->pdev;
+
+        if (!mii_link_ok(&ether->mii)) {
+                ether->linkflag = 0x0;
+                netif_carrier_off(dev);
+                dev_warn(&pdev->dev, "%s: Link down.\n", dev->name);
+                return;
+        }
+
+        if (ether->linkflag == 1)
+                return;
+
+        bmsr = w90p910_mdio_read(dev, ether->mii.phy_id, MII_BMSR);
+        bmcr = w90p910_mdio_read(dev, ether->mii.phy_id, MII_BMCR);
+
+        if (bmcr & BMCR_ANENABLE) {
+                if (!(bmsr & BMSR_ANEGCOMPLETE))
+                        return;
+
+                lpa = w90p910_mdio_read(dev, ether->mii.phy_id, MII_LPA);
+
+                if ((lpa & LPA_100FULL) || (lpa & LPA_100HALF))
+                        speed = SPEED_100;
+                else
+                        speed = SPEED_10;
+
+                if ((lpa & LPA_100FULL) || (lpa & LPA_10FULL))
+                        duplex = DUPLEX_FULL;
+                else
+                        duplex = DUPLEX_HALF;
+
+        } else {
+                speed = (bmcr & BMCR_SPEED100) ? SPEED_100 : SPEED_10;
+                duplex = (bmcr & BMCR_FULLDPLX) ? DUPLEX_FULL : DUPLEX_HALF;
+        }
+
+        update_linkspeed_register(dev, speed, duplex);
+
+        dev_info(&pdev->dev, "%s: Link now %i-%s\n", dev->name, speed,
+                        (duplex == DUPLEX_FULL) ? "FullDuplex" : "HalfDuplex");
+        ether->linkflag = 0x01;
+
+        netif_carrier_on(dev);
+}
+
+static void w90p910_check_link(unsigned long dev_id)
+{
+        struct net_device *dev = (struct net_device *) dev_id;
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        update_linkspeed(dev);
+        mod_timer(&ether->check_timer, jiffies + msecs_to_jiffies(1000));
+}
+
+static void w90p910_write_cam(struct net_device *dev,
+                                unsigned int x, unsigned char *pval)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int msw, lsw;
+
+        msw = (pval[0] << 24) | (pval[1] << 16) | (pval[2] << 8) | pval[3];
+
+        lsw = (pval[4] << 24) | (pval[5] << 16);
+
+        __raw_writel(lsw, ether->reg + REG_CAML_BASE + x * CAM_ENTRY_SIZE);
+        __raw_writel(msw, ether->reg + REG_CAMM_BASE + x * CAM_ENTRY_SIZE);
+}
+
+static void w90p910_init_desc(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+        struct w90p910_txbd  *tdesc, *tdesc_phys;
+        struct w90p910_rxbd  *rdesc, *rdesc_phys;
+        unsigned int i, j;
+
+        ether = netdev_priv(dev);
+
+        ether->tdesc = (struct tran_pdesc *)
+                        dma_alloc_coherent(NULL, sizeof(struct tran_pdesc),
+                                (dma_addr_t *) &ether->tdesc_phys, GFP_KERNEL);
+
+        ether->rdesc = (struct recv_pdesc *)
+                        dma_alloc_coherent(NULL, sizeof(struct recv_pdesc),
+                                (dma_addr_t *) &ether->rdesc_phys, GFP_KERNEL);
+
+        for (i = 0; i < TX_DESC_SIZE; i++) {
+                tdesc = &(ether->tdesc->desclist[i]);
+
+                j = ((i + 1) / TX_DESC_SIZE);
+
+                if (j != 0) {
+                        tdesc_phys = &(ether->tdesc_phys->desclist[0]);
+                        ether->start_tx_ptr = (unsigned int)tdesc_phys;
+                        tdesc->next = (unsigned int)ether->start_tx_ptr;
+                } else {
+                        tdesc_phys = &(ether->tdesc_phys->desclist[i+1]);
+                        tdesc->next = (unsigned int)tdesc_phys;
+                }
+
+                tdesc->buffer = (unsigned int)ether->tdesc_phys->tran_buf[i];
+                tdesc->sl = 0;
+                tdesc->mode = 0;
+        }
+
+        for (i = 0; i < RX_DESC_SIZE; i++) {
+                rdesc = &(ether->rdesc->desclist[i]);
+
+                j = ((i + 1) / RX_DESC_SIZE);
+
+                if (j != 0) {
+                        rdesc_phys = &(ether->rdesc_phys->desclist[0]);
+                        ether->start_rx_ptr = (unsigned int)rdesc_phys;
+                        rdesc->next = (unsigned int)ether->start_rx_ptr;
+                } else {
+                        rdesc_phys = &(ether->rdesc_phys->desclist[i+1]);
+                        rdesc->next = (unsigned int)rdesc_phys;
+                }
+
+                rdesc->sl = RX_OWEN_DMA;
+                rdesc->buffer = (unsigned int)ether->rdesc_phys->recv_buf[i];
+          }
+}
+
+static void w90p910_set_fifo_threshold(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = TXTHD | BLENGTH;
+        __raw_writel(val, ether->reg + REG_FFTCR);
+}
+
+static void w90p910_return_default_idle(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+        val |= SWR;
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void w90p910_trigger_rx(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        __raw_writel(ENSTART, ether->reg + REG_RSDR);
+}
+
+static void w90p910_trigger_tx(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        __raw_writel(ENSTART, ether->reg + REG_TSDR);
+}
+
+static void w90p910_enable_mac_interrupt(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = ENTXINTR | ENRXINTR | ENRXGD | ENTXCP;
+        val |= ENTXBERR | ENRXBERR | ENTXABT;
+
+        __raw_writel(val, ether->reg + REG_MIEN);
+}
+
+static void w90p910_get_and_clear_int(struct net_device *dev,
+                                                        unsigned int *val)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        *val = __raw_readl(ether->reg + REG_MISTA);
+        __raw_writel(*val, ether->reg + REG_MISTA);
+}
+
+static void w90p910_set_global_maccmd(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+        val |= MCMDR_SPCRC | MCMDR_ENMDC | MCMDR_ACP | ENMDC;
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void w90p910_enable_cam(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        w90p910_write_cam(dev, CAM0, dev->dev_addr);
+
+        val = __raw_readl(ether->reg + REG_CAMEN);
+        val |= CAM0EN;
+        __raw_writel(val, ether->reg + REG_CAMEN);
+}
+
+static void w90p910_enable_cam_command(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = CAMCMR_ECMP | CAMCMR_ABP | CAMCMR_AMP;
+        __raw_writel(val, ether->reg + REG_CAMCMR);
+}
+
+static void w90p910_enable_tx(struct net_device *dev, unsigned int enable)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+
+        if (enable)
+                val |= MCMDR_TXON;
+        else
+                val &= ~MCMDR_TXON;
+
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void w90p910_enable_rx(struct net_device *dev, unsigned int enable)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+
+        if (enable)
+                val |= MCMDR_RXON;
+        else
+                val &= ~MCMDR_RXON;
+
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void w90p910_set_curdest(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        __raw_writel(ether->start_rx_ptr, ether->reg + REG_RXDLSA);
+        __raw_writel(ether->start_tx_ptr, ether->reg + REG_TXDLSA);
+}
+
+static void w90p910_reset_mac(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        spin_lock(&ether->lock);
+
+        w90p910_enable_tx(dev, 0);
+        w90p910_enable_rx(dev, 0);
+        w90p910_set_fifo_threshold(dev);
+        w90p910_return_default_idle(dev);
+
+        if (!netif_queue_stopped(dev))
+                netif_stop_queue(dev);
+
+        w90p910_init_desc(dev);
+
+        dev->trans_start = jiffies;
+        ether->cur_tx = 0x0;
+        ether->finish_tx = 0x0;
+        ether->cur_rx = 0x0;
+
+        w90p910_set_curdest(dev);
+        w90p910_enable_cam(dev);
+        w90p910_enable_cam_command(dev);
+        w90p910_enable_mac_interrupt(dev);
+        w90p910_enable_tx(dev, 1);
+        w90p910_enable_rx(dev, 1);
+        w90p910_trigger_tx(dev);
+        w90p910_trigger_rx(dev);
+
+        dev->trans_start = jiffies;
+
+        if (netif_queue_stopped(dev))
+                netif_wake_queue(dev);
+
+        spin_unlock(&ether->lock);
+}
+
+static void w90p910_mdio_write(struct net_device *dev,
+                                        int phy_id, int reg, int data)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct platform_device *pdev;
+        unsigned int val, i;
+
+        pdev = ether->pdev;
+
+        __raw_writel(data, ether->reg + REG_MIID);
+
+        val = (phy_id << 0x08) | reg;
+        val |= PHYBUSY | PHYWR | MDCCR_VAL;
+        __raw_writel(val, ether->reg + REG_MIIDA);
+
+        for (i = 0; i < DELAY; i++) {
+                if ((__raw_readl(ether->reg + REG_MIIDA) & PHYBUSY) == 0)
+                        break;
+        }
+
+        if (i == DELAY)
+                dev_warn(&pdev->dev, "mdio write timed out\n");
+}
+
+static int w90p910_mdio_read(struct net_device *dev, int phy_id, int reg)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct platform_device *pdev;
+        unsigned int val, i, data;
+
+        pdev = ether->pdev;
+
+        val = (phy_id << 0x08) | reg;
+        val |= PHYBUSY | MDCCR_VAL;
+        __raw_writel(val, ether->reg + REG_MIIDA);
+
+        for (i = 0; i < DELAY; i++) {
+                if ((__raw_readl(ether->reg + REG_MIIDA) & PHYBUSY) == 0)
+                        break;
+        }
+
+        if (i == DELAY) {
+                dev_warn(&pdev->dev, "mdio read timed out\n");
+                data = 0xffff;
+        } else {
+                data = __raw_readl(ether->reg + REG_MIID);
+        }
+
+        return data;
+}
+
+static int set_mac_address(struct net_device *dev, void *addr)
+{
+        struct sockaddr *address = addr;
+
+        if (!is_valid_ether_addr(address->sa_data))
+                return -EADDRNOTAVAIL;
+
+        memcpy(dev->dev_addr, address->sa_data, dev->addr_len);
+        w90p910_write_cam(dev, CAM0, dev->dev_addr);
+
+        return 0;
+}
+
+static int w90p910_ether_close(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        dma_free_writecombine(NULL, sizeof(struct w90p910_rxbd),
+                                ether->rdesc, (dma_addr_t)ether->rdesc_phys);
+        dma_free_writecombine(NULL, sizeof(struct w90p910_txbd),
+                                ether->tdesc, (dma_addr_t)ether->tdesc_phys);
+
+        netif_stop_queue(dev);
+
+        del_timer_sync(&ether->check_timer);
+        clk_disable(ether->rmiiclk);
+        clk_disable(ether->clk);
+
+        free_irq(ether->txirq, dev);
+        free_irq(ether->rxirq, dev);
+
+        return 0;
+}
+
+static struct net_device_stats *w90p910_ether_stats(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+
+        ether = netdev_priv(dev);
+
+        return &ether->stats;
+}
+
+static int w90p910_send_frame(struct net_device *dev,
+                                        unsigned char *data, int length)
+{
+        struct w90p910_ether *ether;
+        struct w90p910_txbd *txbd;
+        struct platform_device *pdev;
+        unsigned char *buffer;
+
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+
+        txbd = &ether->tdesc->desclist[ether->cur_tx];
+        buffer = ether->tdesc->tran_buf[ether->cur_tx];
+        if (length > 1514) {
+                dev_err(&pdev->dev, "send data %d bytes, check it\n", length);
+                length = 1514;
+        }
+
+        txbd->sl = length & 0xFFFF;
+
+        memcpy(buffer, data, length);
+
+        txbd->mode = TX_OWEN_DMA | PADDINGMODE | CRCMODE | MACTXINTEN;
+
+        w90p910_enable_tx(dev, 1);
+
+        w90p910_trigger_tx(dev);
+
+        ether->cur_tx = (ether->cur_tx+1) % TX_DESC_SIZE;
+        txbd = &ether->tdesc->desclist[ether->cur_tx];
+
+        dev->trans_start = jiffies;
+
+        if (txbd->mode & TX_OWEN_DMA)
+                netif_stop_queue(dev);
+
+        return 0;
+}
+
+static int w90p910_ether_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        if (!(w90p910_send_frame(dev, skb->data, skb->len))) {
+                ether->skb = skb;
+                dev_kfree_skb_irq(skb);
+                return 0;
+        }
+        return -1;
+}
+
+static irqreturn_t w90p910_tx_interrupt(int irq, void *dev_id)
+{
+        struct w90p910_ether *ether;
+        struct w90p910_txbd  *txbd;
+        struct platform_device *pdev;
+        struct tran_pdesc *tran_pdesc;
+        struct net_device *dev;
+        unsigned int cur_entry, entry, status;
+
+        dev = (struct net_device *)dev_id;
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+
+        spin_lock(&ether->lock);
+
+        w90p910_get_and_clear_int(dev, &status);
+
+        cur_entry = __raw_readl(ether->reg + REG_CTXDSA);
+
+        tran_pdesc = ether->tdesc_phys;
+        entry = (unsigned int)(&tran_pdesc->desclist[ether->finish_tx]);
+
+        while (entry != cur_entry) {
+                txbd = &ether->tdesc->desclist[ether->finish_tx];
+
+                ether->finish_tx = (ether->finish_tx + 1) % TX_DESC_SIZE;
+
+                if (txbd->sl & TXDS_TXCP) {
+                        ether->stats.tx_packets++;
+                        ether->stats.tx_bytes += txbd->sl & 0xFFFF;
+                } else {
+                        ether->stats.tx_errors++;
+                }
+
+                txbd->sl = 0x0;
+                txbd->mode = 0x0;
+
+                if (netif_queue_stopped(dev))
+                        netif_wake_queue(dev);
+
+                entry = (unsigned int)(&tran_pdesc->desclist[ether->finish_tx]);
+        }
+
+        if (status & MISTA_EXDEF) {
+                dev_err(&pdev->dev, "emc defer exceed interrupt\n");
+        } else if (status & MISTA_TXBERR) {
+                        dev_err(&pdev->dev, "emc bus error interrupt\n");
+                        w90p910_reset_mac(dev);
+                } else if (status & MISTA_TDU) {
+                                if (netif_queue_stopped(dev))
+                                        netif_wake_queue(dev);
+                        }
+
+        spin_unlock(&ether->lock);
+
+        return IRQ_HANDLED;
+}
+
+static void netdev_rx(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+        struct w90p910_rxbd *rxbd;
+        struct platform_device *pdev;
+        struct recv_pdesc *rdesc_phys;
+        struct sk_buff *skb;
+        unsigned char *data;
+        unsigned int length, status, val, entry;
+
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+        rdesc_phys = ether->rdesc_phys;
+
+        rxbd = &ether->rdesc->desclist[ether->cur_rx];
+
+        do {
+                val = __raw_readl(ether->reg + REG_CRXDSA);
+                entry = (unsigned int)&rdesc_phys->desclist[ether->cur_rx];
+
+                if (val == entry)
+                        break;
+
+                status = rxbd->sl;
+                length = status & 0xFFFF;
+
+                if (status & RXDS_RXGD) {
+                        data = ether->rdesc->recv_buf[ether->cur_rx];
+                        skb = dev_alloc_skb(length+2);
+                        if (!skb) {
+                                dev_err(&pdev->dev, "get skb buffer error\n");
+                                ether->stats.rx_dropped++;
+                                return;
+                        }
+
+                        skb->dev = dev;
+                        skb_reserve(skb, 2);
+                        skb_put(skb, length);
+                        skb_copy_to_linear_data(skb, data, length);
+                        skb->protocol = eth_type_trans(skb, dev);
+                        ether->stats.rx_packets++;
+                        ether->stats.rx_bytes += length;
+                        netif_rx(skb);
+                } else {
+                        ether->stats.rx_errors++;
+
+                        if (status & RXDS_RP) {
+                                dev_err(&pdev->dev, "rx runt err\n");
+                                ether->stats.rx_length_errors++;
+                        } else if (status & RXDS_CRCE) {
+                                        dev_err(&pdev->dev, "rx crc err\n");
+                                        ether->stats.rx_crc_errors++;
+                                }
+
+                        if (status & RXDS_ALIE) {
+                                dev_err(&pdev->dev, "rx aligment err\n");
+                                ether->stats.rx_frame_errors++;
+                        } else if (status & RXDS_PTLE) {
+                                        dev_err(&pdev->dev, "rx longer err\n");
+                                        ether->stats.rx_over_errors++;
+                                }
+                        }
+
+                rxbd->sl = RX_OWEN_DMA;
+                rxbd->reserved = 0x0;
+                ether->cur_rx = (ether->cur_rx+1) % RX_DESC_SIZE;
+                rxbd = &ether->rdesc->desclist[ether->cur_rx];
+
+                dev->last_rx = jiffies;
+        } while (1);
+}
+
+static irqreturn_t w90p910_rx_interrupt(int irq, void *dev_id)
+{
+        struct net_device *dev;
+        struct w90p910_ether  *ether;
+        struct platform_device *pdev;
+        unsigned int status;
+
+        dev = (struct net_device *)dev_id;
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+
+        spin_lock(&ether->lock);
+
+        w90p910_get_and_clear_int(dev, &status);
+
+        if (status & MISTA_RDU) {
+                netdev_rx(dev);
+
+                w90p910_trigger_rx(dev);
+
+                spin_unlock(&ether->lock);
+                return IRQ_HANDLED;
+        } else if (status & MISTA_RXBERR) {
+                        dev_err(&pdev->dev, "emc rx bus error\n");
+                        w90p910_reset_mac(dev);
+                }
+
+        netdev_rx(dev);
+        spin_unlock(&ether->lock);
+        return IRQ_HANDLED;
+}
+
+static int w90p910_ether_open(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+        struct platform_device *pdev;
+
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+
+        w90p910_reset_mac(dev);
+        w90p910_set_fifo_threshold(dev);
+        w90p910_set_curdest(dev);
+        w90p910_enable_cam(dev);
+        w90p910_enable_cam_command(dev);
+        w90p910_enable_mac_interrupt(dev);
+        w90p910_set_global_maccmd(dev);
+        w90p910_enable_rx(dev, 1);
+
+        ether->rx_packets = 0x0;
+        ether->rx_bytes = 0x0;
+
+        if (request_irq(ether->txirq, w90p910_tx_interrupt,
+                                                0x0, pdev->name, dev)) {
+                dev_err(&pdev->dev, "register irq tx failed\n");
+                return -EAGAIN;
+        }
+
+        if (request_irq(ether->rxirq, w90p910_rx_interrupt,
+                                                0x0, pdev->name, dev)) {
+                dev_err(&pdev->dev, "register irq rx failed\n");
+                return -EAGAIN;
+        }
+
+        mod_timer(&ether->check_timer, jiffies + msecs_to_jiffies(1000));
+        netif_start_queue(dev);
+        w90p910_trigger_rx(dev);
+
+        dev_info(&pdev->dev, "%s is OPENED\n", dev->name);
+
+        return 0;
+}
+
+static void w90p910_ether_set_multicast_list(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+        unsigned int rx_mode;
+
+        ether = netdev_priv(dev);
+
+        if (dev->flags & IFF_PROMISC)
+                rx_mode = CAMCMR_AUP | CAMCMR_AMP | CAMCMR_ABP | CAMCMR_ECMP;
+        else if ((dev->flags & IFF_ALLMULTI) || dev->mc_list)
+                        rx_mode = CAMCMR_AMP | CAMCMR_ABP | CAMCMR_ECMP;
+                else
+                                rx_mode = CAMCMR_ECMP | CAMCMR_ABP;
+        __raw_writel(rx_mode, ether->reg + REG_CAMCMR);
+}
+
+static int w90p910_ether_ioctl(struct net_device *dev,
+                                                struct ifreq *ifr, int cmd)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct mii_ioctl_data *data = if_mii(ifr);
+
+        return generic_mii_ioctl(&ether->mii, data, cmd, NULL);
+}
+
+static void w90p910_get_drvinfo(struct net_device *dev,
+                                        struct ethtool_drvinfo *info)
+{
+        strcpy(info->driver, DRV_MODULE_NAME);
+        strcpy(info->version, DRV_MODULE_VERSION);
+}
+
+static int w90p910_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        return mii_ethtool_gset(&ether->mii, cmd);
+}
+
+static int w90p910_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        return mii_ethtool_sset(&ether->mii, cmd);
+}
+
+static int w90p910_nway_reset(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        return mii_nway_restart(&ether->mii);
+}
+
+static u32 w90p910_get_link(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        return mii_link_ok(&ether->mii);
+}
+
+static const struct ethtool_ops w90p910_ether_ethtool_ops = {
+        .get_settings   = w90p910_get_settings,
+        .set_settings   = w90p910_set_settings,
+        .get_drvinfo    = w90p910_get_drvinfo,
+        .nway_reset     = w90p910_nway_reset,
+        .get_link       = w90p910_get_link,
+};
+
+static const struct net_device_ops w90p910_ether_netdev_ops = {
+        .ndo_open               = w90p910_ether_open,
+        .ndo_stop               = w90p910_ether_close,
+        .ndo_start_xmit         = w90p910_ether_start_xmit,
+        .ndo_get_stats          = w90p910_ether_stats,
+        .ndo_set_multicast_list = w90p910_ether_set_multicast_list,
+        .ndo_set_mac_address    = set_mac_address,
+        .ndo_do_ioctl           = w90p910_ether_ioctl,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_change_mtu         = eth_change_mtu,
+};
+
+static void __init get_mac_address(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct platform_device *pdev;
+        char addr[6];
+
+        pdev = ether->pdev;
+
+        addr[0] = 0x00;
+        addr[1] = 0x02;
+        addr[2] = 0xac;
+        addr[3] = 0x55;
+        addr[4] = 0x88;
+        addr[5] = 0xa8;
+
+        if (is_valid_ether_addr(addr))
+                memcpy(dev->dev_addr, &addr, 0x06);
+        else
+                dev_err(&pdev->dev, "invalid mac address\n");
+}
+
+static int w90p910_ether_setup(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        ether_setup(dev);
+        dev->netdev_ops = &w90p910_ether_netdev_ops;
+        dev->ethtool_ops = &w90p910_ether_ethtool_ops;
+
+        dev->tx_queue_len = 16;
+        dev->dma = 0x0;
+        dev->watchdog_timeo = TX_TIMEOUT;
+
+        get_mac_address(dev);
+
+        spin_lock_init(&ether->lock);
+
+        ether->cur_tx = 0x0;
+        ether->cur_rx = 0x0;
+        ether->finish_tx = 0x0;
+        ether->linkflag = 0x0;
+        ether->mii.phy_id = 0x01;
+        ether->mii.phy_id_mask = 0x1f;
+        ether->mii.reg_num_mask = 0x1f;
+        ether->mii.dev = dev;
+        ether->mii.mdio_read = w90p910_mdio_read;
+        ether->mii.mdio_write = w90p910_mdio_write;
+
+        setup_timer(&ether->check_timer, w90p910_check_link,
+                                                (unsigned long)dev);
+
+        return 0;
+}
+
+static int __devinit w90p910_ether_probe(struct platform_device *pdev)
+{
+        struct w90p910_ether *ether;
+        struct net_device *dev;
+        struct resource *res;
+        int error;
+
+        dev = alloc_etherdev(sizeof(struct w90p910_ether));
+        if (!dev)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (res == NULL) {
+                dev_err(&pdev->dev, "failed to get I/O memory\n");
+                error = -ENXIO;
+                goto failed_free;
+        }
+
+        res = request_mem_region(res->start, resource_size(res), pdev->name);
+        if (res == NULL) {
+                dev_err(&pdev->dev, "failed to request I/O memory\n");
+                error = -EBUSY;
+                goto failed_free;
+        }
+
+        ether = netdev_priv(dev);
+
+        ether->reg = ioremap(res->start, resource_size(res));
+        if (ether->reg == NULL) {
+                dev_err(&pdev->dev, "failed to remap I/O memory\n");
+                error = -ENXIO;
+                goto failed_free_mem;
+        }
+
+        ether->txirq = platform_get_irq(pdev, 0);
+        if (ether->txirq < 0) {
+                dev_err(&pdev->dev, "failed to get ether tx irq\n");
+                error = -ENXIO;
+                goto failed_free_io;
+        }
+
+        ether->rxirq = platform_get_irq(pdev, 1);
+        if (ether->rxirq < 0) {
+                dev_err(&pdev->dev, "failed to get ether rx irq\n");
+                error = -ENXIO;
+                goto failed_free_txirq;
+        }
+
+        platform_set_drvdata(pdev, dev);
+
+        ether->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(ether->clk)) {
+                dev_err(&pdev->dev, "failed to get ether clock\n");
+                error = PTR_ERR(ether->clk);
+                goto failed_free_rxirq;
+        }
+
+        ether->rmiiclk = clk_get(&pdev->dev, "RMII");
+        if (IS_ERR(ether->rmiiclk)) {
+                dev_err(&pdev->dev, "failed to get ether clock\n");
+                error = PTR_ERR(ether->rmiiclk);
+                goto failed_put_clk;
+        }
+
+        ether->pdev = pdev;
+
+        w90p910_ether_setup(dev);
+
+        error = register_netdev(dev);
+        if (error != 0) {
+                dev_err(&pdev->dev, "Regiter EMC w90p910 FAILED\n");
+                error = -ENODEV;
+                goto failed_put_rmiiclk;
+        }
+
+        return 0;
+failed_put_rmiiclk:
+        clk_put(ether->rmiiclk);
+failed_put_clk:
+        clk_put(ether->clk);
+failed_free_rxirq:
+        free_irq(ether->rxirq, pdev);
+        platform_set_drvdata(pdev, NULL);
+failed_free_txirq:
+        free_irq(ether->txirq, pdev);
+failed_free_io:
+        iounmap(ether->reg);
+failed_free_mem:
+        release_mem_region(res->start, resource_size(res));
+failed_free:
+        free_netdev(dev);
+        return error;
+}
+
+static int __devexit w90p910_ether_remove(struct platform_device *pdev)
+{
+        struct net_device *dev = platform_get_drvdata(pdev);
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        unregister_netdev(dev);
+        clk_put(ether->rmiiclk);
+        clk_put(ether->clk);
+        del_timer_sync(&ether->check_timer);
+        platform_set_drvdata(pdev, NULL);
+        free_netdev(dev);
+        return 0;
+}
+
+static struct platform_driver w90p910_ether_driver = {
+        .probe          = w90p910_ether_probe,
+        .remove         = __devexit_p(w90p910_ether_remove),
+        .driver         = {
+                .name   = "w90p910-emc",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init w90p910_ether_init(void)
+{
+        return platform_driver_register(&w90p910_ether_driver);
+}
+
+static void __exit w90p910_ether_exit(void)
+{
+        platform_driver_unregister(&w90p910_ether_driver);
+}
+
+module_init(w90p910_ether_init);
+module_exit(w90p910_ether_exit);
+
+MODULE_AUTHOR("Wan ZongShun <mcuos.com@gmail.com>");
+MODULE_DESCRIPTION("w90p910 MAC driver!");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:w90p910-emc");
+
diff --git a/drivers/net/atl1c/atl1c.h b/drivers/net/atl1c/atl1c.h
index e1658ef3fcdf..2a1120ad2e74 100644
--- a/drivers/net/atl1c/atl1c.h
+++ b/drivers/net/atl1c/atl1c.h
@@ -188,14 +188,14 @@ struct atl1c_tpd_ext_desc {
 #define RRS_HDS_TYPE_DATA       2
 
 #define RRS_IS_NO_HDS_TYPE(flag) \
-        (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == 0)
+        ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == 0)
 
 #define RRS_IS_HDS_HEAD(flag) \
-        (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == \
+        ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == \
                         RRS_HDS_TYPE_HEAD)
 
 #define RRS_IS_HDS_DATA(flag) \
-        (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == \
+        ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == \
                         RRS_HDS_TYPE_DATA)
 
 /* rrs word 3 bit 0:31 */
@@ -245,7 +245,7 @@ struct atl1c_tpd_ext_desc {
 #define RRS_PACKET_TYPE_802_3   1
 #define RRS_PACKET_TYPE_ETH     0
 #define RRS_PACKET_IS_ETH(word) \
-        (((word) >> RRS_PACKET_TYPE_SHIFT) & RRS_PACKET_TYPE_MASK == \
+        ((((word) >> RRS_PACKET_TYPE_SHIFT) & RRS_PACKET_TYPE_MASK) == \
                         RRS_PACKET_TYPE_ETH)
 #define RRS_RXD_IS_VALID(word) \
         ((((word) >> RRS_RXD_UPDATED_SHIFT) & RRS_RXD_UPDATED_MASK) == 1)
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index cd547a205fb9..a383122679de 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -1689,7 +1689,7 @@ static void atl1c_clean_rx_irq(struct atl1c_adapter *adapter, u8 que,
                 if (likely(RRS_RXD_IS_VALID(rrs->word3))) {
                         rfd_num = (rrs->word0 >> RRS_RX_RFD_CNT_SHIFT) &
                                 RRS_RX_RFD_CNT_MASK;
-                        if (unlikely(rfd_num) != 1)
+                        if (unlikely(rfd_num != 1))
                                 /* TODO support mul rfd*/
                                 if (netif_msg_rx_err(adapter))
                                         dev_warn(&pdev->dev,
diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
index c734b1983ec1..204db961029e 100644
--- a/drivers/net/atlx/atl2.c
+++ b/drivers/net/atlx/atl2.c
@@ -2071,7 +2071,7 @@ static int atl2_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & (WAKE_ARP | WAKE_MAGICSECURE))
                 return -EOPNOTSUPP;
 
-        if (wol->wolopts & (WAKE_MCAST|WAKE_BCAST|WAKE_MCAST))
+        if (wol->wolopts & (WAKE_UCAST | WAKE_BCAST | WAKE_MCAST))
                 return -EOPNOTSUPP;
 
         /* these settings will always override what we currently have */
diff --git a/drivers/net/bnx2x_link.c b/drivers/net/bnx2x_link.c
index ed648acef7cf..2ee581a2cdec 100644
--- a/drivers/net/bnx2x_link.c
+++ b/drivers/net/bnx2x_link.c
@@ -4212,13 +4212,14 @@ static void bnx2x_turn_off_sf(struct bnx2x *bp, u8 port)
 u8 bnx2x_get_ext_phy_fw_version(struct link_params *params, u8 driver_loaded,
                               u8 *version, u16 len)
 {
-        struct bnx2x *bp = params->bp;
+        struct bnx2x *bp;
         u32 ext_phy_type = 0;
         u32 spirom_ver = 0;
         u8 status = 0 ;
 
         if (version == NULL || params == NULL)
                 return -EINVAL;
+        bp = params->bp;
 
         spirom_ver = REG_RD(bp, params->shmem_base +
                    offsetof(struct shmem_region,
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index d927f71af8a3..aa1be1feceed 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1459,8 +1459,16 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
          * ether type (eg ARPHRD_ETHER and ARPHRD_INFINIBAND) share the same bond
          */
         if (bond->slave_cnt == 0) {
-                if (slave_dev->type != ARPHRD_ETHER)
-                        bond_setup_by_slave(bond_dev, slave_dev);
+                if (bond_dev->type != slave_dev->type) {
+                        dev_close(bond_dev);
+                        pr_debug("%s: change device type from %d to %d\n",
+                                bond_dev->name, bond_dev->type, slave_dev->type);
+                        if (slave_dev->type != ARPHRD_ETHER)
+                                bond_setup_by_slave(bond_dev, slave_dev);
+                        else
+                                ether_setup(bond_dev);
+                        dev_open(bond_dev);
+                }
         } else if (bond_dev->type != slave_dev->type) {
                 pr_err(DRV_NAME ": %s ether type (%d) is different "
                         "from other slaves (%d), can not enslave it.\n",
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 574daddc21bf..9e4283aff828 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -346,7 +346,7 @@ void can_restart(unsigned long data)
         skb = dev_alloc_skb(sizeof(struct can_frame));
         if (skb == NULL) {
                 err = -ENOMEM;
-                goto out;
+                goto restart;
         }
         skb->dev = dev;
         skb->protocol = htons(ETH_P_CAN);
@@ -361,13 +361,13 @@ void can_restart(unsigned long data)
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
 
+restart:
         dev_dbg(dev->dev.parent, "restarted\n");
         priv->can_stats.restarts++;
 
         /* Now restart the device */
         err = priv->do_set_mode(dev, CAN_MODE_START);
 
-out:
         netif_carrier_on(dev);
         if (err)
                 dev_err(dev->dev.parent, "Error %d during restart", err);
@@ -473,6 +473,10 @@ int open_candev(struct net_device *dev)
                 return -EINVAL;
         }
 
+        /* Switch carrier on if device was stopped while in bus-off state */
+        if (!netif_carrier_ok(dev))
+                netif_carrier_on(dev);
+
         setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
 
         return 0;
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 571f133a8fec..08ebee79d8a6 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -63,7 +63,6 @@
 #include <linux/can.h>
 #include <linux/can/dev.h>
 #include <linux/can/error.h>
-#include <linux/can/dev.h>
 
 #include "sja1000.h"
 
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index 3eee666a9cd2..55445f980f9c 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -1524,6 +1524,7 @@ static void net_timeout(struct net_device *dev)
 static int net_send_packet(struct sk_buff *skb, struct net_device *dev)
 {
         struct net_local *lp = netdev_priv(dev);
+        unsigned long flags;
 
         if (net_debug > 3) {
                 printk("%s: sent %d byte packet of type %x\n",
@@ -1535,7 +1536,7 @@ static int net_send_packet(struct sk_buff *skb, struct net_device *dev)
                   ask the chip to start transmitting before the
                   whole packet has been completely uploaded. */
 
-        spin_lock_irq(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
         netif_stop_queue(dev);
 
         /* initiate a transmit sequence */
@@ -1549,13 +1550,13 @@ static int net_send_packet(struct sk_buff *skb, struct net_device *dev)
                  * we're waiting for TxOk, so return 1 and requeue this packet.
                  */
 
-                spin_unlock_irq(&lp->lock);
+                spin_unlock_irqrestore(&lp->lock, flags);
                 if (net_debug) printk("cs89x0: Tx buffer not free!\n");
                 return NETDEV_TX_BUSY;
         }
         /* Write the contents of the packet */
         writewords(dev->base_addr, TX_FRAME_PORT,skb->data,(skb->len+1) >>1);
-        spin_unlock_irq(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
         lp->stats.tx_bytes += skb->len;
         dev->trans_start = jiffies;
         dev_kfree_skb (skb);
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index efa680f4b8dd..41b648a67fec 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1897,6 +1897,9 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
 
                         if (ioread8(&nic->csr->scb.status) & rus_no_res)
                                 nic->ru_running = RU_SUSPENDED;
+                pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
+                                               sizeof(struct rfd),
+                                               PCI_DMA_BIDIRECTIONAL);
                 return -ENODATA;
         }
 
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 147c4b088fb3..e8d46cc1bec2 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -3080,7 +3080,9 @@ static const struct net_device_ops ehea_netdev_ops = {
         .ndo_poll_controller    = ehea_netpoll,
 #endif
         .ndo_get_stats          = ehea_get_stats,
+        .ndo_change_mtu         = eth_change_mtu,
         .ndo_set_mac_address    = ehea_set_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_multicast_list = ehea_set_multicast_list,
         .ndo_change_mtu         = ehea_change_mtu,
         .ndo_vlan_rx_register   = ehea_vlan_rx_register,
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 0f19b743749b..d4b98074b1b7 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1642,6 +1642,7 @@ static const struct net_device_ops fec_netdev_ops = {
         .ndo_stop               = fec_enet_close,
         .ndo_start_xmit         = fec_enet_start_xmit,
         .ndo_set_multicast_list = set_multicast_list,
+        .ndo_change_mtu         = eth_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_tx_timeout         = fec_timeout,
         .ndo_set_mac_address    = fec_set_mac_address,
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 4ae1d259fced..43d813ed9f45 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -156,6 +156,8 @@ static const struct net_device_ops gfar_netdev_ops = {
         .ndo_tx_timeout = gfar_timeout,
         .ndo_do_ioctl = gfar_ioctl,
         .ndo_vlan_rx_register = gfar_vlan_rx_register,
+        .ndo_set_mac_address = eth_mac_addr,
+        .ndo_validate_addr = eth_validate_addr,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = gfar_netpoll,
 #endif
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 155160052c8b..981ab530e9ac 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -3,7 +3,7 @@
  *              devices like TTY. It interfaces between a raw TTY and the
  *              kernel's AX.25 protocol layers.
  *
- * Authors:     Andreas Könsgen <ajk@iehk.rwth-aachen.de>
+ * Authors:     Andreas Könsgen <ajk@comnets.uni-bremen.de>
  *              Ralf Baechle DL5RB <ralf@linux-mips.org>
  *
  * Quite a lot of stuff "stolen" by Joerg Reuter from slip.c, written by
diff --git a/drivers/net/ibm_newemac/rgmii.c b/drivers/net/ibm_newemac/rgmii.c
index 1d5379de6900..8d76cb89dbd6 100644
--- a/drivers/net/ibm_newemac/rgmii.c
+++ b/drivers/net/ibm_newemac/rgmii.c
@@ -188,11 +188,12 @@ void rgmii_put_mdio(struct of_device *ofdev, int input)
 void rgmii_detach(struct of_device *ofdev, int input)
 {
         struct rgmii_instance *dev = dev_get_drvdata(&ofdev->dev);
-        struct rgmii_regs __iomem *p = dev->base;
-
-        mutex_lock(&dev->lock);
+        struct rgmii_regs __iomem *p;
 
         BUG_ON(!dev || dev->users == 0);
+        p = dev->base;
+
+        mutex_lock(&dev->lock);
 
         RGMII_DBG(dev, "detach(%d)" NL, input);
 
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index be480292aba1..adb09d32625d 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -127,14 +127,48 @@ static void igb_restore_vlan(struct igb_adapter *);
 static void igb_ping_all_vfs(struct igb_adapter *);
 static void igb_msg_task(struct igb_adapter *);
 static int igb_rcv_msg_from_vf(struct igb_adapter *, u32);
-static inline void igb_set_rah_pool(struct e1000_hw *, int , int);
 static void igb_set_mc_list_pools(struct igb_adapter *, int, u16);
 static void igb_vmm_control(struct igb_adapter *);
-static inline void igb_set_vmolr(struct e1000_hw *, int);
-static inline int igb_set_vf_rlpml(struct igb_adapter *, int, int);
 static int igb_set_vf_mac(struct igb_adapter *adapter, int, unsigned char *);
 static void igb_restore_vf_multicasts(struct igb_adapter *adapter);
 
+static inline void igb_set_vmolr(struct e1000_hw *hw, int vfn)
+{
+        u32 reg_data;
+
+        reg_data = rd32(E1000_VMOLR(vfn));
+        reg_data |= E1000_VMOLR_BAM |    /* Accept broadcast */
+                    E1000_VMOLR_ROPE |   /* Accept packets matched in UTA */
+                    E1000_VMOLR_ROMPE |  /* Accept packets matched in MTA */
+                    E1000_VMOLR_AUPE |   /* Accept untagged packets */
+                    E1000_VMOLR_STRVLAN; /* Strip vlan tags */
+        wr32(E1000_VMOLR(vfn), reg_data);
+}
+
+static inline int igb_set_vf_rlpml(struct igb_adapter *adapter, int size,
+                                 int vfn)
+{
+        struct e1000_hw *hw = &adapter->hw;
+        u32 vmolr;
+
+        vmolr = rd32(E1000_VMOLR(vfn));
+        vmolr &= ~E1000_VMOLR_RLPML_MASK;
+        vmolr |= size | E1000_VMOLR_LPE;
+        wr32(E1000_VMOLR(vfn), vmolr);
+
+        return 0;
+}
+
+static inline void igb_set_rah_pool(struct e1000_hw *hw, int pool, int entry)
+{
+        u32 reg_data;
+
+        reg_data = rd32(E1000_RAH(entry));
+        reg_data &= ~E1000_RAH_POOL_MASK;
+        reg_data |= E1000_RAH_POOL_1 << pool;;
+        wr32(E1000_RAH(entry), reg_data);
+}
+
 #ifdef CONFIG_PM
 static int igb_suspend(struct pci_dev *, pm_message_t);
 static int igb_resume(struct pci_dev *);
@@ -5418,43 +5452,6 @@ static void igb_io_resume(struct pci_dev *pdev)
         igb_get_hw_control(adapter);
 }
 
-static inline void igb_set_vmolr(struct e1000_hw *hw, int vfn)
-{
-        u32 reg_data;
-
-        reg_data = rd32(E1000_VMOLR(vfn));
-        reg_data |= E1000_VMOLR_BAM |    /* Accept broadcast */
-                    E1000_VMOLR_ROPE |   /* Accept packets matched in UTA */
-                    E1000_VMOLR_ROMPE |  /* Accept packets matched in MTA */
-                    E1000_VMOLR_AUPE |   /* Accept untagged packets */
-                    E1000_VMOLR_STRVLAN; /* Strip vlan tags */
-        wr32(E1000_VMOLR(vfn), reg_data);
-}
-
-static inline int igb_set_vf_rlpml(struct igb_adapter *adapter, int size,
-                                 int vfn)
-{
-        struct e1000_hw *hw = &adapter->hw;
-        u32 vmolr;
-
-        vmolr = rd32(E1000_VMOLR(vfn));
-        vmolr &= ~E1000_VMOLR_RLPML_MASK;
-        vmolr |= size | E1000_VMOLR_LPE;
-        wr32(E1000_VMOLR(vfn), vmolr);
-
-        return 0;
-}
-
-static inline void igb_set_rah_pool(struct e1000_hw *hw, int pool, int entry)
-{
-        u32 reg_data;
-
-        reg_data = rd32(E1000_RAH(entry));
-        reg_data &= ~E1000_RAH_POOL_MASK;
-        reg_data |= E1000_RAH_POOL_1 << pool;;
-        wr32(E1000_RAH(entry), reg_data);
-}
-
 static void igb_set_mc_list_pools(struct igb_adapter *adapter,
                                   int entry_count, u16 total_rar_filters)
 {
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index d53aa9582137..20f9bc626688 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -31,7 +31,6 @@
 #include <linux/tty.h>
 #include <linux/init.h>
 #include <asm/uaccess.h>
-#include <linux/smp_lock.h>
 #include <linux/delay.h>
 #include <linux/mutex.h>
 
diff --git a/drivers/net/isa-skeleton.c b/drivers/net/isa-skeleton.c
index 73585fd8f29f..d12377b84358 100644
--- a/drivers/net/isa-skeleton.c
+++ b/drivers/net/isa-skeleton.c
@@ -430,7 +430,8 @@ static int net_send_packet(struct sk_buff *skb, struct net_device *dev)
          * hardware interrupt handler.  Queue flow control is
          * thus managed under this lock as well.
          */
-        spin_lock_irq(&np->lock);
+        unsigned long flags;
+        spin_lock_irqsave(&np->lock, flags);
 
         add_to_tx_ring(np, skb, length);
         dev->trans_start = jiffies;
@@ -446,7 +447,7 @@ static int net_send_packet(struct sk_buff *skb, struct net_device *dev)
          * is when the transmit statistics are updated.
          */
 
-        spin_unlock_irq(&np->lock);
+        spin_unlock_irqrestore(&np->lock, flags);
 #else
         /* This is the case for older hardware which takes
          * a single transmit buffer at a time, and it is
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index 7c5978ad929a..da2c8514b8d0 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -106,8 +106,6 @@ static u8 ixgbe_dcbnl_get_state(struct net_device *netdev)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
 
-        DPRINTK(DRV, INFO, "Get DCB Admin Mode.\n");
-
         return !!(adapter->flags & IXGBE_FLAG_DCB_ENABLED);
 }
 
@@ -116,8 +114,6 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
         u8 err = 0;
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
 
-        DPRINTK(DRV, INFO, "Set DCB Admin Mode.\n");
-
         if (state > 0) {
                 /* Turn on DCB */
                 if (adapter->flags & IXGBE_FLAG_DCB_ENABLED)
@@ -175,6 +171,8 @@ static void ixgbe_dcbnl_get_perm_hw_addr(struct net_device *netdev,
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
         int i, j;
 
+        memset(perm_addr, 0xff, MAX_ADDR_LEN);
+
         for (i = 0; i < netdev->addr_len; i++)
                 perm_addr[i] = adapter->hw.mac.perm_addr[i];
 
diff --git a/drivers/net/jazzsonic.c b/drivers/net/jazzsonic.c
index d12106b47bf2..2f286091394d 100644
--- a/drivers/net/jazzsonic.c
+++ b/drivers/net/jazzsonic.c
@@ -229,6 +229,7 @@ static int __init jazz_sonic_probe(struct platform_device *pdev)
         lp = netdev_priv(dev);
         lp->device = &pdev->dev;
         SET_NETDEV_DEV(dev, &pdev->dev);
+        platform_set_drvdata(pdev, dev);
 
         netdev_boot_setup_check(dev);
 
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
new file mode 100644
index 000000000000..9a1dea60c1c4
--- /dev/null
+++ b/drivers/net/ks8851.c
@@ -0,0 +1,1322 @@
+/* drivers/net/ks8651.c
+ *
+ * Copyright 2009 Simtec Electronics
+ *      http://www.simtec.co.uk/
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#define DEBUG
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/cache.h>
+#include <linux/crc32.h>
+#include <linux/mii.h>
+
+#include <linux/spi/spi.h>
+
+#include "ks8851.h"
+
+/**
+ * struct ks8851_rxctrl - KS8851 driver rx control
+ * @mchash: Multicast hash-table data.
+ * @rxcr1: KS_RXCR1 register setting
+ * @rxcr2: KS_RXCR2 register setting
+ *
+ * Representation of the settings needs to control the receive filtering
+ * such as the multicast hash-filter and the receive register settings. This
+ * is used to make the job of working out if the receive settings change and
+ * then issuing the new settings to the worker that will send the necessary
+ * commands.
+ */
+struct ks8851_rxctrl {
+        u16     mchash[4];
+        u16     rxcr1;
+        u16     rxcr2;
+};
+
+/**
+ * union ks8851_tx_hdr - tx header data
+ * @txb: The header as bytes
+ * @txw: The header as 16bit, little-endian words
+ *
+ * A dual representation of the tx header data to allow
+ * access to individual bytes, and to allow 16bit accesses
+ * with 16bit alignment.
+ */
+union ks8851_tx_hdr {
+        u8      txb[6];
+        __le16  txw[3];
+};
+
+/**
+ * struct ks8851_net - KS8851 driver private data
+ * @netdev: The network device we're bound to
+ * @spidev: The spi device we're bound to.
+ * @lock: Lock to ensure that the device is not accessed when busy.
+ * @statelock: Lock on this structure for tx list.
+ * @mii: The MII state information for the mii calls.
+ * @rxctrl: RX settings for @rxctrl_work.
+ * @tx_work: Work queue for tx packets
+ * @irq_work: Work queue for servicing interrupts
+ * @rxctrl_work: Work queue for updating RX mode and multicast lists
+ * @txq: Queue of packets for transmission.
+ * @spi_msg1: pre-setup SPI transfer with one message, @spi_xfer1.
+ * @spi_msg2: pre-setup SPI transfer with two messages, @spi_xfer2.
+ * @txh: Space for generating packet TX header in DMA-able data
+ * @rxd: Space for receiving SPI data, in DMA-able space.
+ * @txd: Space for transmitting SPI data, in DMA-able space.
+ * @msg_enable: The message flags controlling driver output (see ethtool).
+ * @fid: Incrementing frame id tag.
+ * @rc_ier: Cached copy of KS_IER.
+ * @rc_rxqcr: Cached copy of KS_RXQCR.
+ *
+ * The @lock ensures that the chip is protected when certain operations are
+ * in progress. When the read or write packet transfer is in progress, most
+ * of the chip registers are not ccessible until the transfer is finished and
+ * the DMA has been de-asserted.
+ *
+ * The @statelock is used to protect information in the structure which may
+ * need to be accessed via several sources, such as the network driver layer
+ * or one of the work queues.
+ *
+ * We align the buffers we may use for rx/tx to ensure that if the SPI driver
+ * wants to DMA map them, it will not have any problems with data the driver
+ * modifies.
+ */
+struct ks8851_net {
+        struct net_device       *netdev;
+        struct spi_device       *spidev;
+        struct mutex            lock;
+        spinlock_t              statelock;
+
+        union ks8851_tx_hdr     txh ____cacheline_aligned;
+        u8                      rxd[8];
+        u8                      txd[8];
+
+        u32                     msg_enable ____cacheline_aligned;
+        u16                     tx_space;
+        u8                      fid;
+
+        u16                     rc_ier;
+        u16                     rc_rxqcr;
+
+        struct mii_if_info      mii;
+        struct ks8851_rxctrl    rxctrl;
+
+        struct work_struct      tx_work;
+        struct work_struct      irq_work;
+        struct work_struct      rxctrl_work;
+
+        struct sk_buff_head     txq;
+
+        struct spi_message      spi_msg1;
+        struct spi_message      spi_msg2;
+        struct spi_transfer     spi_xfer1;
+        struct spi_transfer     spi_xfer2[2];
+};
+
+static int msg_enable;
+
+#define ks_info(_ks, _msg...) dev_info(&(_ks)->spidev->dev, _msg)
+#define ks_warn(_ks, _msg...) dev_warn(&(_ks)->spidev->dev, _msg)
+#define ks_dbg(_ks, _msg...) dev_dbg(&(_ks)->spidev->dev, _msg)
+#define ks_err(_ks, _msg...) dev_err(&(_ks)->spidev->dev, _msg)
+
+/* shift for byte-enable data */
+#define BYTE_EN(_x)     ((_x) << 2)
+
+/* turn register number and byte-enable mask into data for start of packet */
+#define MK_OP(_byteen, _reg) (BYTE_EN(_byteen) | (_reg)  << (8+2) | (_reg) >> 6)
+
+/* SPI register read/write calls.
+ *
+ * All these calls issue SPI transactions to access the chip's registers. They
+ * all require that the necessary lock is held to prevent accesses when the
+ * chip is busy transfering packet data (RX/TX FIFO accesses).
+ */
+
+/**
+ * ks8851_wrreg16 - write 16bit register value to chip
+ * @ks: The chip state
+ * @reg: The register address
+ * @val: The value to write
+ *
+ * Issue a write to put the value @val into the register specified in @reg.
+ */
+static void ks8851_wrreg16(struct ks8851_net *ks, unsigned reg, unsigned val)
+{
+        struct spi_transfer *xfer = &ks->spi_xfer1;
+        struct spi_message *msg = &ks->spi_msg1;
+        __le16 txb[2];
+        int ret;
+
+        txb[0] = cpu_to_le16(MK_OP(reg & 2 ? 0xC : 0x03, reg) | KS_SPIOP_WR);
+        txb[1] = cpu_to_le16(val);
+
+        xfer->tx_buf = txb;
+        xfer->rx_buf = NULL;
+        xfer->len = 4;
+
+        ret = spi_sync(ks->spidev, msg);
+        if (ret < 0)
+                ks_err(ks, "spi_sync() failed\n");
+}
+
+/**
+ * ks8851_rx_1msg - select whether to use one or two messages for spi read
+ * @ks: The device structure
+ *
+ * Return whether to generate a single message with a tx and rx buffer
+ * supplied to spi_sync(), or alternatively send the tx and rx buffers
+ * as separate messages.
+ *
+ * Depending on the hardware in use, a single message may be more efficient
+ * on interrupts or work done by the driver.
+ *
+ * This currently always returns true until we add some per-device data passed
+ * from the platform code to specify which mode is better.
+ */
+static inline bool ks8851_rx_1msg(struct ks8851_net *ks)
+{
+        return true;
+}
+
+/**
+ * ks8851_rdreg - issue read register command and return the data
+ * @ks: The device state
+ * @op: The register address and byte enables in message format.
+ * @rxb: The RX buffer to return the result into
+ * @rxl: The length of data expected.
+ *
+ * This is the low level read call that issues the necessary spi message(s)
+ * to read data from the register specified in @op.
+ */
+static void ks8851_rdreg(struct ks8851_net *ks, unsigned op,
+                         u8 *rxb, unsigned rxl)
+{
+        struct spi_transfer *xfer;
+        struct spi_message *msg;
+        __le16 *txb = (__le16 *)ks->txd;
+        u8 *trx = ks->rxd;
+        int ret;
+
+        txb[0] = cpu_to_le16(op | KS_SPIOP_RD);
+
+        if (ks8851_rx_1msg(ks)) {
+                msg = &ks->spi_msg1;
+                xfer = &ks->spi_xfer1;
+
+                xfer->tx_buf = txb;
+                xfer->rx_buf = trx;
+                xfer->len = rxl + 2;
+        } else {
+                msg = &ks->spi_msg2;
+                xfer = ks->spi_xfer2;
+
+                xfer->tx_buf = txb;
+                xfer->rx_buf = NULL;
+                xfer->len = 2;
+
+                xfer++;
+                xfer->tx_buf = NULL;
+                xfer->rx_buf = trx;
+                xfer->len = rxl;
+        }
+
+        ret = spi_sync(ks->spidev, msg);
+        if (ret < 0)
+                ks_err(ks, "read: spi_sync() failed\n");
+        else if (ks8851_rx_1msg(ks))
+                memcpy(rxb, trx + 2, rxl);
+        else
+                memcpy(rxb, trx, rxl);
+}
+
+/**
+ * ks8851_rdreg8 - read 8 bit register from device
+ * @ks: The chip information
+ * @reg: The register address
+ *
+ * Read a 8bit register from the chip, returning the result
+*/
+static unsigned ks8851_rdreg8(struct ks8851_net *ks, unsigned reg)
+{
+        u8 rxb[1];
+
+        ks8851_rdreg(ks, MK_OP(1 << (reg & 3), reg), rxb, 1);
+        return rxb[0];
+}
+
+/**
+ * ks8851_rdreg16 - read 16 bit register from device
+ * @ks: The chip information
+ * @reg: The register address
+ *
+ * Read a 16bit register from the chip, returning the result
+*/
+static unsigned ks8851_rdreg16(struct ks8851_net *ks, unsigned reg)
+{
+        __le16 rx = 0;
+
+        ks8851_rdreg(ks, MK_OP(reg & 2 ? 0xC : 0x3, reg), (u8 *)&rx, 2);
+        return le16_to_cpu(rx);
+}
+
+/**
+ * ks8851_rdreg32 - read 32 bit register from device
+ * @ks: The chip information
+ * @reg: The register address
+ *
+ * Read a 32bit register from the chip.
+ *
+ * Note, this read requires the address be aligned to 4 bytes.
+*/
+static unsigned ks8851_rdreg32(struct ks8851_net *ks, unsigned reg)
+{
+        __le32 rx = 0;
+
+        WARN_ON(reg & 3);
+
+        ks8851_rdreg(ks, MK_OP(0xf, reg), (u8 *)&rx, 4);
+        return le32_to_cpu(rx);
+}
+
+/**
+ * ks8851_soft_reset - issue one of the soft reset to the device
+ * @ks: The device state.
+ * @op: The bit(s) to set in the GRR
+ *
+ * Issue the relevant soft-reset command to the device's GRR register
+ * specified by @op.
+ *
+ * Note, the delays are in there as a caution to ensure that the reset
+ * has time to take effect and then complete. Since the datasheet does
+ * not currently specify the exact sequence, we have chosen something
+ * that seems to work with our device.
+ */
+static void ks8851_soft_reset(struct ks8851_net *ks, unsigned op)
+{
+        ks8851_wrreg16(ks, KS_GRR, op);
+        mdelay(1);      /* wait a short time to effect reset */
+        ks8851_wrreg16(ks, KS_GRR, 0);
+        mdelay(1);      /* wait for condition to clear */
+}
+
+/**
+ * ks8851_write_mac_addr - write mac address to device registers
+ * @dev: The network device
+ *
+ * Update the KS8851 MAC address registers from the address in @dev.
+ *
+ * This call assumes that the chip is not running, so there is no need to
+ * shutdown the RXQ process whilst setting this.
+*/
+static int ks8851_write_mac_addr(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        u16 *mcp = (u16 *)dev->dev_addr;
+
+        mutex_lock(&ks->lock);
+
+        ks8851_wrreg16(ks, KS_MARL, mcp[0]);
+        ks8851_wrreg16(ks, KS_MARM, mcp[1]);
+        ks8851_wrreg16(ks, KS_MARH, mcp[2]);
+
+        mutex_unlock(&ks->lock);
+
+        return 0;
+}
+
+/**
+ * ks8851_init_mac - initialise the mac address
+ * @ks: The device structure
+ *
+ * Get or create the initial mac address for the device and then set that
+ * into the station address register. Currently we assume that the device
+ * does not have a valid mac address in it, and so we use random_ether_addr()
+ * to create a new one.
+ *
+ * In future, the driver should check to see if the device has an EEPROM
+ * attached and whether that has a valid ethernet address in it.
+ */
+static void ks8851_init_mac(struct ks8851_net *ks)
+{
+        struct net_device *dev = ks->netdev;
+
+        random_ether_addr(dev->dev_addr);
+        ks8851_write_mac_addr(dev);
+}
+
+/**
+ * ks8851_irq - device interrupt handler
+ * @irq: Interrupt number passed from the IRQ hnalder.
+ * @pw: The private word passed to register_irq(), our struct ks8851_net.
+ *
+ * Disable the interrupt from happening again until we've processed the
+ * current status by scheduling ks8851_irq_work().
+ */
+static irqreturn_t ks8851_irq(int irq, void *pw)
+{
+        struct ks8851_net *ks = pw;
+
+        disable_irq_nosync(irq);
+        schedule_work(&ks->irq_work);
+        return IRQ_HANDLED;
+}
+
+/**
+ * ks8851_rdfifo - read data from the receive fifo
+ * @ks: The device state.
+ * @buff: The buffer address
+ * @len: The length of the data to read
+ *
+ * Issue an RXQ FIFO read command and read the @len ammount of data from
+ * the FIFO into the buffer specified by @buff.
+ */
+static void ks8851_rdfifo(struct ks8851_net *ks, u8 *buff, unsigned len)
+{
+        struct spi_transfer *xfer = ks->spi_xfer2;
+        struct spi_message *msg = &ks->spi_msg2;
+        u8 txb[1];
+        int ret;
+
+        if (netif_msg_rx_status(ks))
+                ks_dbg(ks, "%s: %d@%p\n", __func__, len, buff);
+
+        /* set the operation we're issuing */
+        txb[0] = KS_SPIOP_RXFIFO;
+
+        xfer->tx_buf = txb;
+        xfer->rx_buf = NULL;
+        xfer->len = 1;
+
+        xfer++;
+        xfer->rx_buf = buff;
+        xfer->tx_buf = NULL;
+        xfer->len = len;
+
+        ret = spi_sync(ks->spidev, msg);
+        if (ret < 0)
+                ks_err(ks, "%s: spi_sync() failed\n", __func__);
+}
+
+/**
+ * ks8851_dbg_dumpkkt - dump initial packet contents to debug
+ * @ks: The device state
+ * @rxpkt: The data for the received packet
+ *
+ * Dump the initial data from the packet to dev_dbg().
+*/
+static void ks8851_dbg_dumpkkt(struct ks8851_net *ks, u8 *rxpkt)
+{
+        ks_dbg(ks, "pkt %02x%02x%02x%02x %02x%02x%02x%02x %02x%02x%02x%02x\n",
+               rxpkt[4], rxpkt[5], rxpkt[6], rxpkt[7],
+               rxpkt[8], rxpkt[9], rxpkt[10], rxpkt[11],
+               rxpkt[12], rxpkt[13], rxpkt[14], rxpkt[15]);
+}
+
+/**
+ * ks8851_rx_pkts - receive packets from the host
+ * @ks: The device information.
+ *
+ * This is called from the IRQ work queue when the system detects that there
+ * are packets in the receive queue. Find out how many packets there are and
+ * read them from the FIFO.
+ */
+static void ks8851_rx_pkts(struct ks8851_net *ks)
+{
+        struct sk_buff *skb;
+        unsigned rxfc;
+        unsigned rxlen;
+        unsigned rxstat;
+        u32 rxh;
+        u8 *rxpkt;
+
+        rxfc = ks8851_rdreg8(ks, KS_RXFC);
+
+        if (netif_msg_rx_status(ks))
+                ks_dbg(ks, "%s: %d packets\n", __func__, rxfc);
+
+        /* Currently we're issuing a read per packet, but we could possibly
+         * improve the code by issuing a single read, getting the receive
+         * header, allocating the packet and then reading the packet data
+         * out in one go.
+         *
+         * This form of operation would require us to hold the SPI bus'
+         * chipselect low during the entie transaction to avoid any
+         * reset to the data stream comming from the chip.
+         */
+
+        for (; rxfc != 0; rxfc--) {
+                rxh = ks8851_rdreg32(ks, KS_RXFHSR);
+                rxstat = rxh & 0xffff;
+                rxlen = rxh >> 16;
+
+                if (netif_msg_rx_status(ks))
+                        ks_dbg(ks, "rx: stat 0x%04x, len 0x%04x\n",
+                                rxstat, rxlen);
+
+                /* the length of the packet includes the 32bit CRC */
+
+                /* set dma read address */
+                ks8851_wrreg16(ks, KS_RXFDPR, RXFDPR_RXFPAI | 0x00);
+
+                /* start the packet dma process, and set auto-dequeue rx */
+                ks8851_wrreg16(ks, KS_RXQCR,
+                               ks->rc_rxqcr | RXQCR_SDA | RXQCR_ADRFE);
+
+                if (rxlen > 0) {
+                        skb = netdev_alloc_skb(ks->netdev, rxlen + 2 + 8);
+                        if (!skb) {
+                                /* todo - dump frame and move on */
+                        }
+
+                        /* two bytes to ensure ip is aligned, and four bytes
+                         * for the status header and 4 bytes of garbage */
+                        skb_reserve(skb, 2 + 4 + 4);
+
+                        rxpkt = skb_put(skb, rxlen - 4) - 8;
+
+                        /* align the packet length to 4 bytes, and add 4 bytes
+                         * as we're getting the rx status header as well */
+                        ks8851_rdfifo(ks, rxpkt, ALIGN(rxlen, 4) + 8);
+
+                        if (netif_msg_pktdata(ks))
+                                ks8851_dbg_dumpkkt(ks, rxpkt);
+
+                        skb->protocol = eth_type_trans(skb, ks->netdev);
+                        netif_rx(skb);
+
+                        ks->netdev->stats.rx_packets++;
+                        ks->netdev->stats.rx_bytes += rxlen - 4;
+                }
+
+                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+        }
+}
+
+/**
+ * ks8851_irq_work - work queue handler for dealing with interrupt requests
+ * @work: The work structure that was scheduled by schedule_work()
+ *
+ * This is the handler invoked when the ks8851_irq() is called to find out
+ * what happened, as we cannot allow ourselves to sleep whilst waiting for
+ * anything other process has the chip's lock.
+ *
+ * Read the interrupt status, work out what needs to be done and then clear
+ * any of the interrupts that are not needed.
+ */
+static void ks8851_irq_work(struct work_struct *work)
+{
+        struct ks8851_net *ks = container_of(work, struct ks8851_net, irq_work);
+        unsigned status;
+        unsigned handled = 0;
+
+        mutex_lock(&ks->lock);
+
+        status = ks8851_rdreg16(ks, KS_ISR);
+
+        if (netif_msg_intr(ks))
+                dev_dbg(&ks->spidev->dev, "%s: status 0x%04x\n",
+                        __func__, status);
+
+        if (status & IRQ_LCI) {
+                /* should do something about checking link status */
+                handled |= IRQ_LCI;
+        }
+
+        if (status & IRQ_LDI) {
+                u16 pmecr = ks8851_rdreg16(ks, KS_PMECR);
+                pmecr &= ~PMECR_WKEVT_MASK;
+                ks8851_wrreg16(ks, KS_PMECR, pmecr | PMECR_WKEVT_LINK);
+
+                handled |= IRQ_LDI;
+        }
+
+        if (status & IRQ_RXPSI)
+                handled |= IRQ_RXPSI;
+
+        if (status & IRQ_TXI) {
+                handled |= IRQ_TXI;
+
+                /* no lock here, tx queue should have been stopped */
+
+                /* update our idea of how much tx space is available to the
+                 * system */
+                ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR);
+
+                if (netif_msg_intr(ks))
+                        ks_dbg(ks, "%s: txspace %d\n", __func__, ks->tx_space);
+        }
+
+        if (status & IRQ_RXI)
+                handled |= IRQ_RXI;
+
+        if (status & IRQ_SPIBEI) {
+                dev_err(&ks->spidev->dev, "%s: spi bus error\n", __func__);
+                handled |= IRQ_SPIBEI;
+        }
+
+        ks8851_wrreg16(ks, KS_ISR, handled);
+
+        if (status & IRQ_RXI) {
+                /* the datasheet says to disable the rx interrupt during
+                 * packet read-out, however we're masking the interrupt
+                 * from the device so do not bother masking just the RX
+                 * from the device. */
+
+                ks8851_rx_pkts(ks);
+        }
+
+        /* if something stopped the rx process, probably due to wanting
+         * to change the rx settings, then do something about restarting
+         * it. */
+        if (status & IRQ_RXPSI) {
+                struct ks8851_rxctrl *rxc = &ks->rxctrl;
+
+                /* update the multicast hash table */
+                ks8851_wrreg16(ks, KS_MAHTR0, rxc->mchash[0]);
+                ks8851_wrreg16(ks, KS_MAHTR1, rxc->mchash[1]);
+                ks8851_wrreg16(ks, KS_MAHTR2, rxc->mchash[2]);
+                ks8851_wrreg16(ks, KS_MAHTR3, rxc->mchash[3]);
+
+                ks8851_wrreg16(ks, KS_RXCR2, rxc->rxcr2);
+                ks8851_wrreg16(ks, KS_RXCR1, rxc->rxcr1);
+        }
+
+        mutex_unlock(&ks->lock);
+
+        if (status & IRQ_TXI)
+                netif_wake_queue(ks->netdev);
+
+        enable_irq(ks->netdev->irq);
+}
+
+/**
+ * calc_txlen - calculate size of message to send packet
+ * @len: Lenght of data
+ *
+ * Returns the size of the TXFIFO message needed to send
+ * this packet.
+ */
+static inline unsigned calc_txlen(unsigned len)
+{
+        return ALIGN(len + 4, 4);
+}
+
+/**
+ * ks8851_wrpkt - write packet to TX FIFO
+ * @ks: The device state.
+ * @txp: The sk_buff to transmit.
+ * @irq: IRQ on completion of the packet.
+ *
+ * Send the @txp to the chip. This means creating the relevant packet header
+ * specifying the length of the packet and the other information the chip
+ * needs, such as IRQ on completion. Send the header and the packet data to
+ * the device.
+ */
+static void ks8851_wrpkt(struct ks8851_net *ks, struct sk_buff *txp, bool irq)
+{
+        struct spi_transfer *xfer = ks->spi_xfer2;
+        struct spi_message *msg = &ks->spi_msg2;
+        unsigned fid = 0;
+        int ret;
+
+        if (netif_msg_tx_queued(ks))
+                dev_dbg(&ks->spidev->dev, "%s: skb %p, %d@%p, irq %d\n",
+                        __func__, txp, txp->len, txp->data, irq);
+
+        fid = ks->fid++;
+        fid &= TXFR_TXFID_MASK;
+
+        if (irq)
+                fid |= TXFR_TXIC;       /* irq on completion */
+
+        /* start header at txb[1] to align txw entries */
+        ks->txh.txb[1] = KS_SPIOP_TXFIFO;
+        ks->txh.txw[1] = cpu_to_le16(fid);
+        ks->txh.txw[2] = cpu_to_le16(txp->len);
+
+        xfer->tx_buf = &ks->txh.txb[1];
+        xfer->rx_buf = NULL;
+        xfer->len = 5;
+
+        xfer++;
+        xfer->tx_buf = txp->data;
+        xfer->rx_buf = NULL;
+        xfer->len = ALIGN(txp->len, 4);
+
+        ret = spi_sync(ks->spidev, msg);
+        if (ret < 0)
+                ks_err(ks, "%s: spi_sync() failed\n", __func__);
+}
+
+/**
+ * ks8851_done_tx - update and then free skbuff after transmitting
+ * @ks: The device state
+ * @txb: The buffer transmitted
+ */
+static void ks8851_done_tx(struct ks8851_net *ks, struct sk_buff *txb)
+{
+        struct net_device *dev = ks->netdev;
+
+        dev->stats.tx_bytes += txb->len;
+        dev->stats.tx_packets++;
+
+        dev_kfree_skb(txb);
+}
+
+/**
+ * ks8851_tx_work - process tx packet(s)
+ * @work: The work strucutre what was scheduled.
+ *
+ * This is called when a number of packets have been scheduled for
+ * transmission and need to be sent to the device.
+ */
+static void ks8851_tx_work(struct work_struct *work)
+{
+        struct ks8851_net *ks = container_of(work, struct ks8851_net, tx_work);
+        struct sk_buff *txb;
+        bool last = false;
+
+        mutex_lock(&ks->lock);
+
+        while (!last) {
+                txb = skb_dequeue(&ks->txq);
+                last = skb_queue_empty(&ks->txq);
+
+                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+                ks8851_wrpkt(ks, txb, last);
+                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+
+                ks8851_done_tx(ks, txb);
+        }
+
+        mutex_unlock(&ks->lock);
+}
+
+/**
+ * ks8851_set_powermode - set power mode of the device
+ * @ks: The device state
+ * @pwrmode: The power mode value to write to KS_PMECR.
+ *
+ * Change the power mode of the chip.
+ */
+static void ks8851_set_powermode(struct ks8851_net *ks, unsigned pwrmode)
+{
+        unsigned pmecr;
+
+        if (netif_msg_hw(ks))
+                ks_dbg(ks, "setting power mode %d\n", pwrmode);
+
+        pmecr = ks8851_rdreg16(ks, KS_PMECR);
+        pmecr &= ~PMECR_PM_MASK;
+        pmecr |= pwrmode;
+
+        ks8851_wrreg16(ks, KS_PMECR, pmecr);
+}
+
+/**
+ * ks8851_net_open - open network device
+ * @dev: The network device being opened.
+ *
+ * Called when the network device is marked active, such as a user executing
+ * 'ifconfig up' on the device.
+ */
+static int ks8851_net_open(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+
+        /* lock the card, even if we may not actually be doing anything
+         * else at the moment */
+        mutex_lock(&ks->lock);
+
+        if (netif_msg_ifup(ks))
+                ks_dbg(ks, "opening %s\n", dev->name);
+
+        /* bring chip out of any power saving mode it was in */
+        ks8851_set_powermode(ks, PMECR_PM_NORMAL);
+
+        /* issue a soft reset to the RX/TX QMU to put it into a known
+         * state. */
+        ks8851_soft_reset(ks, GRR_QMU);
+
+        /* setup transmission parameters */
+
+        ks8851_wrreg16(ks, KS_TXCR, (TXCR_TXE | /* enable transmit process */
+                                     TXCR_TXPE | /* pad to min length */
+                                     TXCR_TXCRC | /* add CRC */
+                                     TXCR_TXFCE)); /* enable flow control */
+
+        /* auto-increment tx data, reset tx pointer */
+        ks8851_wrreg16(ks, KS_TXFDPR, TXFDPR_TXFPAI);
+
+        /* setup receiver control */
+
+        ks8851_wrreg16(ks, KS_RXCR1, (RXCR1_RXPAFMA | /*  from mac filter */
+                                      RXCR1_RXFCE | /* enable flow control */
+                                      RXCR1_RXBE | /* broadcast enable */
+                                      RXCR1_RXUE | /* unicast enable */
+                                      RXCR1_RXE)); /* enable rx block */
+
+        /* transfer entire frames out in one go */
+        ks8851_wrreg16(ks, KS_RXCR2, RXCR2_SRDBL_FRAME);
+
+        /* set receive counter timeouts */
+        ks8851_wrreg16(ks, KS_RXDTTR, 1000); /* 1ms after first frame to IRQ */
+        ks8851_wrreg16(ks, KS_RXDBCTR, 4096); /* >4Kbytes in buffer to IRQ */
+        ks8851_wrreg16(ks, KS_RXFCTR, 10);  /* 10 frames to IRQ */
+
+        ks->rc_rxqcr = (RXQCR_RXFCTE |  /* IRQ on frame count exceeded */
+                        RXQCR_RXDBCTE | /* IRQ on byte count exceeded */
+                        RXQCR_RXDTTE);  /* IRQ on time exceeded */
+
+        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+
+        /* clear then enable interrupts */
+
+#define STD_IRQ (IRQ_LCI |      /* Link Change */       \
+                 IRQ_TXI |      /* TX done */           \
+                 IRQ_RXI |      /* RX done */           \
+                 IRQ_SPIBEI |   /* SPI bus error */     \
+                 IRQ_TXPSI |    /* TX process stop */   \
+                 IRQ_RXPSI)     /* RX process stop */
+
+        ks->rc_ier = STD_IRQ;
+        ks8851_wrreg16(ks, KS_ISR, STD_IRQ);
+        ks8851_wrreg16(ks, KS_IER, STD_IRQ);
+
+        netif_start_queue(ks->netdev);
+
+        if (netif_msg_ifup(ks))
+                ks_dbg(ks, "network device %s up\n", dev->name);
+
+        mutex_unlock(&ks->lock);
+        return 0;
+}
+
+/**
+ * ks8851_net_stop - close network device
+ * @dev: The device being closed.
+ *
+ * Called to close down a network device which has been active. Cancell any
+ * work, shutdown the RX and TX process and then place the chip into a low
+ * power state whilst it is not being used.
+ */
+static int ks8851_net_stop(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+
+        if (netif_msg_ifdown(ks))
+                ks_info(ks, "%s: shutting down\n", dev->name);
+
+        netif_stop_queue(dev);
+
+        mutex_lock(&ks->lock);
+
+        /* stop any outstanding work */
+        flush_work(&ks->irq_work);
+        flush_work(&ks->tx_work);
+        flush_work(&ks->rxctrl_work);
+
+        /* turn off the IRQs and ack any outstanding */
+        ks8851_wrreg16(ks, KS_IER, 0x0000);
+        ks8851_wrreg16(ks, KS_ISR, 0xffff);
+
+        /* shutdown RX process */
+        ks8851_wrreg16(ks, KS_RXCR1, 0x0000);
+
+        /* shutdown TX process */
+        ks8851_wrreg16(ks, KS_TXCR, 0x0000);
+
+        /* set powermode to soft power down to save power */
+        ks8851_set_powermode(ks, PMECR_PM_SOFTDOWN);
+
+        /* ensure any queued tx buffers are dumped */
+        while (!skb_queue_empty(&ks->txq)) {
+                struct sk_buff *txb = skb_dequeue(&ks->txq);
+
+                if (netif_msg_ifdown(ks))
+                        ks_dbg(ks, "%s: freeing txb %p\n", __func__, txb);
+
+                dev_kfree_skb(txb);
+        }
+
+        mutex_unlock(&ks->lock);
+        return 0;
+}
+
+/**
+ * ks8851_start_xmit - transmit packet
+ * @skb: The buffer to transmit
+ * @dev: The device used to transmit the packet.
+ *
+ * Called by the network layer to transmit the @skb. Queue the packet for
+ * the device and schedule the necessary work to transmit the packet when
+ * it is free.
+ *
+ * We do this to firstly avoid sleeping with the network device locked,
+ * and secondly so we can round up more than one packet to transmit which
+ * means we can try and avoid generating too many transmit done interrupts.
+ */
+static int ks8851_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        unsigned needed = calc_txlen(skb->len);
+        int ret = NETDEV_TX_OK;
+
+        if (netif_msg_tx_queued(ks))
+                ks_dbg(ks, "%s: skb %p, %d@%p\n", __func__,
+                       skb, skb->len, skb->data);
+
+        spin_lock(&ks->statelock);
+
+        if (needed > ks->tx_space) {
+                netif_stop_queue(dev);
+                ret = NETDEV_TX_BUSY;
+        } else {
+                ks->tx_space -= needed;
+                skb_queue_tail(&ks->txq, skb);
+        }
+
+        spin_unlock(&ks->statelock);
+        schedule_work(&ks->tx_work);
+
+        return ret;
+}
+
+/**
+ * ks8851_rxctrl_work - work handler to change rx mode
+ * @work: The work structure this belongs to.
+ *
+ * Lock the device and issue the necessary changes to the receive mode from
+ * the network device layer. This is done so that we can do this without
+ * having to sleep whilst holding the network device lock.
+ *
+ * Since the recommendation from Micrel is that the RXQ is shutdown whilst the
+ * receive parameters are programmed, we issue a write to disable the RXQ and
+ * then wait for the interrupt handler to be triggered once the RXQ shutdown is
+ * complete. The interrupt handler then writes the new values into the chip.
+ */
+static void ks8851_rxctrl_work(struct work_struct *work)
+{
+        struct ks8851_net *ks = container_of(work, struct ks8851_net, rxctrl_work);
+
+        mutex_lock(&ks->lock);
+
+        /* need to shutdown RXQ before modifying filter parameters */
+        ks8851_wrreg16(ks, KS_RXCR1, 0x00);
+
+        mutex_unlock(&ks->lock);
+}
+
+static void ks8851_set_rx_mode(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        struct ks8851_rxctrl rxctrl;
+
+        memset(&rxctrl, 0, sizeof(rxctrl));
+
+        if (dev->flags & IFF_PROMISC) {
+                /* interface to receive everything */
+
+                rxctrl.rxcr1 = RXCR1_RXAE | RXCR1_RXINVF;
+        } else if (dev->flags & IFF_ALLMULTI) {
+                /* accept all multicast packets */
+
+                rxctrl.rxcr1 = (RXCR1_RXME | RXCR1_RXAE |
+                                RXCR1_RXPAFMA | RXCR1_RXMAFMA);
+        } else if (dev->flags & IFF_MULTICAST && dev->mc_count > 0) {
+                struct dev_mc_list *mcptr = dev->mc_list;
+                u32 crc;
+                int i;
+
+                /* accept some multicast */
+
+                for (i = dev->mc_count; i > 0; i--) {
+                        crc = ether_crc(ETH_ALEN, mcptr->dmi_addr);
+                        crc >>= (32 - 6);  /* get top six bits */
+
+                        rxctrl.mchash[crc >> 4] |= (1 << (crc & 0xf));
+                        mcptr = mcptr->next;
+                }
+
+                rxctrl.rxcr1 = RXCR1_RXME | RXCR1_RXAE | RXCR1_RXPAFMA;
+        } else {
+                /* just accept broadcast / unicast */
+                rxctrl.rxcr1 = RXCR1_RXPAFMA;
+        }
+
+        rxctrl.rxcr1 |= (RXCR1_RXUE | /* unicast enable */
+                         RXCR1_RXBE | /* broadcast enable */
+                         RXCR1_RXE | /* RX process enable */
+                         RXCR1_RXFCE); /* enable flow control */
+
+        rxctrl.rxcr2 |= RXCR2_SRDBL_FRAME;
+
+        /* schedule work to do the actual set of the data if needed */
+
+        spin_lock(&ks->statelock);
+
+        if (memcmp(&rxctrl, &ks->rxctrl, sizeof(rxctrl)) != 0) {
+                memcpy(&ks->rxctrl, &rxctrl, sizeof(ks->rxctrl));
+                schedule_work(&ks->rxctrl_work);
+        }
+
+        spin_unlock(&ks->statelock);
+}
+
+static int ks8851_set_mac_address(struct net_device *dev, void *addr)
+{
+        struct sockaddr *sa = addr;
+
+        if (netif_running(dev))
+                return -EBUSY;
+
+        if (!is_valid_ether_addr(sa->sa_data))
+                return -EADDRNOTAVAIL;
+
+        memcpy(dev->dev_addr, sa->sa_data, ETH_ALEN);
+        return ks8851_write_mac_addr(dev);
+}
+
+static int ks8851_net_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+
+        if (!netif_running(dev))
+                return -EINVAL;
+
+        return generic_mii_ioctl(&ks->mii, if_mii(req), cmd, NULL);
+}
+
+static const struct net_device_ops ks8851_netdev_ops = {
+        .ndo_open               = ks8851_net_open,
+        .ndo_stop               = ks8851_net_stop,
+        .ndo_do_ioctl           = ks8851_net_ioctl,
+        .ndo_start_xmit         = ks8851_start_xmit,
+        .ndo_set_mac_address    = ks8851_set_mac_address,
+        .ndo_set_rx_mode        = ks8851_set_rx_mode,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+/* ethtool support */
+
+static void ks8851_get_drvinfo(struct net_device *dev,
+                               struct ethtool_drvinfo *di)
+{
+        strlcpy(di->driver, "KS8851", sizeof(di->driver));
+        strlcpy(di->version, "1.00", sizeof(di->version));
+        strlcpy(di->bus_info, dev_name(dev->dev.parent), sizeof(di->bus_info));
+}
+
+static u32 ks8851_get_msglevel(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return ks->msg_enable;
+}
+
+static void ks8851_set_msglevel(struct net_device *dev, u32 to)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        ks->msg_enable = to;
+}
+
+static int ks8851_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return mii_ethtool_gset(&ks->mii, cmd);
+}
+
+static int ks8851_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return mii_ethtool_sset(&ks->mii, cmd);
+}
+
+static u32 ks8851_get_link(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return mii_link_ok(&ks->mii);
+}
+
+static int ks8851_nway_reset(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return mii_nway_restart(&ks->mii);
+}
+
+static const struct ethtool_ops ks8851_ethtool_ops = {
+        .get_drvinfo    = ks8851_get_drvinfo,
+        .get_msglevel   = ks8851_get_msglevel,
+        .set_msglevel   = ks8851_set_msglevel,
+        .get_settings   = ks8851_get_settings,
+        .set_settings   = ks8851_set_settings,
+        .get_link       = ks8851_get_link,
+        .nway_reset     = ks8851_nway_reset,
+};
+
+/* MII interface controls */
+
+/**
+ * ks8851_phy_reg - convert MII register into a KS8851 register
+ * @reg: MII register number.
+ *
+ * Return the KS8851 register number for the corresponding MII PHY register
+ * if possible. Return zero if the MII register has no direct mapping to the
+ * KS8851 register set.
+ */
+static int ks8851_phy_reg(int reg)
+{
+        switch (reg) {
+        case MII_BMCR:
+                return KS_P1MBCR;
+        case MII_BMSR:
+                return KS_P1MBSR;
+        case MII_PHYSID1:
+                return KS_PHY1ILR;
+        case MII_PHYSID2:
+                return KS_PHY1IHR;
+        case MII_ADVERTISE:
+                return KS_P1ANAR;
+        case MII_LPA:
+                return KS_P1ANLPR;
+        }
+
+        return 0x0;
+}
+
+/**
+ * ks8851_phy_read - MII interface PHY register read.
+ * @dev: The network device the PHY is on.
+ * @phy_addr: Address of PHY (ignored as we only have one)
+ * @reg: The register to read.
+ *
+ * This call reads data from the PHY register specified in @reg. Since the
+ * device does not support all the MII registers, the non-existant values
+ * are always returned as zero.
+ *
+ * We return zero for unsupported registers as the MII code does not check
+ * the value returned for any error status, and simply returns it to the
+ * caller. The mii-tool that the driver was tested with takes any -ve error
+ * as real PHY capabilities, thus displaying incorrect data to the user.
+ */
+static int ks8851_phy_read(struct net_device *dev, int phy_addr, int reg)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        int ksreg;
+        int result;
+
+        ksreg = ks8851_phy_reg(reg);
+        if (!ksreg)
+                return 0x0;     /* no error return allowed, so use zero */
+
+        mutex_lock(&ks->lock);
+        result = ks8851_rdreg16(ks, ksreg);
+        mutex_unlock(&ks->lock);
+
+        return result;
+}
+
+static void ks8851_phy_write(struct net_device *dev,
+                             int phy, int reg, int value)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        int ksreg;
+
+        ksreg = ks8851_phy_reg(reg);
+        if (ksreg) {
+                mutex_lock(&ks->lock);
+                ks8851_wrreg16(ks, ksreg, value);
+                mutex_unlock(&ks->lock);
+        }
+}
+
+/**
+ * ks8851_read_selftest - read the selftest memory info.
+ * @ks: The device state
+ *
+ * Read and check the TX/RX memory selftest information.
+ */
+static int ks8851_read_selftest(struct ks8851_net *ks)
+{
+        unsigned both_done = MBIR_TXMBF | MBIR_RXMBF;
+        int ret = 0;
+        unsigned rd;
+
+        rd = ks8851_rdreg16(ks, KS_MBIR);
+
+        if ((rd & both_done) != both_done) {
+                ks_warn(ks, "Memory selftest not finished\n");
+                return 0;
+        }
+
+        if (rd & MBIR_TXMBFA) {
+                ks_err(ks, "TX memory selftest fail\n");
+                ret |= 1;
+        }
+
+        if (rd & MBIR_RXMBFA) {
+                ks_err(ks, "RX memory selftest fail\n");
+                ret |= 2;
+        }
+
+        return 0;
+}
+
+/* driver bus management functions */
+
+static int __devinit ks8851_probe(struct spi_device *spi)
+{
+        struct net_device *ndev;
+        struct ks8851_net *ks;
+        int ret;
+
+        ndev = alloc_etherdev(sizeof(struct ks8851_net));
+        if (!ndev) {
+                dev_err(&spi->dev, "failed to alloc ethernet device\n");
+                return -ENOMEM;
+        }
+
+        spi->bits_per_word = 8;
+
+        ks = netdev_priv(ndev);
+
+        ks->netdev = ndev;
+        ks->spidev = spi;
+        ks->tx_space = 6144;
+
+        mutex_init(&ks->lock);
+        spin_lock_init(&ks->statelock);
+
+        INIT_WORK(&ks->tx_work, ks8851_tx_work);
+        INIT_WORK(&ks->irq_work, ks8851_irq_work);
+        INIT_WORK(&ks->rxctrl_work, ks8851_rxctrl_work);
+
+        /* initialise pre-made spi transfer messages */
+
+        spi_message_init(&ks->spi_msg1);
+        spi_message_add_tail(&ks->spi_xfer1, &ks->spi_msg1);
+
+        spi_message_init(&ks->spi_msg2);
+        spi_message_add_tail(&ks->spi_xfer2[0], &ks->spi_msg2);
+        spi_message_add_tail(&ks->spi_xfer2[1], &ks->spi_msg2);
+
+        /* setup mii state */
+        ks->mii.dev             = ndev;
+        ks->mii.phy_id          = 1,
+        ks->mii.phy_id_mask     = 1;
+        ks->mii.reg_num_mask    = 0xf;
+        ks->mii.mdio_read       = ks8851_phy_read;
+        ks->mii.mdio_write      = ks8851_phy_write;
+
+        dev_info(&spi->dev, "message enable is %d\n", msg_enable);
+
+        /* set the default message enable */
+        ks->msg_enable = netif_msg_init(msg_enable, (NETIF_MSG_DRV |
+                                                     NETIF_MSG_PROBE |
+                                                     NETIF_MSG_LINK));
+
+        skb_queue_head_init(&ks->txq);
+
+        SET_ETHTOOL_OPS(ndev, &ks8851_ethtool_ops);
+        SET_NETDEV_DEV(ndev, &spi->dev);
+
+        dev_set_drvdata(&spi->dev, ks);
+
+        ndev->if_port = IF_PORT_100BASET;
+        ndev->netdev_ops = &ks8851_netdev_ops;
+        ndev->irq = spi->irq;
+
+        /* simple check for a valid chip being connected to the bus */
+
+        if ((ks8851_rdreg16(ks, KS_CIDER) & ~CIDER_REV_MASK) != CIDER_ID) {
+                dev_err(&spi->dev, "failed to read device ID\n");
+                ret = -ENODEV;
+                goto err_id;
+        }
+
+        ks8851_read_selftest(ks);
+        ks8851_init_mac(ks);
+
+        ret = request_irq(spi->irq, ks8851_irq, IRQF_TRIGGER_LOW,
+                          ndev->name, ks);
+        if (ret < 0) {
+                dev_err(&spi->dev, "failed to get irq\n");
+                goto err_irq;
+        }
+
+        ret = register_netdev(ndev);
+        if (ret) {
+                dev_err(&spi->dev, "failed to register network device\n");
+                goto err_netdev;
+        }
+
+        dev_info(&spi->dev, "revision %d, MAC %pM, IRQ %d\n",
+                 CIDER_REV_GET(ks8851_rdreg16(ks, KS_CIDER)),
+                 ndev->dev_addr, ndev->irq);
+
+        return 0;
+
+
+err_netdev:
+        free_irq(ndev->irq, ndev);
+
+err_id:
+err_irq:
+        free_netdev(ndev);
+        return ret;
+}
+
+static int __devexit ks8851_remove(struct spi_device *spi)
+{
+        struct ks8851_net *priv = dev_get_drvdata(&spi->dev);
+
+        if (netif_msg_drv(priv))
+                dev_info(&spi->dev, "remove");
+
+        unregister_netdev(priv->netdev);
+        free_irq(spi->irq, priv);
+        free_netdev(priv->netdev);
+
+        return 0;
+}
+
+static struct spi_driver ks8851_driver = {
+        .driver = {
+                .name = "ks8851",
+                .owner = THIS_MODULE,
+        },
+        .probe = ks8851_probe,
+        .remove = __devexit_p(ks8851_remove),
+};
+
+static int __init ks8851_init(void)
+{
+        return spi_register_driver(&ks8851_driver);
+}
+
+static void __exit ks8851_exit(void)
+{
+        spi_unregister_driver(&ks8851_driver);
+}
+
+module_init(ks8851_init);
+module_exit(ks8851_exit);
+
+MODULE_DESCRIPTION("KS8851 Network driver");
+MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
+MODULE_LICENSE("GPL");
+
+module_param_named(message, msg_enable, int, 0);
+MODULE_PARM_DESC(message, "Message verbosity level (0=none, 31=all)");
diff --git a/drivers/net/ks8851.h b/drivers/net/ks8851.h
new file mode 100644
index 000000000000..85abe147afbf
--- /dev/null
+++ b/drivers/net/ks8851.h
@@ -0,0 +1,296 @@
+/* drivers/net/ks8851.h
+ *
+ * Copyright 2009 Simtec Electronics
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * KS8851 register definitions
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+#define KS_CCR                                  0x08
+#define CCR_EEPROM                              (1 << 9)
+#define CCR_SPI                                 (1 << 8)
+#define CCR_32PIN                               (1 << 0)
+
+/* MAC address registers */
+#define KS_MARL                                 0x10
+#define KS_MARM                                 0x12
+#define KS_MARH                                 0x14
+
+#define KS_OBCR                                 0x20
+#define OBCR_ODS_16mA                           (1 << 6)
+
+#define KS_EEPCR                                0x22
+#define EEPCR_EESA                              (1 << 4)
+#define EEPCR_EESB                              (1 << 3)
+#define EEPCR_EEDO                              (1 << 2)
+#define EEPCR_EESCK                             (1 << 1)
+#define EEPCR_EECS                              (1 << 0)
+
+#define KS_MBIR                                 0x24
+#define MBIR_TXMBF                              (1 << 12)
+#define MBIR_TXMBFA                             (1 << 11)
+#define MBIR_RXMBF                              (1 << 4)
+#define MBIR_RXMBFA                             (1 << 3)
+
+#define KS_GRR                                  0x26
+#define GRR_QMU                                 (1 << 1)
+#define GRR_GSR                                 (1 << 0)
+
+#define KS_WFCR                                 0x2A
+#define WFCR_MPRXE                              (1 << 7)
+#define WFCR_WF3E                               (1 << 3)
+#define WFCR_WF2E                               (1 << 2)
+#define WFCR_WF1E                               (1 << 1)
+#define WFCR_WF0E                               (1 << 0)
+
+#define KS_WF0CRC0                              0x30
+#define KS_WF0CRC1                              0x32
+#define KS_WF0BM0                               0x34
+#define KS_WF0BM1                               0x36
+#define KS_WF0BM2                               0x38
+#define KS_WF0BM3                               0x3A
+
+#define KS_WF1CRC0                              0x40
+#define KS_WF1CRC1                              0x42
+#define KS_WF1BM0                               0x44
+#define KS_WF1BM1                               0x46
+#define KS_WF1BM2                               0x48
+#define KS_WF1BM3                               0x4A
+
+#define KS_WF2CRC0                              0x50
+#define KS_WF2CRC1                              0x52
+#define KS_WF2BM0                               0x54
+#define KS_WF2BM1                               0x56
+#define KS_WF2BM2                               0x58
+#define KS_WF2BM3                               0x5A
+
+#define KS_WF3CRC0                              0x60
+#define KS_WF3CRC1                              0x62
+#define KS_WF3BM0                               0x64
+#define KS_WF3BM1                               0x66
+#define KS_WF3BM2                               0x68
+#define KS_WF3BM3                               0x6A
+
+#define KS_TXCR                                 0x70
+#define TXCR_TCGICMP                            (1 << 8)
+#define TXCR_TCGUDP                             (1 << 7)
+#define TXCR_TCGTCP                             (1 << 6)
+#define TXCR_TCGIP                              (1 << 5)
+#define TXCR_FTXQ                               (1 << 4)
+#define TXCR_TXFCE                              (1 << 3)
+#define TXCR_TXPE                               (1 << 2)
+#define TXCR_TXCRC                              (1 << 1)
+#define TXCR_TXE                                (1 << 0)
+
+#define KS_TXSR                                 0x72
+#define TXSR_TXLC                               (1 << 13)
+#define TXSR_TXMC                               (1 << 12)
+#define TXSR_TXFID_MASK                         (0x3f << 0)
+#define TXSR_TXFID_SHIFT                        (0)
+#define TXSR_TXFID_GET(_v)                      (((_v) >> 0) & 0x3f)
+
+#define KS_RXCR1                                0x74
+#define RXCR1_FRXQ                              (1 << 15)
+#define RXCR1_RXUDPFCC                          (1 << 14)
+#define RXCR1_RXTCPFCC                          (1 << 13)
+#define RXCR1_RXIPFCC                           (1 << 12)
+#define RXCR1_RXPAFMA                           (1 << 11)
+#define RXCR1_RXFCE                             (1 << 10)
+#define RXCR1_RXEFE                             (1 << 9)
+#define RXCR1_RXMAFMA                           (1 << 8)
+#define RXCR1_RXBE                              (1 << 7)
+#define RXCR1_RXME                              (1 << 6)
+#define RXCR1_RXUE                              (1 << 5)
+#define RXCR1_RXAE                              (1 << 4)
+#define RXCR1_RXINVF                            (1 << 1)
+#define RXCR1_RXE                               (1 << 0)
+
+#define KS_RXCR2                                0x76
+#define RXCR2_SRDBL_MASK                        (0x7 << 5)
+#define RXCR2_SRDBL_SHIFT                       (5)
+#define RXCR2_SRDBL_4B                          (0x0 << 5)
+#define RXCR2_SRDBL_8B                          (0x1 << 5)
+#define RXCR2_SRDBL_16B                         (0x2 << 5)
+#define RXCR2_SRDBL_32B                         (0x3 << 5)
+#define RXCR2_SRDBL_FRAME                       (0x4 << 5)
+#define RXCR2_IUFFP                             (1 << 4)
+#define RXCR2_RXIUFCEZ                          (1 << 3)
+#define RXCR2_UDPLFE                            (1 << 2)
+#define RXCR2_RXICMPFCC                         (1 << 1)
+#define RXCR2_RXSAF                             (1 << 0)
+
+#define KS_TXMIR                                0x78
+
+#define KS_RXFHSR                               0x7C
+#define RXFSHR_RXFV                             (1 << 15)
+#define RXFSHR_RXICMPFCS                        (1 << 13)
+#define RXFSHR_RXIPFCS                          (1 << 12)
+#define RXFSHR_RXTCPFCS                         (1 << 11)
+#define RXFSHR_RXUDPFCS                         (1 << 10)
+#define RXFSHR_RXBF                             (1 << 7)
+#define RXFSHR_RXMF                             (1 << 6)
+#define RXFSHR_RXUF                             (1 << 5)
+#define RXFSHR_RXMR                             (1 << 4)
+#define RXFSHR_RXFT                             (1 << 3)
+#define RXFSHR_RXFTL                            (1 << 2)
+#define RXFSHR_RXRF                             (1 << 1)
+#define RXFSHR_RXCE                             (1 << 0)
+
+#define KS_RXFHBCR                              0x7E
+#define KS_TXQCR                                0x80
+#define TXQCR_AETFE                             (1 << 2)
+#define TXQCR_TXQMAM                            (1 << 1)
+#define TXQCR_METFE                             (1 << 0)
+
+#define KS_RXQCR                                0x82
+#define RXQCR_RXDTTS                            (1 << 12)
+#define RXQCR_RXDBCTS                           (1 << 11)
+#define RXQCR_RXFCTS                            (1 << 10)
+#define RXQCR_RXIPHTOE                          (1 << 9)
+#define RXQCR_RXDTTE                            (1 << 7)
+#define RXQCR_RXDBCTE                           (1 << 6)
+#define RXQCR_RXFCTE                            (1 << 5)
+#define RXQCR_ADRFE                             (1 << 4)
+#define RXQCR_SDA                               (1 << 3)
+#define RXQCR_RRXEF                             (1 << 0)
+
+#define KS_TXFDPR                               0x84
+#define TXFDPR_TXFPAI                           (1 << 14)
+#define TXFDPR_TXFP_MASK                        (0x7ff << 0)
+#define TXFDPR_TXFP_SHIFT                       (0)
+
+#define KS_RXFDPR                               0x86
+#define RXFDPR_RXFPAI                           (1 << 14)
+
+#define KS_RXDTTR                               0x8C
+#define KS_RXDBCTR                              0x8E
+
+#define KS_IER                                  0x90
+#define KS_ISR                                  0x92
+#define IRQ_LCI                                 (1 << 15)
+#define IRQ_TXI                                 (1 << 14)
+#define IRQ_RXI                                 (1 << 13)
+#define IRQ_RXOI                                (1 << 11)
+#define IRQ_TXPSI                               (1 << 9)
+#define IRQ_RXPSI                               (1 << 8)
+#define IRQ_TXSAI                               (1 << 6)
+#define IRQ_RXWFDI                              (1 << 5)
+#define IRQ_RXMPDI                              (1 << 4)
+#define IRQ_LDI                                 (1 << 3)
+#define IRQ_EDI                                 (1 << 2)
+#define IRQ_SPIBEI                              (1 << 1)
+#define IRQ_DEDI                                (1 << 0)
+
+#define KS_RXFCTR                               0x9C
+#define KS_RXFC                                 0x9D
+#define RXFCTR_RXFC_MASK                        (0xff << 8)
+#define RXFCTR_RXFC_SHIFT                       (8)
+#define RXFCTR_RXFC_GET(_v)                     (((_v) >> 8) & 0xff)
+#define RXFCTR_RXFCT_MASK                       (0xff << 0)
+#define RXFCTR_RXFCT_SHIFT                      (0)
+
+#define KS_TXNTFSR                              0x9E
+
+#define KS_MAHTR0                               0xA0
+#define KS_MAHTR1                               0xA2
+#define KS_MAHTR2                               0xA4
+#define KS_MAHTR3                               0xA6
+
+#define KS_FCLWR                                0xB0
+#define KS_FCHWR                                0xB2
+#define KS_FCOWR                                0xB4
+
+#define KS_CIDER                                0xC0
+#define CIDER_ID                                0x8870
+#define CIDER_REV_MASK                          (0x7 << 1)
+#define CIDER_REV_SHIFT                         (1)
+#define CIDER_REV_GET(_v)                       (((_v) >> 1) & 0x7)
+
+#define KS_CGCR                                 0xC6
+
+#define KS_IACR                                 0xC8
+#define IACR_RDEN                               (1 << 12)
+#define IACR_TSEL_MASK                          (0x3 << 10)
+#define IACR_TSEL_SHIFT                         (10)
+#define IACR_TSEL_MIB                           (0x3 << 10)
+#define IACR_ADDR_MASK                          (0x1f << 0)
+#define IACR_ADDR_SHIFT                         (0)
+
+#define KS_IADLR                                0xD0
+#define KS_IAHDR                                0xD2
+
+#define KS_PMECR                                0xD4
+#define PMECR_PME_DELAY                         (1 << 14)
+#define PMECR_PME_POL                           (1 << 12)
+#define PMECR_WOL_WAKEUP                        (1 << 11)
+#define PMECR_WOL_MAGICPKT                      (1 << 10)
+#define PMECR_WOL_LINKUP                        (1 << 9)
+#define PMECR_WOL_ENERGY                        (1 << 8)
+#define PMECR_AUTO_WAKE_EN                      (1 << 7)
+#define PMECR_WAKEUP_NORMAL                     (1 << 6)
+#define PMECR_WKEVT_MASK                        (0xf << 2)
+#define PMECR_WKEVT_SHIFT                       (2)
+#define PMECR_WKEVT_GET(_v)                     (((_v) >> 2) & 0xf)
+#define PMECR_WKEVT_ENERGY                      (0x1 << 2)
+#define PMECR_WKEVT_LINK                        (0x2 << 2)
+#define PMECR_WKEVT_MAGICPKT                    (0x4 << 2)
+#define PMECR_WKEVT_FRAME                       (0x8 << 2)
+#define PMECR_PM_MASK                           (0x3 << 0)
+#define PMECR_PM_SHIFT                          (0)
+#define PMECR_PM_NORMAL                         (0x0 << 0)
+#define PMECR_PM_ENERGY                         (0x1 << 0)
+#define PMECR_PM_SOFTDOWN                       (0x2 << 0)
+#define PMECR_PM_POWERSAVE                      (0x3 << 0)
+
+/* Standard MII PHY data */
+#define KS_P1MBCR                               0xE4
+#define KS_P1MBSR                               0xE6
+#define KS_PHY1ILR                              0xE8
+#define KS_PHY1IHR                              0xEA
+#define KS_P1ANAR                               0xEC
+#define KS_P1ANLPR                              0xEE
+
+#define KS_P1SCLMD                              0xF4
+#define P1SCLMD_LEDOFF                          (1 << 15)
+#define P1SCLMD_TXIDS                           (1 << 14)
+#define P1SCLMD_RESTARTAN                       (1 << 13)
+#define P1SCLMD_DISAUTOMDIX                     (1 << 10)
+#define P1SCLMD_FORCEMDIX                       (1 << 9)
+#define P1SCLMD_AUTONEGEN                       (1 << 7)
+#define P1SCLMD_FORCE100                        (1 << 6)
+#define P1SCLMD_FORCEFDX                        (1 << 5)
+#define P1SCLMD_ADV_FLOW                        (1 << 4)
+#define P1SCLMD_ADV_100BT_FDX                   (1 << 3)
+#define P1SCLMD_ADV_100BT_HDX                   (1 << 2)
+#define P1SCLMD_ADV_10BT_FDX                    (1 << 1)
+#define P1SCLMD_ADV_10BT_HDX                    (1 << 0)
+
+#define KS_P1CR                                 0xF6
+#define P1CR_HP_MDIX                            (1 << 15)
+#define P1CR_REV_POL                            (1 << 13)
+#define P1CR_OP_100M                            (1 << 10)
+#define P1CR_OP_FDX                             (1 << 9)
+#define P1CR_OP_MDI                             (1 << 7)
+#define P1CR_AN_DONE                            (1 << 6)
+#define P1CR_LINK_GOOD                          (1 << 5)
+#define P1CR_PNTR_FLOW                          (1 << 4)
+#define P1CR_PNTR_100BT_FDX                     (1 << 3)
+#define P1CR_PNTR_100BT_HDX                     (1 << 2)
+#define P1CR_PNTR_10BT_FDX                      (1 << 1)
+#define P1CR_PNTR_10BT_HDX                      (1 << 0)
+
+/* TX Frame control */
+
+#define TXFR_TXIC                               (1 << 15)
+#define TXFR_TXFID_MASK                         (0x3f << 0)
+#define TXFR_TXFID_SHIFT                        (0)
+
+/* SPI frame opcodes */
+#define KS_SPIOP_RD                             (0x00)
+#define KS_SPIOP_WR                             (0x40)
+#define KS_SPIOP_RXFIFO                         (0x80)
+#define KS_SPIOP_TXFIFO                         (0xC0)
diff --git a/drivers/net/macsonic.c b/drivers/net/macsonic.c
index acd143da161d..61eabcac734c 100644
--- a/drivers/net/macsonic.c
+++ b/drivers/net/macsonic.c
@@ -179,7 +179,7 @@ static const struct net_device_ops macsonic_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
 };
 
-static int __init macsonic_init(struct net_device *dev)
+static int __devinit macsonic_init(struct net_device *dev)
 {
         struct sonic_local* lp = netdev_priv(dev);
 
@@ -223,7 +223,7 @@ static int __init macsonic_init(struct net_device *dev)
         return 0;
 }
 
-static int __init mac_onboard_sonic_ethernet_addr(struct net_device *dev)
+static int __devinit mac_onboard_sonic_ethernet_addr(struct net_device *dev)
 {
         struct sonic_local *lp = netdev_priv(dev);
         const int prom_addr = ONBOARD_SONIC_PROM_BASE;
@@ -288,7 +288,7 @@ static int __init mac_onboard_sonic_ethernet_addr(struct net_device *dev)
         } else return 0;
 }
 
-static int __init mac_onboard_sonic_probe(struct net_device *dev)
+static int __devinit mac_onboard_sonic_probe(struct net_device *dev)
 {
         /* Bwahahaha */
         static int once_is_more_than_enough;
@@ -409,7 +409,7 @@ static int __init mac_onboard_sonic_probe(struct net_device *dev)
         return macsonic_init(dev);
 }
 
-static int __init mac_nubus_sonic_ethernet_addr(struct net_device *dev,
+static int __devinit mac_nubus_sonic_ethernet_addr(struct net_device *dev,
                                                 unsigned long prom_addr,
                                                 int id)
 {
@@ -424,7 +424,7 @@ static int __init mac_nubus_sonic_ethernet_addr(struct net_device *dev,
         return 0;
 }
 
-static int __init macsonic_ident(struct nubus_dev *ndev)
+static int __devinit macsonic_ident(struct nubus_dev *ndev)
 {
         if (ndev->dr_hw == NUBUS_DRHW_ASANTE_LC &&
             ndev->dr_sw == NUBUS_DRSW_SONIC_LC)
@@ -449,7 +449,7 @@ static int __init macsonic_ident(struct nubus_dev *ndev)
         return -1;
 }
 
-static int __init mac_nubus_sonic_probe(struct net_device *dev)
+static int __devinit mac_nubus_sonic_probe(struct net_device *dev)
 {
         static int slots;
         struct nubus_dev* ndev = NULL;
@@ -562,7 +562,7 @@ static int __init mac_nubus_sonic_probe(struct net_device *dev)
         return macsonic_init(dev);
 }
 
-static int __init mac_sonic_probe(struct platform_device *pdev)
+static int __devinit mac_sonic_probe(struct platform_device *pdev)
 {
         struct net_device *dev;
         struct sonic_local *lp;
@@ -575,6 +575,7 @@ static int __init mac_sonic_probe(struct platform_device *pdev)
         lp = netdev_priv(dev);
         lp->device = &pdev->dev;
         SET_NETDEV_DEV(dev, &pdev->dev);
+        platform_set_drvdata(pdev, dev);
 
         /* This will catch fatal stuff like -ENOMEM as well as success */
         err = mac_onboard_sonic_probe(dev);
diff --git a/drivers/net/mlx4/cmd.c b/drivers/net/mlx4/cmd.c
index 2845a0560b84..65ec77dc31f5 100644
--- a/drivers/net/mlx4/cmd.c
+++ b/drivers/net/mlx4/cmd.c
@@ -80,7 +80,9 @@ enum {
         /* Bad management packet (silently discarded): */
         CMD_STAT_BAD_PKT        = 0x30,
         /* More outstanding CQEs in CQ than new CQ size: */
-        CMD_STAT_BAD_SIZE       = 0x40
+        CMD_STAT_BAD_SIZE       = 0x40,
+        /* Multi Function device support required: */
+        CMD_STAT_MULTI_FUNC_REQ = 0x50,
 };
 
 enum {
@@ -128,6 +130,7 @@ static int mlx4_status_to_errno(u8 status)
                 [CMD_STAT_LAM_NOT_PRE]    = -EAGAIN,
                 [CMD_STAT_BAD_PKT]        = -EINVAL,
                 [CMD_STAT_BAD_SIZE]       = -ENOMEM,
+                [CMD_STAT_MULTI_FUNC_REQ] = -EACCES,
         };
 
         if (status >= ARRAY_SIZE(trans_table) ||
diff --git a/drivers/net/mlx4/en_ethtool.c b/drivers/net/mlx4/en_ethtool.c
index 091f99052c91..86467b444ac6 100644
--- a/drivers/net/mlx4/en_ethtool.c
+++ b/drivers/net/mlx4/en_ethtool.c
@@ -220,7 +220,7 @@ static int mlx4_en_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         cmd->autoneg = AUTONEG_DISABLE;
         cmd->supported = SUPPORTED_10000baseT_Full;
-        cmd->advertising = SUPPORTED_10000baseT_Full;
+        cmd->advertising = ADVERTISED_1000baseT_Full;
         if (netif_carrier_ok(dev)) {
                 cmd->speed = SPEED_10000;
                 cmd->duplex = DUPLEX_FULL;
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index 018348c01193..dac621b1e9fc 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -729,7 +729,10 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
 
         err = mlx4_QUERY_FW(dev);
         if (err) {
-                mlx4_err(dev, "QUERY_FW command failed, aborting.\n");
+                if (err == -EACCES)
+                        mlx4_info(dev, "non-primary physical function, skipping.\n");
+                else
+                        mlx4_err(dev, "QUERY_FW command failed, aborting.\n");
                 return err;
         }
 
@@ -1285,6 +1288,7 @@ static struct pci_device_id mlx4_pci_table[] = {
         { PCI_VDEVICE(MELLANOX, 0x6750) }, /* MT25408 "Hermon" EN 10GigE PCIe gen2 */
         { PCI_VDEVICE(MELLANOX, 0x6372) }, /* MT25458 ConnectX EN 10GBASE-T 10GigE */
         { PCI_VDEVICE(MELLANOX, 0x675a) }, /* MT25458 ConnectX EN 10GBASE-T+Gen2 10GigE */
+        { PCI_VDEVICE(MELLANOX, 0x6764) }, /* MT26468 ConnectX EN 10GigE PCIe gen2*/
         { 0, }
 };
 
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index e1cdba752e09..f86e05047d19 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -210,6 +210,7 @@
 #define NETXEN_CTX_SIGNATURE    0xdee0
 #define NETXEN_CTX_SIGNATURE_V2 0x0002dee0
 #define NETXEN_CTX_RESET        0xbad0
+#define NETXEN_CTX_D3_RESET     0xacc0
 #define NETXEN_RCV_PRODUCER(ringid)     (ringid)
 
 #define PHAN_PEG_RCV_INITIALIZED        0xff01
@@ -773,6 +774,8 @@ struct nx_host_tx_ring {
         u32 crb_cmd_consumer;
         u32 num_desc;
 
+        struct netdev_queue *txq;
+
         struct netxen_cmd_buffer *cmd_buf_arr;
         struct cmd_desc_type0 *desc_head;
         dma_addr_t phys_addr;
diff --git a/drivers/net/netxen/netxen_nic_ctx.c b/drivers/net/netxen/netxen_nic_ctx.c
index 4754f5cffad0..9f8ae4719e2f 100644
--- a/drivers/net/netxen/netxen_nic_ctx.c
+++ b/drivers/net/netxen/netxen_nic_ctx.c
@@ -684,10 +684,8 @@ int netxen_alloc_hw_resources(struct netxen_adapter *adapter)
                         goto err_out_free;
         } else {
                 err = netxen_init_old_ctx(adapter);
-                if (err) {
-                        netxen_free_hw_resources(adapter);
-                        return err;
-                }
+                if (err)
+                        goto err_out_free;
         }
 
         return 0;
@@ -708,15 +706,18 @@ void netxen_free_hw_resources(struct netxen_adapter *adapter)
         int port = adapter->portnum;
 
         if (adapter->fw_major >= 4) {
-                nx_fw_cmd_destroy_tx_ctx(adapter);
                 nx_fw_cmd_destroy_rx_ctx(adapter);
+                nx_fw_cmd_destroy_tx_ctx(adapter);
         } else {
                 netxen_api_lock(adapter);
                 NXWR32(adapter, CRB_CTX_SIGNATURE_REG(port),
-                                NETXEN_CTX_RESET | port);
+                                NETXEN_CTX_D3_RESET | port);
                 netxen_api_unlock(adapter);
         }
 
+        /* Allow dma queues to drain after context reset */
+        msleep(20);
+
         recv_ctx = &adapter->recv_ctx;
 
         if (recv_ctx->hwctx != NULL) {
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index ce3b89d2cbb6..b9123d445c96 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -461,13 +461,14 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter,
         i = 0;
 
         tx_ring = adapter->tx_ring;
-        netif_tx_lock_bh(adapter->netdev);
+        __netif_tx_lock_bh(tx_ring->txq);
 
         producer = tx_ring->producer;
         consumer = tx_ring->sw_consumer;
 
-        if (nr_desc >= find_diff_among(producer, consumer, tx_ring->num_desc)) {
-                netif_tx_unlock_bh(adapter->netdev);
+        if (nr_desc >= netxen_tx_avail(tx_ring)) {
+                netif_tx_stop_queue(tx_ring->txq);
+                __netif_tx_unlock_bh(tx_ring->txq);
                 return -EBUSY;
         }
 
@@ -490,7 +491,7 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter,
 
         netxen_nic_update_cmd_producer(adapter, tx_ring);
 
-        netif_tx_unlock_bh(adapter->netdev);
+        __netif_tx_unlock_bh(tx_ring->txq);
 
         return 0;
 }
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index b899bd51fcd8..5d3343ef3d86 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -214,6 +214,7 @@ int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
         adapter->tx_ring = tx_ring;
 
         tx_ring->num_desc = adapter->num_txd;
+        tx_ring->txq = netdev_get_tx_queue(netdev, 0);
 
         cmd_buf_arr = vmalloc(TX_BUFF_RINGSIZE(tx_ring));
         if (cmd_buf_arr == NULL) {
@@ -1400,10 +1401,10 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter)
                 smp_mb();
 
                 if (netif_queue_stopped(netdev) && netif_carrier_ok(netdev)) {
-                        netif_tx_lock(netdev);
+                        __netif_tx_lock(tx_ring->txq, smp_processor_id());
                         if (netxen_tx_avail(tx_ring) > TX_STOP_THRESH)
                                 netif_wake_queue(netdev);
-                        netif_tx_unlock(netdev);
+                        __netif_tx_unlock(tx_ring->txq);
                 }
         }
         /*
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 27539ddf94c4..637ac8b89bac 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -215,9 +215,9 @@ netxen_napi_disable(struct netxen_adapter *adapter)
 
         for (ring = 0; ring < adapter->max_sds_rings; ring++) {
                 sds_ring = &recv_ctx->sds_rings[ring];
-                napi_disable(&sds_ring->napi);
                 netxen_nic_disable_int(sds_ring);
-                synchronize_irq(sds_ring->irq);
+                napi_synchronize(&sds_ring->napi);
+                napi_disable(&sds_ring->napi);
         }
 }
 
@@ -833,11 +833,11 @@ netxen_nic_up(struct netxen_adapter *adapter, struct net_device *netdev)
 
         adapter->ahw.linkup = 0;
 
-        netxen_napi_enable(adapter);
-
         if (adapter->max_sds_rings > 1)
                 netxen_config_rss(adapter, 1);
 
+        netxen_napi_enable(adapter);
+
         if (adapter->capabilities & NX_FW_CAPABILITY_LINK_NOTIFICATION)
                 netxen_linkevent_request(adapter, 1);
         else
@@ -851,8 +851,9 @@ netxen_nic_up(struct netxen_adapter *adapter, struct net_device *netdev)
 static void
 netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
 {
+        spin_lock(&adapter->tx_clean_lock);
         netif_carrier_off(netdev);
-        netif_stop_queue(netdev);
+        netif_tx_disable(netdev);
 
         if (adapter->stop_port)
                 adapter->stop_port(adapter);
@@ -863,9 +864,10 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
         netxen_napi_disable(adapter);
 
         netxen_release_tx_buffers(adapter);
+        spin_unlock(&adapter->tx_clean_lock);
 
-        FLUSH_SCHEDULED_WORK();
         del_timer_sync(&adapter->watchdog_timer);
+        FLUSH_SCHEDULED_WORK();
 }
 
 
@@ -943,8 +945,8 @@ err_out_free_sw:
 static void
 netxen_nic_detach(struct netxen_adapter *adapter)
 {
-        netxen_release_rx_buffers(adapter);
         netxen_free_hw_resources(adapter);
+        netxen_release_rx_buffers(adapter);
         netxen_nic_free_irq(adapter);
         netxen_free_sw_resources(adapter);
 
@@ -1533,10 +1535,12 @@ static int netxen_nic_check_temp(struct netxen_adapter *adapter)
                 printk(KERN_ALERT
                        "%s: Device temperature %d degrees C exceeds"
                        " maximum allowed. Hardware has been shut down.\n",
-                       netxen_nic_driver_name, temp_val);
+                       netdev->name, temp_val);
+
+                netif_device_detach(netdev);
+                netxen_nic_down(adapter, netdev);
+                netxen_nic_detach(adapter);
 
-                netif_carrier_off(netdev);
-                netif_stop_queue(netdev);
                 rv = 1;
         } else if (temp_state == NX_TEMP_WARN) {
                 if (adapter->temp == NX_TEMP_NORMAL) {
@@ -1544,13 +1548,13 @@ static int netxen_nic_check_temp(struct netxen_adapter *adapter)
                                "%s: Device temperature %d degrees C "
                                "exceeds operating range."
                                " Immediate action needed.\n",
-                               netxen_nic_driver_name, temp_val);
+                               netdev->name, temp_val);
                 }
         } else {
                 if (adapter->temp == NX_TEMP_WARN) {
                         printk(KERN_INFO
                                "%s: Device temperature is now %d degrees C"
-                               " in normal range.\n", netxen_nic_driver_name,
+                               " in normal range.\n", netdev->name,
                                temp_val);
                 }
         }
@@ -1623,7 +1627,7 @@ void netxen_watchdog_task(struct work_struct *work)
         struct netxen_adapter *adapter =
                 container_of(work, struct netxen_adapter, watchdog_task);
 
-        if ((adapter->portnum  == 0) && netxen_nic_check_temp(adapter))
+        if (netxen_nic_check_temp(adapter))
                 return;
 
         if (!adapter->has_link_events)
@@ -1645,6 +1649,9 @@ static void netxen_tx_timeout_task(struct work_struct *work)
         struct netxen_adapter *adapter =
                 container_of(work, struct netxen_adapter, tx_timeout_task);
 
+        if (!netif_running(adapter->netdev))
+                return;
+
         printk(KERN_ERR "%s %s: transmit timeout, resetting.\n",
                netxen_nic_driver_name, adapter->netdev->name);
 
@@ -1757,7 +1764,8 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
 
         if ((work_done < budget) && tx_complete) {
                 napi_complete(&sds_ring->napi);
-                netxen_nic_enable_int(sds_ring);
+                if (netif_running(adapter->netdev))
+                        netxen_nic_enable_int(sds_ring);
         }
 
         return work_done;
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index ec7cf5ac4f05..690b9c76d34e 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -156,6 +156,7 @@ static struct net_device_stats *el3_get_stats(struct net_device *dev);
 static int el3_rx(struct net_device *dev);
 static int el3_close(struct net_device *dev);
 static void el3_tx_timeout(struct net_device *dev);
+static void set_rx_mode(struct net_device *dev);
 static void set_multicast_list(struct net_device *dev);
 static const struct ethtool_ops netdev_ethtool_ops;
 
@@ -488,8 +489,7 @@ static void tc589_reset(struct net_device *dev)
     /* Switch to register set 1 for normal use. */
     EL3WINDOW(1);
 
-    /* Accept b-cast and phys addr only. */
-    outw(SetRxFilter | RxStation | RxBroadcast, ioaddr + EL3_CMD);
+    set_rx_mode(dev);
     outw(StatsEnable, ioaddr + EL3_CMD); /* Turn on statistics. */
     outw(RxEnable, ioaddr + EL3_CMD); /* Enable the receiver. */
     outw(TxEnable, ioaddr + EL3_CMD); /* Enable transmitter. */
@@ -700,7 +700,7 @@ static irqreturn_t el3_interrupt(int irq, void *dev_id)
                 if (fifo_diag & 0x2000) {
                     /* Rx underrun */
                     tc589_wait_for_completion(dev, RxReset);
-                    set_multicast_list(dev);
+                    set_rx_mode(dev);
                     outw(RxEnable, ioaddr + EL3_CMD);
                 }
                 outw(AckIntr | AdapterFailure, ioaddr + EL3_CMD);
@@ -905,14 +905,11 @@ static int el3_rx(struct net_device *dev)
     return 0;
 }
 
-static void set_multicast_list(struct net_device *dev)
+static void set_rx_mode(struct net_device *dev)
 {
-    struct el3_private *lp = netdev_priv(dev);
-    struct pcmcia_device *link = lp->p_dev;
     unsigned int ioaddr = dev->base_addr;
     u16 opts = SetRxFilter | RxStation | RxBroadcast;
 
-    if (!pcmcia_dev_present(link)) return;
     if (dev->flags & IFF_PROMISC)
         opts |= RxMulticast | RxProm;
     else if (dev->mc_count || (dev->flags & IFF_ALLMULTI))
@@ -920,6 +917,16 @@ static void set_multicast_list(struct net_device *dev)
     outw(opts, ioaddr + EL3_CMD);
 }
 
+static void set_multicast_list(struct net_device *dev)
+{
+        struct el3_private *priv = netdev_priv(dev);
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        set_rx_mode(dev);
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
 static int el3_close(struct net_device *dev)
 {
     struct el3_private *lp = netdev_priv(dev);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index eba937c46376..b10fedd82143 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -134,8 +134,10 @@ int phy_scan_fixups(struct phy_device *phydev)
 
                         err = fixup->run(phydev);
 
-                        if (err < 0)
+                        if (err < 0) {
+                                mutex_unlock(&phy_fixup_lock);
                                 return err;
+                        }
                 }
         }
         mutex_unlock(&phy_fixup_lock);
diff --git a/drivers/net/plip.c b/drivers/net/plip.c
index 7a62f781fef2..2ca8b0d84ee2 100644
--- a/drivers/net/plip.c
+++ b/drivers/net/plip.c
@@ -270,6 +270,9 @@ static const struct net_device_ops plip_netdev_ops = {
         .ndo_stop                = plip_close,
         .ndo_start_xmit          = plip_tx_packet,
         .ndo_do_ioctl            = plip_ioctl,
+        .ndo_change_mtu          = eth_change_mtu,
+        .ndo_set_mac_address     = eth_mac_addr,
+        .ndo_validate_addr       = eth_validate_addr,
 };
 
 /* Entry point of PLIP driver.
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 17c116bb332c..6de8399d6dd9 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -356,6 +356,7 @@ ppp_asynctty_receive(struct tty_struct *tty, const unsigned char *buf,
         if (!skb_queue_empty(&ap->rqueue))
                 tasklet_schedule(&ap->tsk);
         ap_put(ap);
+        tty_unthrottle(tty);
 }
 
 static void
diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
index aa3d39f38e22..d2fa2db13586 100644
--- a/drivers/net/ppp_synctty.c
+++ b/drivers/net/ppp_synctty.c
@@ -397,6 +397,7 @@ ppp_sync_receive(struct tty_struct *tty, const unsigned char *buf,
         if (!skb_queue_empty(&ap->rqueue))
                 tasklet_schedule(&ap->tsk);
         sp_put(ap);
+        tty_unthrottle(tty);
 }
 
 static void
diff --git a/drivers/net/ps3_gelic_net.c b/drivers/net/ps3_gelic_net.c
index d1a5fb4d6acb..a3932c9f3406 100644
--- a/drivers/net/ps3_gelic_net.c
+++ b/drivers/net/ps3_gelic_net.c
@@ -1411,6 +1411,7 @@ static const struct net_device_ops gelic_netdevice_ops = {
         .ndo_set_multicast_list = gelic_net_set_multi,
         .ndo_change_mtu = gelic_net_change_mtu,
         .ndo_tx_timeout = gelic_net_tx_timeout,
+        .ndo_set_mac_address = eth_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = gelic_net_poll_controller,
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index b6b3ca9bdb21..6932b08d746b 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -2707,6 +2707,7 @@ static const struct net_device_ops gelic_wl_netdevice_ops = {
         .ndo_set_multicast_list = gelic_net_set_multi,
         .ndo_change_mtu = gelic_net_change_mtu,
         .ndo_tx_timeout = gelic_net_tx_timeout,
+        .ndo_set_mac_address = eth_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = gelic_net_poll_controller,
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index 18821f217e19..e3156c97bb58 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -1593,6 +1593,7 @@ out:
 static struct pci_device_id sc92031_pci_device_id_table[] __devinitdata = {
         { PCI_DEVICE(PCI_VENDOR_ID_SILAN, 0x2031) },
         { PCI_DEVICE(PCI_VENDOR_ID_SILAN, 0x8139) },
+        { PCI_DEVICE(0x1088, 0x2031) },
         { 0, }
 };
 MODULE_DEVICE_TABLE(pci, sc92031_pci_device_id_table);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index daf961ab68bc..3550c5dcd93c 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1151,14 +1151,7 @@ stopped:
 
         /* reset the Rx prefetch unit */
         sky2_write32(hw, Y2_QADDR(rxq, PREF_UNIT_CTRL), PREF_UNIT_RST_SET);
-
-        /* Reset the RAM Buffer receive queue */
-        sky2_write8(hw, RB_ADDR(rxq, RB_CTRL), RB_RST_SET);
-
-        /* Reset Rx MAC FIFO */
-        sky2_write8(hw, SK_REG(sky2->port, RX_GMF_CTRL_T), GMF_RST_SET);
-
-        sky2_read8(hw, B0_CTST);
+        mmiowb();
 }
 
 /* Clean out receive buffer area, assumes receiver hardware stopped */
@@ -1825,12 +1818,6 @@ static int sky2_down(struct net_device *dev)
         if (netif_msg_ifdown(sky2))
                 printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
 
-        /* Disable port IRQ */
-        imask = sky2_read32(hw, B0_IMSK);
-        imask &= ~portirq_msk[port];
-        sky2_write32(hw, B0_IMSK, imask);
-        sky2_read32(hw, B0_IMSK);
-
         /* Force flow control off */
         sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
 
@@ -1870,8 +1857,6 @@ static int sky2_down(struct net_device *dev)
 
         sky2_write32(hw, RB_ADDR(txqaddr[port], RB_CTRL), RB_RST_SET);
 
-        sky2_rx_stop(sky2);
-
         sky2_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_SET);
         sky2_write8(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_RST_SET);
 
@@ -1881,6 +1866,14 @@ static int sky2_down(struct net_device *dev)
         sky2_write32(hw, STAT_ISR_TIMER_CNT, 0);
         sky2_read8(hw, STAT_ISR_TIMER_CTRL);
 
+        sky2_rx_stop(sky2);
+
+        /* Disable port IRQ */
+        imask = sky2_read32(hw, B0_IMSK);
+        imask &= ~portirq_msk[port];
+        sky2_write32(hw, B0_IMSK, imask);
+        sky2_read32(hw, B0_IMSK);
+
         synchronize_irq(hw->pdev->irq);
         napi_synchronize(&hw->napi);
 
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index fdcbaf8dfa73..1c70e999cc50 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -1774,6 +1774,7 @@ static const struct net_device_ops smc_netdev_ops = {
         .ndo_start_xmit         = smc_hard_start_xmit,
         .ndo_tx_timeout         = smc_timeout,
         .ndo_set_multicast_list = smc_set_multicast_list,
+        .ndo_change_mtu         = eth_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
 #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index 66067f9d91c0..94b6d2658ddc 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -1779,6 +1779,7 @@ static const struct net_device_ops smsc911x_netdev_ops = {
         .ndo_get_stats          = smsc911x_get_stats,
         .ndo_set_multicast_list = smsc911x_set_multicast_list,
         .ndo_do_ioctl           = smsc911x_do_ioctl,
+        .ndo_change_mtu         = eth_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = smsc911x_set_mac_address,
 #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/drivers/net/sunvnet.c b/drivers/net/sunvnet.c
index a82fb2aca4cb..f1e5e4542c2a 100644
--- a/drivers/net/sunvnet.c
+++ b/drivers/net/sunvnet.c
@@ -1016,7 +1016,9 @@ static const struct net_device_ops vnet_ops = {
         .ndo_open               = vnet_open,
         .ndo_stop               = vnet_close,
         .ndo_set_multicast_list = vnet_set_rx_mode,
+        .ndo_change_mtu         = eth_change_mtu,
         .ndo_set_mac_address    = vnet_set_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
         .ndo_tx_timeout         = vnet_tx_timeout,
         .ndo_change_mtu         = vnet_change_mtu,
         .ndo_start_xmit         = vnet_start_xmit,
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index a906d3998131..c47237c2d638 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -369,4 +369,12 @@ config USB_NET_INT51X1
           (Powerline Communications) solution with an Intellon
           INT51x1/INT5200 chip, like the "devolo dLan duo".
 
+config USB_CDC_PHONET
+        tristate "CDC Phonet support"
+        depends on PHONET
+        help
+          Choose this option to support the Phonet interface to a Nokia
+          cellular modem, as found on most Nokia handsets with the
+          "PC suite" USB profile.
+
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index b870b0b1cbe0..e17afb78f372 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -21,4 +21,5 @@ obj-$(CONFIG_USB_NET_ZAURUS)	+= zaurus.o
 obj-$(CONFIG_USB_NET_MCS7830)   += mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
+obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
 
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
new file mode 100644
index 000000000000..792af72da8ac
--- /dev/null
+++ b/drivers/net/usb/cdc-phonet.c
@@ -0,0 +1,461 @@
+/*
+ * phonet.c -- USB CDC Phonet host driver
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation. All rights reserved.
+ *
+ * Author: Rémi Denis-Courmont
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/if_phonet.h>
+
+#define PN_MEDIA_USB    0x1B
+
+static const unsigned rxq_size = 17;
+
+struct usbpn_dev {
+        struct net_device       *dev;
+
+        struct usb_interface    *intf, *data_intf;
+        struct usb_device       *usb;
+        unsigned int            tx_pipe, rx_pipe;
+        u8 active_setting;
+        u8 disconnected;
+
+        unsigned                tx_queue;
+        spinlock_t              tx_lock;
+
+        spinlock_t              rx_lock;
+        struct sk_buff          *rx_skb;
+        struct urb              *urbs[0];
+};
+
+static void tx_complete(struct urb *req);
+static void rx_complete(struct urb *req);
+
+/*
+ * Network device callbacks
+ */
+static int usbpn_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct usbpn_dev *pnd = netdev_priv(dev);
+        struct urb *req = NULL;
+        unsigned long flags;
+        int err;
+
+        if (skb->protocol != htons(ETH_P_PHONET))
+                goto drop;
+
+        req = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!req)
+                goto drop;
+        usb_fill_bulk_urb(req, pnd->usb, pnd->tx_pipe, skb->data, skb->len,
+                                tx_complete, skb);
+        req->transfer_flags = URB_ZERO_PACKET;
+        err = usb_submit_urb(req, GFP_ATOMIC);
+        if (err) {
+                usb_free_urb(req);
+                goto drop;
+        }
+
+        spin_lock_irqsave(&pnd->tx_lock, flags);
+        pnd->tx_queue++;
+        if (pnd->tx_queue >= dev->tx_queue_len)
+                netif_stop_queue(dev);
+        spin_unlock_irqrestore(&pnd->tx_lock, flags);
+        return 0;
+
+drop:
+        dev_kfree_skb(skb);
+        dev->stats.tx_dropped++;
+        return 0;
+}
+
+static void tx_complete(struct urb *req)
+{
+        struct sk_buff *skb = req->context;
+        struct net_device *dev = skb->dev;
+        struct usbpn_dev *pnd = netdev_priv(dev);
+
+        switch (req->status) {
+        case 0:
+                dev->stats.tx_bytes += skb->len;
+                break;
+
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                dev->stats.tx_aborted_errors++;
+        default:
+                dev->stats.tx_errors++;
+                dev_dbg(&dev->dev, "TX error (%d)\n", req->status);
+        }
+        dev->stats.tx_packets++;
+
+        spin_lock(&pnd->tx_lock);
+        pnd->tx_queue--;
+        netif_wake_queue(dev);
+        spin_unlock(&pnd->tx_lock);
+
+        dev_kfree_skb_any(skb);
+        usb_free_urb(req);
+}
+
+static int rx_submit(struct usbpn_dev *pnd, struct urb *req, gfp_t gfp_flags)
+{
+        struct net_device *dev = pnd->dev;
+        struct page *page;
+        int err;
+
+        page = __netdev_alloc_page(dev, gfp_flags);
+        if (!page)
+                return -ENOMEM;
+
+        usb_fill_bulk_urb(req, pnd->usb, pnd->rx_pipe, page_address(page),
+                                PAGE_SIZE, rx_complete, dev);
+        req->transfer_flags = 0;
+        err = usb_submit_urb(req, gfp_flags);
+        if (unlikely(err)) {
+                dev_dbg(&dev->dev, "RX submit error (%d)\n", err);
+                netdev_free_page(dev, page);
+        }
+        return err;
+}
+
+static void rx_complete(struct urb *req)
+{
+        struct net_device *dev = req->context;
+        struct usbpn_dev *pnd = netdev_priv(dev);
+        struct page *page = virt_to_page(req->transfer_buffer);
+        struct sk_buff *skb;
+        unsigned long flags;
+
+        switch (req->status) {
+        case 0:
+                spin_lock_irqsave(&pnd->rx_lock, flags);
+                skb = pnd->rx_skb;
+                if (!skb) {
+                        skb = pnd->rx_skb = netdev_alloc_skb(dev, 12);
+                        if (likely(skb)) {
+                                /* Can't use pskb_pull() on page in IRQ */
+                                memcpy(skb_put(skb, 1), page_address(page), 1);
+                                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+                                                page, 1, req->actual_length);
+                                page = NULL;
+                        }
+                } else {
+                        skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+                                        page, 0, req->actual_length);
+                        page = NULL;
+                }
+                if (req->actual_length < PAGE_SIZE)
+                        pnd->rx_skb = NULL; /* Last fragment */
+                else
+                        skb = NULL;
+                spin_unlock_irqrestore(&pnd->rx_lock, flags);
+                if (skb) {
+                        skb->protocol = htons(ETH_P_PHONET);
+                        skb_reset_mac_header(skb);
+                        __skb_pull(skb, 1);
+                        skb->dev = dev;
+                        dev->stats.rx_packets++;
+                        dev->stats.rx_bytes += skb->len;
+
+                        netif_rx(skb);
+                }
+                goto resubmit;
+
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                req = NULL;
+                break;
+
+        case -EOVERFLOW:
+                dev->stats.rx_over_errors++;
+                dev_dbg(&dev->dev, "RX overflow\n");
+                break;
+
+        case -EILSEQ:
+                dev->stats.rx_crc_errors++;
+                break;
+        }
+
+        dev->stats.rx_errors++;
+resubmit:
+        if (page)
+                netdev_free_page(dev, page);
+        if (req)
+                rx_submit(pnd, req, GFP_ATOMIC);
+}
+
+static int usbpn_close(struct net_device *dev);
+
+static int usbpn_open(struct net_device *dev)
+{
+        struct usbpn_dev *pnd = netdev_priv(dev);
+        int err;
+        unsigned i;
+        unsigned num = pnd->data_intf->cur_altsetting->desc.bInterfaceNumber;
+
+        err = usb_set_interface(pnd->usb, num, pnd->active_setting);
+        if (err)
+                return err;
+
+        for (i = 0; i < rxq_size; i++) {
+                struct urb *req = usb_alloc_urb(0, GFP_KERNEL);
+
+                if (!req || rx_submit(pnd, req, GFP_KERNEL)) {
+                        usbpn_close(dev);
+                        return -ENOMEM;
+                }
+                pnd->urbs[i] = req;
+        }
+
+        netif_wake_queue(dev);
+        return 0;
+}
+
+static int usbpn_close(struct net_device *dev)
+{
+        struct usbpn_dev *pnd = netdev_priv(dev);
+        unsigned i;
+        unsigned num = pnd->data_intf->cur_altsetting->desc.bInterfaceNumber;
+
+        netif_stop_queue(dev);
+
+        for (i = 0; i < rxq_size; i++) {
+                struct urb *req = pnd->urbs[i];
+
+                if (!req)
+                        continue;
+                usb_kill_urb(req);
+                usb_free_urb(req);
+                pnd->urbs[i] = NULL;
+        }
+
+        return usb_set_interface(pnd->usb, num, !pnd->active_setting);
+}
+
+static int usbpn_set_mtu(struct net_device *dev, int new_mtu)
+{
+        if ((new_mtu < PHONET_MIN_MTU) || (new_mtu > PHONET_MAX_MTU))
+                return -EINVAL;
+
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+static const struct net_device_ops usbpn_ops = {
+        .ndo_open       = usbpn_open,
+        .ndo_stop       = usbpn_close,
+        .ndo_start_xmit = usbpn_xmit,
+        .ndo_change_mtu = usbpn_set_mtu,
+};
+
+static void usbpn_setup(struct net_device *dev)
+{
+        dev->features           = 0;
+        dev->netdev_ops         = &usbpn_ops,
+        dev->header_ops         = &phonet_header_ops;
+        dev->type               = ARPHRD_PHONET;
+        dev->flags              = IFF_POINTOPOINT | IFF_NOARP;
+        dev->mtu                = PHONET_MAX_MTU;
+        dev->hard_header_len    = 1;
+        dev->dev_addr[0]        = PN_MEDIA_USB;
+        dev->addr_len           = 1;
+        dev->tx_queue_len       = 3;
+
+        dev->destructor         = free_netdev;
+}
+
+/*
+ * USB driver callbacks
+ */
+static struct usb_device_id usbpn_ids[] = {
+        {
+                .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+                        | USB_DEVICE_ID_MATCH_INT_CLASS
+                        | USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+                .idVendor = 0x0421, /* Nokia */
+                .bInterfaceClass = USB_CLASS_COMM,
+                .bInterfaceSubClass = 0xFE,
+        },
+        { },
+};
+
+MODULE_DEVICE_TABLE(usb, usbpn_ids);
+
+static struct usb_driver usbpn_driver;
+
+int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+        static const char ifname[] = "usbpn%d";
+        const struct usb_cdc_union_desc *union_header = NULL;
+        const struct usb_cdc_header_desc *phonet_header = NULL;
+        const struct usb_host_interface *data_desc;
+        struct usb_interface *data_intf;
+        struct usb_device *usbdev = interface_to_usbdev(intf);
+        struct net_device *dev;
+        struct usbpn_dev *pnd;
+        u8 *data;
+        int len, err;
+
+        data = intf->altsetting->extra;
+        len = intf->altsetting->extralen;
+        while (len >= 3) {
+                u8 dlen = data[0];
+                if (dlen < 3)
+                        return -EINVAL;
+
+                /* bDescriptorType */
+                if (data[1] == USB_DT_CS_INTERFACE) {
+                        /* bDescriptorSubType */
+                        switch (data[2]) {
+                        case USB_CDC_UNION_TYPE:
+                                if (union_header || dlen < 5)
+                                        break;
+                                union_header =
+                                        (struct usb_cdc_union_desc *)data;
+                                break;
+                        case 0xAB:
+                                if (phonet_header || dlen < 5)
+                                        break;
+                                phonet_header =
+                                        (struct usb_cdc_header_desc *)data;
+                                break;
+                        }
+                }
+                data += dlen;
+                len -= dlen;
+        }
+
+        if (!union_header || !phonet_header)
+                return -EINVAL;
+
+        data_intf = usb_ifnum_to_if(usbdev, union_header->bSlaveInterface0);
+        if (data_intf == NULL)
+                return -ENODEV;
+        /* Data interface has one inactive and one active setting */
+        if (data_intf->num_altsetting != 2)
+                return -EINVAL;
+        if (data_intf->altsetting[0].desc.bNumEndpoints == 0
+         && data_intf->altsetting[1].desc.bNumEndpoints == 2)
+                data_desc = data_intf->altsetting + 1;
+        else
+        if (data_intf->altsetting[0].desc.bNumEndpoints == 2
+         && data_intf->altsetting[1].desc.bNumEndpoints == 0)
+                data_desc = data_intf->altsetting;
+        else
+                return -EINVAL;
+
+        dev = alloc_netdev(sizeof(*pnd) + sizeof(pnd->urbs[0]) * rxq_size,
+                                ifname, usbpn_setup);
+        if (!dev)
+                return -ENOMEM;
+
+        pnd = netdev_priv(dev);
+        SET_NETDEV_DEV(dev, &intf->dev);
+        netif_stop_queue(dev);
+
+        pnd->dev = dev;
+        pnd->usb = usb_get_dev(usbdev);
+        pnd->intf = intf;
+        pnd->data_intf = data_intf;
+        spin_lock_init(&pnd->tx_lock);
+        spin_lock_init(&pnd->rx_lock);
+        /* Endpoints */
+        if (usb_pipein(data_desc->endpoint[0].desc.bEndpointAddress)) {
+                pnd->rx_pipe = usb_rcvbulkpipe(usbdev,
+                        data_desc->endpoint[0].desc.bEndpointAddress);
+                pnd->tx_pipe = usb_sndbulkpipe(usbdev,
+                        data_desc->endpoint[1].desc.bEndpointAddress);
+        } else {
+                pnd->rx_pipe = usb_rcvbulkpipe(usbdev,
+                        data_desc->endpoint[1].desc.bEndpointAddress);
+                pnd->tx_pipe = usb_sndbulkpipe(usbdev,
+                        data_desc->endpoint[0].desc.bEndpointAddress);
+        }
+        pnd->active_setting = data_desc - data_intf->altsetting;
+
+        err = usb_driver_claim_interface(&usbpn_driver, data_intf, pnd);
+        if (err)
+                goto out;
+
+        /* Force inactive mode until the network device is brought UP */
+        usb_set_interface(usbdev, union_header->bSlaveInterface0,
+                                !pnd->active_setting);
+        usb_set_intfdata(intf, pnd);
+
+        err = register_netdev(dev);
+        if (err) {
+                usb_driver_release_interface(&usbpn_driver, data_intf);
+                goto out;
+        }
+
+        dev_dbg(&dev->dev, "USB CDC Phonet device found\n");
+        return 0;
+
+out:
+        usb_set_intfdata(intf, NULL);
+        free_netdev(dev);
+        return err;
+}
+
+static void usbpn_disconnect(struct usb_interface *intf)
+{
+        struct usbpn_dev *pnd = usb_get_intfdata(intf);
+        struct usb_device *usb = pnd->usb;
+
+        if (pnd->disconnected)
+                return;
+
+        pnd->disconnected = 1;
+        usb_driver_release_interface(&usbpn_driver,
+                        (pnd->intf == intf) ? pnd->data_intf : pnd->intf);
+        unregister_netdev(pnd->dev);
+        usb_put_dev(usb);
+}
+
+static struct usb_driver usbpn_driver = {
+        .name =         "cdc_phonet",
+        .probe =        usbpn_probe,
+        .disconnect =   usbpn_disconnect,
+        .id_table =     usbpn_ids,
+};
+
+static int __init usbpn_init(void)
+{
+        return usb_register(&usbpn_driver);
+}
+
+static void __exit usbpn_exit(void)
+{
+        usb_deregister(&usbpn_driver);
+}
+
+module_init(usbpn_init);
+module_exit(usbpn_exit);
+
+MODULE_AUTHOR("Remi Denis-Courmont");
+MODULE_DESCRIPTION("USB CDC Phonet host interface");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
index cd35d50e46d4..45cebfb302cf 100644
--- a/drivers/net/usb/cdc_eem.c
+++ b/drivers/net/usb/cdc_eem.c
@@ -311,7 +311,7 @@ static int eem_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                          *      bmCRC = 0       : CRC = 0xDEADBEEF
                          */
                         if (header & BIT(14))
-                                crc2 = ~crc32_le(~0, skb2->data, len);
+                                crc2 = ~crc32_le(~0, skb2->data, skb2->len);
                         else
                                 crc2 = 0xdeadbeef;
 
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index e01314789718..1f9ec29fce50 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -999,6 +999,9 @@ static const struct net_device_ops kaweth_netdev_ops = {
         .ndo_tx_timeout =               kaweth_tx_timeout,
         .ndo_set_multicast_list =       kaweth_set_rx_mode,
         .ndo_get_stats =                kaweth_netdev_stats,
+        .ndo_change_mtu =               eth_change_mtu,
+        .ndo_set_mac_address =          eth_mac_addr,
+        .ndo_validate_addr =            eth_validate_addr,
 };
 
 static int kaweth_probe(
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index 73acbd244aa1..631d269ac980 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -1493,6 +1493,9 @@ static const struct net_device_ops pegasus_netdev_ops = {
         .ndo_set_multicast_list =       pegasus_set_multicast,
         .ndo_get_stats =                pegasus_netdev_stats,
         .ndo_tx_timeout =               pegasus_tx_timeout,
+        .ndo_change_mtu =               eth_change_mtu,
+        .ndo_set_mac_address =          eth_mac_addr,
+        .ndo_validate_addr =            eth_validate_addr,
 };
 
 static struct usb_driver pegasus_driver = {
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index d3489a3c4c03..88c30a58b4bd 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -621,6 +621,7 @@ static const struct net_device_ops rhine_netdev_ops = {
         .ndo_start_xmit          = rhine_start_tx,
         .ndo_get_stats           = rhine_get_stats,
         .ndo_set_multicast_list  = rhine_set_rx_mode,
+        .ndo_change_mtu          = eth_change_mtu,
         .ndo_validate_addr       = eth_validate_addr,
         .ndo_set_mac_address     = eth_mac_addr,
         .ndo_do_ioctl            = netdev_ioctl,
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index 345593c4accb..a370e510f19f 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -2521,6 +2521,8 @@ static const struct net_device_ops orinoco_netdev_ops = {
         .ndo_start_xmit         = orinoco_xmit,
         .ndo_set_multicast_list = orinoco_set_multicast_list,
         .ndo_change_mtu         = orinoco_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
         .ndo_tx_timeout         = orinoco_tx_timeout,
         .ndo_get_stats          = orinoco_get_stats,
 };
@@ -2555,7 +2557,6 @@ struct net_device
         priv->wireless_data.spy_data = &priv->spy_data;
         dev->wireless_data = &priv->wireless_data;
 #endif
-        /* we use the default eth_mac_addr for setting the MAC addr */
 
         /* Reserve space in skb for the SNAP header */
         dev->hard_header_len += ENCAPS_OVERHEAD;
diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
index e1f6ce03705e..3c2270a8300c 100644
--- a/drivers/oprofile/oprofile_stats.c
+++ b/drivers/oprofile/oprofile_stats.c
@@ -33,6 +33,7 @@ void oprofile_reset_stats(void)
         atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
         atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
         atomic_set(&oprofile_stats.event_lost_overflow, 0);
+        atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
 }
 
 
diff --git a/drivers/pci/hotplug/cpci_hotplug_core.c b/drivers/pci/hotplug/cpci_hotplug_core.c
index a5b9f6ae507b..d703e73fffa7 100644
--- a/drivers/pci/hotplug/cpci_hotplug_core.c
+++ b/drivers/pci/hotplug/cpci_hotplug_core.c
@@ -32,7 +32,6 @@
 #include <linux/pci_hotplug.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
-#include <linux/smp_lock.h>
 #include <asm/atomic.h>
 #include <linux/delay.h>
 #include <linux/kthread.h>
diff --git a/drivers/pci/hotplug/cpqphp_ctrl.c b/drivers/pci/hotplug/cpqphp_ctrl.c
index 2fa47af992a8..0ff689afa757 100644
--- a/drivers/pci/hotplug/cpqphp_ctrl.c
+++ b/drivers/pci/hotplug/cpqphp_ctrl.c
@@ -34,7 +34,6 @@
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/wait.h>
-#include <linux/smp_lock.h>
 #include <linux/pci.h>
 #include <linux/pci_hotplug.h>
 #include <linux/kthread.h>
diff --git a/drivers/pci/hotplug/cpqphp_sysfs.c b/drivers/pci/hotplug/cpqphp_sysfs.c
index 8450f4a6568a..e6089bdb6e5b 100644
--- a/drivers/pci/hotplug/cpqphp_sysfs.c
+++ b/drivers/pci/hotplug/cpqphp_sysfs.c
@@ -33,6 +33,7 @@
 #include <linux/workqueue.h>
 #include <linux/pci.h>
 #include <linux/pci_hotplug.h>
+#include <linux/smp_lock.h>
 #include <linux/debugfs.h>
 #include "cpqphp.h"
 
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index ff4034502d24..8aab8edf123e 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -30,7 +30,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/smp_lock.h>
 #include <linux/pci.h>
 #include <linux/workqueue.h>
 #include "../pci.h"
diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
index ec22284eed30..e1c1ec540893 100644
--- a/drivers/pci/syscall.c
+++ b/drivers/pci/syscall.c
@@ -9,7 +9,6 @@
 
 #include <linux/errno.h>
 #include <linux/pci.h>
-#include <linux/smp_lock.h>
 #include <linux/syscalls.h>
 #include <asm/uaccess.h>
 #include "pci.h"
diff --git a/drivers/power/wm97xx_battery.c b/drivers/power/wm97xx_battery.c
index 8bde92126d34..b787335a8419 100644
--- a/drivers/power/wm97xx_battery.c
+++ b/drivers/power/wm97xx_battery.c
@@ -33,14 +33,14 @@ static enum power_supply_property *prop;
 
 static unsigned long wm97xx_read_bat(struct power_supply *bat_ps)
 {
-        return wm97xx_read_aux_adc(bat_ps->dev->parent->driver_data,
+        return wm97xx_read_aux_adc(dev_get_drvdata(bat_ps->dev->parent),
                                         pdata->batt_aux) * pdata->batt_mult /
                                         pdata->batt_div;
 }
 
 static unsigned long wm97xx_read_temp(struct power_supply *bat_ps)
 {
-        return wm97xx_read_aux_adc(bat_ps->dev->parent->driver_data,
+        return wm97xx_read_aux_adc(dev_get_drvdata(bat_ps->dev->parent),
                                         pdata->temp_aux) * pdata->temp_mult /
                                         pdata->temp_div;
 }
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index f8b1f04f26b8..c11770f5b368 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -1696,8 +1696,7 @@ static void dasd_eckd_handle_unsolicited_interrupt(struct dasd_device *device,
                 DBF_DEV_EVENT(DBF_ERR, device, "%s",
                             "unsolicited interrupt received "
                             "(sense available)");
-                device->discipline->dump_sense_dbf(device, NULL, irb,
-                                                   "unsolicited");
+                device->discipline->dump_sense_dbf(device, irb, "unsolicited");
         }
 
         dasd_schedule_device_bh(device);
@@ -2941,42 +2940,20 @@ dasd_eckd_dump_ccw_range(struct ccw1 *from, struct ccw1 *to, char *page)
 }
 
 static void
-dasd_eckd_dump_sense_dbf(struct dasd_device *device, struct dasd_ccw_req *req,
-                         struct irb *irb, char *reason)
+dasd_eckd_dump_sense_dbf(struct dasd_device *device, struct irb *irb,
+                         char *reason)
 {
         u64 *sense;
-        int sl;
-        struct tsb *tsb;
 
-        sense = NULL;
-        tsb = NULL;
-        if (req && scsw_is_tm(&req->irb.scsw)) {
-                if (irb->scsw.tm.tcw)
-                        tsb = tcw_get_tsb(
-                                (struct tcw *)(unsigned long)irb->scsw.tm.tcw);
-                if (tsb && (irb->scsw.tm.fcxs == 0x01)) {
-                        switch (tsb->flags & 0x07) {
-                        case 1: /* tsa_iostat */
-                                sense = (u64 *)tsb->tsa.iostat.sense;
-                        break;
-                        case 2: /* ts_ddpc */
-                                sense = (u64 *)tsb->tsa.ddpc.sense;
-                        break;
-                        case 3: /* tsa_intrg */
-                        break;
-                        }
-                }
-        } else {
-                if (irb->esw.esw0.erw.cons)
-                        sense = (u64 *)irb->ecw;
-        }
+        sense = (u64 *) dasd_get_sense(irb);
         if (sense) {
-                for (sl = 0; sl < 4; sl++) {
-                        DBF_DEV_EVENT(DBF_EMERG, device,
-                                      "%s: %016llx %016llx %016llx %016llx",
-                                      reason, sense[0], sense[1], sense[2],
-                                      sense[3]);
-                }
+                DBF_DEV_EVENT(DBF_EMERG, device,
+                              "%s: %s %02x%02x%02x %016llx %016llx %016llx "
+                              "%016llx", reason,
+                              scsw_is_tm(&irb->scsw) ? "t" : "c",
+                              scsw_cc(&irb->scsw), scsw_cstat(&irb->scsw),
+                              scsw_dstat(&irb->scsw), sense[0], sense[1],
+                              sense[2], sense[3]);
         } else {
                 DBF_DEV_EVENT(DBF_EMERG, device, "%s",
                               "SORRY - NO VALID SENSE AVAILABLE\n");
diff --git a/drivers/s390/block/dasd_erp.c b/drivers/s390/block/dasd_erp.c
index d970ce2814be..cb8f9cef7429 100644
--- a/drivers/s390/block/dasd_erp.c
+++ b/drivers/s390/block/dasd_erp.c
@@ -172,7 +172,7 @@ dasd_log_sense_dbf(struct dasd_ccw_req *cqr, struct irb *irb)
         device = cqr->startdev;
         /* dump sense data to s390 debugfeature*/
         if (device->discipline && device->discipline->dump_sense_dbf)
-                device->discipline->dump_sense_dbf(device, cqr, irb, "log");
+                device->discipline->dump_sense_dbf(device, irb, "log");
 }
 EXPORT_SYMBOL(dasd_log_sense_dbf);
 
diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
index e21ee735f926..31849ad5e59f 100644
--- a/drivers/s390/block/dasd_fba.c
+++ b/drivers/s390/block/dasd_fba.c
@@ -241,7 +241,7 @@ static void dasd_fba_handle_unsolicited_interrupt(struct dasd_device *device,
         /* check for unsolicited interrupts */
         DBF_DEV_EVENT(DBF_WARNING, device, "%s",
                     "unsolicited interrupt received");
-        device->discipline->dump_sense_dbf(device, NULL, irb, "unsolicited");
+        device->discipline->dump_sense_dbf(device, irb, "unsolicited");
         dasd_schedule_device_bh(device);
         return;
 };
@@ -444,17 +444,20 @@ dasd_fba_fill_info(struct dasd_device * device,
 }
 
 static void
-dasd_fba_dump_sense_dbf(struct dasd_device *device, struct dasd_ccw_req *req,
-                         struct irb *irb, char *reason)
+dasd_fba_dump_sense_dbf(struct dasd_device *device, struct irb *irb,
+                        char *reason)
 {
-        int sl;
-        if (irb->esw.esw0.erw.cons) {
-                for (sl = 0; sl < 4; sl++) {
-                        DBF_DEV_EVENT(DBF_EMERG, device,
-                                      "%s: %08x %08x %08x %08x",
-                                      reason, irb->ecw[8 * 0], irb->ecw[8 * 1],
-                                      irb->ecw[8 * 2], irb->ecw[8 * 3]);
-                }
+        u64 *sense;
+
+        sense = (u64 *) dasd_get_sense(irb);
+        if (sense) {
+                DBF_DEV_EVENT(DBF_EMERG, device,
+                              "%s: %s %02x%02x%02x %016llx %016llx %016llx "
+                              "%016llx", reason,
+                              scsw_is_tm(&irb->scsw) ? "t" : "c",
+                              scsw_cc(&irb->scsw), scsw_cstat(&irb->scsw),
+                              scsw_dstat(&irb->scsw), sense[0], sense[1],
+                              sense[2], sense[3]);
         } else {
                 DBF_DEV_EVENT(DBF_EMERG, device, "%s",
                               "SORRY - NO VALID SENSE AVAILABLE\n");
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index fd63b2f2bda9..b699ca356ac5 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -284,8 +284,7 @@ struct dasd_discipline {
         dasd_erp_fn_t(*erp_postaction) (struct dasd_ccw_req *);
         void (*dump_sense) (struct dasd_device *, struct dasd_ccw_req *,
                             struct irb *);
-        void (*dump_sense_dbf) (struct dasd_device *, struct dasd_ccw_req *,
-                            struct irb *, char *);
+        void (*dump_sense_dbf) (struct dasd_device *, struct irb *, char *);
 
         void (*handle_unsolicited_interrupt) (struct dasd_device *,
                                               struct irb *);
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 4ce3f72ee1c1..df918ef27965 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -16,6 +16,7 @@
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/blkpg.h>
+#include <linux/smp_lock.h>
 
 #include <asm/ccwdev.h>
 #include <asm/cmb.h>
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index 016f9e9d2591..d34617682a62 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -964,7 +964,8 @@ static int dcssblk_freeze(struct device *dev)
                         break;
         }
         if (rc)
-                pr_err("Suspend failed because device %s is writeable.\n",
+                pr_err("Suspending the system failed because DCSS device %s "
+                       "is writable\n",
                        dev_info->segment_name);
         return rc;
 }
@@ -987,8 +988,8 @@ static int dcssblk_restore(struct device *dev)
                                 goto out_panic;
                         }
                         if (start != entry->start || end != entry->end) {
-                                pr_err("Mismatch of start / end address after "
-                                       "resuming device %s\n",
+                                pr_err("The address range of DCSS %s changed "
+                                       "while the system was suspended\n",
                                        entry->segment_name);
                                 goto out_panic;
                         }
diff --git a/drivers/s390/block/xpram.c b/drivers/s390/block/xpram.c
index 2e9e1ecd6d82..db442cd6621e 100644
--- a/drivers/s390/block/xpram.c
+++ b/drivers/s390/block/xpram.c
@@ -443,7 +443,7 @@ fail:
  */
 static void xpram_resume_error(const char *message)
 {
-        pr_err("Resume error: %s\n", message);
+        pr_err("Resuming the system failed: %s\n", message);
         panic("xpram resume error\n");
 }
 
diff --git a/drivers/s390/char/monreader.c b/drivers/s390/char/monreader.c
index 7892550d7932..3234e90bd7f9 100644
--- a/drivers/s390/char/monreader.c
+++ b/drivers/s390/char/monreader.c
@@ -320,7 +320,7 @@ static int mon_open(struct inode *inode, struct file *filp)
                 goto out_path;
         }
         filp->private_data = monpriv;
-        dev_set_drvdata(&monreader_device, monpriv);
+        dev_set_drvdata(monreader_device, monpriv);
         unlock_kernel();
         return nonseekable_open(inode, filp);
 
@@ -463,7 +463,7 @@ static struct miscdevice mon_dev = {
  *****************************************************************************/
 static int monreader_freeze(struct device *dev)
 {
-        struct mon_private *monpriv = dev_get_drvdata(&dev);
+        struct mon_private *monpriv = dev_get_drvdata(dev);
         int rc;
 
         if (!monpriv)
diff --git a/drivers/s390/char/sclp_rw.h b/drivers/s390/char/sclp_rw.h
index 85f491ea929c..7a7bfc947d97 100644
--- a/drivers/s390/char/sclp_rw.h
+++ b/drivers/s390/char/sclp_rw.h
@@ -92,5 +92,10 @@ void sclp_set_columns(struct sclp_buffer *, unsigned short);
 void sclp_set_htab(struct sclp_buffer *, unsigned short);
 int sclp_chars_in_buffer(struct sclp_buffer *);
 
+#ifdef CONFIG_SCLP_CONSOLE
 void sclp_console_pm_event(enum sclp_pm_event sclp_pm_event);
+#else
+static inline void sclp_console_pm_event(enum sclp_pm_event sclp_pm_event) { }
+#endif
+
 #endif  /* __SCLP_RW_H__ */
diff --git a/drivers/s390/char/vmwatchdog.c b/drivers/s390/char/vmwatchdog.c
index cb7854c10c04..f2bc287b69e4 100644
--- a/drivers/s390/char/vmwatchdog.c
+++ b/drivers/s390/char/vmwatchdog.c
@@ -250,14 +250,14 @@ static int vmwdt_resume(void)
 static int vmwdt_suspend(void)
 {
         if (test_and_set_bit(VMWDT_OPEN, &vmwdt_is_open)) {
-                pr_err("The watchdog is in use. "
-                        "This prevents hibernation or suspend.\n");
+                pr_err("The system cannot be suspended while the watchdog"
+                        " is in use\n");
                 return NOTIFY_BAD;
         }
         if (test_bit(VMWDT_RUNNING, &vmwdt_is_open)) {
                 clear_bit(VMWDT_OPEN, &vmwdt_is_open);
-                pr_err("The watchdog is running. "
-                        "This prevents hibernation or suspend.\n");
+                pr_err("The system cannot be suspended while the watchdog"
+                        " is running\n");
                 return NOTIFY_BAD;
         }
         return NOTIFY_DONE;
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index 650bcef08f2a..cd78c501803a 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -9,7 +9,6 @@
 
 #include <linux/moduleparam.h>
 #include <linux/vmalloc.h>
-#include <linux/smp_lock.h>
 #include <linux/list.h>
 
 #include <scsi/scsi_tcq.h>
diff --git a/drivers/serial/bfin_sport_uart.c b/drivers/serial/bfin_sport_uart.c
index 34b4ae0fe760..c108b1a0ce98 100644
--- a/drivers/serial/bfin_sport_uart.c
+++ b/drivers/serial/bfin_sport_uart.c
@@ -236,7 +236,6 @@ static int sport_startup(struct uart_port *port)
         int retval;
 
         pr_debug("%s enter\n", __func__);
-        memset(buffer, 20, '\0');
         snprintf(buffer, 20, "%s rx", up->name);
         retval = request_irq(up->rx_irq, sport_uart_rx_irq, IRQF_SAMPLE_RANDOM, buffer, up);
         if (retval) {
diff --git a/drivers/serial/msm_serial.c b/drivers/serial/msm_serial.c
index 698048f64f5e..f7c24baa1416 100644
--- a/drivers/serial/msm_serial.c
+++ b/drivers/serial/msm_serial.c
@@ -730,7 +730,6 @@ static int __devexit msm_serial_remove(struct platform_device *pdev)
 }
 
 static struct platform_driver msm_platform_driver = {
-        .probe = msm_serial_probe,
         .remove = msm_serial_remove,
         .driver = {
                 .name = "msm_serial",
diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c
index baf83c6a9412..e3c3adc282e2 100644
--- a/drivers/staging/comedi/drivers/jr3_pci.c
+++ b/drivers/staging/comedi/drivers/jr3_pci.c
@@ -45,6 +45,8 @@ Devices: [JR3] PCI force sensor board (jr3_pci)
 #include <linux/delay.h>
 #include <linux/ctype.h>
 #include <linux/firmware.h>
+#include <linux/jiffies.h>
+#include <linux/timer.h>
 #include "comedi_pci.h"
 #include "jr3_pci.h"
 
diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
index 92121cf8c45c..5d9bab352c1d 100644
--- a/drivers/staging/comedi/drivers/s626.c
+++ b/drivers/staging/comedi/drivers/s626.c
@@ -111,9 +111,13 @@ static const struct s626_board s626_boards[] = {
 #define PCI_VENDOR_ID_S626 0x1131
 #define PCI_DEVICE_ID_S626 0x7146
 
+/*
+ * For devices with vendor:device id == 0x1131:0x7146 you must specify
+ * also subvendor:subdevice ids, because otherwise it will conflict with
+ * Philips SAA7146 media/dvb based cards.
+ */
 static DEFINE_PCI_DEVICE_TABLE(s626_pci_table) = {
-        {PCI_VENDOR_ID_S626, PCI_DEVICE_ID_S626, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
-                0},
+        {PCI_VENDOR_ID_S626, PCI_DEVICE_ID_S626, 0x6000, 0x0272, 0, 0, 0},
         {0}
 };
 
@@ -499,25 +503,26 @@ static int s626_attach(struct comedi_device *dev, struct comedi_devconfig *it)
         resource_size_t resourceStart;
         dma_addr_t appdma;
         struct comedi_subdevice *s;
-        struct pci_dev *pdev;
+        const struct pci_device_id *ids;
+        struct pci_dev *pdev = NULL;
 
         if (alloc_private(dev, sizeof(struct s626_private)) < 0)
                 return -ENOMEM;
 
-        for (pdev = pci_get_device(PCI_VENDOR_ID_S626, PCI_DEVICE_ID_S626,
-                        NULL); pdev != NULL;
-                pdev = pci_get_device(PCI_VENDOR_ID_S626,
-                        PCI_DEVICE_ID_S626, pdev)) {
-                if (it->options[0] || it->options[1]) {
-                        if (pdev->bus->number == it->options[0] &&
-                                PCI_SLOT(pdev->devfn) == it->options[1]) {
+        for (i = 0; i < (ARRAY_SIZE(s626_pci_table) - 1) && !pdev; i++) {
+                ids = &s626_pci_table[i];
+                do {
+                        pdev = pci_get_subsys(ids->vendor, ids->device, ids->subvendor,
+                                              ids->subdevice, pdev);
+
+                        if ((it->options[0] || it->options[1]) && pdev) {
                                 /* matches requested bus/slot */
+                                if (pdev->bus->number == it->options[0] &&
+                                    PCI_SLOT(pdev->devfn) == it->options[1])
+                                        break;
+                        } else
                                 break;
-                        }
-                } else {
-                        /* no bus/slot specified */
-                        break;
-                }
+                } while (1);
         }
         devpriv->pdev = pdev;
 
diff --git a/drivers/staging/go7007/s2250-loader.c b/drivers/staging/go7007/s2250-loader.c
index a5e4acab089e..bb22347af60e 100644
--- a/drivers/staging/go7007/s2250-loader.c
+++ b/drivers/staging/go7007/s2250-loader.c
@@ -17,6 +17,7 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/smp_lock.h>
 #include <linux/usb.h>
 #include <dvb-usb.h>
 
diff --git a/drivers/staging/meilhaus/TODO b/drivers/staging/meilhaus/TODO
index 6ec25203089c..d6ce39823de6 100644
--- a/drivers/staging/meilhaus/TODO
+++ b/drivers/staging/meilhaus/TODO
@@ -7,4 +7,4 @@ TODO:
         - possible comedi merge
 
 Please send cleanup patches to Greg Kroah-Hartman <greg@kroah.com>
-and CC: David Kiliani <mail@davidkiliani.de>
+and CC: David Kiliani <mail@davidkiliani.de> and Meilhaus Support <support@meilhaus.de>
diff --git a/drivers/staging/rspiusb/rspiusb.c b/drivers/staging/rspiusb/rspiusb.c
index 1cdfe69585ea..2f8155c1968b 100644
--- a/drivers/staging/rspiusb/rspiusb.c
+++ b/drivers/staging/rspiusb/rspiusb.c
@@ -444,8 +444,7 @@ static void piusb_write_bulk_callback(struct urb *urb)
                         __func__, status);
 
         pdx->pendingWrite = 0;
-        usb_buffer_free(urb->dev, urb->transfer_buffer_length,
-                        urb->transfer_buffer, urb->transfer_dma);
+        kfree(urb->transfer_buffer);
 }
 
 int piusb_output(struct ioctl_struct *io, unsigned char *uBuf, int len,
@@ -457,9 +456,7 @@ int piusb_output(struct ioctl_struct *io, unsigned char *uBuf, int len,
 
         urb = usb_alloc_urb(0, GFP_KERNEL);
         if (urb != NULL) {
-                kbuf =
-                    usb_buffer_alloc(pdx->udev, len, GFP_KERNEL,
-                                     &urb->transfer_dma);
+                kbuf = kmalloc(len, GFP_KERNEL);
                 if (!kbuf) {
                         dev_err(&pdx->udev->dev, "buffer_alloc failed\n");
                         return -ENOMEM;
@@ -470,7 +467,6 @@ int piusb_output(struct ioctl_struct *io, unsigned char *uBuf, int len,
                 }
                 usb_fill_bulk_urb(urb, pdx->udev, pdx->hEP[io->endpoint], kbuf,
                                   len, piusb_write_bulk_callback, pdx);
-                urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
                 err = usb_submit_urb(urb, GFP_KERNEL);
                 if (err) {
                         dev_err(&pdx->udev->dev,
@@ -641,7 +637,7 @@ static int MapUserBuffer(struct ioctl_struct *io, struct device_extension *pdx)
         numPagesRequired =
             ((uaddr & ~PAGE_MASK) + count + ~PAGE_MASK) >> PAGE_SHIFT;
         dbg("Number of pages needed = %d", numPagesRequired);
-        maplist_p = vmalloc(numPagesRequired * sizeof(struct page));
+        maplist_p = vmalloc(numPagesRequired * sizeof(struct page *));
         if (!maplist_p) {
                 dbg("Can't Allocate Memory for maplist_p");
                 return -ENOMEM;
@@ -712,9 +708,7 @@ static int MapUserBuffer(struct ioctl_struct *io, struct device_extension *pdx)
                 usb_fill_bulk_urb(pdx->PixelUrb[frameInfo][i],
                                   pdx->udev,
                                   epAddr,
-                                  (dma_addr_t *) sg_dma_address(&pdx->
-                                                                sgl[frameInfo]
-                                                                [i]),
+                                  NULL, // non-DMA HC? buy a better hardware
                                   sg_dma_len(&pdx->sgl[frameInfo][i]),
                                   piusb_readPIXEL_callback, (void *)pdx);
                 pdx->PixelUrb[frameInfo][i]->transfer_dma =
diff --git a/drivers/staging/rt2870/rt2870.h b/drivers/staging/rt2870/rt2870.h
index 5e5b3f2b7eb1..29e3b53e52a1 100644
--- a/drivers/staging/rt2870/rt2870.h
+++ b/drivers/staging/rt2870/rt2870.h
@@ -89,6 +89,7 @@
         {USB_DEVICE(0x0DF6,0x002C)}, /* Sitecom */              \
         {USB_DEVICE(0x0DF6,0x002D)}, /* Sitecom */              \
         {USB_DEVICE(0x0DF6,0x0039)}, /* Sitecom */              \
+        {USB_DEVICE(0x0DF6,0x003F)}, /* Sitecom WL-608 */       \
         {USB_DEVICE(0x14B2,0x3C06)}, /* Conceptronic */         \
         {USB_DEVICE(0x14B2,0x3C28)}, /* Conceptronic */         \
         {USB_DEVICE(0x2019,0xED06)}, /* Planex Communications, Inc. */          \
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
index 93af37e2d31a..54b4b718f84a 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
                              struct iw_request_info *info,
                              union iwreq_data *wrqu, char *extra)
 {
-        strcpy(wrqu->name, "802.11");
+        strlcpy(wrqu->name, "802.11", IFNAMSIZ);
         if(ieee->modulation & IEEE80211_CCK_MODULATION){
-                strcat(wrqu->name, "b");
+                strlcat(wrqu->name, "b", IFNAMSIZ);
                 if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-                        strcat(wrqu->name, "/g");
+                        strlcat(wrqu->name, "/g", IFNAMSIZ);
         }else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-                strcat(wrqu->name, "g");
+                strlcat(wrqu->name, "g", IFNAMSIZ);
 
         if((ieee->state == IEEE80211_LINKED) ||
                 (ieee->state == IEEE80211_LINKED_SCANNING))
-                strcat(wrqu->name," linked");
+                strlcat(wrqu->name,"  link", IFNAMSIZ);
         else if(ieee->state != IEEE80211_NOLINK)
-                strcat(wrqu->name," link..");
+                strlcat(wrqu->name," .....", IFNAMSIZ);
 
 
         return 0;
diff --git a/drivers/staging/rtl8192su/Kconfig b/drivers/staging/rtl8192su/Kconfig
index 4b5552c5926e..770f41280f21 100644
--- a/drivers/staging/rtl8192su/Kconfig
+++ b/drivers/staging/rtl8192su/Kconfig
@@ -1,6 +1,6 @@
 config RTL8192SU
         tristate "RealTek RTL8192SU Wireless LAN NIC driver"
         depends on PCI
-        depends on WIRELESS_EXT && COMPAT_NET_DEV_OPS
+        depends on WIRELESS_EXT
         default N
         ---help---
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_module.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_module.c
index f408b4583b82..759032db4a34 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_module.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_module.c
@@ -118,7 +118,6 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
 #else
         ieee = (struct ieee80211_device *)dev->priv;
 #endif
-        dev->hard_start_xmit = ieee80211_xmit;
 
         memset(ieee, 0, sizeof(struct ieee80211_device)+sizeof_priv);
         ieee->dev = dev;
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
index 1f50c46dcb90..191dc3fbbe32 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac_wx.c
@@ -548,21 +548,21 @@ int ieee80211_wx_get_name(struct ieee80211_device *ieee,
                              struct iw_request_info *info,
                              union iwreq_data *wrqu, char *extra)
 {
-        strcpy(wrqu->name, "802.11");
+        strlcpy(wrqu->name, "802.11", IFNAMSIZ);
         if(ieee->modulation & IEEE80211_CCK_MODULATION){
-                strcat(wrqu->name, "b");
+                strlcat(wrqu->name, "b", IFNAMSIZ);
                 if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-                        strcat(wrqu->name, "/g");
+                        strlcat(wrqu->name, "/g", IFNAMSIZ);
         }else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
-                strcat(wrqu->name, "g");
+                strlcat(wrqu->name, "g", IFNAMSIZ);
         if (ieee->mode & (IEEE_N_24G | IEEE_N_5G))
-                strcat(wrqu->name, "/n");
+                strlcat(wrqu->name, "/n", IFNAMSIZ);
 
         if((ieee->state == IEEE80211_LINKED) ||
                 (ieee->state == IEEE80211_LINKED_SCANNING))
-                strcat(wrqu->name," linked");
+                strlcat(wrqu->name, "  link", IFNAMSIZ);
         else if(ieee->state != IEEE80211_NOLINK)
-                strcat(wrqu->name," link..");
+                strlcat(wrqu->name, " .....", IFNAMSIZ);
 
 
         return 0;
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index f1423d714496..4ab250743e81 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -12132,6 +12132,19 @@ static void HalUsbSetQueuePipeMapping8192SUsb(struct usb_interface *intf, struct
 }
 #endif
 
+static const struct net_device_ops rtl8192_netdev_ops = {
+        .ndo_open               = rtl8192_open,
+        .ndo_stop               = rtl8192_close,
+        .ndo_get_stats          = rtl8192_stats,
+        .ndo_tx_timeout         = tx_timeout,
+        .ndo_do_ioctl           = rtl8192_ioctl,
+        .ndo_set_multicast_list = r8192_set_multicast,
+        .ndo_set_mac_address    = r8192_set_mac_adr,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_start_xmit         = ieee80211_xmit,
+};
+
 #if LINUX_VERSION_CODE > KERNEL_VERSION(2,5,0)
 static int __devinit rtl8192_usb_probe(struct usb_interface *intf,
                          const struct usb_device_id *id)
@@ -12186,15 +12199,7 @@ static void * __devinit rtl8192_usb_probe(struct usb_device *udev,
         priv->ops = &rtl8192u_ops;
 #endif
 
-        dev->open = rtl8192_open;
-        dev->stop = rtl8192_close;
-        //dev->hard_start_xmit = rtl8192_8023_hard_start_xmit;
-        dev->tx_timeout = tx_timeout;
-        //dev->wireless_handlers = &r8192_wx_handlers_def;
-        dev->do_ioctl = rtl8192_ioctl;
-        dev->set_multicast_list = r8192_set_multicast;
-        dev->set_mac_address = r8192_set_mac_adr;
-        dev->get_stats = rtl8192_stats;
+        dev->netdev_ops = &rtl8192_netdev_ops;
 
          //DMESG("Oops: i'm coming\n");
 #if WIRELESS_EXT >= 12
diff --git a/drivers/staging/rtl8192su/r8192U_pm.c b/drivers/staging/rtl8192su/r8192U_pm.c
index 92c95aa36638..b1531a8d0cde 100644
--- a/drivers/staging/rtl8192su/r8192U_pm.c
+++ b/drivers/staging/rtl8192su/r8192U_pm.c
@@ -35,7 +35,9 @@ int rtl8192U_suspend(struct usb_interface *intf, pm_message_t state)
                       return 0;
                  }
 
-                dev->stop(dev);
+                if (dev->netdev_ops->ndo_stop)
+                        dev->netdev_ops->ndo_stop(dev);
+
                 mdelay(10);
 
                 netif_device_detach(dev);
@@ -61,7 +63,9 @@ int rtl8192U_resume (struct usb_interface *intf)
                 }
 
                 netif_device_attach(dev);
-                dev->open(dev);
+
+                if (dev->netdev_ops->ndo_open)
+                        dev->netdev_ops->ndo_open(dev);
         }
 
         return 0;
diff --git a/drivers/staging/serqt_usb2/serqt_usb2.c b/drivers/staging/serqt_usb2/serqt_usb2.c
index 90b29b564631..a9bd4106beb7 100644
--- a/drivers/staging/serqt_usb2/serqt_usb2.c
+++ b/drivers/staging/serqt_usb2/serqt_usb2.c
@@ -866,7 +866,7 @@ static void qt_release(struct usb_serial *serial)
 
 }
 
-int qt_open(struct tty_struct *tty,
+static int qt_open(struct tty_struct *tty,
             struct usb_serial_port *port, struct file *filp)
 {
         struct usb_serial *serial;
@@ -1041,17 +1041,19 @@ static void qt_block_until_empty(struct tty_struct *tty,
         }
 }
 
-static void qt_close(struct tty_struct *tty, struct usb_serial_port *port,
-                     struct file *filp)
+static void qt_close( struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         struct quatech_port *qt_port;
         struct quatech_port *port0;
+        struct tty_struct *tty;
         int status;
         unsigned int index;
         status = 0;
 
         dbg("%s - port %d\n", __func__, port->number);
+
+        tty = tty_port_tty_get(&port->port);
         index = tty->index - serial->minor;
 
         qt_port = qt_get_port_private(port);
diff --git a/drivers/staging/stlc45xx/stlc45xx.c b/drivers/staging/stlc45xx/stlc45xx.c
index cfdaac9b747e..a137c78fac09 100644
--- a/drivers/staging/stlc45xx/stlc45xx.c
+++ b/drivers/staging/stlc45xx/stlc45xx.c
@@ -2235,24 +2235,6 @@ static void stlc45xx_op_remove_interface(struct ieee80211_hw *hw,
         stlc45xx_debug(DEBUG_FUNC, "%s", __func__);
 }
 
-static int stlc45xx_op_config_interface(struct ieee80211_hw *hw,
-                                        struct ieee80211_vif *vif,
-                                        struct ieee80211_if_conf *conf)
-{
-        struct stlc45xx *stlc = hw->priv;
-
-        stlc45xx_debug(DEBUG_FUNC, "%s", __func__);
-
-        mutex_lock(&stlc->mutex);
-
-        memcpy(stlc->bssid, conf->bssid, ETH_ALEN);
-        stlc45xx_tx_setup(stlc);
-
-        mutex_unlock(&stlc->mutex);
-
-        return 0;
-}
-
 static int stlc45xx_op_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct stlc45xx *stlc = hw->priv;
@@ -2295,6 +2277,14 @@ static void stlc45xx_op_bss_info_changed(struct ieee80211_hw *hw,
 {
         struct stlc45xx *stlc = hw->priv;
 
+        stlc45xx_debug(DEBUG_FUNC, "%s", __func__);
+        mutex_lock(&stlc->mutex);
+
+        memcpy(stlc->bssid, info->bssid, ETH_ALEN);
+        stlc45xx_tx_setup(stlc);
+
+        mutex_unlock(&stlc->mutex);
+
         if (changed & BSS_CHANGED_ASSOC) {
                 stlc->associated = info->assoc;
                 if (info->assoc)
@@ -2357,7 +2347,6 @@ static const struct ieee80211_ops stlc45xx_ops = {
         .add_interface = stlc45xx_op_add_interface,
         .remove_interface = stlc45xx_op_remove_interface,
         .config = stlc45xx_op_config,
-        .config_interface = stlc45xx_op_config_interface,
         .configure_filter = stlc45xx_op_configure_filter,
         .tx = stlc45xx_op_tx,
         .bss_info_changed = stlc45xx_op_bss_info_changed,
diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c
index 22f93dd0ba03..251220dc8851 100644
--- a/drivers/staging/usbip/usbip_common.c
+++ b/drivers/staging/usbip/usbip_common.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/smp_lock.h>
 #include <linux/file.h>
 #include <linux/tcp.h>
 #include <linux/in.h>
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index a10ed27acbc2..f43ca416e4a8 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -344,7 +344,7 @@ static CHIP_INFO chip_info_table[]= {
 };
 
 static struct pci_device_id device_id_table[] __devinitdata = {
-{ 0x1106, 0x3253, PCI_ANY_ID, PCI_ANY_ID, 0, 0, (int)&chip_info_table[0]},
+{ 0x1106, 0x3253, PCI_ANY_ID, PCI_ANY_ID, 0, 0, (long)&chip_info_table[0]},
 { 0, }
 };
 #endif
@@ -369,7 +369,7 @@ static int  device_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 
 #ifdef CONFIG_PM
 static int device_notify_reboot(struct notifier_block *, unsigned long event, void *ptr);
-static int viawget_suspend(struct pci_dev *pcid, u32 state);
+static int viawget_suspend(struct pci_dev *pcid, pm_message_t state);
 static int viawget_resume(struct pci_dev *pcid);
 struct notifier_block device_notifier = {
         notifier_call:  device_notify_reboot,
@@ -3941,7 +3941,7 @@ device_notify_reboot(struct notifier_block *nb, unsigned long event, void *p)
         while ((pdev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, pdev)) != NULL) {
             if(pci_dev_driver(pdev) == &device_driver) {
                 if (pci_get_drvdata(pdev))
-                    viawget_suspend(pdev, 3);
+                    viawget_suspend(pdev, PMSG_HIBERNATE);
             }
         }
     }
@@ -3949,7 +3949,7 @@ device_notify_reboot(struct notifier_block *nb, unsigned long event, void *p)
 }
 
 static int
-viawget_suspend(struct pci_dev *pcid, u32 state)
+viawget_suspend(struct pci_dev *pcid, pm_message_t state)
 {
     int power_status;   // to silence the compiler
 
@@ -3971,7 +3971,7 @@ viawget_suspend(struct pci_dev *pcid, u32 state)
     memset(pMgmt->abyCurrBSSID, 0, 6);
     pMgmt->eCurrState = WMAC_STATE_IDLE;
     pci_disable_device(pcid);
-    power_status = pci_set_power_state(pcid, state);
+    power_status = pci_set_power_state(pcid, pci_choose_state(pcid, state));
     spin_unlock_irq(&pDevice->lock);
     return 0;
 }
diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
index a913efc69669..40de151f2789 100644
--- a/drivers/telephony/ixj.c
+++ b/drivers/telephony/ixj.c
@@ -257,6 +257,7 @@
 #include <linux/fs.h>           /* everything... */
 #include <linux/errno.h>        /* error codes */
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
diff --git a/drivers/telephony/phonedev.c b/drivers/telephony/phonedev.c
index b52cc830c0b4..f3873f650bb4 100644
--- a/drivers/telephony/phonedev.c
+++ b/drivers/telephony/phonedev.c
@@ -23,7 +23,6 @@
 #include <linux/errno.h>
 #include <linux/phonedev.h>
 #include <linux/init.h>
-#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 3f1045993474..e1f89416ef8c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -387,6 +387,7 @@ static void acm_rx_tasklet(unsigned long _acm)
         struct acm_ru *rcv;
         unsigned long flags;
         unsigned char throttled;
+        struct usb_host_endpoint *ep;
 
         dbg("Entering acm_rx_tasklet");
 
@@ -462,11 +463,20 @@ urbs:
 
                 rcv->buffer = buf;
 
-                usb_fill_bulk_urb(rcv->urb, acm->dev,
-                                  acm->rx_endpoint,
-                                  buf->base,
-                                  acm->readsize,
-                                  acm_read_bulk, rcv);
+                ep = (usb_pipein(acm->rx_endpoint) ? acm->dev->ep_in : acm->dev->ep_out)
+                                [usb_pipeendpoint(acm->rx_endpoint)];
+                if (usb_endpoint_xfer_int(&ep->desc))
+                        usb_fill_int_urb(rcv->urb, acm->dev,
+                                         acm->rx_endpoint,
+                                         buf->base,
+                                         acm->readsize,
+                                         acm_read_bulk, rcv, ep->desc.bInterval);
+                else
+                        usb_fill_bulk_urb(rcv->urb, acm->dev,
+                                          acm->rx_endpoint,
+                                          buf->base,
+                                          acm->readsize,
+                                          acm_read_bulk, rcv);
                 rcv->urb->transfer_dma = buf->dma;
                 rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
@@ -740,7 +750,7 @@ static int acm_tty_chars_in_buffer(struct tty_struct *tty)
 {
         struct acm *acm = tty->driver_data;
         if (!ACM_READY(acm))
-                return -EINVAL;
+                return 0;
         /*
          * This is inaccurate (overcounts), but it works.
          */
@@ -1227,9 +1237,14 @@ made_compressed_probe:
                         goto alloc_fail7;
                 }
 
-                usb_fill_bulk_urb(snd->urb, usb_dev,
-                        usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
-                        NULL, acm->writesize, acm_write_bulk, snd);
+                if (usb_endpoint_xfer_int(epwrite))
+                        usb_fill_int_urb(snd->urb, usb_dev,
+                                usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
+                                NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval);
+                else
+                        usb_fill_bulk_urb(snd->urb, usb_dev,
+                                usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
+                                NULL, acm->writesize, acm_write_bulk, snd);
                 snd->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
                 snd->instance = acm;
         }
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 0fe434505ac4..ba589d4ca8bc 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -15,7 +15,6 @@
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/smp_lock.h>
 #include <linux/mutex.h>
 #include <linux/uaccess.h>
 #include <linux/bitops.h>
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 3703789d0d2a..b09a527f7341 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -751,7 +751,7 @@ static int get_capabilities(struct usbtmc_device_data *data)
 {
         struct device *dev = &data->usb_dev->dev;
         char *buffer;
-        int rv;
+        int rv = 0;
 
         buffer = kmalloc(0x18, GFP_KERNEL);
         if (!buffer)
@@ -763,7 +763,7 @@ static int get_capabilities(struct usbtmc_device_data *data)
                              0, 0, buffer, 0x18, USBTMC_TIMEOUT);
         if (rv < 0) {
                 dev_err(dev, "usb_control_msg returned %d\n", rv);
-                return rv;
+                goto err_out;
         }
 
         dev_dbg(dev, "GET_CAPABILITIES returned %x\n", buffer[0]);
@@ -773,7 +773,8 @@ static int get_capabilities(struct usbtmc_device_data *data)
         dev_dbg(dev, "USB488 device capabilities are %x\n", buffer[15]);
         if (buffer[0] != USBTMC_STATUS_SUCCESS) {
                 dev_err(dev, "GET_CAPABILITIES returned %x\n", buffer[0]);
-                return -EPERM;
+                rv = -EPERM;
+                goto err_out;
         }
 
         data->capabilities.interface_capabilities = buffer[4];
@@ -781,8 +782,9 @@ static int get_capabilities(struct usbtmc_device_data *data)
         data->capabilities.usb488_interface_capabilities = buffer[14];
         data->capabilities.usb488_device_capabilities = buffer[15];
 
+err_out:
         kfree(buffer);
-        return 0;
+        return rv;
 }
 
 #define capability_attribute(name)                                      \
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 69280c35b5cb..ad925946f869 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -28,7 +28,7 @@ comment "Miscellaneous USB options"
         depends on USB
 
 config USB_DEVICEFS
-        bool "USB device filesystem (DEPRECATED)" if EMBEDDED
+        bool "USB device filesystem (DEPRECATED)"
         depends on USB
         ---help---
           If you say Y here (and to "/proc file system support" in the "File
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index 73c108d117b4..96f11715cd26 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -136,17 +136,19 @@ static const struct class_info clas_info[] =
         {USB_CLASS_AUDIO,               "audio"},
         {USB_CLASS_COMM,                "comm."},
         {USB_CLASS_HID,                 "HID"},
-        {USB_CLASS_HUB,                 "hub"},
         {USB_CLASS_PHYSICAL,            "PID"},
+        {USB_CLASS_STILL_IMAGE,         "still"},
         {USB_CLASS_PRINTER,             "print"},
         {USB_CLASS_MASS_STORAGE,        "stor."},
+        {USB_CLASS_HUB,                 "hub"},
         {USB_CLASS_CDC_DATA,            "data"},
-        {USB_CLASS_APP_SPEC,            "app."},
-        {USB_CLASS_VENDOR_SPEC,         "vend."},
-        {USB_CLASS_STILL_IMAGE,         "still"},
         {USB_CLASS_CSCID,               "scard"},
         {USB_CLASS_CONTENT_SEC,         "c-sec"},
         {USB_CLASS_VIDEO,               "video"},
+        {USB_CLASS_WIRELESS_CONTROLLER, "wlcon"},
+        {USB_CLASS_MISC,                "misc"},
+        {USB_CLASS_APP_SPEC,            "app."},
+        {USB_CLASS_VENDOR_SPEC,         "vend."},
         {-1,                            "unk."}         /* leave as last */
 };
 
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 308609039c73..38b8bce782d6 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -325,21 +325,34 @@ static void async_completed(struct urb *urb)
         struct async *as = urb->context;
         struct dev_state *ps = as->ps;
         struct siginfo sinfo;
+        struct pid *pid = NULL;
+        uid_t uid = 0;
+        uid_t euid = 0;
+        u32 secid = 0;
+        int signr;
 
         spin_lock(&ps->lock);
         list_move_tail(&as->asynclist, &ps->async_completed);
-        spin_unlock(&ps->lock);
         as->status = urb->status;
-        if (as->signr) {
+        signr = as->signr;
+        if (signr) {
                 sinfo.si_signo = as->signr;
                 sinfo.si_errno = as->status;
                 sinfo.si_code = SI_ASYNCIO;
                 sinfo.si_addr = as->userurb;
-                kill_pid_info_as_uid(as->signr, &sinfo, as->pid, as->uid,
-                                      as->euid, as->secid);
+                pid = as->pid;
+                uid = as->uid;
+                euid = as->euid;
+                secid = as->secid;
         }
         snoop(&urb->dev->dev, "urb complete\n");
         snoop_urb(urb, as->userurb);
+        spin_unlock(&ps->lock);
+
+        if (signr)
+                kill_pid_info_as_uid(sinfo.si_signo, &sinfo, pid, uid,
+                                      euid, secid);
+
         wake_up(&ps->wait);
 }
 
@@ -982,7 +995,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                                 USBDEVFS_URB_ZERO_PACKET |
                                 USBDEVFS_URB_NO_INTERRUPT))
                 return -EINVAL;
-        if (!uurb->buffer)
+        if (uurb->buffer_length > 0 && !uurb->buffer)
                 return -EINVAL;
         if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
             (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
@@ -1038,11 +1051,6 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                         is_in = 0;
                         uurb->endpoint &= ~USB_DIR_IN;
                 }
-                if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
-                                uurb->buffer, uurb->buffer_length)) {
-                        kfree(dr);
-                        return -EFAULT;
-                }
                 snoop(&ps->dev->dev, "control urb: bRequest=%02x "
                         "bRrequestType=%02x wValue=%04x "
                         "wIndex=%04x wLength=%04x\n",
@@ -1062,9 +1070,6 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                 uurb->number_of_packets = 0;
                 if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
                         return -EINVAL;
-                if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
-                                uurb->buffer, uurb->buffer_length))
-                        return -EFAULT;
                 snoop(&ps->dev->dev, "bulk urb\n");
                 break;
 
@@ -1106,28 +1111,35 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                         return -EINVAL;
                 if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
                         return -EINVAL;
-                if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
-                                uurb->buffer, uurb->buffer_length))
-                        return -EFAULT;
                 snoop(&ps->dev->dev, "interrupt urb\n");
                 break;
 
         default:
                 return -EINVAL;
         }
-        as = alloc_async(uurb->number_of_packets);
-        if (!as) {
+        if (uurb->buffer_length > 0 &&
+                        !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+                                uurb->buffer, uurb->buffer_length)) {
                 kfree(isopkt);
                 kfree(dr);
-                return -ENOMEM;
+                return -EFAULT;
         }
-        as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL);
-        if (!as->urb->transfer_buffer) {
+        as = alloc_async(uurb->number_of_packets);
+        if (!as) {
                 kfree(isopkt);
                 kfree(dr);
-                free_async(as);
                 return -ENOMEM;
         }
+        if (uurb->buffer_length > 0) {
+                as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
+                                GFP_KERNEL);
+                if (!as->urb->transfer_buffer) {
+                        kfree(isopkt);
+                        kfree(dr);
+                        free_async(as);
+                        return -ENOMEM;
+                }
+        }
         as->urb->dev = ps->dev;
         as->urb->pipe = (uurb->type << 30) |
                         __create_pipe(ps->dev, uurb->endpoint & 0xf) |
@@ -1169,7 +1181,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
         kfree(isopkt);
         as->ps = ps;
         as->userurb = arg;
-        if (uurb->endpoint & USB_DIR_IN)
+        if (is_in && uurb->buffer_length > 0)
                 as->userbuffer = uurb->buffer;
         else
                 as->userbuffer = NULL;
@@ -1179,9 +1191,9 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
         as->uid = cred->uid;
         as->euid = cred->euid;
         security_task_getsecid(current, &as->secid);
-        if (!is_in) {
+        if (!is_in && uurb->buffer_length > 0) {
                 if (copy_from_user(as->urb->transfer_buffer, uurb->buffer,
-                                as->urb->transfer_buffer_length)) {
+                                uurb->buffer_length)) {
                         free_async(as);
                         return -EFAULT;
                 }
@@ -1231,22 +1243,22 @@ static int processcompl(struct async *as, void __user * __user *arg)
         if (as->userbuffer)
                 if (copy_to_user(as->userbuffer, urb->transfer_buffer,
                                  urb->transfer_buffer_length))
-                        return -EFAULT;
+                        goto err_out;
         if (put_user(as->status, &userurb->status))
-                return -EFAULT;
+                goto err_out;
         if (put_user(urb->actual_length, &userurb->actual_length))
-                return -EFAULT;
+                goto err_out;
         if (put_user(urb->error_count, &userurb->error_count))
-                return -EFAULT;
+                goto err_out;
 
         if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
                 for (i = 0; i < urb->number_of_packets; i++) {
                         if (put_user(urb->iso_frame_desc[i].actual_length,
                                      &userurb->iso_frame_desc[i].actual_length))
-                                return -EFAULT;
+                                goto err_out;
                         if (put_user(urb->iso_frame_desc[i].status,
                                      &userurb->iso_frame_desc[i].status))
-                                return -EFAULT;
+                                goto err_out;
                 }
         }
 
@@ -1255,6 +1267,10 @@ static int processcompl(struct async *as, void __user * __user *arg)
         if (put_user(addr, (void __user * __user *)arg))
                 return -EFAULT;
         return 0;
+
+err_out:
+        free_async(as);
+        return -EFAULT;
 }
 
 static struct async *reap_as(struct dev_state *ps)
diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
index d397ecfd5b17..ec5c67ea07b7 100644
--- a/drivers/usb/core/hcd.h
+++ b/drivers/usb/core/hcd.h
@@ -227,6 +227,10 @@ struct hc_driver {
                 /* has a port been handed over to a companion? */
         int     (*port_handed_over)(struct usb_hcd *, int);
 
+                /* CLEAR_TT_BUFFER completion callback */
+        void    (*clear_tt_buffer_complete)(struct usb_hcd *,
+                                struct usb_host_endpoint *);
+
         /* xHCI specific functions */
                 /* Called by usb_alloc_dev to alloc HC device structures */
         int     (*alloc_dev)(struct usb_hcd *, struct usb_device *);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 2af3b4f06054..71f86c60d83c 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -450,10 +450,10 @@ hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
  * talking to TTs must queue control transfers (not just bulk and iso), so
  * both can talk to the same hub concurrently.
  */
-static void hub_tt_kevent (struct work_struct *work)
+static void hub_tt_work(struct work_struct *work)
 {
         struct usb_hub          *hub =
-                container_of(work, struct usb_hub, tt.kevent);
+                container_of(work, struct usb_hub, tt.clear_work);
         unsigned long           flags;
         int                     limit = 100;
 
@@ -462,6 +462,7 @@ static void hub_tt_kevent (struct work_struct *work)
                 struct list_head        *next;
                 struct usb_tt_clear     *clear;
                 struct usb_device       *hdev = hub->hdev;
+                const struct hc_driver  *drv;
                 int                     status;
 
                 next = hub->tt.clear_list.next;
@@ -471,21 +472,25 @@ static void hub_tt_kevent (struct work_struct *work)
                 /* drop lock so HCD can concurrently report other TT errors */
                 spin_unlock_irqrestore (&hub->tt.lock, flags);
                 status = hub_clear_tt_buffer (hdev, clear->devinfo, clear->tt);
-                spin_lock_irqsave (&hub->tt.lock, flags);
-
                 if (status)
                         dev_err (&hdev->dev,
                                 "clear tt %d (%04x) error %d\n",
                                 clear->tt, clear->devinfo, status);
+
+                /* Tell the HCD, even if the operation failed */
+                drv = clear->hcd->driver;
+                if (drv->clear_tt_buffer_complete)
+                        (drv->clear_tt_buffer_complete)(clear->hcd, clear->ep);
+
                 kfree(clear);
+                spin_lock_irqsave(&hub->tt.lock, flags);
         }
         spin_unlock_irqrestore (&hub->tt.lock, flags);
 }
 
 /**
- * usb_hub_tt_clear_buffer - clear control/bulk TT state in high speed hub
- * @udev: the device whose split transaction failed
- * @pipe: identifies the endpoint of the failed transaction
+ * usb_hub_clear_tt_buffer - clear control/bulk TT state in high speed hub
+ * @urb: an URB associated with the failed or incomplete split transaction
  *
  * High speed HCDs use this to tell the hub driver that some split control or
  * bulk transaction failed in a way that requires clearing internal state of
@@ -495,8 +500,10 @@ static void hub_tt_kevent (struct work_struct *work)
  * It may not be possible for that hub to handle additional full (or low)
  * speed transactions until that state is fully cleared out.
  */
-void usb_hub_tt_clear_buffer (struct usb_device *udev, int pipe)
+int usb_hub_clear_tt_buffer(struct urb *urb)
 {
+        struct usb_device       *udev = urb->dev;
+        int                     pipe = urb->pipe;
         struct usb_tt           *tt = udev->tt;
         unsigned long           flags;
         struct usb_tt_clear     *clear;
@@ -508,7 +515,7 @@ void usb_hub_tt_clear_buffer (struct usb_device *udev, int pipe)
         if ((clear = kmalloc (sizeof *clear, GFP_ATOMIC)) == NULL) {
                 dev_err (&udev->dev, "can't save CLEAR_TT_BUFFER state\n");
                 /* FIXME recover somehow ... RESET_TT? */
-                return;
+                return -ENOMEM;
         }
 
         /* info that CLEAR_TT_BUFFER needs */
@@ -520,14 +527,19 @@ void usb_hub_tt_clear_buffer (struct usb_device *udev, int pipe)
                         : (USB_ENDPOINT_XFER_BULK << 11);
         if (usb_pipein (pipe))
                 clear->devinfo |= 1 << 15;
-        
+
+        /* info for completion callback */
+        clear->hcd = bus_to_hcd(udev->bus);
+        clear->ep = urb->ep;
+
         /* tell keventd to clear state for this TT */
         spin_lock_irqsave (&tt->lock, flags);
         list_add_tail (&clear->clear_list, &tt->clear_list);
-        schedule_work (&tt->kevent);
+        schedule_work(&tt->clear_work);
         spin_unlock_irqrestore (&tt->lock, flags);
+        return 0;
 }
-EXPORT_SYMBOL_GPL(usb_hub_tt_clear_buffer);
+EXPORT_SYMBOL_GPL(usb_hub_clear_tt_buffer);
 
 /* If do_delay is false, return the number of milliseconds the caller
  * needs to delay.
@@ -818,7 +830,7 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
         if (hub->has_indicators)
                 cancel_delayed_work_sync(&hub->leds);
         if (hub->tt.hub)
-                cancel_work_sync(&hub->tt.kevent);
+                cancel_work_sync(&hub->tt.clear_work);
 }
 
 /* caller has locked the hub device */
@@ -935,7 +947,7 @@ static int hub_configure(struct usb_hub *hub,
 
         spin_lock_init (&hub->tt.lock);
         INIT_LIST_HEAD (&hub->tt.clear_list);
-        INIT_WORK (&hub->tt.kevent, hub_tt_kevent);
+        INIT_WORK(&hub->tt.clear_work, hub_tt_work);
         switch (hdev->descriptor.bDeviceProtocol) {
                 case 0:
                         break;
diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h
index 889c0f32a40b..de8081f065ed 100644
--- a/drivers/usb/core/hub.h
+++ b/drivers/usb/core/hub.h
@@ -188,16 +188,18 @@ struct usb_tt {
         /* for control/bulk error recovery (CLEAR_TT_BUFFER) */
         spinlock_t              lock;
         struct list_head        clear_list;     /* of usb_tt_clear */
-        struct work_struct                      kevent;
+        struct work_struct      clear_work;
 };
 
 struct usb_tt_clear {
         struct list_head        clear_list;
         unsigned                tt;
         u16                     devinfo;
+        struct usb_hcd          *hcd;
+        struct usb_host_endpoint        *ep;
 };
 
-extern void usb_hub_tt_clear_buffer(struct usb_device *dev, int pipe);
+extern int usb_hub_clear_tt_buffer(struct urb *urb);
 extern void usb_ep0_reinit(struct usb_device *);
 
 #endif /* __LINUX_HUB_H */
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 2bed83caacb1..9720e699f472 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -806,6 +806,48 @@ static int usb_string_sub(struct usb_device *dev, unsigned int langid,
         return rc;
 }
 
+static int usb_get_langid(struct usb_device *dev, unsigned char *tbuf)
+{
+        int err;
+
+        if (dev->have_langid)
+                return 0;
+
+        if (dev->string_langid < 0)
+                return -EPIPE;
+
+        err = usb_string_sub(dev, 0, 0, tbuf);
+
+        /* If the string was reported but is malformed, default to english
+         * (0x0409) */
+        if (err == -ENODATA || (err > 0 && err < 4)) {
+                dev->string_langid = 0x0409;
+                dev->have_langid = 1;
+                dev_err(&dev->dev,
+                        "string descriptor 0 malformed (err = %d), "
+                        "defaulting to 0x%04x\n",
+                                err, dev->string_langid);
+                return 0;
+        }
+
+        /* In case of all other errors, we assume the device is not able to
+         * deal with strings at all. Set string_langid to -1 in order to
+         * prevent any string to be retrieved from the device */
+        if (err < 0) {
+                dev_err(&dev->dev, "string descriptor 0 read error: %d\n",
+                                        err);
+                dev->string_langid = -1;
+                return -EPIPE;
+        }
+
+        /* always use the first langid listed */
+        dev->string_langid = tbuf[2] | (tbuf[3] << 8);
+        dev->have_langid = 1;
+        dev_dbg(&dev->dev, "default language 0x%04x\n",
+                                dev->string_langid);
+        return 0;
+}
+
 /**
  * usb_string - returns UTF-8 version of a string descriptor
  * @dev: the device whose string descriptor is being retrieved
@@ -837,24 +879,9 @@ int usb_string(struct usb_device *dev, int index, char *buf, size_t size)
         if (!tbuf)
                 return -ENOMEM;
 
-        /* get langid for strings if it's not yet known */
-        if (!dev->have_langid) {
-                err = usb_string_sub(dev, 0, 0, tbuf);
-                if (err < 0) {
-                        dev_err(&dev->dev,
-                                "string descriptor 0 read error: %d\n",
-                                err);
-                } else if (err < 4) {
-                        dev_err(&dev->dev, "string descriptor 0 too short\n");
-                } else {
-                        dev->string_langid = tbuf[2] | (tbuf[3] << 8);
-                        /* always use the first langid listed */
-                        dev_dbg(&dev->dev, "default language 0x%04x\n",
-                                dev->string_langid);
-                }
-
-                dev->have_langid = 1;
-        }
+        err = usb_get_langid(dev, tbuf);
+        if (err < 0)
+                goto errout;
 
         err = usb_string_sub(dev, dev->string_langid, index, tbuf);
         if (err < 0)
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 5d1ddf485d1e..7f8e83a954ac 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -286,6 +286,27 @@ config USB_S3C_HSOTG
         default USB_GADGET
         select USB_GADGET_SELECTED
 
+config USB_GADGET_IMX
+        boolean "Freescale IMX USB Peripheral Controller"
+        depends on ARCH_MX1
+        help
+           Freescale's IMX series include an integrated full speed
+           USB 1.1 device controller.  The controller in the IMX series
+           is register-compatible.
+
+           It has Six fixed-function endpoints, as well as endpoint
+           zero (for control transfers).
+
+           Say "y" to link the driver statically, or "m" to build a
+           dynamically linked module called "imx_udc" and force all
+           gadget drivers to also be dynamically linked.
+
+config USB_IMX
+        tristate
+        depends on USB_GADGET_IMX
+        default USB_GADGET
+        select USB_GADGET_SELECTED
+
 config USB_GADGET_S3C2410
         boolean "S3C2410 USB Device Controller"
         depends on ARCH_S3C2410
@@ -321,27 +342,6 @@ config USB_GADGET_MUSB_HDRC
           This OTG-capable silicon IP is used in dual designs including
           the TI DaVinci, OMAP 243x, OMAP 343x, TUSB 6010, and ADI Blackfin
 
-config USB_GADGET_IMX
-        boolean "Freescale IMX USB Peripheral Controller"
-        depends on ARCH_MX1
-        help
-           Freescale's IMX series include an integrated full speed
-           USB 1.1 device controller.  The controller in the IMX series
-           is register-compatible.
-
-           It has Six fixed-function endpoints, as well as endpoint
-           zero (for control transfers).
-
-           Say "y" to link the driver statically, or "m" to build a
-           dynamically linked module called "imx_udc" and force all
-           gadget drivers to also be dynamically linked.
-
-config USB_IMX
-        tristate
-        depends on USB_GADGET_IMX
-        default USB_GADGET
-        select USB_GADGET_SELECTED
-
 config USB_GADGET_M66592
         boolean "Renesas M66592 USB Peripheral Controller"
         select USB_GADGET_DUALSPEED
@@ -604,6 +604,7 @@ config USB_ZERO_HNPTEST
 config USB_AUDIO
         tristate "Audio Gadget (EXPERIMENTAL)"
         depends on SND
+        select SND_PCM
         help
           Gadget Audio is compatible with USB Audio Class specification 1.0.
           It will include at least one AudioControl interface, zero or more
diff --git a/drivers/usb/gadget/amd5536udc.c b/drivers/usb/gadget/amd5536udc.c
index 826f3adde5d8..77352ccc245e 100644
--- a/drivers/usb/gadget/amd5536udc.c
+++ b/drivers/usb/gadget/amd5536udc.c
@@ -48,7 +48,6 @@
 #include <linux/ioport.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/timer.h>
diff --git a/drivers/usb/gadget/audio.c b/drivers/usb/gadget/audio.c
index 94de7e864614..9f80f4e970bd 100644
--- a/drivers/usb/gadget/audio.c
+++ b/drivers/usb/gadget/audio.c
@@ -42,9 +42,9 @@
  * Instead:  allocate your own, using normal USB-IF procedures.
  */
 
-/* Thanks to NetChip Technologies for donating this product ID. */
-#define AUDIO_VENDOR_NUM                0x0525  /* NetChip */
-#define AUDIO_PRODUCT_NUM               0xa4a1  /* Linux-USB Audio Gadget */
+/* Thanks to Linux Foundation for donating this product ID. */
+#define AUDIO_VENDOR_NUM                0x1d6b  /* Linux Foundation */
+#define AUDIO_PRODUCT_NUM               0x0101  /* Linux-USB Audio Gadget */
 
 /*-------------------------------------------------------------------------*/
 
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index d006dc652e02..bd102f5052ba 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -293,15 +293,16 @@ static int __init eth_bind(struct usb_composite_dev *cdev)
                 /* CDC Subset */
                 eth_config_driver.label = "CDC Subset/SAFE";
 
-                device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM),
-                device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM),
-                device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
+                device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM);
+                device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM);
+                if (!has_rndis())
+                        device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
         }
 
         if (has_rndis()) {
                 /* RNDIS plus ECM-or-Subset */
-                device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM),
-                device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM),
+                device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM);
+                device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM);
                 device_desc.bNumConfigurations = 2;
         }
 
diff --git a/drivers/usb/gadget/langwell_udc.c b/drivers/usb/gadget/langwell_udc.c
index 6829d5961359..a3913519fd58 100644
--- a/drivers/usb/gadget/langwell_udc.c
+++ b/drivers/usb/gadget/langwell_udc.c
@@ -34,7 +34,6 @@
 #include <linux/ioport.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/timer.h>
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index 0ce4e2819847..ed21e263f832 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -139,7 +139,7 @@ static int is_vbus_present(void)
 {
         struct pxa2xx_udc_mach_info             *mach = the_controller->mach;
 
-        if (mach->gpio_vbus) {
+        if (gpio_is_valid(mach->gpio_vbus)) {
                 int value = gpio_get_value(mach->gpio_vbus);
 
                 if (mach->gpio_vbus_inverted)
@@ -158,7 +158,7 @@ static void pullup_off(void)
         struct pxa2xx_udc_mach_info             *mach = the_controller->mach;
         int off_level = mach->gpio_pullup_inverted;
 
-        if (mach->gpio_pullup)
+        if (gpio_is_valid(mach->gpio_pullup))
                 gpio_set_value(mach->gpio_pullup, off_level);
         else if (mach->udc_command)
                 mach->udc_command(PXA2XX_UDC_CMD_DISCONNECT);
@@ -169,7 +169,7 @@ static void pullup_on(void)
         struct pxa2xx_udc_mach_info             *mach = the_controller->mach;
         int on_level = !mach->gpio_pullup_inverted;
 
-        if (mach->gpio_pullup)
+        if (gpio_is_valid(mach->gpio_pullup))
                 gpio_set_value(mach->gpio_pullup, on_level);
         else if (mach->udc_command)
                 mach->udc_command(PXA2XX_UDC_CMD_CONNECT);
@@ -1000,7 +1000,7 @@ static int pxa25x_udc_pullup(struct usb_gadget *_gadget, int is_active)
         udc = container_of(_gadget, struct pxa25x_udc, gadget);
 
         /* not all boards support pullup control */
-        if (!udc->mach->gpio_pullup && !udc->mach->udc_command)
+        if (!gpio_is_valid(udc->mach->gpio_pullup) && !udc->mach->udc_command)
                 return -EOPNOTSUPP;
 
         udc->pullup = (is_active != 0);
@@ -1802,11 +1802,13 @@ pxa25x_udc_irq(int irq, void *_dev)
                                         USIR0 |= tmp;
                                         handled = 1;
                                 }
+#ifndef CONFIG_USB_PXA25X_SMALL
                                 if (usir1 & tmp) {
                                         handle_ep(&dev->ep[i+8]);
                                         USIR1 |= tmp;
                                         handled = 1;
                                 }
+#endif
                         }
                 }
 
@@ -2160,7 +2162,7 @@ static int __init pxa25x_udc_probe(struct platform_device *pdev)
         dev->dev = &pdev->dev;
         dev->mach = pdev->dev.platform_data;
 
-        if (dev->mach->gpio_vbus) {
+        if (gpio_is_valid(dev->mach->gpio_vbus)) {
                 if ((retval = gpio_request(dev->mach->gpio_vbus,
                                 "pxa25x_udc GPIO VBUS"))) {
                         dev_dbg(&pdev->dev,
@@ -2173,7 +2175,7 @@ static int __init pxa25x_udc_probe(struct platform_device *pdev)
         } else
                 vbus_irq = 0;
 
-        if (dev->mach->gpio_pullup) {
+        if (gpio_is_valid(dev->mach->gpio_pullup)) {
                 if ((retval = gpio_request(dev->mach->gpio_pullup,
                                 "pca25x_udc GPIO PULLUP"))) {
                         dev_dbg(&pdev->dev,
@@ -2256,10 +2258,10 @@ lubbock_fail0:
 #endif
         free_irq(irq, dev);
  err_irq1:
-        if (dev->mach->gpio_pullup)
+        if (gpio_is_valid(dev->mach->gpio_pullup))
                 gpio_free(dev->mach->gpio_pullup);
  err_gpio_pullup:
-        if (dev->mach->gpio_vbus)
+        if (gpio_is_valid(dev->mach->gpio_vbus))
                 gpio_free(dev->mach->gpio_vbus);
  err_gpio_vbus:
         clk_put(dev->clk);
@@ -2294,11 +2296,11 @@ static int __exit pxa25x_udc_remove(struct platform_device *pdev)
                 free_irq(LUBBOCK_USB_IRQ, dev);
         }
 #endif
-        if (dev->mach->gpio_vbus) {
+        if (gpio_is_valid(dev->mach->gpio_vbus)) {
                 free_irq(gpio_to_irq(dev->mach->gpio_vbus), dev);
                 gpio_free(dev->mach->gpio_vbus);
         }
-        if (dev->mach->gpio_pullup)
+        if (gpio_is_valid(dev->mach->gpio_pullup))
                 gpio_free(dev->mach->gpio_pullup);
 
         clk_put(dev->clk);
@@ -2329,7 +2331,7 @@ static int pxa25x_udc_suspend(struct platform_device *dev, pm_message_t state)
         struct pxa25x_udc       *udc = platform_get_drvdata(dev);
         unsigned long flags;
 
-        if (!udc->mach->gpio_pullup && !udc->mach->udc_command)
+        if (!gpio_is_valid(udc->mach->gpio_pullup) && !udc->mach->udc_command)
                 WARNING("USB host won't detect disconnect!\n");
         udc->suspended = 1;
 
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 2b4660e08c4d..ca41b0b5afb3 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -442,6 +442,8 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 
         case OID_802_3_MAC_OPTIONS:
                 pr_debug("%s: OID_802_3_MAC_OPTIONS\n", __func__);
+                *outbuf = cpu_to_le32(0);
+                retval = 0;
                 break;
 
         /* ieee802.3 statistics OIDs (table 4-4) */
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index 9a2b8920532d..a9b452fe6221 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -28,7 +28,6 @@
 #include <linux/ioport.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/timer.h>
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 0c03471f0d41..1a920c70b5a1 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -181,26 +181,27 @@ config USB_OHCI_HCD_PPC_SOC
           Enables support for the USB controller on the MPC52xx or
           STB03xxx processor chip.  If unsure, say Y.
 
-config USB_OHCI_HCD_PPC_OF
-        bool "OHCI support for PPC USB controller on OF platform bus"
-        depends on USB_OHCI_HCD && PPC_OF
-        default y
-        ---help---
-          Enables support for the USB controller PowerPC present on the
-          OpenFirmware platform bus.
-
 config USB_OHCI_HCD_PPC_OF_BE
-        bool "Support big endian HC"
-        depends on USB_OHCI_HCD_PPC_OF
-        default y
+        bool "OHCI support for OF platform bus (big endian)"
+        depends on USB_OHCI_HCD && PPC_OF
         select USB_OHCI_BIG_ENDIAN_DESC
         select USB_OHCI_BIG_ENDIAN_MMIO
+        ---help---
+          Enables support for big-endian USB controllers present on the
+          OpenFirmware platform bus.
 
 config USB_OHCI_HCD_PPC_OF_LE
-        bool "Support little endian HC"
-        depends on USB_OHCI_HCD_PPC_OF
-        default n
+        bool "OHCI support for OF platform bus (little endian)"
+        depends on USB_OHCI_HCD && PPC_OF
         select USB_OHCI_LITTLE_ENDIAN
+        ---help---
+          Enables support for little-endian USB controllers present on the
+          OpenFirmware platform bus.
+
+config USB_OHCI_HCD_PPC_OF
+        bool
+        depends on USB_OHCI_HCD && PPC_OF
+        default USB_OHCI_HCD_PPC_OF_BE || USB_OHCI_HCD_PPC_OF_LE
 
 config USB_OHCI_HCD_PCI
         bool "OHCI support for PCI-bus USB controllers"
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index c3a778bd359c..59d208d94d4e 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -113,6 +113,8 @@ static const struct hc_driver ehci_au1xxx_hc_driver = {
         .bus_resume             = ehci_bus_resume,
         .relinquish_port        = ehci_relinquish_port,
         .port_handed_over       = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
 };
 
 static int ehci_hcd_au1xxx_drv_probe(struct platform_device *pdev)
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index bf86809c5120..991174937db3 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -325,6 +325,8 @@ static const struct hc_driver ehci_fsl_hc_driver = {
         .bus_resume = ehci_bus_resume,
         .relinquish_port = ehci_relinquish_port,
         .port_handed_over = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
 };
 
 static int ehci_fsl_drv_probe(struct platform_device *pdev)
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 2b72473544d3..7d03549c3339 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -1003,6 +1003,8 @@ idle_timeout:
                 schedule_timeout_uninterruptible(1);
                 goto rescan;
         case QH_STATE_IDLE:             /* fully unlinked */
+                if (qh->clearing_tt)
+                        goto idle_timeout;
                 if (list_empty (&qh->qtd_list)) {
                         qh_put (qh);
                         break;
@@ -1030,12 +1032,14 @@ ehci_endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
         struct ehci_hcd         *ehci = hcd_to_ehci(hcd);
         struct ehci_qh          *qh;
         int                     eptype = usb_endpoint_type(&ep->desc);
+        int                     epnum = usb_endpoint_num(&ep->desc);
+        int                     is_out = usb_endpoint_dir_out(&ep->desc);
+        unsigned long           flags;
 
         if (eptype != USB_ENDPOINT_XFER_BULK && eptype != USB_ENDPOINT_XFER_INT)
                 return;
 
- rescan:
-        spin_lock_irq(&ehci->lock);
+        spin_lock_irqsave(&ehci->lock, flags);
         qh = ep->hcpriv;
 
         /* For Bulk and Interrupt endpoints we maintain the toggle state
@@ -1044,29 +1048,24 @@ ehci_endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
          * the toggle bit in the QH.
          */
         if (qh) {
+                usb_settoggle(qh->dev, epnum, is_out, 0);
                 if (!list_empty(&qh->qtd_list)) {
                         WARN_ONCE(1, "clear_halt for a busy endpoint\n");
-                } else if (qh->qh_state == QH_STATE_IDLE) {
-                        qh->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
-                } else {
-                        /* It's not safe to write into the overlay area
-                         * while the QH is active.  Unlink it first and
-                         * wait for the unlink to complete.
+                } else if (qh->qh_state == QH_STATE_LINKED) {
+
+                        /* The toggle value in the QH can't be updated
+                         * while the QH is active.  Unlink it now;
+                         * re-linking will call qh_refresh().
                          */
-                        if (qh->qh_state == QH_STATE_LINKED) {
-                                if (eptype == USB_ENDPOINT_XFER_BULK) {
-                                        unlink_async(ehci, qh);
-                                } else {
-                                        intr_deschedule(ehci, qh);
-                                        (void) qh_schedule(ehci, qh);
-                                }
+                        if (eptype == USB_ENDPOINT_XFER_BULK) {
+                                unlink_async(ehci, qh);
+                        } else {
+                                intr_deschedule(ehci, qh);
+                                (void) qh_schedule(ehci, qh);
                         }
-                        spin_unlock_irq(&ehci->lock);
-                        schedule_timeout_uninterruptible(1);
-                        goto rescan;
                 }
         }
-        spin_unlock_irq(&ehci->lock);
+        spin_unlock_irqrestore(&ehci->lock, flags);
 }
 
 static int ehci_get_frame (struct usb_hcd *hcd)
diff --git a/drivers/usb/host/ehci-ixp4xx.c b/drivers/usb/host/ehci-ixp4xx.c
index a44bb4a94954..89b7c70c6ed6 100644
--- a/drivers/usb/host/ehci-ixp4xx.c
+++ b/drivers/usb/host/ehci-ixp4xx.c
@@ -61,6 +61,8 @@ static const struct hc_driver ixp4xx_ehci_hc_driver = {
 #endif
         .relinquish_port        = ehci_relinquish_port,
         .port_handed_over       = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
 };
 
 static int ixp4xx_ehci_probe(struct platform_device *pdev)
diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c
index 770dd9aba62a..dc2ac613a9d1 100644
--- a/drivers/usb/host/ehci-orion.c
+++ b/drivers/usb/host/ehci-orion.c
@@ -165,6 +165,8 @@ static const struct hc_driver ehci_orion_hc_driver = {
         .bus_resume = ehci_bus_resume,
         .relinquish_port = ehci_relinquish_port,
         .port_handed_over = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
 };
 
 static void __init
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index f3683e1da161..c2f1b7df918c 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -404,6 +404,8 @@ static const struct hc_driver ehci_pci_hc_driver = {
         .bus_resume =           ehci_bus_resume,
         .relinquish_port =      ehci_relinquish_port,
         .port_handed_over =     ehci_port_handed_over,
+
+        .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
 };
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci-ppc-of.c b/drivers/usb/host/ehci-ppc-of.c
index fbd272288fc2..36f96da129f5 100644
--- a/drivers/usb/host/ehci-ppc-of.c
+++ b/drivers/usb/host/ehci-ppc-of.c
@@ -79,6 +79,8 @@ static const struct hc_driver ehci_ppc_of_hc_driver = {
 #endif
         .relinquish_port        = ehci_relinquish_port,
         .port_handed_over       = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
 };
 
 
diff --git a/drivers/usb/host/ehci-ps3.c b/drivers/usb/host/ehci-ps3.c
index 93f7035d00a1..1dee33b9139e 100644
--- a/drivers/usb/host/ehci-ps3.c
+++ b/drivers/usb/host/ehci-ps3.c
@@ -75,6 +75,8 @@ static const struct hc_driver ps3_ehci_hc_driver = {
 #endif
         .relinquish_port        = ehci_relinquish_port,
         .port_handed_over       = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
 };
 
 static int __devinit ps3_ehci_probe(struct ps3_system_bus_device *dev)
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 3192f683f807..9a1384747f3b 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -93,6 +93,22 @@ qh_update (struct ehci_hcd *ehci, struct ehci_qh *qh, struct ehci_qtd *qtd)
         qh->hw_qtd_next = QTD_NEXT(ehci, qtd->qtd_dma);
         qh->hw_alt_next = EHCI_LIST_END(ehci);
 
+        /* Except for control endpoints, we make hardware maintain data
+         * toggle (like OHCI) ... here (re)initialize the toggle in the QH,
+         * and set the pseudo-toggle in udev. Only usb_clear_halt() will
+         * ever clear it.
+         */
+        if (!(qh->hw_info1 & cpu_to_hc32(ehci, 1 << 14))) {
+                unsigned        is_out, epnum;
+
+                is_out = !(qtd->hw_token & cpu_to_hc32(ehci, 1 << 8));
+                epnum = (hc32_to_cpup(ehci, &qh->hw_info1) >> 8) & 0x0f;
+                if (unlikely (!usb_gettoggle (qh->dev, epnum, is_out))) {
+                        qh->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
+                        usb_settoggle (qh->dev, epnum, is_out, 1);
+                }
+        }
+
         /* HC must see latest qtd and qh data before we clear ACTIVE+HALT */
         wmb ();
         qh->hw_token &= cpu_to_hc32(ehci, QTD_TOGGLE | QTD_STS_PING);
@@ -123,6 +139,55 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
 /*-------------------------------------------------------------------------*/
 
+static void qh_link_async(struct ehci_hcd *ehci, struct ehci_qh *qh);
+
+static void ehci_clear_tt_buffer_complete(struct usb_hcd *hcd,
+                struct usb_host_endpoint *ep)
+{
+        struct ehci_hcd         *ehci = hcd_to_ehci(hcd);
+        struct ehci_qh          *qh = ep->hcpriv;
+        unsigned long           flags;
+
+        spin_lock_irqsave(&ehci->lock, flags);
+        qh->clearing_tt = 0;
+        if (qh->qh_state == QH_STATE_IDLE && !list_empty(&qh->qtd_list)
+                        && HC_IS_RUNNING(hcd->state))
+                qh_link_async(ehci, qh);
+        spin_unlock_irqrestore(&ehci->lock, flags);
+}
+
+static void ehci_clear_tt_buffer(struct ehci_hcd *ehci, struct ehci_qh *qh,
+                struct urb *urb, u32 token)
+{
+
+        /* If an async split transaction gets an error or is unlinked,
+         * the TT buffer may be left in an indeterminate state.  We
+         * have to clear the TT buffer.
+         *
+         * Note: this routine is never called for Isochronous transfers.
+         */
+        if (urb->dev->tt && !usb_pipeint(urb->pipe) && !qh->clearing_tt) {
+#ifdef DEBUG
+                struct usb_device *tt = urb->dev->tt->hub;
+                dev_dbg(&tt->dev,
+                        "clear tt buffer port %d, a%d ep%d t%08x\n",
+                        urb->dev->ttport, urb->dev->devnum,
+                        usb_pipeendpoint(urb->pipe), token);
+#endif /* DEBUG */
+                if (!ehci_is_TDI(ehci)
+                                || urb->dev->tt->hub !=
+                                   ehci_to_hcd(ehci)->self.root_hub) {
+                        if (usb_hub_clear_tt_buffer(urb) == 0)
+                                qh->clearing_tt = 1;
+                } else {
+
+                        /* REVISIT ARC-derived cores don't clear the root
+                         * hub TT buffer in this way...
+                         */
+                }
+        }
+}
+
 static int qtd_copy_status (
         struct ehci_hcd *ehci,
         struct urb *urb,
@@ -149,6 +214,14 @@ static int qtd_copy_status (
                 if (token & QTD_STS_BABBLE) {
                         /* FIXME "must" disable babbling device's port too */
                         status = -EOVERFLOW;
+                /* CERR nonzero + halt --> stall */
+                } else if (QTD_CERR(token)) {
+                        status = -EPIPE;
+
+                /* In theory, more than one of the following bits can be set
+                 * since they are sticky and the transaction is retried.
+                 * Which to test first is rather arbitrary.
+                 */
                 } else if (token & QTD_STS_MMF) {
                         /* fs/ls interrupt xfer missed the complete-split */
                         status = -EPROTO;
@@ -157,21 +230,15 @@ static int qtd_copy_status (
                                 ? -ENOSR  /* hc couldn't read data */
                                 : -ECOMM; /* hc couldn't write data */
                 } else if (token & QTD_STS_XACT) {
-                        /* timeout, bad crc, wrong PID, etc; retried */
-                        if (QTD_CERR (token))
-                                status = -EPIPE;
-                        else {
-                                ehci_dbg (ehci, "devpath %s ep%d%s 3strikes\n",
-                                        urb->dev->devpath,
-                                        usb_pipeendpoint (urb->pipe),
-                                        usb_pipein (urb->pipe) ? "in" : "out");
-                                status = -EPROTO;
-                        }
-                /* CERR nonzero + no errors + halt --> stall */
-                } else if (QTD_CERR (token))
-                        status = -EPIPE;
-                else    /* unknown */
+                        /* timeout, bad CRC, wrong PID, etc */
+                        ehci_dbg(ehci, "devpath %s ep%d%s 3strikes\n",
+                                urb->dev->devpath,
+                                usb_pipeendpoint(urb->pipe),
+                                usb_pipein(urb->pipe) ? "in" : "out");
+                        status = -EPROTO;
+                } else {        /* unknown */
                         status = -EPROTO;
+                }
 
                 ehci_vdbg (ehci,
                         "dev%d ep%d%s qtd token %08x --> status %d\n",
@@ -179,28 +246,6 @@ static int qtd_copy_status (
                         usb_pipeendpoint (urb->pipe),
                         usb_pipein (urb->pipe) ? "in" : "out",
                         token, status);
-
-                /* if async CSPLIT failed, try cleaning out the TT buffer */
-                if (status != -EPIPE
-                                && urb->dev->tt
-                                && !usb_pipeint(urb->pipe)
-                                && ((token & QTD_STS_MMF) != 0
-                                        || QTD_CERR(token) == 0)
-                                && (!ehci_is_TDI(ehci)
-                                        || urb->dev->tt->hub !=
-                                           ehci_to_hcd(ehci)->self.root_hub)) {
-#ifdef DEBUG
-                        struct usb_device *tt = urb->dev->tt->hub;
-                        dev_dbg (&tt->dev,
-                                "clear tt buffer port %d, a%d ep%d t%08x\n",
-                                urb->dev->ttport, urb->dev->devnum,
-                                usb_pipeendpoint (urb->pipe), token);
-#endif /* DEBUG */
-                        /* REVISIT ARC-derived cores don't clear the root
-                         * hub TT buffer in this way...
-                         */
-                        usb_hub_tt_clear_buffer (urb->dev, urb->pipe);
-                }
         }
 
         return status;
@@ -391,9 +436,16 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                         /* qh unlinked; token in overlay may be most current */
                         if (state == QH_STATE_IDLE
                                         && cpu_to_hc32(ehci, qtd->qtd_dma)
-                                                == qh->hw_current)
+                                                == qh->hw_current) {
                                 token = hc32_to_cpu(ehci, qh->hw_token);
 
+                                /* An unlink may leave an incomplete
+                                 * async transaction in the TT buffer.
+                                 * We have to clear it.
+                                 */
+                                ehci_clear_tt_buffer(ehci, qh, urb, token);
+                        }
+
                         /* force halt for unlinked or blocked qh, so we'll
                          * patch the qh later and so that completions can't
                          * activate it while we "know" it's stopped.
@@ -419,6 +471,13 @@ halt:
                                         && (qtd->hw_alt_next
                                                 & EHCI_LIST_END(ehci)))
                                 last_status = -EINPROGRESS;
+
+                        /* As part of low/full-speed endpoint-halt processing
+                         * we must clear the TT buffer (11.17.5).
+                         */
+                        if (unlikely(last_status != -EINPROGRESS &&
+                                        last_status != -EREMOTEIO))
+                                ehci_clear_tt_buffer(ehci, qh, urb, token);
                 }
 
                 /* if we're removing something not at the queue head,
@@ -834,6 +893,7 @@ done:
         qh->qh_state = QH_STATE_IDLE;
         qh->hw_info1 = cpu_to_hc32(ehci, info1);
         qh->hw_info2 = cpu_to_hc32(ehci, info2);
+        usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), !is_input, 1);
         qh_refresh (ehci, qh);
         return qh;
 }
@@ -847,6 +907,10 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
         __hc32          dma = QH_NEXT(ehci, qh->qh_dma);
         struct ehci_qh  *head;
 
+        /* Don't link a QH if there's a Clear-TT-Buffer pending */
+        if (unlikely(qh->clearing_tt))
+                return;
+
         /* (re)start the async schedule? */
         head = ehci->async;
         timer_action_done (ehci, TIMER_ASYNC_OFF);
@@ -864,7 +928,7 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
                 }
         }
 
-        /* clear halt and maybe recover from silicon quirk */
+        /* clear halt and/or toggle; and maybe recover from silicon quirk */
         if (qh->qh_state == QH_STATE_IDLE)
                 qh_refresh (ehci, qh);
 
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 9d1babc7ff65..74f7f83b29ad 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1619,11 +1619,14 @@ itd_complete (
                                 desc->status = -EPROTO;
 
                         /* HC need not update length with this error */
-                        if (!(t & EHCI_ISOC_BABBLE))
-                                desc->actual_length = EHCI_ITD_LENGTH (t);
+                        if (!(t & EHCI_ISOC_BABBLE)) {
+                                desc->actual_length = EHCI_ITD_LENGTH(t);
+                                urb->actual_length += desc->actual_length;
+                        }
                 } else if (likely ((t & EHCI_ISOC_ACTIVE) == 0)) {
                         desc->status = 0;
-                        desc->actual_length = EHCI_ITD_LENGTH (t);
+                        desc->actual_length = EHCI_ITD_LENGTH(t);
+                        urb->actual_length += desc->actual_length;
                 } else {
                         /* URB was too late */
                         desc->status = -EXDEV;
@@ -2014,7 +2017,8 @@ sitd_complete (
                         desc->status = -EPROTO;
         } else {
                 desc->status = 0;
-                desc->actual_length = desc->length - SITD_LENGTH (t);
+                desc->actual_length = desc->length - SITD_LENGTH(t);
+                urb->actual_length += desc->actual_length;
         }
         stream->depth -= stream->interval << 3;
 
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 90ad3395bb21..2bfff30f4704 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -354,7 +354,9 @@ struct ehci_qh {
         unsigned short          period;         /* polling interval */
         unsigned short          start;          /* where polling starts */
 #define NO_FRAME ((unsigned short)~0)                   /* pick new start */
+
         struct usb_device       *dev;           /* access to TT */
+        unsigned                clearing_tt:1;  /* Clear-TT-Buf in progress */
 } __attribute__ ((aligned (32)));
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/fhci-sched.c b/drivers/usb/host/fhci-sched.c
index bb63b68ddb77..62a226b61670 100644
--- a/drivers/usb/host/fhci-sched.c
+++ b/drivers/usb/host/fhci-sched.c
@@ -576,9 +576,7 @@ irqreturn_t fhci_irq(struct usb_hcd *hcd)
                         out_be16(&usb->fhci->regs->usb_event,
                                  usb->saved_msk);
                 } else if (usb->port_status == FHCI_PORT_DISABLED) {
-                        if (fhci_ioports_check_bus_state(fhci) == 1 &&
-                                        usb->port_status != FHCI_PORT_LOW &&
-                                        usb->port_status != FHCI_PORT_FULL)
+                        if (fhci_ioports_check_bus_state(fhci) == 1)
                                 fhci_device_connected_interrupt(fhci);
                 }
                 usb_er &= ~USB_E_RESET_MASK;
@@ -605,9 +603,7 @@ irqreturn_t fhci_irq(struct usb_hcd *hcd)
         }
 
         if (usb_er & USB_E_IDLE_MASK) {
-                if (usb->port_status == FHCI_PORT_DISABLED &&
-                                usb->port_status != FHCI_PORT_LOW &&
-                                usb->port_status != FHCI_PORT_FULL) {
+                if (usb->port_status == FHCI_PORT_DISABLED) {
                         usb_er &= ~USB_E_RESET_MASK;
                         fhci_device_connected_interrupt(fhci);
                 } else if (usb->port_status ==
diff --git a/drivers/usb/host/isp1760-if.c b/drivers/usb/host/isp1760-if.c
index 3fa3a1702796..d4feebfc63bd 100644
--- a/drivers/usb/host/isp1760-if.c
+++ b/drivers/usb/host/isp1760-if.c
@@ -361,7 +361,7 @@ static int __devexit isp1760_plat_remove(struct platform_device *pdev)
 
 static struct platform_driver isp1760_plat_driver = {
         .probe  = isp1760_plat_probe,
-        .remove = isp1760_plat_remove,
+        .remove = __devexit_p(isp1760_plat_remove),
         .driver = {
                 .name   = "isp1760",
         },
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index 56976cc0352a..e18f74946e68 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -26,7 +26,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/timer.h>
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 3c5fe5cee05a..90e1a8dedfa9 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -18,6 +18,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/poll.h>
 #include <linux/usb/iowarrior.h>
 
diff --git a/drivers/usb/misc/rio500.c b/drivers/usb/misc/rio500.c
index deb95bb49fd1..d645f3899fe1 100644
--- a/drivers/usb/misc/rio500.c
+++ b/drivers/usb/misc/rio500.c
@@ -32,6 +32,7 @@
 #include <linux/kernel.h>
 #include <linux/signal.h>
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/random.h>
 #include <linux/poll.h>
diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c
index e0ff9ccd866b..29092b8e59ce 100644
--- a/drivers/usb/misc/usblcd.c
+++ b/drivers/usb/misc/usblcd.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/mutex.h>
 #include <asm/uaccess.h>
diff --git a/drivers/usb/musb/cppi_dma.h b/drivers/usb/musb/cppi_dma.h
index 8a39de3e6e47..59bf949e589b 100644
--- a/drivers/usb/musb/cppi_dma.h
+++ b/drivers/usb/musb/cppi_dma.h
@@ -5,7 +5,6 @@
 
 #include <linux/slab.h>
 #include <linux/list.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/dmapool.h>
 
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 180d7daa4099..e16ff605c458 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -35,13 +35,14 @@
 #include <mach/hardware.h>
 #include <mach/memory.h>
 #include <mach/gpio.h>
+#include <mach/cputype.h>
 
 #include <asm/mach-types.h>
 
 #include "musb_core.h"
 
 #ifdef CONFIG_MACH_DAVINCI_EVM
-#define GPIO_nVBUS_DRV          87
+#define GPIO_nVBUS_DRV          144
 #endif
 
 #include "davinci.h"
@@ -329,7 +330,6 @@ static irqreturn_t davinci_interrupt(int irq, void *__hci)
                         mod_timer(&otg_workaround, jiffies + POLL_SECONDS * HZ);
                         WARNING("VBUS error workaround (delay coming)\n");
                 } else if (is_host_enabled(musb) && drvvbus) {
-                        musb->is_active = 1;
                         MUSB_HST_MODE(musb);
                         musb->xceiv->default_a = 1;
                         musb->xceiv->state = OTG_STATE_A_WAIT_VRISE;
@@ -343,7 +343,9 @@ static irqreturn_t davinci_interrupt(int irq, void *__hci)
                         portstate(musb->port1_status &= ~USB_PORT_STAT_POWER);
                 }
 
-                /* NOTE:  this must complete poweron within 100 msec */
+                /* NOTE:  this must complete poweron within 100 msec
+                 * (OTG_TIME_A_WAIT_VRISE) but we don't check for that.
+                 */
                 davinci_source_power(musb, drvvbus, 0);
                 DBG(2, "VBUS %s (%s)%s, devctl %02x\n",
                                 drvvbus ? "on" : "off",
@@ -411,6 +413,21 @@ int __init musb_platform_init(struct musb *musb)
                 __raw_writel(phy_ctrl, USB_PHY_CTRL);
         }
 
+        /* On dm355, the default-A state machine needs DRVVBUS control.
+         * If we won't be a host, there's no need to turn it on.
+         */
+        if (cpu_is_davinci_dm355()) {
+                u32     deepsleep = __raw_readl(DM355_DEEPSLEEP);
+
+                if (is_host_enabled(musb)) {
+                        deepsleep &= ~DRVVBUS_OVERRIDE;
+                } else {
+                        deepsleep &= ~DRVVBUS_FORCE;
+                        deepsleep |= DRVVBUS_OVERRIDE;
+                }
+                __raw_writel(deepsleep, DM355_DEEPSLEEP);
+        }
+
         /* reset the controller */
         musb_writel(tibase, DAVINCI_USB_CTRL_REG, 0x1);
 
@@ -437,6 +454,15 @@ int musb_platform_exit(struct musb *musb)
         if (is_host_enabled(musb))
                 del_timer_sync(&otg_workaround);
 
+        /* force VBUS off */
+        if (cpu_is_davinci_dm355()) {
+                u32     deepsleep = __raw_readl(DM355_DEEPSLEEP);
+
+                deepsleep &= ~DRVVBUS_FORCE;
+                deepsleep |= DRVVBUS_OVERRIDE;
+                __raw_writel(deepsleep, DM355_DEEPSLEEP);
+        }
+
         davinci_source_power(musb, 0 /*off*/, 1);
 
         /* delay, to avoid problems with module reload */
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index f3772ca3b2cf..381d648a36b8 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -38,7 +38,6 @@
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/interrupt.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/timer.h>
 #include <linux/clk.h>
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 94a2a350a414..cf94511485f2 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -373,7 +373,7 @@ static void musb_advance_schedule(struct musb *musb, struct urb *urb,
                 musb_save_toggle(qh, is_in, urb);
                 break;
         case USB_ENDPOINT_XFER_ISOC:
-                if (urb->error_count)
+                if (status == 0 && urb->error_count)
                         status = -EXDEV;
                 break;
         }
@@ -2235,13 +2235,30 @@ static void musb_h_stop(struct usb_hcd *hcd)
 static int musb_bus_suspend(struct usb_hcd *hcd)
 {
         struct musb     *musb = hcd_to_musb(hcd);
+        u8              devctl;
 
-        if (musb->xceiv->state == OTG_STATE_A_SUSPEND)
+        if (!is_host_active(musb))
                 return 0;
 
-        if (is_host_active(musb) && musb->is_active) {
-                WARNING("trying to suspend as %s is_active=%i\n",
-                        otg_state_string(musb), musb->is_active);
+        switch (musb->xceiv->state) {
+        case OTG_STATE_A_SUSPEND:
+                return 0;
+        case OTG_STATE_A_WAIT_VRISE:
+                /* ID could be grounded even if there's no device
+                 * on the other end of the cable.  NOTE that the
+                 * A_WAIT_VRISE timers are messy with MUSB...
+                 */
+                devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
+                if ((devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS)
+                        musb->xceiv->state = OTG_STATE_A_WAIT_BCON;
+                break;
+        default:
+                break;
+        }
+
+        if (musb->is_active) {
+                WARNING("trying to suspend as %s while active\n",
+                                otg_state_string(musb));
                 return -EBUSY;
         } else
                 return 0;
diff --git a/drivers/usb/otg/Kconfig b/drivers/usb/otg/Kconfig
index 69feeec1628c..aa884d072f0b 100644
--- a/drivers/usb/otg/Kconfig
+++ b/drivers/usb/otg/Kconfig
@@ -59,18 +59,4 @@ config NOP_USB_XCEIV
          built-in with usb ip or which are autonomous and doesn't require any
          phy programming such as ISP1x04 etc.
 
-config USB_LANGWELL_OTG
-        tristate "Intel Langwell USB OTG dual-role support"
-        depends on USB && MRST
-        select USB_OTG
-        select USB_OTG_UTILS
-        help
-          Say Y here if you want to build Intel Langwell USB OTG
-          transciever driver in kernel. This driver implements role
-          switch between EHCI host driver and Langwell USB OTG
-          client driver.
-
-          To compile this driver as a module, choose M here: the
-          module will be called langwell_otg.
-
 endif # USB || OTG
diff --git a/drivers/usb/otg/Makefile b/drivers/usb/otg/Makefile
index 6d1abdd3c0ac..208167856529 100644
--- a/drivers/usb/otg/Makefile
+++ b/drivers/usb/otg/Makefile
@@ -9,7 +9,6 @@ obj-$(CONFIG_USB_OTG_UTILS)	+= otg.o
 obj-$(CONFIG_USB_GPIO_VBUS)     += gpio_vbus.o
 obj-$(CONFIG_ISP1301_OMAP)      += isp1301_omap.o
 obj-$(CONFIG_TWL4030_USB)       += twl4030-usb.o
-obj-$(CONFIG_USB_LANGWELL_OTG)  += langwell_otg.o
 obj-$(CONFIG_NOP_USB_XCEIV)     += nop-usb-xceiv.o
 
 ccflags-$(CONFIG_USB_DEBUG)     += -DDEBUG
diff --git a/drivers/usb/otg/langwell_otg.c b/drivers/usb/otg/langwell_otg.c
deleted file mode 100644
index 6f628d0e9f39..000000000000
--- a/drivers/usb/otg/langwell_otg.c
+++ /dev/null
@@ -1,1915 +0,0 @@
-/*
- * Intel Langwell USB OTG transceiver driver
- * Copyright (C) 2008 - 2009, Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- */
-/* This driver helps to switch Langwell OTG controller function between host
- * and peripheral. It works with EHCI driver and Langwell client controller
- * driver together.
- */
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/pci.h>
-#include <linux/errno.h>
-#include <linux/interrupt.h>
-#include <linux/kernel.h>
-#include <linux/device.h>
-#include <linux/moduleparam.h>
-#include <linux/usb/ch9.h>
-#include <linux/usb/gadget.h>
-#include <linux/usb.h>
-#include <linux/usb/otg.h>
-#include <linux/notifier.h>
-#include <asm/ipc_defs.h>
-#include <linux/delay.h>
-#include "../core/hcd.h"
-
-#include <linux/usb/langwell_otg.h>
-
-#define DRIVER_DESC             "Intel Langwell USB OTG transceiver driver"
-#define DRIVER_VERSION          "3.0.0.32L.0002"
-
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_AUTHOR("Henry Yuan <hang.yuan@intel.com>, Hao Wu <hao.wu@intel.com>");
-MODULE_VERSION(DRIVER_VERSION);
-MODULE_LICENSE("GPL");
-
-static const char driver_name[] = "langwell_otg";
-
-static int langwell_otg_probe(struct pci_dev *pdev,
-                        const struct pci_device_id *id);
-static void langwell_otg_remove(struct pci_dev *pdev);
-static int langwell_otg_suspend(struct pci_dev *pdev, pm_message_t message);
-static int langwell_otg_resume(struct pci_dev *pdev);
-
-static int langwell_otg_set_host(struct otg_transceiver *otg,
-                                struct usb_bus *host);
-static int langwell_otg_set_peripheral(struct otg_transceiver *otg,
-                                struct usb_gadget *gadget);
-static int langwell_otg_start_srp(struct otg_transceiver *otg);
-
-static const struct pci_device_id pci_ids[] = {{
-        .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
-        .class_mask =   ~0,
-        .vendor =       0x8086,
-        .device =       0x0811,
-        .subvendor =    PCI_ANY_ID,
-        .subdevice =    PCI_ANY_ID,
-}, { /* end: all zeroes */ }
-};
-
-static struct pci_driver otg_pci_driver = {
-        .name =         (char *) driver_name,
-        .id_table =     pci_ids,
-
-        .probe =        langwell_otg_probe,
-        .remove =       langwell_otg_remove,
-
-        .suspend =      langwell_otg_suspend,
-        .resume =       langwell_otg_resume,
-};
-
-static const char *state_string(enum usb_otg_state state)
-{
-        switch (state) {
-        case OTG_STATE_A_IDLE:
-                return "a_idle";
-        case OTG_STATE_A_WAIT_VRISE:
-                return "a_wait_vrise";
-        case OTG_STATE_A_WAIT_BCON:
-                return "a_wait_bcon";
-        case OTG_STATE_A_HOST:
-                return "a_host";
-        case OTG_STATE_A_SUSPEND:
-                return "a_suspend";
-        case OTG_STATE_A_PERIPHERAL:
-                return "a_peripheral";
-        case OTG_STATE_A_WAIT_VFALL:
-                return "a_wait_vfall";
-        case OTG_STATE_A_VBUS_ERR:
-                return "a_vbus_err";
-        case OTG_STATE_B_IDLE:
-                return "b_idle";
-        case OTG_STATE_B_SRP_INIT:
-                return "b_srp_init";
-        case OTG_STATE_B_PERIPHERAL:
-                return "b_peripheral";
-        case OTG_STATE_B_WAIT_ACON:
-                return "b_wait_acon";
-        case OTG_STATE_B_HOST:
-                return "b_host";
-        default:
-                return "UNDEFINED";
-        }
-}
-
-/* HSM timers */
-static inline struct langwell_otg_timer *otg_timer_initializer
-(void (*function)(unsigned long), unsigned long expires, unsigned long data)
-{
-        struct langwell_otg_timer *timer;
-        timer = kmalloc(sizeof(struct langwell_otg_timer), GFP_KERNEL);
-        timer->function = function;
-        timer->expires = expires;
-        timer->data = data;
-        return timer;
-}
-
-static struct langwell_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr,
-        *a_aidl_bdis_tmr, *b_ase0_brst_tmr, *b_se0_srp_tmr, *b_srp_res_tmr,
-        *b_bus_suspend_tmr;
-
-static struct list_head active_timers;
-
-static struct langwell_otg *the_transceiver;
-
-/* host/client notify transceiver when event affects HNP state */
-void langwell_update_transceiver()
-{
-        otg_dbg("transceiver driver is notified\n");
-        queue_work(the_transceiver->qwork, &the_transceiver->work);
-}
-EXPORT_SYMBOL(langwell_update_transceiver);
-
-static int langwell_otg_set_host(struct otg_transceiver *otg,
-                                        struct usb_bus *host)
-{
-        otg->host = host;
-
-        return 0;
-}
-
-static int langwell_otg_set_peripheral(struct otg_transceiver *otg,
-                                        struct usb_gadget *gadget)
-{
-        otg->gadget = gadget;
-
-        return 0;
-}
-
-static int langwell_otg_set_power(struct otg_transceiver *otg,
-                                unsigned mA)
-{
-        return 0;
-}
-
-/* A-device drives vbus, controlled through PMIC CHRGCNTL register*/
-static void langwell_otg_drv_vbus(int on)
-{
-        struct ipc_pmic_reg_data        pmic_data = {0};
-        struct ipc_pmic_reg_data        battery_data;
-
-        /* Check if battery is attached or not */
-        battery_data.pmic_reg_data[0].register_address = 0xd2;
-        battery_data.ioc = 0;
-        battery_data.num_entries = 1;
-        if (ipc_pmic_register_read(&battery_data)) {
-                otg_dbg("Failed to read PMIC register 0xd2.\n");
-                return;
-        }
-
-        if ((battery_data.pmic_reg_data[0].value & 0x20) == 0) {
-                otg_dbg("no battery attached\n");
-                return;
-        }
-
-        /* Workaround for battery attachment issue */
-        if (battery_data.pmic_reg_data[0].value == 0x34) {
-                otg_dbg("battery \n");
-                return;
-        }
-
-        otg_dbg("battery attached\n");
-
-        pmic_data.ioc = 0;
-        pmic_data.pmic_reg_data[0].register_address = 0xD4;
-        pmic_data.num_entries = 1;
-        if (on)
-                pmic_data.pmic_reg_data[0].value = 0x20;
-        else
-                pmic_data.pmic_reg_data[0].value = 0xc0;
-
-        if (ipc_pmic_register_write(&pmic_data, TRUE))
-                otg_dbg("Failed to write PMIC.\n");
-
-}
-
-/* charge vbus or discharge vbus through a resistor to ground */
-static void langwell_otg_chrg_vbus(int on)
-{
-
-        u32     val;
-
-        val = readl(the_transceiver->regs + CI_OTGSC);
-
-        if (on)
-                writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_VC,
-                                the_transceiver->regs + CI_OTGSC);
-        else
-                writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_VD,
-                                the_transceiver->regs + CI_OTGSC);
-
-}
-
-/* Start SRP */
-static int langwell_otg_start_srp(struct otg_transceiver *otg)
-{
-        u32     val;
-
-        otg_dbg("Start SRP ->\n");
-
-        val = readl(the_transceiver->regs + CI_OTGSC);
-
-        writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_HADP,
-                the_transceiver->regs + CI_OTGSC);
-
-        /* Check if the data plus is finished or not */
-        msleep(8);
-        val = readl(the_transceiver->regs + CI_OTGSC);
-        if (val & (OTGSC_HADP | OTGSC_DP))
-                otg_dbg("DataLine SRP Error\n");
-
-        /* FIXME: VBus SRP */
-
-        return 0;
-}
-
-
-/* stop SOF via bus_suspend */
-static void langwell_otg_loc_sof(int on)
-{
-        struct usb_hcd  *hcd;
-        int             err;
-
-        otg_dbg("loc_sof -> %d\n", on);
-
-        hcd = bus_to_hcd(the_transceiver->otg.host);
-        if (on)
-                err = hcd->driver->bus_resume(hcd);
-        else
-                err = hcd->driver->bus_suspend(hcd);
-
-        if (err)
-                otg_dbg("Failed to resume/suspend bus - %d\n", err);
-}
-
-static void langwell_otg_phy_low_power(int on)
-{
-        u32     val;
-
-        otg_dbg("phy low power mode-> %d\n", on);
-
-        val = readl(the_transceiver->regs + CI_HOSTPC1);
-        if (on)
-                writel(val | HOSTPC1_PHCD, the_transceiver->regs + CI_HOSTPC1);
-        else
-                writel(val & ~HOSTPC1_PHCD, the_transceiver->regs + CI_HOSTPC1);
-}
-
-/* Enable/Disable OTG interrupt */
-static void langwell_otg_intr(int on)
-{
-        u32 val;
-
-        otg_dbg("interrupt -> %d\n", on);
-
-        val = readl(the_transceiver->regs + CI_OTGSC);
-        if (on) {
-                val = val | (OTGSC_INTEN_MASK | OTGSC_IDPU);
-                writel(val, the_transceiver->regs + CI_OTGSC);
-        } else {
-                val = val & ~(OTGSC_INTEN_MASK | OTGSC_IDPU);
-                writel(val, the_transceiver->regs + CI_OTGSC);
-        }
-}
-
-/* set HAAR: Hardware Assist Auto-Reset */
-static void langwell_otg_HAAR(int on)
-{
-        u32     val;
-
-        otg_dbg("HAAR -> %d\n", on);
-
-        val = readl(the_transceiver->regs + CI_OTGSC);
-        if (on)
-                writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_HAAR,
-                                the_transceiver->regs + CI_OTGSC);
-        else
-                writel((val & ~OTGSC_INTSTS_MASK) & ~OTGSC_HAAR,
-                                the_transceiver->regs + CI_OTGSC);
-}
-
-/* set HABA: Hardware Assist B-Disconnect to A-Connect */
-static void langwell_otg_HABA(int on)
-{
-        u32     val;
-
-        otg_dbg("HABA -> %d\n", on);
-
-        val = readl(the_transceiver->regs + CI_OTGSC);
-        if (on)
-                writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_HABA,
-                                the_transceiver->regs + CI_OTGSC);
-        else
-                writel((val & ~OTGSC_INTSTS_MASK) & ~OTGSC_HABA,
-                                the_transceiver->regs + CI_OTGSC);
-}
-
-static int langwell_otg_check_se0_srp(int on)
-{
-        u32 val;
-
-        int delay_time = TB_SE0_SRP * 10; /* step is 100us */
-
-        otg_dbg("check_se0_srp -> \n");
-
-        do {
-                udelay(100);
-                if (!delay_time--)
-                        break;
-                val = readl(the_transceiver->regs + CI_PORTSC1);
-                val &= PORTSC_LS;
-        } while (!val);
-
-        otg_dbg("check_se0_srp <- \n");
-        return val;
-}
-
-/* The timeout callback function to set time out bit */
-static void set_tmout(unsigned long indicator)
-{
-        *(int *)indicator = 1;
-}
-
-void langwell_otg_nsf_msg(unsigned long indicator)
-{
-        switch (indicator) {
-        case 2:
-        case 4:
-        case 6:
-        case 7:
-                printk(KERN_ERR "OTG:NSF-%lu - deivce not responding\n",
-                                indicator);
-                break;
-        case 3:
-                printk(KERN_ERR "OTG:NSF-%lu - deivce not supported\n",
-                                indicator);
-                break;
-        default:
-                printk(KERN_ERR "Do not have this kind of NSF\n");
-                break;
-        }
-}
-
-/* Initialize timers */
-static void langwell_otg_init_timers(struct otg_hsm *hsm)
-{
-        /* HSM used timers */
-        a_wait_vrise_tmr = otg_timer_initializer(&set_tmout, TA_WAIT_VRISE,
-                                (unsigned long)&hsm->a_wait_vrise_tmout);
-        a_wait_bcon_tmr = otg_timer_initializer(&set_tmout, TA_WAIT_BCON,
-                                (unsigned long)&hsm->a_wait_bcon_tmout);
-        a_aidl_bdis_tmr = otg_timer_initializer(&set_tmout, TA_AIDL_BDIS,
-                                (unsigned long)&hsm->a_aidl_bdis_tmout);
-        b_ase0_brst_tmr = otg_timer_initializer(&set_tmout, TB_ASE0_BRST,
-                                (unsigned long)&hsm->b_ase0_brst_tmout);
-        b_se0_srp_tmr = otg_timer_initializer(&set_tmout, TB_SE0_SRP,
-                                (unsigned long)&hsm->b_se0_srp);
-        b_srp_res_tmr = otg_timer_initializer(&set_tmout, TB_SRP_RES,
-                                (unsigned long)&hsm->b_srp_res_tmout);
-        b_bus_suspend_tmr = otg_timer_initializer(&set_tmout, TB_BUS_SUSPEND,
-                                (unsigned long)&hsm->b_bus_suspend_tmout);
-}
-
-/* Free timers */
-static void langwell_otg_free_timers(void)
-{
-        kfree(a_wait_vrise_tmr);
-        kfree(a_wait_bcon_tmr);
-        kfree(a_aidl_bdis_tmr);
-        kfree(b_ase0_brst_tmr);
-        kfree(b_se0_srp_tmr);
-        kfree(b_srp_res_tmr);
-        kfree(b_bus_suspend_tmr);
-}
-
-/* Add timer to timer list */
-static void langwell_otg_add_timer(void *gtimer)
-{
-        struct langwell_otg_timer *timer = (struct langwell_otg_timer *)gtimer;
-        struct langwell_otg_timer *tmp_timer;
-        u32     val32;
-
-        /* Check if the timer is already in the active list,
-         * if so update timer count
-         */
-        list_for_each_entry(tmp_timer, &active_timers, list)
-                if (tmp_timer == timer) {
-                        timer->count = timer->expires;
-                        return;
-                }
-        timer->count = timer->expires;
-
-        if (list_empty(&active_timers)) {
-                val32 = readl(the_transceiver->regs + CI_OTGSC);
-                writel(val32 | OTGSC_1MSE, the_transceiver->regs + CI_OTGSC);
-        }
-
-        list_add_tail(&timer->list, &active_timers);
-}
-
-/* Remove timer from the timer list; clear timeout status */
-static void langwell_otg_del_timer(void *gtimer)
-{
-        struct langwell_otg_timer *timer = (struct langwell_otg_timer *)gtimer;
-        struct langwell_otg_timer *tmp_timer, *del_tmp;
-        u32 val32;
-
-        list_for_each_entry_safe(tmp_timer, del_tmp, &active_timers, list)
-                if (tmp_timer == timer)
-                        list_del(&timer->list);
-
-        if (list_empty(&active_timers)) {
-                val32 = readl(the_transceiver->regs + CI_OTGSC);
-                writel(val32 & ~OTGSC_1MSE, the_transceiver->regs + CI_OTGSC);
-        }
-}
-
-/* Reduce timer count by 1, and find timeout conditions.*/
-static int langwell_otg_tick_timer(u32 *int_sts)
-{
-        struct langwell_otg_timer *tmp_timer, *del_tmp;
-        int expired = 0;
-
-        list_for_each_entry_safe(tmp_timer, del_tmp, &active_timers, list) {
-                tmp_timer->count--;
-                /* check if timer expires */
-                if (!tmp_timer->count) {
-                        list_del(&tmp_timer->list);
-                        tmp_timer->function(tmp_timer->data);
-                        expired = 1;
-                }
-        }
-
-        if (list_empty(&active_timers)) {
-                otg_dbg("tick timer: disable 1ms int\n");
-                *int_sts = *int_sts & ~OTGSC_1MSE;
-        }
-        return expired;
-}
-
-static void reset_otg(void)
-{
-        u32     val;
-        int     delay_time = 1000;
-
-        otg_dbg("reseting OTG controller ...\n");
-        val = readl(the_transceiver->regs + CI_USBCMD);
-        writel(val | USBCMD_RST, the_transceiver->regs + CI_USBCMD);
-        do {
-                udelay(100);
-                if (!delay_time--)
-                        otg_dbg("reset timeout\n");
-                val = readl(the_transceiver->regs + CI_USBCMD);
-                val &= USBCMD_RST;
-        } while (val != 0);
-        otg_dbg("reset done.\n");
-}
-
-static void set_host_mode(void)
-{
-        u32     val;
-
-        reset_otg();
-        val = readl(the_transceiver->regs + CI_USBMODE);
-        val = (val & (~USBMODE_CM)) | USBMODE_HOST;
-        writel(val, the_transceiver->regs + CI_USBMODE);
-}
-
-static void set_client_mode(void)
-{
-        u32     val;
-
-        reset_otg();
-        val = readl(the_transceiver->regs + CI_USBMODE);
-        val = (val & (~USBMODE_CM)) | USBMODE_DEVICE;
-        writel(val, the_transceiver->regs + CI_USBMODE);
-}
-
-static void init_hsm(void)
-{
-        struct langwell_otg     *langwell = the_transceiver;
-        u32                     val32;
-
-        /* read OTGSC after reset */
-        val32 = readl(langwell->regs + CI_OTGSC);
-        otg_dbg("%s: OTGSC init value = 0x%x\n", __func__, val32);
-
-        /* set init state */
-        if (val32 & OTGSC_ID) {
-                langwell->hsm.id = 1;
-                langwell->otg.default_a = 0;
-                set_client_mode();
-                langwell->otg.state = OTG_STATE_B_IDLE;
-                langwell_otg_drv_vbus(0);
-        } else {
-                langwell->hsm.id = 0;
-                langwell->otg.default_a = 1;
-                set_host_mode();
-                langwell->otg.state = OTG_STATE_A_IDLE;
-        }
-
-        /* set session indicator */
-        if (val32 & OTGSC_BSE)
-                langwell->hsm.b_sess_end = 1;
-        if (val32 & OTGSC_BSV)
-                langwell->hsm.b_sess_vld = 1;
-        if (val32 & OTGSC_ASV)
-                langwell->hsm.a_sess_vld = 1;
-        if (val32 & OTGSC_AVV)
-                langwell->hsm.a_vbus_vld = 1;
-
-        /* defautly power the bus */
-        langwell->hsm.a_bus_req = 1;
-        langwell->hsm.a_bus_drop = 0;
-        /* defautly don't request bus as B device */
-        langwell->hsm.b_bus_req = 0;
-        /* no system error */
-        langwell->hsm.a_clr_err = 0;
-}
-
-static irqreturn_t otg_dummy_irq(int irq, void *_dev)
-{
-        void __iomem    *reg_base = _dev;
-        u32     val;
-        u32     int_mask = 0;
-
-        val = readl(reg_base + CI_USBMODE);
-        if ((val & USBMODE_CM) != USBMODE_DEVICE)
-                return IRQ_NONE;
-
-        val = readl(reg_base + CI_USBSTS);
-        int_mask = val & INTR_DUMMY_MASK;
-
-        if (int_mask == 0)
-                return IRQ_NONE;
-
-        /* clear hsm.b_conn here since host driver can't detect it
-        *  otg_dummy_irq called means B-disconnect happened.
-        */
-        if (the_transceiver->hsm.b_conn) {
-                the_transceiver->hsm.b_conn = 0;
-                if (spin_trylock(&the_transceiver->wq_lock)) {
-                        queue_work(the_transceiver->qwork,
-                                &the_transceiver->work);
-                        spin_unlock(&the_transceiver->wq_lock);
-                }
-        }
-        /* Clear interrupts */
-        writel(int_mask, reg_base + CI_USBSTS);
-        return IRQ_HANDLED;
-}
-
-static irqreturn_t otg_irq(int irq, void *_dev)
-{
-        struct  langwell_otg *langwell = _dev;
-        u32     int_sts, int_en;
-        u32     int_mask = 0;
-        int     flag = 0;
-
-        int_sts = readl(langwell->regs + CI_OTGSC);
-        int_en = (int_sts & OTGSC_INTEN_MASK) >> 8;
-        int_mask = int_sts & int_en;
-        if (int_mask == 0)
-                return IRQ_NONE;
-
-        if (int_mask & OTGSC_IDIS) {
-                otg_dbg("%s: id change int\n", __func__);
-                langwell->hsm.id = (int_sts & OTGSC_ID) ? 1 : 0;
-                flag = 1;
-        }
-        if (int_mask & OTGSC_DPIS) {
-                otg_dbg("%s: data pulse int\n", __func__);
-                langwell->hsm.a_srp_det = (int_sts & OTGSC_DPS) ? 1 : 0;
-                flag = 1;
-        }
-        if (int_mask & OTGSC_BSEIS) {
-                otg_dbg("%s: b session end int\n", __func__);
-                langwell->hsm.b_sess_end = (int_sts & OTGSC_BSE) ? 1 : 0;
-                flag = 1;
-        }
-        if (int_mask & OTGSC_BSVIS) {
-                otg_dbg("%s: b session valid int\n", __func__);
-                langwell->hsm.b_sess_vld = (int_sts & OTGSC_BSV) ? 1 : 0;
-                flag = 1;
-        }
-        if (int_mask & OTGSC_ASVIS) {
-                otg_dbg("%s: a session valid int\n", __func__);
-                langwell->hsm.a_sess_vld = (int_sts & OTGSC_ASV) ? 1 : 0;
-                flag = 1;
-        }
-        if (int_mask & OTGSC_AVVIS) {
-                otg_dbg("%s: a vbus valid int\n", __func__);
-                langwell->hsm.a_vbus_vld = (int_sts & OTGSC_AVV) ? 1 : 0;
-                flag = 1;
-        }
-
-        if (int_mask & OTGSC_1MSS) {
-                /* need to schedule otg_work if any timer is expired */
-                if (langwell_otg_tick_timer(&int_sts))
-                        flag = 1;
-        }
-
-        writel((int_sts & ~OTGSC_INTSTS_MASK) | int_mask,
-                        langwell->regs + CI_OTGSC);
-        if (flag)
-                queue_work(langwell->qwork, &langwell->work);
-
-        return IRQ_HANDLED;
-}
-
-static void langwell_otg_work(struct work_struct *work)
-{
-        struct langwell_otg *langwell = container_of(work,
-                                        struct langwell_otg, work);
-        int     retval;
-
-        otg_dbg("%s: old state = %s\n", __func__,
-                        state_string(langwell->otg.state));
-
-        switch (langwell->otg.state) {
-        case OTG_STATE_UNDEFINED:
-        case OTG_STATE_B_IDLE:
-                if (!langwell->hsm.id) {
-                        langwell_otg_del_timer(b_srp_res_tmr);
-                        langwell->otg.default_a = 1;
-                        langwell->hsm.a_srp_det = 0;
-
-                        langwell_otg_chrg_vbus(0);
-                        langwell_otg_drv_vbus(0);
-
-                        set_host_mode();
-                        langwell->otg.state = OTG_STATE_A_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (langwell->hsm.b_srp_res_tmout) {
-                        langwell->hsm.b_srp_res_tmout = 0;
-                        langwell->hsm.b_bus_req = 0;
-                        langwell_otg_nsf_msg(6);
-                } else if (langwell->hsm.b_sess_vld) {
-                        langwell_otg_del_timer(b_srp_res_tmr);
-                        langwell->hsm.b_sess_end = 0;
-                        langwell->hsm.a_bus_suspend = 0;
-
-                        langwell_otg_chrg_vbus(0);
-                        if (langwell->client_ops) {
-                                langwell->client_ops->resume(langwell->pdev);
-                                langwell->otg.state = OTG_STATE_B_PERIPHERAL;
-                        } else
-                                otg_dbg("client driver not loaded.\n");
-
-                } else if (langwell->hsm.b_bus_req &&
-                                (langwell->hsm.b_sess_end)) {
-                        /* workaround for b_se0_srp detection */
-                        retval = langwell_otg_check_se0_srp(0);
-                        if (retval) {
-                                langwell->hsm.b_bus_req = 0;
-                                otg_dbg("LS is not SE0, try again later\n");
-                        } else {
-                                /* Start SRP */
-                                langwell_otg_start_srp(&langwell->otg);
-                                langwell_otg_add_timer(b_srp_res_tmr);
-                        }
-                }
-                break;
-        case OTG_STATE_B_SRP_INIT:
-                if (!langwell->hsm.id) {
-                        langwell->otg.default_a = 1;
-                        langwell->hsm.a_srp_det = 0;
-
-                        langwell_otg_drv_vbus(0);
-                        langwell_otg_chrg_vbus(0);
-
-                        langwell->otg.state = OTG_STATE_A_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (langwell->hsm.b_sess_vld) {
-                        langwell_otg_chrg_vbus(0);
-                        if (langwell->client_ops) {
-                                langwell->client_ops->resume(langwell->pdev);
-                                langwell->otg.state = OTG_STATE_B_PERIPHERAL;
-                        } else
-                                otg_dbg("client driver not loaded.\n");
-                }
-                break;
-        case OTG_STATE_B_PERIPHERAL:
-                if (!langwell->hsm.id) {
-                        langwell->otg.default_a = 1;
-                        langwell->hsm.a_srp_det = 0;
-
-                        langwell_otg_drv_vbus(0);
-                        langwell_otg_chrg_vbus(0);
-                        set_host_mode();
-
-                        if (langwell->client_ops) {
-                                langwell->client_ops->suspend(langwell->pdev,
-                                        PMSG_FREEZE);
-                        } else
-                                otg_dbg("client driver has been removed.\n");
-
-                        langwell->otg.state = OTG_STATE_A_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (!langwell->hsm.b_sess_vld) {
-                        langwell->hsm.b_hnp_enable = 0;
-
-                        if (langwell->client_ops) {
-                                langwell->client_ops->suspend(langwell->pdev,
-                                        PMSG_FREEZE);
-                        } else
-                                otg_dbg("client driver has been removed.\n");
-
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                } else if (langwell->hsm.b_bus_req && langwell->hsm.b_hnp_enable
-                        && langwell->hsm.a_bus_suspend) {
-
-                        if (langwell->client_ops) {
-                                langwell->client_ops->suspend(langwell->pdev,
-                                        PMSG_FREEZE);
-                        } else
-                                otg_dbg("client driver has been removed.\n");
-
-                        langwell_otg_HAAR(1);
-                        langwell->hsm.a_conn = 0;
-
-                        if (langwell->host_ops) {
-                                langwell->host_ops->probe(langwell->pdev,
-                                        langwell->host_ops->id_table);
-                                langwell->otg.state = OTG_STATE_B_WAIT_ACON;
-                        } else
-                                otg_dbg("host driver not loaded.\n");
-
-                        langwell->hsm.a_bus_resume = 0;
-                        langwell->hsm.b_ase0_brst_tmout = 0;
-                        langwell_otg_add_timer(b_ase0_brst_tmr);
-                }
-                break;
-
-        case OTG_STATE_B_WAIT_ACON:
-                if (!langwell->hsm.id) {
-                        langwell_otg_del_timer(b_ase0_brst_tmr);
-                        langwell->otg.default_a = 1;
-                        langwell->hsm.a_srp_det = 0;
-
-                        langwell_otg_drv_vbus(0);
-                        langwell_otg_chrg_vbus(0);
-                        set_host_mode();
-
-                        langwell_otg_HAAR(0);
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell->otg.state = OTG_STATE_A_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (!langwell->hsm.b_sess_vld) {
-                        langwell_otg_del_timer(b_ase0_brst_tmr);
-                        langwell->hsm.b_hnp_enable = 0;
-                        langwell->hsm.b_bus_req = 0;
-                        langwell_otg_chrg_vbus(0);
-                        langwell_otg_HAAR(0);
-
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                } else if (langwell->hsm.a_conn) {
-                        langwell_otg_del_timer(b_ase0_brst_tmr);
-                        langwell_otg_HAAR(0);
-                        langwell->otg.state = OTG_STATE_B_HOST;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (langwell->hsm.a_bus_resume ||
-                                langwell->hsm.b_ase0_brst_tmout) {
-                        langwell_otg_del_timer(b_ase0_brst_tmr);
-                        langwell_otg_HAAR(0);
-                        langwell_otg_nsf_msg(7);
-
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-
-                        langwell->hsm.a_bus_suspend = 0;
-                        langwell->hsm.b_bus_req = 0;
-
-                        if (langwell->client_ops)
-                                langwell->client_ops->resume(langwell->pdev);
-                        else
-                                otg_dbg("client driver not loaded.\n");
-
-                        langwell->otg.state = OTG_STATE_B_PERIPHERAL;
-                }
-                break;
-
-        case OTG_STATE_B_HOST:
-                if (!langwell->hsm.id) {
-                        langwell->otg.default_a = 1;
-                        langwell->hsm.a_srp_det = 0;
-
-                        langwell_otg_drv_vbus(0);
-                        langwell_otg_chrg_vbus(0);
-                        set_host_mode();
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell->otg.state = OTG_STATE_A_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (!langwell->hsm.b_sess_vld) {
-                        langwell->hsm.b_hnp_enable = 0;
-                        langwell->hsm.b_bus_req = 0;
-                        langwell_otg_chrg_vbus(0);
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                } else if ((!langwell->hsm.b_bus_req) ||
-                                (!langwell->hsm.a_conn)) {
-                        langwell->hsm.b_bus_req = 0;
-                        langwell_otg_loc_sof(0);
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-
-                        langwell->hsm.a_bus_suspend = 0;
-
-                        if (langwell->client_ops)
-                                langwell->client_ops->resume(langwell->pdev);
-                        else
-                                otg_dbg("client driver not loaded.\n");
-
-                        langwell->otg.state = OTG_STATE_B_PERIPHERAL;
-                }
-                break;
-
-        case OTG_STATE_A_IDLE:
-                langwell->otg.default_a = 1;
-                if (langwell->hsm.id) {
-                        langwell->otg.default_a = 0;
-                        langwell->hsm.b_bus_req = 0;
-                        langwell_otg_drv_vbus(0);
-                        langwell_otg_chrg_vbus(0);
-
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (langwell->hsm.a_sess_vld) {
-                        langwell_otg_drv_vbus(1);
-                        langwell->hsm.a_srp_det = 1;
-                        langwell->hsm.a_wait_vrise_tmout = 0;
-                        langwell_otg_add_timer(a_wait_vrise_tmr);
-                        langwell->otg.state = OTG_STATE_A_WAIT_VRISE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (!langwell->hsm.a_bus_drop &&
-                        (langwell->hsm.a_srp_det || langwell->hsm.a_bus_req)) {
-                        langwell_otg_drv_vbus(1);
-                        langwell->hsm.a_wait_vrise_tmout = 0;
-                        langwell_otg_add_timer(a_wait_vrise_tmr);
-                        langwell->otg.state = OTG_STATE_A_WAIT_VRISE;
-                        queue_work(langwell->qwork, &langwell->work);
-                }
-                break;
-        case OTG_STATE_A_WAIT_VRISE:
-                if (langwell->hsm.id) {
-                        langwell_otg_del_timer(a_wait_vrise_tmr);
-                        langwell->hsm.b_bus_req = 0;
-                        langwell->otg.default_a = 0;
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                } else if (langwell->hsm.a_vbus_vld) {
-                        langwell_otg_del_timer(a_wait_vrise_tmr);
-                        if (langwell->host_ops)
-                                langwell->host_ops->probe(langwell->pdev,
-                                                langwell->host_ops->id_table);
-                        else
-                                otg_dbg("host driver not loaded.\n");
-                        langwell->hsm.b_conn = 0;
-                        langwell->hsm.a_set_b_hnp_en = 0;
-                        langwell->hsm.a_wait_bcon_tmout = 0;
-                        langwell_otg_add_timer(a_wait_bcon_tmr);
-                        langwell->otg.state = OTG_STATE_A_WAIT_BCON;
-                } else if (langwell->hsm.a_wait_vrise_tmout) {
-                        if (langwell->hsm.a_vbus_vld) {
-                                if (langwell->host_ops)
-                                        langwell->host_ops->probe(
-                                                langwell->pdev,
-                                                langwell->host_ops->id_table);
-                                else
-                                        otg_dbg("host driver not loaded.\n");
-                                langwell->hsm.b_conn = 0;
-                                langwell->hsm.a_set_b_hnp_en = 0;
-                                langwell->hsm.a_wait_bcon_tmout = 0;
-                                langwell_otg_add_timer(a_wait_bcon_tmr);
-                                langwell->otg.state = OTG_STATE_A_WAIT_BCON;
-                        } else {
-                                langwell_otg_drv_vbus(0);
-                                langwell->otg.state = OTG_STATE_A_VBUS_ERR;
-                        }
-                }
-                break;
-        case OTG_STATE_A_WAIT_BCON:
-                if (langwell->hsm.id) {
-                        langwell_otg_del_timer(a_wait_bcon_tmr);
-
-                        langwell->otg.default_a = 0;
-                        langwell->hsm.b_bus_req = 0;
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (!langwell->hsm.a_vbus_vld) {
-                        langwell_otg_del_timer(a_wait_bcon_tmr);
-
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_A_VBUS_ERR;
-                } else if (langwell->hsm.a_bus_drop ||
-                                (langwell->hsm.a_wait_bcon_tmout &&
-                                !langwell->hsm.a_bus_req)) {
-                        langwell_otg_del_timer(a_wait_bcon_tmr);
-
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_A_WAIT_VFALL;
-                } else if (langwell->hsm.b_conn) {
-                        langwell_otg_del_timer(a_wait_bcon_tmr);
-
-                        langwell->hsm.a_suspend_req = 0;
-                        langwell->otg.state = OTG_STATE_A_HOST;
-                        if (!langwell->hsm.a_bus_req &&
-                                langwell->hsm.a_set_b_hnp_en) {
-                                /* It is not safe enough to do a fast
-                                 * transistion from A_WAIT_BCON to
-                                 * A_SUSPEND */
-                                msleep(10000);
-                                if (langwell->hsm.a_bus_req)
-                                        break;
-
-                                if (request_irq(langwell->pdev->irq,
-                                        otg_dummy_irq, IRQF_SHARED,
-                                        driver_name, langwell->regs) != 0) {
-                                        otg_dbg("request interrupt %d fail\n",
-                                        langwell->pdev->irq);
-                                }
-
-                                langwell_otg_HABA(1);
-                                langwell->hsm.b_bus_resume = 0;
-                                langwell->hsm.a_aidl_bdis_tmout = 0;
-                                langwell_otg_add_timer(a_aidl_bdis_tmr);
-
-                                langwell_otg_loc_sof(0);
-                                langwell->otg.state = OTG_STATE_A_SUSPEND;
-                        } else if (!langwell->hsm.a_bus_req &&
-                                !langwell->hsm.a_set_b_hnp_en) {
-                                struct pci_dev *pdev = langwell->pdev;
-                                if (langwell->host_ops)
-                                        langwell->host_ops->remove(pdev);
-                                else
-                                        otg_dbg("host driver removed.\n");
-                                langwell_otg_drv_vbus(0);
-                                langwell->otg.state = OTG_STATE_A_WAIT_VFALL;
-                        }
-                }
-                break;
-        case OTG_STATE_A_HOST:
-                if (langwell->hsm.id) {
-                        langwell->otg.default_a = 0;
-                        langwell->hsm.b_bus_req = 0;
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (langwell->hsm.a_bus_drop ||
-                (!langwell->hsm.a_set_b_hnp_en && !langwell->hsm.a_bus_req)) {
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_A_WAIT_VFALL;
-                } else if (!langwell->hsm.a_vbus_vld) {
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_A_VBUS_ERR;
-                } else if (langwell->hsm.a_set_b_hnp_en
-                                && !langwell->hsm.a_bus_req) {
-                        /* Set HABA to enable hardware assistance to signal
-                         *  A-connect after receiver B-disconnect. Hardware
-                         *  will then set client mode and enable URE, SLE and
-                         *  PCE after the assistance. otg_dummy_irq is used to
-                         *  clean these ints when client driver is not resumed.
-                         */
-                        if (request_irq(langwell->pdev->irq,
-                                otg_dummy_irq, IRQF_SHARED, driver_name,
-                                langwell->regs) != 0) {
-                                otg_dbg("request interrupt %d failed\n",
-                                                langwell->pdev->irq);
-                        }
-
-                        /* set HABA */
-                        langwell_otg_HABA(1);
-                        langwell->hsm.b_bus_resume = 0;
-                        langwell->hsm.a_aidl_bdis_tmout = 0;
-                        langwell_otg_add_timer(a_aidl_bdis_tmr);
-                        langwell_otg_loc_sof(0);
-                        langwell->otg.state = OTG_STATE_A_SUSPEND;
-                } else if (!langwell->hsm.b_conn || !langwell->hsm.a_bus_req) {
-                        langwell->hsm.a_wait_bcon_tmout = 0;
-                        langwell->hsm.a_set_b_hnp_en = 0;
-                        langwell_otg_add_timer(a_wait_bcon_tmr);
-                        langwell->otg.state = OTG_STATE_A_WAIT_BCON;
-                }
-                break;
-        case OTG_STATE_A_SUSPEND:
-                if (langwell->hsm.id) {
-                        langwell_otg_del_timer(a_aidl_bdis_tmr);
-                        langwell_otg_HABA(0);
-                        free_irq(langwell->pdev->irq, langwell->regs);
-                        langwell->otg.default_a = 0;
-                        langwell->hsm.b_bus_req = 0;
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (langwell->hsm.a_bus_req ||
-                                langwell->hsm.b_bus_resume) {
-                        langwell_otg_del_timer(a_aidl_bdis_tmr);
-                        langwell_otg_HABA(0);
-                        free_irq(langwell->pdev->irq, langwell->regs);
-                        langwell->hsm.a_suspend_req = 0;
-                        langwell_otg_loc_sof(1);
-                        langwell->otg.state = OTG_STATE_A_HOST;
-                } else if (langwell->hsm.a_aidl_bdis_tmout ||
-                                langwell->hsm.a_bus_drop) {
-                        langwell_otg_del_timer(a_aidl_bdis_tmr);
-                        langwell_otg_HABA(0);
-                        free_irq(langwell->pdev->irq, langwell->regs);
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_A_WAIT_VFALL;
-                } else if (!langwell->hsm.b_conn &&
-                                langwell->hsm.a_set_b_hnp_en) {
-                        langwell_otg_del_timer(a_aidl_bdis_tmr);
-                        langwell_otg_HABA(0);
-                        free_irq(langwell->pdev->irq, langwell->regs);
-
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-
-                        langwell->hsm.b_bus_suspend = 0;
-                        langwell->hsm.b_bus_suspend_vld = 0;
-                        langwell->hsm.b_bus_suspend_tmout = 0;
-
-                        /* msleep(200); */
-                        if (langwell->client_ops)
-                                langwell->client_ops->resume(langwell->pdev);
-                        else
-                                otg_dbg("client driver not loaded.\n");
-
-                        langwell_otg_add_timer(b_bus_suspend_tmr);
-                        langwell->otg.state = OTG_STATE_A_PERIPHERAL;
-                        break;
-                } else if (!langwell->hsm.a_vbus_vld) {
-                        langwell_otg_del_timer(a_aidl_bdis_tmr);
-                        langwell_otg_HABA(0);
-                        free_irq(langwell->pdev->irq, langwell->regs);
-                        if (langwell->host_ops)
-                                langwell->host_ops->remove(langwell->pdev);
-                        else
-                                otg_dbg("host driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_A_VBUS_ERR;
-                }
-                break;
-        case OTG_STATE_A_PERIPHERAL:
-                if (langwell->hsm.id) {
-                        langwell_otg_del_timer(b_bus_suspend_tmr);
-                        langwell->otg.default_a = 0;
-                        langwell->hsm.b_bus_req = 0;
-                        if (langwell->client_ops)
-                                langwell->client_ops->suspend(langwell->pdev,
-                                        PMSG_FREEZE);
-                        else
-                                otg_dbg("client driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (!langwell->hsm.a_vbus_vld) {
-                        langwell_otg_del_timer(b_bus_suspend_tmr);
-                        if (langwell->client_ops)
-                                langwell->client_ops->suspend(langwell->pdev,
-                                        PMSG_FREEZE);
-                        else
-                                otg_dbg("client driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_A_VBUS_ERR;
-                } else if (langwell->hsm.a_bus_drop) {
-                        langwell_otg_del_timer(b_bus_suspend_tmr);
-                        if (langwell->client_ops)
-                                langwell->client_ops->suspend(langwell->pdev,
-                                        PMSG_FREEZE);
-                        else
-                                otg_dbg("client driver has been removed.\n");
-                        langwell_otg_drv_vbus(0);
-                        langwell->otg.state = OTG_STATE_A_WAIT_VFALL;
-                } else if (langwell->hsm.b_bus_suspend) {
-                        langwell_otg_del_timer(b_bus_suspend_tmr);
-                        if (langwell->client_ops)
-                                langwell->client_ops->suspend(langwell->pdev,
-                                        PMSG_FREEZE);
-                        else
-                                otg_dbg("client driver has been removed.\n");
-
-                        if (langwell->host_ops)
-                                langwell->host_ops->probe(langwell->pdev,
-                                                langwell->host_ops->id_table);
-                        else
-                                otg_dbg("host driver not loaded.\n");
-                        langwell->hsm.a_set_b_hnp_en = 0;
-                        langwell->hsm.a_wait_bcon_tmout = 0;
-                        langwell_otg_add_timer(a_wait_bcon_tmr);
-                        langwell->otg.state = OTG_STATE_A_WAIT_BCON;
-                } else if (langwell->hsm.b_bus_suspend_tmout) {
-                        u32     val;
-                        val = readl(langwell->regs + CI_PORTSC1);
-                        if (!(val & PORTSC_SUSP))
-                                break;
-                        if (langwell->client_ops)
-                                langwell->client_ops->suspend(langwell->pdev,
-                                                PMSG_FREEZE);
-                        else
-                                otg_dbg("client driver has been removed.\n");
-                        if (langwell->host_ops)
-                                langwell->host_ops->probe(langwell->pdev,
-                                                langwell->host_ops->id_table);
-                        else
-                                otg_dbg("host driver not loaded.\n");
-                        langwell->hsm.a_set_b_hnp_en = 0;
-                        langwell->hsm.a_wait_bcon_tmout = 0;
-                        langwell_otg_add_timer(a_wait_bcon_tmr);
-                        langwell->otg.state = OTG_STATE_A_WAIT_BCON;
-                }
-                break;
-        case OTG_STATE_A_VBUS_ERR:
-                if (langwell->hsm.id) {
-                        langwell->otg.default_a = 0;
-                        langwell->hsm.a_clr_err = 0;
-                        langwell->hsm.a_srp_det = 0;
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (langwell->hsm.a_clr_err) {
-                        langwell->hsm.a_clr_err = 0;
-                        langwell->hsm.a_srp_det = 0;
-                        reset_otg();
-                        init_hsm();
-                        if (langwell->otg.state == OTG_STATE_A_IDLE)
-                                queue_work(langwell->qwork, &langwell->work);
-                }
-                break;
-        case OTG_STATE_A_WAIT_VFALL:
-                if (langwell->hsm.id) {
-                        langwell->otg.default_a = 0;
-                        langwell->otg.state = OTG_STATE_B_IDLE;
-                        queue_work(langwell->qwork, &langwell->work);
-                } else if (langwell->hsm.a_bus_req) {
-                        langwell_otg_drv_vbus(1);
-                        langwell->hsm.a_wait_vrise_tmout = 0;
-                        langwell_otg_add_timer(a_wait_vrise_tmr);
-                        langwell->otg.state = OTG_STATE_A_WAIT_VRISE;
-                } else if (!langwell->hsm.a_sess_vld) {
-                        langwell->hsm.a_srp_det = 0;
-                        langwell_otg_drv_vbus(0);
-                        set_host_mode();
-                        langwell->otg.state = OTG_STATE_A_IDLE;
-                }
-                break;
-        default:
-                ;
-        }
-
-        otg_dbg("%s: new state = %s\n", __func__,
-                        state_string(langwell->otg.state));
-}
-
-        static ssize_t
-show_registers(struct device *_dev, struct device_attribute *attr, char *buf)
-{
-        struct langwell_otg *langwell;
-        char *next;
-        unsigned size;
-        unsigned t;
-
-        langwell = the_transceiver;
-        next = buf;
-        size = PAGE_SIZE;
-
-        t = scnprintf(next, size,
-                "\n"
-                "USBCMD = 0x%08x \n"
-                "USBSTS = 0x%08x \n"
-                "USBINTR = 0x%08x \n"
-                "ASYNCLISTADDR = 0x%08x \n"
-                "PORTSC1 = 0x%08x \n"
-                "HOSTPC1 = 0x%08x \n"
-                "OTGSC = 0x%08x \n"
-                "USBMODE = 0x%08x \n",
-                readl(langwell->regs + 0x30),
-                readl(langwell->regs + 0x34),
-                readl(langwell->regs + 0x38),
-                readl(langwell->regs + 0x48),
-                readl(langwell->regs + 0x74),
-                readl(langwell->regs + 0xb4),
-                readl(langwell->regs + 0xf4),
-                readl(langwell->regs + 0xf8)
-                );
-        size -= t;
-        next += t;
-
-        return PAGE_SIZE - size;
-}
-static DEVICE_ATTR(registers, S_IRUGO, show_registers, NULL);
-
-static ssize_t
-show_hsm(struct device *_dev, struct device_attribute *attr, char *buf)
-{
-        struct langwell_otg *langwell;
-        char *next;
-        unsigned size;
-        unsigned t;
-
-        langwell = the_transceiver;
-        next = buf;
-        size = PAGE_SIZE;
-
-        t = scnprintf(next, size,
-                "\n"
-                "current state = %s\n"
-                "a_bus_resume = \t%d\n"
-                "a_bus_suspend = \t%d\n"
-                "a_conn = \t%d\n"
-                "a_sess_vld = \t%d\n"
-                "a_srp_det = \t%d\n"
-                "a_vbus_vld = \t%d\n"
-                "b_bus_resume = \t%d\n"
-                "b_bus_suspend = \t%d\n"
-                "b_conn = \t%d\n"
-                "b_se0_srp = \t%d\n"
-                "b_sess_end = \t%d\n"
-                "b_sess_vld = \t%d\n"
-                "id = \t%d\n"
-                "a_set_b_hnp_en = \t%d\n"
-                "b_srp_done = \t%d\n"
-                "b_hnp_enable = \t%d\n"
-                "a_wait_vrise_tmout = \t%d\n"
-                "a_wait_bcon_tmout = \t%d\n"
-                "a_aidl_bdis_tmout = \t%d\n"
-                "b_ase0_brst_tmout = \t%d\n"
-                "a_bus_drop = \t%d\n"
-                "a_bus_req = \t%d\n"
-                "a_clr_err = \t%d\n"
-                "a_suspend_req = \t%d\n"
-                "b_bus_req = \t%d\n"
-                "b_bus_suspend_tmout = \t%d\n"
-                "b_bus_suspend_vld = \t%d\n",
-                state_string(langwell->otg.state),
-                langwell->hsm.a_bus_resume,
-                langwell->hsm.a_bus_suspend,
-                langwell->hsm.a_conn,
-                langwell->hsm.a_sess_vld,
-                langwell->hsm.a_srp_det,
-                langwell->hsm.a_vbus_vld,
-                langwell->hsm.b_bus_resume,
-                langwell->hsm.b_bus_suspend,
-                langwell->hsm.b_conn,
-                langwell->hsm.b_se0_srp,
-                langwell->hsm.b_sess_end,
-                langwell->hsm.b_sess_vld,
-                langwell->hsm.id,
-                langwell->hsm.a_set_b_hnp_en,
-                langwell->hsm.b_srp_done,
-                langwell->hsm.b_hnp_enable,
-                langwell->hsm.a_wait_vrise_tmout,
-                langwell->hsm.a_wait_bcon_tmout,
-                langwell->hsm.a_aidl_bdis_tmout,
-                langwell->hsm.b_ase0_brst_tmout,
-                langwell->hsm.a_bus_drop,
-                langwell->hsm.a_bus_req,
-                langwell->hsm.a_clr_err,
-                langwell->hsm.a_suspend_req,
-                langwell->hsm.b_bus_req,
-                langwell->hsm.b_bus_suspend_tmout,
-                langwell->hsm.b_bus_suspend_vld
-                );
-        size -= t;
-        next += t;
-
-        return PAGE_SIZE - size;
-}
-static DEVICE_ATTR(hsm, S_IRUGO, show_hsm, NULL);
-
-static ssize_t
-get_a_bus_req(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct langwell_otg *langwell;
-        char *next;
-        unsigned size;
-        unsigned t;
-
-        langwell =  the_transceiver;
-        next = buf;
-        size = PAGE_SIZE;
-
-        t = scnprintf(next, size, "%d", langwell->hsm.a_bus_req);
-        size -= t;
-        next += t;
-
-        return PAGE_SIZE - size;
-}
-
-static ssize_t
-set_a_bus_req(struct device *dev, struct device_attribute *attr,
-                const char *buf, size_t count)
-{
-        struct langwell_otg *langwell;
-        langwell = the_transceiver;
-        if (!langwell->otg.default_a)
-                return -1;
-        if (count > 2)
-                return -1;
-
-        if (buf[0] == '0') {
-                langwell->hsm.a_bus_req = 0;
-                otg_dbg("a_bus_req = 0\n");
-        } else if (buf[0] == '1') {
-                /* If a_bus_drop is TRUE, a_bus_req can't be set */
-                if (langwell->hsm.a_bus_drop)
-                        return -1;
-                langwell->hsm.a_bus_req = 1;
-                otg_dbg("a_bus_req = 1\n");
-        }
-        if (spin_trylock(&langwell->wq_lock)) {
-                queue_work(langwell->qwork, &langwell->work);
-                spin_unlock(&langwell->wq_lock);
-        }
-        return count;
-}
-static DEVICE_ATTR(a_bus_req, S_IRUGO | S_IWUGO, get_a_bus_req, set_a_bus_req);
-
-static ssize_t
-get_a_bus_drop(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct langwell_otg *langwell;
-        char *next;
-        unsigned size;
-        unsigned t;
-
-        langwell =  the_transceiver;
-        next = buf;
-        size = PAGE_SIZE;
-
-        t = scnprintf(next, size, "%d", langwell->hsm.a_bus_drop);
-        size -= t;
-        next += t;
-
-        return PAGE_SIZE - size;
-}
-
-static ssize_t
-set_a_bus_drop(struct device *dev, struct device_attribute *attr,
-                const char *buf, size_t count)
-{
-        struct langwell_otg *langwell;
-        langwell = the_transceiver;
-        if (!langwell->otg.default_a)
-                return -1;
-        if (count > 2)
-                return -1;
-
-        if (buf[0] == '0') {
-                langwell->hsm.a_bus_drop = 0;
-                otg_dbg("a_bus_drop = 0\n");
-        } else if (buf[0] == '1') {
-                langwell->hsm.a_bus_drop = 1;
-                langwell->hsm.a_bus_req = 0;
-                otg_dbg("a_bus_drop = 1, then a_bus_req = 0\n");
-        }
-        if (spin_trylock(&langwell->wq_lock)) {
-                queue_work(langwell->qwork, &langwell->work);
-                spin_unlock(&langwell->wq_lock);
-        }
-        return count;
-}
-static DEVICE_ATTR(a_bus_drop, S_IRUGO | S_IWUGO,
-        get_a_bus_drop, set_a_bus_drop);
-
-static ssize_t
-get_b_bus_req(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct langwell_otg *langwell;
-        char *next;
-        unsigned size;
-        unsigned t;
-
-        langwell =  the_transceiver;
-        next = buf;
-        size = PAGE_SIZE;
-
-        t = scnprintf(next, size, "%d", langwell->hsm.b_bus_req);
-        size -= t;
-        next += t;
-
-        return PAGE_SIZE - size;
-}
-
-static ssize_t
-set_b_bus_req(struct device *dev, struct device_attribute *attr,
-                const char *buf, size_t count)
-{
-        struct langwell_otg *langwell;
-        langwell = the_transceiver;
-
-        if (langwell->otg.default_a)
-                return -1;
-
-        if (count > 2)
-                return -1;
-
-        if (buf[0] == '0') {
-                langwell->hsm.b_bus_req = 0;
-                otg_dbg("b_bus_req = 0\n");
-        } else if (buf[0] == '1') {
-                langwell->hsm.b_bus_req = 1;
-                otg_dbg("b_bus_req = 1\n");
-        }
-        if (spin_trylock(&langwell->wq_lock)) {
-                queue_work(langwell->qwork, &langwell->work);
-                spin_unlock(&langwell->wq_lock);
-        }
-        return count;
-}
-static DEVICE_ATTR(b_bus_req, S_IRUGO | S_IWUGO, get_b_bus_req, set_b_bus_req);
-
-static ssize_t
-set_a_clr_err(struct device *dev, struct device_attribute *attr,
-                const char *buf, size_t count)
-{
-        struct langwell_otg *langwell;
-        langwell = the_transceiver;
-
-        if (!langwell->otg.default_a)
-                return -1;
-        if (count > 2)
-                return -1;
-
-        if (buf[0] == '1') {
-                langwell->hsm.a_clr_err = 1;
-                otg_dbg("a_clr_err = 1\n");
-        }
-        if (spin_trylock(&langwell->wq_lock)) {
-                queue_work(langwell->qwork, &langwell->work);
-                spin_unlock(&langwell->wq_lock);
-        }
-        return count;
-}
-static DEVICE_ATTR(a_clr_err, S_IWUGO, NULL, set_a_clr_err);
-
-static struct attribute *inputs_attrs[] = {
-        &dev_attr_a_bus_req.attr,
-        &dev_attr_a_bus_drop.attr,
-        &dev_attr_b_bus_req.attr,
-        &dev_attr_a_clr_err.attr,
-        NULL,
-};
-
-static struct attribute_group debug_dev_attr_group = {
-        .name = "inputs",
-        .attrs = inputs_attrs,
-};
-
-int langwell_register_host(struct pci_driver *host_driver)
-{
-        int     ret = 0;
-
-        the_transceiver->host_ops = host_driver;
-        queue_work(the_transceiver->qwork, &the_transceiver->work);
-        otg_dbg("host controller driver is registered\n");
-
-        return ret;
-}
-EXPORT_SYMBOL(langwell_register_host);
-
-void langwell_unregister_host(struct pci_driver *host_driver)
-{
-        if (the_transceiver->host_ops)
-                the_transceiver->host_ops->remove(the_transceiver->pdev);
-        the_transceiver->host_ops = NULL;
-        the_transceiver->hsm.a_bus_drop = 1;
-        queue_work(the_transceiver->qwork, &the_transceiver->work);
-        otg_dbg("host controller driver is unregistered\n");
-}
-EXPORT_SYMBOL(langwell_unregister_host);
-
-int langwell_register_peripheral(struct pci_driver *client_driver)
-{
-        int     ret = 0;
-
-        if (client_driver)
-                ret = client_driver->probe(the_transceiver->pdev,
-                                client_driver->id_table);
-        if (!ret) {
-                the_transceiver->client_ops = client_driver;
-                queue_work(the_transceiver->qwork, &the_transceiver->work);
-                otg_dbg("client controller driver is registered\n");
-        }
-
-        return ret;
-}
-EXPORT_SYMBOL(langwell_register_peripheral);
-
-void langwell_unregister_peripheral(struct pci_driver *client_driver)
-{
-        if (the_transceiver->client_ops)
-                the_transceiver->client_ops->remove(the_transceiver->pdev);
-        the_transceiver->client_ops = NULL;
-        the_transceiver->hsm.b_bus_req = 0;
-        queue_work(the_transceiver->qwork, &the_transceiver->work);
-        otg_dbg("client controller driver is unregistered\n");
-}
-EXPORT_SYMBOL(langwell_unregister_peripheral);
-
-static int langwell_otg_probe(struct pci_dev *pdev,
-                const struct pci_device_id *id)
-{
-        unsigned long           resource, len;
-        void __iomem            *base = NULL;
-        int                     retval;
-        u32                     val32;
-        struct langwell_otg     *langwell;
-        char                    qname[] = "langwell_otg_queue";
-
-        retval = 0;
-        otg_dbg("\notg controller is detected.\n");
-        if (pci_enable_device(pdev) < 0) {
-                retval = -ENODEV;
-                goto done;
-        }
-
-        langwell = kzalloc(sizeof *langwell, GFP_KERNEL);
-        if (langwell == NULL) {
-                retval = -ENOMEM;
-                goto done;
-        }
-        the_transceiver = langwell;
-
-        /* control register: BAR 0 */
-        resource = pci_resource_start(pdev, 0);
-        len = pci_resource_len(pdev, 0);
-        if (!request_mem_region(resource, len, driver_name)) {
-                retval = -EBUSY;
-                goto err;
-        }
-        langwell->region = 1;
-
-        base = ioremap_nocache(resource, len);
-        if (base == NULL) {
-                retval = -EFAULT;
-                goto err;
-        }
-        langwell->regs = base;
-
-        if (!pdev->irq) {
-                otg_dbg("No IRQ.\n");
-                retval = -ENODEV;
-                goto err;
-        }
-
-        langwell->qwork = create_workqueue(qname);
-        if (!langwell->qwork) {
-                otg_dbg("cannot create workqueue %s\n", qname);
-                retval = -ENOMEM;
-                goto err;
-        }
-        INIT_WORK(&langwell->work, langwell_otg_work);
-
-        /* OTG common part */
-        langwell->pdev = pdev;
-        langwell->otg.dev = &pdev->dev;
-        langwell->otg.label = driver_name;
-        langwell->otg.set_host = langwell_otg_set_host;
-        langwell->otg.set_peripheral = langwell_otg_set_peripheral;
-        langwell->otg.set_power = langwell_otg_set_power;
-        langwell->otg.start_srp = langwell_otg_start_srp;
-        langwell->otg.state = OTG_STATE_UNDEFINED;
-        if (otg_set_transceiver(&langwell->otg)) {
-                otg_dbg("can't set transceiver\n");
-                retval = -EBUSY;
-                goto err;
-        }
-
-        reset_otg();
-        init_hsm();
-
-        spin_lock_init(&langwell->lock);
-        spin_lock_init(&langwell->wq_lock);
-        INIT_LIST_HEAD(&active_timers);
-        langwell_otg_init_timers(&langwell->hsm);
-
-        if (request_irq(pdev->irq, otg_irq, IRQF_SHARED,
-                                driver_name, langwell) != 0) {
-                otg_dbg("request interrupt %d failed\n", pdev->irq);
-                retval = -EBUSY;
-                goto err;
-        }
-
-        /* enable OTGSC int */
-        val32 = OTGSC_DPIE | OTGSC_BSEIE | OTGSC_BSVIE |
-                OTGSC_ASVIE | OTGSC_AVVIE | OTGSC_IDIE | OTGSC_IDPU;
-        writel(val32, langwell->regs + CI_OTGSC);
-
-        retval = device_create_file(&pdev->dev, &dev_attr_registers);
-        if (retval < 0) {
-                otg_dbg("Can't register sysfs attribute: %d\n", retval);
-                goto err;
-        }
-
-        retval = device_create_file(&pdev->dev, &dev_attr_hsm);
-        if (retval < 0) {
-                otg_dbg("Can't hsm sysfs attribute: %d\n", retval);
-                goto err;
-        }
-
-        retval = sysfs_create_group(&pdev->dev.kobj, &debug_dev_attr_group);
-        if (retval < 0) {
-                otg_dbg("Can't register sysfs attr group: %d\n", retval);
-                goto err;
-        }
-
-        if (langwell->otg.state == OTG_STATE_A_IDLE)
-                queue_work(langwell->qwork, &langwell->work);
-
-        return 0;
-
-err:
-        if (the_transceiver)
-                langwell_otg_remove(pdev);
-done:
-        return retval;
-}
-
-static void langwell_otg_remove(struct pci_dev *pdev)
-{
-        struct langwell_otg *langwell;
-
-        langwell = the_transceiver;
-
-        if (langwell->qwork) {
-                flush_workqueue(langwell->qwork);
-                destroy_workqueue(langwell->qwork);
-        }
-        langwell_otg_free_timers();
-
-        /* disable OTGSC interrupt as OTGSC doesn't change in reset */
-        writel(0, langwell->regs + CI_OTGSC);
-
-        if (pdev->irq)
-                free_irq(pdev->irq, langwell);
-        if (langwell->regs)
-                iounmap(langwell->regs);
-        if (langwell->region)
-                release_mem_region(pci_resource_start(pdev, 0),
-                                pci_resource_len(pdev, 0));
-
-        otg_set_transceiver(NULL);
-        pci_disable_device(pdev);
-        sysfs_remove_group(&pdev->dev.kobj, &debug_dev_attr_group);
-        device_remove_file(&pdev->dev, &dev_attr_hsm);
-        device_remove_file(&pdev->dev, &dev_attr_registers);
-        kfree(langwell);
-        langwell = NULL;
-}
-
-static void transceiver_suspend(struct pci_dev *pdev)
-{
-        pci_save_state(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
-        langwell_otg_phy_low_power(1);
-}
-
-static int langwell_otg_suspend(struct pci_dev *pdev, pm_message_t message)
-{
-        int     ret = 0;
-        struct langwell_otg *langwell;
-
-        langwell = the_transceiver;
-
-        /* Disbale OTG interrupts */
-        langwell_otg_intr(0);
-
-        if (pdev->irq)
-                free_irq(pdev->irq, langwell);
-
-        /* Prevent more otg_work */
-        flush_workqueue(langwell->qwork);
-        spin_lock(&langwell->wq_lock);
-
-        /* start actions */
-        switch (langwell->otg.state) {
-        case OTG_STATE_A_IDLE:
-        case OTG_STATE_B_IDLE:
-        case OTG_STATE_A_WAIT_VFALL:
-        case OTG_STATE_A_VBUS_ERR:
-                transceiver_suspend(pdev);
-                break;
-        case OTG_STATE_A_WAIT_VRISE:
-                langwell_otg_del_timer(a_wait_vrise_tmr);
-                langwell->hsm.a_srp_det = 0;
-                langwell_otg_drv_vbus(0);
-                langwell->otg.state = OTG_STATE_A_IDLE;
-                transceiver_suspend(pdev);
-                break;
-        case OTG_STATE_A_WAIT_BCON:
-                langwell_otg_del_timer(a_wait_bcon_tmr);
-                if (langwell->host_ops)
-                        ret = langwell->host_ops->suspend(pdev, message);
-                langwell_otg_drv_vbus(0);
-                break;
-        case OTG_STATE_A_HOST:
-                if (langwell->host_ops)
-                        ret = langwell->host_ops->suspend(pdev, message);
-                langwell_otg_drv_vbus(0);
-                langwell_otg_phy_low_power(1);
-                break;
-        case OTG_STATE_A_SUSPEND:
-                langwell_otg_del_timer(a_aidl_bdis_tmr);
-                langwell_otg_HABA(0);
-                if (langwell->host_ops)
-                        langwell->host_ops->remove(pdev);
-                else
-                        otg_dbg("host driver has been removed.\n");
-                langwell_otg_drv_vbus(0);
-                transceiver_suspend(pdev);
-                langwell->otg.state = OTG_STATE_A_WAIT_VFALL;
-                break;
-        case OTG_STATE_A_PERIPHERAL:
-                if (langwell->client_ops)
-                        ret = langwell->client_ops->suspend(pdev, message);
-                else
-                        otg_dbg("client driver has been removed.\n");
-                langwell_otg_drv_vbus(0);
-                transceiver_suspend(pdev);
-                langwell->otg.state = OTG_STATE_A_WAIT_VFALL;
-                break;
-        case OTG_STATE_B_HOST:
-                if (langwell->host_ops)
-                        langwell->host_ops->remove(pdev);
-                else
-                        otg_dbg("host driver has been removed.\n");
-                langwell->hsm.b_bus_req = 0;
-                transceiver_suspend(pdev);
-                langwell->otg.state = OTG_STATE_B_IDLE;
-                break;
-        case OTG_STATE_B_PERIPHERAL:
-                if (langwell->client_ops)
-                        ret = langwell->client_ops->suspend(pdev, message);
-                else
-                        otg_dbg("client driver has been removed.\n");
-                break;
-        case OTG_STATE_B_WAIT_ACON:
-                langwell_otg_del_timer(b_ase0_brst_tmr);
-                langwell_otg_HAAR(0);
-                if (langwell->host_ops)
-                        langwell->host_ops->remove(pdev);
-                else
-                        otg_dbg("host driver has been removed.\n");
-                langwell->hsm.b_bus_req = 0;
-                langwell->otg.state = OTG_STATE_B_IDLE;
-                transceiver_suspend(pdev);
-                break;
-        default:
-                otg_dbg("error state before suspend\n ");
-                break;
-        }
-        spin_unlock(&langwell->wq_lock);
-
-        return ret;
-}
-
-static void transceiver_resume(struct pci_dev *pdev)
-{
-        pci_restore_state(pdev);
-        pci_set_power_state(pdev, PCI_D0);
-        langwell_otg_phy_low_power(0);
-}
-
-static int langwell_otg_resume(struct pci_dev *pdev)
-{
-        int     ret = 0;
-        struct langwell_otg *langwell;
-
-        langwell = the_transceiver;
-
-        spin_lock(&langwell->wq_lock);
-
-        switch (langwell->otg.state) {
-        case OTG_STATE_A_IDLE:
-        case OTG_STATE_B_IDLE:
-        case OTG_STATE_A_WAIT_VFALL:
-        case OTG_STATE_A_VBUS_ERR:
-                transceiver_resume(pdev);
-                break;
-        case OTG_STATE_A_WAIT_BCON:
-                langwell_otg_add_timer(a_wait_bcon_tmr);
-                langwell_otg_drv_vbus(1);
-                if (langwell->host_ops)
-                        ret = langwell->host_ops->resume(pdev);
-                break;
-        case OTG_STATE_A_HOST:
-                langwell_otg_drv_vbus(1);
-                langwell_otg_phy_low_power(0);
-                if (langwell->host_ops)
-                        ret = langwell->host_ops->resume(pdev);
-                break;
-        case OTG_STATE_B_PERIPHERAL:
-                if (langwell->client_ops)
-                        ret = langwell->client_ops->resume(pdev);
-                else
-                        otg_dbg("client driver not loaded.\n");
-                break;
-        default:
-                otg_dbg("error state before suspend\n ");
-                break;
-        }
-
-        if (request_irq(pdev->irq, otg_irq, IRQF_SHARED,
-                                driver_name, the_transceiver) != 0) {
-                otg_dbg("request interrupt %d failed\n", pdev->irq);
-                ret = -EBUSY;
-        }
-
-        /* enable OTG interrupts */
-        langwell_otg_intr(1);
-
-        spin_unlock(&langwell->wq_lock);
-
-        queue_work(langwell->qwork, &langwell->work);
-
-
-        return ret;
-}
-
-static int __init langwell_otg_init(void)
-{
-        return pci_register_driver(&otg_pci_driver);
-}
-module_init(langwell_otg_init);
-
-static void __exit langwell_otg_cleanup(void)
-{
-        pci_unregister_driver(&otg_pci_driver);
-}
-module_exit(langwell_otg_cleanup);
diff --git a/drivers/usb/otg/nop-usb-xceiv.c b/drivers/usb/otg/nop-usb-xceiv.c
index 9ed5ea568679..af456b48985f 100644
--- a/drivers/usb/otg/nop-usb-xceiv.c
+++ b/drivers/usb/otg/nop-usb-xceiv.c
@@ -53,6 +53,7 @@ EXPORT_SYMBOL(usb_nop_xceiv_register);
 void usb_nop_xceiv_unregister(void)
 {
         platform_device_unregister(pd);
+        pd = NULL;
 }
 EXPORT_SYMBOL(usb_nop_xceiv_unregister);
 
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 247b61bfb7f4..0e4f2e41ace5 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -169,9 +169,11 @@ static int usb_console_setup(struct console *co, char *options)
                         kfree(tty);
                 }
         }
-        /* So we know not to kill the hardware on a hangup on this
-           port. We have also bumped the use count by one so it won't go
-           idle */
+        /* Now that any required fake tty operations are completed restore
+         * the tty port count */
+        --port->port.count;
+        /* The console is special in terms of closing the device so
+         * indicate this port is now acting as a system console. */
         port->console = 1;
         retval = 0;
 
@@ -204,7 +206,7 @@ static void usb_console_write(struct console *co,
 
         dbg("%s - port %d, %d byte(s)", __func__, port->number, count);
 
-        if (!port->port.count) {
+        if (!port->console) {
                 dbg("%s - port not opened", __func__);
                 return;
         }
@@ -300,8 +302,7 @@ void usb_serial_console_exit(void)
 {
         if (usbcons_info.port) {
                 unregister_console(&usbcons);
-                if (usbcons_info.port->port.count)
-                        usbcons_info.port->port.count--;
+                usbcons_info.port->console = 0;
                 usbcons_info.port = NULL;
         }
 }
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 2b9eeda62bfe..e9a40b820fd4 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -67,6 +67,8 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
         { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
         { USB_DEVICE(0x10C4, 0x0F91) }, /* Vstabi */
+        { USB_DEVICE(0x10C4, 0x1101) }, /* Arkham Technology DS101 Bus Monitor */
+        { USB_DEVICE(0x10C4, 0x1601) }, /* Arkham Technology DS101 Adapter */
         { USB_DEVICE(0x10C4, 0x800A) }, /* SPORTident BSM7-D-USB main station */
         { USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */
         { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 9734085fd2fe..59adfe123110 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -1228,8 +1228,8 @@ static void cypress_read_int_callback(struct urb *urb)
                 /* precursor to disconnect so just go away */
                 return;
         case -EPIPE:
-                usb_clear_halt(port->serial->dev, 0x81);
-                break;
+                /* Can't call usb_clear_halt while in_interrupt */
+                /* FALLS THROUGH */
         default:
                 /* something ugly is going on... */
                 dev_err(&urb->dev->dev,
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 3dc3768ca71c..60c64cc5be2a 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -33,6 +33,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
@@ -107,6 +108,7 @@ struct ftdi_sio_quirk {
 
 static int   ftdi_jtag_probe(struct usb_serial *serial);
 static int   ftdi_mtxorb_hack_setup(struct usb_serial *serial);
+static int   ftdi_NDI_device_setup(struct usb_serial *serial);
 static void  ftdi_USB_UIRT_setup(struct ftdi_private *priv);
 static void  ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
 
@@ -118,6 +120,10 @@ static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
         .probe  = ftdi_mtxorb_hack_setup,
 };
 
+static struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
+        .probe  = ftdi_NDI_device_setup,
+};
+
 static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
         .port_probe = ftdi_USB_UIRT_setup,
 };
@@ -191,6 +197,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_4_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) },
@@ -579,6 +586,9 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_CCSICDU20_0_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CCSICDU40_1_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CCSMACHX_2_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_CCSLOAD_N_GO_3_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_CCSICDU64_4_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_CCSPRIME8_5_PID) },
         { USB_DEVICE(FTDI_VID, INSIDE_ACCESSO) },
         { USB_DEVICE(INTREPID_VID, INTREPID_VALUECAN_PID) },
         { USB_DEVICE(INTREPID_VID, INTREPID_NEOVI_PID) },
@@ -644,6 +654,16 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13S_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13U_PID) },
         { USB_DEVICE(ELEKTOR_VID, ELEKTOR_FT323R_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_NDI_HUC_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_NDI_SPECTRA_SCU_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_NDI_FUTURE_2_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_NDI_FUTURE_3_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
         { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
@@ -660,6 +680,8 @@ static struct usb_device_id id_table_combined [] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
         { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO4x4_PID) },
@@ -667,7 +689,6 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
         { USB_DEVICE(ALTI2_VID, ALTI2_N3_PID) },
         { USB_DEVICE(FTDI_VID, DIEBOLD_BCS_SE923_PID) },
-        { USB_DEVICE(FTDI_VID, FTDI_NDI_HUC_PID) },
         { USB_DEVICE(ATMEL_VID, STK541_PID) },
         { USB_DEVICE(DE_VID, STB_PID) },
         { USB_DEVICE(DE_VID, WHT_PID) },
@@ -1023,6 +1044,16 @@ static __u32 get_ftdi_divisor(struct tty_struct *tty,
         case FT2232C: /* FT2232C chip */
         case FT232RL:
                 if (baud <= 3000000) {
+                        __u16 product_id = le16_to_cpu(
+                                port->serial->dev->descriptor.idProduct);
+                        if (((FTDI_NDI_HUC_PID == product_id) ||
+                             (FTDI_NDI_SPECTRA_SCU_PID == product_id) ||
+                             (FTDI_NDI_FUTURE_2_PID == product_id) ||
+                             (FTDI_NDI_FUTURE_3_PID == product_id) ||
+                             (FTDI_NDI_AURORA_SCU_PID == product_id)) &&
+                            (baud == 19200)) {
+                                baud = 1200000;
+                        }
                         div_value = ftdi_232bm_baud_to_divisor(baud);
                 } else {
                         dbg("%s - Baud rate too high!", __func__);
@@ -1554,6 +1585,39 @@ static void ftdi_HE_TIRA1_setup(struct ftdi_private *priv)
 } /* ftdi_HE_TIRA1_setup */
 
 /*
+ * Module parameter to control latency timer for NDI FTDI-based USB devices.
+ * If this value is not set in modprobe.conf.local its value will be set to 1ms.
+ */
+static int ndi_latency_timer = 1;
+
+/* Setup for the NDI FTDI-based USB devices, which requires hardwired
+ * baudrate (19200 gets mapped to 1200000).
+ *
+ * Called from usbserial:serial_probe.
+ */
+static int ftdi_NDI_device_setup(struct usb_serial *serial)
+{
+        struct usb_device *udev = serial->dev;
+        int latency = ndi_latency_timer;
+        int rv = 0;
+        char buf[1];
+
+        if (latency == 0)
+                latency = 1;
+        if (latency > 99)
+                latency = 99;
+
+        dbg("%s setting NDI device latency to %d", __func__, latency);
+        dev_info(&udev->dev, "NDI device with a latency value of %d", latency);
+
+        rv = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                                FTDI_SIO_SET_LATENCY_TIMER_REQUEST,
+                                FTDI_SIO_SET_LATENCY_TIMER_REQUEST_TYPE,
+                                latency, 0, buf, 0, WDR_TIMEOUT);
+        return 0;
+}
+
+/*
  * First port on JTAG adaptors such as Olimex arm-usb-ocd or the FIC/OpenMoko
  * Neo1973 Debug Board is reserved for JTAG interface and can be accessed from
  * userspace using openocd.
@@ -2121,7 +2185,7 @@ static void ftdi_process_read(struct work_struct *work)
                                 /* Note that the error flag is duplicated for
                                    every character received since we don't know
                                    which character it applied to */
-                                if (!usb_serial_handle_sysrq_char(port,
+                                if (!usb_serial_handle_sysrq_char(tty, port,
                                                 data[packet_offset + i]))
                                         tty_insert_flip_char(tty,
                                                 data[packet_offset + i],
@@ -2622,3 +2686,5 @@ MODULE_PARM_DESC(vendor, "User specified vendor ID (default="
 module_param(product, ushort, 0);
 MODULE_PARM_DESC(product, "User specified product ID");
 
+module_param(ndi_latency_timer, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(ndi_latency_timer, "NDI device latency timer override");
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index f1d440a728a3..c9fbd7415092 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -506,6 +506,7 @@
  *
  * Armin Laeuger originally sent the PID for the UM 100 module.
  */
+#define FTDI_R2000KU_TRUE_RNG   0xFB80  /* R2000KU TRUE RNG */
 #define FTDI_ELV_UR100_PID      0xFB58  /* USB-RS232-Umsetzer (UR 100) */
 #define FTDI_ELV_UM100_PID      0xFB5A  /* USB-Modul UM 100 */
 #define FTDI_ELV_UO100_PID      0xFB5B  /* USB-Modul UO 100 */
@@ -614,6 +615,9 @@
 #define FTDI_CCSICDU20_0_PID    0xF9D0
 #define FTDI_CCSICDU40_1_PID    0xF9D1
 #define FTDI_CCSMACHX_2_PID     0xF9D2
+#define FTDI_CCSLOAD_N_GO_3_PID 0xF9D3
+#define FTDI_CCSICDU64_4_PID    0xF9D4
+#define FTDI_CCSPRIME8_5_PID    0xF9D5
 
 /* Inside Accesso contactless reader (http://www.insidefr.com) */
 #define INSIDE_ACCESSO          0xFAD0
@@ -736,6 +740,15 @@
 #define FTDI_PYRAMID_PID        0xE6C8  /* Pyramid Appliance Display */
 
 /*
+ * NDI (www.ndigital.com) product ids
+ */
+#define FTDI_NDI_HUC_PID                0xDA70  /* NDI Host USB Converter */
+#define FTDI_NDI_SPECTRA_SCU_PID        0xDA71  /* NDI Spectra SCU */
+#define FTDI_NDI_FUTURE_2_PID           0xDA72  /* NDI future device #2 */
+#define FTDI_NDI_FUTURE_3_PID           0xDA73  /* NDI future device #3 */
+#define FTDI_NDI_AURORA_SCU_PID         0xDA74  /* NDI Aurora SCU */
+
+/*
  * Posiflex inc retail equipment (http://www.posiflex.com.tw)
  */
 #define POSIFLEX_VID            0x0d3a  /* Vendor ID */
@@ -848,9 +861,6 @@
 #define TML_VID                 0x1B91  /* Vendor ID */
 #define TML_USB_SERIAL_PID      0x0064  /* USB - Serial Converter */
 
-/* NDI Polaris System */
-#define FTDI_NDI_HUC_PID        0xDA70
-
 /* Propox devices */
 #define FTDI_PROPOX_JTAGCABLEII_PID     0xD738
 
@@ -934,6 +944,8 @@
 #define MARVELL_VID             0x9e88
 #define MARVELL_SHEEVAPLUG_PID  0x9e8f
 
+#define FTDI_TURTELIZER_PID     0xBDC8 /* JTAG/RS-232 adapter by egnite GmBH */
+
 /*
  *   BmRequestType:  1100 0000b
  *   bRequest:       FTDI_E2_READ
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 932d6241b787..ce57f6a32bdf 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -424,10 +424,17 @@ static void flush_and_resubmit_read_urb(struct usb_serial_port *port)
         if (!tty)
                 goto done;
 
-        /* Push data to tty */
-        for (i = 0; i < urb->actual_length; i++, ch++) {
-                if (!usb_serial_handle_sysrq_char(port, *ch))
-                        tty_insert_flip_char(tty, *ch, TTY_NORMAL);
+        /* The per character mucking around with sysrq path it too slow for
+           stuff like 3G modems, so shortcircuit it in the 99.9999999% of cases
+           where the USB serial is not a console anyway */
+        if (!port->console || !port->sysrq)
+                tty_insert_flip_string(tty, ch, urb->actual_length);
+        else {
+                /* Push data to tty */
+                for (i = 0; i < urb->actual_length; i++, ch++) {
+                        if (!usb_serial_handle_sysrq_char(tty, port, *ch))
+                                tty_insert_flip_char(tty, *ch, TTY_NORMAL);
+                }
         }
         tty_flip_buffer_push(tty);
         tty_kref_put(tty);
@@ -527,11 +534,12 @@ void usb_serial_generic_unthrottle(struct tty_struct *tty)
         }
 }
 
-int usb_serial_handle_sysrq_char(struct usb_serial_port *port, unsigned int ch)
+int usb_serial_handle_sysrq_char(struct tty_struct *tty,
+                        struct usb_serial_port *port, unsigned int ch)
 {
         if (port->sysrq && port->console) {
                 if (ch && time_before(jiffies, port->sysrq)) {
-                        handle_sysrq(ch, tty_port_tty_get(&port->port));
+                        handle_sysrq(ch, tty);
                         port->sysrq = 0;
                         return 1;
                 }
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index bfc5ce000ef9..ccd4dd340d2c 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -521,7 +521,7 @@ static int mos7720_chars_in_buffer(struct tty_struct *tty)
         mos7720_port = usb_get_serial_port_data(port);
         if (mos7720_port == NULL) {
                 dbg("%s:leaving ...........", __func__);
-                return -ENODEV;
+                return 0;
         }
 
         for (i = 0; i < NUM_URBS; ++i) {
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index c40f95c1951c..c31940a307f8 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -26,6 +26,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 575816e6ba37..98262dd552bb 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -206,6 +206,7 @@ static int  option_resume(struct usb_serial *serial);
 #define NOVATELWIRELESS_PRODUCT_MC950D          0x4400
 #define NOVATELWIRELESS_PRODUCT_U727            0x5010
 #define NOVATELWIRELESS_PRODUCT_MC760           0x6000
+#define NOVATELWIRELESS_PRODUCT_OVMC760         0x6002
 
 /* FUTURE NOVATEL PRODUCTS */
 #define NOVATELWIRELESS_PRODUCT_EVDO_HIGHSPEED  0X6001
@@ -307,11 +308,20 @@ static int  option_resume(struct usb_serial *serial);
 #define DLINK_VENDOR_ID                         0x1186
 #define DLINK_PRODUCT_DWM_652                   0x3e04
 
+#define QISDA_VENDOR_ID                         0x1da5
+#define QISDA_PRODUCT_H21_4512                  0x4512
+#define QISDA_PRODUCT_H21_4523                  0x4523
+#define QISDA_PRODUCT_H20_4515                  0x4515
+#define QISDA_PRODUCT_H20_4519                  0x4519
+
 
 /* TOSHIBA PRODUCTS */
 #define TOSHIBA_VENDOR_ID                       0x0930
 #define TOSHIBA_PRODUCT_HSDPA_MINICARD          0x1302
 
+#define ALINK_VENDOR_ID                         0x1e0e
+#define ALINK_PRODUCT_3GU                       0x9200
+
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -430,6 +440,7 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC727) }, /* Novatel MC727/U727/USB727 */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U727) }, /* Novatel MC727/U727/USB727 */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC760) }, /* Novatel MC760/U760/USB760 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_OVMC760) }, /* Novatel Ovation MC760 */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_FULLSPEED) }, /* Novatel HSPA product */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_FULLSPEED) }, /* Novatel EVDO Embedded product */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED) }, /* Novatel HSPA Embedded product */
@@ -529,8 +540,13 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
-        { USB_DEVICE(0x1da5, 0x4515) }, /* BenQ H20 */
+        { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
+        { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) },
+        { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) },
+        { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4519) },
         { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
+        { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
@@ -732,7 +748,6 @@ static int option_write(struct tty_struct *tty, struct usb_serial_port *port,
                 memcpy(this_urb->transfer_buffer, buf, todo);
                 this_urb->transfer_buffer_length = todo;
 
-                this_urb->dev = port->serial->dev;
                 err = usb_submit_urb(this_urb, GFP_ATOMIC);
                 if (err) {
                         dbg("usb_submit_urb %p (write bulk) failed "
@@ -860,7 +875,6 @@ static void option_instat_callback(struct urb *urb)
 
         /* Resubmit urb so we continue receiving IRQ data */
         if (status != -ESHUTDOWN && status != -ENOENT) {
-                urb->dev = serial->dev;
                 err = usb_submit_urb(urb, GFP_ATOMIC);
                 if (err)
                         dbg("%s: resubmit intr urb failed. (%d)",
@@ -921,23 +935,11 @@ static int option_open(struct tty_struct *tty,
 
         dbg("%s", __func__);
 
-        /* Reset low level data toggle and start reading from endpoints */
+        /* Start reading from the IN endpoint */
         for (i = 0; i < N_IN_URB; i++) {
                 urb = portdata->in_urbs[i];
                 if (!urb)
                         continue;
-                if (urb->dev != serial->dev) {
-                        dbg("%s: dev %p != %p", __func__,
-                                urb->dev, serial->dev);
-                        continue;
-                }
-
-                /*
-                 * make sure endpoint data toggle is synchronized with the
-                 * device
-                 */
-                usb_clear_halt(urb->dev, urb->pipe);
-
                 err = usb_submit_urb(urb, GFP_KERNEL);
                 if (err) {
                         dbg("%s: submit urb %d failed (%d) %d",
@@ -946,16 +948,6 @@ static int option_open(struct tty_struct *tty,
                 }
         }
 
-        /* Reset low level data toggle on out endpoints */
-        for (i = 0; i < N_OUT_URB; i++) {
-                urb = portdata->out_urbs[i];
-                if (!urb)
-                        continue;
-                urb->dev = serial->dev;
-                /* usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
-                                usb_pipeout(urb->pipe), 0); */
-        }
-
         option_send_setup(port);
 
         return 0;
@@ -1218,7 +1210,6 @@ static int option_resume(struct usb_serial *serial)
                         dbg("%s: No interrupt URB for port %d\n", __func__, i);
                         continue;
                 }
-                port->interrupt_in_urb->dev = serial->dev;
                 err = usb_submit_urb(port->interrupt_in_urb, GFP_NOIO);
                 dbg("Submitted interrupt URB for port %d (result %d)", i, err);
                 if (err < 0) {
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index ec6c132a25b5..7d15bfa7c2db 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -94,6 +94,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
         { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
         { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+        { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
 
@@ -971,18 +972,46 @@ exit:
                         __func__, retval);
 }
 
+static void pl2303_push_data(struct tty_struct *tty,
+                struct usb_serial_port *port, struct urb *urb,
+                u8 line_status)
+{
+        unsigned char *data = urb->transfer_buffer;
+        /* get tty_flag from status */
+        char tty_flag = TTY_NORMAL;
+        /* break takes precedence over parity, */
+        /* which takes precedence over framing errors */
+        if (line_status & UART_BREAK_ERROR)
+                tty_flag = TTY_BREAK;
+        else if (line_status & UART_PARITY_ERROR)
+                tty_flag = TTY_PARITY;
+        else if (line_status & UART_FRAME_ERROR)
+                tty_flag = TTY_FRAME;
+        dbg("%s - tty_flag = %d", __func__, tty_flag);
+
+        tty_buffer_request_room(tty, urb->actual_length + 1);
+        /* overrun is special, not associated with a char */
+        if (line_status & UART_OVERRUN_ERROR)
+                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+        if (port->console && port->sysrq) {
+                int i;
+                for (i = 0; i < urb->actual_length; ++i)
+                        if (!usb_serial_handle_sysrq_char(tty, port, data[i]))
+                                tty_insert_flip_char(tty, data[i], tty_flag);
+        } else
+                tty_insert_flip_string(tty, data, urb->actual_length);
+        tty_flip_buffer_push(tty);
+}
+
 static void pl2303_read_bulk_callback(struct urb *urb)
 {
         struct usb_serial_port *port =  urb->context;
         struct pl2303_private *priv = usb_get_serial_port_data(port);
         struct tty_struct *tty;
-        unsigned char *data = urb->transfer_buffer;
         unsigned long flags;
-        int i;
         int result;
         int status = urb->status;
         u8 line_status;
-        char tty_flag;
 
         dbg("%s - port %d", __func__, port->number);
 
@@ -1010,10 +1039,7 @@ static void pl2303_read_bulk_callback(struct urb *urb)
         }
 
         usb_serial_debug_data(debug, &port->dev, __func__,
-                              urb->actual_length, data);
-
-        /* get tty_flag from status */
-        tty_flag = TTY_NORMAL;
+                              urb->actual_length, urb->transfer_buffer);
 
         spin_lock_irqsave(&priv->lock, flags);
         line_status = priv->line_status;
@@ -1021,26 +1047,9 @@ static void pl2303_read_bulk_callback(struct urb *urb)
         spin_unlock_irqrestore(&priv->lock, flags);
         wake_up_interruptible(&priv->delta_msr_wait);
 
-        /* break takes precedence over parity, */
-        /* which takes precedence over framing errors */
-        if (line_status & UART_BREAK_ERROR)
-                tty_flag = TTY_BREAK;
-        else if (line_status & UART_PARITY_ERROR)
-                tty_flag = TTY_PARITY;
-        else if (line_status & UART_FRAME_ERROR)
-                tty_flag = TTY_FRAME;
-        dbg("%s - tty_flag = %d", __func__, tty_flag);
-
         tty = tty_port_tty_get(&port->port);
         if (tty && urb->actual_length) {
-                tty_buffer_request_room(tty, urb->actual_length + 1);
-                /* overrun is special, not associated with a char */
-                if (line_status & UART_OVERRUN_ERROR)
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                for (i = 0; i < urb->actual_length; ++i)
-                        if (!usb_serial_handle_sysrq_char(port, data[i]))
-                                tty_insert_flip_char(tty, data[i], tty_flag);
-                tty_flip_buffer_push(tty);
+                pl2303_push_data(tty, port, urb, line_status);
         }
         tty_kref_put(tty);
         /* Schedule the next read _if_ we are still open */
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 1d7a22e3a9fd..12aac7d2462d 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -122,3 +122,7 @@
 /* Hewlett-Packard LD220-HP POS Pole Display */
 #define HP_VENDOR_ID            0x03f0
 #define HP_LD220_PRODUCT_ID     0x3524
+
+/* Cressi Edy (diving computer) PC interface */
+#define CRESSI_VENDOR_ID        0x04b8
+#define CRESSI_EDY_PRODUCT_ID   0x0521
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 032f7aeb40a4..f48d05e0acc1 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -181,35 +181,50 @@ static const struct sierra_iface_info direct_ip_interface_blacklist = {
 };
 
 static struct usb_device_id id_table [] = {
+        { USB_DEVICE(0x0F3D, 0x0112) }, /* Airprime/Sierra PC 5220 */
+        { USB_DEVICE(0x03F0, 0x1B1D) }, /* HP ev2200 a.k.a MC5720 */
+        { USB_DEVICE(0x03F0, 0x1E1D) }, /* HP hs2300 a.k.a MC8775 */
+
         { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */
         { USB_DEVICE(0x1199, 0x0018) }, /* Sierra Wireless MC5720 */
         { USB_DEVICE(0x1199, 0x0218) }, /* Sierra Wireless MC5720 */
-        { USB_DEVICE(0x03f0, 0x1b1d) }, /* HP ev2200 a.k.a MC5720 */
         { USB_DEVICE(0x1199, 0x0020) }, /* Sierra Wireless MC5725 */
-        { USB_DEVICE(0x1199, 0x0024) }, /* Sierra Wireless MC5727 */
         { USB_DEVICE(0x1199, 0x0220) }, /* Sierra Wireless MC5725 */
+        { USB_DEVICE(0x1199, 0x0022) }, /* Sierra Wireless EM5725 */
+        { USB_DEVICE(0x1199, 0x0024) }, /* Sierra Wireless MC5727 */
+        { USB_DEVICE(0x1199, 0x0224) }, /* Sierra Wireless MC5727 */
         { USB_DEVICE(0x1199, 0x0019) }, /* Sierra Wireless AirCard 595 */
         { USB_DEVICE(0x1199, 0x0021) }, /* Sierra Wireless AirCard 597E */
+        { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */
         { USB_DEVICE(0x1199, 0x0120) }, /* Sierra Wireless USB Dongle 595U */
-         /* Sierra Wireless C597 */
+        /* Sierra Wireless C597 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x0023, 0xFF, 0xFF, 0xFF) },
-         /* Sierra Wireless Device */
+        /* Sierra Wireless T598 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x0025, 0xFF, 0xFF, 0xFF) },
-        { USB_DEVICE(0x1199, 0x0026) }, /* Sierra Wireless Device */
-        { USB_DEVICE(0x1199, 0x0027) }, /* Sierra Wireless Device */
-        { USB_DEVICE(0x1199, 0x0028) }, /* Sierra Wireless Device */
+        { USB_DEVICE(0x1199, 0x0026) }, /* Sierra Wireless T11 */
+        { USB_DEVICE(0x1199, 0x0027) }, /* Sierra Wireless AC402 */
+        { USB_DEVICE(0x1199, 0x0028) }, /* Sierra Wireless MC5728 */
+        { USB_DEVICE(0x1199, 0x0029) }, /* Sierra Wireless Device */
 
         { USB_DEVICE(0x1199, 0x6802) }, /* Sierra Wireless MC8755 */
-        { USB_DEVICE(0x1199, 0x6804) }, /* Sierra Wireless MC8755 */
         { USB_DEVICE(0x1199, 0x6803) }, /* Sierra Wireless MC8765 */
+        { USB_DEVICE(0x1199, 0x6804) }, /* Sierra Wireless MC8755 */
+        { USB_DEVICE(0x1199, 0x6805) }, /* Sierra Wireless MC8765 */
+        { USB_DEVICE(0x1199, 0x6808) }, /* Sierra Wireless MC8755 */
+        { USB_DEVICE(0x1199, 0x6809) }, /* Sierra Wireless MC8765 */
         { USB_DEVICE(0x1199, 0x6812) }, /* Sierra Wireless MC8775 & AC 875U */
-        { USB_DEVICE(0x1199, 0x6813) }, /* Sierra Wireless MC8775 (Lenovo) */
+        { USB_DEVICE(0x1199, 0x6813) }, /* Sierra Wireless MC8775 */
         { USB_DEVICE(0x1199, 0x6815) }, /* Sierra Wireless MC8775 */
-        { USB_DEVICE(0x03f0, 0x1e1d) }, /* HP hs2300 a.k.a MC8775 */
+        { USB_DEVICE(0x1199, 0x6816) }, /* Sierra Wireless MC8775 */
         { USB_DEVICE(0x1199, 0x6820) }, /* Sierra Wireless AirCard 875 */
         { USB_DEVICE(0x1199, 0x6821) }, /* Sierra Wireless AirCard 875U */
+        { USB_DEVICE(0x1199, 0x6822) }, /* Sierra Wireless AirCard 875E */
         { USB_DEVICE(0x1199, 0x6832) }, /* Sierra Wireless MC8780 */
         { USB_DEVICE(0x1199, 0x6833) }, /* Sierra Wireless MC8781 */
+        { USB_DEVICE(0x1199, 0x6834) }, /* Sierra Wireless MC8780 */
+        { USB_DEVICE(0x1199, 0x6835) }, /* Sierra Wireless MC8781 */
+        { USB_DEVICE(0x1199, 0x6838) }, /* Sierra Wireless MC8780 */
+        { USB_DEVICE(0x1199, 0x6839) }, /* Sierra Wireless MC8781 */
         { USB_DEVICE(0x1199, 0x683A) }, /* Sierra Wireless MC8785 */
         { USB_DEVICE(0x1199, 0x683B) }, /* Sierra Wireless MC8785 Composite */
         /* Sierra Wireless MC8790, MC8791, MC8792 Composite */
@@ -227,16 +242,13 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x1199, 0x685A) }, /* Sierra Wireless AirCard 885 E */
         /* Sierra Wireless C885 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6880, 0xFF, 0xFF, 0xFF)},
-        /* Sierra Wireless Device */
+        /* Sierra Wireless C888, Air Card 501, USB 303, USB 304 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6890, 0xFF, 0xFF, 0xFF)},
-        /* Sierra Wireless Device */
+        /* Sierra Wireless C22/C33 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6891, 0xFF, 0xFF, 0xFF)},
-        /* Sierra Wireless Device */
+        /* Sierra Wireless HSPA Non-Composite Device */
         { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6892, 0xFF, 0xFF, 0xFF)},
-
-        { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */
-        { USB_DEVICE(0x0F3D, 0x0112) }, /* Airprime/Sierra PC 5220 */
-
+        { USB_DEVICE(0x1199, 0x6893) }, /* Sierra Wireless Device */
         { USB_DEVICE(0x1199, 0x68A3),   /* Sierra Wireless Direct IP modems */
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
         },
@@ -814,7 +826,7 @@ static int sierra_startup(struct usb_serial *serial)
         return 0;
 }
 
-static void sierra_disconnect(struct usb_serial *serial)
+static void sierra_release(struct usb_serial *serial)
 {
         int i;
         struct usb_serial_port *port;
@@ -830,7 +842,6 @@ static void sierra_disconnect(struct usb_serial *serial)
                 if (!portdata)
                         continue;
                 kfree(portdata);
-                usb_set_serial_port_data(port, NULL);
         }
 }
 
@@ -853,7 +864,7 @@ static struct usb_serial_driver sierra_device = {
         .tiocmget          = sierra_tiocmget,
         .tiocmset          = sierra_tiocmset,
         .attach            = sierra_startup,
-        .disconnect        = sierra_disconnect,
+        .release           = sierra_release,
         .read_int_callback = sierra_instat_callback,
 };
 
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 991d8232e376..3bc609fe2242 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -191,7 +191,6 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
-        { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
 };
 
 static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
@@ -728,7 +727,7 @@ static int ti_write_room(struct tty_struct *tty)
         dbg("%s - port %d", __func__, port->number);
 
         if (tport == NULL)
-                return -ENODEV;
+                return 0;
 
         spin_lock_irqsave(&tport->tp_lock, flags);
         room = ti_buf_space_avail(tport->tp_write_buf);
@@ -749,7 +748,7 @@ static int ti_chars_in_buffer(struct tty_struct *tty)
         dbg("%s - port %d", __func__, port->number);
 
         if (tport == NULL)
-                return -ENODEV;
+                return 0;
 
         spin_lock_irqsave(&tport->tp_lock, flags);
         chars = ti_buf_data_avail(tport->tp_write_buf);
@@ -1658,7 +1657,7 @@ static int ti_do_download(struct usb_device *dev, int pipe,
         u8 cs = 0;
         int done;
         struct ti_firmware_header *header;
-        int status;
+        int status = 0;
         int len;
 
         for (pos = sizeof(struct ti_firmware_header); pos < size; pos++)
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index a84216464ca0..bd7581b3a48a 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -21,6 +21,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
@@ -220,7 +221,8 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
         tty->driver_data = port;
         tty_port_tty_set(&port->port, tty);
 
-        if (port->port.count == 1) {
+        /* If the console is attached, the device is already open */
+        if (port->port.count == 1 && !port->console) {
 
                 /* lock this module before we call it
                  * this may fail, which means we must bail out,
diff --git a/drivers/usb/storage/option_ms.c b/drivers/usb/storage/option_ms.c
index d41cc0a970f7..773a5cd38c5a 100644
--- a/drivers/usb/storage/option_ms.c
+++ b/drivers/usb/storage/option_ms.c
@@ -118,6 +118,9 @@ static int option_inquiry(struct us_data *us)
 
         result = memcmp(buffer+8, "Option", 6);
 
+        if (result != 0)
+                result = memcmp(buffer+8, "ZCOPTION", 8);
+
         /* Read the CSW */
         usb_stor_bulk_transfer_buf(us,
                         us->recv_bulk_pipe,
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 8afcf08eba98..3b54b3940178 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1119,12 +1119,13 @@ config FB_CARILLO_RANCH
 
 config FB_INTEL
         tristate "Intel 830M/845G/852GM/855GM/865G/915G/945G/945GM/965G/965GM support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && FB && PCI && X86 && AGP_INTEL
+        depends on EXPERIMENTAL && FB && PCI && X86 && AGP_INTEL && EMBEDDED
         select FB_MODE_HELPERS
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
         select FB_BOOT_VESA_SUPPORT if FB_INTEL = y
+        depends on !DRM_I915
         help
           This driver supports the on-board graphics built in to the Intel
           830M/845G/852GM/855GM/865G/915G/915GM/945G/945GM/965G/965GM chipsets.
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index e641584e212e..887166267443 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -145,6 +145,8 @@ static int pwm_backlight_suspend(struct platform_device *pdev,
         struct backlight_device *bl = platform_get_drvdata(pdev);
         struct pwm_bl_data *pb = dev_get_drvdata(&bl->dev);
 
+        if (pb->notify)
+                pb->notify(0);
         pwm_config(pb->pwm, 0, pb->period);
         pwm_disable(pb->pwm);
         return 0;
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 53ea05645ff8..a85c818be945 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -16,7 +16,6 @@
 #include <linux/compat.h>
 #include <linux/types.h>
 #include <linux/errno.h>
-#include <linux/smp_lock.h>
 #include <linux/kernel.h>
 #include <linux/major.h>
 #include <linux/slab.h>
diff --git a/drivers/video/fbmon.c b/drivers/video/fbmon.c
index 5c1a2c01778f..9ae9cd32bd06 100644
--- a/drivers/video/fbmon.c
+++ b/drivers/video/fbmon.c
@@ -256,8 +256,8 @@ static void fix_edid(unsigned char *edid, int fix)
 
 static int edid_checksum(unsigned char *edid)
 {
-        unsigned char i, csum = 0, all_null = 0;
-        int err = 0, fix = check_edid(edid);
+        unsigned char csum = 0, all_null = 0;
+        int i, err = 0, fix = check_edid(edid);
 
         if (fix)
                 fix_edid(edid, fix);
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index 567fb944bd2a..f8778cde2183 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -1365,11 +1365,6 @@ static int init_fb_chan(struct mx3fb_data *mx3fb, struct idmac_channel *ichan)
         init_completion(&mx3fbi->flip_cmpl);
         disable_irq(ichan->eof_irq);
         dev_dbg(mx3fb->dev, "disabling irq %d\n", ichan->eof_irq);
-        ret = mx3fb_set_par(fbi);
-        if (ret < 0)
-                goto esetpar;
-
-        mx3fb_blank(FB_BLANK_UNBLANK, fbi);
 
         dev_info(dev, "registered, using mode %s\n", fb_mode);
 
diff --git a/drivers/video/omap/omapfb_main.c b/drivers/video/omap/omapfb_main.c
index 4ea99bfc37b4..8862233d57b6 100644
--- a/drivers/video/omap/omapfb_main.c
+++ b/drivers/video/omap/omapfb_main.c
@@ -1254,7 +1254,7 @@ static struct fb_ops omapfb_ops = {
 static ssize_t omapfb_show_caps_num(struct device *dev,
                                     struct device_attribute *attr, char *buf)
 {
-        struct omapfb_device *fbdev = (struct omapfb_device *)dev->driver_data;
+        struct omapfb_device *fbdev = dev_get_drvdata(dev);
         int plane;
         size_t size;
         struct omapfb_caps caps;
@@ -1274,7 +1274,7 @@ static ssize_t omapfb_show_caps_num(struct device *dev,
 static ssize_t omapfb_show_caps_text(struct device *dev,
                                      struct device_attribute *attr, char *buf)
 {
-        struct omapfb_device *fbdev = (struct omapfb_device *)dev->driver_data;
+        struct omapfb_device *fbdev = dev_get_drvdata(dev);
         int i;
         struct omapfb_caps caps;
         int plane;
@@ -1321,7 +1321,7 @@ static DEVICE_ATTR(caps_text, 0444, omapfb_show_caps_text, NULL);
 static ssize_t omapfb_show_panel_name(struct device *dev,
                                       struct device_attribute *attr, char *buf)
 {
-        struct omapfb_device *fbdev = (struct omapfb_device *)dev->driver_data;
+        struct omapfb_device *fbdev = dev_get_drvdata(dev);
 
         return snprintf(buf, PAGE_SIZE, "%s\n", fbdev->panel->name);
 }
@@ -1330,7 +1330,7 @@ static ssize_t omapfb_show_bklight_level(struct device *dev,
                                          struct device_attribute *attr,
                                          char *buf)
 {
-        struct omapfb_device *fbdev = (struct omapfb_device *)dev->driver_data;
+        struct omapfb_device *fbdev = dev_get_drvdata(dev);
         int r;
 
         if (fbdev->panel->get_bklight_level) {
@@ -1345,7 +1345,7 @@ static ssize_t omapfb_store_bklight_level(struct device *dev,
                                           struct device_attribute *attr,
                                           const char *buf, size_t size)
 {
-        struct omapfb_device *fbdev = (struct omapfb_device *)dev->driver_data;
+        struct omapfb_device *fbdev = dev_get_drvdata(dev);
         int r;
 
         if (fbdev->panel->set_bklight_level) {
@@ -1364,7 +1364,7 @@ static ssize_t omapfb_store_bklight_level(struct device *dev,
 static ssize_t omapfb_show_bklight_max(struct device *dev,
                                        struct device_attribute *attr, char *buf)
 {
-        struct omapfb_device *fbdev = (struct omapfb_device *)dev->driver_data;
+        struct omapfb_device *fbdev = dev_get_drvdata(dev);
         int r;
 
         if (fbdev->panel->get_bklight_level) {
@@ -1397,7 +1397,7 @@ static struct attribute_group panel_attr_grp = {
 static ssize_t omapfb_show_ctrl_name(struct device *dev,
                                      struct device_attribute *attr, char *buf)
 {
-        struct omapfb_device *fbdev = (struct omapfb_device *)dev->driver_data;
+        struct omapfb_device *fbdev = dev_get_drvdata(dev);
 
         return snprintf(buf, PAGE_SIZE, "%s\n", fbdev->ctrl->name);
 }
diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c
index 16d4f4c7d52b..924d79462780 100644
--- a/drivers/video/sm501fb.c
+++ b/drivers/video/sm501fb.c
@@ -1540,9 +1540,6 @@ static int sm501fb_init_fb(struct fb_info *fb,
         if (ret)
                 dev_err(info->dev, "check_var() failed on initial setup?\n");
 
-        /* ensure we've activated our new configuration */
-        (fb->fbops->fb_set_par)(fb);
-
         return 0;
 }
 
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index 193c8f0e5cc5..bcec78ffc765 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -669,7 +669,7 @@ static int __init virtio_pci_init(void)
 
         err = pci_register_driver(&virtio_pci_driver);
         if (err)
-                device_unregister(virtio_pci_root);
+                root_device_unregister(virtio_pci_root);
 
         return err;
 }
diff --git a/drivers/watchdog/bcm47xx_wdt.c b/drivers/watchdog/bcm47xx_wdt.c
index 5c7011cda6a6..751c003864ad 100644
--- a/drivers/watchdog/bcm47xx_wdt.c
+++ b/drivers/watchdog/bcm47xx_wdt.c
@@ -161,7 +161,7 @@ static long bcm47xx_wdt_ioctl(struct file *file,
 {
         void __user *argp = (void __user *)arg;
         int __user *p = argp;
-        int new_value, retval = -EINVAL;;
+        int new_value, retval = -EINVAL;
 
         switch (cmd) {
         case WDIOC_GETSUPPORT:
diff --git a/drivers/watchdog/ep93xx_wdt.c b/drivers/watchdog/ep93xx_wdt.c
index e9f950ff86ea..cdd55e0d09f8 100644
--- a/drivers/watchdog/ep93xx_wdt.c
+++ b/drivers/watchdog/ep93xx_wdt.c
@@ -29,6 +29,7 @@
 #include <linux/watchdog.h>
 #include <linux/timer.h>
 #include <linux/uaccess.h>
+#include <linux/io.h>
 #include <mach/hardware.h>
 
 #define WDT_VERSION     "0.3"
diff --git a/drivers/watchdog/sa1100_wdt.c b/drivers/watchdog/sa1100_wdt.c
index ee1caae4d33b..016245419fad 100644
--- a/drivers/watchdog/sa1100_wdt.c
+++ b/drivers/watchdog/sa1100_wdt.c
@@ -38,7 +38,7 @@
 
 static unsigned long oscr_freq;
 static unsigned long sa1100wdt_users;
-static int pre_margin;
+static unsigned int pre_margin;
 static int boot_status;
 
 /*
@@ -84,6 +84,7 @@ static const struct watchdog_info ident = {
         .options        = WDIOF_CARDRESET | WDIOF_SETTIMEOUT
                                 | WDIOF_KEEPALIVEPING,
         .identity       = "SA1100/PXA255 Watchdog",
+        .firmware_version       = 1,
 };
 
 static long sa1100dog_ioctl(struct file *file, unsigned int cmd,
@@ -118,7 +119,7 @@ static long sa1100dog_ioctl(struct file *file, unsigned int cmd,
                 if (ret)
                         break;
 
-                if (time <= 0 || time > 255) {
+                if (time <= 0 || (oscr_freq * (long long)time >= 0xffffffff)) {
                         ret = -EINVAL;
                         break;
                 }
diff --git a/drivers/watchdog/w83627hf_wdt.c b/drivers/watchdog/w83627hf_wdt.c
index 916890abffdd..f201accc4e3d 100644
--- a/drivers/watchdog/w83627hf_wdt.c
+++ b/drivers/watchdog/w83627hf_wdt.c
@@ -89,6 +89,11 @@ static void w83627hf_select_wd_register(void)
                 c = ((inb_p(WDT_EFDR) & 0xf7) | 0x04); /* select WDT0 */
                 outb_p(0x2b, WDT_EFER);
                 outb_p(c, WDT_EFDR);    /* set GPIO3 to WDT0 */
+        } else if (c == 0x88) { /* W83627EHF */
+                outb_p(0x2d, WDT_EFER); /* select GPIO5 */
+                c = inb_p(WDT_EFDR) & ~0x01; /* PIN77 -> WDT0# */
+                outb_p(0x2d, WDT_EFER);
+                outb_p(c, WDT_EFDR); /* set GPIO5 to WDT0 */
         }
 
         outb_p(0x07, WDT_EFER); /* point to logical device number reg */
diff --git a/drivers/watchdog/w83697ug_wdt.c b/drivers/watchdog/w83697ug_wdt.c
index 883b5f79673a..a6c12dec91a1 100644
--- a/drivers/watchdog/w83697ug_wdt.c
+++ b/drivers/watchdog/w83697ug_wdt.c
@@ -149,8 +149,10 @@ static void wdt_ctrl(int timeout)
 {
         spin_lock(&io_lock);
 
-        if (w83697ug_select_wd_register() < 0)
+        if (w83697ug_select_wd_register() < 0) {
+                spin_unlock(&io_lock);
                 return;
+        }
 
         outb_p(0xF4, WDT_EFER);    /* Select CRF4 */
         outb_p(timeout, WDT_EFDR); /* Write Timeout counter to CRF4 */
diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
index 6fcb1e7095cf..92828281a30b 100644
--- a/fs/9p/vfs_addr.c
+++ b/fs/9p/vfs_addr.c
@@ -57,7 +57,7 @@ static int v9fs_vfs_readpage(struct file *filp, struct page *page)
         buffer = kmap(page);
         offset = page_offset(page);
 
-        retval = v9fs_file_readn(filp, buffer, NULL, offset, PAGE_CACHE_SIZE);
+        retval = v9fs_file_readn(filp, buffer, NULL, PAGE_CACHE_SIZE, offset);
         if (retval < 0)
                 goto done;
 
diff --git a/fs/Kconfig b/fs/Kconfig
index a97263be6a91..0e7da7bb5d93 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -186,32 +186,7 @@ source "fs/romfs/Kconfig"
 source "fs/sysv/Kconfig"
 source "fs/ufs/Kconfig"
 source "fs/exofs/Kconfig"
-
-config NILFS2_FS
-        tristate "NILFS2 file system support (EXPERIMENTAL)"
-        depends on BLOCK && EXPERIMENTAL
-        select CRC32
-        help
-          NILFS2 is a log-structured file system (LFS) supporting continuous
-          snapshotting.  In addition to versioning capability of the entire
-          file system, users can even restore files mistakenly overwritten or
-          destroyed just a few seconds ago.  Since this file system can keep
-          consistency like conventional LFS, it achieves quick recovery after
-          system crashes.
-
-          NILFS2 creates a number of checkpoints every few seconds or per
-          synchronous write basis (unless there is no change).  Users can
-          select significant versions among continuously created checkpoints,
-          and can change them into snapshots which will be preserved for long
-          periods until they are changed back to checkpoints.  Each
-          snapshot is mountable as a read-only file system concurrently with
-          its writable mount, and this feature is convenient for online backup.
-
-          Some features including atime, extended attributes, and POSIX ACLs,
-          are not supported yet.
-
-          To compile this file system support as a module, choose M here: the
-          module will be called nilfs2.  If unsure, say N.
+source "fs/nilfs2/Kconfig"
 
 endif # MISC_FILESYSTEMS
 
diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index aad92f0a1048..6910a98bd73c 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -13,6 +13,7 @@
 #include <linux/parser.h>
 #include <linux/mount.h>
 #include <linux/seq_file.h>
+#include <linux/smp_lock.h>
 #include <linux/statfs.h>
 #include "adfs.h"
 #include "dir_f.h"
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 9bd757774c9e..88067f36e5e7 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -564,7 +564,7 @@ static struct dentry *afs_lookup(struct inode *dir, struct dentry *dentry,
 static int afs_d_revalidate(struct dentry *dentry, struct nameidata *nd)
 {
         struct afs_vnode *vnode, *dir;
-        struct afs_fid fid;
+        struct afs_fid uninitialized_var(fid);
         struct dentry *parent;
         struct key *key;
         void *dir_version;
diff --git a/fs/afs/super.c b/fs/afs/super.c
index ad0514d0115f..e1ea1c240b6a 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -18,6 +18,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/parser.h>
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index f3da2eb51f56..00bf8fcb245f 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -19,7 +19,6 @@
 #include <linux/sched.h>
 #include <linux/compat.h>
 #include <linux/syscalls.h>
-#include <linux/smp_lock.h>
 #include <linux/magic.h>
 #include <linux/dcache.h>
 #include <linux/uaccess.h>
diff --git a/fs/bfs/dir.c b/fs/bfs/dir.c
index 54bd07d44e68..1e41aadb1068 100644
--- a/fs/bfs/dir.c
+++ b/fs/bfs/dir.c
@@ -8,7 +8,6 @@
 #include <linux/time.h>
 #include <linux/string.h>
 #include <linux/fs.h>
-#include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
 #include <linux/sched.h>
 #include "bfs.h"
diff --git a/fs/bfs/file.c b/fs/bfs/file.c
index 6a021265f018..88b9a3ff44e4 100644
--- a/fs/bfs/file.c
+++ b/fs/bfs/file.c
@@ -11,7 +11,6 @@
 
 #include <linux/fs.h>
 #include <linux/buffer_head.h>
-#include <linux/smp_lock.h>
 #include "bfs.h"
 
 #undef DEBUG
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index de1e2fd32080..9d8ba4d54a37 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -26,7 +26,6 @@
 #include <linux/time.h>
 #include <linux/init.h>
 #include <linux/string.h>
-#include <linux/smp_lock.h>
 #include <linux/backing-dev.h>
 #include <linux/mpage.h>
 #include <linux/swap.h>
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 7c3cd248d8d6..4b833972273a 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -22,7 +22,6 @@
 #include <linux/time.h>
 #include <linux/init.h>
 #include <linux/string.h>
-#include <linux/smp_lock.h>
 #include <linux/backing-dev.h>
 #include <linux/mpage.h>
 #include <linux/swap.h>
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 7ffa3d34ea19..791eab19e330 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -26,7 +26,6 @@
 #include <linux/time.h>
 #include <linux/init.h>
 #include <linux/string.h>
-#include <linux/smp_lock.h>
 #include <linux/backing-dev.h>
 #include <linux/mpage.h>
 #include <linux/swap.h>
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 9f4db848db10..bd88f25889f7 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -27,7 +27,6 @@
 #include <linux/time.h>
 #include <linux/init.h>
 #include <linux/string.h>
-#include <linux/smp_lock.h>
 #include <linux/backing-dev.h>
 #include <linux/mount.h>
 #include <linux/mpage.h>
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 9f179d4832d5..6d6d06cb6dfc 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -26,7 +26,6 @@
 #include <linux/init.h>
 #include <linux/seq_file.h>
 #include <linux/string.h>
-#include <linux/smp_lock.h>
 #include <linux/backing-dev.h>
 #include <linux/mount.h>
 #include <linux/mpage.h>
diff --git a/fs/char_dev.c b/fs/char_dev.c
index b7c9d5187a75..a173551e19d7 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -13,7 +13,6 @@
 #include <linux/major.h>
 #include <linux/errno.h>
 #include <linux/module.h>
-#include <linux/smp_lock.h>
 #include <linux/seq_file.h>
 
 #include <linux/kobject.h>
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 7f19fefd3d45..42cec2a7c0cf 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -261,6 +261,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,
                                         atomic_set(&tcon->num_reads, 0);
                                         atomic_set(&tcon->num_oplock_brks, 0);
                                         atomic_set(&tcon->num_opens, 0);
+                                        atomic_set(&tcon->num_posixopens, 0);
+                                        atomic_set(&tcon->num_posixmkdirs, 0);
                                         atomic_set(&tcon->num_closes, 0);
                                         atomic_set(&tcon->num_deletes, 0);
                                         atomic_set(&tcon->num_mkdirs, 0);
@@ -347,11 +349,15 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
                                         atomic_read(&tcon->num_locks),
                                         atomic_read(&tcon->num_hardlinks),
                                         atomic_read(&tcon->num_symlinks));
-                                seq_printf(m, "\nOpens: %d Closes: %d"
+                                seq_printf(m, "\nOpens: %d Closes: %d "
                                               "Deletes: %d",
                                         atomic_read(&tcon->num_opens),
                                         atomic_read(&tcon->num_closes),
                                         atomic_read(&tcon->num_deletes));
+                                seq_printf(m, "\nPosix Opens: %d "
+                                              "Posix Mkdirs: %d",
+                                        atomic_read(&tcon->num_posixopens),
+                                        atomic_read(&tcon->num_posixmkdirs));
                                 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
                                         atomic_read(&tcon->num_mkdirs),
                                         atomic_read(&tcon->num_rmdirs));
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 63f6cdfa5638..6084d6379c03 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -260,6 +260,8 @@ struct cifsTconInfo {
         atomic_t num_closes;
         atomic_t num_deletes;
         atomic_t num_mkdirs;
+        atomic_t num_posixopens;
+        atomic_t num_posixmkdirs;
         atomic_t num_rmdirs;
         atomic_t num_renames;
         atomic_t num_t2renames;
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 922f5fe2084c..1866bc2927d4 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1113,7 +1113,10 @@ PsxCreat:
 psx_create_err:
         cifs_buf_release(pSMB);
 
-        cifs_stats_inc(&tcon->num_mkdirs);
+        if (posix_flags & SMB_O_DIRECTORY)
+                cifs_stats_inc(&tcon->num_posixmkdirs);
+        else
+                cifs_stats_inc(&tcon->num_posixopens);
 
         if (rc == -EAGAIN)
                 goto PsxCreat;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e16d7592116a..9bb5c8750736 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2726,6 +2726,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
 
                 /* mostly informational -- no need to fail on error here */
+                kfree(tcon->nativeFileSystem);
                 tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
                                                       bytes_left, is_unicode,
                                                       nls_codepage);
diff --git a/fs/compat.c b/fs/compat.c
index fbadb947727b..94502dab972a 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -32,7 +32,6 @@
 #include <linux/smb_mount.h>
 #include <linux/ncp_mount.h>
 #include <linux/nfs4_mount.h>
-#include <linux/smp_lock.h>
 #include <linux/syscalls.h>
 #include <linux/ctype.h>
 #include <linux/module.h>
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 626c7483b4de..f28f070a60fc 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -19,6 +19,7 @@
 #include <linux/compiler.h>
 #include <linux/sched.h>
 #include <linux/smp.h>
+#include <linux/smp_lock.h>
 #include <linux/ioctl.h>
 #include <linux/if.h>
 #include <linux/if_bridge.h>
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index 205ec95b347e..eb507c453c5f 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -435,7 +435,7 @@ static int search_rsb(struct dlm_ls *ls, char *name, int len, int b,
 static int find_rsb(struct dlm_ls *ls, char *name, int namelen,
                     unsigned int flags, struct dlm_rsb **r_ret)
 {
-        struct dlm_rsb *r, *tmp;
+        struct dlm_rsb *r = NULL, *tmp;
         uint32_t hash, bucket;
         int error = -EINVAL;
 
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index cdb580a9c7a2..618a60f03886 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -902,7 +902,7 @@ static void tcp_connect_to_sock(struct connection *con)
         int result = -EHOSTUNREACH;
         struct sockaddr_storage saddr, src_addr;
         int addr_len;
-        struct socket *sock;
+        struct socket *sock = NULL;
 
         if (con->nodeid == 0) {
                 log_print("attempt to connect sock 0 foiled");
@@ -962,6 +962,8 @@ out_err:
         if (con->sock) {
                 sock_release(con->sock);
                 con->sock = NULL;
+        } else if (sock) {
+                sock_release(sock);
         }
         /*
          * Some errors are fatal and this list might need adjusting. For other
diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
index 894a32d438d5..16f682e26c07 100644
--- a/fs/dlm/plock.c
+++ b/fs/dlm/plock.c
@@ -353,7 +353,7 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
 {
         struct dlm_plock_info info;
         struct plock_op *op;
-        int found = 0;
+        int found = 0, do_callback = 0;
 
         if (count != sizeof(info))
                 return -EINVAL;
@@ -366,21 +366,24 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
 
         spin_lock(&ops_lock);
         list_for_each_entry(op, &recv_list, list) {
-                if (op->info.fsid == info.fsid && op->info.number == info.number &&
+                if (op->info.fsid == info.fsid &&
+                    op->info.number == info.number &&
                     op->info.owner == info.owner) {
+                        struct plock_xop *xop = (struct plock_xop *)op;
                         list_del_init(&op->list);
-                        found = 1;
-                        op->done = 1;
                         memcpy(&op->info, &info, sizeof(info));
+                        if (xop->callback)
+                                do_callback = 1;
+                        else
+                                op->done = 1;
+                        found = 1;
                         break;
                 }
         }
         spin_unlock(&ops_lock);
 
         if (found) {
-                struct plock_xop *xop;
-                xop = (struct plock_xop *)op;
-                if (xop->callback)
+                if (do_callback)
                         dlm_plock_callback(op);
                 else
                         wake_up(&recv_wq);
diff --git a/fs/exofs/common.h b/fs/exofs/common.h
index 24667eedc023..c6718e4817fe 100644
--- a/fs/exofs/common.h
+++ b/fs/exofs/common.h
@@ -2,9 +2,7 @@
  * common.h - Common definitions for both Kernel and user-mode utilities
  *
  * Copyright (C) 2005, 2006
- * Avishay Traeger (avishay@gmail.com) (avishay@il.ibm.com)
- * Copyright (C) 2005, 2006
- * International Business Machines
+ * Avishay Traeger (avishay@gmail.com)
  * Copyright (C) 2008, 2009
  * Boaz Harrosh <bharrosh@panasas.com>
  *
diff --git a/fs/exofs/dir.c b/fs/exofs/dir.c
index 65b0c8c776a1..4cfab1cc75c0 100644
--- a/fs/exofs/dir.c
+++ b/fs/exofs/dir.c
@@ -1,8 +1,6 @@
 /*
  * Copyright (C) 2005, 2006
- * Avishay Traeger (avishay@gmail.com) (avishay@il.ibm.com)
- * Copyright (C) 2005, 2006
- * International Business Machines
+ * Avishay Traeger (avishay@gmail.com)
  * Copyright (C) 2008, 2009
  * Boaz Harrosh <bharrosh@panasas.com>
  *
diff --git a/fs/exofs/exofs.h b/fs/exofs/exofs.h
index 0fd4c7859679..5ec72e020b22 100644
--- a/fs/exofs/exofs.h
+++ b/fs/exofs/exofs.h
@@ -1,8 +1,6 @@
 /*
  * Copyright (C) 2005, 2006
- * Avishay Traeger (avishay@gmail.com) (avishay@il.ibm.com)
- * Copyright (C) 2005, 2006
- * International Business Machines
+ * Avishay Traeger (avishay@gmail.com)
  * Copyright (C) 2008, 2009
  * Boaz Harrosh <bharrosh@panasas.com>
  *
@@ -156,6 +154,9 @@ ino_t exofs_parent_ino(struct dentry *child);
 int exofs_set_link(struct inode *, struct exofs_dir_entry *, struct page *,
                     struct inode *);
 
+/* super.c               */
+int exofs_sync_fs(struct super_block *sb, int wait);
+
 /*********************
  * operation vectors *
  *********************/
diff --git a/fs/exofs/file.c b/fs/exofs/file.c
index 6ed7fe484752..839b9dc1e70f 100644
--- a/fs/exofs/file.c
+++ b/fs/exofs/file.c
@@ -1,8 +1,6 @@
 /*
  * Copyright (C) 2005, 2006
- * Avishay Traeger (avishay@gmail.com) (avishay@il.ibm.com)
- * Copyright (C) 2005, 2006
- * International Business Machines
+ * Avishay Traeger (avishay@gmail.com)
  * Copyright (C) 2008, 2009
  * Boaz Harrosh <bharrosh@panasas.com>
  *
@@ -47,16 +45,23 @@ static int exofs_file_fsync(struct file *filp, struct dentry *dentry,
 {
         int ret;
         struct address_space *mapping = filp->f_mapping;
+        struct inode *inode = dentry->d_inode;
+        struct super_block *sb;
 
         ret = filemap_write_and_wait(mapping);
         if (ret)
                 return ret;
 
-        /*Note: file_fsync below also calles sync_blockdev, which is a no-op
-         *      for exofs, but other then that it does sync_inode and
-         *      sync_superblock which is what we need here.
-         */
-        return file_fsync(filp, dentry, datasync);
+        /* sync the inode attributes */
+        ret = write_inode_now(inode, 1);
+
+        /* This is a good place to write the sb */
+        /* TODO: Sechedule an sb-sync on create */
+        sb = inode->i_sb;
+        if (sb->s_dirt)
+                exofs_sync_fs(sb, 1);
+
+        return ret;
 }
 
 static int exofs_flush(struct file *file, fl_owner_t id)
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 77d0a295eb1c..6c10f7476699 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -1,8 +1,6 @@
 /*
  * Copyright (C) 2005, 2006
- * Avishay Traeger (avishay@gmail.com) (avishay@il.ibm.com)
- * Copyright (C) 2005, 2006
- * International Business Machines
+ * Avishay Traeger (avishay@gmail.com)
  * Copyright (C) 2008, 2009
  * Boaz Harrosh <bharrosh@panasas.com>
  *
@@ -295,6 +293,9 @@ static int read_exec(struct page_collect *pcol, bool is_sync)
 err:
         if (!is_sync)
                 _unlock_pcol_pages(pcol, ret, READ);
+        else /* Pages unlocked by caller in sync mode only free bio */
+                pcol_free(pcol);
+
         kfree(pcol_copy);
         if (or)
                 osd_end_request(or);
diff --git a/fs/exofs/namei.c b/fs/exofs/namei.c
index 77fdd765e76d..b7dd0c236863 100644
--- a/fs/exofs/namei.c
+++ b/fs/exofs/namei.c
@@ -1,8 +1,6 @@
 /*
  * Copyright (C) 2005, 2006
- * Avishay Traeger (avishay@gmail.com) (avishay@il.ibm.com)
- * Copyright (C) 2005, 2006
- * International Business Machines
+ * Avishay Traeger (avishay@gmail.com)
  * Copyright (C) 2008, 2009
  * Boaz Harrosh <bharrosh@panasas.com>
  *
diff --git a/fs/exofs/osd.c b/fs/exofs/osd.c
index b3d2ccb87aaa..4372542df284 100644
--- a/fs/exofs/osd.c
+++ b/fs/exofs/osd.c
@@ -1,8 +1,6 @@
 /*
  * Copyright (C) 2005, 2006
- * Avishay Traeger (avishay@gmail.com) (avishay@il.ibm.com)
- * Copyright (C) 2005, 2006
- * International Business Machines
+ * Avishay Traeger (avishay@gmail.com)
  * Copyright (C) 2008, 2009
  * Boaz Harrosh <bharrosh@panasas.com>
  *
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index 8216c5b77b53..5ab10c3bbebe 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -1,8 +1,6 @@
 /*
  * Copyright (C) 2005, 2006
- * Avishay Traeger (avishay@gmail.com) (avishay@il.ibm.com)
- * Copyright (C) 2005, 2006
- * International Business Machines
+ * Avishay Traeger (avishay@gmail.com)
  * Copyright (C) 2008, 2009
  * Boaz Harrosh <bharrosh@panasas.com>
  *
@@ -33,6 +31,7 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/parser.h>
 #include <linux/vfs.h>
@@ -200,7 +199,7 @@ static const struct export_operations exofs_export_ops;
 /*
  * Write the superblock to the OSD
  */
-static int exofs_sync_fs(struct super_block *sb, int wait)
+int exofs_sync_fs(struct super_block *sb, int wait)
 {
         struct exofs_sb_info *sbi;
         struct exofs_fscb *fscb;
diff --git a/fs/exofs/symlink.c b/fs/exofs/symlink.c
index 36e2d7bc7f7b..4dd687c3e747 100644
--- a/fs/exofs/symlink.c
+++ b/fs/exofs/symlink.c
@@ -1,8 +1,6 @@
 /*
  * Copyright (C) 2005, 2006
- * Avishay Traeger (avishay@gmail.com) (avishay@il.ibm.com)
- * Copyright (C) 2005, 2006
- * International Business Machines
+ * Avishay Traeger (avishay@gmail.com)
  * Copyright (C) 2008, 2009
  * Boaz Harrosh <bharrosh@panasas.com>
  *
diff --git a/fs/ext2/ioctl.c b/fs/ext2/ioctl.c
index 7cb4badef927..e7431309bdca 100644
--- a/fs/ext2/ioctl.c
+++ b/fs/ext2/ioctl.c
@@ -13,7 +13,6 @@
 #include <linux/sched.h>
 #include <linux/compat.h>
 #include <linux/mount.h>
-#include <linux/smp_lock.h>
 #include <asm/current.h>
 #include <asm/uaccess.h>
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 0ddf7e55abe1..9714db393efe 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -93,20 +93,20 @@ typedef unsigned int ext4_group_t;
 struct ext4_allocation_request {
         /* target inode for block we're allocating */
         struct inode *inode;
+        /* how many blocks we want to allocate */
+        unsigned int len;
         /* logical block in target inode */
         ext4_lblk_t logical;
-        /* phys. target (a hint) */
-        ext4_fsblk_t goal;
         /* the closest logical allocated block to the left */
         ext4_lblk_t lleft;
-        /* phys. block for ^^^ */
-        ext4_fsblk_t pleft;
         /* the closest logical allocated block to the right */
         ext4_lblk_t lright;
-        /* phys. block for ^^^ */
+        /* phys. target (a hint) */
+        ext4_fsblk_t goal;
+        /* phys. block for the closest logical allocated block to the left */
+        ext4_fsblk_t pleft;
+        /* phys. block for the closest logical allocated block to the right */
         ext4_fsblk_t pright;
-        /* how many blocks we want to allocate */
-        unsigned int len;
         /* flags. see above EXT4_MB_HINT_* */
         unsigned int flags;
 };
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index ad13a84644e1..eb27fd0f2ee8 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -43,6 +43,8 @@ int __ext4_journal_forget(const char *where, handle_t *handle,
                         ext4_journal_abort_handle(where, __func__, bh,
                                                   handle, err);
         }
+        else
+                brelse(bh);
         return err;
 }
 
@@ -57,6 +59,8 @@ int __ext4_journal_revoke(const char *where, handle_t *handle,
                         ext4_journal_abort_handle(where, __func__, bh,
                                                   handle, err);
         }
+        else
+                brelse(bh);
         return err;
 }
 
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index be2f426f6805..139fb8cb87e4 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -131,9 +131,11 @@ int __ext4_journal_get_undo_access(const char *where, handle_t *handle,
 int __ext4_journal_get_write_access(const char *where, handle_t *handle,
                                 struct buffer_head *bh);
 
+/* When called with an invalid handle, this will still do a put on the BH */
 int __ext4_journal_forget(const char *where, handle_t *handle,
                                 struct buffer_head *bh);
 
+/* When called with an invalid handle, this will still do a put on the BH */
 int __ext4_journal_revoke(const char *where, handle_t *handle,
                                 ext4_fsblk_t blocknr, struct buffer_head *bh);
 
@@ -281,10 +283,10 @@ static inline int ext4_should_order_data(struct inode *inode)
 
 static inline int ext4_should_writeback_data(struct inode *inode)
 {
-        if (EXT4_JOURNAL(inode) == NULL)
-                return 0;
         if (!S_ISREG(inode->i_mode))
                 return 0;
+        if (EXT4_JOURNAL(inode) == NULL)
+                return 1;
         if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
                 return 0;
         if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 50322a09bd01..73ebfb44ad75 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -1977,6 +1977,7 @@ int ext4_ext_calc_credits_for_single_extent(struct inode *inode, int nrblocks,
                          */
                         /* 1 bitmap, 1 block group descriptor */
                         ret = 2 + EXT4_META_TRANS_BLOCKS(inode->i_sb);
+                        return ret;
                 }
         }
 
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 2f645732e3b7..29e6dc7299b8 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -833,7 +833,7 @@ struct inode *ext4_new_inode(handle_t *handle, struct inode *dir, int mode,
         if (!goal)
                 goal = sbi->s_inode_goal;
 
-        if (goal && goal < le32_to_cpu(sbi->s_es->s_inodes_count)) {
+        if (goal && goal <= le32_to_cpu(sbi->s_es->s_inodes_count)) {
                 group = (goal - 1) / EXT4_INODES_PER_GROUP(sb);
                 ino = (goal - 1) % EXT4_INODES_PER_GROUP(sb);
                 ret2 = 0;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 60a26f3a6f8b..f9c642b22efa 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -78,16 +78,14 @@ static int ext4_inode_is_fast_symlink(struct inode *inode)
  * but there may still be a record of it in the journal, and that record
  * still needs to be revoked.
  *
- * If the handle isn't valid we're not journaling so there's nothing to do.
+ * If the handle isn't valid we're not journaling, but we still need to
+ * call into ext4_journal_revoke() to put the buffer head.
  */
 int ext4_forget(handle_t *handle, int is_metadata, struct inode *inode,
                 struct buffer_head *bh, ext4_fsblk_t blocknr)
 {
         int err;
 
-        if (!ext4_handle_valid(handle))
-                return 0;
-
         might_sleep();
 
         BUFFER_TRACE(bh, "enter");
@@ -1513,14 +1511,14 @@ retry:
                  * Add inode to orphan list in case we crash before
                  * truncate finishes
                  */
-                if (pos + len > inode->i_size)
+                if (pos + len > inode->i_size && ext4_can_truncate(inode))
                         ext4_orphan_add(handle, inode);
 
                 ext4_journal_stop(handle);
                 if (pos + len > inode->i_size) {
-                        vmtruncate(inode, inode->i_size);
+                        ext4_truncate(inode);
                         /*
-                         * If vmtruncate failed early the inode might
+                         * If truncate failed early the inode might
                          * still be on the orphan list; we need to
                          * make sure the inode is removed from the
                          * orphan list in that case.
@@ -1614,7 +1612,7 @@ static int ext4_ordered_write_end(struct file *file,
                 ret2 = ext4_generic_write_end(file, mapping, pos, len, copied,
                                                         page, fsdata);
                 copied = ret2;
-                if (pos + len > inode->i_size)
+                if (pos + len > inode->i_size && ext4_can_truncate(inode))
                         /* if we have allocated more blocks and copied
                          * less. We will have blocks allocated outside
                          * inode->i_size. So truncate them
@@ -1628,9 +1626,9 @@ static int ext4_ordered_write_end(struct file *file,
                 ret = ret2;
 
         if (pos + len > inode->i_size) {
-                vmtruncate(inode, inode->i_size);
+                ext4_truncate(inode);
                 /*
-                 * If vmtruncate failed early the inode might still be
+                 * If truncate failed early the inode might still be
                  * on the orphan list; we need to make sure the inode
                  * is removed from the orphan list in that case.
                  */
@@ -1655,7 +1653,7 @@ static int ext4_writeback_write_end(struct file *file,
         ret2 = ext4_generic_write_end(file, mapping, pos, len, copied,
                                                         page, fsdata);
         copied = ret2;
-        if (pos + len > inode->i_size)
+        if (pos + len > inode->i_size && ext4_can_truncate(inode))
                 /* if we have allocated more blocks and copied
                  * less. We will have blocks allocated outside
                  * inode->i_size. So truncate them
@@ -1670,9 +1668,9 @@ static int ext4_writeback_write_end(struct file *file,
                 ret = ret2;
 
         if (pos + len > inode->i_size) {
-                vmtruncate(inode, inode->i_size);
+                ext4_truncate(inode);
                 /*
-                 * If vmtruncate failed early the inode might still be
+                 * If truncate failed early the inode might still be
                  * on the orphan list; we need to make sure the inode
                  * is removed from the orphan list in that case.
                  */
@@ -1722,7 +1720,7 @@ static int ext4_journalled_write_end(struct file *file,
 
         unlock_page(page);
         page_cache_release(page);
-        if (pos + len > inode->i_size)
+        if (pos + len > inode->i_size && ext4_can_truncate(inode))
                 /* if we have allocated more blocks and copied
                  * less. We will have blocks allocated outside
                  * inode->i_size. So truncate them
@@ -1733,9 +1731,9 @@ static int ext4_journalled_write_end(struct file *file,
         if (!ret)
                 ret = ret2;
         if (pos + len > inode->i_size) {
-                vmtruncate(inode, inode->i_size);
+                ext4_truncate(inode);
                 /*
-                 * If vmtruncate failed early the inode might still be
+                 * If truncate failed early the inode might still be
                  * on the orphan list; we need to make sure the inode
                  * is removed from the orphan list in that case.
                  */
@@ -2305,15 +2303,9 @@ flush_it:
         return;
 }
 
-static int ext4_bh_unmapped_or_delay(handle_t *handle, struct buffer_head *bh)
+static int ext4_bh_delay_or_unwritten(handle_t *handle, struct buffer_head *bh)
 {
-        /*
-         * unmapped buffer is possible for holes.
-         * delay buffer is possible with delayed allocation.
-         * We also need to consider unwritten buffer as unmapped.
-         */
-        return (!buffer_mapped(bh) || buffer_delay(bh) ||
-                                buffer_unwritten(bh)) && buffer_dirty(bh);
+        return (buffer_delay(bh) || buffer_unwritten(bh)) && buffer_dirty(bh);
 }
 
 /*
@@ -2398,9 +2390,9 @@ static int __mpage_da_writepage(struct page *page,
                          * We need to try to allocate
                          * unmapped blocks in the same page.
                          * Otherwise we won't make progress
-                         * with the page in ext4_da_writepage
+                         * with the page in ext4_writepage
                          */
-                        if (ext4_bh_unmapped_or_delay(NULL, bh)) {
+                        if (ext4_bh_delay_or_unwritten(NULL, bh)) {
                                 mpage_add_bh_to_extent(mpd, logical,
                                                        bh->b_size,
                                                        bh->b_state);
@@ -2517,7 +2509,6 @@ static int noalloc_get_block_write(struct inode *inode, sector_t iblock,
          * so call get_block_wrap with create = 0
          */
         ret = ext4_get_blocks(NULL, inode, iblock, max_blocks, bh_result, 0);
-        BUG_ON(create && ret == 0);
         if (ret > 0) {
                 bh_result->b_size = (ret << inode->i_blkbits);
                 ret = 0;
@@ -2525,15 +2516,102 @@ static int noalloc_get_block_write(struct inode *inode, sector_t iblock,
         return ret;
 }
 
+static int bget_one(handle_t *handle, struct buffer_head *bh)
+{
+        get_bh(bh);
+        return 0;
+}
+
+static int bput_one(handle_t *handle, struct buffer_head *bh)
+{
+        put_bh(bh);
+        return 0;
+}
+
+static int __ext4_journalled_writepage(struct page *page,
+                                       struct writeback_control *wbc,
+                                       unsigned int len)
+{
+        struct address_space *mapping = page->mapping;
+        struct inode *inode = mapping->host;
+        struct buffer_head *page_bufs;
+        handle_t *handle = NULL;
+        int ret = 0;
+        int err;
+
+        page_bufs = page_buffers(page);
+        BUG_ON(!page_bufs);
+        walk_page_buffers(handle, page_bufs, 0, len, NULL, bget_one);
+        /* As soon as we unlock the page, it can go away, but we have
+         * references to buffers so we are safe */
+        unlock_page(page);
+
+        handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode));
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                goto out;
+        }
+
+        ret = walk_page_buffers(handle, page_bufs, 0, len, NULL,
+                                do_journal_get_write_access);
+
+        err = walk_page_buffers(handle, page_bufs, 0, len, NULL,
+                                write_end_fn);
+        if (ret == 0)
+                ret = err;
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+
+        walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one);
+        EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
+out:
+        return ret;
+}
+
 /*
+ * Note that we don't need to start a transaction unless we're journaling data
+ * because we should have holes filled from ext4_page_mkwrite(). We even don't
+ * need to file the inode to the transaction's list in ordered mode because if
+ * we are writing back data added by write(), the inode is already there and if
+ * we are writing back data modified via mmap(), noone guarantees in which
+ * transaction the data will hit the disk. In case we are journaling data, we
+ * cannot start transaction directly because transaction start ranks above page
+ * lock so we have to do some magic.
+ *
  * This function can get called via...
  *   - ext4_da_writepages after taking page lock (have journal handle)
  *   - journal_submit_inode_data_buffers (no journal handle)
  *   - shrink_page_list via pdflush (no journal handle)
  *   - grab_page_cache when doing write_begin (have journal handle)
+ *
+ * We don't do any block allocation in this function. If we have page with
+ * multiple blocks we need to write those buffer_heads that are mapped. This
+ * is important for mmaped based write. So if we do with blocksize 1K
+ * truncate(f, 1024);
+ * a = mmap(f, 0, 4096);
+ * a[0] = 'a';
+ * truncate(f, 4096);
+ * we have in the page first buffer_head mapped via page_mkwrite call back
+ * but other bufer_heads would be unmapped but dirty(dirty done via the
+ * do_wp_page). So writepage should write the first block. If we modify
+ * the mmap area beyond 1024 we will again get a page_fault and the
+ * page_mkwrite callback will do the block allocation and mark the
+ * buffer_heads mapped.
+ *
+ * We redirty the page if we have any buffer_heads that is either delay or
+ * unwritten in the page.
+ *
+ * We can get recursively called as show below.
+ *
+ *      ext4_writepage() -> kmalloc() -> __alloc_pages() -> page_launder() ->
+ *              ext4_writepage()
+ *
+ * But since we don't do any block allocation we should not deadlock.
+ * Page also have the dirty flag cleared so we don't get recurive page_lock.
  */
-static int ext4_da_writepage(struct page *page,
-                                struct writeback_control *wbc)
+static int ext4_writepage(struct page *page,
+                          struct writeback_control *wbc)
 {
         int ret = 0;
         loff_t size;
@@ -2541,7 +2619,7 @@ static int ext4_da_writepage(struct page *page,
         struct buffer_head *page_bufs;
         struct inode *inode = page->mapping->host;
 
-        trace_ext4_da_writepage(inode, page);
+        trace_ext4_writepage(inode, page);
         size = i_size_read(inode);
         if (page->index == size >> PAGE_CACHE_SHIFT)
                 len = size & ~PAGE_CACHE_MASK;
@@ -2551,7 +2629,7 @@ static int ext4_da_writepage(struct page *page,
         if (page_has_buffers(page)) {
                 page_bufs = page_buffers(page);
                 if (walk_page_buffers(NULL, page_bufs, 0, len, NULL,
-                                        ext4_bh_unmapped_or_delay)) {
+                                        ext4_bh_delay_or_unwritten)) {
                         /*
                          * We don't want to do  block allocation
                          * So redirty the page and return
@@ -2578,13 +2656,13 @@ static int ext4_da_writepage(struct page *page,
                  * all are mapped and non delay. We don't want to
                  * do block allocation here.
                  */
-                ret = block_prepare_write(page, 0, PAGE_CACHE_SIZE,
+                ret = block_prepare_write(page, 0, len,
                                           noalloc_get_block_write);
                 if (!ret) {
                         page_bufs = page_buffers(page);
                         /* check whether all are mapped and non delay */
                         if (walk_page_buffers(NULL, page_bufs, 0, len, NULL,
-                                                ext4_bh_unmapped_or_delay)) {
+                                                ext4_bh_delay_or_unwritten)) {
                                 redirty_page_for_writepage(wbc, page);
                                 unlock_page(page);
                                 return 0;
@@ -2600,7 +2678,16 @@ static int ext4_da_writepage(struct page *page,
                         return 0;
                 }
                 /* now mark the buffer_heads as dirty and uptodate */
-                block_commit_write(page, 0, PAGE_CACHE_SIZE);
+                block_commit_write(page, 0, len);
+        }
+
+        if (PageChecked(page) && ext4_should_journal_data(inode)) {
+                /*
+                 * It's mmapped pagecache.  Add buffers and journal it.  There
+                 * doesn't seem much point in redirtying the page here.
+                 */
+                ClearPageChecked(page);
+                return __ext4_journalled_writepage(page, wbc, len);
         }
 
         if (test_opt(inode->i_sb, NOBH) && ext4_should_writeback_data(inode))
@@ -2907,7 +2994,7 @@ retry:
                  * i_size_read because we hold i_mutex.
                  */
                 if (pos + len > inode->i_size)
-                        vmtruncate(inode, inode->i_size);
+                        ext4_truncate(inode);
         }
 
         if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
@@ -3130,222 +3217,6 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
         return generic_block_bmap(mapping, block, ext4_get_block);
 }
 
-static int bget_one(handle_t *handle, struct buffer_head *bh)
-{
-        get_bh(bh);
-        return 0;
-}
-
-static int bput_one(handle_t *handle, struct buffer_head *bh)
-{
-        put_bh(bh);
-        return 0;
-}
-
-/*
- * Note that we don't need to start a transaction unless we're journaling data
- * because we should have holes filled from ext4_page_mkwrite(). We even don't
- * need to file the inode to the transaction's list in ordered mode because if
- * we are writing back data added by write(), the inode is already there and if
- * we are writing back data modified via mmap(), noone guarantees in which
- * transaction the data will hit the disk. In case we are journaling data, we
- * cannot start transaction directly because transaction start ranks above page
- * lock so we have to do some magic.
- *
- * In all journaling modes block_write_full_page() will start the I/O.
- *
- * Problem:
- *
- *      ext4_writepage() -> kmalloc() -> __alloc_pages() -> page_launder() ->
- *              ext4_writepage()
- *
- * Similar for:
- *
- *      ext4_file_write() -> generic_file_write() -> __alloc_pages() -> ...
- *
- * Same applies to ext4_get_block().  We will deadlock on various things like
- * lock_journal and i_data_sem
- *
- * Setting PF_MEMALLOC here doesn't work - too many internal memory
- * allocations fail.
- *
- * 16May01: If we're reentered then journal_current_handle() will be
- *          non-zero. We simply *return*.
- *
- * 1 July 2001: @@@ FIXME:
- *   In journalled data mode, a data buffer may be metadata against the
- *   current transaction.  But the same file is part of a shared mapping
- *   and someone does a writepage() on it.
- *
- *   We will move the buffer onto the async_data list, but *after* it has
- *   been dirtied. So there's a small window where we have dirty data on
- *   BJ_Metadata.
- *
- *   Note that this only applies to the last partial page in the file.  The
- *   bit which block_write_full_page() uses prepare/commit for.  (That's
- *   broken code anyway: it's wrong for msync()).
- *
- *   It's a rare case: affects the final partial page, for journalled data
- *   where the file is subject to bith write() and writepage() in the same
- *   transction.  To fix it we'll need a custom block_write_full_page().
- *   We'll probably need that anyway for journalling writepage() output.
- *
- * We don't honour synchronous mounts for writepage().  That would be
- * disastrous.  Any write() or metadata operation will sync the fs for
- * us.
- *
- */
-static int __ext4_normal_writepage(struct page *page,
-                                   struct writeback_control *wbc)
-{
-        struct inode *inode = page->mapping->host;
-
-        if (test_opt(inode->i_sb, NOBH))
-                return nobh_writepage(page, noalloc_get_block_write, wbc);
-        else
-                return block_write_full_page(page, noalloc_get_block_write,
-                                             wbc);
-}
-
-static int ext4_normal_writepage(struct page *page,
-                                 struct writeback_control *wbc)
-{
-        struct inode *inode = page->mapping->host;
-        loff_t size = i_size_read(inode);
-        loff_t len;
-
-        trace_ext4_normal_writepage(inode, page);
-        J_ASSERT(PageLocked(page));
-        if (page->index == size >> PAGE_CACHE_SHIFT)
-                len = size & ~PAGE_CACHE_MASK;
-        else
-                len = PAGE_CACHE_SIZE;
-
-        if (page_has_buffers(page)) {
-                /* if page has buffers it should all be mapped
-                 * and allocated. If there are not buffers attached
-                 * to the page we know the page is dirty but it lost
-                 * buffers. That means that at some moment in time
-                 * after write_begin() / write_end() has been called
-                 * all buffers have been clean and thus they must have been
-                 * written at least once. So they are all mapped and we can
-                 * happily proceed with mapping them and writing the page.
-                 */
-                BUG_ON(walk_page_buffers(NULL, page_buffers(page), 0, len, NULL,
-                                        ext4_bh_unmapped_or_delay));
-        }
-
-        if (!ext4_journal_current_handle())
-                return __ext4_normal_writepage(page, wbc);
-
-        redirty_page_for_writepage(wbc, page);
-        unlock_page(page);
-        return 0;
-}
-
-static int __ext4_journalled_writepage(struct page *page,
-                                       struct writeback_control *wbc)
-{
-        struct address_space *mapping = page->mapping;
-        struct inode *inode = mapping->host;
-        struct buffer_head *page_bufs;
-        handle_t *handle = NULL;
-        int ret = 0;
-        int err;
-
-        ret = block_prepare_write(page, 0, PAGE_CACHE_SIZE,
-                                  noalloc_get_block_write);
-        if (ret != 0)
-                goto out_unlock;
-
-        page_bufs = page_buffers(page);
-        walk_page_buffers(handle, page_bufs, 0, PAGE_CACHE_SIZE, NULL,
-                                                                bget_one);
-        /* As soon as we unlock the page, it can go away, but we have
-         * references to buffers so we are safe */
-        unlock_page(page);
-
-        handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode));
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
-                goto out;
-        }
-
-        ret = walk_page_buffers(handle, page_bufs, 0,
-                        PAGE_CACHE_SIZE, NULL, do_journal_get_write_access);
-
-        err = walk_page_buffers(handle, page_bufs, 0,
-                                PAGE_CACHE_SIZE, NULL, write_end_fn);
-        if (ret == 0)
-                ret = err;
-        err = ext4_journal_stop(handle);
-        if (!ret)
-                ret = err;
-
-        walk_page_buffers(handle, page_bufs, 0,
-                                PAGE_CACHE_SIZE, NULL, bput_one);
-        EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
-        goto out;
-
-out_unlock:
-        unlock_page(page);
-out:
-        return ret;
-}
-
-static int ext4_journalled_writepage(struct page *page,
-                                     struct writeback_control *wbc)
-{
-        struct inode *inode = page->mapping->host;
-        loff_t size = i_size_read(inode);
-        loff_t len;
-
-        trace_ext4_journalled_writepage(inode, page);
-        J_ASSERT(PageLocked(page));
-        if (page->index == size >> PAGE_CACHE_SHIFT)
-                len = size & ~PAGE_CACHE_MASK;
-        else
-                len = PAGE_CACHE_SIZE;
-
-        if (page_has_buffers(page)) {
-                /* if page has buffers it should all be mapped
-                 * and allocated. If there are not buffers attached
-                 * to the page we know the page is dirty but it lost
-                 * buffers. That means that at some moment in time
-                 * after write_begin() / write_end() has been called
-                 * all buffers have been clean and thus they must have been
-                 * written at least once. So they are all mapped and we can
-                 * happily proceed with mapping them and writing the page.
-                 */
-                BUG_ON(walk_page_buffers(NULL, page_buffers(page), 0, len, NULL,
-                                        ext4_bh_unmapped_or_delay));
-        }
-
-        if (ext4_journal_current_handle())
-                goto no_write;
-
-        if (PageChecked(page)) {
-                /*
-                 * It's mmapped pagecache.  Add buffers and journal it.  There
-                 * doesn't seem much point in redirtying the page here.
-                 */
-                ClearPageChecked(page);
-                return __ext4_journalled_writepage(page, wbc);
-        } else {
-                /*
-                 * It may be a page full of checkpoint-mode buffers.  We don't
-                 * really know unless we go poke around in the buffer_heads.
-                 * But block_write_full_page will do the right thing.
-                 */
-                return block_write_full_page(page, noalloc_get_block_write,
-                                             wbc);
-        }
-no_write:
-        redirty_page_for_writepage(wbc, page);
-        unlock_page(page);
-        return 0;
-}
-
 static int ext4_readpage(struct file *file, struct page *page)
 {
         return mpage_readpage(page, ext4_get_block);
@@ -3492,7 +3363,7 @@ static int ext4_journalled_set_page_dirty(struct page *page)
 static const struct address_space_operations ext4_ordered_aops = {
         .readpage               = ext4_readpage,
         .readpages              = ext4_readpages,
-        .writepage              = ext4_normal_writepage,
+        .writepage              = ext4_writepage,
         .sync_page              = block_sync_page,
         .write_begin            = ext4_write_begin,
         .write_end              = ext4_ordered_write_end,
@@ -3507,7 +3378,7 @@ static const struct address_space_operations ext4_ordered_aops = {
 static const struct address_space_operations ext4_writeback_aops = {
         .readpage               = ext4_readpage,
         .readpages              = ext4_readpages,
-        .writepage              = ext4_normal_writepage,
+        .writepage              = ext4_writepage,
         .sync_page              = block_sync_page,
         .write_begin            = ext4_write_begin,
         .write_end              = ext4_writeback_write_end,
@@ -3522,7 +3393,7 @@ static const struct address_space_operations ext4_writeback_aops = {
 static const struct address_space_operations ext4_journalled_aops = {
         .readpage               = ext4_readpage,
         .readpages              = ext4_readpages,
-        .writepage              = ext4_journalled_writepage,
+        .writepage              = ext4_writepage,
         .sync_page              = block_sync_page,
         .write_begin            = ext4_write_begin,
         .write_end              = ext4_journalled_write_end,
@@ -3536,7 +3407,7 @@ static const struct address_space_operations ext4_journalled_aops = {
 static const struct address_space_operations ext4_da_aops = {
         .readpage               = ext4_readpage,
         .readpages              = ext4_readpages,
-        .writepage              = ext4_da_writepage,
+        .writepage              = ext4_writepage,
         .writepages             = ext4_da_writepages,
         .sync_page              = block_sync_page,
         .write_begin            = ext4_da_write_begin,
@@ -3583,7 +3454,8 @@ int ext4_block_truncate_page(handle_t *handle,
         struct page *page;
         int err = 0;
 
-        page = grab_cache_page(mapping, from >> PAGE_CACHE_SHIFT);
+        page = find_or_create_page(mapping, from >> PAGE_CACHE_SHIFT,
+                                   mapping_gfp_mask(mapping) & ~__GFP_FS);
         if (!page)
                 return -EINVAL;
 
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index bb415408fdb6..7050a9cd04a4 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -12,7 +12,6 @@
 #include <linux/capability.h>
 #include <linux/time.h>
 #include <linux/compat.h>
-#include <linux/smp_lock.h>
 #include <linux/mount.h>
 #include <linux/file.h>
 #include <asm/uaccess.h>
@@ -192,7 +191,7 @@ setversion_out:
         case EXT4_IOC_GROUP_EXTEND: {
                 ext4_fsblk_t n_blocks_count;
                 struct super_block *sb = inode->i_sb;
-                int err, err2;
+                int err, err2=0;
 
                 if (!capable(CAP_SYS_RESOURCE))
                         return -EPERM;
@@ -205,9 +204,11 @@ setversion_out:
                         return err;
 
                 err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
-                jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
-                err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal);
-                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+                if (EXT4_SB(sb)->s_journal) {
+                        jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+                        err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal);
+                        jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+                }
                 if (err == 0)
                         err = err2;
                 mnt_drop_write(filp->f_path.mnt);
@@ -252,7 +253,7 @@ setversion_out:
         case EXT4_IOC_GROUP_ADD: {
                 struct ext4_new_group_data input;
                 struct super_block *sb = inode->i_sb;
-                int err, err2;
+                int err, err2=0;
 
                 if (!capable(CAP_SYS_RESOURCE))
                         return -EPERM;
@@ -266,9 +267,11 @@ setversion_out:
                         return err;
 
                 err = ext4_group_add(sb, &input);
-                jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
-                err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal);
-                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+                if (EXT4_SB(sb)->s_journal) {
+                        jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+                        err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal);
+                        jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+                }
                 if (err == 0)
                         err = err2;
                 mnt_drop_write(filp->f_path.mnt);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 519a0a686d94..cd258463e2a9 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -657,7 +657,8 @@ static void ext4_mb_mark_free_simple(struct super_block *sb,
         }
 }
 
-static void ext4_mb_generate_buddy(struct super_block *sb,
+static noinline_for_stack
+void ext4_mb_generate_buddy(struct super_block *sb,
                                 void *buddy, void *bitmap, ext4_group_t group)
 {
         struct ext4_group_info *grp = ext4_get_group_info(sb, group);
@@ -1480,7 +1481,8 @@ static void ext4_mb_measure_extent(struct ext4_allocation_context *ac,
         ext4_mb_check_limits(ac, e4b, 0);
 }
 
-static int ext4_mb_try_best_found(struct ext4_allocation_context *ac,
+static noinline_for_stack
+int ext4_mb_try_best_found(struct ext4_allocation_context *ac,
                                         struct ext4_buddy *e4b)
 {
         struct ext4_free_extent ex = ac->ac_b_ex;
@@ -1507,7 +1509,8 @@ static int ext4_mb_try_best_found(struct ext4_allocation_context *ac,
         return 0;
 }
 
-static int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
+static noinline_for_stack
+int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
                                 struct ext4_buddy *e4b)
 {
         ext4_group_t group = ac->ac_g_ex.fe_group;
@@ -1566,7 +1569,8 @@ static int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
  * The routine scans buddy structures (not bitmap!) from given order
  * to max order and tries to find big enough chunk to satisfy the req
  */
-static void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
+static noinline_for_stack
+void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
                                         struct ext4_buddy *e4b)
 {
         struct super_block *sb = ac->ac_sb;
@@ -1609,7 +1613,8 @@ static void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
  * In order to optimize scanning, caller must pass number of
  * free blocks in the group, so the routine can know upper limit.
  */
-static void ext4_mb_complex_scan_group(struct ext4_allocation_context *ac,
+static noinline_for_stack
+void ext4_mb_complex_scan_group(struct ext4_allocation_context *ac,
                                         struct ext4_buddy *e4b)
 {
         struct super_block *sb = ac->ac_sb;
@@ -1668,7 +1673,8 @@ static void ext4_mb_complex_scan_group(struct ext4_allocation_context *ac,
  * we try to find stripe-aligned chunks for stripe-size requests
  * XXX should do so at least for multiples of stripe size as well
  */
-static void ext4_mb_scan_aligned(struct ext4_allocation_context *ac,
+static noinline_for_stack
+void ext4_mb_scan_aligned(struct ext4_allocation_context *ac,
                                  struct ext4_buddy *e4b)
 {
         struct super_block *sb = ac->ac_sb;
@@ -1831,7 +1837,8 @@ void ext4_mb_put_buddy_cache_lock(struct super_block *sb,
 
 }
 
-static int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
+static noinline_for_stack
+int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
 {
 
         int ret;
@@ -2902,7 +2909,11 @@ int __init init_ext4_mballoc(void)
 
 void exit_ext4_mballoc(void)
 {
-        /* XXX: synchronize_rcu(); */
+        /* 
+         * Wait for completion of call_rcu()'s on ext4_pspace_cachep
+         * before destroying the slab cache.
+         */
+        rcu_barrier();
         kmem_cache_destroy(ext4_pspace_cachep);
         kmem_cache_destroy(ext4_ac_cachep);
         kmem_cache_destroy(ext4_free_ext_cachep);
@@ -3457,7 +3468,8 @@ static void ext4_mb_generate_from_freelist(struct super_block *sb, void *bitmap,
  * used in in-core bitmap. buddy must be generated from this bitmap
  * Need to be called with ext4 group lock held
  */
-static void ext4_mb_generate_from_pa(struct super_block *sb, void *bitmap,
+static noinline_for_stack
+void ext4_mb_generate_from_pa(struct super_block *sb, void *bitmap,
                                         ext4_group_t group)
 {
         struct ext4_group_info *grp = ext4_get_group_info(sb, group);
@@ -4215,14 +4227,9 @@ ext4_mb_initialize_context(struct ext4_allocation_context *ac,
         ext4_get_group_no_and_offset(sb, goal, &group, &block);
 
         /* set up allocation goals */
+        memset(ac, 0, sizeof(struct ext4_allocation_context));
         ac->ac_b_ex.fe_logical = ar->logical;
-        ac->ac_b_ex.fe_group = 0;
-        ac->ac_b_ex.fe_start = 0;
-        ac->ac_b_ex.fe_len = 0;
         ac->ac_status = AC_STATUS_CONTINUE;
-        ac->ac_groups_scanned = 0;
-        ac->ac_ex_scanned = 0;
-        ac->ac_found = 0;
         ac->ac_sb = sb;
         ac->ac_inode = ar->inode;
         ac->ac_o_ex.fe_logical = ar->logical;
@@ -4233,15 +4240,7 @@ ext4_mb_initialize_context(struct ext4_allocation_context *ac,
         ac->ac_g_ex.fe_group = group;
         ac->ac_g_ex.fe_start = block;
         ac->ac_g_ex.fe_len = len;
-        ac->ac_f_ex.fe_len = 0;
         ac->ac_flags = ar->flags;
-        ac->ac_2order = 0;
-        ac->ac_criteria = 0;
-        ac->ac_pa = NULL;
-        ac->ac_bitmap_page = NULL;
-        ac->ac_buddy_page = NULL;
-        ac->alloc_semp = NULL;
-        ac->ac_lg = NULL;
 
         /* we have to define context: we'll we work with a file or
          * locality group. this is a policy, actually */
@@ -4509,10 +4508,7 @@ ext4_fsblk_t ext4_mb_new_blocks(handle_t *handle,
         }
 
         ac = kmem_cache_alloc(ext4_ac_cachep, GFP_NOFS);
-        if (ac) {
-                ac->ac_sb = sb;
-                ac->ac_inode = ar->inode;
-        } else {
+        if (!ac) {
                 ar->len = 0;
                 *errp = -ENOMEM;
                 goto out1;
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 38ff75a0fe22..530b4ca01510 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -16,7 +16,6 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/time.h>
-#include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
 #include <linux/compat.h>
 #include <asm/uaccess.h>
diff --git a/fs/fat/namei_msdos.c b/fs/fat/namei_msdos.c
index 82f88733b681..bbc94ae4fd77 100644
--- a/fs/fat/namei_msdos.c
+++ b/fs/fat/namei_msdos.c
@@ -9,7 +9,6 @@
 #include <linux/module.h>
 #include <linux/time.h>
 #include <linux/buffer_head.h>
-#include <linux/smp_lock.h>
 #include "fat.h"
 
 /* Characters that are undesirable in an MS-DOS file name */
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index 73471b7ecc8c..cb6e83557112 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -19,7 +19,6 @@
 #include <linux/jiffies.h>
 #include <linux/ctype.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
 #include <linux/namei.h>
 #include "fat.h"
diff --git a/fs/fcntl.c b/fs/fcntl.c
index a040b764f8e3..ae413086db97 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -19,7 +19,6 @@
 #include <linux/signal.h>
 #include <linux/rcupdate.h>
 #include <linux/pid_namespace.h>
-#include <linux/smp_lock.h>
 
 #include <asm/poll.h>
 #include <asm/siginfo.h>
diff --git a/fs/freevxfs/vxfs_super.c b/fs/freevxfs/vxfs_super.c
index cdbd1654e4cd..1e8af939b3e4 100644
--- a/fs/freevxfs/vxfs_super.c
+++ b/fs/freevxfs/vxfs_super.c
@@ -38,6 +38,7 @@
 #include <linux/buffer_head.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/stat.h>
 #include <linux/vfs.h>
 #include <linux/mount.h>
diff --git a/fs/gfs2/trace_gfs2.h b/fs/gfs2/trace_gfs2.h
index 98d6ef1c1dc0..148d55c14171 100644
--- a/fs/gfs2/trace_gfs2.h
+++ b/fs/gfs2/trace_gfs2.h
@@ -1,12 +1,11 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM gfs2
+
 #if !defined(_TRACE_GFS2_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_GFS2_H
 
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM gfs2
-#define TRACE_INCLUDE_FILE trace_gfs2
-
 #include <linux/fs.h>
 #include <linux/buffer_head.h>
 #include <linux/dlmconstants.h>
@@ -403,5 +402,6 @@ TRACE_EVENT(gfs2_block_alloc,
 /* This part must be outside protection */
 #undef TRACE_INCLUDE_PATH
 #define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE trace_gfs2
 #include <trace/define_trace.h>
 
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 6f833dc8e910..f7fcbe49da72 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -19,6 +19,7 @@
 #include <linux/nls.h>
 #include <linux/parser.h>
 #include <linux/seq_file.h>
+#include <linux/smp_lock.h>
 #include <linux/vfs.h>
 
 #include "hfs_fs.h"
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 9fc3af0c0dab..c0759fe0855b 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -12,6 +12,7 @@
 #include <linux/pagemap.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/vfs.h>
 #include <linux/nls.h>
 
diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c
index 6916c41d7017..8865c94f55f6 100644
--- a/fs/hpfs/dir.c
+++ b/fs/hpfs/dir.c
@@ -6,6 +6,7 @@
  *  directory VFS functions
  */
 
+#include <linux/smp_lock.h>
 #include "hpfs_fn.h"
 
 static int hpfs_dir_release(struct inode *inode, struct file *filp)
diff --git a/fs/hpfs/file.c b/fs/hpfs/file.c
index 64ab52259204..3efabff00367 100644
--- a/fs/hpfs/file.c
+++ b/fs/hpfs/file.c
@@ -6,6 +6,7 @@
  *  file VFS functions
  */
 
+#include <linux/smp_lock.h>
 #include "hpfs_fn.h"
 
 #define BLOCKS(size) (((size) + 511) >> 9)
diff --git a/fs/hpfs/hpfs_fn.h b/fs/hpfs/hpfs_fn.h
index c2ea31bae313..701ca54c0867 100644
--- a/fs/hpfs/hpfs_fn.h
+++ b/fs/hpfs/hpfs_fn.h
@@ -13,7 +13,6 @@
 #include <linux/pagemap.h>
 #include <linux/buffer_head.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 
 #include "hpfs.h"
 
diff --git a/fs/hpfs/inode.c b/fs/hpfs/inode.c
index 39a1bfbea312..fe703ae46bc7 100644
--- a/fs/hpfs/inode.c
+++ b/fs/hpfs/inode.c
@@ -6,6 +6,7 @@
  *  inode VFS functions
  */
 
+#include <linux/smp_lock.h>
 #include "hpfs_fn.h"
 
 void hpfs_init_inode(struct inode *i)
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index b649232dde97..82b9c4ba9ed0 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -6,6 +6,7 @@
  *  adding & removing files & directories
  */
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include "hpfs_fn.h"
 
 static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 58a7963e168a..85f96bc651c7 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -142,6 +142,7 @@ static const struct dentry_operations isofs_dentry_ops[] = {
 
 struct iso9660_options{
         unsigned int rock:1;
+        unsigned int joliet:1;
         unsigned int cruft:1;
         unsigned int hide:1;
         unsigned int showassoc:1;
@@ -151,7 +152,6 @@ struct iso9660_options{
         unsigned int gid_set:1;
         unsigned int utf8:1;
         unsigned char map;
-        char joliet;
         unsigned char check;
         unsigned int blocksize;
         mode_t fmode;
@@ -632,7 +632,7 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent)
                         else if (isonum_711(vdp->type) == ISO_VD_SUPPLEMENTARY) {
                                 sec = (struct iso_supplementary_descriptor *)vdp;
                                 if (sec->escape[0] == 0x25 && sec->escape[1] == 0x2f) {
-                                        if (opt.joliet == 'y') {
+                                        if (opt.joliet) {
                                                 if (sec->escape[2] == 0x40)
                                                         joliet_level = 1;
                                                 else if (sec->escape[2] == 0x43)
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 18bfd5dab642..e378cb383979 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -297,6 +297,7 @@ int jbd2_journal_write_metadata_buffer(transaction_t *transaction,
         unsigned int new_offset;
         struct buffer_head *bh_in = jh2bh(jh_in);
         struct jbd2_buffer_trigger_type *triggers;
+        journal_t *journal = transaction->t_journal;
 
         /*
          * The buffer really shouldn't be locked: only the current committing
@@ -310,6 +311,11 @@ int jbd2_journal_write_metadata_buffer(transaction_t *transaction,
         J_ASSERT_BH(bh_in, buffer_jbddirty(bh_in));
 
         new_bh = alloc_buffer_head(GFP_NOFS|__GFP_NOFAIL);
+        /* keep subsequent assertions sane */
+        new_bh->b_state = 0;
+        init_buffer(new_bh, NULL, NULL);
+        atomic_set(&new_bh->b_count, 1);
+        new_jh = jbd2_journal_add_journal_head(new_bh); /* This sleeps */
 
         /*
          * If a new transaction has already done a buffer copy-out, then
@@ -388,14 +394,6 @@ repeat:
                 kunmap_atomic(mapped_data, KM_USER0);
         }
 
-        /* keep subsequent assertions sane */
-        new_bh->b_state = 0;
-        init_buffer(new_bh, NULL, NULL);
-        atomic_set(&new_bh->b_count, 1);
-        jbd_unlock_bh_state(bh_in);
-
-        new_jh = jbd2_journal_add_journal_head(new_bh); /* This sleeps */
-
         set_bh_page(new_bh, new_page, new_offset);
         new_jh->b_transaction = NULL;
         new_bh->b_size = jh2bh(jh_in)->b_size;
@@ -412,7 +410,11 @@ repeat:
          * copying is moved to the transaction's shadow queue.
          */
         JBUFFER_TRACE(jh_in, "file as BJ_Shadow");
-        jbd2_journal_file_buffer(jh_in, transaction, BJ_Shadow);
+        spin_lock(&journal->j_list_lock);
+        __jbd2_journal_file_buffer(jh_in, transaction, BJ_Shadow);
+        spin_unlock(&journal->j_list_lock);
+        jbd_unlock_bh_state(bh_in);
+
         JBUFFER_TRACE(new_jh, "file as BJ_IO");
         jbd2_journal_file_buffer(new_jh, transaction, BJ_IO);
 
@@ -2410,6 +2412,7 @@ const char *jbd2_dev_to_name(dev_t device)
         int     i = hash_32(device, CACHE_SIZE_BITS);
         char    *ret;
         struct block_device *bd;
+        static struct devname_cache *new_dev;
 
         rcu_read_lock();
         if (devcache[i] && devcache[i]->device == device) {
@@ -2419,20 +2422,20 @@ const char *jbd2_dev_to_name(dev_t device)
         }
         rcu_read_unlock();
 
+        new_dev = kmalloc(sizeof(struct devname_cache), GFP_KERNEL);
+        if (!new_dev)
+                return "NODEV-ALLOCFAILURE"; /* Something non-NULL */
         spin_lock(&devname_cache_lock);
         if (devcache[i]) {
                 if (devcache[i]->device == device) {
+                        kfree(new_dev);
                         ret = devcache[i]->devname;
                         spin_unlock(&devname_cache_lock);
                         return ret;
                 }
                 call_rcu(&devcache[i]->rcu, free_devcache);
         }
-        devcache[i] = kmalloc(sizeof(struct devname_cache), GFP_KERNEL);
-        if (!devcache[i]) {
-                spin_unlock(&devname_cache_lock);
-                return "NODEV-ALLOCFAILURE"; /* Something non-NULL */
-        }
+        devcache[i] = new_dev;
         devcache[i]->device = device;
         bd = bdget(device);
         if (bd) {
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 494501edba6b..6213ac728f30 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -499,34 +499,15 @@ void jbd2_journal_unlock_updates (journal_t *journal)
         wake_up(&journal->j_wait_transaction_locked);
 }
 
-/*
- * Report any unexpected dirty buffers which turn up.  Normally those
- * indicate an error, but they can occur if the user is running (say)
- * tune2fs to modify the live filesystem, so we need the option of
- * continuing as gracefully as possible.  #
- *
- * The caller should already hold the journal lock and
- * j_list_lock spinlock: most callers will need those anyway
- * in order to probe the buffer's journaling state safely.
- */
-static void jbd_unexpected_dirty_buffer(struct journal_head *jh)
+static void warn_dirty_buffer(struct buffer_head *bh)
 {
-        int jlist;
-
-        /* If this buffer is one which might reasonably be dirty
-         * --- ie. data, or not part of this journal --- then
-         * we're OK to leave it alone, but otherwise we need to
-         * move the dirty bit to the journal's own internal
-         * JBDDirty bit. */
-        jlist = jh->b_jlist;
+        char b[BDEVNAME_SIZE];
 
-        if (jlist == BJ_Metadata || jlist == BJ_Reserved ||
-            jlist == BJ_Shadow || jlist == BJ_Forget) {
-                struct buffer_head *bh = jh2bh(jh);
-
-                if (test_clear_buffer_dirty(bh))
-                        set_buffer_jbddirty(bh);
-        }
+        printk(KERN_WARNING
+               "JBD: Spotted dirty metadata buffer (dev = %s, blocknr = %llu). "
+               "There's a risk of filesystem corruption in case of system "
+               "crash.\n",
+               bdevname(bh->b_bdev, b), (unsigned long long)bh->b_blocknr);
 }
 
 /*
@@ -593,14 +574,16 @@ repeat:
                         if (jh->b_next_transaction)
                                 J_ASSERT_JH(jh, jh->b_next_transaction ==
                                                         transaction);
+                        warn_dirty_buffer(bh);
                 }
                 /*
                  * In any case we need to clean the dirty flag and we must
                  * do it under the buffer lock to be sure we don't race
                  * with running write-out.
                  */
-                JBUFFER_TRACE(jh, "Unexpected dirty buffer");
-                jbd_unexpected_dirty_buffer(jh);
+                JBUFFER_TRACE(jh, "Journalling dirty buffer");
+                clear_buffer_dirty(bh);
+                set_buffer_jbddirty(bh);
         }
 
         unlock_buffer(bh);
@@ -843,6 +826,15 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
         J_ASSERT_JH(jh, buffer_locked(jh2bh(jh)));
 
         if (jh->b_transaction == NULL) {
+                /*
+                 * Previous jbd2_journal_forget() could have left the buffer
+                 * with jbddirty bit set because it was being committed. When
+                 * the commit finished, we've filed the buffer for
+                 * checkpointing and marked it dirty. Now we are reallocating
+                 * the buffer so the transaction freeing it must have
+                 * committed and so it's safe to clear the dirty bit.
+                 */
+                clear_buffer_dirty(jh2bh(jh));
                 jh->b_transaction = transaction;
 
                 /* first access by this transaction */
@@ -1644,8 +1636,13 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
 
         if (jh->b_cp_transaction) {
                 JBUFFER_TRACE(jh, "on running+cp transaction");
+                /*
+                 * We don't want to write the buffer anymore, clear the
+                 * bit so that we don't confuse checks in
+                 * __journal_file_buffer
+                 */
+                clear_buffer_dirty(bh);
                 __jbd2_journal_file_buffer(jh, transaction, BJ_Forget);
-                clear_buffer_jbddirty(bh);
                 may_free = 0;
         } else {
                 JBUFFER_TRACE(jh, "on running transaction");
@@ -1896,12 +1893,17 @@ void __jbd2_journal_file_buffer(struct journal_head *jh,
         if (jh->b_transaction && jh->b_jlist == jlist)
                 return;
 
-        /* The following list of buffer states needs to be consistent
-         * with __jbd_unexpected_dirty_buffer()'s handling of dirty
-         * state. */
-
         if (jlist == BJ_Metadata || jlist == BJ_Reserved ||
             jlist == BJ_Shadow || jlist == BJ_Forget) {
+                /*
+                 * For metadata buffers, we track dirty bit in buffer_jbddirty
+                 * instead of buffer_dirty. We should not see a dirty bit set
+                 * here because we clear it in do_get_write_access but e.g.
+                 * tune2fs can modify the sb and set the dirty bit at any time
+                 * so we try to gracefully handle that.
+                 */
+                if (buffer_dirty(bh))
+                        warn_dirty_buffer(bh);
                 if (test_clear_buffer_dirty(bh) ||
                     test_clear_buffer_jbddirty(bh))
                         was_dirty = 1;
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 07a22caf2687..0035c021395a 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -12,6 +12,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/fs.h>
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index f2fdcbce143e..4336adba952a 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/smp_lock.h>
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
diff --git a/fs/lockd/svc4proc.c b/fs/lockd/svc4proc.c
index 1725037374c5..bd173a6ca3b1 100644
--- a/fs/lockd/svc4proc.c
+++ b/fs/lockd/svc4proc.c
@@ -10,6 +10,7 @@
 #include <linux/types.h>
 #include <linux/time.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/in.h>
 #include <linux/sunrpc/svc.h>
 #include <linux/sunrpc/clnt.h>
diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c
index 3688e55901fc..e1d28ddd2169 100644
--- a/fs/lockd/svcproc.c
+++ b/fs/lockd/svcproc.c
@@ -10,6 +10,7 @@
 #include <linux/types.h>
 #include <linux/time.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/in.h>
 #include <linux/sunrpc/svc.h>
 #include <linux/sunrpc/clnt.h>
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index c2d061675d80..8d25ccb2d51d 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1242,20 +1242,6 @@ error:
         return error;
 }
 
-/*
- * Initialize a session.
- * Note: save the mount rsize and wsize for create_server negotiation.
- */
-static void nfs4_init_session(struct nfs_client *clp,
-                              unsigned int wsize, unsigned int rsize)
-{
-#if defined(CONFIG_NFS_V4_1)
-        if (nfs4_has_session(clp)) {
-                clp->cl_session->fc_attrs.max_rqst_sz = wsize;
-                clp->cl_session->fc_attrs.max_resp_sz = rsize;
-        }
-#endif /* CONFIG_NFS_V4_1 */
-}
 
 /*
  * Session has been established, and the client marked ready.
@@ -1350,7 +1336,9 @@ struct nfs_server *nfs4_create_server(const struct nfs_parsed_mount_data *data,
         BUG_ON(!server->nfs_client->rpc_ops);
         BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
 
-        nfs4_init_session(server->nfs_client, server->wsize, server->rsize);
+        error = nfs4_init_session(server);
+        if (error < 0)
+                goto error;
 
         /* Probe the root fh to retrieve its FSID */
         error = nfs4_path_walk(server, mntfh, data->nfs_server.export_path);
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index af05b918cb5b..6dd48a4405b4 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -10,6 +10,7 @@
 #include <linux/kthread.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 
 #include <linux/nfs4.h>
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 89f98e9a024b..32062c33c859 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -29,7 +29,6 @@
 #include <linux/nfs_fs.h>
 #include <linux/nfs_mount.h>
 #include <linux/pagemap.h>
-#include <linux/smp_lock.h>
 #include <linux/pagevec.h>
 #include <linux/namei.h>
 #include <linux/mount.h>
@@ -1026,12 +1025,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
                                 res = NULL;
                                 goto out;
                         /* This turned out not to be a regular file */
-                        case -EISDIR:
                         case -ENOTDIR:
                                 goto no_open;
                         case -ELOOP:
                                 if (!(nd->intent.open.flags & O_NOFOLLOW))
                                         goto no_open;
+                        /* case -EISDIR: */
                         /* case -EINVAL: */
                         default:
                                 goto out;
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 0055b813ec2c..05062329b678 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -26,7 +26,6 @@
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/pagemap.h>
-#include <linux/smp_lock.h>
 #include <linux/aio.h>
 
 #include <asm/uaccess.h>
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 64f87194d390..bd7938eda6a8 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -30,7 +30,6 @@
 #include <linux/nfs_mount.h>
 #include <linux/nfs4_mount.h>
 #include <linux/lockd/bind.h>
-#include <linux/smp_lock.h>
 #include <linux/seq_file.h>
 #include <linux/mount.h>
 #include <linux/nfs_idmap.h>
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 61bc3a32e1e2..6ea07a3c75d4 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -220,6 +220,7 @@ extern void nfs4_destroy_session(struct nfs4_session *session);
 extern struct nfs4_session *nfs4_alloc_session(struct nfs_client *clp);
 extern int nfs4_proc_create_session(struct nfs_client *, int reset);
 extern int nfs4_proc_destroy_session(struct nfs4_session *);
+extern int nfs4_init_session(struct nfs_server *server);
 #else /* CONFIG_NFS_v4_1 */
 static inline int nfs4_setup_sequence(struct nfs_client *clp,
                 struct nfs4_sequence_args *args, struct nfs4_sequence_res *res,
@@ -227,6 +228,11 @@ static inline int nfs4_setup_sequence(struct nfs_client *clp,
 {
         return 0;
 }
+
+static inline int nfs4_init_session(struct nfs_server *server)
+{
+        return 0;
+}
 #endif /* CONFIG_NFS_V4_1 */
 
 extern struct nfs4_state_maintenance_ops *nfs4_state_renewal_ops[];
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 92ce43517814..6917311f201c 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -45,7 +45,6 @@
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
 #include <linux/nfs_page.h>
-#include <linux/smp_lock.h>
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/module.h>
@@ -2041,15 +2040,9 @@ static int _nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
                 .rpc_argp = &args,
                 .rpc_resp = &res,
         };
-        int status;
 
         nfs_fattr_init(info->fattr);
-        status = nfs4_recover_expired_lease(server);
-        if (!status)
-                status = nfs4_check_client_ready(server->nfs_client);
-        if (!status)
-                status = nfs4_call_sync(server, &msg, &args, &res, 0);
-        return status;
+        return nfs4_call_sync(server, &msg, &args, &res, 0);
 }
 
 static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
@@ -4100,15 +4093,23 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
         if (request->fl_start < 0 || request->fl_end < 0)
                 return -EINVAL;
 
-        if (IS_GETLK(cmd))
-                return nfs4_proc_getlk(state, F_GETLK, request);
+        if (IS_GETLK(cmd)) {
+                if (state != NULL)
+                        return nfs4_proc_getlk(state, F_GETLK, request);
+                return 0;
+        }
 
         if (!(IS_SETLK(cmd) || IS_SETLKW(cmd)))
                 return -EINVAL;
 
-        if (request->fl_type == F_UNLCK)
-                return nfs4_proc_unlck(state, cmd, request);
+        if (request->fl_type == F_UNLCK) {
+                if (state != NULL)
+                        return nfs4_proc_unlck(state, cmd, request);
+                return 0;
+        }
 
+        if (state == NULL)
+                return -ENOLCK;
         do {
                 status = nfs4_proc_setlk(state, cmd, request);
                 if ((status != -EAGAIN) || IS_SETLK(cmd))
@@ -4794,6 +4795,22 @@ int nfs4_proc_destroy_session(struct nfs4_session *session)
         return status;
 }
 
+int nfs4_init_session(struct nfs_server *server)
+{
+        struct nfs_client *clp = server->nfs_client;
+        int ret;
+
+        if (!nfs4_has_session(clp))
+                return 0;
+
+        clp->cl_session->fc_attrs.max_rqst_sz = server->wsize;
+        clp->cl_session->fc_attrs.max_resp_sz = server->rsize;
+        ret = nfs4_recover_expired_lease(server);
+        if (!ret)
+                ret = nfs4_check_client_ready(clp);
+        return ret;
+}
+
 /*
  * Renew the cl_session lease.
  */
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index b73c5a728655..65ca8c18476f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -553,6 +553,7 @@ static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, f
         INIT_LIST_HEAD(&lsp->ls_sequence.list);
         lsp->ls_seqid.sequence = &lsp->ls_sequence;
         atomic_set(&lsp->ls_count, 1);
+        lsp->ls_state = state;
         lsp->ls_owner = fl_owner;
         spin_lock(&clp->cl_lock);
         nfs_alloc_unique_id(&clp->cl_lockowner_id, &lsp->ls_id, 1, 64);
@@ -587,7 +588,6 @@ static struct nfs4_lock_state *nfs4_get_lock_state(struct nfs4_state *state, fl_
                 if (lsp != NULL)
                         break;
                 if (new != NULL) {
-                        new->ls_state = state;
                         list_add(&new->ls_locks, &state->lock_states);
                         set_bit(LK_STATE_IN_USE, &state->flags);
                         lsp = new;
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 96c4ebfa46f4..73ea5e8d66ce 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -18,7 +18,6 @@
 #include <linux/sunrpc/clnt.h>
 #include <linux/nfs_fs.h>
 #include <linux/nfs_page.h>
-#include <linux/smp_lock.h>
 
 #include <asm/system.h>
 
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 1250fb978ac1..6d0847562d87 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -25,7 +25,6 @@
 #include <linux/init.h>
 #include <linux/inet.h>
 #include <linux/string.h>
-#include <linux/smp_lock.h>
 #include <linux/ctype.h>
 
 #include <linux/nfs.h>
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index d4c9884cd54b..492c79b7800b 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -18,7 +18,6 @@
 #include <linux/unistd.h>
 #include <linux/slab.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/freezer.h>
 #include <linux/fs_struct.h>
 #include <linux/kthread.h>
diff --git a/fs/nilfs2/Kconfig b/fs/nilfs2/Kconfig
new file mode 100644
index 000000000000..72da095d4009
--- /dev/null
+++ b/fs/nilfs2/Kconfig
@@ -0,0 +1,25 @@
+config NILFS2_FS
+        tristate "NILFS2 file system support (EXPERIMENTAL)"
+        depends on BLOCK && EXPERIMENTAL
+        select CRC32
+        help
+          NILFS2 is a log-structured file system (LFS) supporting continuous
+          snapshotting.  In addition to versioning capability of the entire
+          file system, users can even restore files mistakenly overwritten or
+          destroyed just a few seconds ago.  Since this file system can keep
+          consistency like conventional LFS, it achieves quick recovery after
+          system crashes.
+
+          NILFS2 creates a number of checkpoints every few seconds or per
+          synchronous write basis (unless there is no change).  Users can
+          select significant versions among continuously created checkpoints,
+          and can change them into snapshots which will be preserved for long
+          periods until they are changed back to checkpoints.  Each
+          snapshot is mountable as a read-only file system concurrently with
+          its writable mount, and this feature is convenient for online backup.
+
+          Some features including atime, extended attributes, and POSIX ACLs,
+          are not supported yet.
+
+          To compile this file system support as a module, choose M here: the
+          module will be called nilfs2.  If unsure, say N.
diff --git a/fs/nilfs2/bmap.c b/fs/nilfs2/bmap.c
index 36df60b6d8a4..99d58a028b94 100644
--- a/fs/nilfs2/bmap.c
+++ b/fs/nilfs2/bmap.c
@@ -568,6 +568,7 @@ void nilfs_bmap_abort_update_v(struct nilfs_bmap *bmap,
 }
 
 static struct lock_class_key nilfs_bmap_dat_lock_key;
+static struct lock_class_key nilfs_bmap_mdt_lock_key;
 
 /**
  * nilfs_bmap_read - read a bmap from an inode
@@ -603,7 +604,11 @@ int nilfs_bmap_read(struct nilfs_bmap *bmap, struct nilfs_inode *raw_inode)
                 bmap->b_ptr_type = NILFS_BMAP_PTR_VS;
                 bmap->b_last_allocated_key = 0;
                 bmap->b_last_allocated_ptr = NILFS_BMAP_INVALID_PTR;
+                lockdep_set_class(&bmap->b_sem, &nilfs_bmap_mdt_lock_key);
                 break;
+        case NILFS_IFILE_INO:
+                lockdep_set_class(&bmap->b_sem, &nilfs_bmap_mdt_lock_key);
+                /* Fall through */
         default:
                 bmap->b_ptr_type = NILFS_BMAP_PTR_VM;
                 bmap->b_last_allocated_key = 0;
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index 7d49813f66d6..aec942cf79e3 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -307,7 +307,7 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
                 ret = nilfs_cpfile_get_checkpoint_block(cpfile, cno, 0, &cp_bh);
                 if (ret < 0) {
                         if (ret != -ENOENT)
-                                goto out_header;
+                                break;
                         /* skip hole */
                         ret = 0;
                         continue;
@@ -340,7 +340,7 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
                                         continue;
                                 printk(KERN_ERR "%s: cannot delete block\n",
                                        __func__);
-                                goto out_header;
+                                break;
                         }
                 }
 
@@ -358,7 +358,6 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
                 kunmap_atomic(kaddr, KM_USER0);
         }
 
- out_header:
         brelse(header_bh);
 
  out_sem:
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index 0b2710e2d565..8927ca27e6f7 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -134,15 +134,6 @@ void nilfs_dat_commit_start(struct inode *dat, struct nilfs_palloc_req *req,
         entry = nilfs_palloc_block_get_entry(dat, req->pr_entry_nr,
                                              req->pr_entry_bh, kaddr);
         entry->de_start = cpu_to_le64(nilfs_mdt_cno(dat));
-        if (entry->de_blocknr != cpu_to_le64(0) ||
-            entry->de_end != cpu_to_le64(NILFS_CNO_MAX)) {
-                printk(KERN_CRIT
-                       "%s: vbn = %llu, start = %llu, end = %llu, pbn = %llu\n",
-                       __func__, (unsigned long long)req->pr_entry_nr,
-                       (unsigned long long)le64_to_cpu(entry->de_start),
-                       (unsigned long long)le64_to_cpu(entry->de_end),
-                       (unsigned long long)le64_to_cpu(entry->de_blocknr));
-        }
         entry->de_blocknr = cpu_to_le64(blocknr);
         kunmap_atomic(kaddr, KM_USER0);
 
diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 54100acc1102..1a4fa04cf071 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -43,7 +43,6 @@
  */
 
 #include <linux/pagemap.h>
-#include <linux/smp_lock.h>
 #include "nilfs.h"
 #include "page.h"
 
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index aa977549919e..8b5e4778cf28 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1829,26 +1829,13 @@ static int nilfs_segctor_write(struct nilfs_sc_info *sci,
                 err = nilfs_segbuf_write(segbuf, &wi);
 
                 res = nilfs_segbuf_wait(segbuf, &wi);
-                err = unlikely(err) ? : res;
-                if (unlikely(err))
+                err = err ? : res;
+                if (err)
                         return err;
         }
         return 0;
 }
 
-static int nilfs_page_has_uncleared_buffer(struct page *page)
-{
-        struct buffer_head *head, *bh;
-
-        head = bh = page_buffers(page);
-        do {
-                if (buffer_dirty(bh) && !list_empty(&bh->b_assoc_buffers))
-                        return 1;
-                bh = bh->b_this_page;
-        } while (bh != head);
-        return 0;
-}
-
 static void __nilfs_end_page_io(struct page *page, int err)
 {
         if (!err) {
@@ -1872,12 +1859,11 @@ static void nilfs_end_page_io(struct page *page, int err)
         if (!page)
                 return;
 
-        if (buffer_nilfs_node(page_buffers(page)) &&
-            nilfs_page_has_uncleared_buffer(page))
-                /* For b-tree node pages, this function may be called twice
-                   or more because they might be split in a segment.
-                   This check assures that cleanup has been done for all
-                   buffers in a split btnode page. */
+        if (buffer_nilfs_node(page_buffers(page)) && !PageWriteback(page))
+                /*
+                 * For b-tree node pages, this function may be called twice
+                 * or more because they might be split in a segment.
+                 */
                 return;
 
         __nilfs_end_page_io(page, err);
@@ -1940,7 +1926,7 @@ static void nilfs_segctor_abort_write(struct nilfs_sc_info *sci,
                         }
                         if (bh->b_page != fs_page) {
                                 nilfs_end_page_io(fs_page, err);
-                                if (unlikely(fs_page == failed_page))
+                                if (fs_page && fs_page == failed_page)
                                         goto done;
                                 fs_page = bh->b_page;
                         }
diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index 9fcd36dcc9a0..467b413bec21 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -7,7 +7,6 @@
 
 #include <linux/fs.h>
 #include <linux/mount.h>
-#include <linux/smp_lock.h>
 
 #define MLOG_MASK_PREFIX ML_INODE
 #include <cluster/masklog.h>
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index 1a9c7878f864..ea4e6cb29e13 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -436,7 +436,7 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno,
         rcu_assign_pointer(ptbl->part[partno], p);
 
         /* suppress uevent if the disk supresses it */
-        if (!dev_get_uevent_suppress(pdev))
+        if (!dev_get_uevent_suppress(ddev))
                 kobject_uevent(&pdev->kobj, KOBJ_ADD);
 
         return p;
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index f3d47d856848..6925b835a43b 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -46,7 +46,6 @@
 #include <linux/reiserfs_acl.h>
 #include <asm/uaccess.h>
 #include <net/checksum.h>
-#include <linux/smp_lock.h>
 #include <linux/stat.h>
 #include <linux/quotaops.h>
 
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 3b52770f46ff..cb5fc57e370b 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -30,6 +30,7 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <linux/mutex.h>
 #include <linux/pagemap.h>
 #include <linux/init.h>
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index bc5857199ec2..762a7d6cec73 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -297,6 +297,7 @@ static enum hrtimer_restart wbuf_timer_callback_nolock(struct hrtimer *timer)
 {
         struct ubifs_wbuf *wbuf = container_of(timer, struct ubifs_wbuf, timer);
 
+        dbg_io("jhead %d", wbuf->jhead);
         wbuf->need_sync = 1;
         wbuf->c->need_wbuf_sync = 1;
         ubifs_wake_up_bgt(wbuf->c);
@@ -311,8 +312,12 @@ static void new_wbuf_timer_nolock(struct ubifs_wbuf *wbuf)
 {
         ubifs_assert(!hrtimer_active(&wbuf->timer));
 
-        if (!ktime_to_ns(wbuf->softlimit))
+        if (wbuf->no_timer)
                 return;
+        dbg_io("set timer for jhead %d, %llu-%llu millisecs", wbuf->jhead,
+               div_u64(ktime_to_ns(wbuf->softlimit), USEC_PER_SEC),
+               div_u64(ktime_to_ns(wbuf->softlimit) + wbuf->delta,
+                       USEC_PER_SEC));
         hrtimer_start_range_ns(&wbuf->timer, wbuf->softlimit, wbuf->delta,
                                HRTIMER_MODE_REL);
 }
@@ -323,11 +328,8 @@ static void new_wbuf_timer_nolock(struct ubifs_wbuf *wbuf)
  */
 static void cancel_wbuf_timer_nolock(struct ubifs_wbuf *wbuf)
 {
-        /*
-         * If the syncer is waiting for the lock (from the background thread's
-         * context) and another task is changing write-buffer then the syncing
-         * should be canceled.
-         */
+        if (wbuf->no_timer)
+                return;
         wbuf->need_sync = 0;
         hrtimer_cancel(&wbuf->timer);
 }
@@ -349,8 +351,8 @@ int ubifs_wbuf_sync_nolock(struct ubifs_wbuf *wbuf)
                 /* Write-buffer is empty or not seeked */
                 return 0;
 
-        dbg_io("LEB %d:%d, %d bytes",
-               wbuf->lnum, wbuf->offs, wbuf->used);
+        dbg_io("LEB %d:%d, %d bytes, jhead %d",
+               wbuf->lnum, wbuf->offs, wbuf->used, wbuf->jhead);
         ubifs_assert(!(c->vfs_sb->s_flags & MS_RDONLY));
         ubifs_assert(!(wbuf->avail & 7));
         ubifs_assert(wbuf->offs + c->min_io_size <= c->leb_size);
@@ -390,7 +392,7 @@ int ubifs_wbuf_sync_nolock(struct ubifs_wbuf *wbuf)
  * @offs: logical eraseblock offset to seek to
  * @dtype: data type
  *
- * This function targets the write buffer to logical eraseblock @lnum:@offs.
+ * This function targets the write-buffer to logical eraseblock @lnum:@offs.
  * The write-buffer is synchronized if it is not empty. Returns zero in case of
  * success and a negative error code in case of failure.
  */
@@ -399,7 +401,7 @@ int ubifs_wbuf_seek_nolock(struct ubifs_wbuf *wbuf, int lnum, int offs,
 {
         const struct ubifs_info *c = wbuf->c;
 
-        dbg_io("LEB %d:%d", lnum, offs);
+        dbg_io("LEB %d:%d, jhead %d", lnum, offs, wbuf->jhead);
         ubifs_assert(lnum >= 0 && lnum < c->leb_cnt);
         ubifs_assert(offs >= 0 && offs <= c->leb_size);
         ubifs_assert(offs % c->min_io_size == 0 && !(offs & 7));
@@ -506,9 +508,9 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
         struct ubifs_info *c = wbuf->c;
         int err, written, n, aligned_len = ALIGN(len, 8), offs;
 
-        dbg_io("%d bytes (%s) to wbuf at LEB %d:%d", len,
-               dbg_ntype(((struct ubifs_ch *)buf)->node_type), wbuf->lnum,
-               wbuf->offs + wbuf->used);
+        dbg_io("%d bytes (%s) to jhead %d wbuf at LEB %d:%d", len,
+               dbg_ntype(((struct ubifs_ch *)buf)->node_type), wbuf->jhead,
+               wbuf->lnum, wbuf->offs + wbuf->used);
         ubifs_assert(len > 0 && wbuf->lnum >= 0 && wbuf->lnum < c->leb_cnt);
         ubifs_assert(wbuf->offs >= 0 && wbuf->offs % c->min_io_size == 0);
         ubifs_assert(!(wbuf->offs & 7) && wbuf->offs <= c->leb_size);
@@ -533,8 +535,8 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
                 memcpy(wbuf->buf + wbuf->used, buf, len);
 
                 if (aligned_len == wbuf->avail) {
-                        dbg_io("flush wbuf to LEB %d:%d", wbuf->lnum,
-                                wbuf->offs);
+                        dbg_io("flush jhead %d wbuf to LEB %d:%d",
+                               wbuf->jhead, wbuf->lnum, wbuf->offs);
                         err = ubi_leb_write(c->ubi, wbuf->lnum, wbuf->buf,
                                             wbuf->offs, c->min_io_size,
                                             wbuf->dtype);
@@ -562,7 +564,8 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
          * minimal I/O unit. We have to fill and flush write-buffer and switch
          * to the next min. I/O unit.
          */
-        dbg_io("flush wbuf to LEB %d:%d", wbuf->lnum, wbuf->offs);
+        dbg_io("flush jhead %d wbuf to LEB %d:%d",
+               wbuf->jhead, wbuf->lnum, wbuf->offs);
         memcpy(wbuf->buf + wbuf->used, buf, wbuf->avail);
         err = ubi_leb_write(c->ubi, wbuf->lnum, wbuf->buf, wbuf->offs,
                             c->min_io_size, wbuf->dtype);
@@ -695,7 +698,8 @@ int ubifs_read_node_wbuf(struct ubifs_wbuf *wbuf, void *buf, int type, int len,
         int err, rlen, overlap;
         struct ubifs_ch *ch = buf;
 
-        dbg_io("LEB %d:%d, %s, length %d", lnum, offs, dbg_ntype(type), len);
+        dbg_io("LEB %d:%d, %s, length %d, jhead %d", lnum, offs,
+               dbg_ntype(type), len, wbuf->jhead);
         ubifs_assert(wbuf && lnum >= 0 && lnum < c->leb_cnt && offs >= 0);
         ubifs_assert(!(offs & 7) && offs < c->leb_size);
         ubifs_assert(type >= 0 && type < UBIFS_NODE_TYPES_CNT);
@@ -819,13 +823,12 @@ out:
  * @c: UBIFS file-system description object
  * @wbuf: write-buffer to initialize
  *
- * This function initializes write buffer. Returns zero in case of success
+ * This function initializes write-buffer. Returns zero in case of success
  * %-ENOMEM in case of failure.
  */
 int ubifs_wbuf_init(struct ubifs_info *c, struct ubifs_wbuf *wbuf)
 {
         size_t size;
-        ktime_t hardlimit;
 
         wbuf->buf = kmalloc(c->min_io_size, GFP_KERNEL);
         if (!wbuf->buf)
@@ -851,22 +854,16 @@ int ubifs_wbuf_init(struct ubifs_info *c, struct ubifs_wbuf *wbuf)
 
         hrtimer_init(&wbuf->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         wbuf->timer.function = wbuf_timer_callback_nolock;
-        /*
-         * Make write-buffer soft limit to be 20% of the hard limit. The
-         * write-buffer timer is allowed to expire any time between the soft
-         * and hard limits.
-         */
-        hardlimit = ktime_set(DEFAULT_WBUF_TIMEOUT_SECS, 0);
-        wbuf->delta = (DEFAULT_WBUF_TIMEOUT_SECS * NSEC_PER_SEC) * 2 / 10;
-        wbuf->softlimit = ktime_sub_ns(hardlimit, wbuf->delta);
-        hrtimer_set_expires_range_ns(&wbuf->timer,  wbuf->softlimit,
-                                     wbuf->delta);
+        wbuf->softlimit = ktime_set(WBUF_TIMEOUT_SOFTLIMIT, 0);
+        wbuf->delta = WBUF_TIMEOUT_HARDLIMIT - WBUF_TIMEOUT_SOFTLIMIT;
+        wbuf->delta *= 1000000000ULL;
+        ubifs_assert(wbuf->delta <= ULONG_MAX);
         return 0;
 }
 
 /**
  * ubifs_wbuf_add_ino_nolock - add an inode number into the wbuf inode array.
- * @wbuf: the write-buffer whereto add
+ * @wbuf: the write-buffer where to add
  * @inum: the inode number
  *
  * This function adds an inode number to the inode array of the write-buffer.
diff --git a/fs/ubifs/ioctl.c b/fs/ubifs/ioctl.c
index 6db7a6be6c97..8aacd64957a2 100644
--- a/fs/ubifs/ioctl.c
+++ b/fs/ubifs/ioctl.c
@@ -25,7 +25,6 @@
 /* This file implements EXT2-compatible extended attribute ioctl() calls */
 
 #include <linux/compat.h>
-#include <linux/smp_lock.h>
 #include <linux/mount.h>
 #include "ubifs.h"
 
diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
index 805605250f12..e5f6cf8a1155 100644
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -53,6 +53,25 @@ static int is_empty(void *buf, int len)
 }
 
 /**
+ * first_non_ff - find offset of the first non-0xff byte.
+ * @buf: buffer to search in
+ * @len: length of buffer
+ *
+ * This function returns offset of the first non-0xff byte in @buf or %-1 if
+ * the buffer contains only 0xff bytes.
+ */
+static int first_non_ff(void *buf, int len)
+{
+        uint8_t *p = buf;
+        int i;
+
+        for (i = 0; i < len; i++)
+                if (*p++ != 0xff)
+                        return i;
+        return -1;
+}
+
+/**
  * get_master_node - get the last valid master node allowing for corruption.
  * @c: UBIFS file-system description object
  * @lnum: LEB number
@@ -357,11 +376,7 @@ static int is_last_write(const struct ubifs_info *c, void *buf, int offs)
         empty_offs = ALIGN(offs + 1, c->min_io_size);
         check_len = c->leb_size - empty_offs;
         p = buf + empty_offs - offs;
-
-        for (; check_len > 0; check_len--)
-                if (*p++ != 0xff)
-                        return 0;
-        return 1;
+        return is_empty(p, check_len);
 }
 
 /**
@@ -543,8 +558,8 @@ static int drop_incomplete_group(struct ubifs_scan_leb *sleb, int *offs)
  *
  * This function does a scan of a LEB, but caters for errors that might have
  * been caused by the unclean unmount from which we are attempting to recover.
- *
- * This function returns %0 on success and a negative error code on failure.
+ * Returns %0 in case of success, %-EUCLEAN if an unrecoverable corruption is
+ * found, and a negative error code in case of failure.
  */
 struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
                                          int offs, void *sbuf, int grouped)
@@ -643,7 +658,8 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
                         goto corrupted;
                 default:
                         dbg_err("unknown");
-                        goto corrupted;
+                        err = -EINVAL;
+                        goto error;
                 }
         }
 
@@ -652,8 +668,13 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
                         clean_buf(c, &buf, lnum, &offs, &len);
                         need_clean = 1;
                 } else {
-                        ubifs_err("corrupt empty space at LEB %d:%d",
-                                  lnum, offs);
+                        int corruption = first_non_ff(buf, len);
+
+                        ubifs_err("corrupt empty space LEB %d:%d, corruption "
+                                  "starts at %d", lnum, offs, corruption);
+                        /* Make sure we dump interesting non-0xFF data */
+                        offs = corruption;
+                        buf += corruption;
                         goto corrupted;
                 }
         }
@@ -813,7 +834,7 @@ struct ubifs_scan_leb *ubifs_recover_log_leb(struct ubifs_info *c, int lnum,
 static int recover_head(const struct ubifs_info *c, int lnum, int offs,
                         void *sbuf)
 {
-        int len, err, need_clean = 0;
+        int len, err;
 
         if (c->min_io_size > 1)
                 len = c->min_io_size;
@@ -827,19 +848,7 @@ static int recover_head(const struct ubifs_info *c, int lnum, int offs,
 
         /* Read at the head location and check it is empty flash */
         err = ubi_read(c->ubi, lnum, sbuf, offs, len);
-        if (err)
-                need_clean = 1;
-        else {
-                uint8_t *p = sbuf;
-
-                while (len--)
-                        if (*p++ != 0xff) {
-                                need_clean = 1;
-                                break;
-                        }
-        }
-
-        if (need_clean) {
+        if (err || !is_empty(sbuf, len)) {
                 dbg_rcvry("cleaning head at %d:%d", lnum, offs);
                 if (offs == 0)
                         return ubifs_leb_unmap(c, lnum);
diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
index 11cc80125a49..2970500f32df 100644
--- a/fs/ubifs/replay.c
+++ b/fs/ubifs/replay.c
@@ -837,9 +837,10 @@ static int replay_log_leb(struct ubifs_info *c, int lnum, int offs, void *sbuf)
 
         dbg_mnt("replay log LEB %d:%d", lnum, offs);
         sleb = ubifs_scan(c, lnum, offs, sbuf);
-        if (IS_ERR(sleb)) {
-                if (c->need_recovery)
-                        sleb = ubifs_recover_log_leb(c, lnum, offs, sbuf);
+        if (IS_ERR(sleb) ) {
+                if (PTR_ERR(sleb) != -EUCLEAN || !c->need_recovery)
+                        return PTR_ERR(sleb);
+                sleb = ubifs_recover_log_leb(c, lnum, offs, sbuf);
                 if (IS_ERR(sleb))
                         return PTR_ERR(sleb);
         }
@@ -957,7 +958,7 @@ out:
         return err;
 
 out_dump:
-        ubifs_err("log error detected while replying the log at LEB %d:%d",
+        ubifs_err("log error detected while replaying the log at LEB %d:%d",
                   lnum, offs + snod->offs);
         dbg_dump_node(c, snod->node);
         ubifs_scan_destroy(sleb);
diff --git a/fs/ubifs/scan.c b/fs/ubifs/scan.c
index 0ed82479b44b..892ebfee4fe5 100644
--- a/fs/ubifs/scan.c
+++ b/fs/ubifs/scan.c
@@ -238,12 +238,12 @@ void ubifs_scanned_corruption(const struct ubifs_info *c, int lnum, int offs,
 {
         int len;
 
-        ubifs_err("corrupted data at LEB %d:%d", lnum, offs);
+        ubifs_err("corruption at LEB %d:%d", lnum, offs);
         if (dbg_failure_mode)
                 return;
         len = c->leb_size - offs;
-        if (len > 4096)
-                len = 4096;
+        if (len > 8192)
+                len = 8192;
         dbg_err("first %d bytes from LEB %d:%d", len, lnum, offs);
         print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 4, buf, len, 1);
 }
@@ -256,7 +256,9 @@ void ubifs_scanned_corruption(const struct ubifs_info *c, int lnum, int offs,
  * @sbuf: scan buffer (must be c->leb_size)
  *
  * This function scans LEB number @lnum and returns complete information about
- * its contents. Returns an error code in case of failure.
+ * its contents. Returns the scaned information in case of success and,
+ * %-EUCLEAN if the LEB neads recovery, and other negative error codes in case
+ * of failure.
  */
 struct ubifs_scan_leb *ubifs_scan(const struct ubifs_info *c, int lnum,
                                   int offs, void *sbuf)
@@ -279,7 +281,6 @@ struct ubifs_scan_leb *ubifs_scan(const struct ubifs_info *c, int lnum,
                 cond_resched();
 
                 ret = ubifs_scan_a_node(c, buf, len, lnum, offs, 0);
-
                 if (ret > 0) {
                         /* Padding bytes or a valid padding node */
                         offs += ret;
@@ -304,7 +305,8 @@ struct ubifs_scan_leb *ubifs_scan(const struct ubifs_info *c, int lnum,
                         goto corrupted;
                 default:
                         dbg_err("unknown");
-                        goto corrupted;
+                        err = -EINVAL;
+                        goto error;
                 }
 
                 err = ubifs_add_snod(c, sleb, buf, offs);
@@ -317,8 +319,10 @@ struct ubifs_scan_leb *ubifs_scan(const struct ubifs_info *c, int lnum,
                 len -= node_len;
         }
 
-        if (offs % c->min_io_size)
-                goto corrupted;
+        if (offs % c->min_io_size) {
+                ubifs_err("empty space starts at non-aligned offset %d", offs);
+                goto corrupted;;
+        }
 
         ubifs_end_scan(c, sleb, lnum, offs);
 
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 79fad43f3c57..26d2e0d80465 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -797,7 +797,7 @@ static int alloc_wbufs(struct ubifs_info *c)
          * does not need to be synchronized by timer.
          */
         c->jheads[GCHD].wbuf.dtype = UBI_LONGTERM;
-        c->jheads[GCHD].wbuf.softlimit = ktime_set(0, 0);
+        c->jheads[GCHD].wbuf.no_timer = 1;
 
         return 0;
 }
@@ -986,7 +986,7 @@ static int ubifs_parse_options(struct ubifs_info *c, char *options,
                 switch (token) {
                 /*
                  * %Opt_fast_unmount and %Opt_norm_unmount options are ignored.
-                 * We accepte them in order to be backware-compatible. But this
+                 * We accept them in order to be backward-compatible. But this
                  * should be removed at some point.
                  */
                 case Opt_fast_unmount:
@@ -1287,6 +1287,9 @@ static int mount_ubifs(struct ubifs_info *c)
         if (err)
                 goto out_journal;
 
+        /* Calculate 'min_idx_lebs' after journal replay */
+        c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+
         err = ubifs_mount_orphans(c, c->need_recovery, mounted_read_only);
         if (err)
                 goto out_orphans;
@@ -1754,10 +1757,8 @@ static void ubifs_put_super(struct super_block *sb)
 
                 /* Synchronize write-buffers */
                 if (c->jheads)
-                        for (i = 0; i < c->jhead_cnt; i++) {
+                        for (i = 0; i < c->jhead_cnt; i++)
                                 ubifs_wbuf_sync(&c->jheads[i].wbuf);
-                                hrtimer_cancel(&c->jheads[i].wbuf.timer);
-                        }
 
                 /*
                  * On fatal errors c->ro_media is set to 1, in which case we do
@@ -1975,7 +1976,8 @@ static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
         err  = bdi_init(&c->bdi);
         if (err)
                 goto out_close;
-        err = bdi_register(&c->bdi, NULL, "ubifs");
+        err = bdi_register(&c->bdi, NULL, "ubifs_%d_%d",
+                           c->vi.ubi_num, c->vi.vol_id);
         if (err)
                 goto out_bdi;
 
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index 1bf01d820066..a29349094422 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -95,8 +95,9 @@
  */
 #define BGT_NAME_PATTERN "ubifs_bgt%d_%d"
 
-/* Default write-buffer synchronization timeout in seconds */
-#define DEFAULT_WBUF_TIMEOUT_SECS 5
+/* Write-buffer synchronization timeout interval in seconds */
+#define WBUF_TIMEOUT_SOFTLIMIT 3
+#define WBUF_TIMEOUT_HARDLIMIT 5
 
 /* Maximum possible inode number (only 32-bit inodes are supported now) */
 #define MAX_INUM 0xFFFFFFFF
@@ -654,7 +655,8 @@ typedef int (*ubifs_lpt_scan_callback)(struct ubifs_info *c,
  * @delta: hard and soft timeouts delta (the timer expire inteval is @softlimit
  *         and @softlimit + @delta)
  * @timer: write-buffer timer
- * @need_sync: it is set if its timer expired and needs sync
+ * @no_timer: non-zero if this write-buffer does not have a timer
+ * @need_sync: non-zero if the timer expired and the wbuf needs sync'ing
  * @next_ino: points to the next position of the following inode number
  * @inodes: stores the inode numbers of the nodes which are in wbuf
  *
@@ -683,7 +685,8 @@ struct ubifs_wbuf {
         ktime_t softlimit;
         unsigned long long delta;
         struct hrtimer timer;
-        int need_sync;
+        unsigned int no_timer:1;
+        unsigned int need_sync:1;
         int next_ino;
         ino_t *inodes;
 };
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index f4e255441574..0542fd507649 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -41,7 +41,6 @@
 #include "xfs_ioctl.h"
 
 #include <linux/dcache.h>
-#include <linux/smp_lock.h>
 
 static struct vm_operations_struct xfs_file_vm_ops;
 
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index a553f1041cf1..6ad76bf5fb40 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -30,9 +30,7 @@
  *      EXCEPTION_TABLE(...)
  *      NOTES
  *
- *      __bss_start = .;
- *      BSS_SECTION(0, 0)
- *      __bss_stop = .;
+ *      BSS_SECTION(0, 0, 0)
  *      _end = .;
  *
  *      /DISCARD/ : {
@@ -489,7 +487,8 @@
  * bss (Block Started by Symbol) - uninitialized data
  * zeroed during startup
  */
-#define SBSS                                                            \
+#define SBSS(sbss_align)                                                \
+        . = ALIGN(sbss_align);                                          \
         .sbss : AT(ADDR(.sbss) - LOAD_OFFSET) {                         \
                 *(.sbss)                                                \
                 *(.scommon)                                             \
@@ -498,12 +497,10 @@
 #define BSS(bss_align)                                                  \
         . = ALIGN(bss_align);                                           \
         .bss : AT(ADDR(.bss) - LOAD_OFFSET) {                           \
-                VMLINUX_SYMBOL(__bss_start) = .;                        \
                 *(.bss.page_aligned)                                    \
                 *(.dynbss)                                              \
                 *(.bss)                                                 \
                 *(COMMON)                                               \
-                VMLINUX_SYMBOL(__bss_stop) = .;                         \
         }
 
 /*
@@ -735,8 +732,10 @@
                 INIT_RAM_FS                                             \
         }
 
-#define BSS_SECTION(sbss_align, bss_align)                              \
-        SBSS                                                            \
+#define BSS_SECTION(sbss_align, bss_align, stop_align)                  \
+        . = ALIGN(sbss_align);                                          \
+        VMLINUX_SYMBOL(__bss_start) = .;                                \
+        SBSS(sbss_align)                                                \
         BSS(bss_align)                                                  \
-        . = ALIGN(4);
-
+        . = ALIGN(stop_align);                                          \
+        VMLINUX_SYMBOL(__bss_stop) = .;
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 45c18672b093..7174818c2c13 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -43,6 +43,7 @@
         {0x1002, 0x4A4F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4A50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4A54, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x4B48, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4B49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4B4A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4B4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|RADEON_NEW_MEMMAP}, \
@@ -262,6 +263,7 @@
         {0x1002, 0x9440, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9441, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9442, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x9443, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9444, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x9446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x944A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV770|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
@@ -346,12 +348,12 @@
         {0x1002, 0x9599, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV635|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x959B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV635|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x95C2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x95C4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C5, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C7, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95C9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x95C2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x95C4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95CC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95CD, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x95CE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV620|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index 3a52a63c1351..1d52425a6118 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -229,6 +229,11 @@ static inline int bdi_rw_congested(struct backing_dev_info *bdi)
                                   (1 << BDI_async_congested));
 }
 
+enum {
+        BLK_RW_ASYNC    = 0,
+        BLK_RW_SYNC     = 1,
+};
+
 void clear_bdi_congested(struct backing_dev_info *bdi, int sync);
 void set_bdi_congested(struct backing_dev_info *bdi, int sync);
 long congestion_wait(int sync, long timeout);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0146e0fecf1a..e7cb5dbf6c26 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -70,11 +70,6 @@ enum rq_cmd_type_bits {
         REQ_TYPE_ATA_PC,
 };
 
-enum {
-        BLK_RW_ASYNC    = 0,
-        BLK_RW_SYNC     = 1,
-};
-
 /*
  * For request of type REQ_TYPE_LINUX_BLOCK, rq->cmd[0] is the opcode being
  * sent down (similar to how REQ_TYPE_BLOCK_PC means that ->cmd[] holds a
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index 20a100fe2b4f..3a1dbba4d3ae 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -143,12 +143,3 @@ extern void clockevents_notify(unsigned long reason, void *arg);
 #endif
 
 #endif
-
-#ifdef CONFIG_GENERIC_CLOCKEVENTS
-extern ktime_t clockevents_get_next_event(int cpu);
-#else
-static inline ktime_t clockevents_get_next_event(int cpu)
-{
-        return (ktime_t) { .tv64 = KTIME_MAX };
-}
-#endif
diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
index d71f7c0f931b..38fe59dc89ae 100644
--- a/include/linux/console_struct.h
+++ b/include/linux/console_struct.h
@@ -89,7 +89,6 @@ struct vc_data {
         unsigned int    vc_need_wrap    : 1;
         unsigned int    vc_can_do_color : 1;
         unsigned int    vc_report_mouse : 2;
-        unsigned int    vc_kmalloced    : 1;
         unsigned char   vc_utf          : 1;    /* Unicode UTF-8 encoding */
         unsigned char   vc_utf_count;
                  int    vc_utf_char;
diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
index 2dac064d8359..0026f267da20 100644
--- a/include/linux/crash_dump.h
+++ b/include/linux/crash_dump.h
@@ -3,7 +3,6 @@
 
 #ifdef CONFIG_CRASH_DUMP
 #include <linux/kexec.h>
-#include <linux/smp_lock.h>
 #include <linux/device.h>
 #include <linux/proc_fs.h>
 
diff --git a/include/linux/device.h b/include/linux/device.h
index ed4e39f2c423..aebb81036db2 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -25,8 +25,6 @@
 #include <asm/atomic.h>
 #include <asm/device.h>
 
-#define BUS_ID_SIZE             20
-
 struct device;
 struct device_private;
 struct device_driver;
diff --git a/include/linux/hardirq.h b/include/linux/hardirq.h
index 45257475623c..8246c697863d 100644
--- a/include/linux/hardirq.h
+++ b/include/linux/hardirq.h
@@ -2,7 +2,9 @@
 #define LINUX_HARDIRQ_H
 
 #include <linux/preempt.h>
+#ifdef CONFIG_PREEMPT
 #include <linux/smp_lock.h>
+#endif
 #include <linux/lockdep.h>
 #include <linux/ftrace_irq.h>
 #include <asm/hardirq.h>
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 54648e625efd..4759917adc71 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -448,7 +448,7 @@ extern void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
 
 static inline void timer_stats_account_hrtimer(struct hrtimer *timer)
 {
-        if (likely(!timer->start_pid))
+        if (likely(!timer->start_site))
                 return;
         timer_stats_update_stats(timer, timer->start_pid, timer->start_site,
                                  timer->function, timer->start_comm, 0);
diff --git a/include/linux/kmemleak.h b/include/linux/kmemleak.h
index 7796aed6cdd5..6a63807f714e 100644
--- a/include/linux/kmemleak.h
+++ b/include/linux/kmemleak.h
@@ -27,6 +27,7 @@ extern void kmemleak_init(void);
 extern void kmemleak_alloc(const void *ptr, size_t size, int min_count,
                            gfp_t gfp);
 extern void kmemleak_free(const void *ptr);
+extern void kmemleak_free_part(const void *ptr, size_t size);
 extern void kmemleak_padding(const void *ptr, unsigned long offset,
                              size_t size);
 extern void kmemleak_not_leak(const void *ptr);
@@ -71,6 +72,9 @@ static inline void kmemleak_alloc_recursive(const void *ptr, size_t size,
 static inline void kmemleak_free(const void *ptr)
 {
 }
+static inline void kmemleak_free_part(const void *ptr, size_t size)
+{
+}
 static inline void kmemleak_free_recursive(const void *ptr, unsigned long flags)
 {
 }
diff --git a/include/linux/lguest.h b/include/linux/lguest.h
index 7bc1440fc473..dbf2479e808e 100644
--- a/include/linux/lguest.h
+++ b/include/linux/lguest.h
@@ -11,7 +11,7 @@
 #define LG_CLOCK_MIN_DELTA      100UL
 #define LG_CLOCK_MAX_DELTA      ULONG_MAX
 
-/*G:032 The second method of communicating with the Host is to via "struct
+/*G:031 The second method of communicating with the Host is to via "struct
  * lguest_data".  Once the Guest's initialization hypercall tells the Host where
  * this is, the Guest and Host both publish information in it. :*/
 struct lguest_data
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 3d501db36a26..79b6d7fd4ac2 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -385,6 +385,7 @@ enum {
                                                     not multiple of 16 bytes */
         ATA_HORKAGE_FIRMWARE_WARN = (1 << 12),  /* firmware update warning */
         ATA_HORKAGE_1_5_GBPS    = (1 << 13),    /* force 1.5 Gbps */
+        ATA_HORKAGE_NOSETXFER   = (1 << 14),    /* skip SETXFER, SATA only */
 
          /* DMA mask for user DMA control: User visible values; DO NOT
             renumber */
diff --git a/include/linux/personality.h b/include/linux/personality.h
index a84e9ff9b27e..126120819a0d 100644
--- a/include/linux/personality.h
+++ b/include/linux/personality.h
@@ -40,7 +40,10 @@ enum {
  * Security-relevant compatibility flags that must be
  * cleared upon setuid or setgid exec:
  */
-#define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC|ADDR_NO_RANDOMIZE)
+#define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC  | \
+                            ADDR_NO_RANDOMIZE  | \
+                            ADDR_COMPAT_LAYOUT | \
+                            MMAP_PAGE_ZERO)
 
 /*
  * Personality types.
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index 7bc457593684..26361c4c037a 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -7,7 +7,6 @@
 #ifndef _LINUX_QUOTAOPS_
 #define _LINUX_QUOTAOPS_
 
-#include <linux/smp_lock.h>
 #include <linux/fs.h>
 
 static inline struct quota_info *sb_dqopt(struct super_block *sb)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 0085d758d645..16a982e389fb 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -498,6 +498,15 @@ struct task_cputime {
                 .sum_exec_runtime = 0,                          \
         }
 
+/*
+ * Disable preemption until the scheduler is running.
+ * Reset by start_kernel()->sched_init()->init_idle().
+ *
+ * We include PREEMPT_ACTIVE to avoid cond_resched() from working
+ * before the scheduler is active -- see should_resched().
+ */
+#define INIT_PREEMPT_COUNT      (1 + PREEMPT_ACTIVE)
+
 /**
  * struct thread_group_cputimer - thread group interval timer counts
  * @cputime:            thread group interval timers.
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index b47b3f039d14..f2c69a2cca17 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1342,12 +1342,12 @@ static inline int skb_network_offset(const struct sk_buff *skb)
  * shifting the start of the packet by 2 bytes. Drivers should do this
  * with:
  *
- * skb_reserve(NET_IP_ALIGN);
+ * skb_reserve(skb, NET_IP_ALIGN);
  *
  * The downside to this alignment of the IP header is that the DMA is now
  * unaligned. On some architectures the cost of an unaligned DMA is high
  * and this cost outweighs the gains made by aligning the IP header.
- * 
+ *
  * Since this trade off varies between architectures, we allow NET_IP_ALIGN
  * to be overridden.
  */
diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
index 4dcbc2c71491..c1c862b1d01a 100644
--- a/include/linux/slub_def.h
+++ b/include/linux/slub_def.h
@@ -11,6 +11,7 @@
 #include <linux/workqueue.h>
 #include <linux/kobject.h>
 #include <linux/kmemtrace.h>
+#include <linux/kmemleak.h>
 
 enum stat_item {
         ALLOC_FASTPATH,         /* Allocation from cpu slab */
@@ -233,6 +234,7 @@ static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
         unsigned int order = get_order(size);
         void *ret = (void *) __get_free_pages(flags | __GFP_COMP, order);
 
+        kmemleak_alloc(ret, size, 1, flags);
         trace_kmalloc(_THIS_IP_, ret, size, PAGE_SIZE << order, flags);
 
         return ret;
diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index d8910b68e1bd..b99c625fddfe 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -12,7 +12,6 @@
 #include <linux/uio.h>
 #include <asm/byteorder.h>
 #include <linux/scatterlist.h>
-#include <linux/smp_lock.h>
 
 /*
  * Buffer adjustment
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index fa4242cdade8..80de7003d8c2 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -321,6 +321,8 @@ asmlinkage long sys_rt_sigtimedwait(const sigset_t __user *uthese,
                                 siginfo_t __user *uinfo,
                                 const struct timespec __user *uts,
                                 size_t sigsetsize);
+asmlinkage long sys_rt_tgsigqueueinfo(pid_t tgid, pid_t  pid, int sig,
+                siginfo_t __user *uinfo);
 asmlinkage long sys_kill(int pid, int sig);
 asmlinkage long sys_tgkill(int tgid, int pid, int sig);
 asmlinkage long sys_tkill(int pid, int sig);
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 84929e914034..b1e3c2fbfe11 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -888,8 +888,6 @@ struct usb_driver {
  * struct usb_device_driver - identifies USB device driver to usbcore
  * @name: The driver name should be unique among USB drivers,
  *      and should normally be the same as the module name.
- * @nodename: Callback to provide a naming hint for a possible
- *      device node to create.
  * @probe: Called to see if the driver is willing to manage a particular
  *      device.  If it is, probe returns zero and uses dev_set_drvdata()
  *      to associate driver-specific data with the device.  If unwilling
@@ -924,6 +922,8 @@ extern struct bus_type usb_bus_type;
 /**
  * struct usb_class_driver - identifies a USB driver that wants to use the USB major number
  * @name: the usb class device name for this driver.  Will show up in sysfs.
+ * @nodename: Callback to provide a naming hint for a possible
+ *      device node to create.
  * @fops: pointer to the struct file_operations of this driver.
  * @minor_base: the start of the minor range for this driver.
  *
@@ -1046,6 +1046,8 @@ typedef void (*usb_complete_t)(struct urb *);
  *      the device driver is saying that it provided this DMA address,
  *      which the host controller driver should use in preference to the
  *      transfer_buffer.
+ * @sg: scatter gather buffer list
+ * @num_sgs: number of entries in the sg list
  * @transfer_buffer_length: How big is transfer_buffer.  The transfer may
  *      be broken up into chunks according to the current maximum packet
  *      size for the endpoint, which is a function of the configuration
diff --git a/include/linux/usb/langwell_otg.h b/include/linux/usb/langwell_otg.h
deleted file mode 100644
index e115ae6df1da..000000000000
--- a/include/linux/usb/langwell_otg.h
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Intel Langwell USB OTG transceiver driver
- * Copyright (C) 2008, Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
- *
- */
-
-#ifndef __LANGWELL_OTG_H__
-#define __LANGWELL_OTG_H__
-
-/* notify transceiver driver about OTG events */
-extern void langwell_update_transceiver(void);
-/* HCD register bus driver */
-extern int langwell_register_host(struct pci_driver *host_driver);
-/* HCD unregister bus driver */
-extern void langwell_unregister_host(struct pci_driver *host_driver);
-/* DCD register bus driver */
-extern int langwell_register_peripheral(struct pci_driver *client_driver);
-/* DCD unregister bus driver */
-extern void langwell_unregister_peripheral(struct pci_driver *client_driver);
-/* No silent failure, output warning message */
-extern void langwell_otg_nsf_msg(unsigned long message);
-
-#define CI_USBCMD               0x30
-#       define USBCMD_RST               BIT(1)
-#       define USBCMD_RS                BIT(0)
-#define CI_USBSTS               0x34
-#       define USBSTS_SLI               BIT(8)
-#       define USBSTS_URI               BIT(6)
-#       define USBSTS_PCI               BIT(2)
-#define CI_PORTSC1              0x74
-#       define PORTSC_PP                BIT(12)
-#       define PORTSC_LS                (BIT(11) | BIT(10))
-#       define PORTSC_SUSP              BIT(7)
-#       define PORTSC_CCS               BIT(0)
-#define CI_HOSTPC1              0xb4
-#       define HOSTPC1_PHCD             BIT(22)
-#define CI_OTGSC                0xf4
-#       define OTGSC_DPIE               BIT(30)
-#       define OTGSC_1MSE               BIT(29)
-#       define OTGSC_BSEIE              BIT(28)
-#       define OTGSC_BSVIE              BIT(27)
-#       define OTGSC_ASVIE              BIT(26)
-#       define OTGSC_AVVIE              BIT(25)
-#       define OTGSC_IDIE               BIT(24)
-#       define OTGSC_DPIS               BIT(22)
-#       define OTGSC_1MSS               BIT(21)
-#       define OTGSC_BSEIS              BIT(20)
-#       define OTGSC_BSVIS              BIT(19)
-#       define OTGSC_ASVIS              BIT(18)
-#       define OTGSC_AVVIS              BIT(17)
-#       define OTGSC_IDIS               BIT(16)
-#       define OTGSC_DPS                BIT(14)
-#       define OTGSC_1MST               BIT(13)
-#       define OTGSC_BSE                BIT(12)
-#       define OTGSC_BSV                BIT(11)
-#       define OTGSC_ASV                BIT(10)
-#       define OTGSC_AVV                BIT(9)
-#       define OTGSC_ID                 BIT(8)
-#       define OTGSC_HABA               BIT(7)
-#       define OTGSC_HADP               BIT(6)
-#       define OTGSC_IDPU               BIT(5)
-#       define OTGSC_DP                 BIT(4)
-#       define OTGSC_OT                 BIT(3)
-#       define OTGSC_HAAR               BIT(2)
-#       define OTGSC_VC                 BIT(1)
-#       define OTGSC_VD                 BIT(0)
-#       define OTGSC_INTEN_MASK         (0x7f << 24)
-#       define OTGSC_INTSTS_MASK        (0x7f << 16)
-#define CI_USBMODE              0xf8
-#       define USBMODE_CM               (BIT(1) | BIT(0))
-#       define USBMODE_IDLE             0
-#       define USBMODE_DEVICE           0x2
-#       define USBMODE_HOST             0x3
-
-#define INTR_DUMMY_MASK (USBSTS_SLI | USBSTS_URI | USBSTS_PCI)
-
-struct otg_hsm {
-        /* Input */
-        int a_bus_resume;
-        int a_bus_suspend;
-        int a_conn;
-        int a_sess_vld;
-        int a_srp_det;
-        int a_vbus_vld;
-        int b_bus_resume;
-        int b_bus_suspend;
-        int b_conn;
-        int b_se0_srp;
-        int b_sess_end;
-        int b_sess_vld;
-        int id;
-
-        /* Internal variables */
-        int a_set_b_hnp_en;
-        int b_srp_done;
-        int b_hnp_enable;
-
-        /* Timeout indicator for timers */
-        int a_wait_vrise_tmout;
-        int a_wait_bcon_tmout;
-        int a_aidl_bdis_tmout;
-        int b_ase0_brst_tmout;
-        int b_bus_suspend_tmout;
-        int b_srp_res_tmout;
-
-        /* Informative variables */
-        int a_bus_drop;
-        int a_bus_req;
-        int a_clr_err;
-        int a_suspend_req;
-        int b_bus_req;
-
-        /* Output */
-        int drv_vbus;
-        int loc_conn;
-        int loc_sof;
-
-        /* Others */
-        int b_bus_suspend_vld;
-};
-
-#define TA_WAIT_VRISE   100
-#define TA_WAIT_BCON    30000
-#define TA_AIDL_BDIS    15000
-#define TB_ASE0_BRST    5000
-#define TB_SE0_SRP      2
-#define TB_SRP_RES      100
-#define TB_BUS_SUSPEND  500
-
-struct langwell_otg_timer {
-        unsigned long expires;  /* Number of count increase to timeout */
-        unsigned long count;    /* Tick counter */
-        void (*function)(unsigned long);        /* Timeout function */
-        unsigned long data;     /* Data passed to function */
-        struct list_head list;
-};
-
-struct langwell_otg {
-        struct otg_transceiver  otg;
-        struct otg_hsm          hsm;
-        void __iomem            *regs;
-        unsigned                region;
-        struct pci_driver       *host_ops;
-        struct pci_driver       *client_ops;
-        struct pci_dev          *pdev;
-        struct work_struct      work;
-        struct workqueue_struct *qwork;
-        spinlock_t              lock;
-        spinlock_t              wq_lock;
-};
-
-static inline struct langwell_otg *otg_to_langwell(struct otg_transceiver *otg)
-{
-        return container_of(otg, struct langwell_otg, otg);
-}
-
-#ifdef DEBUG
-#define otg_dbg(fmt, args...) \
-        printk(KERN_DEBUG fmt , ## args)
-#else
-#define otg_dbg(fmt, args...) \
-        do { } while (0)
-#endif /* DEBUG */
-#endif /* __LANGWELL_OTG_H__ */
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index 44801d26a37a..0ec50ba62139 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -317,7 +317,8 @@ extern int usb_serial_generic_register(int debug);
 extern void usb_serial_generic_deregister(void);
 extern void usb_serial_generic_resubmit_read_urb(struct usb_serial_port *port,
                                                  gfp_t mem_flags);
-extern int usb_serial_handle_sysrq_char(struct usb_serial_port *port,
+extern int usb_serial_handle_sysrq_char(struct tty_struct *tty,
+                                        struct usb_serial_port *port,
                                         unsigned int ch);
 extern int usb_serial_handle_break(struct usb_serial_port *port);
 
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index cec79adbe3ea..9c543d6ac535 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -27,6 +27,7 @@
 #define VIRTIO_NET_F_CTRL_VQ    17      /* Control channel available */
 #define VIRTIO_NET_F_CTRL_RX    18      /* Control channel RX mode support */
 #define VIRTIO_NET_F_CTRL_VLAN  19      /* Control channel VLAN filtering */
+#define VIRTIO_NET_F_CTRL_RX_EXTRA 20   /* Extra RX mode control support */
 
 #define VIRTIO_NET_S_LINK_UP    1       /* Link is up */
 
@@ -81,14 +82,19 @@ typedef __u8 virtio_net_ctrl_ack;
 #define VIRTIO_NET_ERR    1
 
 /*
- * Control the RX mode, ie. promisucous and allmulti.  PROMISC and
- * ALLMULTI commands require an "out" sg entry containing a 1 byte
- * state value, zero = disable, non-zero = enable.  These commands
- * are supported with the VIRTIO_NET_F_CTRL_RX feature.
+ * Control the RX mode, ie. promisucous, allmulti, etc...
+ * All commands require an "out" sg entry containing a 1 byte
+ * state value, zero = disable, non-zero = enable.  Commands
+ * 0 and 1 are supported with the VIRTIO_NET_F_CTRL_RX feature.
+ * Commands 2-5 are added with VIRTIO_NET_F_CTRL_RX_EXTRA.
  */
 #define VIRTIO_NET_CTRL_RX    0
  #define VIRTIO_NET_CTRL_RX_PROMISC      0
  #define VIRTIO_NET_CTRL_RX_ALLMULTI     1
+ #define VIRTIO_NET_CTRL_RX_ALLUNI       2
+ #define VIRTIO_NET_CTRL_RX_NOMULTI      3
+ #define VIRTIO_NET_CTRL_RX_NOUNI        4
+ #define VIRTIO_NET_CTRL_RX_NOBCAST      5
 
 /*
  * Control the MAC filter table.
diff --git a/include/net/sock.h b/include/net/sock.h
index 2c0da9239b95..950409dcec3d 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -104,15 +104,15 @@ struct net;
 
 /**
  *      struct sock_common - minimal network layer representation of sockets
+ *      @skc_node: main hash linkage for various protocol lookup tables
+ *      @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol
+ *      @skc_refcnt: reference count
+ *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_family: network address family
  *      @skc_state: Connection state
  *      @skc_reuse: %SO_REUSEADDR setting
  *      @skc_bound_dev_if: bound device index if != 0
- *      @skc_node: main hash linkage for various protocol lookup tables
- *      @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol
  *      @skc_bind_node: bind hash linkage for various protocol lookup tables
- *      @skc_refcnt: reference count
- *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_prot: protocol handlers inside a network family
  *      @skc_net: reference to the network namespace of this socket
  *
@@ -120,17 +120,21 @@ struct net;
  *      for struct sock and struct inet_timewait_sock.
  */
 struct sock_common {
-        unsigned short          skc_family;
-        volatile unsigned char  skc_state;
-        unsigned char           skc_reuse;
-        int                     skc_bound_dev_if;
+        /*
+         * first fields are not copied in sock_copy()
+         */
         union {
                 struct hlist_node       skc_node;
                 struct hlist_nulls_node skc_nulls_node;
         };
-        struct hlist_node       skc_bind_node;
         atomic_t                skc_refcnt;
+
         unsigned int            skc_hash;
+        unsigned short          skc_family;
+        volatile unsigned char  skc_state;
+        unsigned char           skc_reuse;
+        int                     skc_bound_dev_if;
+        struct hlist_node       skc_bind_node;
         struct proto            *skc_prot;
 #ifdef CONFIG_NET_NS
         struct net              *skc_net;
@@ -208,15 +212,17 @@ struct sock {
          * don't add nothing before this first member (__sk_common) --acme
          */
         struct sock_common      __sk_common;
+#define sk_node                 __sk_common.skc_node
+#define sk_nulls_node           __sk_common.skc_nulls_node
+#define sk_refcnt               __sk_common.skc_refcnt
+
+#define sk_copy_start           __sk_common.skc_hash
+#define sk_hash                 __sk_common.skc_hash
 #define sk_family               __sk_common.skc_family
 #define sk_state                __sk_common.skc_state
 #define sk_reuse                __sk_common.skc_reuse
 #define sk_bound_dev_if         __sk_common.skc_bound_dev_if
-#define sk_node                 __sk_common.skc_node
-#define sk_nulls_node           __sk_common.skc_nulls_node
 #define sk_bind_node            __sk_common.skc_bind_node
-#define sk_refcnt               __sk_common.skc_refcnt
-#define sk_hash                 __sk_common.skc_hash
 #define sk_prot                 __sk_common.skc_prot
 #define sk_net                  __sk_common.skc_net
         kmemcheck_bitfield_begin(flags);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 19f4150f4d4d..88af84306471 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1425,6 +1425,11 @@ struct tcp_request_sock_ops {
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_md5sig_key   *(*md5_lookup) (struct sock *sk,
                                                 struct request_sock *req);
+        int                     (*calc_md5_hash) (char *location,
+                                                  struct tcp_md5sig_key *md5,
+                                                  struct sock *sk,
+                                                  struct request_sock *req,
+                                                  struct sk_buff *skb);
 #endif
 };
 
diff --git a/include/trace/events/block.h b/include/trace/events/block.h
index d6b05f42dd44..9a74b468a229 100644
--- a/include/trace/events/block.h
+++ b/include/trace/events/block.h
@@ -1,3 +1,6 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM block
+
 #if !defined(_TRACE_BLOCK_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_BLOCK_H
 
@@ -5,9 +8,6 @@
 #include <linux/blkdev.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM block
-
 TRACE_EVENT(block_rq_abort,
 
         TP_PROTO(struct request_queue *q, struct request *rq),
diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
index acf4cc9cd36d..7d8b5bc74185 100644
--- a/include/trace/events/ext4.h
+++ b/include/trace/events/ext4.h
@@ -1,9 +1,9 @@
-#if !defined(_TRACE_EXT4_H) || defined(TRACE_HEADER_MULTI_READ)
-#define _TRACE_EXT4_H
-
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM ext4
 
+#if !defined(_TRACE_EXT4_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_EXT4_H
+
 #include <linux/writeback.h>
 #include "../../../fs/ext4/ext4.h"
 #include "../../../fs/ext4/mballoc.h"
@@ -34,7 +34,8 @@ TRACE_EVENT(ext4_free_inode,
 
         TP_printk("dev %s ino %lu mode %d uid %u gid %u blocks %llu",
                   jbd2_dev_to_name(__entry->dev), __entry->ino, __entry->mode,
-                  __entry->uid, __entry->gid, __entry->blocks)
+                  __entry->uid, __entry->gid,
+                  (unsigned long long) __entry->blocks)
 );
 
 TRACE_EVENT(ext4_request_inode,
@@ -189,7 +190,7 @@ TRACE_EVENT(ext4_journalled_write_end,
                   __entry->copied)
 );
 
-TRACE_EVENT(ext4_da_writepage,
+TRACE_EVENT(ext4_writepage,
         TP_PROTO(struct inode *inode, struct page *page),
 
         TP_ARGS(inode, page),
@@ -341,49 +342,6 @@ TRACE_EVENT(ext4_da_write_end,
                   __entry->copied)
 );
 
-TRACE_EVENT(ext4_normal_writepage,
-        TP_PROTO(struct inode *inode, struct page *page),
-
-        TP_ARGS(inode, page),
-
-        TP_STRUCT__entry(
-                __field(        dev_t,  dev                     )
-                __field(        ino_t,  ino                     )
-                __field(        pgoff_t, index                  )
-        ),
-
-        TP_fast_assign(
-                __entry->dev    = inode->i_sb->s_dev;
-                __entry->ino    = inode->i_ino;
-                __entry->index  = page->index;
-        ),
-
-        TP_printk("dev %s ino %lu page_index %lu",
-                  jbd2_dev_to_name(__entry->dev), __entry->ino, __entry->index)
-);
-
-TRACE_EVENT(ext4_journalled_writepage,
-        TP_PROTO(struct inode *inode, struct page *page),
-
-        TP_ARGS(inode, page),
-
-        TP_STRUCT__entry(
-                __field(        dev_t,  dev                     )
-                __field(        ino_t,  ino                     )
-                __field(        pgoff_t, index                  )
-
-        ),
-
-        TP_fast_assign(
-                __entry->dev    = inode->i_sb->s_dev;
-                __entry->ino    = inode->i_ino;
-                __entry->index  = page->index;
-        ),
-
-        TP_printk("dev %s ino %lu page_index %lu",
-                  jbd2_dev_to_name(__entry->dev), __entry->ino, __entry->index)
-);
-
 TRACE_EVENT(ext4_discard_blocks,
         TP_PROTO(struct super_block *sb, unsigned long long blk,
                         unsigned long long count),
diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
index b0c7ede55eb1..1cb0c3aa11e6 100644
--- a/include/trace/events/irq.h
+++ b/include/trace/events/irq.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM irq
+
 #if !defined(_TRACE_IRQ_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_IRQ_H
 
 #include <linux/tracepoint.h>
 #include <linux/interrupt.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM irq
-
 #define softirq_name(sirq) { sirq##_SOFTIRQ, #sirq }
 #define show_softirq_name(val)                  \
         __print_symbolic(val,                   \
diff --git a/include/trace/events/jbd2.h b/include/trace/events/jbd2.h
index 845b0b4b48fd..10813fa0c8d0 100644
--- a/include/trace/events/jbd2.h
+++ b/include/trace/events/jbd2.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM jbd2
+
 #if !defined(_TRACE_JBD2_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_JBD2_H
 
 #include <linux/jbd2.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM jbd2
-
 TRACE_EVENT(jbd2_checkpoint,
 
         TP_PROTO(journal_t *journal, int result),
diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
index 9baba50d6512..1493c541f9c4 100644
--- a/include/trace/events/kmem.h
+++ b/include/trace/events/kmem.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM kmem
+
 #if !defined(_TRACE_KMEM_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_KMEM_H
 
 #include <linux/types.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM kmem
-
 /*
  * The order of these masks is important. Matching masks will be seen
  * first and the left over flags will end up showing by themselves.
diff --git a/include/trace/events/lockdep.h b/include/trace/events/lockdep.h
index 0e956c9dfd7e..bcf1d209a00d 100644
--- a/include/trace/events/lockdep.h
+++ b/include/trace/events/lockdep.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM lockdep
+
 #if !defined(_TRACE_LOCKDEP_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_LOCKDEP_H
 
 #include <linux/lockdep.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM lockdep
-
 #ifdef CONFIG_LOCKDEP
 
 TRACE_EVENT(lock_acquire,
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index 24ab5bcff7b2..8949bb7eb082 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM sched
+
 #if !defined(_TRACE_SCHED_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_SCHED_H
 
 #include <linux/sched.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM sched
-
 /*
  * Tracepoint for calling kthread_stop, performed to end a kthread:
  */
diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
index 1e8fabb57c06..e499863b9669 100644
--- a/include/trace/events/skb.h
+++ b/include/trace/events/skb.h
@@ -1,12 +1,12 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM skb
+
 #if !defined(_TRACE_SKB_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_SKB_H
 
 #include <linux/skbuff.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM skb
-
 /*
  * Tracepoint for free an sk_buff:
  */
diff --git a/include/trace/events/workqueue.h b/include/trace/events/workqueue.h
index 035f1bff288e..fcfd9a1e4b96 100644
--- a/include/trace/events/workqueue.h
+++ b/include/trace/events/workqueue.h
@@ -1,3 +1,6 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM workqueue
+
 #if !defined(_TRACE_WORKQUEUE_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _TRACE_WORKQUEUE_H
 
@@ -5,9 +8,6 @@
 #include <linux/sched.h>
 #include <linux/tracepoint.h>
 
-#undef TRACE_SYSTEM
-#define TRACE_SYSTEM workqueue
-
 TRACE_EVENT(workqueue_insertion,
 
         TP_PROTO(struct task_struct *wq_thread, struct work_struct *work),
diff --git a/kernel/futex.c b/kernel/futex.c
index 794c862125fe..0672ff88f159 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -247,6 +247,7 @@ again:
         if (err < 0)
                 return err;
 
+        page = compound_head(page);
         lock_page(page);
         if (!page->mapping) {
                 unlock_page(page);
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 9002958a96e7..49da79ab8486 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -191,6 +191,46 @@ struct hrtimer_clock_base *lock_hrtimer_base(const struct hrtimer *timer,
         }
 }
 
+
+/*
+ * Get the preferred target CPU for NOHZ
+ */
+static int hrtimer_get_target(int this_cpu, int pinned)
+{
+#ifdef CONFIG_NO_HZ
+        if (!pinned && get_sysctl_timer_migration() && idle_cpu(this_cpu)) {
+                int preferred_cpu = get_nohz_load_balancer();
+
+                if (preferred_cpu >= 0)
+                        return preferred_cpu;
+        }
+#endif
+        return this_cpu;
+}
+
+/*
+ * With HIGHRES=y we do not migrate the timer when it is expiring
+ * before the next event on the target cpu because we cannot reprogram
+ * the target cpu hardware and we would cause it to fire late.
+ *
+ * Called with cpu_base->lock of target cpu held.
+ */
+static int
+hrtimer_check_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base)
+{
+#ifdef CONFIG_HIGH_RES_TIMERS
+        ktime_t expires;
+
+        if (!new_base->cpu_base->hres_active)
+                return 0;
+
+        expires = ktime_sub(hrtimer_get_expires(timer), new_base->offset);
+        return expires.tv64 <= new_base->cpu_base->expires_next.tv64;
+#else
+        return 0;
+#endif
+}
+
 /*
  * Switch the timer base to the current CPU when possible.
  */
@@ -200,16 +240,8 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base,
 {
         struct hrtimer_clock_base *new_base;
         struct hrtimer_cpu_base *new_cpu_base;
-        int cpu, preferred_cpu = -1;
-
-        cpu = smp_processor_id();
-#if defined(CONFIG_NO_HZ) && defined(CONFIG_SMP)
-        if (!pinned && get_sysctl_timer_migration() && idle_cpu(cpu)) {
-                preferred_cpu = get_nohz_load_balancer();
-                if (preferred_cpu >= 0)
-                        cpu = preferred_cpu;
-        }
-#endif
+        int this_cpu = smp_processor_id();
+        int cpu = hrtimer_get_target(this_cpu, pinned);
 
 again:
         new_cpu_base = &per_cpu(hrtimer_bases, cpu);
@@ -217,7 +249,7 @@ again:
 
         if (base != new_base) {
                 /*
-                 * We are trying to schedule the timer on the local CPU.
+                 * We are trying to move timer to new_base.
                  * However we can't change timer's base while it is running,
                  * so we keep it on the same CPU. No hassle vs. reprogramming
                  * the event source in the high resolution case. The softirq
@@ -233,38 +265,12 @@ again:
                 spin_unlock(&base->cpu_base->lock);
                 spin_lock(&new_base->cpu_base->lock);
 
-                /* Optimized away for NOHZ=n SMP=n */
-                if (cpu == preferred_cpu) {
-                        /* Calculate clock monotonic expiry time */
-#ifdef CONFIG_HIGH_RES_TIMERS
-                        ktime_t expires = ktime_sub(hrtimer_get_expires(timer),
-                                                        new_base->offset);
-#else
-                        ktime_t expires = hrtimer_get_expires(timer);
-#endif
-
-                        /*
-                         * Get the next event on target cpu from the
-                         * clock events layer.
-                         * This covers the highres=off nohz=on case as well.
-                         */
-                        ktime_t next = clockevents_get_next_event(cpu);
-
-                        ktime_t delta = ktime_sub(expires, next);
-
-                        /*
-                         * We do not migrate the timer when it is expiring
-                         * before the next event on the target cpu because
-                         * we cannot reprogram the target cpu hardware and
-                         * we would cause it to fire late.
-                         */
-                        if (delta.tv64 < 0) {
-                                cpu = smp_processor_id();
-                                spin_unlock(&new_base->cpu_base->lock);
-                                spin_lock(&base->cpu_base->lock);
-                                timer->base = base;
-                                goto again;
-                        }
+                if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
+                        cpu = this_cpu;
+                        spin_unlock(&new_base->cpu_base->lock);
+                        spin_lock(&base->cpu_base->lock);
+                        timer->base = base;
+                        goto again;
                 }
                 timer->base = new_base;
         }
@@ -1276,14 +1282,22 @@ void hrtimer_interrupt(struct clock_event_device *dev)
 
         expires_next.tv64 = KTIME_MAX;
 
+        spin_lock(&cpu_base->lock);
+        /*
+         * We set expires_next to KTIME_MAX here with cpu_base->lock
+         * held to prevent that a timer is enqueued in our queue via
+         * the migration code. This does not affect enqueueing of
+         * timers which run their callback and need to be requeued on
+         * this CPU.
+         */
+        cpu_base->expires_next.tv64 = KTIME_MAX;
+
         base = cpu_base->clock_base;
 
         for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
                 ktime_t basenow;
                 struct rb_node *node;
 
-                spin_lock(&cpu_base->lock);
-
                 basenow = ktime_add(now, base->offset);
 
                 while ((node = base->first)) {
@@ -1316,11 +1330,15 @@ void hrtimer_interrupt(struct clock_event_device *dev)
 
                         __run_hrtimer(timer);
                 }
-                spin_unlock(&cpu_base->lock);
                 base++;
         }
 
+        /*
+         * Store the new expiry value so the migration code can verify
+         * against it.
+         */
         cpu_base->expires_next = expires_next;
+        spin_unlock(&cpu_base->lock);
 
         /* Reprogramming necessary ? */
         if (expires_next.tv64 != KTIME_MAX) {
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index c0fa54b276d9..16b5739c516a 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -237,13 +237,9 @@ static int __kprobes collect_garbage_slots(void)
 {
         struct kprobe_insn_page *kip;
         struct hlist_node *pos, *next;
-        int safety;
 
         /* Ensure no-one is preepmted on the garbages */
-        mutex_unlock(&kprobe_insn_mutex);
-        safety = check_safety();
-        mutex_lock(&kprobe_insn_mutex);
-        if (safety != 0)
+        if (check_safety())
                 return -EAGAIN;
 
         hlist_for_each_entry_safe(kip, pos, next, &kprobe_insn_pages, hlist) {
diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c
index a641eb753b8c..7bc888dfd06a 100644
--- a/kernel/perf_counter.c
+++ b/kernel/perf_counter.c
@@ -2665,6 +2665,7 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
                 header.size += sizeof(cpu_entry);
 
                 cpu_entry.cpu = raw_smp_processor_id();
+                cpu_entry.reserved = 0;
         }
 
         if (sample_type & PERF_SAMPLE_PERIOD)
diff --git a/kernel/pid.c b/kernel/pid.c
index 5fa1db48d8b7..31310b5d3f50 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -36,7 +36,6 @@
 #include <linux/pid_namespace.h>
 #include <linux/init_task.h>
 #include <linux/syscalls.h>
-#include <linux/kmemleak.h>
 
 #define pid_hashfn(nr, ns)      \
         hash_long((unsigned long)nr + (unsigned long)ns, pidhash_shift)
@@ -513,12 +512,6 @@ void __init pidhash_init(void)
         pid_hash = alloc_bootmem(pidhash_size * sizeof(*(pid_hash)));
         if (!pid_hash)
                 panic("Could not alloc pidhash!\n");
-        /*
-         * pid_hash contains references to allocated struct pid objects and it
-         * must be scanned by kmemleak to avoid false positives.
-         */
-        kmemleak_alloc(pid_hash, pidhash_size * sizeof(*(pid_hash)), 0,
-                       GFP_KERNEL);
         for (i = 0; i < pidhash_size; i++)
                 INIT_HLIST_HEAD(&pid_hash[i]);
 }
diff --git a/kernel/power/user.c b/kernel/power/user.c
index ed97375daae9..bf0014d6a5f0 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -23,7 +23,6 @@
 #include <linux/console.h>
 #include <linux/cpu.h>
 #include <linux/freezer.h>
-#include <linux/smp_lock.h>
 #include <scsi/scsi_scan.h>
 
 #include <asm/uaccess.h>
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 0dccfbba6d26..7717b95c2027 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -1533,7 +1533,7 @@ void __init __rcu_init(void)
         int j;
         struct rcu_node *rnp;
 
-        printk(KERN_WARNING "Experimental hierarchical RCU implementation.\n");
+        printk(KERN_INFO "Hierarchical RCU implementation.\n");
 #ifdef CONFIG_RCU_CPU_STALL_DETECTOR
         printk(KERN_INFO "RCU-based detection of stalled CPUs is enabled.\n");
 #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
@@ -1546,7 +1546,6 @@ void __init __rcu_init(void)
                 rcu_cpu_notify(&rcu_nb, CPU_UP_PREPARE, (void *)(long)i);
         /* Register notifier for non-boot CPUs */
         register_cpu_notifier(&rcu_nb);
-        printk(KERN_WARNING "Experimental hierarchical RCU init done.\n");
 }
 
 module_param(blimit, int, 0);
diff --git a/kernel/sched.c b/kernel/sched.c
index 7c9098d186e6..98972d366fdc 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -493,6 +493,7 @@ struct rt_rq {
 #endif
 #ifdef CONFIG_SMP
         unsigned long rt_nr_migratory;
+        unsigned long rt_nr_total;
         int overloaded;
         struct plist_head pushable_tasks;
 #endif
@@ -2571,15 +2572,37 @@ static void __sched_fork(struct task_struct *p)
         p->se.avg_wakeup                = sysctl_sched_wakeup_granularity;
 
 #ifdef CONFIG_SCHEDSTATS
-        p->se.wait_start                = 0;
-        p->se.sum_sleep_runtime         = 0;
-        p->se.sleep_start               = 0;
-        p->se.block_start               = 0;
-        p->se.sleep_max                 = 0;
-        p->se.block_max                 = 0;
-        p->se.exec_max                  = 0;
-        p->se.slice_max                 = 0;
-        p->se.wait_max                  = 0;
+        p->se.wait_start                        = 0;
+        p->se.wait_max                          = 0;
+        p->se.wait_count                        = 0;
+        p->se.wait_sum                          = 0;
+
+        p->se.sleep_start                       = 0;
+        p->se.sleep_max                         = 0;
+        p->se.sum_sleep_runtime                 = 0;
+
+        p->se.block_start                       = 0;
+        p->se.block_max                         = 0;
+        p->se.exec_max                          = 0;
+        p->se.slice_max                         = 0;
+
+        p->se.nr_migrations_cold                = 0;
+        p->se.nr_failed_migrations_affine       = 0;
+        p->se.nr_failed_migrations_running      = 0;
+        p->se.nr_failed_migrations_hot          = 0;
+        p->se.nr_forced_migrations              = 0;
+        p->se.nr_forced2_migrations             = 0;
+
+        p->se.nr_wakeups                        = 0;
+        p->se.nr_wakeups_sync                   = 0;
+        p->se.nr_wakeups_migrate                = 0;
+        p->se.nr_wakeups_local                  = 0;
+        p->se.nr_wakeups_remote                 = 0;
+        p->se.nr_wakeups_affine                 = 0;
+        p->se.nr_wakeups_affine_attempts        = 0;
+        p->se.nr_wakeups_passive                = 0;
+        p->se.nr_wakeups_idle                   = 0;
+
 #endif
 
         INIT_LIST_HEAD(&p->rt.run_list);
@@ -6541,6 +6564,11 @@ SYSCALL_DEFINE0(sched_yield)
         return 0;
 }
 
+static inline int should_resched(void)
+{
+        return need_resched() && !(preempt_count() & PREEMPT_ACTIVE);
+}
+
 static void __cond_resched(void)
 {
 #ifdef CONFIG_DEBUG_SPINLOCK_SLEEP
@@ -6560,8 +6588,7 @@ static void __cond_resched(void)
 
 int __sched _cond_resched(void)
 {
-        if (need_resched() && !(preempt_count() & PREEMPT_ACTIVE) &&
-                                        system_state == SYSTEM_RUNNING) {
+        if (should_resched()) {
                 __cond_resched();
                 return 1;
         }
@@ -6579,12 +6606,12 @@ EXPORT_SYMBOL(_cond_resched);
  */
 int cond_resched_lock(spinlock_t *lock)
 {
-        int resched = need_resched() && system_state == SYSTEM_RUNNING;
+        int resched = should_resched();
         int ret = 0;
 
         if (spin_needbreak(lock) || resched) {
                 spin_unlock(lock);
-                if (resched && need_resched())
+                if (resched)
                         __cond_resched();
                 else
                         cpu_relax();
@@ -6599,7 +6626,7 @@ int __sched cond_resched_softirq(void)
 {
         BUG_ON(!in_softirq());
 
-        if (need_resched() && system_state == SYSTEM_RUNNING) {
+        if (should_resched()) {
                 local_bh_enable();
                 __cond_resched();
                 local_bh_disable();
@@ -9070,7 +9097,7 @@ static void init_rt_rq(struct rt_rq *rt_rq, struct rq *rq)
 #ifdef CONFIG_SMP
         rt_rq->rt_nr_migratory = 0;
         rt_rq->overloaded = 0;
-        plist_head_init(&rq->rt.pushable_tasks, &rq->lock);
+        plist_head_init(&rt_rq->pushable_tasks, &rq->lock);
 #endif
 
         rt_rq->rt_time = 0;
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index ba7fd6e9556f..7c248dc30f41 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -687,7 +687,8 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
                          * all of which have the same weight.
                          */
                         if (sched_feat(NORMALIZED_SLEEPER) &&
-                                        task_of(se)->policy != SCHED_IDLE)
+                                        (!entity_is_task(se) ||
+                                         task_of(se)->policy != SCHED_IDLE))
                                 thresh = calc_delta_fair(thresh, se);
 
                         vruntime -= thresh;
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index 9bf0d2a73045..3918e01994e0 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -10,6 +10,8 @@ static inline struct task_struct *rt_task_of(struct sched_rt_entity *rt_se)
 
 #ifdef CONFIG_RT_GROUP_SCHED
 
+#define rt_entity_is_task(rt_se) (!(rt_se)->my_q)
+
 static inline struct rq *rq_of_rt_rq(struct rt_rq *rt_rq)
 {
         return rt_rq->rq;
@@ -22,6 +24,8 @@ static inline struct rt_rq *rt_rq_of_se(struct sched_rt_entity *rt_se)
 
 #else /* CONFIG_RT_GROUP_SCHED */
 
+#define rt_entity_is_task(rt_se) (1)
+
 static inline struct rq *rq_of_rt_rq(struct rt_rq *rt_rq)
 {
         return container_of(rt_rq, struct rq, rt);
@@ -73,7 +77,7 @@ static inline void rt_clear_overload(struct rq *rq)
 
 static void update_rt_migration(struct rt_rq *rt_rq)
 {
-        if (rt_rq->rt_nr_migratory && (rt_rq->rt_nr_running > 1)) {
+        if (rt_rq->rt_nr_migratory && rt_rq->rt_nr_total > 1) {
                 if (!rt_rq->overloaded) {
                         rt_set_overload(rq_of_rt_rq(rt_rq));
                         rt_rq->overloaded = 1;
@@ -86,6 +90,12 @@ static void update_rt_migration(struct rt_rq *rt_rq)
 
 static void inc_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq)
 {
+        if (!rt_entity_is_task(rt_se))
+                return;
+
+        rt_rq = &rq_of_rt_rq(rt_rq)->rt;
+
+        rt_rq->rt_nr_total++;
         if (rt_se->nr_cpus_allowed > 1)
                 rt_rq->rt_nr_migratory++;
 
@@ -94,6 +104,12 @@ static void inc_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq)
 
 static void dec_rt_migration(struct sched_rt_entity *rt_se, struct rt_rq *rt_rq)
 {
+        if (!rt_entity_is_task(rt_se))
+                return;
+
+        rt_rq = &rq_of_rt_rq(rt_rq)->rt;
+
+        rt_rq->rt_nr_total--;
         if (rt_se->nr_cpus_allowed > 1)
                 rt_rq->rt_nr_migratory--;
 
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 1ad6dd461119..a6dcd67b041d 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -254,15 +254,4 @@ void clockevents_notify(unsigned long reason, void *arg)
         spin_unlock(&clockevents_lock);
 }
 EXPORT_SYMBOL_GPL(clockevents_notify);
-
-ktime_t clockevents_get_next_event(int cpu)
-{
-        struct tick_device *td;
-        struct clock_event_device *dev;
-
-        td = &per_cpu(tick_cpu_device, cpu);
-        dev = td->evtdev;
-
-        return dev->next_event;
-}
 #endif
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 1551f47e7669..019f380fd764 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -226,13 +226,13 @@ config BOOT_TRACER
           the timings of the initcalls and traces key events and the identity
           of tasks that can cause boot delays, such as context-switches.
 
-          Its aim is to be parsed by the /scripts/bootgraph.pl tool to
+          Its aim is to be parsed by the scripts/bootgraph.pl tool to
           produce pretty graphics about boot inefficiencies, giving a visual
           representation of the delays during initcalls - but the raw
           /debug/tracing/trace text output is readable too.
 
-          You must pass in ftrace=initcall to the kernel command line
-          to enable this on bootup.
+          You must pass in initcall_debug and ftrace=initcall to the kernel
+          command line to enable this on bootup.
 
 config TRACE_BRANCH_PROFILING
         bool
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 39af8af6fc30..1090b0aed9ba 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -22,6 +22,7 @@
 #include <linux/init.h>
 #include <linux/mutex.h>
 #include <linux/debugfs.h>
+#include <linux/smp_lock.h>
 #include <linux/time.h>
 #include <linux/uaccess.h>
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index f3716bf04df6..4521c77d1a1a 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -768,7 +768,7 @@ static struct tracer_stat function_stats __initdata = {
         .stat_show      = function_stat_show
 };
 
-static void ftrace_profile_debugfs(struct dentry *d_tracer)
+static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
 {
         struct ftrace_profile_stat *stat;
         struct dentry *entry;
@@ -786,7 +786,6 @@ static void ftrace_profile_debugfs(struct dentry *d_tracer)
                          * The files created are permanent, if something happens
                          * we still do not free memory.
                          */
-                        kfree(stat);
                         WARN(1,
                              "Could not allocate stat file for cpu %d\n",
                              cpu);
@@ -813,7 +812,7 @@ static void ftrace_profile_debugfs(struct dentry *d_tracer)
 }
 
 #else /* CONFIG_FUNCTION_PROFILER */
-static void ftrace_profile_debugfs(struct dentry *d_tracer)
+static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
 {
 }
 #endif /* CONFIG_FUNCTION_PROFILER */
@@ -3160,10 +3159,10 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
 
         ret  = proc_dointvec(table, write, file, buffer, lenp, ppos);
 
-        if (ret || !write || (last_ftrace_enabled == ftrace_enabled))
+        if (ret || !write || (last_ftrace_enabled == !!ftrace_enabled))
                 goto out;
 
-        last_ftrace_enabled = ftrace_enabled;
+        last_ftrace_enabled = !!ftrace_enabled;
 
         if (ftrace_enabled) {
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 3aa0a0dfdfa8..8bc8d8afea6a 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -17,6 +17,7 @@
 #include <linux/writeback.h>
 #include <linux/kallsyms.h>
 #include <linux/seq_file.h>
+#include <linux/smp_lock.h>
 #include <linux/notifier.h>
 #include <linux/irqflags.h>
 #include <linux/debugfs.h>
diff --git a/kernel/trace/trace_event_types.h b/kernel/trace/trace_event_types.h
index 5e32e375134d..6db005e12487 100644
--- a/kernel/trace/trace_event_types.h
+++ b/kernel/trace/trace_event_types.h
@@ -26,6 +26,9 @@ TRACE_EVENT_FORMAT(funcgraph_exit, TRACE_GRAPH_RET,
                    ftrace_graph_ret_entry, ignore,
         TRACE_STRUCT(
                 TRACE_FIELD(unsigned long, ret.func, func)
+                TRACE_FIELD(unsigned long long, ret.calltime, calltime)
+                TRACE_FIELD(unsigned long long, ret.rettime, rettime)
+                TRACE_FIELD(unsigned long, ret.overrun, overrun)
                 TRACE_FIELD(int, ret.depth, depth)
         ),
         TP_RAW_FMT("<-- %lx (%d)")
diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
index 7402144bff21..75ef000613c3 100644
--- a/kernel/trace/trace_functions.c
+++ b/kernel/trace/trace_functions.c
@@ -363,7 +363,7 @@ ftrace_trace_onoff_callback(char *glob, char *cmd, char *param, int enable)
  out_reg:
         ret = register_ftrace_function_probe(glob, ops, count);
 
-        return ret;
+        return ret < 0 ? ret : 0;
 }
 
 static struct ftrace_func_command ftrace_traceon_cmd = {
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index 7938f3ae93e3..e0c2545622e8 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -27,8 +27,7 @@ void trace_print_seq(struct seq_file *m, struct trace_seq *s)
 {
         int len = s->len >= PAGE_SIZE ? PAGE_SIZE - 1 : s->len;
 
-        s->buffer[len] = 0;
-        seq_puts(m, s->buffer);
+        seq_write(m, s->buffer, len);
 
         trace_seq_init(s);
 }
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 2d7aebd71dbd..e644af910124 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -326,10 +326,10 @@ stack_trace_sysctl(struct ctl_table *table, int write,
         ret = proc_dointvec(table, write, file, buffer, lenp, ppos);
 
         if (ret || !write ||
-            (last_stack_tracer_enabled == stack_tracer_enabled))
+            (last_stack_tracer_enabled == !!stack_tracer_enabled))
                 goto out;
 
-        last_stack_tracer_enabled = stack_tracer_enabled;
+        last_stack_tracer_enabled = !!stack_tracer_enabled;
 
         if (stack_tracer_enabled)
                 register_ftrace_function(&trace_ops);
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 3b93129a968c..65b0d99b6d0a 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -716,7 +716,7 @@ void dma_debug_init(u32 num_entries)
 
         for (i = 0; i < HASH_SIZE; ++i) {
                 INIT_LIST_HEAD(&dma_entry_hash[i].list);
-                dma_entry_hash[i].lock = SPIN_LOCK_UNLOCKED;
+                spin_lock_init(&dma_entry_hash[i].lock);
         }
 
         if (dma_debug_fs_init() != 0) {
@@ -856,22 +856,21 @@ static void check_for_stack(struct device *dev, void *addr)
                                 "stack [addr=%p]\n", addr);
 }
 
-static inline bool overlap(void *addr, u64 size, void *start, void *end)
+static inline bool overlap(void *addr, unsigned long len, void *start, void *end)
 {
-        void *addr2 = (char *)addr + size;
+        unsigned long a1 = (unsigned long)addr;
+        unsigned long b1 = a1 + len;
+        unsigned long a2 = (unsigned long)start;
+        unsigned long b2 = (unsigned long)end;
 
-        return ((addr >= start && addr < end) ||
-                (addr2 >= start && addr2 < end) ||
-                ((addr < start) && (addr2 >= end)));
+        return !(b1 <= a2 || a1 >= b2);
 }
 
-static void check_for_illegal_area(struct device *dev, void *addr, u64 size)
+static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
 {
-        if (overlap(addr, size, _text, _etext) ||
-            overlap(addr, size, __start_rodata, __end_rodata))
-                err_printk(dev, NULL, "DMA-API: device driver maps "
-                                "memory from kernel text or rodata "
-                                "[addr=%p] [size=%llu]\n", addr, size);
+        if (overlap(addr, len, _text, _etext) ||
+            overlap(addr, len, __start_rodata, __end_rodata))
+                err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
 }
 
 static void check_sync(struct device *dev,
@@ -969,7 +968,8 @@ void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,
                 entry->type = dma_debug_single;
 
         if (!PageHighMem(page)) {
-                void *addr = ((char *)page_address(page)) + offset;
+                void *addr = page_address(page) + offset;
+
                 check_for_stack(dev, addr);
                 check_for_illegal_area(dev, addr, size);
         }
diff --git a/mm/bootmem.c b/mm/bootmem.c
index d2a9ce952768..701740c9e81b 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -12,6 +12,7 @@
 #include <linux/pfn.h>
 #include <linux/bootmem.h>
 #include <linux/module.h>
+#include <linux/kmemleak.h>
 
 #include <asm/bug.h>
 #include <asm/io.h>
@@ -335,6 +336,8 @@ void __init free_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
 {
         unsigned long start, end;
 
+        kmemleak_free_part(__va(physaddr), size);
+
         start = PFN_UP(physaddr);
         end = PFN_DOWN(physaddr + size);
 
@@ -354,6 +357,8 @@ void __init free_bootmem(unsigned long addr, unsigned long size)
 {
         unsigned long start, end;
 
+        kmemleak_free_part(__va(addr), size);
+
         start = PFN_UP(addr);
         end = PFN_DOWN(addr + size);
 
@@ -516,6 +521,7 @@ find_block:
                 region = phys_to_virt(PFN_PHYS(bdata->node_min_pfn) +
                                 start_off);
                 memset(region, 0, size);
+                kmemleak_alloc(region, size, 1, 0);
                 return region;
         }
 
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index e766e1da09d2..5aabd41ffb8f 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -103,10 +103,10 @@
  * Kmemleak configuration and common defines.
  */
 #define MAX_TRACE               16      /* stack trace length */
-#define REPORTS_NR              50      /* maximum number of reported leaks */
 #define MSECS_MIN_AGE           5000    /* minimum object age for reporting */
 #define SECS_FIRST_SCAN         60      /* delay before the first scan */
 #define SECS_SCAN_WAIT          600     /* subsequent auto scanning delay */
+#define GRAY_LIST_PASSES        25      /* maximum number of gray list scans */
 
 #define BYTES_PER_POINTER       sizeof(void *)
 
@@ -158,6 +158,8 @@ struct kmemleak_object {
 #define OBJECT_REPORTED         (1 << 1)
 /* flag set to not scan the object */
 #define OBJECT_NO_SCAN          (1 << 2)
+/* flag set on newly allocated objects */
+#define OBJECT_NEW              (1 << 3)
 
 /* the list of all allocated objects */
 static LIST_HEAD(object_list);
@@ -196,9 +198,6 @@ static int kmemleak_stack_scan = 1;
 /* protects the memory scanning, parameters and debug/kmemleak file access */
 static DEFINE_MUTEX(scan_mutex);
 
-/* number of leaks reported (for limitation purposes) */
-static int reported_leaks;
-
 /*
  * Early object allocation/freeing logging. Kmemleak is initialized after the
  * kernel allocator. However, both the kernel allocator and kmemleak may
@@ -211,6 +210,7 @@ static int reported_leaks;
 enum {
         KMEMLEAK_ALLOC,
         KMEMLEAK_FREE,
+        KMEMLEAK_FREE_PART,
         KMEMLEAK_NOT_LEAK,
         KMEMLEAK_IGNORE,
         KMEMLEAK_SCAN_AREA,
@@ -274,6 +274,11 @@ static int color_gray(const struct kmemleak_object *object)
         return object->min_count != -1 && object->count >= object->min_count;
 }
 
+static int color_black(const struct kmemleak_object *object)
+{
+        return object->min_count == -1;
+}
+
 /*
  * Objects are considered unreferenced only if their color is white, they have
  * not be deleted and have a minimum age to avoid false positives caused by
@@ -451,7 +456,7 @@ static void create_object(unsigned long ptr, size_t size, int min_count,
         INIT_HLIST_HEAD(&object->area_list);
         spin_lock_init(&object->lock);
         atomic_set(&object->use_count, 1);
-        object->flags = OBJECT_ALLOCATED;
+        object->flags = OBJECT_ALLOCATED | OBJECT_NEW;
         object->pointer = ptr;
         object->size = size;
         object->min_count = min_count;
@@ -519,27 +524,17 @@ out:
  * Remove the metadata (struct kmemleak_object) for a memory block from the
  * object_list and object_tree_root and decrement its use_count.
  */
-static void delete_object(unsigned long ptr)
+static void __delete_object(struct kmemleak_object *object)
 {
         unsigned long flags;
-        struct kmemleak_object *object;
 
         write_lock_irqsave(&kmemleak_lock, flags);
-        object = lookup_object(ptr, 0);
-        if (!object) {
-#ifdef DEBUG
-                kmemleak_warn("Freeing unknown object at 0x%08lx\n",
-                              ptr);
-#endif
-                write_unlock_irqrestore(&kmemleak_lock, flags);
-                return;
-        }
         prio_tree_remove(&object_tree_root, &object->tree_node);
         list_del_rcu(&object->object_list);
         write_unlock_irqrestore(&kmemleak_lock, flags);
 
         WARN_ON(!(object->flags & OBJECT_ALLOCATED));
-        WARN_ON(atomic_read(&object->use_count) < 1);
+        WARN_ON(atomic_read(&object->use_count) < 2);
 
         /*
          * Locking here also ensures that the corresponding memory block
@@ -552,6 +547,64 @@ static void delete_object(unsigned long ptr)
 }
 
 /*
+ * Look up the metadata (struct kmemleak_object) corresponding to ptr and
+ * delete it.
+ */
+static void delete_object_full(unsigned long ptr)
+{
+        struct kmemleak_object *object;
+
+        object = find_and_get_object(ptr, 0);
+        if (!object) {
+#ifdef DEBUG
+                kmemleak_warn("Freeing unknown object at 0x%08lx\n",
+                              ptr);
+#endif
+                return;
+        }
+        __delete_object(object);
+        put_object(object);
+}
+
+/*
+ * Look up the metadata (struct kmemleak_object) corresponding to ptr and
+ * delete it. If the memory block is partially freed, the function may create
+ * additional metadata for the remaining parts of the block.
+ */
+static void delete_object_part(unsigned long ptr, size_t size)
+{
+        struct kmemleak_object *object;
+        unsigned long start, end;
+
+        object = find_and_get_object(ptr, 1);
+        if (!object) {
+#ifdef DEBUG
+                kmemleak_warn("Partially freeing unknown object at 0x%08lx "
+                              "(size %zu)\n", ptr, size);
+#endif
+                return;
+        }
+        __delete_object(object);
+
+        /*
+         * Create one or two objects that may result from the memory block
+         * split. Note that partial freeing is only done by free_bootmem() and
+         * this happens before kmemleak_init() is called. The path below is
+         * only executed during early log recording in kmemleak_init(), so
+         * GFP_KERNEL is enough.
+         */
+        start = object->pointer;
+        end = object->pointer + object->size;
+        if (ptr > start)
+                create_object(start, ptr - start, object->min_count,
+                              GFP_KERNEL);
+        if (ptr + size < end)
+                create_object(ptr + size, end - ptr - size, object->min_count,
+                              GFP_KERNEL);
+
+        put_object(object);
+}
+/*
  * Make a object permanently as gray-colored so that it can no longer be
  * reported as a leak. This is used in general to mark a false positive.
  */
@@ -715,13 +768,28 @@ void kmemleak_free(const void *ptr)
         pr_debug("%s(0x%p)\n", __func__, ptr);
 
         if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr))
-                delete_object((unsigned long)ptr);
+                delete_object_full((unsigned long)ptr);
         else if (atomic_read(&kmemleak_early_log))
                 log_early(KMEMLEAK_FREE, ptr, 0, 0, 0, 0);
 }
 EXPORT_SYMBOL_GPL(kmemleak_free);
 
 /*
+ * Partial memory freeing function callback. This function is usually called
+ * from bootmem allocator when (part of) a memory block is freed.
+ */
+void kmemleak_free_part(const void *ptr, size_t size)
+{
+        pr_debug("%s(0x%p)\n", __func__, ptr);
+
+        if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr))
+                delete_object_part((unsigned long)ptr, size);
+        else if (atomic_read(&kmemleak_early_log))
+                log_early(KMEMLEAK_FREE_PART, ptr, size, 0, 0, 0);
+}
+EXPORT_SYMBOL_GPL(kmemleak_free_part);
+
+/*
  * Mark an already allocated memory block as a false positive. This will cause
  * the block to no longer be reported as leak and always be scanned.
  */
@@ -807,7 +875,7 @@ static int scan_should_stop(void)
  * found to the gray list.
  */
 static void scan_block(void *_start, void *_end,
-                       struct kmemleak_object *scanned)
+                       struct kmemleak_object *scanned, int allow_resched)
 {
         unsigned long *ptr;
         unsigned long *start = PTR_ALIGN(_start, BYTES_PER_POINTER);
@@ -818,6 +886,8 @@ static void scan_block(void *_start, void *_end,
                 unsigned long pointer = *ptr;
                 struct kmemleak_object *object;
 
+                if (allow_resched)
+                        cond_resched();
                 if (scan_should_stop())
                         break;
 
@@ -881,12 +951,12 @@ static void scan_object(struct kmemleak_object *object)
                 goto out;
         if (hlist_empty(&object->area_list))
                 scan_block((void *)object->pointer,
-                           (void *)(object->pointer + object->size), object);
+                           (void *)(object->pointer + object->size), object, 0);
         else
                 hlist_for_each_entry(area, elem, &object->area_list, node)
                         scan_block((void *)(object->pointer + area->offset),
                                    (void *)(object->pointer + area->offset
-                                            + area->length), object);
+                                            + area->length), object, 0);
 out:
         spin_unlock_irqrestore(&object->lock, flags);
 }
@@ -903,6 +973,7 @@ static void kmemleak_scan(void)
         struct task_struct *task;
         int i;
         int new_leaks = 0;
+        int gray_list_pass = 0;
 
         jiffies_last_scan = jiffies;
 
@@ -923,6 +994,7 @@ static void kmemleak_scan(void)
 #endif
                 /* reset the reference count (whiten the object) */
                 object->count = 0;
+                object->flags &= ~OBJECT_NEW;
                 if (color_gray(object) && get_object(object))
                         list_add_tail(&object->gray_list, &gray_list);
 
@@ -931,14 +1003,14 @@ static void kmemleak_scan(void)
         rcu_read_unlock();
 
         /* data/bss scanning */
-        scan_block(_sdata, _edata, NULL);
-        scan_block(__bss_start, __bss_stop, NULL);
+        scan_block(_sdata, _edata, NULL, 1);
+        scan_block(__bss_start, __bss_stop, NULL, 1);
 
 #ifdef CONFIG_SMP
         /* per-cpu sections scanning */
         for_each_possible_cpu(i)
                 scan_block(__per_cpu_start + per_cpu_offset(i),
-                           __per_cpu_end + per_cpu_offset(i), NULL);
+                           __per_cpu_end + per_cpu_offset(i), NULL, 1);
 #endif
 
         /*
@@ -960,7 +1032,7 @@ static void kmemleak_scan(void)
                         /* only scan if page is in use */
                         if (page_count(page) == 0)
                                 continue;
-                        scan_block(page, page + 1, NULL);
+                        scan_block(page, page + 1, NULL, 1);
                 }
         }
 
@@ -972,7 +1044,8 @@ static void kmemleak_scan(void)
                 read_lock(&tasklist_lock);
                 for_each_process(task)
                         scan_block(task_stack_page(task),
-                                   task_stack_page(task) + THREAD_SIZE, NULL);
+                                   task_stack_page(task) + THREAD_SIZE,
+                                   NULL, 0);
                 read_unlock(&tasklist_lock);
         }
 
@@ -984,6 +1057,7 @@ static void kmemleak_scan(void)
          * kmemleak objects cannot be freed from outside the loop because their
          * use_count was increased.
          */
+repeat:
         object = list_entry(gray_list.next, typeof(*object), gray_list);
         while (&object->gray_list != &gray_list) {
                 cond_resched();
@@ -1001,12 +1075,38 @@ static void kmemleak_scan(void)
 
                 object = tmp;
         }
+
+        if (scan_should_stop() || ++gray_list_pass >= GRAY_LIST_PASSES)
+                goto scan_end;
+
+        /*
+         * Check for new objects allocated during this scanning and add them
+         * to the gray list.
+         */
+        rcu_read_lock();
+        list_for_each_entry_rcu(object, &object_list, object_list) {
+                spin_lock_irqsave(&object->lock, flags);
+                if ((object->flags & OBJECT_NEW) && !color_black(object) &&
+                    get_object(object)) {
+                        object->flags &= ~OBJECT_NEW;
+                        list_add_tail(&object->gray_list, &gray_list);
+                }
+                spin_unlock_irqrestore(&object->lock, flags);
+        }
+        rcu_read_unlock();
+
+        if (!list_empty(&gray_list))
+                goto repeat;
+
+scan_end:
         WARN_ON(!list_empty(&gray_list));
 
         /*
-         * If scanning was stopped do not report any new unreferenced objects.
+         * If scanning was stopped or new objects were being allocated at a
+         * higher rate than gray list scanning, do not report any new
+         * unreferenced objects.
          */
-        if (scan_should_stop())
+        if (scan_should_stop() || gray_list_pass >= GRAY_LIST_PASSES)
                 return;
 
         /*
@@ -1039,6 +1139,7 @@ static int kmemleak_scan_thread(void *arg)
         static int first_run = 1;
 
         pr_info("Automatic memory scanning thread started\n");
+        set_user_nice(current, 10);
 
         /*
          * Wait before the first scan to allow the system to fully initialize.
@@ -1101,11 +1202,11 @@ static void *kmemleak_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct kmemleak_object *object;
         loff_t n = *pos;
+        int err;
 
-        if (!n)
-                reported_leaks = 0;
-        if (reported_leaks >= REPORTS_NR)
-                return NULL;
+        err = mutex_lock_interruptible(&scan_mutex);
+        if (err < 0)
+                return ERR_PTR(err);
 
         rcu_read_lock();
         list_for_each_entry_rcu(object, &object_list, object_list) {
@@ -1131,8 +1232,6 @@ static void *kmemleak_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         struct list_head *n = &prev_obj->object_list;
 
         ++(*pos);
-        if (reported_leaks >= REPORTS_NR)
-                goto out;
 
         rcu_read_lock();
         list_for_each_continue_rcu(n, &object_list) {
@@ -1141,7 +1240,7 @@ static void *kmemleak_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                         break;
         }
         rcu_read_unlock();
-out:
+
         put_object(prev_obj);
         return next_obj;
 }
@@ -1151,8 +1250,15 @@ out:
  */
 static void kmemleak_seq_stop(struct seq_file *seq, void *v)
 {
-        if (v)
-                put_object(v);
+        if (!IS_ERR(v)) {
+                /*
+                 * kmemleak_seq_start may return ERR_PTR if the scan_mutex
+                 * waiting was interrupted, so only release it if !IS_ERR.
+                 */
+                mutex_unlock(&scan_mutex);
+                if (v)
+                        put_object(v);
+        }
 }
 
 /*
@@ -1164,10 +1270,8 @@ static int kmemleak_seq_show(struct seq_file *seq, void *v)
         unsigned long flags;
 
         spin_lock_irqsave(&object->lock, flags);
-        if ((object->flags & OBJECT_REPORTED) && unreferenced_object(object)) {
+        if ((object->flags & OBJECT_REPORTED) && unreferenced_object(object))
                 print_unreferenced(seq, object);
-                reported_leaks++;
-        }
         spin_unlock_irqrestore(&object->lock, flags);
         return 0;
 }
@@ -1181,36 +1285,15 @@ static const struct seq_operations kmemleak_seq_ops = {
 
 static int kmemleak_open(struct inode *inode, struct file *file)
 {
-        int ret = 0;
-
         if (!atomic_read(&kmemleak_enabled))
                 return -EBUSY;
 
-        ret = mutex_lock_interruptible(&scan_mutex);
-        if (ret < 0)
-                goto out;
-        if (file->f_mode & FMODE_READ) {
-                ret = seq_open(file, &kmemleak_seq_ops);
-                if (ret < 0)
-                        goto scan_unlock;
-        }
-        return ret;
-
-scan_unlock:
-        mutex_unlock(&scan_mutex);
-out:
-        return ret;
+        return seq_open(file, &kmemleak_seq_ops);
 }
 
 static int kmemleak_release(struct inode *inode, struct file *file)
 {
-        int ret = 0;
-
-        if (file->f_mode & FMODE_READ)
-                seq_release(inode, file);
-        mutex_unlock(&scan_mutex);
-
-        return ret;
+        return seq_release(inode, file);
 }
 
 /*
@@ -1230,15 +1313,17 @@ static ssize_t kmemleak_write(struct file *file, const char __user *user_buf,
 {
         char buf[64];
         int buf_size;
-
-        if (!atomic_read(&kmemleak_enabled))
-                return -EBUSY;
+        int ret;
 
         buf_size = min(size, (sizeof(buf) - 1));
         if (strncpy_from_user(buf, user_buf, buf_size) < 0)
                 return -EFAULT;
         buf[buf_size] = 0;
 
+        ret = mutex_lock_interruptible(&scan_mutex);
+        if (ret < 0)
+                return ret;
+
         if (strncmp(buf, "off", 3) == 0)
                 kmemleak_disable();
         else if (strncmp(buf, "stack=on", 8) == 0)
@@ -1251,11 +1336,10 @@ static ssize_t kmemleak_write(struct file *file, const char __user *user_buf,
                 stop_scan_thread();
         else if (strncmp(buf, "scan=", 5) == 0) {
                 unsigned long secs;
-                int err;
 
-                err = strict_strtoul(buf + 5, 0, &secs);
-                if (err < 0)
-                        return err;
+                ret = strict_strtoul(buf + 5, 0, &secs);
+                if (ret < 0)
+                        goto out;
                 stop_scan_thread();
                 if (secs) {
                         jiffies_scan_wait = msecs_to_jiffies(secs * 1000);
@@ -1264,7 +1348,12 @@ static ssize_t kmemleak_write(struct file *file, const char __user *user_buf,
         } else if (strncmp(buf, "scan", 4) == 0)
                 kmemleak_scan();
         else
-                return -EINVAL;
+                ret = -EINVAL;
+
+out:
+        mutex_unlock(&scan_mutex);
+        if (ret < 0)
+                return ret;
 
         /* ignore the rest of the buffer, only one command at a time */
         *ppos += size;
@@ -1293,7 +1382,7 @@ static int kmemleak_cleanup_thread(void *arg)
 
         rcu_read_lock();
         list_for_each_entry_rcu(object, &object_list, object_list)
-                delete_object(object->pointer);
+                delete_object_full(object->pointer);
         rcu_read_unlock();
         mutex_unlock(&scan_mutex);
 
@@ -1388,6 +1477,9 @@ void __init kmemleak_init(void)
                 case KMEMLEAK_FREE:
                         kmemleak_free(log->ptr);
                         break;
+                case KMEMLEAK_FREE_PART:
+                        kmemleak_free_part(log->ptr, log->size);
+                        break;
                 case KMEMLEAK_NOT_LEAK:
                         kmemleak_not_leak(log->ptr);
                         break;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a35eeab2724c..caa92689aac9 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4745,8 +4745,10 @@ void *__init alloc_large_system_hash(const char *tablename,
                          * some pages at the end of hash table which
                          * alloc_pages_exact() automatically does
                          */
-                        if (get_order(size) < MAX_ORDER)
+                        if (get_order(size) < MAX_ORDER) {
                                 table = alloc_pages_exact(size, GFP_ATOMIC);
+                                kmemleak_alloc(table, size, 1, GFP_ATOMIC);
+                        }
                 }
         } while (!table && size > PAGE_SIZE && --log2qty);
 
@@ -4764,16 +4766,6 @@ void *__init alloc_large_system_hash(const char *tablename,
         if (_hash_mask)
                 *_hash_mask = (1 << log2qty) - 1;
 
-        /*
-         * If hashdist is set, the table allocation is done with __vmalloc()
-         * which invokes the kmemleak_alloc() callback. This function may also
-         * be called before the slab and kmemleak are initialised when
-         * kmemleak simply buffers the request to be executed later
-         * (GFP_ATOMIC flag ignored in this case).
-         */
-        if (!hashdist)
-                kmemleak_alloc(table, size, 1, GFP_ATOMIC);
-
         return table;
 }
 
diff --git a/mm/slub.c b/mm/slub.c
index a9201d83178b..b9f1491a58a1 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -21,7 +21,6 @@
 #include <linux/kmemcheck.h>
 #include <linux/cpu.h>
 #include <linux/cpuset.h>
-#include <linux/kmemleak.h>
 #include <linux/mempolicy.h>
 #include <linux/ctype.h>
 #include <linux/debugobjects.h>
@@ -2835,13 +2834,15 @@ EXPORT_SYMBOL(__kmalloc);
 static void *kmalloc_large_node(size_t size, gfp_t flags, int node)
 {
         struct page *page;
+        void *ptr = NULL;
 
         flags |= __GFP_COMP | __GFP_NOTRACK;
         page = alloc_pages_node(node, flags, get_order(size));
         if (page)
-                return page_address(page);
-        else
-                return NULL;
+                ptr = page_address(page);
+
+        kmemleak_alloc(ptr, size, 1, flags);
+        return ptr;
 }
 
 #ifdef CONFIG_NUMA
@@ -2926,6 +2927,7 @@ void kfree(const void *x)
         page = virt_to_head_page(x);
         if (unlikely(!PageSlab(page))) {
                 BUG_ON(!PageCompound(page));
+                kmemleak_free(x);
                 put_page(page);
                 return;
         }
diff --git a/net/9p/client.c b/net/9p/client.c
index dd43a8289b0d..787ccddb85ea 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -117,9 +117,6 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                 }
         }
 
-        if (!clnt->trans_mod)
-                clnt->trans_mod = v9fs_get_default_trans();
-
         kfree(options);
         return ret;
 }
@@ -689,6 +686,9 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
         if (err < 0)
                 goto error;
 
+        if (!clnt->trans_mod)
+                clnt->trans_mod = v9fs_get_default_trans();
+
         if (clnt->trans_mod == NULL) {
                 err = -EPROTONOSUPPORT;
                 P9_DPRINTK(P9_DEBUG_ERROR,
@@ -1098,7 +1098,6 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
 
         if (data) {
                 memmove(data, dataptr, count);
-                data += count;
         }
 
         if (udata) {
@@ -1192,9 +1191,9 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
 
         err = p9pdu_readf(req->rc, clnt->dotu, "wS", &ignored, ret);
         if (err) {
-                ret = ERR_PTR(err);
                 p9pdu_dump(1, req->rc);
-                goto free_and_error;
+                p9_free_req(clnt, req);
+                goto error;
         }
 
         P9_DPRINTK(P9_DEBUG_9P,
@@ -1211,8 +1210,6 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
         p9_free_req(clnt, req);
         return ret;
 
-free_and_error:
-        p9_free_req(clnt, req);
 error:
         kfree(ret);
         return ERR_PTR(err);
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 590b83963622..bfbe13786bb4 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -54,6 +54,7 @@
 #include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/if_arp.h>
+#include <linux/smp_lock.h>
 #include <linux/termios.h>      /* For TIOCOUTQ/INQ */
 #include <net/datalink.h>
 #include <net/psnap.h>
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 95d7f32643ae..72720c710351 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -75,6 +75,7 @@ static __initdata const char banner[] = KERN_INFO
 MODULE_DESCRIPTION("PF_CAN broadcast manager protocol");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
+MODULE_ALIAS("can-proto-2");
 
 /* easy access to can_frame payload */
 static inline u64 GET_U64(const struct can_frame *cp)
@@ -1469,6 +1470,9 @@ static int bcm_release(struct socket *sock)
                 bo->ifindex = 0;
         }
 
+        sock_orphan(sk);
+        sock->sk = NULL;
+
         release_sock(sk);
         sock_put(sk);
 
diff --git a/net/can/raw.c b/net/can/raw.c
index 6aa154e806ae..f4cc44548bda 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -62,6 +62,7 @@ static __initdata const char banner[] =
 MODULE_DESCRIPTION("PF_CAN raw protocol");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Urs Thuermann <urs.thuermann@volkswagen.de>");
+MODULE_ALIAS("can-proto-1");
 
 #define MASK_ALL 0
 
@@ -306,6 +307,9 @@ static int raw_release(struct socket *sock)
         ro->bound   = 0;
         ro->count   = 0;
 
+        sock_orphan(sk);
+        sock->sk = NULL;
+
         release_sock(sk);
         sock_put(sk);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 6354863b1c68..bbb25be7ddfe 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -631,7 +631,7 @@ set_rcvbuf:
 
         case SO_TIMESTAMPING:
                 if (val & ~SOF_TIMESTAMPING_MASK) {
-                        ret = EINVAL;
+                        ret = -EINVAL;
                         break;
                 }
                 sock_valbool_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE,
@@ -919,13 +919,19 @@ static inline void sock_lock_init(struct sock *sk)
                         af_family_keys + sk->sk_family);
 }
 
+/*
+ * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
+ * even temporarly, because of RCU lookups. sk_node should also be left as is.
+ */
 static void sock_copy(struct sock *nsk, const struct sock *osk)
 {
 #ifdef CONFIG_SECURITY_NETWORK
         void *sptr = nsk->sk_security;
 #endif
-
-        memcpy(nsk, osk, osk->sk_prot->obj_size);
+        BUILD_BUG_ON(offsetof(struct sock, sk_copy_start) !=
+                     sizeof(osk->sk_node) + sizeof(osk->sk_refcnt));
+        memcpy(&nsk->sk_copy_start, &osk->sk_copy_start,
+               osk->sk_prot->obj_size - offsetof(struct sock, sk_copy_start));
 #ifdef CONFIG_SECURITY_NETWORK
         nsk->sk_security = sptr;
         security_sk_clone(osk, nsk);
@@ -939,8 +945,23 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
         struct kmem_cache *slab;
 
         slab = prot->slab;
-        if (slab != NULL)
-                sk = kmem_cache_alloc(slab, priority);
+        if (slab != NULL) {
+                sk = kmem_cache_alloc(slab, priority & ~__GFP_ZERO);
+                if (!sk)
+                        return sk;
+                if (priority & __GFP_ZERO) {
+                        /*
+                         * caches using SLAB_DESTROY_BY_RCU should let
+                         * sk_node.next un-modified. Special care is taken
+                         * when initializing object to zero.
+                         */
+                        if (offsetof(struct sock, sk_node.next) != 0)
+                                memset(sk, 0, offsetof(struct sock, sk_node.next));
+                        memset(&sk->sk_node.pprev, 0,
+                               prot->obj_size - offsetof(struct sock,
+                                                         sk_node.pprev));
+                }
+        }
         else
                 sk = kmalloc(prot->obj_size, priority);
 
@@ -1125,6 +1146,11 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
 
                 newsk->sk_err      = 0;
                 newsk->sk_priority = 0;
+                /*
+                 * Before updating sk_refcnt, we must commit prior changes to memory
+                 * (Documentation/RCU/rculist_nulls.txt for details)
+                 */
+                smp_wmb();
                 atomic_set(&newsk->sk_refcnt, 2);
 
                 /*
@@ -1840,6 +1866,11 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         sk->sk_stamp = ktime_set(-1L, 0);
 
+        /*
+         * Before updating sk_refcnt, we must commit prior changes to memory
+         * (Documentation/RCU/rculist_nulls.txt for details)
+         */
+        smp_wmb();
         atomic_set(&sk->sk_refcnt, 1);
         atomic_set(&sk->sk_wmem_alloc, 1);
         atomic_set(&sk->sk_drops, 0);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 44e2a3d2359a..cb4a0f4bd5e5 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -735,10 +735,10 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         tos = tiph->tos;
-        if (tos&1) {
+        if (tos == 1) {
+                tos = 0;
                 if (skb->protocol == htons(ETH_P_IP))
                         tos = old_iph->tos;
-                tos &= ~1;
         }
 
         {
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 247026282669..7d0821054729 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1243,7 +1243,6 @@ int ip_push_pending_frames(struct sock *sk)
                 skb->len += tmp_skb->len;
                 skb->data_len += tmp_skb->len;
                 skb->truesize += tmp_skb->truesize;
-                __sock_put(tmp_skb->sk);
                 tmp_skb->destructor = NULL;
                 tmp_skb->sk = NULL;
         }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a1ca2698c88..6d88219c5e22 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1160,6 +1160,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
         .md5_lookup     =       tcp_v4_reqsk_md5_lookup,
+        .calc_md5_hash  =       tcp_v4_md5_hash_skb,
 };
 #endif
 
@@ -1373,7 +1374,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v4_md5_do_add(newsk, inet_sk(sk)->daddr,
+                        tcp_v4_md5_do_add(newsk, newinet->daddr,
                                           newkey, key->keylen);
                 newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5bdf08d312d9..bd62712848fa 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2261,7 +2261,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 #ifdef CONFIG_TCP_MD5SIG
         /* Okay, we have all we need - do the md5 hash if needed */
         if (md5) {
-                tp->af_specific->calc_md5_hash(md5_hash_location,
+                tcp_rsk(req)->af_specific->calc_md5_hash(md5_hash_location,
                                                md5, NULL, req, skb);
         }
 #endif
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7c76e3d18215..87f8419a68fd 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1484,7 +1484,6 @@ int ip6_push_pending_frames(struct sock *sk)
                 skb->len += tmp_skb->len;
                 skb->data_len += tmp_skb->len;
                 skb->truesize += tmp_skb->truesize;
-                __sock_put(tmp_skb->sk);
                 tmp_skb->destructor = NULL;
                 tmp_skb->sk = NULL;
         }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 68e52308e552..98b7327d0949 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1018,6 +1018,7 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
         dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr);
         dev->flags              = IFF_NOARP;
+        dev->priv_flags        &= ~IFF_XMIT_DST_RELEASE;
         dev->iflink             = 0;
         dev->addr_len           = 4;
         dev->features           |= NETIF_F_NETNS_LOCAL;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 58810c65b635..d849dd53b788 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -896,6 +896,7 @@ struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
+        .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 };
 #endif
 
@@ -1441,7 +1442,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
+                        tcp_v6_md5_do_add(newsk, &newnp->daddr,
                                           newkey, key->keylen);
         }
 #endif
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 417b0e309495..f1118d92a191 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -41,6 +41,7 @@
 #include <linux/netdevice.h>
 #include <linux/uio.h>
 #include <linux/skbuff.h>
+#include <linux/smp_lock.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/string.h>
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index cb762c8723ea..80cf29aae096 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -45,6 +45,7 @@
 #include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/smp_lock.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/init.h>
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index bccf4d0059f0..b001c361ad30 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -241,7 +241,6 @@
 #include <linux/module.h>
 
 #include <linux/kernel.h>
-#include <linux/smp_lock.h>
 #include <linux/skbuff.h>
 #include <linux/tty.h>
 #include <linux/proc_fs.h>
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 6d8ae03c14f5..68cbcb19cbd8 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -13,6 +13,7 @@
  *      2) as a control channel (write commands, read events)
  */
 
+#include <linux/smp_lock.h>
 #include "irnet_ppp.h"          /* Private header */
 /* Please put other headers in irnet.h - Thanks */
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7508f11c5b39..b5869b9574b0 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -561,23 +561,38 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
                 }
         }
 
-        ct = kmem_cache_zalloc(nf_conntrack_cachep, gfp);
+        /*
+         * Do not use kmem_cache_zalloc(), as this cache uses
+         * SLAB_DESTROY_BY_RCU.
+         */
+        ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
         if (ct == NULL) {
                 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
                 atomic_dec(&net->ct.count);
                 return ERR_PTR(-ENOMEM);
         }
-
+        /*
+         * Let ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.next
+         * and ct->tuplehash[IP_CT_DIR_REPLY].hnnode.next unchanged.
+         */
+        memset(&ct->tuplehash[IP_CT_DIR_MAX], 0,
+               sizeof(*ct) - offsetof(struct nf_conn, tuplehash[IP_CT_DIR_MAX]));
         spin_lock_init(&ct->lock);
-        atomic_set(&ct->ct_general.use, 1);
         ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
+        ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.pprev = NULL;
         ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
+        ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev = NULL;
         /* Don't set timer yet: wait for confirmation */
         setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
 #ifdef CONFIG_NET_NS
         ct->ct_net = net;
 #endif
 
+        /*
+         * changes to lookup keys must be done before setting refcnt to 1
+         */
+        smp_wmb();
+        atomic_set(&ct->ct_general.use, 1);
         return ct;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 863e40977a4d..0f482e2440b4 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -330,7 +330,8 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
                         fcount++;
 
                         if (info->flags & XT_OSF_LOG)
-                                nf_log_packet(p->hooknum, 0, skb, p->in, p->out, NULL,
+                                nf_log_packet(p->family, p->hooknum, skb,
+                                        p->in, p->out, NULL,
                                         "%s [%s:%s] : %pi4:%d -> %pi4:%d hops=%d\n",
                                         f->genre, f->version, f->subtype,
                                         &ip->saddr, ntohs(tcp->source),
@@ -345,7 +346,7 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
         rcu_read_unlock();
 
         if (!fcount && (info->flags & XT_OSF_LOG))
-                nf_log_packet(p->hooknum, 0, skb, p->in, p->out, NULL,
+                nf_log_packet(p->family, p->hooknum, skb, p->in, p->out, NULL,
                         "Remote OS is not known: %pi4:%u -> %pi4:%u\n",
                                 &ip->saddr, ntohs(tcp->source),
                                 &ip->daddr, ntohs(tcp->dest));
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 5bc2f45bddf0..ebfcf9b89909 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -28,7 +28,6 @@
 #include <linux/kallsyms.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/utsname.h>
 #include <linux/workqueue.h>
 #include <linux/in6.h>
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 1102ce1251f7..8f459abe97cf 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -16,7 +16,6 @@
 #include <linux/slab.h>
 #include <linux/mempool.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 6f33d33cc064..27d44332f017 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -5,6 +5,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/freezer.h>
 #include <linux/kthread.h>
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 466e2d22d256..258daa80ad92 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -48,6 +48,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>       /* support for loadable modules */
 #include <linux/slab.h>         /* kmalloc(), kfree() */
+#include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/string.h>       /* inline mem*, str* functions */
 
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 21cdc872004e..5e6c072c64d3 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -40,6 +40,7 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/timer.h>
 #include <linux/string.h>
 #include <linux/net.h>
diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h
index 9977a756fb32..f24ae370e514 100644
--- a/samples/trace_events/trace-events-sample.h
+++ b/samples/trace_events/trace-events-sample.h
@@ -1,21 +1,4 @@
 /*
- * Notice that this file is not protected like a normal header.
- * We also must allow for rereading of this file. The
- *
- *  || defined(TRACE_HEADER_MULTI_READ)
- *
- * serves this purpose.
- */
-#if !defined(_TRACE_EVENT_SAMPLE_H) || defined(TRACE_HEADER_MULTI_READ)
-#define _TRACE_EVENT_SAMPLE_H
-
-/*
- * All trace headers should include tracepoint.h, until we finally
- * make it into a standard header.
- */
-#include <linux/tracepoint.h>
-
-/*
  * If TRACE_SYSTEM is defined, that will be the directory created
  * in the ftrace directory under /debugfs/tracing/events/<system>
  *
@@ -34,11 +17,31 @@
  * #define TRACE_INCLUDE_FILE trace-events-sample
  *
  * As we do an the bottom of this file.
+ *
+ * Notice that TRACE_SYSTEM should be defined outside of #if
+ * protection, just like TRACE_INCLUDE_FILE.
  */
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM sample
 
 /*
+ * Notice that this file is not protected like a normal header.
+ * We also must allow for rereading of this file. The
+ *
+ *  || defined(TRACE_HEADER_MULTI_READ)
+ *
+ * serves this purpose.
+ */
+#if !defined(_TRACE_EVENT_SAMPLE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_EVENT_SAMPLE_H
+
+/*
+ * All trace headers should include tracepoint.h, until we finally
+ * make it into a standard header.
+ */
+#include <linux/tracepoint.h>
+
+/*
  * The TRACE_EVENT macro is broken up into 5 parts.
  *
  * name: name of the trace point. This is also how to enable the tracepoint.
diff --git a/scripts/kconfig/lxdialog/util.c b/scripts/kconfig/lxdialog/util.c
index 86d95cca46a7..f2375ad7ebc9 100644
--- a/scripts/kconfig/lxdialog/util.c
+++ b/scripts/kconfig/lxdialog/util.c
@@ -19,6 +19,8 @@
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#include <stdarg.h>
+
 #include "dialog.h"
 
 struct dialog_info dlg;
diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
index 3bcacb4bfd3a..25b60bc117f7 100644
--- a/scripts/kconfig/mconf.c
+++ b/scripts/kconfig/mconf.c
@@ -888,6 +888,8 @@ int main(int ac, char **av)
                         single_menu_mode = 1;
         }
 
+        initscr();
+
         getyx(stdscr, saved_y, saved_x);
         if (init_dialog(NULL)) {
                 fprintf(stderr, N_("Your display is too small to run Menuconfig!\n"));
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index b19f1f4962e3..8b357b0bd250 100644
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -89,7 +89,7 @@ for script in postinst postrm preinst prerm ; do
 set -e
 
 # Pass maintainer script parameters to hook scripts
-export DEB_MAINT_PARAMS="\$@"
+export DEB_MAINT_PARAMS="\$*"
 
 test -d $debhookdir/$script.d && run-parts --arg="$version" $debhookdir/$script.d
 exit 0
diff --git a/sound/arm/pxa2xx-pcm-lib.c b/sound/arm/pxa2xx-pcm-lib.c
index 108b643229ba..6205f37d547c 100644
--- a/sound/arm/pxa2xx-pcm-lib.c
+++ b/sound/arm/pxa2xx-pcm-lib.c
@@ -75,7 +75,7 @@ int __pxa2xx_pcm_hw_free(struct snd_pcm_substream *substream)
 {
         struct pxa2xx_runtime_data *rtd = substream->runtime->private_data;
 
-        if (rtd && rtd->params)
+        if (rtd && rtd->params && rtd->params->drcmr)
                 *rtd->params->drcmr = 0;
 
         snd_pcm_set_runtime_buffer(substream, NULL);
diff --git a/sound/core/seq/Makefile b/sound/core/seq/Makefile
index 1bcb360330e5..941f64a853eb 100644
--- a/sound/core/seq/Makefile
+++ b/sound/core/seq/Makefile
@@ -3,10 +3,6 @@
 # Copyright (c) 1999 by Jaroslav Kysela <perex@perex.cz>
 #
 
-ifeq ($(CONFIG_SND_SEQUENCER_OSS),y)
-  obj-$(CONFIG_SND_SEQUENCER) += oss/
-endif
-
 snd-seq-device-objs := seq_device.o
 snd-seq-objs := seq.o seq_lock.o seq_clientmgr.o seq_memory.o seq_queue.o \
                 seq_fifo.o seq_prioq.o seq_timer.o \
@@ -19,7 +15,8 @@ snd-seq-virmidi-objs := seq_virmidi.o
 
 obj-$(CONFIG_SND_SEQUENCER) += snd-seq.o snd-seq-device.o
 ifeq ($(CONFIG_SND_SEQUENCER_OSS),y)
-obj-$(CONFIG_SND_SEQUENCER) += snd-seq-midi-event.o
+  obj-$(CONFIG_SND_SEQUENCER) += snd-seq-midi-event.o
+  obj-$(CONFIG_SND_SEQUENCER) += oss/
 endif
 obj-$(CONFIG_SND_SEQ_DUMMY) += snd-seq-dummy.o
 
diff --git a/sound/isa/gus/gus_pcm.c b/sound/isa/gus/gus_pcm.c
index edb11eefdfe3..2dcf45bf7293 100644
--- a/sound/isa/gus/gus_pcm.c
+++ b/sound/isa/gus/gus_pcm.c
@@ -795,13 +795,13 @@ static int snd_gf1_pcm_volume_put(struct snd_kcontrol *kcontrol, struct snd_ctl_
                 if (!(pcmp->flags & SNDRV_GF1_PCM_PFLG_ACTIVE))
                         continue;
                 /* load real volume - better precision */
-                spin_lock_irqsave(&gus->reg_lock, flags);
+                spin_lock(&gus->reg_lock);
                 snd_gf1_select_voice(gus, pvoice->number);
                 snd_gf1_ctrl_stop(gus, SNDRV_GF1_VB_VOLUME_CONTROL);
                 vol = pvoice == pcmp->pvoices[0] ? gus->gf1.pcm_volume_level_left : gus->gf1.pcm_volume_level_right;
                 snd_gf1_write16(gus, SNDRV_GF1_VW_VOLUME, vol);
                 pcmp->final_volume = 1;
-                spin_unlock_irqrestore(&gus->reg_lock, flags);
+                spin_unlock(&gus->reg_lock);
         }
         spin_unlock_irqrestore(&gus->voice_alloc, flags);
         return change;
diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c
index f24bf1ecb36d..15e4138bce17 100644
--- a/sound/pci/ca0106/ca0106_main.c
+++ b/sound/pci/ca0106/ca0106_main.c
@@ -325,9 +325,9 @@ static struct snd_pcm_hardware snd_ca0106_capture_hw = {
         .rate_max =             192000,
         .channels_min =         2,
         .channels_max =         2,
-        .buffer_bytes_max =     ((65536 - 64) * 8),
+        .buffer_bytes_max =     65536 - 128,
         .period_bytes_min =     64,
-        .period_bytes_max =     (65536 - 64),
+        .period_bytes_max =     32768 - 64,
         .periods_min =          2,
         .periods_max =          2,
         .fifo_size =            0,
diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c
index 082e35c08c02..deb6cfa73600 100644
--- a/sound/pci/ctxfi/ctdaio.c
+++ b/sound/pci/ctxfi/ctdaio.c
@@ -57,9 +57,9 @@ struct daio_rsc_idx idx_20k1[NUM_DAIOTYP] = {
 
 struct daio_rsc_idx idx_20k2[NUM_DAIOTYP] = {
         [LINEO1] = {.left = 0x40, .right = 0x41},
-        [LINEO2] = {.left = 0x70, .right = 0x71},
+        [LINEO2] = {.left = 0x60, .right = 0x61},
         [LINEO3] = {.left = 0x50, .right = 0x51},
-        [LINEO4] = {.left = 0x60, .right = 0x61},
+        [LINEO4] = {.left = 0x70, .right = 0x71},
         [LINEIM] = {.left = 0x45, .right = 0xc5},
         [SPDIFOO] = {.left = 0x00, .right = 0x01},
         [SPDIFIO] = {.left = 0x05, .right = 0x85},
diff --git a/sound/pci/hda/hda_beep.c b/sound/pci/hda/hda_beep.c
index 29272f2e95a0..b0275a050870 100644
--- a/sound/pci/hda/hda_beep.c
+++ b/sound/pci/hda/hda_beep.c
@@ -50,19 +50,22 @@ static void snd_hda_generate_beep(struct work_struct *work)
  * The tone frequency of beep generator on IDT/STAC codecs is
  * defined from the 8bit tone parameter, in Hz,
  *    freq = 48000 * (257 - tone) / 1024
- * that is from 12kHz to 93.75kHz in step of 46.875 hz
+ * that is from 12kHz to 93.75Hz in steps of 46.875 Hz
  */
 static int beep_linear_tone(struct hda_beep *beep, int hz)
 {
+        if (hz <= 0)
+                return 0;
         hz *= 1000; /* fixed point */
-        hz = hz - DIGBEEP_HZ_MIN;
+        hz = hz - DIGBEEP_HZ_MIN
+                + DIGBEEP_HZ_STEP / 2; /* round to nearest step */
         if (hz < 0)
                 hz = 0; /* turn off PC beep*/
         else if (hz >= (DIGBEEP_HZ_MAX - DIGBEEP_HZ_MIN))
-                hz = 0xff;
+                hz = 1; /* max frequency */
         else {
                 hz /= DIGBEEP_HZ_STEP;
-                hz++;
+                hz = 255 - hz;
         }
         return hz;
 }
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 26d255de6beb..88480c0c58a0 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -332,6 +332,12 @@ int snd_hda_get_connections(struct hda_codec *codec, hda_nid_t nid,
                                                   AC_VERB_GET_CONNECT_LIST, i);
                 range_val = !!(parm & (1 << (shift-1))); /* ranges */
                 val = parm & mask;
+                if (val == 0) {
+                        snd_printk(KERN_WARNING "hda_codec: "
+                                   "invalid CONNECT_LIST verb %x[%i]:%x\n",
+                                    nid, i, parm);
+                        return 0;
+                }
                 parm >>= shift;
                 if (range_val) {
                         /* ranges between the previous and this one */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 1877d95d4aa6..77c1b840ca8b 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1455,6 +1455,17 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
                 return err;
         }
         snd_pcm_limit_hw_rates(runtime);
+        /* sanity check */
+        if (snd_BUG_ON(!runtime->hw.channels_min) ||
+            snd_BUG_ON(!runtime->hw.channels_max) ||
+            snd_BUG_ON(!runtime->hw.formats) ||
+            snd_BUG_ON(!runtime->hw.rates)) {
+                azx_release_device(azx_dev);
+                hinfo->ops.close(hinfo, apcm->codec, substream);
+                snd_hda_power_down(apcm->codec);
+                mutex_unlock(&chip->open_mutex);
+                return -EINVAL;
+        }
         spin_lock_irqsave(&chip->reg_lock, flags);
         azx_dev->substream = substream;
         azx_dev->running = 0;
@@ -1463,13 +1474,6 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
         runtime->private_data = azx_dev;
         snd_pcm_set_sync(substream);
         mutex_unlock(&chip->open_mutex);
-
-        if (snd_BUG_ON(!runtime->hw.channels_min || !runtime->hw.channels_max))
-                return -EINVAL;
-        if (snd_BUG_ON(!runtime->hw.formats))
-                return -EINVAL;
-        if (snd_BUG_ON(!runtime->hw.rates))
-                return -EINVAL;
         return 0;
 }
 
@@ -2329,9 +2333,19 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
         gcap = azx_readw(chip, GCAP);
         snd_printdd(SFX "chipset global capabilities = 0x%x\n", gcap);
 
-        /* ATI chips seems buggy about 64bit DMA addresses */
-        if (chip->driver_type == AZX_DRIVER_ATI)
-                gcap &= ~ICH6_GCAP_64OK;
+        /* disable SB600 64bit support for safety */
+        if ((chip->driver_type == AZX_DRIVER_ATI) ||
+            (chip->driver_type == AZX_DRIVER_ATIHDMI)) {
+                struct pci_dev *p_smbus;
+                p_smbus = pci_get_device(PCI_VENDOR_ID_ATI,
+                                         PCI_DEVICE_ID_ATI_SBX00_SMBUS,
+                                         NULL);
+                if (p_smbus) {
+                        if (p_smbus->revision < 0x30)
+                                gcap &= ~ICH6_GCAP_64OK;
+                        pci_dev_put(p_smbus);
+                }
+        }
 
         /* allow 64bit DMA address if supported by H/W */
         if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index e661b21354be..7e99763ca527 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4505,6 +4505,12 @@ static int alc880_parse_auto_config(struct hda_codec *codec)
                                               &dig_nid, 1);
                 if (err < 0)
                         continue;
+                if (dig_nid > 0x7f) {
+                        printk(KERN_ERR "alc880_auto: invalid dig_nid "
+                                "connection 0x%x for NID 0x%x\n", dig_nid,
+                                spec->autocfg.dig_out_pins[i]);
+                        continue;
+                }
                 if (!i)
                         spec->multiout.dig_out_nid = dig_nid;
                 else {
@@ -6919,9 +6925,6 @@ static struct hda_verb alc882_targa_verbs[] = {
         {0x1b, AC_VERB_SET_CONNECT_SEL, 0x00}, /* HP */
 
         {0x14, AC_VERB_SET_UNSOLICITED_ENABLE, ALC880_HP_EVENT | AC_USRSP_EN},
-        {0x01, AC_VERB_SET_GPIO_MASK, 0x03},
-        {0x01, AC_VERB_SET_GPIO_DIRECTION, 0x03},
-        {0x01, AC_VERB_SET_GPIO_DATA, 0x03},
         { } /* end */
 };
 
@@ -7241,7 +7244,8 @@ static struct alc_config_preset alc882_presets[] = {
         },
         [ALC882_TARGA] = {
                 .mixers = { alc882_targa_mixer, alc882_chmode_mixer },
-                .init_verbs = { alc882_init_verbs, alc882_targa_verbs},
+                .init_verbs = { alc882_init_verbs, alc880_gpio3_init_verbs,
+                                alc882_targa_verbs},
                 .num_dacs = ARRAY_SIZE(alc882_dac_nids),
                 .dac_nids = alc882_dac_nids,
                 .dig_out_nid = ALC882_DIGOUT_NID,
@@ -9238,7 +9242,8 @@ static struct alc_config_preset alc883_presets[] = {
         },
         [ALC883_TARGA_DIG] = {
                 .mixers = { alc883_targa_mixer, alc883_chmode_mixer },
-                .init_verbs = { alc883_init_verbs, alc883_targa_verbs},
+                .init_verbs = { alc883_init_verbs, alc880_gpio3_init_verbs,
+                                alc883_targa_verbs},
                 .num_dacs = ARRAY_SIZE(alc883_dac_nids),
                 .dac_nids = alc883_dac_nids,
                 .dig_out_nid = ALC883_DIGOUT_NID,
@@ -9251,7 +9256,8 @@ static struct alc_config_preset alc883_presets[] = {
         },
         [ALC883_TARGA_2ch_DIG] = {
                 .mixers = { alc883_targa_2ch_mixer},
-                .init_verbs = { alc883_init_verbs, alc883_targa_verbs},
+                .init_verbs = { alc883_init_verbs, alc880_gpio3_init_verbs,
+                                alc883_targa_verbs},
                 .num_dacs = ARRAY_SIZE(alc883_dac_nids),
                 .dac_nids = alc883_dac_nids,
                 .adc_nids = alc883_adc_nids_alt,
@@ -12878,9 +12884,9 @@ static struct snd_kcontrol_new alc269_lifebook_mixer[] = {
 
 static struct snd_kcontrol_new alc269_eeepc_mixer[] = {
         HDA_CODEC_MUTE("Speaker Playback Switch", 0x14, 0x0, HDA_OUTPUT),
-        HDA_CODEC_MUTE("Speaker Playback Volume", 0x02, 0x0, HDA_OUTPUT),
+        HDA_CODEC_VOLUME("Speaker Playback Volume", 0x02, 0x0, HDA_OUTPUT),
         HDA_CODEC_MUTE("Headphone Playback Switch", 0x15, 0x0, HDA_OUTPUT),
-        HDA_CODEC_MUTE("Headphone Playback Volume", 0x03, 0x0, HDA_OUTPUT),
+        HDA_CODEC_VOLUME("Headphone Playback Volume", 0x03, 0x0, HDA_OUTPUT),
         { } /* end */
 };
 
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 14f3c3e0f62d..da7f9f65c047 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1590,8 +1590,6 @@ static struct snd_pci_quirk stac9200_cfg_tbl[] = {
         /* SigmaTel reference board */
         SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
                       "DFI LanParty", STAC_REF),
-        SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0xfb30,
-                      "SigmaTel",STAC_9205_REF),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DFI, 0x3101,
                       "DFI LanParty", STAC_REF),
         /* Dell laptops have BIOS problem */
@@ -2344,6 +2342,8 @@ static struct snd_pci_quirk stac9205_cfg_tbl[] = {
         /* SigmaTel reference board */
         SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
                       "DFI LanParty", STAC_9205_REF),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0xfb30,
+                      "SigmaTel", STAC_9205_REF),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DFI, 0x3101,
                       "DFI LanParty", STAC_9205_REF),
         /* Dell */
@@ -2378,6 +2378,7 @@ static struct snd_pci_quirk stac9205_cfg_tbl[] = {
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0228,
                       "Dell Vostro 1500", STAC_9205_DELL_M42),
         /* Gateway */
+        SND_PCI_QUIRK(0x107b, 0x0560, "Gateway T6834c", STAC_9205_EAPD),
         SND_PCI_QUIRK(0x107b, 0x0565, "Gateway T1616", STAC_9205_EAPD),
         {} /* terminator */
 };
@@ -5854,6 +5855,8 @@ static unsigned int *stac9872_brd_tbl[STAC_9872_MODELS] = {
 };
 
 static struct snd_pci_quirk stac9872_cfg_tbl[] = {
+        SND_PCI_QUIRK_MASK(0x104d, 0xfff0, 0x81e0,
+                           "Sony VAIO F/S", STAC_9872_VAIO),
         {} /* terminator */
 };
 
@@ -5866,6 +5869,8 @@ static int patch_stac9872(struct hda_codec *codec)
         if (spec == NULL)
                 return -ENOMEM;
         codec->spec = spec;
+        spec->num_pins = ARRAY_SIZE(stac9872_pin_nids);
+        spec->pin_nids = stac9872_pin_nids;
 
         spec->board_config = snd_hda_check_board_config(codec, STAC_9872_MODELS,
                                                         stac9872_models,
@@ -5877,8 +5882,6 @@ static int patch_stac9872(struct hda_codec *codec)
                 stac92xx_set_config_regs(codec,
                                          stac9872_brd_tbl[spec->board_config]);
 
-        spec->num_pins = ARRAY_SIZE(stac9872_pin_nids);
-        spec->pin_nids = stac9872_pin_nids;
         spec->multiout.dac_nids = spec->dac_nids;
         spec->num_adcs = ARRAY_SIZE(stac9872_adc_nids);
         spec->adc_nids = stac9872_adc_nids;
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 8e004fb6961a..9008b4b013aa 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -210,7 +210,9 @@ struct via_spec {
         /* capture */
         unsigned int num_adc_nids;
         hda_nid_t *adc_nids;
+        hda_nid_t mux_nids[3];
         hda_nid_t dig_in_nid;
+        hda_nid_t dig_in_pin;
 
         /* capture source */
         const struct hda_input_mux *input_mux;
@@ -319,6 +321,9 @@ static void via_auto_set_output_and_unmute(struct hda_codec *codec,
                             pin_type);
         snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE,
                             AMP_OUT_UNMUTE);
+        if (snd_hda_query_pin_caps(codec, nid) & AC_PINCAP_EAPD)
+                snd_hda_codec_write(codec, nid, 0, 
+                                    AC_VERB_SET_EAPD_BTLENABLE, 0x02);
 }
 
 
@@ -387,27 +392,12 @@ static int via_mux_enum_put(struct snd_kcontrol *kcontrol,
         struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
         struct via_spec *spec = codec->spec;
         unsigned int adc_idx = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
-        unsigned int vendor_id = codec->vendor_id;
-
-        /* AIW0  lydia 060801 add for correct sw0 input select */
-        if (IS_VT1708_VENDORID(vendor_id) && (adc_idx == 0))
-                return snd_hda_input_mux_put(codec, spec->input_mux, ucontrol,
-                                             0x18, &spec->cur_mux[adc_idx]);
-        else if ((IS_VT1709_10CH_VENDORID(vendor_id) ||
-                  IS_VT1709_6CH_VENDORID(vendor_id)) && (adc_idx == 0))
-                return snd_hda_input_mux_put(codec, spec->input_mux, ucontrol,
-                                             0x19, &spec->cur_mux[adc_idx]);
-        else if ((IS_VT1708B_8CH_VENDORID(vendor_id) ||
-                  IS_VT1708B_4CH_VENDORID(vendor_id)) && (adc_idx == 0))
-                return snd_hda_input_mux_put(codec, spec->input_mux, ucontrol,
-                                             0x17, &spec->cur_mux[adc_idx]);
-        else if (IS_VT1702_VENDORID(vendor_id) && (adc_idx == 0))
-                return snd_hda_input_mux_put(codec, spec->input_mux, ucontrol,
-                                             0x13, &spec->cur_mux[adc_idx]);
-        else
-                return snd_hda_input_mux_put(codec, spec->input_mux, ucontrol,
-                                             spec->adc_nids[adc_idx],
-                                             &spec->cur_mux[adc_idx]);
+
+        if (!spec->mux_nids[adc_idx])
+                return -EINVAL;
+        return snd_hda_input_mux_put(codec, spec->input_mux, ucontrol,
+                                     spec->mux_nids[adc_idx],
+                                     &spec->cur_mux[adc_idx]);
 }
 
 static int via_independent_hp_info(struct snd_kcontrol *kcontrol,
@@ -998,25 +988,11 @@ static int via_init(struct hda_codec *codec)
 
         /* Lydia Add for EAPD enable */
         if (!spec->dig_in_nid) { /* No Digital In connection */
-                if (IS_VT1708_VENDORID(codec->vendor_id)) {
-                        snd_hda_codec_write(codec, VT1708_DIGIN_PIN, 0,
-                                            AC_VERB_SET_PIN_WIDGET_CONTROL,
-                                            PIN_OUT);
-                        snd_hda_codec_write(codec, VT1708_DIGIN_PIN, 0,
-                                            AC_VERB_SET_EAPD_BTLENABLE, 0x02);
-                } else if (IS_VT1709_10CH_VENDORID(codec->vendor_id) ||
-                           IS_VT1709_6CH_VENDORID(codec->vendor_id)) {
-                        snd_hda_codec_write(codec, VT1709_DIGIN_PIN, 0,
+                if (spec->dig_in_pin) {
+                        snd_hda_codec_write(codec, spec->dig_in_pin, 0,
                                             AC_VERB_SET_PIN_WIDGET_CONTROL,
                                             PIN_OUT);
-                        snd_hda_codec_write(codec, VT1709_DIGIN_PIN, 0,
-                                            AC_VERB_SET_EAPD_BTLENABLE, 0x02);
-                } else if (IS_VT1708B_8CH_VENDORID(codec->vendor_id) ||
-                           IS_VT1708B_4CH_VENDORID(codec->vendor_id)) {
-                        snd_hda_codec_write(codec, VT1708B_DIGIN_PIN, 0,
-                                            AC_VERB_SET_PIN_WIDGET_CONTROL,
-                                            PIN_OUT);
-                        snd_hda_codec_write(codec, VT1708B_DIGIN_PIN, 0,
+                        snd_hda_codec_write(codec, spec->dig_in_pin, 0,
                                             AC_VERB_SET_EAPD_BTLENABLE, 0x02);
                 }
         } else /* enable SPDIF-input pin */
@@ -1326,6 +1302,7 @@ static int vt1708_parse_auto_config(struct hda_codec *codec)
 
         if (spec->autocfg.dig_outs)
                 spec->multiout.dig_out_nid = VT1708_DIGOUT_NID;
+        spec->dig_in_pin = VT1708_DIGIN_PIN;
         if (spec->autocfg.dig_in_pin)
                 spec->dig_in_nid = VT1708_DIGIN_NID;
 
@@ -1352,6 +1329,34 @@ static int via_auto_init(struct hda_codec *codec)
         return 0;
 }
 
+static int get_mux_nids(struct hda_codec *codec)
+{
+        struct via_spec *spec = codec->spec;
+        hda_nid_t nid, conn[8];
+        unsigned int type;
+        int i, n;
+
+        for (i = 0; i < spec->num_adc_nids; i++) {
+                nid = spec->adc_nids[i];
+                while (nid) {
+                        type = (get_wcaps(codec, nid) & AC_WCAP_TYPE)
+                                >> AC_WCAP_TYPE_SHIFT;
+                        if (type == AC_WID_PIN)
+                                break;
+                        n = snd_hda_get_connections(codec, nid, conn,
+                                                    ARRAY_SIZE(conn));
+                        if (n <= 0)
+                                break;
+                        if (n > 1) {
+                                spec->mux_nids[i] = nid;
+                                break;
+                        }
+                        nid = conn[0];
+                }
+        }
+        return 0;
+}
+
 static int patch_vt1708(struct hda_codec *codec)
 {
         struct via_spec *spec;
@@ -1799,6 +1804,7 @@ static int vt1709_parse_auto_config(struct hda_codec *codec)
 
         if (spec->autocfg.dig_outs)
                 spec->multiout.dig_out_nid = VT1709_DIGOUT_NID;
+        spec->dig_in_pin = VT1709_DIGIN_PIN;
         if (spec->autocfg.dig_in_pin)
                 spec->dig_in_nid = VT1709_DIGIN_NID;
 
@@ -1859,6 +1865,7 @@ static int patch_vt1709_10ch(struct hda_codec *codec)
         if (!spec->adc_nids && spec->input_mux) {
                 spec->adc_nids = vt1709_adc_nids;
                 spec->num_adc_nids = ARRAY_SIZE(vt1709_adc_nids);
+                get_mux_nids(codec);
                 spec->mixers[spec->num_mixers] = vt1709_capture_mixer;
                 spec->num_mixers++;
         }
@@ -1952,6 +1959,7 @@ static int patch_vt1709_6ch(struct hda_codec *codec)
         if (!spec->adc_nids && spec->input_mux) {
                 spec->adc_nids = vt1709_adc_nids;
                 spec->num_adc_nids = ARRAY_SIZE(vt1709_adc_nids);
+                get_mux_nids(codec);
                 spec->mixers[spec->num_mixers] = vt1709_capture_mixer;
                 spec->num_mixers++;
         }
@@ -2344,6 +2352,7 @@ static int vt1708B_parse_auto_config(struct hda_codec *codec)
 
         if (spec->autocfg.dig_outs)
                 spec->multiout.dig_out_nid = VT1708B_DIGOUT_NID;
+        spec->dig_in_pin = VT1708B_DIGIN_PIN;
         if (spec->autocfg.dig_in_pin)
                 spec->dig_in_nid = VT1708B_DIGIN_NID;
 
@@ -2404,6 +2413,7 @@ static int patch_vt1708B_8ch(struct hda_codec *codec)
         if (!spec->adc_nids && spec->input_mux) {
                 spec->adc_nids = vt1708B_adc_nids;
                 spec->num_adc_nids = ARRAY_SIZE(vt1708B_adc_nids);
+                get_mux_nids(codec);
                 spec->mixers[spec->num_mixers] = vt1708B_capture_mixer;
                 spec->num_mixers++;
         }
@@ -2455,6 +2465,7 @@ static int patch_vt1708B_4ch(struct hda_codec *codec)
         if (!spec->adc_nids && spec->input_mux) {
                 spec->adc_nids = vt1708B_adc_nids;
                 spec->num_adc_nids = ARRAY_SIZE(vt1708B_adc_nids);
+                get_mux_nids(codec);
                 spec->mixers[spec->num_mixers] = vt1708B_capture_mixer;
                 spec->num_mixers++;
         }
@@ -2889,6 +2900,7 @@ static int patch_vt1708S(struct hda_codec *codec)
         if (!spec->adc_nids && spec->input_mux) {
                 spec->adc_nids = vt1708S_adc_nids;
                 spec->num_adc_nids = ARRAY_SIZE(vt1708S_adc_nids);
+                get_mux_nids(codec);
                 spec->mixers[spec->num_mixers] = vt1708S_capture_mixer;
                 spec->num_mixers++;
         }
@@ -3206,6 +3218,7 @@ static int patch_vt1702(struct hda_codec *codec)
         if (!spec->adc_nids && spec->input_mux) {
                 spec->adc_nids = vt1702_adc_nids;
                 spec->num_adc_nids = ARRAY_SIZE(vt1702_adc_nids);
+                get_mux_nids(codec);
                 spec->mixers[spec->num_mixers] = vt1702_capture_mixer;
                 spec->num_mixers++;
         }
diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c
index 235a71e5ac8d..b5ca02e2038c 100644
--- a/sound/pci/riptide/riptide.c
+++ b/sound/pci/riptide/riptide.c
@@ -2197,9 +2197,12 @@ static int __init alsa_card_riptide_init(void)
         if (err < 0)
                 return err;
 #if defined(SUPPORT_JOYSTICK)
-        pci_register_driver(&joystick_driver);
+        err = pci_register_driver(&joystick_driver);
+        /* On failure unregister formerly registered audio driver */
+        if (err < 0)
+                pci_unregister_driver(&driver);
 #endif
-        return 0;
+        return err;
 }
 
 static void __exit alsa_card_riptide_exit(void)
diff --git a/sound/soc/codecs/wm8753.c b/sound/soc/codecs/wm8753.c
index d28eeaceb857..49c4b2898aff 100644
--- a/sound/soc/codecs/wm8753.c
+++ b/sound/soc/codecs/wm8753.c
@@ -79,7 +79,7 @@ static const u16 wm8753_reg[] = {
         0x0097, 0x0097, 0x0000, 0x0004,
         0x0000, 0x0083, 0x0024, 0x01ba,
         0x0000, 0x0083, 0x0024, 0x01ba,
-        0x0000, 0x0000
+        0x0000, 0x0000, 0x0000
 };
 
 /* codec private data */
@@ -1660,11 +1660,11 @@ static int wm8753_register(struct wm8753_priv *wm8753)
         codec->set_bias_level = wm8753_set_bias_level;
         codec->dai = wm8753_dai;
         codec->num_dai = 2;
-        codec->reg_cache_size = ARRAY_SIZE(wm8753->reg_cache);
+        codec->reg_cache_size = ARRAY_SIZE(wm8753->reg_cache) + 1;
         codec->reg_cache = &wm8753->reg_cache;
         codec->private_data = wm8753;
 
-        memcpy(codec->reg_cache, wm8753_reg, sizeof(codec->reg_cache));
+        memcpy(codec->reg_cache, wm8753_reg, sizeof(wm8753->reg_cache));
         INIT_DELAYED_WORK(&codec->delayed_work, wm8753_work);
 
         ret = wm8753_reset(codec);
diff --git a/sound/soc/codecs/wm8988.c b/sound/soc/codecs/wm8988.c
index c05f71803aa8..8c0fdf84aac3 100644
--- a/sound/soc/codecs/wm8988.c
+++ b/sound/soc/codecs/wm8988.c
@@ -1037,14 +1037,14 @@ static int __devinit wm8988_spi_probe(struct spi_device *spi)
         codec->control_data = spi;
         codec->dev = &spi->dev;
 
-        spi->dev.driver_data = wm8988;
+        dev_set_drvdata(&spi->dev, wm8988);
 
         return wm8988_register(wm8988);
 }
 
 static int __devexit wm8988_spi_remove(struct spi_device *spi)
 {
-        struct wm8988_priv *wm8988 = spi->dev.driver_data;
+        struct wm8988_priv *wm8988 = dev_get_drvdata(&spi->dev);
 
         wm8988_unregister(wm8988);
 
diff --git a/sound/soc/fsl/mpc5200_dma.c b/sound/soc/fsl/mpc5200_dma.c
index efec33a1c5bd..f0a2d4071998 100644
--- a/sound/soc/fsl/mpc5200_dma.c
+++ b/sound/soc/fsl/mpc5200_dma.c
@@ -456,6 +456,7 @@ int mpc5200_audio_dma_create(struct of_device *op)
                 return -ENODEV;
 
         spin_lock_init(&psc_dma->lock);
+        mutex_init(&psc_dma->mutex);
         psc_dma->id = be32_to_cpu(*prop);
         psc_dma->irq = irq;
         psc_dma->psc_regs = regs;
diff --git a/sound/soc/fsl/mpc5200_dma.h b/sound/soc/fsl/mpc5200_dma.h
index 2000803f06a7..8d396bb9d9fe 100644
--- a/sound/soc/fsl/mpc5200_dma.h
+++ b/sound/soc/fsl/mpc5200_dma.h
@@ -55,6 +55,7 @@ struct psc_dma {
         unsigned int irq;
         struct device *dev;
         spinlock_t lock;
+        struct mutex mutex;
         u32 sicr;
         uint sysclk;
         int imr;
diff --git a/sound/soc/fsl/mpc5200_psc_ac97.c b/sound/soc/fsl/mpc5200_psc_ac97.c
index 794a247b3eb5..7eb549985d49 100644
--- a/sound/soc/fsl/mpc5200_psc_ac97.c
+++ b/sound/soc/fsl/mpc5200_psc_ac97.c
@@ -34,13 +34,20 @@ static unsigned short psc_ac97_read(struct snd_ac97 *ac97, unsigned short reg)
         int status;
         unsigned int val;
 
+        mutex_lock(&psc_dma->mutex);
+
         /* Wait for command send status zero = ready */
         status = spin_event_timeout(!(in_be16(&psc_dma->psc_regs->sr_csr.status) &
                                 MPC52xx_PSC_SR_CMDSEND), 100, 0);
         if (status == 0) {
                 pr_err("timeout on ac97 bus (rdy)\n");
+                mutex_unlock(&psc_dma->mutex);
                 return -ENODEV;
         }
+
+        /* Force clear the data valid bit */
+        in_be32(&psc_dma->psc_regs->ac97_data);
+
         /* Send the read */
         out_be32(&psc_dma->psc_regs->ac97_cmd, (1<<31) | ((reg & 0x7f) << 24));
 
@@ -50,16 +57,19 @@ static unsigned short psc_ac97_read(struct snd_ac97 *ac97, unsigned short reg)
         if (status == 0) {
                 pr_err("timeout on ac97 read (val) %x\n",
                                 in_be16(&psc_dma->psc_regs->sr_csr.status));
+                mutex_unlock(&psc_dma->mutex);
                 return -ENODEV;
         }
         /* Get the data */
         val = in_be32(&psc_dma->psc_regs->ac97_data);
         if (((val >> 24) & 0x7f) != reg) {
                 pr_err("reg echo error on ac97 read\n");
+                mutex_unlock(&psc_dma->mutex);
                 return -ENODEV;
         }
         val = (val >> 8) & 0xffff;
 
+        mutex_unlock(&psc_dma->mutex);
         return (unsigned short) val;
 }
 
@@ -68,16 +78,21 @@ static void psc_ac97_write(struct snd_ac97 *ac97,
 {
         int status;
 
+        mutex_lock(&psc_dma->mutex);
+
         /* Wait for command status zero = ready */
         status = spin_event_timeout(!(in_be16(&psc_dma->psc_regs->sr_csr.status) &
                                 MPC52xx_PSC_SR_CMDSEND), 100, 0);
         if (status == 0) {
                 pr_err("timeout on ac97 bus (write)\n");
-                return;
+                goto out;
         }
         /* Write data */
         out_be32(&psc_dma->psc_regs->ac97_cmd,
                         ((reg & 0x7f) << 24) | (val << 8));
+
+ out:
+        mutex_unlock(&psc_dma->mutex);
 }
 
 static void psc_ac97_warm_reset(struct snd_ac97 *ac97)
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index c7b902358b7b..44b9cdc8a83b 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -2661,7 +2661,7 @@ static int parse_audio_endpoints(struct snd_usb_audio *chip, int iface_no)
         struct usb_interface_descriptor *altsd;
         int i, altno, err, stream;
         int format;
-        struct audioformat *fp;
+        struct audioformat *fp = NULL;
         unsigned char *fmt, *csep;
         int num;
 
@@ -2734,6 +2734,18 @@ static int parse_audio_endpoints(struct snd_usb_audio *chip, int iface_no)
                         continue;
                 }
 
+                /*
+                 * Blue Microphones workaround: The last altsetting is identical
+                 * with the previous one, except for a larger packet size, but
+                 * is actually a mislabeled two-channel setting; ignore it.
+                 */
+                if (fmt[4] == 1 && fmt[5] == 2 && altno == 2 && num == 3 &&
+                    fp && fp->altsetting == 1 && fp->channels == 1 &&
+                    fp->format == SNDRV_PCM_FORMAT_S16_LE &&
+                    le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize) ==
+                                                        fp->maxpacksize * 2)
+                        continue;
+
                 csep = snd_usb_find_desc(alts->endpoint[0].extra, alts->endpoint[0].extralen, NULL, USB_DT_CS_ENDPOINT);
                 /* Creamware Noah has this descriptor after the 2nd endpoint */
                 if (!csep && altsd->bNumEndpoints >= 2)
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 9c6d0ae3708e..7822b3d6baca 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -164,7 +164,7 @@ endif
 
 # CFLAGS and LDFLAGS are for the users to override from the command line.
 
-CFLAGS = $(M64) -ggdb3 -Wall -Wstrict-prototypes -Wmissing-declarations -Wmissing-prototypes -std=gnu99 -Wdeclaration-after-statement -Werror -O6
+CFLAGS = $(M64) -ggdb3 -Wall -Wextra -Wstrict-prototypes -Wmissing-declarations -Wmissing-prototypes -std=gnu99 -Wdeclaration-after-statement -Werror -O6
 LDFLAGS = -lpthread -lrt -lelf -lm
 ALL_CFLAGS = $(CFLAGS)
 ALL_LDFLAGS = $(LDFLAGS)
@@ -223,7 +223,7 @@ SPARSE_FLAGS = -D__BIG_ENDIAN__ -D__powerpc__
 # Those must not be GNU-specific; they are shared with perl/ which may
 # be built by a different compiler. (Note that this is an artifact now
 # but it still might be nice to keep that distinction.)
-BASIC_CFLAGS =
+BASIC_CFLAGS = -Iutil/include
 BASIC_LDFLAGS =
 
 # Guard against environment variables
@@ -289,10 +289,11 @@ export PERL_PATH
 LIB_FILE=libperf.a
 
 LIB_H += ../../include/linux/perf_counter.h
+LIB_H += ../../include/linux/rbtree.h
+LIB_H += ../../include/linux/list.h
+LIB_H += util/include/linux/list.h
 LIB_H += perf.h
 LIB_H += util/types.h
-LIB_H += util/list.h
-LIB_H += util/rbtree.h
 LIB_H += util/levenshtein.h
 LIB_H += util/parse-options.h
 LIB_H += util/parse-events.h
@@ -305,6 +306,7 @@ LIB_H += util/strlist.h
 LIB_H += util/run-command.h
 LIB_H += util/sigchain.h
 LIB_H += util/symbol.h
+LIB_H += util/module.h
 LIB_H += util/color.h
 
 LIB_OBJS += util/abspath.o
@@ -328,6 +330,7 @@ LIB_OBJS += util/usage.o
 LIB_OBJS += util/wrapper.o
 LIB_OBJS += util/sigchain.o
 LIB_OBJS += util/symbol.o
+LIB_OBJS += util/module.o
 LIB_OBJS += util/color.o
 LIB_OBJS += util/pager.o
 LIB_OBJS += util/header.o
@@ -381,12 +384,6 @@ ifndef CC_LD_DYNPATH
         endif
 endif
 
-ifdef ZLIB_PATH
-        BASIC_CFLAGS += -I$(ZLIB_PATH)/include
-        EXTLIBS += -L$(ZLIB_PATH)/$(lib) $(CC_LD_DYNPATH)$(ZLIB_PATH)/$(lib)
-endif
-EXTLIBS += -lz
-
 ifdef NEEDS_SOCKET
         EXTLIBS += -lsocket
 endif
@@ -697,6 +694,9 @@ builtin-init-db.o: builtin-init-db.c PERF-CFLAGS
 util/config.o: util/config.c PERF-CFLAGS
         $(QUIET_CC)$(CC) -o $*.o -c $(ALL_CFLAGS) -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $<
 
+util/rbtree.o: ../../lib/rbtree.c PERF-CFLAGS
+        $(QUIET_CC)$(CC) -o util/rbtree.o -c $(ALL_CFLAGS) -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $<
+
 perf-%$X: %.o $(PERFLIBS)
         $(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) $(filter %.o,$^) $(LIBS)
 
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 722c0f54e549..5f9eefecc574 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -10,9 +10,9 @@
 #include "util/util.h"
 
 #include "util/color.h"
-#include "util/list.h"
+#include <linux/list.h>
 #include "util/cache.h"
-#include "util/rbtree.h"
+#include <linux/rbtree.h>
 #include "util/symbol.h"
 #include "util/string.h"
 
@@ -25,10 +25,6 @@
 #define SHOW_USER       2
 #define SHOW_HV         4
 
-#define MIN_GREEN               0.5
-#define MIN_RED         5.0
-
-
 static char             const *input_name = "perf.data";
 static char             *vmlinux = "vmlinux";
 
@@ -43,6 +39,10 @@ static int		dump_trace = 0;
 
 static int              verbose;
 
+static int              modules;
+
+static int              full_paths;
+
 static int              print_line;
 
 static unsigned long    page_size;
@@ -160,7 +160,7 @@ static void dsos__fprintf(FILE *fp)
 
 static struct symbol *vdso__find_symbol(struct dso *dso, u64 ip)
 {
-        return dso__find_symbol(kernel_dso, ip);
+        return dso__find_symbol(dso, ip);
 }
 
 static int load_kernel(void)
@@ -171,8 +171,8 @@ static int load_kernel(void)
         if (!kernel_dso)
                 return -1;
 
-        err = dso__load_kernel(kernel_dso, vmlinux, NULL, verbose);
-        if (err) {
+        err = dso__load_kernel(kernel_dso, vmlinux, NULL, verbose, modules);
+        if (err <= 0) {
                 dso__delete(kernel_dso);
                 kernel_dso = NULL;
         } else
@@ -203,7 +203,7 @@ static u64 map__map_ip(struct map *map, u64 ip)
         return ip - map->start + map->pgoff;
 }
 
-static u64 vdso__map_ip(struct map *map, u64 ip)
+static u64 vdso__map_ip(struct map *map __used, u64 ip)
 {
         return ip;
 }
@@ -600,7 +600,7 @@ static LIST_HEAD(hist_entry__sort_list);
 
 static int sort_dimension__add(char *tok)
 {
-        int i;
+        unsigned int i;
 
         for (i = 0; i < ARRAY_SIZE(sort_dimensions); i++) {
                 struct sort_dimension *sd = &sort_dimensions[i];
@@ -1043,24 +1043,6 @@ process_event(event_t *event, unsigned long offset, unsigned long head)
         return 0;
 }
 
-static char *get_color(double percent)
-{
-        char *color = PERF_COLOR_NORMAL;
-
-        /*
-         * We color high-overhead entries in red, mid-overhead
-         * entries in green - and keep the low overhead places
-         * normal:
-         */
-        if (percent >= MIN_RED)
-                color = PERF_COLOR_RED;
-        else {
-                if (percent > MIN_GREEN)
-                        color = PERF_COLOR_GREEN;
-        }
-        return color;
-}
-
 static int
 parse_line(FILE *file, struct symbol *sym, u64 start, u64 len)
 {
@@ -1069,7 +1051,7 @@ parse_line(FILE *file, struct symbol *sym, u64 start, u64 len)
         static const char *prev_color;
         unsigned int offset;
         size_t line_len;
-        u64 line_ip;
+        s64 line_ip;
         int ret;
         char *c;
 
@@ -1122,7 +1104,7 @@ parse_line(FILE *file, struct symbol *sym, u64 start, u64 len)
                 } else if (sym->hist_sum)
                         percent = 100.0 * hits / sym->hist_sum;
 
-                color = get_color(percent);
+                color = get_percent_color(percent);
 
                 /*
                  * Also color the filename and line if needed, with
@@ -1258,7 +1240,7 @@ static void print_summary(char *filename)
 
                 sym_ext = rb_entry(node, struct sym_ext, node);
                 percent = sym_ext->percent;
-                color = get_color(percent);
+                color = get_percent_color(percent);
                 path = sym_ext->path;
 
                 color_fprintf(stdout, color, " %7.2f %s", percent, path);
@@ -1268,19 +1250,25 @@ static void print_summary(char *filename)
 
 static void annotate_sym(struct dso *dso, struct symbol *sym)
 {
-        char *filename = dso->name;
+        char *filename = dso->name, *d_filename;
         u64 start, end, len;
         char command[PATH_MAX*2];
         FILE *file;
 
         if (!filename)
                 return;
-        if (dso == kernel_dso)
+        if (sym->module)
+                filename = sym->module->path;
+        else if (dso == kernel_dso)
                 filename = vmlinux;
 
         start = sym->obj_start;
         if (!start)
                 start = sym->start;
+        if (full_paths)
+                d_filename = filename;
+        else
+                d_filename = basename(filename);
 
         end = start + sym->end - sym->start + 1;
         len = sym->end - sym->start;
@@ -1291,13 +1279,14 @@ static void annotate_sym(struct dso *dso, struct symbol *sym)
         }
 
         printf("\n\n------------------------------------------------\n");
-        printf(" Percent |      Source code & Disassembly of %s\n", filename);
+        printf(" Percent |      Source code & Disassembly of %s\n", d_filename);
         printf("------------------------------------------------\n");
 
         if (verbose >= 2)
                 printf("annotating [%p] %30s : [%p] %30s\n", dso, dso->name, sym, sym->name);
 
-        sprintf(command, "objdump --start-address=0x%016Lx --stop-address=0x%016Lx -dS %s", (u64)start, (u64)end, filename);
+        sprintf(command, "objdump --start-address=0x%016Lx --stop-address=0x%016Lx -dS %s|grep -v %s",
+                        (u64)start, (u64)end, filename, filename);
 
         if (verbose >= 3)
                 printf("doing: %s\n", command);
@@ -1428,7 +1417,7 @@ more:
 
         head += size;
 
-        if (offset + head < stat.st_size)
+        if (offset + head < (unsigned long)stat.st_size)
                 goto more;
 
         rc = EXIT_SUCCESS;
@@ -1472,8 +1461,12 @@ static const struct option options[] = {
         OPT_BOOLEAN('D', "dump-raw-trace", &dump_trace,
                     "dump raw trace in ASCII"),
         OPT_STRING('k', "vmlinux", &vmlinux, "file", "vmlinux pathname"),
+        OPT_BOOLEAN('m', "modules", &modules,
+                    "load module symbols - WARNING: use only with -k and LIVE kernel"),
         OPT_BOOLEAN('l', "print-line", &print_line,
                     "print matching source lines (may be slow)"),
+        OPT_BOOLEAN('P', "full-paths", &full_paths,
+                    "Don't shorten the displayed pathnames"),
         OPT_END()
 };
 
@@ -1492,7 +1485,7 @@ static void setup_sorting(void)
         free(str);
 }
 
-int cmd_annotate(int argc, const char **argv, const char *prefix)
+int cmd_annotate(int argc, const char **argv, const char *prefix __used)
 {
         symbol__init();
 
diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c
index 0f32dc3f3c4c..2599d86a733b 100644
--- a/tools/perf/builtin-help.c
+++ b/tools/perf/builtin-help.c
@@ -3,6 +3,7 @@
  *
  * Builtin help command
  */
+#include "perf.h"
 #include "util/cache.h"
 #include "builtin.h"
 #include "util/exec_cmd.h"
@@ -277,7 +278,7 @@ static struct cmdnames main_cmds, other_cmds;
 
 void list_common_cmds_help(void)
 {
-        int i, longest = 0;
+        unsigned int i, longest = 0;
 
         for (i = 0; i < ARRAY_SIZE(common_cmds); i++) {
                 if (longest < strlen(common_cmds[i].name))
@@ -415,9 +416,10 @@ static void show_html_page(const char *perf_cmd)
         open_html(page_path.buf);
 }
 
-int cmd_help(int argc, const char **argv, const char *prefix)
+int cmd_help(int argc, const char **argv, const char *prefix __used)
 {
         const char *alias;
+
         load_command_list("perf-", &main_cmds, &other_cmds);
 
         perf_config(perf_help_config, NULL);
diff --git a/tools/perf/builtin-list.c b/tools/perf/builtin-list.c
index fe60e37c96ef..f990fa8a35c9 100644
--- a/tools/perf/builtin-list.c
+++ b/tools/perf/builtin-list.c
@@ -13,7 +13,7 @@
 #include "util/parse-options.h"
 #include "util/parse-events.h"
 
-int cmd_list(int argc, const char **argv, const char *prefix)
+int cmd_list(int argc __used, const char **argv __used, const char *prefix __used)
 {
         print_events();
         return 0;
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index d18546f37d7c..4ef78a5e6f32 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -294,7 +294,7 @@ static void pid_synthesize_mmap_samples(pid_t pid)
         while (1) {
                 char bf[BUFSIZ], *pbf = bf;
                 struct mmap_event mmap_ev = {
-                        .header.type = PERF_EVENT_MMAP,
+                        .header = { .type = PERF_EVENT_MMAP },
                 };
                 int n;
                 size_t size;
@@ -650,7 +650,7 @@ static const struct option options[] = {
         OPT_END()
 };
 
-int cmd_record(int argc, const char **argv, const char *prefix)
+int cmd_record(int argc, const char **argv, const char *prefix __used)
 {
         int counter;
 
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 135b7837e6bf..4e5cc266311e 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -10,9 +10,9 @@
 #include "util/util.h"
 
 #include "util/color.h"
-#include "util/list.h"
+#include <linux/list.h>
 #include "util/cache.h"
-#include "util/rbtree.h"
+#include <linux/rbtree.h>
 #include "util/symbol.h"
 #include "util/string.h"
 #include "util/callchain.h"
@@ -46,6 +46,8 @@ static int		dump_trace = 0;
 static int              verbose;
 #define eprintf(x...)   do { if (verbose) fprintf(stderr, x); } while (0)
 
+static int              modules;
+
 static int              full_paths;
 
 static unsigned long    page_size;
@@ -56,8 +58,17 @@ static char		*parent_pattern = default_parent_pattern;
 static regex_t          parent_regex;
 
 static int              exclude_other = 1;
+
+static char             callchain_default_opt[] = "fractal,0.5";
+
 static int              callchain;
 
+static
+struct callchain_param  callchain_param = {
+        .mode   = CHAIN_GRAPH_ABS,
+        .min_percent = 0.5
+};
+
 static u64              sample_type;
 
 struct ip_event {
@@ -121,6 +132,7 @@ typedef union event_union {
 static LIST_HEAD(dsos);
 static struct dso *kernel_dso;
 static struct dso *vdso;
+static struct dso *hypervisor_dso;
 
 static void dsos__add(struct dso *dso)
 {
@@ -176,7 +188,7 @@ static void dsos__fprintf(FILE *fp)
 
 static struct symbol *vdso__find_symbol(struct dso *dso, u64 ip)
 {
-        return dso__find_symbol(kernel_dso, ip);
+        return dso__find_symbol(dso, ip);
 }
 
 static int load_kernel(void)
@@ -187,8 +199,8 @@ static int load_kernel(void)
         if (!kernel_dso)
                 return -1;
 
-        err = dso__load_kernel(kernel_dso, vmlinux, NULL, verbose);
-        if (err) {
+        err = dso__load_kernel(kernel_dso, vmlinux, NULL, verbose, modules);
+        if (err <= 0) {
                 dso__delete(kernel_dso);
                 kernel_dso = NULL;
         } else
@@ -202,6 +214,11 @@ static int load_kernel(void)
 
         dsos__add(vdso);
 
+        hypervisor_dso = dso__new("[hypervisor]", 0);
+        if (!hypervisor_dso)
+                return -1;
+        dsos__add(hypervisor_dso);
+
         return err;
 }
 
@@ -233,7 +250,7 @@ static u64 map__map_ip(struct map *map, u64 ip)
         return ip - map->start + map->pgoff;
 }
 
-static u64 vdso__map_ip(struct map *map, u64 ip)
+static u64 vdso__map_ip(struct map *map __used, u64 ip)
 {
         return ip;
 }
@@ -640,7 +657,11 @@ sort__sym_print(FILE *fp, struct hist_entry *self)
 
         if (self->sym) {
                 ret += fprintf(fp, "[%c] %s",
-                        self->dso == kernel_dso ? 'k' : '.', self->sym->name);
+                        self->dso == kernel_dso ? 'k' :
+                        self->dso == hypervisor_dso ? 'h' : '.', self->sym->name);
+
+                if (self->sym->module)
+                        ret += fprintf(fp, "\t[%s]", self->sym->module->name);
         } else {
                 ret += fprintf(fp, "%#016llx", (u64)self->ip);
         }
@@ -705,7 +726,7 @@ static LIST_HEAD(hist_entry__sort_list);
 
 static int sort_dimension__add(char *tok)
 {
-        int i;
+        unsigned int i;
 
         for (i = 0; i < ARRAY_SIZE(sort_dimensions); i++) {
                 struct sort_dimension *sd = &sort_dimensions[i];
@@ -775,8 +796,109 @@ hist_entry__collapse(struct hist_entry *left, struct hist_entry *right)
         return cmp;
 }
 
+static size_t ipchain__fprintf_graph_line(FILE *fp, int depth, int depth_mask)
+{
+        int i;
+        size_t ret = 0;
+
+        ret += fprintf(fp, "%s", "                ");
+
+        for (i = 0; i < depth; i++)
+                if (depth_mask & (1 << i))
+                        ret += fprintf(fp, "|          ");
+                else
+                        ret += fprintf(fp, "           ");
+
+        ret += fprintf(fp, "\n");
+
+        return ret;
+}
+static size_t
+ipchain__fprintf_graph(FILE *fp, struct callchain_list *chain, int depth,
+                       int depth_mask, int count, u64 total_samples,
+                       int hits)
+{
+        int i;
+        size_t ret = 0;
+
+        ret += fprintf(fp, "%s", "                ");
+        for (i = 0; i < depth; i++) {
+                if (depth_mask & (1 << i))
+                        ret += fprintf(fp, "|");
+                else
+                        ret += fprintf(fp, " ");
+                if (!count && i == depth - 1) {
+                        double percent;
+
+                        percent = hits * 100.0 / total_samples;
+                        ret += percent_color_fprintf(fp, "--%2.2f%%-- ", percent);
+                } else
+                        ret += fprintf(fp, "%s", "          ");
+        }
+        if (chain->sym)
+                ret += fprintf(fp, "%s\n", chain->sym->name);
+        else
+                ret += fprintf(fp, "%p\n", (void *)(long)chain->ip);
+
+        return ret;
+}
+
+static size_t
+callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
+                        u64 total_samples, int depth, int depth_mask)
+{
+        struct rb_node *node, *next;
+        struct callchain_node *child;
+        struct callchain_list *chain;
+        int new_depth_mask = depth_mask;
+        u64 new_total;
+        size_t ret = 0;
+        int i;
+
+        if (callchain_param.mode == CHAIN_GRAPH_REL)
+                new_total = self->cumul_hit;
+        else
+                new_total = total_samples;
+
+        node = rb_first(&self->rb_root);
+        while (node) {
+                child = rb_entry(node, struct callchain_node, rb_node);
+
+                /*
+                 * The depth mask manages the output of pipes that show
+                 * the depth. We don't want to keep the pipes of the current
+                 * level for the last child of this depth
+                 */
+                next = rb_next(node);
+                if (!next)
+                        new_depth_mask &= ~(1 << (depth - 1));
+
+                /*
+                 * But we keep the older depth mask for the line seperator
+                 * to keep the level link until we reach the last child
+                 */
+                ret += ipchain__fprintf_graph_line(fp, depth, depth_mask);
+                i = 0;
+                list_for_each_entry(chain, &child->val, list) {
+                        if (chain->ip >= PERF_CONTEXT_MAX)
+                                continue;
+                        ret += ipchain__fprintf_graph(fp, chain, depth,
+                                                      new_depth_mask, i++,
+                                                      new_total,
+                                                      child->cumul_hit);
+                }
+                ret += callchain__fprintf_graph(fp, child, new_total,
+                                                depth + 1,
+                                                new_depth_mask | (1 << depth));
+                node = next;
+        }
+
+        return ret;
+}
+
 static size_t
-callchain__fprintf(FILE *fp, struct callchain_node *self, u64 total_samples)
+callchain__fprintf_flat(FILE *fp, struct callchain_node *self,
+                        u64 total_samples)
 {
         struct callchain_list *chain;
         size_t ret = 0;
@@ -784,11 +906,18 @@ callchain__fprintf(FILE *fp, struct callchain_node *self, u64 total_samples)
         if (!self)
                 return 0;
 
-        ret += callchain__fprintf(fp, self->parent, total_samples);
+        ret += callchain__fprintf_flat(fp, self->parent, total_samples);
 
 
-        list_for_each_entry(chain, &self->val, list)
-                ret += fprintf(fp, "                %p\n", (void *)chain->ip);
+        list_for_each_entry(chain, &self->val, list) {
+                if (chain->ip >= PERF_CONTEXT_MAX)
+                        continue;
+                if (chain->sym)
+                        ret += fprintf(fp, "                %s\n", chain->sym->name);
+                else
+                        ret += fprintf(fp, "                %p\n",
+                                        (void *)(long)chain->ip);
+        }
 
         return ret;
 }
@@ -807,8 +936,19 @@ hist_entry_callchain__fprintf(FILE *fp, struct hist_entry *self,
 
                 chain = rb_entry(rb_node, struct callchain_node, rb_node);
                 percent = chain->hit * 100.0 / total_samples;
-                ret += fprintf(fp, "           %6.2f%%\n", percent);
-                ret += callchain__fprintf(fp, chain, total_samples);
+                switch (callchain_param.mode) {
+                case CHAIN_FLAT:
+                        ret += percent_color_fprintf(fp, "           %6.2f%%\n",
+                                                     percent);
+                        ret += callchain__fprintf_flat(fp, chain, total_samples);
+                        break;
+                case CHAIN_GRAPH_ABS: /* Falldown */
+                case CHAIN_GRAPH_REL:
+                        ret += callchain__fprintf_graph(fp, chain,
+                                                        total_samples, 1, 1);
+                default:
+                        break;
+                }
                 ret += fprintf(fp, "\n");
                 rb_node = rb_next(rb_node);
         }
@@ -826,25 +966,10 @@ hist_entry__fprintf(FILE *fp, struct hist_entry *self, u64 total_samples)
         if (exclude_other && !self->parent)
                 return 0;
 
-        if (total_samples) {
-                double percent = self->count * 100.0 / total_samples;
-                char *color = PERF_COLOR_NORMAL;
-
-                /*
-                 * We color high-overhead entries in red, mid-overhead
-                 * entries in green - and keep the low overhead places
-                 * normal:
-                 */
-                if (percent >= 5.0) {
-                        color = PERF_COLOR_RED;
-                } else {
-                        if (percent >= 0.5)
-                                color = PERF_COLOR_GREEN;
-                }
-
-                ret = color_fprintf(fp, color, "   %6.2f%%",
+        if (total_samples)
+                ret = percent_color_fprintf(fp, "   %6.2f%%",
                                 (self->count * 100.0) / total_samples);
-        } else
+        else
                 ret = fprintf(fp, "%12Ld ", self->count);
 
         list_for_each_entry(se, &hist_entry__sort_list, list) {
@@ -923,6 +1048,58 @@ static int call__match(struct symbol *sym)
         return 0;
 }
 
+static struct symbol **
+resolve_callchain(struct thread *thread, struct map *map __used,
+                    struct ip_callchain *chain, struct hist_entry *entry)
+{
+        u64 context = PERF_CONTEXT_MAX;
+        struct symbol **syms = NULL;
+        unsigned int i;
+
+        if (callchain) {
+                syms = calloc(chain->nr, sizeof(*syms));
+                if (!syms) {
+                        fprintf(stderr, "Can't allocate memory for symbols\n");
+                        exit(-1);
+                }
+        }
+
+        for (i = 0; i < chain->nr; i++) {
+                u64 ip = chain->ips[i];
+                struct dso *dso = NULL;
+                struct symbol *sym;
+
+                if (ip >= PERF_CONTEXT_MAX) {
+                        context = ip;
+                        continue;
+                }
+
+                switch (context) {
+                case PERF_CONTEXT_HV:
+                        dso = hypervisor_dso;
+                        break;
+                case PERF_CONTEXT_KERNEL:
+                        dso = kernel_dso;
+                        break;
+                default:
+                        break;
+                }
+
+                sym = resolve_symbol(thread, NULL, &dso, &ip);
+
+                if (sym) {
+                        if (sort__has_parent && call__match(sym) &&
+                            !entry->parent)
+                                entry->parent = sym;
+                        if (!callchain)
+                                break;
+                        syms[i] = sym;
+                }
+        }
+
+        return syms;
+}
+
 /*
  * collect histogram counts
  */
@@ -935,6 +1112,7 @@ hist_entry__add(struct thread *thread, struct map *map, struct dso *dso,
         struct rb_node **p = &hist.rb_node;
         struct rb_node *parent = NULL;
         struct hist_entry *he;
+        struct symbol **syms = NULL;
         struct hist_entry entry = {
                 .thread = thread,
                 .map    = map,
@@ -948,36 +1126,8 @@ hist_entry__add(struct thread *thread, struct map *map, struct dso *dso,
         };
         int cmp;
 
-        if (sort__has_parent && chain) {
-                u64 context = PERF_CONTEXT_MAX;
-                int i;
-
-                for (i = 0; i < chain->nr; i++) {
-                        u64 ip = chain->ips[i];
-                        struct dso *dso = NULL;
-                        struct symbol *sym;
-
-                        if (ip >= PERF_CONTEXT_MAX) {
-                                context = ip;
-                                continue;
-                        }
-
-                        switch (context) {
-                        case PERF_CONTEXT_KERNEL:
-                                dso = kernel_dso;
-                                break;
-                        default:
-                                break;
-                        }
-
-                        sym = resolve_symbol(thread, NULL, &dso, &ip);
-
-                        if (sym && call__match(sym)) {
-                                entry.parent = sym;
-                                break;
-                        }
-                }
-        }
+        if ((sort__has_parent || callchain) && chain)
+                syms = resolve_callchain(thread, map, chain, &entry);
 
         while (*p != NULL) {
                 parent = *p;
@@ -987,8 +1137,10 @@ hist_entry__add(struct thread *thread, struct map *map, struct dso *dso,
 
                 if (!cmp) {
                         he->count += count;
-                        if (callchain)
-                                append_chain(&he->callchain, chain);
+                        if (callchain) {
+                                append_chain(&he->callchain, chain, syms);
+                                free(syms);
+                        }
                         return 0;
                 }
 
@@ -1004,7 +1156,8 @@ hist_entry__add(struct thread *thread, struct map *map, struct dso *dso,
         *he = entry;
         if (callchain) {
                 callchain_init(&he->callchain);
-                append_chain(&he->callchain, chain);
+                append_chain(&he->callchain, chain, syms);
+                free(syms);
         }
         rb_link_node(&he->rb_node, parent, p);
         rb_insert_color(&he->rb_node, &hist);
@@ -1076,14 +1229,15 @@ static void collapse__resort(void)
 
 static struct rb_root output_hists;
 
-static void output__insert_entry(struct hist_entry *he)
+static void output__insert_entry(struct hist_entry *he, u64 min_callchain_hits)
 {
         struct rb_node **p = &output_hists.rb_node;
         struct rb_node *parent = NULL;
         struct hist_entry *iter;
 
         if (callchain)
-                sort_chain_to_rbtree(&he->sorted_chain, &he->callchain);
+                callchain_param.sort(&he->sorted_chain, &he->callchain,
+                                      min_callchain_hits, &callchain_param);
 
         while (*p != NULL) {
                 parent = *p;
@@ -1099,11 +1253,14 @@ static void output__insert_entry(struct hist_entry *he)
         rb_insert_color(&he->rb_node, &output_hists);
 }
 
-static void output__resort(void)
+static void output__resort(u64 total_samples)
 {
         struct rb_node *next;
         struct hist_entry *n;
         struct rb_root *tree = &hist;
+        u64 min_callchain_hits;
+
+        min_callchain_hits = total_samples * (callchain_param.min_percent / 100);
 
         if (sort__need_collapse)
                 tree = &collapse_hists;
@@ -1115,7 +1272,7 @@ static void output__resort(void)
                 next = rb_next(&n->rb_node);
 
                 rb_erase(&n->rb_node, tree);
-                output__insert_entry(n);
+                output__insert_entry(n, min_callchain_hits);
         }
 }
 
@@ -1141,7 +1298,7 @@ static size_t output__fprintf(FILE *fp, u64 total_samples)
 
         fprintf(fp, "# ........");
         list_for_each_entry(se, &hist_entry__sort_list, list) {
-                int i;
+                unsigned int i;
 
                 if (exclude_other && (se == &sort_parent))
                         continue;
@@ -1213,6 +1370,7 @@ process_sample_event(event_t *event, unsigned long offset, unsigned long head)
         struct map *map = NULL;
         void *more_data = event->ip.__more_data;
         struct ip_callchain *chain = NULL;
+        int cpumode;
 
         if (sample_type & PERF_SAMPLE_PERIOD) {
                 period = *(u64 *)more_data;
@@ -1228,7 +1386,7 @@ process_sample_event(event_t *event, unsigned long offset, unsigned long head)
                 (long long)period);
 
         if (sample_type & PERF_SAMPLE_CALLCHAIN) {
-                int i;
+                unsigned int i;
 
                 chain = (void *)more_data;
 
@@ -1256,7 +1414,9 @@ process_sample_event(event_t *event, unsigned long offset, unsigned long head)
         if (comm_list && !strlist__has_entry(comm_list, thread->comm))
                 return 0;
 
-        if (event->header.misc & PERF_EVENT_MISC_KERNEL) {
+        cpumode = event->header.misc & PERF_EVENT_MISC_CPUMODE_MASK;
+
+        if (cpumode == PERF_EVENT_MISC_KERNEL) {
                 show = SHOW_KERNEL;
                 level = 'k';
 
@@ -1264,7 +1424,7 @@ process_sample_event(event_t *event, unsigned long offset, unsigned long head)
 
                 dprintf(" ...... dso: %s\n", dso->name);
 
-        } else if (event->header.misc & PERF_EVENT_MISC_USER) {
+        } else if (cpumode == PERF_EVENT_MISC_USER) {
 
                 show = SHOW_USER;
                 level = '.';
@@ -1272,6 +1432,9 @@ process_sample_event(event_t *event, unsigned long offset, unsigned long head)
         } else {
                 show = SHOW_HV;
                 level = 'H';
+
+                dso = hypervisor_dso;
+
                 dprintf(" ...... dso: [hypervisor]\n");
         }
 
@@ -1534,9 +1697,19 @@ static int __cmd_report(void)
 
         sample_type = perf_header__sample_type();
 
-        if (sort__has_parent && !(sample_type & PERF_SAMPLE_CALLCHAIN)) {
-                fprintf(stderr, "selected --sort parent, but no callchain data\n");
-                exit(-1);
+        if (!(sample_type & PERF_SAMPLE_CALLCHAIN)) {
+                if (sort__has_parent) {
+                        fprintf(stderr, "selected --sort parent, but no"
+                                        " callchain data. Did you call"
+                                        " perf record without -g?\n");
+                        exit(-1);
+                }
+                if (callchain) {
+                        fprintf(stderr, "selected -c but no callchain data."
+                                        " Did you call perf record without"
+                                        " -g?\n");
+                        exit(-1);
+                }
         }
 
         if (load_kernel() < 0) {
@@ -1619,7 +1792,7 @@ more:
         if (offset + head >= header->data_offset + header->data_size)
                 goto done;
 
-        if (offset + head < stat.st_size)
+        if (offset + head < (unsigned long)stat.st_size)
                 goto more;
 
 done:
@@ -1643,12 +1816,58 @@ done:
                 dsos__fprintf(stdout);
 
         collapse__resort();
-        output__resort();
+        output__resort(total);
         output__fprintf(stdout, total);
 
         return rc;
 }
 
+static int
+parse_callchain_opt(const struct option *opt __used, const char *arg,
+                    int unset __used)
+{
+        char *tok;
+        char *endptr;
+
+        callchain = 1;
+
+        if (!arg)
+                return 0;
+
+        tok = strtok((char *)arg, ",");
+        if (!tok)
+                return -1;
+
+        /* get the output mode */
+        if (!strncmp(tok, "graph", strlen(arg)))
+                callchain_param.mode = CHAIN_GRAPH_ABS;
+
+        else if (!strncmp(tok, "flat", strlen(arg)))
+                callchain_param.mode = CHAIN_FLAT;
+
+        else if (!strncmp(tok, "fractal", strlen(arg)))
+                callchain_param.mode = CHAIN_GRAPH_REL;
+
+        else
+                return -1;
+
+        /* get the min percentage */
+        tok = strtok(NULL, ",");
+        if (!tok)
+                goto setup;
+
+        callchain_param.min_percent = strtod(tok, &endptr);
+        if (tok == endptr)
+                return -1;
+
+setup:
+        if (register_callchain_param(&callchain_param) < 0) {
+                fprintf(stderr, "Can't register callchain params\n");
+                return -1;
+        }
+        return 0;
+}
+
 static const char * const report_usage[] = {
         "perf report [<options>] <command>",
         NULL
@@ -1662,6 +1881,8 @@ static const struct option options[] = {
         OPT_BOOLEAN('D', "dump-raw-trace", &dump_trace,
                     "dump raw trace in ASCII"),
         OPT_STRING('k', "vmlinux", &vmlinux, "file", "vmlinux pathname"),
+        OPT_BOOLEAN('m', "modules", &modules,
+                    "load module symbols - WARNING: use only with -k and LIVE kernel"),
         OPT_STRING('s', "sort", &sort_order, "key[,key2...]",
                    "sort by key(s): pid, comm, dso, symbol, parent"),
         OPT_BOOLEAN('P', "full-paths", &full_paths,
@@ -1670,7 +1891,9 @@ static const struct option options[] = {
                    "regex filter to identify parent, see: '--sort parent'"),
         OPT_BOOLEAN('x', "exclude-other", &exclude_other,
                     "Only display entries with parent-match"),
-        OPT_BOOLEAN('c', "callchain", &callchain, "Display callchains"),
+        OPT_CALLBACK_DEFAULT('c', "callchain", NULL, "output_type,min_percent",
+                     "Display callchains using output_type and min percent threshold. "
+                     "Default: flat,0", &parse_callchain_opt, callchain_default_opt),
         OPT_STRING('d', "dsos", &dso_list_str, "dso[,dso...]",
                    "only consider symbols in these dsos"),
         OPT_STRING('C', "comms", &comm_list_str, "comm[,comm...]",
@@ -1708,7 +1931,7 @@ static void setup_list(struct strlist **list, const char *list_str,
         }
 }
 
-int cmd_report(int argc, const char **argv, const char *prefix)
+int cmd_report(int argc, const char **argv, const char *prefix __used)
 {
         symbol__init();
 
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 2e03524a1de0..27921a8ce1a9 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -64,7 +64,7 @@ static struct perf_counter_attr default_attrs[] = {
 
 static int                      system_wide                     =  0;
 static int                      verbose                         =  0;
-static int                      nr_cpus                         =  0;
+static unsigned int             nr_cpus                         =  0;
 static int                      run_idx                         =  0;
 
 static int                      run_count                       =  1;
@@ -96,6 +96,10 @@ static u64			walltime_nsecs_noise;
 static u64                      runtime_cycles_avg;
 static u64                      runtime_cycles_noise;
 
+#define MATCH_EVENT(t, c, counter)                      \
+        (attrs[counter].type == PERF_TYPE_##t &&        \
+         attrs[counter].config == PERF_COUNT_##c)
+
 #define ERR_PERF_OPEN \
 "Error: counter %d, sys_perf_counter_open() syscall returned with %d (%s)\n"
 
@@ -108,7 +112,8 @@ static void create_perf_stat_counter(int counter, int pid)
                                     PERF_FORMAT_TOTAL_TIME_RUNNING;
 
         if (system_wide) {
-                int cpu;
+                unsigned int cpu;
+
                 for (cpu = 0; cpu < nr_cpus; cpu++) {
                         fd[cpu][counter] = sys_perf_counter_open(attr, -1, cpu, -1, 0);
                         if (fd[cpu][counter] < 0 && verbose)
@@ -132,13 +137,8 @@ static void create_perf_stat_counter(int counter, int pid)
  */
 static inline int nsec_counter(int counter)
 {
-        if (attrs[counter].type != PERF_TYPE_SOFTWARE)
-                return 0;
-
-        if (attrs[counter].config == PERF_COUNT_SW_CPU_CLOCK)
-                return 1;
-
-        if (attrs[counter].config == PERF_COUNT_SW_TASK_CLOCK)
+        if (MATCH_EVENT(SOFTWARE, SW_CPU_CLOCK, counter) ||
+            MATCH_EVENT(SOFTWARE, SW_TASK_CLOCK, counter))
                 return 1;
 
         return 0;
@@ -150,8 +150,8 @@ static inline int nsec_counter(int counter)
 static void read_counter(int counter)
 {
         u64 *count, single_count[3];
-        ssize_t res;
-        int cpu, nv;
+        unsigned int cpu;
+        size_t res, nv;
         int scaled;
 
         count = event_res[run_idx][counter];
@@ -165,6 +165,7 @@ static void read_counter(int counter)
 
                 res = read(fd[cpu][counter], single_count, nv * sizeof(u64));
                 assert(res == nv * sizeof(u64));
+
                 close(fd[cpu][counter]);
                 fd[cpu][counter] = -1;
 
@@ -192,15 +193,13 @@ static void read_counter(int counter)
         /*
          * Save the full runtime - to allow normalization during printout:
          */
-        if (attrs[counter].type == PERF_TYPE_SOFTWARE &&
-                attrs[counter].config == PERF_COUNT_SW_TASK_CLOCK)
+        if (MATCH_EVENT(SOFTWARE, SW_TASK_CLOCK, counter))
                 runtime_nsecs[run_idx] = count[0];
-        if (attrs[counter].type == PERF_TYPE_HARDWARE &&
-                attrs[counter].config == PERF_COUNT_HW_CPU_CYCLES)
+        if (MATCH_EVENT(HARDWARE, HW_CPU_CYCLES, counter))
                 runtime_cycles[run_idx] = count[0];
 }
 
-static int run_perf_stat(int argc, const char **argv)
+static int run_perf_stat(int argc __used, const char **argv)
 {
         unsigned long long t0, t1;
         int status = 0;
@@ -240,7 +239,8 @@ static int run_perf_stat(int argc, const char **argv)
                 /*
                  * Wait until the parent tells us to go.
                  */
-                read(go_pipe[0], &buf, 1);
+                if (read(go_pipe[0], &buf, 1) == -1)
+                        perror("unable to read pipe");
 
                 execvp(argv[0], (char **)argv);
 
@@ -253,7 +253,8 @@ static int run_perf_stat(int argc, const char **argv)
          */
         close(child_ready_pipe[1]);
         close(go_pipe[0]);
-        read(child_ready_pipe[0], &buf, 1);
+        if (read(child_ready_pipe[0], &buf, 1) == -1)
+                perror("unable to read pipe");
         close(child_ready_pipe[0]);
 
         for (counter = 0; counter < nr_counters; counter++)
@@ -290,9 +291,7 @@ static void nsec_printout(int counter, u64 *count, u64 *noise)
 
         fprintf(stderr, " %14.6f  %-24s", msecs, event_name(counter));
 
-        if (attrs[counter].type == PERF_TYPE_SOFTWARE &&
-                attrs[counter].config == PERF_COUNT_SW_TASK_CLOCK) {
-
+        if (MATCH_EVENT(SOFTWARE, SW_TASK_CLOCK, counter)) {
                 if (walltime_nsecs_avg)
                         fprintf(stderr, " # %10.3f CPUs ",
                                 (double)count[0] / (double)walltime_nsecs_avg);
@@ -305,9 +304,7 @@ static void abs_printout(int counter, u64 *count, u64 *noise)
         fprintf(stderr, " %14Ld  %-24s", count[0], event_name(counter));
 
         if (runtime_cycles_avg &&
-                attrs[counter].type == PERF_TYPE_HARDWARE &&
-                        attrs[counter].config == PERF_COUNT_HW_INSTRUCTIONS) {
-
+            MATCH_EVENT(HARDWARE, HW_INSTRUCTIONS, counter)) {
                 fprintf(stderr, " # %10.3f IPC  ",
                         (double)count[0] / (double)runtime_cycles_avg);
         } else {
@@ -390,7 +387,7 @@ static void calc_avg(void)
                                 event_res_avg[j]+1, event_res[i][j]+1);
                         update_avg("counter/2", j,
                                 event_res_avg[j]+2, event_res[i][j]+2);
-                        if (event_scaled[i][j] != -1)
+                        if (event_scaled[i][j] != (u64)-1)
                                 update_avg("scaled", j,
                                         event_scaled_avg + j, event_scaled[i]+j);
                         else
@@ -510,7 +507,7 @@ static const struct option options[] = {
         OPT_END()
 };
 
-int cmd_stat(int argc, const char **argv, const char *prefix)
+int cmd_stat(int argc, const char **argv, const char *prefix __used)
 {
         int status;
 
@@ -528,7 +525,7 @@ int cmd_stat(int argc, const char **argv, const char *prefix)
 
         nr_cpus = sysconf(_SC_NPROCESSORS_ONLN);
         assert(nr_cpus <= MAX_NR_CPUS);
-        assert(nr_cpus >= 0);
+        assert((int)nr_cpus >= 0);
 
         /*
          * We dont want to block the signals - that would cause
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index cf0d21f1ae10..95d5c0ae375a 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -23,7 +23,7 @@
 #include "util/symbol.h"
 #include "util/color.h"
 #include "util/util.h"
-#include "util/rbtree.h"
+#include <linux/rbtree.h>
 #include "util/parse-options.h"
 #include "util/parse-events.h"
 
@@ -66,6 +66,7 @@ static unsigned int		page_size;
 static unsigned int             mmap_pages                      = 16;
 static int                      freq                            =  0;
 static int                      verbose                         =  0;
+static char                     *vmlinux                        =  NULL;
 
 static char                     *sym_filter;
 static unsigned long            filter_start;
@@ -238,7 +239,6 @@ static void print_sym_table(void)
         for (nd = rb_first(&tmp); nd; nd = rb_next(nd)) {
                 struct sym_entry *syme = rb_entry(nd, struct sym_entry, rb_node);
                 struct symbol *sym = (struct symbol *)(syme + 1);
-                char *color = PERF_COLOR_NORMAL;
                 double pcnt;
 
                 if (++printed > print_entries || syme->snap_count < count_filter)
@@ -247,29 +247,20 @@ static void print_sym_table(void)
                 pcnt = 100.0 - (100.0 * ((sum_ksamples - syme->snap_count) /
                                          sum_ksamples));
 
-                /*
-                 * We color high-overhead entries in red, mid-overhead
-                 * entries in green - and keep the low overhead places
-                 * normal:
-                 */
-                if (pcnt >= 5.0) {
-                        color = PERF_COLOR_RED;
-                } else {
-                        if (pcnt >= 0.5)
-                                color = PERF_COLOR_GREEN;
-                }
-
                 if (nr_counters == 1)
                         printf("%20.2f - ", syme->weight);
                 else
                         printf("%9.1f %10ld - ", syme->weight, syme->snap_count);
 
-                color_fprintf(stdout, color, "%4.1f%%", pcnt);
-                printf(" - %016llx : %s\n", sym->start, sym->name);
+                percent_color_fprintf(stdout, "%4.1f%%", pcnt);
+                printf(" - %016llx : %s", sym->start, sym->name);
+                if (sym->module)
+                        printf("\t[%s]", sym->module->name);
+                printf("\n");
         }
 }
 
-static void *display_thread(void *arg)
+static void *display_thread(void *arg __used)
 {
         struct pollfd stdin_poll = { .fd = 0, .events = POLLIN };
         int delay_msecs = delay_secs * 1000;
@@ -286,11 +277,31 @@ static void *display_thread(void *arg)
         return NULL;
 }
 
+/* Tag samples to be skipped. */
+static const char *skip_symbols[] = {
+        "default_idle",
+        "cpu_idle",
+        "enter_idle",
+        "exit_idle",
+        "mwait_idle",
+        "ppc64_runlatch_off",
+        "pseries_dedicated_idle_sleep",
+        NULL
+};
+
 static int symbol_filter(struct dso *self, struct symbol *sym)
 {
         static int filter_match;
         struct sym_entry *syme;
         const char *name = sym->name;
+        int i;
+
+        /*
+         * ppc64 uses function descriptors and appends a '.' to the
+         * start of every instruction address. Remove it.
+         */
+        if (name[0] == '.')
+                name++;
 
         if (!strcmp(name, "_text") ||
             !strcmp(name, "_etext") ||
@@ -302,13 +313,12 @@ static int symbol_filter(struct dso *self, struct symbol *sym)
                 return 1;
 
         syme = dso__sym_priv(self, sym);
-        /* Tag samples to be skipped. */
-        if (!strcmp("default_idle", name) ||
-            !strcmp("cpu_idle", name) ||
-            !strcmp("enter_idle", name) ||
-            !strcmp("exit_idle", name) ||
-            !strcmp("mwait_idle", name))
-                syme->skip = 1;
+        for (i = 0; skip_symbols[i]; i++) {
+                if (!strcmp(skip_symbols[i], name)) {
+                        syme->skip = 1;
+                        break;
+                }
+        }
 
         if (filter_match == 1) {
                 filter_end = sym->start;
@@ -340,12 +350,13 @@ static int parse_symbols(void)
 {
         struct rb_node *node;
         struct symbol  *sym;
+        int modules = vmlinux ? 1 : 0;
 
         kernel_dso = dso__new("[kernel]", sizeof(struct sym_entry));
         if (kernel_dso == NULL)
                 return -1;
 
-        if (dso__load_kernel(kernel_dso, NULL, symbol_filter, 1) != 0)
+        if (dso__load_kernel(kernel_dso, vmlinux, symbol_filter, verbose, modules) <= 0)
                 goto out_delete_dso;
 
         node = rb_first(&kernel_dso->syms);
@@ -407,7 +418,7 @@ static void process_event(u64 ip, int counter, int user)
 struct mmap_data {
         int                     counter;
         void                    *base;
-        unsigned int            mask;
+        int                     mask;
         unsigned int            prev;
 };
 
@@ -661,6 +672,7 @@ static const struct option options[] = {
                             "system-wide collection from all CPUs"),
         OPT_INTEGER('C', "CPU", &profile_cpu,
                     "CPU to profile on"),
+        OPT_STRING('k', "vmlinux", &vmlinux, "file", "vmlinux pathname"),
         OPT_INTEGER('m', "mmap-pages", &mmap_pages,
                     "number of mmap data pages"),
         OPT_INTEGER('r', "realtime", &realtime_prio,
@@ -675,7 +687,7 @@ static const struct option options[] = {
                             "put the counters into a counter group"),
         OPT_STRING('s', "sym-filter", &sym_filter, "pattern",
                     "only display symbols matchig this pattern"),
-        OPT_BOOLEAN('z', "zero", &group,
+        OPT_BOOLEAN('z', "zero", &zero,
                     "zero history across updates"),
         OPT_INTEGER('F', "freq", &freq,
                     "profile at this frequency"),
@@ -686,10 +698,12 @@ static const struct option options[] = {
         OPT_END()
 };
 
-int cmd_top(int argc, const char **argv, const char *prefix)
+int cmd_top(int argc, const char **argv, const char *prefix __used)
 {
         int counter;
 
+        symbol__init();
+
         page_size = sysconf(_SC_PAGE_SIZE);
 
         argc = parse_options(argc, argv, options, top_usage, 0);
diff --git a/tools/perf/perf.c b/tools/perf/perf.c
index 4eb725933703..c5656784c61d 100644
--- a/tools/perf/perf.c
+++ b/tools/perf/perf.c
@@ -229,9 +229,6 @@ static int run_builtin(struct cmd_struct *p, int argc, const char **argv)
                 use_pager = 1;
         commit_pager_choice();
 
-        if (p->option & NEED_WORK_TREE)
-                /* setup_work_tree() */;
-
         status = p->fn(argc, argv, prefix);
         if (status)
                 return status & 0xff;
@@ -266,7 +263,7 @@ static void handle_internal_command(int argc, const char **argv)
                 { "annotate", cmd_annotate, 0 },
                 { "version", cmd_version, 0 },
         };
-        int i;
+        unsigned int i;
         static const char ext[] = STRIP_EXTENSION;
 
         if (sizeof(ext) > 1) {
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index d3042a6ba03d..63e67cc5487b 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -68,6 +68,8 @@ static inline unsigned long long rdclock(void)
 #define __user
 #define asmlinkage
 
+#define __used          __attribute__((__unused__))
+
 #define unlikely(x)     __builtin_expect(!!(x), 0)
 #define min(x, y) ({                            \
         typeof(x) _min1 = (x);                  \
diff --git a/tools/perf/util/alias.c b/tools/perf/util/alias.c
index 9b3dd2b428df..b8144e80bb1e 100644
--- a/tools/perf/util/alias.c
+++ b/tools/perf/util/alias.c
@@ -3,7 +3,7 @@
 static const char *alias_key;
 static char *alias_val;
 
-static int alias_lookup_cb(const char *k, const char *v, void *cb)
+static int alias_lookup_cb(const char *k, const char *v, void *cb __used)
 {
         if (!prefixcmp(k, "alias.") && !strcmp(k+6, alias_key)) {
                 if (!v)
diff --git a/tools/perf/util/cache.h b/tools/perf/util/cache.h
index 393d6146d13b..161d5f413e28 100644
--- a/tools/perf/util/cache.h
+++ b/tools/perf/util/cache.h
@@ -3,6 +3,7 @@
 
 #include "util.h"
 #include "strbuf.h"
+#include "../perf.h"
 
 #define PERF_DIR_ENVIRONMENT "PERF_DIR"
 #define PERF_WORK_TREE_ENVIRONMENT "PERF_WORK_TREE"
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index ad3c28578961..9d3c8141b8c1 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -4,6 +4,9 @@
  * Handle the callchains from the stream in an ad-hoc radix tree and then
  * sort them in an rbtree.
  *
+ * Using a radix for code path provides a fast retrieval and factorizes
+ * memory use. Also that lets us use the paths in a hierarchical graph view.
+ *
  */
 
 #include <stdlib.h>
@@ -13,8 +16,12 @@
 
 #include "callchain.h"
 
+#define chain_for_each_child(child, parent)     \
+        list_for_each_entry(child, &parent->children, brothers)
 
-static void rb_insert_callchain(struct rb_root *root, struct callchain_node *chain)
+static void
+rb_insert_callchain(struct rb_root *root, struct callchain_node *chain,
+                    enum chain_mode mode)
 {
         struct rb_node **p = &root->rb_node;
         struct rb_node *parent = NULL;
@@ -24,32 +31,125 @@ static void rb_insert_callchain(struct rb_root *root, struct callchain_node *cha
                 parent = *p;
                 rnode = rb_entry(parent, struct callchain_node, rb_node);
 
-                if (rnode->hit < chain->hit)
-                        p = &(*p)->rb_left;
-                else
-                        p = &(*p)->rb_right;
+                switch (mode) {
+                case CHAIN_FLAT:
+                        if (rnode->hit < chain->hit)
+                                p = &(*p)->rb_left;
+                        else
+                                p = &(*p)->rb_right;
+                        break;
+                case CHAIN_GRAPH_ABS: /* Falldown */
+                case CHAIN_GRAPH_REL:
+                        if (rnode->cumul_hit < chain->cumul_hit)
+                                p = &(*p)->rb_left;
+                        else
+                                p = &(*p)->rb_right;
+                        break;
+                default:
+                        break;
+                }
         }
 
         rb_link_node(&chain->rb_node, parent, p);
         rb_insert_color(&chain->rb_node, root);
 }
 
+static void
+__sort_chain_flat(struct rb_root *rb_root, struct callchain_node *node,
+                  u64 min_hit)
+{
+        struct callchain_node *child;
+
+        chain_for_each_child(child, node)
+                __sort_chain_flat(rb_root, child, min_hit);
+
+        if (node->hit && node->hit >= min_hit)
+                rb_insert_callchain(rb_root, node, CHAIN_FLAT);
+}
+
 /*
  * Once we get every callchains from the stream, we can now
  * sort them by hit
  */
-void sort_chain_to_rbtree(struct rb_root *rb_root, struct callchain_node *node)
+static void
+sort_chain_flat(struct rb_root *rb_root, struct callchain_node *node,
+                u64 min_hit, struct callchain_param *param __used)
+{
+        __sort_chain_flat(rb_root, node, min_hit);
+}
+
+static void __sort_chain_graph_abs(struct callchain_node *node,
+                                   u64 min_hit)
+{
+        struct callchain_node *child;
+
+        node->rb_root = RB_ROOT;
+
+        chain_for_each_child(child, node) {
+                __sort_chain_graph_abs(child, min_hit);
+                if (child->cumul_hit >= min_hit)
+                        rb_insert_callchain(&node->rb_root, child,
+                                            CHAIN_GRAPH_ABS);
+        }
+}
+
+static void
+sort_chain_graph_abs(struct rb_root *rb_root, struct callchain_node *chain_root,
+                     u64 min_hit, struct callchain_param *param __used)
+{
+        __sort_chain_graph_abs(chain_root, min_hit);
+        rb_root->rb_node = chain_root->rb_root.rb_node;
+}
+
+static void __sort_chain_graph_rel(struct callchain_node *node,
+                                   double min_percent)
 {
         struct callchain_node *child;
+        u64 min_hit;
 
-        list_for_each_entry(child, &node->children, brothers)
-                sort_chain_to_rbtree(rb_root, child);
+        node->rb_root = RB_ROOT;
+        min_hit = node->cumul_hit * min_percent / 100.0;
 
-        if (node->hit)
-                rb_insert_callchain(rb_root, node);
+        chain_for_each_child(child, node) {
+                __sort_chain_graph_rel(child, min_percent);
+                if (child->cumul_hit >= min_hit)
+                        rb_insert_callchain(&node->rb_root, child,
+                                            CHAIN_GRAPH_REL);
+        }
 }
 
-static struct callchain_node *create_child(struct callchain_node *parent)
+static void
+sort_chain_graph_rel(struct rb_root *rb_root, struct callchain_node *chain_root,
+                     u64 min_hit __used, struct callchain_param *param)
+{
+        __sort_chain_graph_rel(chain_root, param->min_percent);
+        rb_root->rb_node = chain_root->rb_root.rb_node;
+}
+
+int register_callchain_param(struct callchain_param *param)
+{
+        switch (param->mode) {
+        case CHAIN_GRAPH_ABS:
+                param->sort = sort_chain_graph_abs;
+                break;
+        case CHAIN_GRAPH_REL:
+                param->sort = sort_chain_graph_rel;
+                break;
+        case CHAIN_FLAT:
+                param->sort = sort_chain_flat;
+                break;
+        default:
+                return -1;
+        }
+        return 0;
+}
+
+/*
+ * Create a child for a parent. If inherit_children, then the new child
+ * will become the new parent of it's parent children
+ */
+static struct callchain_node *
+create_child(struct callchain_node *parent, bool inherit_children)
 {
         struct callchain_node *new;
 
@@ -61,91 +161,147 @@ static struct callchain_node *create_child(struct callchain_node *parent)
         new->parent = parent;
         INIT_LIST_HEAD(&new->children);
         INIT_LIST_HEAD(&new->val);
+
+        if (inherit_children) {
+                struct callchain_node *next;
+
+                list_splice(&parent->children, &new->children);
+                INIT_LIST_HEAD(&parent->children);
+
+                chain_for_each_child(next, new)
+                        next->parent = new;
+        }
         list_add_tail(&new->brothers, &parent->children);
 
         return new;
 }
 
+/*
+ * Fill the node with callchain values
+ */
 static void
-fill_node(struct callchain_node *node, struct ip_callchain *chain, int start)
+fill_node(struct callchain_node *node, struct ip_callchain *chain,
+          int start, struct symbol **syms)
 {
-        int i;
+        unsigned int i;
 
         for (i = start; i < chain->nr; i++) {
                 struct callchain_list *call;
 
-                call = malloc(sizeof(*chain));
+                call = malloc(sizeof(*call));
                 if (!call) {
                         perror("not enough memory for the code path tree");
                         return;
                 }
                 call->ip = chain->ips[i];
+                call->sym = syms[i];
                 list_add_tail(&call->list, &node->val);
         }
-        node->val_nr = i - start;
+        node->val_nr = chain->nr - start;
+        if (!node->val_nr)
+                printf("Warning: empty node in callchain tree\n");
 }
 
-static void add_child(struct callchain_node *parent, struct ip_callchain *chain)
+static void
+add_child(struct callchain_node *parent, struct ip_callchain *chain,
+          int start, struct symbol **syms)
 {
         struct callchain_node *new;
 
-        new = create_child(parent);
-        fill_node(new, chain, parent->val_nr);
+        new = create_child(parent, false);
+        fill_node(new, chain, start, syms);
 
-        new->hit = 1;
+        new->cumul_hit = new->hit = 1;
 }
 
+/*
+ * Split the parent in two parts (a new child is created) and
+ * give a part of its callchain to the created child.
+ * Then create another child to host the given callchain of new branch
+ */
 static void
 split_add_child(struct callchain_node *parent, struct ip_callchain *chain,
-                struct callchain_list *to_split, int idx)
+                struct callchain_list *to_split, int idx_parents, int idx_local,
+                struct symbol **syms)
 {
         struct callchain_node *new;
+        struct list_head *old_tail;
+        unsigned int idx_total = idx_parents + idx_local;
 
         /* split */
-        new = create_child(parent);
-        list_move_tail(&to_split->list, &new->val);
-        new->hit = parent->hit;
-        parent->hit = 0;
-        parent->val_nr = idx;
+        new = create_child(parent, true);
 
-        /* create the new one */
-        add_child(parent, chain);
+        /* split the callchain and move a part to the new child */
+        old_tail = parent->val.prev;
+        list_del_range(&to_split->list, old_tail);
+        new->val.next = &to_split->list;
+        new->val.prev = old_tail;
+        to_split->list.prev = &new->val;
+        old_tail->next = &new->val;
+
+        /* split the hits */
+        new->hit = parent->hit;
+        new->cumul_hit = parent->cumul_hit;
+        new->val_nr = parent->val_nr - idx_local;
+        parent->val_nr = idx_local;
+
+        /* create a new child for the new branch if any */
+        if (idx_total < chain->nr) {
+                parent->hit = 0;
+                add_child(parent, chain, idx_total, syms);
+        } else {
+                parent->hit = 1;
+        }
 }
 
 static int
 __append_chain(struct callchain_node *root, struct ip_callchain *chain,
-                int start);
+               unsigned int start, struct symbol **syms);
 
-static int
-__append_chain_children(struct callchain_node *root, struct ip_callchain *chain)
+static void
+__append_chain_children(struct callchain_node *root, struct ip_callchain *chain,
+                        struct symbol **syms, unsigned int start)
 {
         struct callchain_node *rnode;
 
         /* lookup in childrens */
-        list_for_each_entry(rnode, &root->children, brothers) {
-                int ret = __append_chain(rnode, chain, root->val_nr);
+        chain_for_each_child(rnode, root) {
+                unsigned int ret = __append_chain(rnode, chain, start, syms);
+
                 if (!ret)
-                        return 0;
+                        goto cumul;
         }
-        return -1;
+        /* nothing in children, add to the current node */
+        add_child(root, chain, start, syms);
+
+cumul:
+        root->cumul_hit++;
 }
 
 static int
 __append_chain(struct callchain_node *root, struct ip_callchain *chain,
-                int start)
+               unsigned int start, struct symbol **syms)
 {
         struct callchain_list *cnode;
-        int i = start;
+        unsigned int i = start;
         bool found = false;
 
-        /* lookup in the current node */
+        /*
+         * Lookup in the current node
+         * If we have a symbol, then compare the start to match
+         * anywhere inside a function.
+         */
         list_for_each_entry(cnode, &root->val, list) {
-                if (cnode->ip != chain->ips[i++])
+                if (i == chain->nr)
+                        break;
+                if (cnode->sym && syms[i]) {
+                        if (cnode->sym->start != syms[i]->start)
+                                break;
+                } else if (cnode->ip != chain->ips[i])
                         break;
                 if (!found)
                         found = true;
-                if (i == chain->nr)
-                        break;
+                i++;
         }
 
         /* matches not, relay on the parent */
@@ -153,22 +309,27 @@ __append_chain(struct callchain_node *root, struct ip_callchain *chain,
                 return -1;
 
         /* we match only a part of the node. Split it and add the new chain */
-        if (i < root->val_nr) {
-                split_add_child(root, chain, cnode, i);
+        if (i - start < root->val_nr) {
+                split_add_child(root, chain, cnode, start, i - start, syms);
                 return 0;
         }
 
         /* we match 100% of the path, increment the hit */
-        if (i == root->val_nr) {
+        if (i - start == root->val_nr && i == chain->nr) {
                 root->hit++;
+                root->cumul_hit++;
+
                 return 0;
         }
 
-        return __append_chain_children(root, chain);
+        /* We match the node and still have a part remaining */
+        __append_chain_children(root, chain, syms, i);
+
+        return 0;
 }
 
-void append_chain(struct callchain_node *root, struct ip_callchain *chain)
+void append_chain(struct callchain_node *root, struct ip_callchain *chain,
+                  struct symbol **syms)
 {
-        if (__append_chain_children(root, chain) == -1)
-                add_child(root, chain);
+        __append_chain_children(root, chain, syms, 0);
 }
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index fa1cd2f71fd3..7812122bea1d 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -2,22 +2,42 @@
 #define __PERF_CALLCHAIN_H
 
 #include "../perf.h"
-#include "list.h"
-#include "rbtree.h"
+#include <linux/list.h>
+#include <linux/rbtree.h>
+#include "symbol.h"
 
+enum chain_mode {
+        CHAIN_FLAT,
+        CHAIN_GRAPH_ABS,
+        CHAIN_GRAPH_REL
+};
 
 struct callchain_node {
         struct callchain_node   *parent;
         struct list_head        brothers;
-        struct list_head        children;
-        struct list_head        val;
-        struct rb_node          rb_node;
-        int                     val_nr;
-        int                     hit;
+        struct list_head        children;
+        struct list_head        val;
+        struct rb_node          rb_node; /* to sort nodes in an rbtree */
+        struct rb_root          rb_root; /* sorted tree of children */
+        unsigned int            val_nr;
+        u64                     hit;
+        u64                     cumul_hit; /* hit + hits of children */
+};
+
+struct callchain_param;
+
+typedef void (*sort_chain_func_t)(struct rb_root *, struct callchain_node *,
+                                 u64, struct callchain_param *);
+
+struct callchain_param {
+        enum chain_mode         mode;
+        double                  min_percent;
+        sort_chain_func_t       sort;
 };
 
 struct callchain_list {
-        unsigned long           ip;
+        u64                     ip;
+        struct symbol           *sym;
         struct list_head        list;
 };
 
@@ -28,6 +48,7 @@ static inline void callchain_init(struct callchain_node *node)
         INIT_LIST_HEAD(&node->val);
 }
 
-void append_chain(struct callchain_node *root, struct ip_callchain *chain);
-void sort_chain_to_rbtree(struct rb_root *rb_root, struct callchain_node *node);
+int register_callchain_param(struct callchain_param *param);
+void append_chain(struct callchain_node *root, struct ip_callchain *chain,
+                  struct symbol **syms);
 #endif
diff --git a/tools/perf/util/color.c b/tools/perf/util/color.c
index 9a8c20ccc53e..90a044d1fe7d 100644
--- a/tools/perf/util/color.c
+++ b/tools/perf/util/color.c
@@ -11,7 +11,8 @@ static int parse_color(const char *name, int len)
         };
         char *end;
         int i;
-        for (i = 0; i < ARRAY_SIZE(color_names); i++) {
+
+        for (i = 0; i < (int)ARRAY_SIZE(color_names); i++) {
                 const char *str = color_names[i];
                 if (!strncasecmp(name, str, len) && !str[len])
                         return i - 1;
@@ -28,7 +29,8 @@ static int parse_attr(const char *name, int len)
         static const char * const attr_names[] = {
                 "bold", "dim", "ul", "blink", "reverse"
         };
-        int i;
+        unsigned int i;
+
         for (i = 0; i < ARRAY_SIZE(attr_names); i++) {
                 const char *str = attr_names[i];
                 if (!strncasecmp(name, str, len) && !str[len])
@@ -222,10 +224,12 @@ int color_fwrite_lines(FILE *fp, const char *color,
 {
         if (!*color)
                 return fwrite(buf, count, 1, fp) != 1;
+
         while (count) {
                 char *p = memchr(buf, '\n', count);
+
                 if (p != buf && (fputs(color, fp) < 0 ||
-                                fwrite(buf, p ? p - buf : count, 1, fp) != 1 ||
+                                fwrite(buf, p ? (size_t)(p - buf) : count, 1, fp) != 1 ||
                                 fputs(PERF_COLOR_RESET, fp) < 0))
                         return -1;
                 if (!p)
@@ -238,4 +242,31 @@ int color_fwrite_lines(FILE *fp, const char *color,
         return 0;
 }
 
+char *get_percent_color(double percent)
+{
+        char *color = PERF_COLOR_NORMAL;
 
+        /*
+         * We color high-overhead entries in red, mid-overhead
+         * entries in green - and keep the low overhead places
+         * normal:
+         */
+        if (percent >= MIN_RED)
+                color = PERF_COLOR_RED;
+        else {
+                if (percent > MIN_GREEN)
+                        color = PERF_COLOR_GREEN;
+        }
+        return color;
+}
+
+int percent_color_fprintf(FILE *fp, const char *fmt, double percent)
+{
+        int r;
+        char *color;
+
+        color = get_percent_color(percent);
+        r = color_fprintf(fp, color, fmt, percent);
+
+        return r;
+}
diff --git a/tools/perf/util/color.h b/tools/perf/util/color.h
index 5abfd379582b..706cec50bd25 100644
--- a/tools/perf/util/color.h
+++ b/tools/perf/util/color.h
@@ -15,6 +15,9 @@
 #define PERF_COLOR_CYAN         "\033[36m"
 #define PERF_COLOR_BG_RED       "\033[41m"
 
+#define MIN_GREEN       0.5
+#define MIN_RED         5.0
+
 /*
  * This variable stores the value of color.ui
  */
@@ -32,5 +35,7 @@ void color_parse_mem(const char *value, int len, const char *var, char *dst);
 int color_fprintf(FILE *fp, const char *color, const char *fmt, ...);
 int color_fprintf_ln(FILE *fp, const char *color, const char *fmt, ...);
 int color_fwrite_lines(FILE *fp, const char *color, size_t count, const char *buf);
+int percent_color_fprintf(FILE *fp, const char *fmt, double percent);
+char *get_percent_color(double percent);
 
 #endif /* COLOR_H */
diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
index 3dd13faa6a27..780df541006d 100644
--- a/tools/perf/util/config.c
+++ b/tools/perf/util/config.c
@@ -47,10 +47,12 @@ static int get_next_char(void)
 static char *parse_value(void)
 {
         static char value[1024];
-        int quote = 0, comment = 0, len = 0, space = 0;
+        int quote = 0, comment = 0, space = 0;
+        size_t len = 0;
 
         for (;;) {
                 int c = get_next_char();
+
                 if (len >= sizeof(value) - 1)
                         return NULL;
                 if (c == '\n') {
@@ -353,13 +355,13 @@ int perf_config_string(const char **dest, const char *var, const char *value)
         return 0;
 }
 
-static int perf_default_core_config(const char *var, const char *value)
+static int perf_default_core_config(const char *var __used, const char *value __used)
 {
         /* Add other config variables here and to Documentation/config.txt. */
         return 0;
 }
 
-int perf_default_config(const char *var, const char *value, void *dummy)
+int perf_default_config(const char *var, const char *value, void *dummy __used)
 {
         if (!prefixcmp(var, "core."))
                 return perf_default_core_config(var, value);
@@ -471,10 +473,10 @@ static int matches(const char* key, const char* value)
                   !regexec(store.value_regex, value, 0, NULL, 0)));
 }
 
-static int store_aux(const char* key, const char* value, void *cb)
+static int store_aux(const char* key, const char* value, void *cb __used)
 {
+        int section_len;
         const char *ep;
-        size_t section_len;
 
         switch (store.state) {
         case KEY_SEEN:
@@ -551,7 +553,7 @@ static int store_write_section(int fd, const char* key)
                 strbuf_addf(&sb, "[%.*s]\n", store.baselen, key);
         }
 
-        success = write_in_full(fd, sb.buf, sb.len) == sb.len;
+        success = (write_in_full(fd, sb.buf, sb.len) == (ssize_t)sb.len);
         strbuf_release(&sb);
 
         return success;
@@ -599,7 +601,7 @@ static int store_write_pair(int fd, const char* key, const char* value)
                 }
         strbuf_addf(&sb, "%s\n", quote);
 
-        success = write_in_full(fd, sb.buf, sb.len) == sb.len;
+        success = (write_in_full(fd, sb.buf, sb.len) == (ssize_t)sb.len);
         strbuf_release(&sb);
 
         return success;
@@ -741,7 +743,7 @@ int perf_config_set_multivar(const char* key, const char* value,
         } else {
                 struct stat st;
                 char* contents;
-                size_t contents_sz, copy_begin, copy_end;
+                ssize_t contents_sz, copy_begin, copy_end;
                 int i, new_line = 0;
 
                 if (value_regex == NULL)
diff --git a/tools/perf/util/exec_cmd.c b/tools/perf/util/exec_cmd.c
index d39292263153..34a352867382 100644
--- a/tools/perf/util/exec_cmd.c
+++ b/tools/perf/util/exec_cmd.c
@@ -1,6 +1,9 @@
 #include "cache.h"
 #include "exec_cmd.h"
 #include "quote.h"
+
+#include <string.h>
+
 #define MAX_ARGS        32
 
 extern char **environ;
@@ -51,7 +54,7 @@ const char *perf_extract_argv0_path(const char *argv0)
                 slash--;
 
         if (slash >= argv0) {
-                argv0_path = strndup(argv0, slash - argv0);
+                argv0_path = xstrndup(argv0, slash - argv0);
                 return slash + 1;
         }
 
diff --git a/tools/perf/util/help.c b/tools/perf/util/help.c
index 17a00e0df2c4..fbb00978b2e2 100644
--- a/tools/perf/util/help.c
+++ b/tools/perf/util/help.c
@@ -26,7 +26,7 @@ static int term_columns(void)
         return 80;
 }
 
-void add_cmdname(struct cmdnames *cmds, const char *name, int len)
+void add_cmdname(struct cmdnames *cmds, const char *name, size_t len)
 {
         struct cmdname *ent = malloc(sizeof(*ent) + len + 1);
 
@@ -40,7 +40,8 @@ void add_cmdname(struct cmdnames *cmds, const char *name, int len)
 
 static void clean_cmdnames(struct cmdnames *cmds)
 {
-        int i;
+        unsigned int i;
+
         for (i = 0; i < cmds->cnt; ++i)
                 free(cmds->names[i]);
         free(cmds->names);
@@ -57,7 +58,7 @@ static int cmdname_compare(const void *a_, const void *b_)
 
 static void uniq(struct cmdnames *cmds)
 {
-        int i, j;
+        unsigned int i, j;
 
         if (!cmds->cnt)
                 return;
@@ -71,7 +72,7 @@ static void uniq(struct cmdnames *cmds)
 
 void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
 {
-        int ci, cj, ei;
+        size_t ci, cj, ei;
         int cmp;
 
         ci = cj = ei = 0;
@@ -106,8 +107,9 @@ static void pretty_print_string_list(struct cmdnames *cmds, int longest)
                 printf("  ");
 
                 for (j = 0; j < cols; j++) {
-                        int n = j * rows + i;
-                        int size = space;
+                        unsigned int n = j * rows + i;
+                        unsigned int size = space;
+
                         if (n >= cmds->cnt)
                                 break;
                         if (j == cols-1 || n + rows >= cmds->cnt)
@@ -208,7 +210,7 @@ void load_command_list(const char *prefix,
 void list_commands(const char *title, struct cmdnames *main_cmds,
                    struct cmdnames *other_cmds)
 {
-        int i, longest = 0;
+        unsigned int i, longest = 0;
 
         for (i = 0; i < main_cmds->cnt; i++)
                 if (longest < main_cmds->names[i]->len)
@@ -239,7 +241,8 @@ void list_commands(const char *title, struct cmdnames *main_cmds,
 
 int is_in_cmdlist(struct cmdnames *c, const char *s)
 {
-        int i;
+        unsigned int i;
+
         for (i = 0; i < c->cnt; i++)
                 if (!strcmp(s, c->names[i]->name))
                         return 1;
@@ -271,7 +274,8 @@ static int levenshtein_compare(const void *p1, const void *p2)
 
 static void add_cmd_list(struct cmdnames *cmds, struct cmdnames *old)
 {
-        int i;
+        unsigned int i;
+
         ALLOC_GROW(cmds->names, cmds->cnt + old->cnt, cmds->alloc);
 
         for (i = 0; i < old->cnt; i++)
@@ -283,7 +287,7 @@ static void add_cmd_list(struct cmdnames *cmds, struct cmdnames *old)
 
 const char *help_unknown_cmd(const char *cmd)
 {
-        int i, n = 0, best_similarity = 0;
+        unsigned int i, n = 0, best_similarity = 0;
         struct cmdnames main_cmds, other_cmds;
 
         memset(&main_cmds, 0, sizeof(main_cmds));
@@ -345,7 +349,7 @@ const char *help_unknown_cmd(const char *cmd)
         exit(1);
 }
 
-int cmd_version(int argc, const char **argv, const char *prefix)
+int cmd_version(int argc __used, const char **argv __used, const char *prefix __used)
 {
         printf("perf version %s\n", perf_version_string);
         return 0;
diff --git a/tools/perf/util/help.h b/tools/perf/util/help.h
index 56bc15406ffc..7128783637b4 100644
--- a/tools/perf/util/help.h
+++ b/tools/perf/util/help.h
@@ -2,8 +2,8 @@
 #define HELP_H
 
 struct cmdnames {
-        int alloc;
-        int cnt;
+        size_t alloc;
+        size_t cnt;
         struct cmdname {
                 size_t len; /* also used for similarity index in help.c */
                 char name[FLEX_ARRAY];
@@ -19,7 +19,7 @@ static inline void mput_char(char c, unsigned int num)
 void load_command_list(const char *prefix,
                 struct cmdnames *main_cmds,
                 struct cmdnames *other_cmds);
-void add_cmdname(struct cmdnames *cmds, const char *name, int len);
+void add_cmdname(struct cmdnames *cmds, const char *name, size_t len);
 /* Here we require that excludes is a sorted list. */
 void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes);
 int is_in_cmdlist(struct cmdnames *c, const char *s);
diff --git a/tools/perf/util/include/asm/system.h b/tools/perf/util/include/asm/system.h
new file mode 100644
index 000000000000..710cecca972d
--- /dev/null
+++ b/tools/perf/util/include/asm/system.h
@@ -0,0 +1 @@
+/* Empty */
diff --git a/tools/perf/util/include/linux/kernel.h b/tools/perf/util/include/linux/kernel.h
new file mode 100644
index 000000000000..99c1b3d1edd9
--- /dev/null
+++ b/tools/perf/util/include/linux/kernel.h
@@ -0,0 +1,21 @@
+#ifndef PERF_LINUX_KERNEL_H_
+#define PERF_LINUX_KERNEL_H_
+
+#ifndef offsetof
+#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+#endif
+
+#ifndef container_of
+/**
+ * container_of - cast a member of a structure out to the containing structure
+ * @ptr:        the pointer to the member.
+ * @type:       the type of the container struct this is embedded in.
+ * @member:     the name of the member within the struct.
+ *
+ */
+#define container_of(ptr, type, member) ({                      \
+        const typeof(((type *)0)->member) * __mptr = (ptr);     \
+        (type *)((char *)__mptr - offsetof(type, member)); })
+#endif
+
+#endif
diff --git a/tools/perf/util/include/linux/list.h b/tools/perf/util/include/linux/list.h
new file mode 100644
index 000000000000..dbe4b814382a
--- /dev/null
+++ b/tools/perf/util/include/linux/list.h
@@ -0,0 +1,18 @@
+#include "../../../../include/linux/list.h"
+
+#ifndef PERF_LIST_H
+#define PERF_LIST_H
+/**
+ * list_del_range - deletes range of entries from list.
+ * @begin: first element in the range to delete from the list.
+ * @end: last element in the range to delete from the list.
+ * Note: list_empty on the range of entries does not return true after this,
+ * the entries is in an undefined state.
+ */
+static inline void list_del_range(struct list_head *begin,
+                                  struct list_head *end)
+{
+        begin->prev->next = end->next;
+        end->next->prev = begin->prev;
+}
+#endif
diff --git a/tools/perf/util/include/linux/module.h b/tools/perf/util/include/linux/module.h
new file mode 100644
index 000000000000..b43e2dc21e04
--- /dev/null
+++ b/tools/perf/util/include/linux/module.h
@@ -0,0 +1,6 @@
+#ifndef PERF_LINUX_MODULE_H
+#define PERF_LINUX_MODULE_H
+
+#define EXPORT_SYMBOL(name)
+
+#endif
diff --git a/tools/perf/util/include/linux/poison.h b/tools/perf/util/include/linux/poison.h
new file mode 100644
index 000000000000..fef6dbc9ce13
--- /dev/null
+++ b/tools/perf/util/include/linux/poison.h
@@ -0,0 +1 @@
+#include "../../../../include/linux/poison.h"
diff --git a/tools/perf/util/include/linux/prefetch.h b/tools/perf/util/include/linux/prefetch.h
new file mode 100644
index 000000000000..7841e485d8c3
--- /dev/null
+++ b/tools/perf/util/include/linux/prefetch.h
@@ -0,0 +1,6 @@
+#ifndef PERF_LINUX_PREFETCH_H
+#define PERF_LINUX_PREFETCH_H
+
+static inline void prefetch(void *a __attribute__((unused))) { }
+
+#endif
diff --git a/tools/perf/util/include/linux/rbtree.h b/tools/perf/util/include/linux/rbtree.h
new file mode 100644
index 000000000000..7a243a143037
--- /dev/null
+++ b/tools/perf/util/include/linux/rbtree.h
@@ -0,0 +1 @@
+#include "../../../../include/linux/rbtree.h"
diff --git a/tools/perf/util/list.h b/tools/perf/util/list.h
deleted file mode 100644
index e2548e8072cf..000000000000
--- a/tools/perf/util/list.h
+++ /dev/null
@@ -1,603 +0,0 @@
-#ifndef _LINUX_LIST_H
-#define _LINUX_LIST_H
-/*
-  Copyright (C) Cast of dozens, comes from the Linux kernel
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-*/
-
-#include <stddef.h>
-
-/*
- * These are non-NULL pointers that will result in page faults
- * under normal circumstances, used to verify that nobody uses
- * non-initialized list entries.
- */
-#define LIST_POISON1 ((void *)0x00100100)
-#define LIST_POISON2 ((void *)0x00200200)
-
-/**
- * container_of - cast a member of a structure out to the containing structure
- * @ptr:        the pointer to the member.
- * @type:       the type of the container struct this is embedded in.
- * @member:     the name of the member within the struct.
- *
- */
-#define container_of(ptr, type, member) ({                      \
-        const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
-        (type *)( (char *)__mptr - offsetof(type,member) );})
-
-/*
- * Simple doubly linked list implementation.
- *
- * Some of the internal functions ("__xxx") are useful when
- * manipulating whole lists rather than single entries, as
- * sometimes we already know the next/prev entries and we can
- * generate better code by using them directly rather than
- * using the generic single-entry routines.
- */
-
-struct list_head {
-        struct list_head *next, *prev;
-};
-
-#define LIST_HEAD_INIT(name) { &(name), &(name) }
-
-#define LIST_HEAD(name) \
-        struct list_head name = LIST_HEAD_INIT(name)
-
-static inline void INIT_LIST_HEAD(struct list_head *list)
-{
-        list->next = list;
-        list->prev = list;
-}
-
-/*
- * Insert a new entry between two known consecutive entries.
- *
- * This is only for internal list manipulation where we know
- * the prev/next entries already!
- */
-static inline void __list_add(struct list_head *new,
-                              struct list_head *prev,
-                              struct list_head *next)
-{
-        next->prev = new;
-        new->next = next;
-        new->prev = prev;
-        prev->next = new;
-}
-
-/**
- * list_add - add a new entry
- * @new: new entry to be added
- * @head: list head to add it after
- *
- * Insert a new entry after the specified head.
- * This is good for implementing stacks.
- */
-static inline void list_add(struct list_head *new, struct list_head *head)
-{
-        __list_add(new, head, head->next);
-}
-
-/**
- * list_add_tail - add a new entry
- * @new: new entry to be added
- * @head: list head to add it before
- *
- * Insert a new entry before the specified head.
- * This is useful for implementing queues.
- */
-static inline void list_add_tail(struct list_head *new, struct list_head *head)
-{
-        __list_add(new, head->prev, head);
-}
-
-/*
- * Delete a list entry by making the prev/next entries
- * point to each other.
- *
- * This is only for internal list manipulation where we know
- * the prev/next entries already!
- */
-static inline void __list_del(struct list_head * prev, struct list_head * next)
-{
-        next->prev = prev;
-        prev->next = next;
-}
-
-/**
- * list_del - deletes entry from list.
- * @entry: the element to delete from the list.
- * Note: list_empty on entry does not return true after this, the entry is
- * in an undefined state.
- */
-static inline void list_del(struct list_head *entry)
-{
-        __list_del(entry->prev, entry->next);
-        entry->next = LIST_POISON1;
-        entry->prev = LIST_POISON2;
-}
-
-/**
- * list_del_range - deletes range of entries from list.
- * @beging: first element in the range to delete from the list.
- * @beging: first element in the range to delete from the list.
- * Note: list_empty on the range of entries does not return true after this,
- * the entries is in an undefined state.
- */
-static inline void list_del_range(struct list_head *begin,
-                                  struct list_head *end)
-{
-        begin->prev->next = end->next;
-        end->next->prev = begin->prev;
-}
-
-/**
- * list_replace - replace old entry by new one
- * @old : the element to be replaced
- * @new : the new element to insert
- * Note: if 'old' was empty, it will be overwritten.
- */
-static inline void list_replace(struct list_head *old,
-                                struct list_head *new)
-{
-        new->next = old->next;
-        new->next->prev = new;
-        new->prev = old->prev;
-        new->prev->next = new;
-}
-
-static inline void list_replace_init(struct list_head *old,
-                                        struct list_head *new)
-{
-        list_replace(old, new);
-        INIT_LIST_HEAD(old);
-}
-
-/**
- * list_del_init - deletes entry from list and reinitialize it.
- * @entry: the element to delete from the list.
- */
-static inline void list_del_init(struct list_head *entry)
-{
-        __list_del(entry->prev, entry->next);
-        INIT_LIST_HEAD(entry);
-}
-
-/**
- * list_move - delete from one list and add as another's head
- * @list: the entry to move
- * @head: the head that will precede our entry
- */
-static inline void list_move(struct list_head *list, struct list_head *head)
-{
-        __list_del(list->prev, list->next);
-        list_add(list, head);
-}
-
-/**
- * list_move_tail - delete from one list and add as another's tail
- * @list: the entry to move
- * @head: the head that will follow our entry
- */
-static inline void list_move_tail(struct list_head *list,
-                                  struct list_head *head)
-{
-        __list_del(list->prev, list->next);
-        list_add_tail(list, head);
-}
-
-/**
- * list_is_last - tests whether @list is the last entry in list @head
- * @list: the entry to test
- * @head: the head of the list
- */
-static inline int list_is_last(const struct list_head *list,
-                                const struct list_head *head)
-{
-        return list->next == head;
-}
-
-/**
- * list_empty - tests whether a list is empty
- * @head: the list to test.
- */
-static inline int list_empty(const struct list_head *head)
-{
-        return head->next == head;
-}
-
-/**
- * list_empty_careful - tests whether a list is empty and not being modified
- * @head: the list to test
- *
- * Description:
- * tests whether a list is empty _and_ checks that no other CPU might be
- * in the process of modifying either member (next or prev)
- *
- * NOTE: using list_empty_careful() without synchronization
- * can only be safe if the only activity that can happen
- * to the list entry is list_del_init(). Eg. it cannot be used
- * if another CPU could re-list_add() it.
- */
-static inline int list_empty_careful(const struct list_head *head)
-{
-        struct list_head *next = head->next;
-        return (next == head) && (next == head->prev);
-}
-
-static inline void __list_splice(struct list_head *list,
-                                 struct list_head *head)
-{
-        struct list_head *first = list->next;
-        struct list_head *last = list->prev;
-        struct list_head *at = head->next;
-
-        first->prev = head;
-        head->next = first;
-
-        last->next = at;
-        at->prev = last;
-}
-
-/**
- * list_splice - join two lists
- * @list: the new list to add.
- * @head: the place to add it in the first list.
- */
-static inline void list_splice(struct list_head *list, struct list_head *head)
-{
-        if (!list_empty(list))
-                __list_splice(list, head);
-}
-
-/**
- * list_splice_init - join two lists and reinitialise the emptied list.
- * @list: the new list to add.
- * @head: the place to add it in the first list.
- *
- * The list at @list is reinitialised
- */
-static inline void list_splice_init(struct list_head *list,
-                                    struct list_head *head)
-{
-        if (!list_empty(list)) {
-                __list_splice(list, head);
-                INIT_LIST_HEAD(list);
-        }
-}
-
-/**
- * list_entry - get the struct for this entry
- * @ptr:        the &struct list_head pointer.
- * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
- */
-#define list_entry(ptr, type, member) \
-        container_of(ptr, type, member)
-
-/**
- * list_first_entry - get the first element from a list
- * @ptr:       the list head to take the element from.
- * @type:      the type of the struct this is embedded in.
- * @member:    the name of the list_struct within the struct.
- *
- * Note, that list is expected to be not empty.
- */
-#define list_first_entry(ptr, type, member) \
-        list_entry((ptr)->next, type, member)
-
-/**
- * list_for_each        -       iterate over a list
- * @pos:        the &struct list_head to use as a loop cursor.
- * @head:       the head for your list.
- */
-#define list_for_each(pos, head) \
-        for (pos = (head)->next; pos != (head); \
-                pos = pos->next)
-
-/**
- * __list_for_each      -       iterate over a list
- * @pos:        the &struct list_head to use as a loop cursor.
- * @head:       the head for your list.
- *
- * This variant differs from list_for_each() in that it's the
- * simplest possible list iteration code, no prefetching is done.
- * Use this for code that knows the list to be very short (empty
- * or 1 entry) most of the time.
- */
-#define __list_for_each(pos, head) \
-        for (pos = (head)->next; pos != (head); pos = pos->next)
-
-/**
- * list_for_each_prev   -       iterate over a list backwards
- * @pos:        the &struct list_head to use as a loop cursor.
- * @head:       the head for your list.
- */
-#define list_for_each_prev(pos, head) \
-        for (pos = (head)->prev; pos != (head); \
-                pos = pos->prev)
-
-/**
- * list_for_each_safe - iterate over a list safe against removal of list entry
- * @pos:        the &struct list_head to use as a loop cursor.
- * @n:          another &struct list_head to use as temporary storage
- * @head:       the head for your list.
- */
-#define list_for_each_safe(pos, n, head) \
-        for (pos = (head)->next, n = pos->next; pos != (head); \
-                pos = n, n = pos->next)
-
-/**
- * list_for_each_entry  -       iterate over list of given type
- * @pos:        the type * to use as a loop cursor.
- * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
- */
-#define list_for_each_entry(pos, head, member)                          \
-        for (pos = list_entry((head)->next, typeof(*pos), member);      \
-             &pos->member != (head);    \
-             pos = list_entry(pos->member.next, typeof(*pos), member))
-
-/**
- * list_for_each_entry_reverse - iterate backwards over list of given type.
- * @pos:        the type * to use as a loop cursor.
- * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
- */
-#define list_for_each_entry_reverse(pos, head, member)                  \
-        for (pos = list_entry((head)->prev, typeof(*pos), member);      \
-             &pos->member != (head);    \
-             pos = list_entry(pos->member.prev, typeof(*pos), member))
-
-/**
- * list_prepare_entry - prepare a pos entry for use in list_for_each_entry_continue
- * @pos:        the type * to use as a start point
- * @head:       the head of the list
- * @member:     the name of the list_struct within the struct.
- *
- * Prepares a pos entry for use as a start point in list_for_each_entry_continue.
- */
-#define list_prepare_entry(pos, head, member) \
-        ((pos) ? : list_entry(head, typeof(*pos), member))
-
-/**
- * list_for_each_entry_continue - continue iteration over list of given type
- * @pos:        the type * to use as a loop cursor.
- * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
- *
- * Continue to iterate over list of given type, continuing after
- * the current position.
- */
-#define list_for_each_entry_continue(pos, head, member)                 \
-        for (pos = list_entry(pos->member.next, typeof(*pos), member);  \
-             &pos->member != (head);    \
-             pos = list_entry(pos->member.next, typeof(*pos), member))
-
-/**
- * list_for_each_entry_from - iterate over list of given type from the current point
- * @pos:        the type * to use as a loop cursor.
- * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
- *
- * Iterate over list of given type, continuing from current position.
- */
-#define list_for_each_entry_from(pos, head, member)                     \
-        for (; &pos->member != (head);  \
-             pos = list_entry(pos->member.next, typeof(*pos), member))
-
-/**
- * list_for_each_entry_safe - iterate over list of given type safe against removal of list entry
- * @pos:        the type * to use as a loop cursor.
- * @n:          another type * to use as temporary storage
- * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
- */
-#define list_for_each_entry_safe(pos, n, head, member)                  \
-        for (pos = list_entry((head)->next, typeof(*pos), member),      \
-                n = list_entry(pos->member.next, typeof(*pos), member); \
-             &pos->member != (head);                                    \
-             pos = n, n = list_entry(n->member.next, typeof(*n), member))
-
-/**
- * list_for_each_entry_safe_continue
- * @pos:        the type * to use as a loop cursor.
- * @n:          another type * to use as temporary storage
- * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
- *
- * Iterate over list of given type, continuing after current point,
- * safe against removal of list entry.
- */
-#define list_for_each_entry_safe_continue(pos, n, head, member)                 \
-        for (pos = list_entry(pos->member.next, typeof(*pos), member),          \
-                n = list_entry(pos->member.next, typeof(*pos), member);         \
-             &pos->member != (head);                                            \
-             pos = n, n = list_entry(n->member.next, typeof(*n), member))
-
-/**
- * list_for_each_entry_safe_from
- * @pos:        the type * to use as a loop cursor.
- * @n:          another type * to use as temporary storage
- * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
- *
- * Iterate over list of given type from current point, safe against
- * removal of list entry.
- */
-#define list_for_each_entry_safe_from(pos, n, head, member)                     \
-        for (n = list_entry(pos->member.next, typeof(*pos), member);            \
-             &pos->member != (head);                                            \
-             pos = n, n = list_entry(n->member.next, typeof(*n), member))
-
-/**
- * list_for_each_entry_safe_reverse
- * @pos:        the type * to use as a loop cursor.
- * @n:          another type * to use as temporary storage
- * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
- *
- * Iterate backwards over list of given type, safe against removal
- * of list entry.
- */
-#define list_for_each_entry_safe_reverse(pos, n, head, member)          \
-        for (pos = list_entry((head)->prev, typeof(*pos), member),      \
-                n = list_entry(pos->member.prev, typeof(*pos), member); \
-             &pos->member != (head);                                    \
-             pos = n, n = list_entry(n->member.prev, typeof(*n), member))
-
-/*
- * Double linked lists with a single pointer list head.
- * Mostly useful for hash tables where the two pointer list head is
- * too wasteful.
- * You lose the ability to access the tail in O(1).
- */
-
-struct hlist_head {
-        struct hlist_node *first;
-};
-
-struct hlist_node {
-        struct hlist_node *next, **pprev;
-};
-
-#define HLIST_HEAD_INIT { .first = NULL }
-#define HLIST_HEAD(name) struct hlist_head name = {  .first = NULL }
-#define INIT_HLIST_HEAD(ptr) ((ptr)->first = NULL)
-static inline void INIT_HLIST_NODE(struct hlist_node *h)
-{
-        h->next = NULL;
-        h->pprev = NULL;
-}
-
-static inline int hlist_unhashed(const struct hlist_node *h)
-{
-        return !h->pprev;
-}
-
-static inline int hlist_empty(const struct hlist_head *h)
-{
-        return !h->first;
-}
-
-static inline void __hlist_del(struct hlist_node *n)
-{
-        struct hlist_node *next = n->next;
-        struct hlist_node **pprev = n->pprev;
-        *pprev = next;
-        if (next)
-                next->pprev = pprev;
-}
-
-static inline void hlist_del(struct hlist_node *n)
-{
-        __hlist_del(n);
-        n->next = LIST_POISON1;
-        n->pprev = LIST_POISON2;
-}
-
-static inline void hlist_del_init(struct hlist_node *n)
-{
-        if (!hlist_unhashed(n)) {
-                __hlist_del(n);
-                INIT_HLIST_NODE(n);
-        }
-}
-
-static inline void hlist_add_head(struct hlist_node *n, struct hlist_head *h)
-{
-        struct hlist_node *first = h->first;
-        n->next = first;
-        if (first)
-                first->pprev = &n->next;
-        h->first = n;
-        n->pprev = &h->first;
-}
-
-/* next must be != NULL */
-static inline void hlist_add_before(struct hlist_node *n,
-                                        struct hlist_node *next)
-{
-        n->pprev = next->pprev;
-        n->next = next;
-        next->pprev = &n->next;
-        *(n->pprev) = n;
-}
-
-static inline void hlist_add_after(struct hlist_node *n,
-                                        struct hlist_node *next)
-{
-        next->next = n->next;
-        n->next = next;
-        next->pprev = &n->next;
-
-        if(next->next)
-                next->next->pprev  = &next->next;
-}
-
-#define hlist_entry(ptr, type, member) container_of(ptr,type,member)
-
-#define hlist_for_each(pos, head) \
-        for (pos = (head)->first; pos; \
-             pos = pos->next)
-
-#define hlist_for_each_safe(pos, n, head) \
-        for (pos = (head)->first; pos && ({ n = pos->next; 1; }); \
-             pos = n)
-
-/**
- * hlist_for_each_entry - iterate over list of given type
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
- * @head:       the head for your list.
- * @member:     the name of the hlist_node within the struct.
- */
-#define hlist_for_each_entry(tpos, pos, head, member)                    \
-        for (pos = (head)->first;                                        \
-             pos &&                      \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
-             pos = pos->next)
-
-/**
- * hlist_for_each_entry_continue - iterate over a hlist continuing after current point
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
- * @member:     the name of the hlist_node within the struct.
- */
-#define hlist_for_each_entry_continue(tpos, pos, member)                 \
-        for (pos = (pos)->next;                                          \
-             pos &&                      \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
-             pos = pos->next)
-
-/**
- * hlist_for_each_entry_from - iterate over a hlist continuing from current point
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
- * @member:     the name of the hlist_node within the struct.
- */
-#define hlist_for_each_entry_from(tpos, pos, member)                     \
-        for (; pos &&                    \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
-             pos = pos->next)
-
-/**
- * hlist_for_each_entry_safe - iterate over list of given type safe against removal of list entry
- * @tpos:       the type * to use as a loop cursor.
- * @pos:        the &struct hlist_node to use as a loop cursor.
- * @n:          another &struct hlist_node to use as temporary storage
- * @head:       the head for your list.
- * @member:     the name of the hlist_node within the struct.
- */
-#define hlist_for_each_entry_safe(tpos, pos, n, head, member)            \
-        for (pos = (head)->first;                                        \
-             pos && ({ n = pos->next; 1; }) &&                           \
-                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
-             pos = n)
-
-#endif
diff --git a/tools/perf/util/module.c b/tools/perf/util/module.c
new file mode 100644
index 000000000000..ddabe925d65d
--- /dev/null
+++ b/tools/perf/util/module.c
@@ -0,0 +1,509 @@
+#include "util.h"
+#include "../perf.h"
+#include "string.h"
+#include "module.h"
+
+#include <libelf.h>
+#include <gelf.h>
+#include <elf.h>
+#include <dirent.h>
+#include <sys/utsname.h>
+
+static unsigned int crc32(const char *p, unsigned int len)
+{
+        int i;
+        unsigned int crc = 0;
+
+        while (len--) {
+                crc ^= *p++;
+                for (i = 0; i < 8; i++)
+                        crc = (crc >> 1) ^ ((crc & 1) ? 0xedb88320 : 0);
+        }
+        return crc;
+}
+
+/* module section methods */
+
+struct sec_dso *sec_dso__new_dso(const char *name)
+{
+        struct sec_dso *self = malloc(sizeof(*self) + strlen(name) + 1);
+
+        if (self != NULL) {
+                strcpy(self->name, name);
+                self->secs = RB_ROOT;
+                self->find_section = sec_dso__find_section;
+        }
+
+        return self;
+}
+
+static void sec_dso__delete_section(struct section *self)
+{
+        free(((void *)self));
+}
+
+void sec_dso__delete_sections(struct sec_dso *self)
+{
+        struct section *pos;
+        struct rb_node *next = rb_first(&self->secs);
+
+        while (next) {
+                pos = rb_entry(next, struct section, rb_node);
+                next = rb_next(&pos->rb_node);
+                rb_erase(&pos->rb_node, &self->secs);
+                sec_dso__delete_section(pos);
+        }
+}
+
+void sec_dso__delete_self(struct sec_dso *self)
+{
+        sec_dso__delete_sections(self);
+        free(self);
+}
+
+static void sec_dso__insert_section(struct sec_dso *self, struct section *sec)
+{
+        struct rb_node **p = &self->secs.rb_node;
+        struct rb_node *parent = NULL;
+        const u64 hash = sec->hash;
+        struct section *s;
+
+        while (*p != NULL) {
+                parent = *p;
+                s = rb_entry(parent, struct section, rb_node);
+                if (hash < s->hash)
+                        p = &(*p)->rb_left;
+                else
+                        p = &(*p)->rb_right;
+        }
+        rb_link_node(&sec->rb_node, parent, p);
+        rb_insert_color(&sec->rb_node, &self->secs);
+}
+
+struct section *sec_dso__find_section(struct sec_dso *self, const char *name)
+{
+        struct rb_node *n;
+        u64 hash;
+        int len;
+
+        if (self == NULL)
+                return NULL;
+
+        len = strlen(name);
+        hash = crc32(name, len);
+
+        n = self->secs.rb_node;
+
+        while (n) {
+                struct section *s = rb_entry(n, struct section, rb_node);
+
+                if (hash < s->hash)
+                        n = n->rb_left;
+                else if (hash > s->hash)
+                        n = n->rb_right;
+                else {
+                        if (!strcmp(name, s->name))
+                                return s;
+                        else
+                                n = rb_next(&s->rb_node);
+                }
+        }
+
+        return NULL;
+}
+
+static size_t sec_dso__fprintf_section(struct section *self, FILE *fp)
+{
+        return fprintf(fp, "name:%s vma:%llx path:%s\n",
+                       self->name, self->vma, self->path);
+}
+
+size_t sec_dso__fprintf(struct sec_dso *self, FILE *fp)
+{
+        size_t ret = fprintf(fp, "dso: %s\n", self->name);
+
+        struct rb_node *nd;
+        for (nd = rb_first(&self->secs); nd; nd = rb_next(nd)) {
+                struct section *pos = rb_entry(nd, struct section, rb_node);
+                ret += sec_dso__fprintf_section(pos, fp);
+        }
+
+        return ret;
+}
+
+static struct section *section__new(const char *name, const char *path)
+{
+        struct section *self = calloc(1, sizeof(*self));
+
+        if (!self)
+                goto out_failure;
+
+        self->name = calloc(1, strlen(name) + 1);
+        if (!self->name)
+                goto out_failure;
+
+        self->path = calloc(1, strlen(path) + 1);
+        if (!self->path)
+                goto out_failure;
+
+        strcpy(self->name, name);
+        strcpy(self->path, path);
+        self->hash = crc32(self->name, strlen(name));
+
+        return self;
+
+out_failure:
+        if (self) {
+                if (self->name)
+                        free(self->name);
+                if (self->path)
+                        free(self->path);
+                free(self);
+        }
+
+        return NULL;
+}
+
+/* module methods */
+
+struct mod_dso *mod_dso__new_dso(const char *name)
+{
+        struct mod_dso *self = malloc(sizeof(*self) + strlen(name) + 1);
+
+        if (self != NULL) {
+                strcpy(self->name, name);
+                self->mods = RB_ROOT;
+                self->find_module = mod_dso__find_module;
+        }
+
+        return self;
+}
+
+static void mod_dso__delete_module(struct module *self)
+{
+        free(((void *)self));
+}
+
+void mod_dso__delete_modules(struct mod_dso *self)
+{
+        struct module *pos;
+        struct rb_node *next = rb_first(&self->mods);
+
+        while (next) {
+                pos = rb_entry(next, struct module, rb_node);
+                next = rb_next(&pos->rb_node);
+                rb_erase(&pos->rb_node, &self->mods);
+                mod_dso__delete_module(pos);
+        }
+}
+
+void mod_dso__delete_self(struct mod_dso *self)
+{
+        mod_dso__delete_modules(self);
+        free(self);
+}
+
+static void mod_dso__insert_module(struct mod_dso *self, struct module *mod)
+{
+        struct rb_node **p = &self->mods.rb_node;
+        struct rb_node *parent = NULL;
+        const u64 hash = mod->hash;
+        struct module *m;
+
+        while (*p != NULL) {
+                parent = *p;
+                m = rb_entry(parent, struct module, rb_node);
+                if (hash < m->hash)
+                        p = &(*p)->rb_left;
+                else
+                        p = &(*p)->rb_right;
+        }
+        rb_link_node(&mod->rb_node, parent, p);
+        rb_insert_color(&mod->rb_node, &self->mods);
+}
+
+struct module *mod_dso__find_module(struct mod_dso *self, const char *name)
+{
+        struct rb_node *n;
+        u64 hash;
+        int len;
+
+        if (self == NULL)
+                return NULL;
+
+        len = strlen(name);
+        hash = crc32(name, len);
+
+        n = self->mods.rb_node;
+
+        while (n) {
+                struct module *m = rb_entry(n, struct module, rb_node);
+
+                if (hash < m->hash)
+                        n = n->rb_left;
+                else if (hash > m->hash)
+                        n = n->rb_right;
+                else {
+                        if (!strcmp(name, m->name))
+                                return m;
+                        else
+                                n = rb_next(&m->rb_node);
+                }
+        }
+
+        return NULL;
+}
+
+static size_t mod_dso__fprintf_module(struct module *self, FILE *fp)
+{
+        return fprintf(fp, "name:%s path:%s\n", self->name, self->path);
+}
+
+size_t mod_dso__fprintf(struct mod_dso *self, FILE *fp)
+{
+        struct rb_node *nd;
+        size_t ret;
+
+        ret = fprintf(fp, "dso: %s\n", self->name);
+
+        for (nd = rb_first(&self->mods); nd; nd = rb_next(nd)) {
+                struct module *pos = rb_entry(nd, struct module, rb_node);
+
+                ret += mod_dso__fprintf_module(pos, fp);
+        }
+
+        return ret;
+}
+
+static struct module *module__new(const char *name, const char *path)
+{
+        struct module *self = calloc(1, sizeof(*self));
+
+        if (!self)
+                goto out_failure;
+
+        self->name = calloc(1, strlen(name) + 1);
+        if (!self->name)
+                goto out_failure;
+
+        self->path = calloc(1, strlen(path) + 1);
+        if (!self->path)
+                goto out_failure;
+
+        strcpy(self->name, name);
+        strcpy(self->path, path);
+        self->hash = crc32(self->name, strlen(name));
+
+        return self;
+
+out_failure:
+        if (self) {
+                if (self->name)
+                        free(self->name);
+                if (self->path)
+                        free(self->path);
+                free(self);
+        }
+
+        return NULL;
+}
+
+static int mod_dso__load_sections(struct module *mod)
+{
+        int count = 0, path_len;
+        struct dirent *entry;
+        char *line = NULL;
+        char *dir_path;
+        DIR *dir;
+        size_t n;
+
+        path_len = strlen("/sys/module/");
+        path_len += strlen(mod->name);
+        path_len += strlen("/sections/");
+
+        dir_path = calloc(1, path_len + 1);
+        if (dir_path == NULL)
+                goto out_failure;
+
+        strcat(dir_path, "/sys/module/");
+        strcat(dir_path, mod->name);
+        strcat(dir_path, "/sections/");
+
+        dir = opendir(dir_path);
+        if (dir == NULL)
+                goto out_free;
+
+        while ((entry = readdir(dir))) {
+                struct section *section;
+                char *path, *vma;
+                int line_len;
+                FILE *file;
+
+                if (!strcmp(".", entry->d_name) || !strcmp("..", entry->d_name))
+                        continue;
+
+                path = calloc(1, path_len + strlen(entry->d_name) + 1);
+                if (path == NULL)
+                        break;
+                strcat(path, dir_path);
+                strcat(path, entry->d_name);
+
+                file = fopen(path, "r");
+                if (file == NULL) {
+                        free(path);
+                        break;
+                }
+
+                line_len = getline(&line, &n, file);
+                if (line_len < 0) {
+                        free(path);
+                        fclose(file);
+                        break;
+                }
+
+                if (!line) {
+                        free(path);
+                        fclose(file);
+                        break;
+                }
+
+                line[--line_len] = '\0'; /* \n */
+
+                vma = strstr(line, "0x");
+                if (!vma) {
+                        free(path);
+                        fclose(file);
+                        break;
+                }
+                vma += 2;
+
+                section = section__new(entry->d_name, path);
+                if (!section) {
+                        fprintf(stderr, "load_sections: allocation error\n");
+                        free(path);
+                        fclose(file);
+                        break;
+                }
+
+                hex2u64(vma, &section->vma);
+                sec_dso__insert_section(mod->sections, section);
+
+                free(path);
+                fclose(file);
+                count++;
+        }
+
+        closedir(dir);
+        free(line);
+        free(dir_path);
+
+        return count;
+
+out_free:
+        free(dir_path);
+
+out_failure:
+        return count;
+}
+
+static int mod_dso__load_module_paths(struct mod_dso *self)
+{
+        struct utsname uts;
+        int count = 0, len;
+        char *line = NULL;
+        FILE *file;
+        char *path;
+        size_t n;
+
+        if (uname(&uts) < 0)
+                goto out_failure;
+
+        len = strlen("/lib/modules/");
+        len += strlen(uts.release);
+        len += strlen("/modules.dep");
+
+        path = calloc(1, len);
+        if (path == NULL)
+                goto out_failure;
+
+        strcat(path, "/lib/modules/");
+        strcat(path, uts.release);
+        strcat(path, "/modules.dep");
+
+        file = fopen(path, "r");
+        free(path);
+        if (file == NULL)
+                goto out_failure;
+
+        while (!feof(file)) {
+                char *path, *name, *tmp;
+                struct module *module;
+                int line_len, len;
+
+                line_len = getline(&line, &n, file);
+                if (line_len < 0)
+                        break;
+
+                if (!line)
+                        goto out_failure;
+
+                line[--line_len] = '\0'; /* \n */
+
+                path = strtok(line, ":");
+                if (!path)
+                        goto out_failure;
+
+                name = strdup(path);
+                name = strtok(name, "/");
+
+                tmp = name;
+
+                while (tmp) {
+                        tmp = strtok(NULL, "/");
+                        if (tmp)
+                                name = tmp;
+                }
+                name = strsep(&name, ".");
+
+                /* Quirk: replace '-' with '_' in sound modules */
+                for (len = strlen(name); len; len--) {
+                        if (*(name+len) == '-')
+                                *(name+len) = '_';
+                }
+
+                module = module__new(name, path);
+                if (!module) {
+                        fprintf(stderr, "load_module_paths: allocation error\n");
+                        goto out_failure;
+                }
+                mod_dso__insert_module(self, module);
+
+                module->sections = sec_dso__new_dso("sections");
+                if (!module->sections) {
+                        fprintf(stderr, "load_module_paths: allocation error\n");
+                        goto out_failure;
+                }
+
+                module->active = mod_dso__load_sections(module);
+
+                if (module->active > 0)
+                        count++;
+        }
+
+        free(line);
+        fclose(file);
+
+        return count;
+
+out_failure:
+        return -1;
+}
+
+int mod_dso__load_modules(struct mod_dso *dso)
+{
+        int err;
+
+        err = mod_dso__load_module_paths(dso);
+
+        return err;
+}
diff --git a/tools/perf/util/module.h b/tools/perf/util/module.h
new file mode 100644
index 000000000000..8a592ef641ca
--- /dev/null
+++ b/tools/perf/util/module.h
@@ -0,0 +1,53 @@
+#ifndef _PERF_MODULE_
+#define _PERF_MODULE_ 1
+
+#include <linux/types.h>
+#include "../types.h"
+#include <linux/list.h>
+#include <linux/rbtree.h>
+
+struct section {
+        struct rb_node  rb_node;
+        u64             hash;
+        u64             vma;
+        char            *name;
+        char            *path;
+};
+
+struct sec_dso {
+        struct list_head node;
+        struct rb_root   secs;
+        struct section    *(*find_section)(struct sec_dso *, const char *name);
+        char             name[0];
+};
+
+struct module {
+        struct rb_node  rb_node;
+        u64             hash;
+        char            *name;
+        char            *path;
+        struct sec_dso  *sections;
+        int             active;
+};
+
+struct mod_dso {
+        struct list_head node;
+        struct rb_root   mods;
+        struct module    *(*find_module)(struct mod_dso *, const char *name);
+        char             name[0];
+};
+
+struct sec_dso *sec_dso__new_dso(const char *name);
+void sec_dso__delete_sections(struct sec_dso *self);
+void sec_dso__delete_self(struct sec_dso *self);
+size_t sec_dso__fprintf(struct sec_dso *self, FILE *fp);
+struct section *sec_dso__find_section(struct sec_dso *self, const char *name);
+
+struct mod_dso *mod_dso__new_dso(const char *name);
+void mod_dso__delete_modules(struct mod_dso *self);
+void mod_dso__delete_self(struct mod_dso *self);
+size_t mod_dso__fprintf(struct mod_dso *self, FILE *fp);
+struct module *mod_dso__find_module(struct mod_dso *self, const char *name);
+int mod_dso__load_modules(struct mod_dso *dso);
+
+#endif /* _PERF_MODULE_ */
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 4d042f104cdc..5184959e0615 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -184,16 +184,20 @@ char *event_name(int counter)
         return "unknown";
 }
 
-static int parse_aliases(const char *str, char *names[][MAX_ALIASES], int size)
+static int parse_aliases(const char **str, char *names[][MAX_ALIASES], int size)
 {
         int i, j;
+        int n, longest = -1;
 
         for (i = 0; i < size; i++) {
-                for (j = 0; j < MAX_ALIASES; j++) {
-                        if (!names[i][j])
-                                break;
-                        if (strcasestr(str, names[i][j]))
-                                return i;
+                for (j = 0; j < MAX_ALIASES && names[i][j]; j++) {
+                        n = strlen(names[i][j]);
+                        if (n > longest && !strncasecmp(*str, names[i][j], n))
+                                longest = n;
+                }
+                if (longest > 0) {
+                        *str += longest;
+                        return i;
                 }
         }
 
@@ -201,30 +205,53 @@ static int parse_aliases(const char *str, char *names[][MAX_ALIASES], int size)
 }
 
 static int
-parse_generic_hw_symbols(const char *str, struct perf_counter_attr *attr)
+parse_generic_hw_event(const char **str, struct perf_counter_attr *attr)
 {
-        int cache_type = -1, cache_op = 0, cache_result = 0;
+        const char *s = *str;
+        int cache_type = -1, cache_op = -1, cache_result = -1;
 
-        cache_type = parse_aliases(str, hw_cache, PERF_COUNT_HW_CACHE_MAX);
+        cache_type = parse_aliases(&s, hw_cache, PERF_COUNT_HW_CACHE_MAX);
         /*
          * No fallback - if we cannot get a clear cache type
          * then bail out:
          */
         if (cache_type == -1)
-                return -EINVAL;
+                return 0;
+
+        while ((cache_op == -1 || cache_result == -1) && *s == '-') {
+                ++s;
+
+                if (cache_op == -1) {
+                        cache_op = parse_aliases(&s, hw_cache_op,
+                                                PERF_COUNT_HW_CACHE_OP_MAX);
+                        if (cache_op >= 0) {
+                                if (!is_cache_op_valid(cache_type, cache_op))
+                                        return 0;
+                                continue;
+                        }
+                }
+
+                if (cache_result == -1) {
+                        cache_result = parse_aliases(&s, hw_cache_result,
+                                                PERF_COUNT_HW_CACHE_RESULT_MAX);
+                        if (cache_result >= 0)
+                                continue;
+                }
+
+                /*
+                 * Can't parse this as a cache op or result, so back up
+                 * to the '-'.
+                 */
+                --s;
+                break;
+        }
 
-        cache_op = parse_aliases(str, hw_cache_op, PERF_COUNT_HW_CACHE_OP_MAX);
         /*
          * Fall back to reads:
          */
         if (cache_op == -1)
                 cache_op = PERF_COUNT_HW_CACHE_OP_READ;
 
-        if (!is_cache_op_valid(cache_type, cache_op))
-                return -EINVAL;
-
-        cache_result = parse_aliases(str, hw_cache_result,
-                                        PERF_COUNT_HW_CACHE_RESULT_MAX);
         /*
          * Fall back to accesses:
          */
@@ -234,93 +261,154 @@ parse_generic_hw_symbols(const char *str, struct perf_counter_attr *attr)
         attr->config = cache_type | (cache_op << 8) | (cache_result << 16);
         attr->type = PERF_TYPE_HW_CACHE;
 
-        return 0;
+        *str = s;
+        return 1;
 }
 
 static int check_events(const char *str, unsigned int i)
 {
-        if (!strncmp(str, event_symbols[i].symbol,
-                     strlen(event_symbols[i].symbol)))
-                return 1;
+        int n;
 
-        if (strlen(event_symbols[i].alias))
-                if (!strncmp(str, event_symbols[i].alias,
-                             strlen(event_symbols[i].alias)))
-                        return 1;
+        n = strlen(event_symbols[i].symbol);
+        if (!strncmp(str, event_symbols[i].symbol, n))
+                return n;
+
+        n = strlen(event_symbols[i].alias);
+        if (n)
+                if (!strncmp(str, event_symbols[i].alias, n))
+                        return n;
         return 0;
 }
 
-/*
- * Each event can have multiple symbolic names.
- * Symbolic names are (almost) exactly matched.
- */
-static int parse_event_symbols(const char *str, struct perf_counter_attr *attr)
+static int
+parse_symbolic_event(const char **strp, struct perf_counter_attr *attr)
 {
-        u64 config, id;
-        int type;
+        const char *str = *strp;
         unsigned int i;
-        const char *sep, *pstr;
+        int n;
 
-        if (str[0] == 'r' && hex2u64(str + 1, &config) > 0) {
-                attr->type = PERF_TYPE_RAW;
-                attr->config = config;
+        for (i = 0; i < ARRAY_SIZE(event_symbols); i++) {
+                n = check_events(str, i);
+                if (n > 0) {
+                        attr->type = event_symbols[i].type;
+                        attr->config = event_symbols[i].config;
+                        *strp = str + n;
+                        return 1;
+                }
+        }
+        return 0;
+}
 
+static int parse_raw_event(const char **strp, struct perf_counter_attr *attr)
+{
+        const char *str = *strp;
+        u64 config;
+        int n;
+
+        if (*str != 'r')
                 return 0;
+        n = hex2u64(str + 1, &config);
+        if (n > 0) {
+                *strp = str + n + 1;
+                attr->type = PERF_TYPE_RAW;
+                attr->config = config;
+                return 1;
         }
+        return 0;
+}
 
-        pstr = str;
-        sep = strchr(pstr, ':');
-        if (sep) {
-                type = atoi(pstr);
-                pstr = sep + 1;
-                id = atoi(pstr);
-                sep = strchr(pstr, ':');
-                if (sep) {
-                        pstr = sep + 1;
-                        if (strchr(pstr, 'k'))
-                                attr->exclude_user = 1;
-                        if (strchr(pstr, 'u'))
-                                attr->exclude_kernel = 1;
+static int
+parse_numeric_event(const char **strp, struct perf_counter_attr *attr)
+{
+        const char *str = *strp;
+        char *endp;
+        unsigned long type;
+        u64 config;
+
+        type = strtoul(str, &endp, 0);
+        if (endp > str && type < PERF_TYPE_MAX && *endp == ':') {
+                str = endp + 1;
+                config = strtoul(str, &endp, 0);
+                if (endp > str) {
+                        attr->type = type;
+                        attr->config = config;
+                        *strp = endp;
+                        return 1;
                 }
-                attr->type = type;
-                attr->config = id;
+        }
+        return 0;
+}
 
+static int
+parse_event_modifier(const char **strp, struct perf_counter_attr *attr)
+{
+        const char *str = *strp;
+        int eu = 1, ek = 1, eh = 1;
+
+        if (*str++ != ':')
                 return 0;
+        while (*str) {
+                if (*str == 'u')
+                        eu = 0;
+                else if (*str == 'k')
+                        ek = 0;
+                else if (*str == 'h')
+                        eh = 0;
+                else
+                        break;
+                ++str;
         }
+        if (str >= *strp + 2) {
+                *strp = str;
+                attr->exclude_user   = eu;
+                attr->exclude_kernel = ek;
+                attr->exclude_hv     = eh;
+                return 1;
+        }
+        return 0;
+}
 
-        for (i = 0; i < ARRAY_SIZE(event_symbols); i++) {
-                if (check_events(str, i)) {
-                        attr->type = event_symbols[i].type;
-                        attr->config = event_symbols[i].config;
+/*
+ * Each event can have multiple symbolic names.
+ * Symbolic names are (almost) exactly matched.
+ */
+static int parse_event_symbols(const char **str, struct perf_counter_attr *attr)
+{
+        if (!(parse_raw_event(str, attr) ||
+              parse_numeric_event(str, attr) ||
+              parse_symbolic_event(str, attr) ||
+              parse_generic_hw_event(str, attr)))
+                return 0;
 
-                        return 0;
-                }
-        }
+        parse_event_modifier(str, attr);
 
-        return parse_generic_hw_symbols(str, attr);
+        return 1;
 }
 
-int parse_events(const struct option *opt, const char *str, int unset)
+int parse_events(const struct option *opt __used, const char *str, int unset __used)
 {
         struct perf_counter_attr attr;
-        int ret;
 
-        memset(&attr, 0, sizeof(attr));
-again:
-        if (nr_counters == MAX_COUNTERS)
-                return -1;
+        for (;;) {
+                if (nr_counters == MAX_COUNTERS)
+                        return -1;
+
+                memset(&attr, 0, sizeof(attr));
+                if (!parse_event_symbols(&str, &attr))
+                        return -1;
 
-        ret = parse_event_symbols(str, &attr);
-        if (ret < 0)
-                return ret;
+                if (!(*str == 0 || *str == ',' || isspace(*str)))
+                        return -1;
 
-        attrs[nr_counters] = attr;
-        nr_counters++;
+                attrs[nr_counters] = attr;
+                nr_counters++;
 
-        str = strstr(str, ",");
-        if (str) {
-                str++;
-                goto again;
+                if (*str == 0)
+                        break;
+                if (*str == ',')
+                        ++str;
+                while (isspace(*str))
+                        ++str;
         }
 
         return 0;
@@ -340,7 +428,7 @@ static const char * const event_type_descriptors[] = {
 void print_events(void)
 {
         struct event_symbol *syms = event_symbols;
-        unsigned int i, type, prev_type = -1;
+        unsigned int i, type, op, prev_type = -1;
         char name[40];
 
         fprintf(stderr, "\n");
@@ -365,6 +453,21 @@ void print_events(void)
         }
 
         fprintf(stderr, "\n");
+        for (type = 0; type < PERF_COUNT_HW_CACHE_MAX; type++) {
+                for (op = 0; op < PERF_COUNT_HW_CACHE_OP_MAX; op++) {
+                        /* skip invalid cache type */
+                        if (!is_cache_op_valid(type, op))
+                                continue;
+
+                        for (i = 0; i < PERF_COUNT_HW_CACHE_RESULT_MAX; i++) {
+                                fprintf(stderr, "  %-40s [%s]\n",
+                                        event_cache_name(type, op, i),
+                                        event_type_descriptors[4]);
+                        }
+                }
+        }
+
+        fprintf(stderr, "\n");
         fprintf(stderr, "  %-40s [raw hardware event descriptor]\n",
                 "rNNN");
         fprintf(stderr, "\n");
diff --git a/tools/perf/util/parse-options.c b/tools/perf/util/parse-options.c
index b3affb1658d2..1bf67190c820 100644
--- a/tools/perf/util/parse-options.c
+++ b/tools/perf/util/parse-options.c
@@ -20,7 +20,8 @@ static int get_arg(struct parse_opt_ctx_t *p, const struct option *opt,
         if (p->opt) {
                 *arg = p->opt;
                 p->opt = NULL;
-        } else if (p->argc == 1 && (opt->flags & PARSE_OPT_LASTARG_DEFAULT)) {
+        } else if ((opt->flags & PARSE_OPT_LASTARG_DEFAULT) && (p->argc == 1 ||
+                    **(p->argv + 1) == '-')) {
                 *arg = (const char *)opt->defval;
         } else if (p->argc > 1) {
                 p->argc--;
@@ -485,7 +486,7 @@ int parse_options_usage(const char * const *usagestr,
 }
 
 
-int parse_opt_verbosity_cb(const struct option *opt, const char *arg,
+int parse_opt_verbosity_cb(const struct option *opt, const char *arg __used,
                            int unset)
 {
         int *target = opt->value;
diff --git a/tools/perf/util/parse-options.h b/tools/perf/util/parse-options.h
index a1039a6ce0eb..8aa3464c7090 100644
--- a/tools/perf/util/parse-options.h
+++ b/tools/perf/util/parse-options.h
@@ -90,21 +90,22 @@ struct option {
         intptr_t defval;
 };
 
-#define OPT_END()                   { OPTION_END }
-#define OPT_ARGUMENT(l, h)          { OPTION_ARGUMENT, 0, (l), NULL, NULL, (h) }
-#define OPT_GROUP(h)                { OPTION_GROUP, 0, NULL, NULL, NULL, (h) }
-#define OPT_BIT(s, l, v, h, b)      { OPTION_BIT, (s), (l), (v), NULL, (h), 0, NULL, (b) }
-#define OPT_BOOLEAN(s, l, v, h)     { OPTION_BOOLEAN, (s), (l), (v), NULL, (h) }
-#define OPT_SET_INT(s, l, v, h, i)  { OPTION_SET_INT, (s), (l), (v), NULL, (h), 0, NULL, (i) }
-#define OPT_SET_PTR(s, l, v, h, p)  { OPTION_SET_PTR, (s), (l), (v), NULL, (h), 0, NULL, (p) }
-#define OPT_INTEGER(s, l, v, h)     { OPTION_INTEGER, (s), (l), (v), NULL, (h) }
-#define OPT_LONG(s, l, v, h)        { OPTION_LONG, (s), (l), (v), NULL, (h) }
-#define OPT_STRING(s, l, v, a, h)   { OPTION_STRING,  (s), (l), (v), (a), (h) }
+#define OPT_END()                   { .type = OPTION_END }
+#define OPT_ARGUMENT(l, h)          { .type = OPTION_ARGUMENT, .long_name = (l), .help = (h) }
+#define OPT_GROUP(h)                { .type = OPTION_GROUP, .help = (h) }
+#define OPT_BIT(s, l, v, h, b)      { .type = OPTION_BIT, .short_name = (s), .long_name = (l), .value = (v), .help = (h), .defval = (b) }
+#define OPT_BOOLEAN(s, l, v, h)     { .type = OPTION_BOOLEAN, .short_name = (s), .long_name = (l), .value = (v), .help = (h) }
+#define OPT_SET_INT(s, l, v, h, i)  { .type = OPTION_SET_INT, .short_name = (s), .long_name = (l), .value = (v), .help = (h), .defval = (i) }
+#define OPT_SET_PTR(s, l, v, h, p)  { .type = OPTION_SET_PTR, .short_name = (s), .long_name = (l), .value = (v), .help = (h), .defval = (p) }
+#define OPT_INTEGER(s, l, v, h)     { .type = OPTION_INTEGER, .short_name = (s), .long_name = (l), .value = (v), .help = (h) }
+#define OPT_LONG(s, l, v, h)        { .type = OPTION_LONG, .short_name = (s), .long_name = (l), .value = (v), .help = (h) }
+#define OPT_STRING(s, l, v, a, h)   { .type = OPTION_STRING,  .short_name = (s), .long_name = (l), .value = (v), (a), .help = (h) }
 #define OPT_DATE(s, l, v, h) \
-        { OPTION_CALLBACK, (s), (l), (v), "time",(h), 0, \
-          parse_opt_approxidate_cb }
+        { .type = OPTION_CALLBACK, .short_name = (s), .long_name = (l), .value = (v), .argh = "time", .help = (h), .callback = parse_opt_approxidate_cb }
 #define OPT_CALLBACK(s, l, v, a, h, f) \
-        { OPTION_CALLBACK, (s), (l), (v), (a), (h), 0, (f) }
+        { .type = OPTION_CALLBACK, .short_name = (s), .long_name = (l), .value = (v), (a), .help = (h), .callback = (f) }
+#define OPT_CALLBACK_DEFAULT(s, l, v, a, h, f, d) \
+        { .type = OPTION_CALLBACK, .short_name = (s), .long_name = (l), .value = (v), (a), .help = (h), .callback = (f), .defval = (intptr_t)d, .flags = PARSE_OPT_LASTARG_DEFAULT }
 
 /* parse_options() will filter out the processed options and leave the
  * non-option argments in argv[].
diff --git a/tools/perf/util/quote.c b/tools/perf/util/quote.c
index f18c5212bc92..c6e5dc0dc82f 100644
--- a/tools/perf/util/quote.c
+++ b/tools/perf/util/quote.c
@@ -162,12 +162,16 @@ static inline int sq_must_quote(char c)
         return sq_lookup[(unsigned char)c] + quote_path_fully > 0;
 }
 
-/* returns the longest prefix not needing a quote up to maxlen if positive.
-   This stops at the first \0 because it's marked as a character needing an
-   escape */
-static size_t next_quote_pos(const char *s, ssize_t maxlen)
+/*
+ * Returns the longest prefix not needing a quote up to maxlen if
+ * positive.
+ * This stops at the first \0 because it's marked as a character
+ * needing an escape.
+ */
+static ssize_t next_quote_pos(const char *s, ssize_t maxlen)
 {
-        size_t len;
+        ssize_t len;
+
         if (maxlen < 0) {
                 for (len = 0; !sq_must_quote(s[len]); len++);
         } else {
@@ -192,22 +196,22 @@ static size_t next_quote_pos(const char *s, ssize_t maxlen)
 static size_t quote_c_style_counted(const char *name, ssize_t maxlen,
                                     struct strbuf *sb, FILE *fp, int no_dq)
 {
-#undef EMIT
-#define EMIT(c)                                 \
-        do {                                        \
-                if (sb) strbuf_addch(sb, (c));          \
-                if (fp) fputc((c), fp);                 \
-                count++;                                \
+#define EMIT(c)                                                 \
+        do {                                                    \
+                if (sb) strbuf_addch(sb, (c));                  \
+                if (fp) fputc((c), fp);                         \
+                count++;                                        \
         } while (0)
-#define EMITBUF(s, l)                           \
-        do {                                        \
-                int __ret;                              \
-                if (sb) strbuf_add(sb, (s), (l));       \
-                if (fp) __ret = fwrite((s), (l), 1, fp);        \
-                count += (l);                           \
+
+#define EMITBUF(s, l)                                           \
+        do {                                                    \
+                int __ret;                                      \
+                if (sb) strbuf_add(sb, (s), (l));               \
+                if (fp) __ret = fwrite((s), (l), 1, fp);        \
+                count += (l);                                   \
         } while (0)
 
-        size_t len, count = 0;
+        ssize_t len, count = 0;
         const char *p = name;
 
         for (;;) {
@@ -273,8 +277,8 @@ void write_name_quoted(const char *name, FILE *fp, int terminator)
         fputc(terminator, fp);
 }
 
-extern void write_name_quotedpfx(const char *pfx, size_t pfxlen,
-                                 const char *name, FILE *fp, int terminator)
+void write_name_quotedpfx(const char *pfx, ssize_t pfxlen,
+                          const char *name, FILE *fp, int terminator)
 {
         int needquote = 0;
 
@@ -306,7 +310,7 @@ char *quote_path_relative(const char *in, int len,
                 len = strlen(in);
 
         /* "../" prefix itself does not need quoting, but "in" might. */
-        needquote = next_quote_pos(in, len) < len;
+        needquote = (next_quote_pos(in, len) < len);
         strbuf_setlen(out, 0);
         strbuf_grow(out, len);
 
diff --git a/tools/perf/util/quote.h b/tools/perf/util/quote.h
index 5dfad89816db..a5454a1d1c13 100644
--- a/tools/perf/util/quote.h
+++ b/tools/perf/util/quote.h
@@ -53,7 +53,7 @@ extern size_t quote_c_style(const char *name, struct strbuf *, FILE *, int no_dq
 extern void quote_two_c_style(struct strbuf *, const char *, const char *, int);
 
 extern void write_name_quoted(const char *name, FILE *, int terminator);
-extern void write_name_quotedpfx(const char *pfx, size_t pfxlen,
+extern void write_name_quotedpfx(const char *pfx, ssize_t pfxlen,
                                  const char *name, FILE *, int terminator);
 
 /* quote path as relative to the given prefix */
diff --git a/tools/perf/util/rbtree.c b/tools/perf/util/rbtree.c
deleted file mode 100644
index b15ba9c7cb3f..000000000000
--- a/tools/perf/util/rbtree.c
+++ /dev/null
@@ -1,383 +0,0 @@
-/*
-  Red Black Trees
-  (C) 1999  Andrea Arcangeli <andrea@suse.de>
-  (C) 2002  David Woodhouse <dwmw2@infradead.org>
-  
-  This program is free software; you can redistribute it and/or modify
-  it under the terms of the GNU General Public License as published by
-  the Free Software Foundation; either version 2 of the License, or
-  (at your option) any later version.
-
-  This program is distributed in the hope that it will be useful,
-  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  GNU General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with this program; if not, write to the Free Software
-  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-  linux/lib/rbtree.c
-*/
-
-#include "rbtree.h"
-
-static void __rb_rotate_left(struct rb_node *node, struct rb_root *root)
-{
-        struct rb_node *right = node->rb_right;
-        struct rb_node *parent = rb_parent(node);
-
-        if ((node->rb_right = right->rb_left))
-                rb_set_parent(right->rb_left, node);
-        right->rb_left = node;
-
-        rb_set_parent(right, parent);
-
-        if (parent)
-        {
-                if (node == parent->rb_left)
-                        parent->rb_left = right;
-                else
-                        parent->rb_right = right;
-        }
-        else
-                root->rb_node = right;
-        rb_set_parent(node, right);
-}
-
-static void __rb_rotate_right(struct rb_node *node, struct rb_root *root)
-{
-        struct rb_node *left = node->rb_left;
-        struct rb_node *parent = rb_parent(node);
-
-        if ((node->rb_left = left->rb_right))
-                rb_set_parent(left->rb_right, node);
-        left->rb_right = node;
-
-        rb_set_parent(left, parent);
-
-        if (parent)
-        {
-                if (node == parent->rb_right)
-                        parent->rb_right = left;
-                else
-                        parent->rb_left = left;
-        }
-        else
-                root->rb_node = left;
-        rb_set_parent(node, left);
-}
-
-void rb_insert_color(struct rb_node *node, struct rb_root *root)
-{
-        struct rb_node *parent, *gparent;
-
-        while ((parent = rb_parent(node)) && rb_is_red(parent))
-        {
-                gparent = rb_parent(parent);
-
-                if (parent == gparent->rb_left)
-                {
-                        {
-                                register struct rb_node *uncle = gparent->rb_right;
-                                if (uncle && rb_is_red(uncle))
-                                {
-                                        rb_set_black(uncle);
-                                        rb_set_black(parent);
-                                        rb_set_red(gparent);
-                                        node = gparent;
-                                        continue;
-                                }
-                        }
-
-                        if (parent->rb_right == node)
-                        {
-                                register struct rb_node *tmp;
-                                __rb_rotate_left(parent, root);
-                                tmp = parent;
-                                parent = node;
-                                node = tmp;
-                        }
-
-                        rb_set_black(parent);
-                        rb_set_red(gparent);
-                        __rb_rotate_right(gparent, root);
-                } else {
-                        {
-                                register struct rb_node *uncle = gparent->rb_left;
-                                if (uncle && rb_is_red(uncle))
-                                {
-                                        rb_set_black(uncle);
-                                        rb_set_black(parent);
-                                        rb_set_red(gparent);
-                                        node = gparent;
-                                        continue;
-                                }
-                        }
-
-                        if (parent->rb_left == node)
-                        {
-                                register struct rb_node *tmp;
-                                __rb_rotate_right(parent, root);
-                                tmp = parent;
-                                parent = node;
-                                node = tmp;
-                        }
-
-                        rb_set_black(parent);
-                        rb_set_red(gparent);
-                        __rb_rotate_left(gparent, root);
-                }
-        }
-
-        rb_set_black(root->rb_node);
-}
-
-static void __rb_erase_color(struct rb_node *node, struct rb_node *parent,
-                             struct rb_root *root)
-{
-        struct rb_node *other;
-
-        while ((!node || rb_is_black(node)) && node != root->rb_node)
-        {
-                if (parent->rb_left == node)
-                {
-                        other = parent->rb_right;
-                        if (rb_is_red(other))
-                        {
-                                rb_set_black(other);
-                                rb_set_red(parent);
-                                __rb_rotate_left(parent, root);
-                                other = parent->rb_right;
-                        }
-                        if ((!other->rb_left || rb_is_black(other->rb_left)) &&
-                            (!other->rb_right || rb_is_black(other->rb_right)))
-                        {
-                                rb_set_red(other);
-                                node = parent;
-                                parent = rb_parent(node);
-                        }
-                        else
-                        {
-                                if (!other->rb_right || rb_is_black(other->rb_right))
-                                {
-                                        rb_set_black(other->rb_left);
-                                        rb_set_red(other);
-                                        __rb_rotate_right(other, root);
-                                        other = parent->rb_right;
-                                }
-                                rb_set_color(other, rb_color(parent));
-                                rb_set_black(parent);
-                                rb_set_black(other->rb_right);
-                                __rb_rotate_left(parent, root);
-                                node = root->rb_node;
-                                break;
-                        }
-                }
-                else
-                {
-                        other = parent->rb_left;
-                        if (rb_is_red(other))
-                        {
-                                rb_set_black(other);
-                                rb_set_red(parent);
-                                __rb_rotate_right(parent, root);
-                                other = parent->rb_left;
-                        }
-                        if ((!other->rb_left || rb_is_black(other->rb_left)) &&
-                            (!other->rb_right || rb_is_black(other->rb_right)))
-                        {
-                                rb_set_red(other);
-                                node = parent;
-                                parent = rb_parent(node);
-                        }
-                        else
-                        {
-                                if (!other->rb_left || rb_is_black(other->rb_left))
-                                {
-                                        rb_set_black(other->rb_right);
-                                        rb_set_red(other);
-                                        __rb_rotate_left(other, root);
-                                        other = parent->rb_left;
-                                }
-                                rb_set_color(other, rb_color(parent));
-                                rb_set_black(parent);
-                                rb_set_black(other->rb_left);
-                                __rb_rotate_right(parent, root);
-                                node = root->rb_node;
-                                break;
-                        }
-                }
-        }
-        if (node)
-                rb_set_black(node);
-}
-
-void rb_erase(struct rb_node *node, struct rb_root *root)
-{
-        struct rb_node *child, *parent;
-        int color;
-
-        if (!node->rb_left)
-                child = node->rb_right;
-        else if (!node->rb_right)
-                child = node->rb_left;
-        else
-        {
-                struct rb_node *old = node, *left;
-
-                node = node->rb_right;
-                while ((left = node->rb_left) != NULL)
-                        node = left;
-                child = node->rb_right;
-                parent = rb_parent(node);
-                color = rb_color(node);
-
-                if (child)
-                        rb_set_parent(child, parent);
-                if (parent == old) {
-                        parent->rb_right = child;
-                        parent = node;
-                } else
-                        parent->rb_left = child;
-
-                node->rb_parent_color = old->rb_parent_color;
-                node->rb_right = old->rb_right;
-                node->rb_left = old->rb_left;
-
-                if (rb_parent(old))
-                {
-                        if (rb_parent(old)->rb_left == old)
-                                rb_parent(old)->rb_left = node;
-                        else
-                                rb_parent(old)->rb_right = node;
-                } else
-                        root->rb_node = node;
-
-                rb_set_parent(old->rb_left, node);
-                if (old->rb_right)
-                        rb_set_parent(old->rb_right, node);
-                goto color;
-        }
-
-        parent = rb_parent(node);
-        color = rb_color(node);
-
-        if (child)
-                rb_set_parent(child, parent);
-        if (parent)
-        {
-                if (parent->rb_left == node)
-                        parent->rb_left = child;
-                else
-                        parent->rb_right = child;
-        }
-        else
-                root->rb_node = child;
-
- color:
-        if (color == RB_BLACK)
-                __rb_erase_color(child, parent, root);
-}
-
-/*
- * This function returns the first node (in sort order) of the tree.
- */
-struct rb_node *rb_first(const struct rb_root *root)
-{
-        struct rb_node  *n;
-
-        n = root->rb_node;
-        if (!n)
-                return NULL;
-        while (n->rb_left)
-                n = n->rb_left;
-        return n;
-}
-
-struct rb_node *rb_last(const struct rb_root *root)
-{
-        struct rb_node  *n;
-
-        n = root->rb_node;
-        if (!n)
-                return NULL;
-        while (n->rb_right)
-                n = n->rb_right;
-        return n;
-}
-
-struct rb_node *rb_next(const struct rb_node *node)
-{
-        struct rb_node *parent;
-
-        if (rb_parent(node) == node)
-                return NULL;
-
-        /* If we have a right-hand child, go down and then left as far
-           as we can. */
-        if (node->rb_right) {
-                node = node->rb_right; 
-                while (node->rb_left)
-                        node=node->rb_left;
-                return (struct rb_node *)node;
-        }
-
-        /* No right-hand children.  Everything down and left is
-           smaller than us, so any 'next' node must be in the general
-           direction of our parent. Go up the tree; any time the
-           ancestor is a right-hand child of its parent, keep going
-           up. First time it's a left-hand child of its parent, said
-           parent is our 'next' node. */
-        while ((parent = rb_parent(node)) && node == parent->rb_right)
-                node = parent;
-
-        return parent;
-}
-
-struct rb_node *rb_prev(const struct rb_node *node)
-{
-        struct rb_node *parent;
-
-        if (rb_parent(node) == node)
-                return NULL;
-
-        /* If we have a left-hand child, go down and then right as far
-           as we can. */
-        if (node->rb_left) {
-                node = node->rb_left; 
-                while (node->rb_right)
-                        node=node->rb_right;
-                return (struct rb_node *)node;
-        }
-
-        /* No left-hand children. Go up till we find an ancestor which
-           is a right-hand child of its parent */
-        while ((parent = rb_parent(node)) && node == parent->rb_left)
-                node = parent;
-
-        return parent;
-}
-
-void rb_replace_node(struct rb_node *victim, struct rb_node *new,
-                     struct rb_root *root)
-{
-        struct rb_node *parent = rb_parent(victim);
-
-        /* Set the surrounding nodes to point to the replacement */
-        if (parent) {
-                if (victim == parent->rb_left)
-                        parent->rb_left = new;
-                else
-                        parent->rb_right = new;
-        } else {
-                root->rb_node = new;
-        }
-        if (victim->rb_left)
-                rb_set_parent(victim->rb_left, new);
-        if (victim->rb_right)
-                rb_set_parent(victim->rb_right, new);
-
-        /* Copy the pointers/colour from the victim to the replacement */
-        *new = *victim;
-}
diff --git a/tools/perf/util/rbtree.h b/tools/perf/util/rbtree.h
deleted file mode 100644
index 6bdc488a47fb..000000000000
--- a/tools/perf/util/rbtree.h
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
-  Red Black Trees
-  (C) 1999  Andrea Arcangeli <andrea@suse.de>
-  
-  This program is free software; you can redistribute it and/or modify
-  it under the terms of the GNU General Public License as published by
-  the Free Software Foundation; either version 2 of the License, or
-  (at your option) any later version.
-
-  This program is distributed in the hope that it will be useful,
-  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  GNU General Public License for more details.
-
-  You should have received a copy of the GNU General Public License
-  along with this program; if not, write to the Free Software
-  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-  linux/include/linux/rbtree.h
-
-  To use rbtrees you'll have to implement your own insert and search cores.
-  This will avoid us to use callbacks and to drop drammatically performances.
-  I know it's not the cleaner way,  but in C (not in C++) to get
-  performances and genericity...
-
-  Some example of insert and search follows here. The search is a plain
-  normal search over an ordered tree. The insert instead must be implemented
-  int two steps: as first thing the code must insert the element in
-  order as a red leaf in the tree, then the support library function
-  rb_insert_color() must be called. Such function will do the
-  not trivial work to rebalance the rbtree if necessary.
-
------------------------------------------------------------------------
-static inline struct page * rb_search_page_cache(struct inode * inode,
-                                                 unsigned long offset)
-{
-        struct rb_node * n = inode->i_rb_page_cache.rb_node;
-        struct page * page;
-
-        while (n)
-        {
-                page = rb_entry(n, struct page, rb_page_cache);
-
-                if (offset < page->offset)
-                        n = n->rb_left;
-                else if (offset > page->offset)
-                        n = n->rb_right;
-                else
-                        return page;
-        }
-        return NULL;
-}
-
-static inline struct page * __rb_insert_page_cache(struct inode * inode,
-                                                   unsigned long offset,
-                                                   struct rb_node * node)
-{
-        struct rb_node ** p = &inode->i_rb_page_cache.rb_node;
-        struct rb_node * parent = NULL;
-        struct page * page;
-
-        while (*p)
-        {
-                parent = *p;
-                page = rb_entry(parent, struct page, rb_page_cache);
-
-                if (offset < page->offset)
-                        p = &(*p)->rb_left;
-                else if (offset > page->offset)
-                        p = &(*p)->rb_right;
-                else
-                        return page;
-        }
-
-        rb_link_node(node, parent, p);
-
-        return NULL;
-}
-
-static inline struct page * rb_insert_page_cache(struct inode * inode,
-                                                 unsigned long offset,
-                                                 struct rb_node * node)
-{
-        struct page * ret;
-        if ((ret = __rb_insert_page_cache(inode, offset, node)))
-                goto out;
-        rb_insert_color(node, &inode->i_rb_page_cache);
- out:
-        return ret;
-}
------------------------------------------------------------------------
-*/
-
-#ifndef _LINUX_RBTREE_H
-#define _LINUX_RBTREE_H
-
-#include <stddef.h>
-
-/**
- * container_of - cast a member of a structure out to the containing structure
- * @ptr:        the pointer to the member.
- * @type:       the type of the container struct this is embedded in.
- * @member:     the name of the member within the struct.
- *
- */
-#define container_of(ptr, type, member) ({                      \
-        const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
-        (type *)( (char *)__mptr - offsetof(type,member) );})
-
-struct rb_node
-{
-        unsigned long  rb_parent_color;
-#define RB_RED          0
-#define RB_BLACK        1
-        struct rb_node *rb_right;
-        struct rb_node *rb_left;
-} __attribute__((aligned(sizeof(long))));
-    /* The alignment might seem pointless, but allegedly CRIS needs it */
-
-struct rb_root
-{
-        struct rb_node *rb_node;
-};
-
-
-#define rb_parent(r)   ((struct rb_node *)((r)->rb_parent_color & ~3))
-#define rb_color(r)   ((r)->rb_parent_color & 1)
-#define rb_is_red(r)   (!rb_color(r))
-#define rb_is_black(r) rb_color(r)
-#define rb_set_red(r)  do { (r)->rb_parent_color &= ~1; } while (0)
-#define rb_set_black(r)  do { (r)->rb_parent_color |= 1; } while (0)
-
-static inline void rb_set_parent(struct rb_node *rb, struct rb_node *p)
-{
-        rb->rb_parent_color = (rb->rb_parent_color & 3) | (unsigned long)p;
-}
-static inline void rb_set_color(struct rb_node *rb, int color)
-{
-        rb->rb_parent_color = (rb->rb_parent_color & ~1) | color;
-}
-
-#define RB_ROOT (struct rb_root) { NULL, }
-#define rb_entry(ptr, type, member) container_of(ptr, type, member)
-
-#define RB_EMPTY_ROOT(root)     ((root)->rb_node == NULL)
-#define RB_EMPTY_NODE(node)     (rb_parent(node) == node)
-#define RB_CLEAR_NODE(node)     (rb_set_parent(node, node))
-
-extern void rb_insert_color(struct rb_node *, struct rb_root *);
-extern void rb_erase(struct rb_node *, struct rb_root *);
-
-/* Find logical next and previous nodes in a tree */
-extern struct rb_node *rb_next(const struct rb_node *);
-extern struct rb_node *rb_prev(const struct rb_node *);
-extern struct rb_node *rb_first(const struct rb_root *);
-extern struct rb_node *rb_last(const struct rb_root *);
-
-/* Fast replacement of a single node without remove/rebalance/add/rebalance */
-extern void rb_replace_node(struct rb_node *victim, struct rb_node *new, 
-                            struct rb_root *root);
-
-static inline void rb_link_node(struct rb_node * node, struct rb_node * parent,
-                                struct rb_node ** rb_link)
-{
-        node->rb_parent_color = (unsigned long )parent;
-        node->rb_left = node->rb_right = NULL;
-
-        *rb_link = node;
-}
-
-#endif  /* _LINUX_RBTREE_H */
diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c
index 464e7ca898cf..5249d5a1b0c2 100644
--- a/tools/perf/util/strbuf.c
+++ b/tools/perf/util/strbuf.c
@@ -16,7 +16,7 @@ int prefixcmp(const char *str, const char *prefix)
  */
 char strbuf_slopbuf[1];
 
-void strbuf_init(struct strbuf *sb, size_t hint)
+void strbuf_init(struct strbuf *sb, ssize_t hint)
 {
         sb->alloc = sb->len = 0;
         sb->buf = strbuf_slopbuf;
@@ -92,7 +92,8 @@ void strbuf_ltrim(struct strbuf *sb)
 
 void strbuf_tolower(struct strbuf *sb)
 {
-        int i;
+        unsigned int i;
+
         for (i = 0; i < sb->len; i++)
                 sb->buf[i] = tolower(sb->buf[i]);
 }
@@ -264,7 +265,7 @@ size_t strbuf_fread(struct strbuf *sb, size_t size, FILE *f)
         return res;
 }
 
-ssize_t strbuf_read(struct strbuf *sb, int fd, size_t hint)
+ssize_t strbuf_read(struct strbuf *sb, int fd, ssize_t hint)
 {
         size_t oldlen = sb->len;
         size_t oldalloc = sb->alloc;
@@ -293,7 +294,7 @@ ssize_t strbuf_read(struct strbuf *sb, int fd, size_t hint)
 
 #define STRBUF_MAXLINK (2*PATH_MAX)
 
-int strbuf_readlink(struct strbuf *sb, const char *path, size_t hint)
+int strbuf_readlink(struct strbuf *sb, const char *path, ssize_t hint)
 {
         size_t oldalloc = sb->alloc;
 
@@ -301,7 +302,7 @@ int strbuf_readlink(struct strbuf *sb, const char *path, size_t hint)
                 hint = 32;
 
         while (hint < STRBUF_MAXLINK) {
-                int len;
+                ssize_t len;
 
                 strbuf_grow(sb, hint);
                 len = readlink(path, sb->buf, hint);
@@ -343,7 +344,7 @@ int strbuf_getline(struct strbuf *sb, FILE *fp, int term)
         return 0;
 }
 
-int strbuf_read_file(struct strbuf *sb, const char *path, size_t hint)
+int strbuf_read_file(struct strbuf *sb, const char *path, ssize_t hint)
 {
         int fd, len;
 
diff --git a/tools/perf/util/strbuf.h b/tools/perf/util/strbuf.h
index 9ee908a3ec5d..d2aa86c014c1 100644
--- a/tools/perf/util/strbuf.h
+++ b/tools/perf/util/strbuf.h
@@ -50,7 +50,7 @@ struct strbuf {
 #define STRBUF_INIT  { 0, 0, strbuf_slopbuf }
 
 /*----- strbuf life cycle -----*/
-extern void strbuf_init(struct strbuf *, size_t);
+extern void strbuf_init(struct strbuf *buf, ssize_t hint);
 extern void strbuf_release(struct strbuf *);
 extern char *strbuf_detach(struct strbuf *, size_t *);
 extern void strbuf_attach(struct strbuf *, void *, size_t, size_t);
@@ -61,7 +61,7 @@ static inline void strbuf_swap(struct strbuf *a, struct strbuf *b) {
 }
 
 /*----- strbuf size related -----*/
-static inline size_t strbuf_avail(const struct strbuf *sb) {
+static inline ssize_t strbuf_avail(const struct strbuf *sb) {
         return sb->alloc ? sb->alloc - sb->len - 1 : 0;
 }
 
@@ -122,9 +122,9 @@ extern void strbuf_addf(struct strbuf *sb, const char *fmt, ...);
 
 extern size_t strbuf_fread(struct strbuf *, size_t, FILE *);
 /* XXX: if read fails, any partial read is undone */
-extern ssize_t strbuf_read(struct strbuf *, int fd, size_t hint);
-extern int strbuf_read_file(struct strbuf *sb, const char *path, size_t hint);
-extern int strbuf_readlink(struct strbuf *sb, const char *path, size_t hint);
+extern ssize_t strbuf_read(struct strbuf *, int fd, ssize_t hint);
+extern int strbuf_read_file(struct strbuf *sb, const char *path, ssize_t hint);
+extern int strbuf_readlink(struct strbuf *sb, const char *path, ssize_t hint);
 
 extern int strbuf_getline(struct strbuf *, FILE *, int);
 
diff --git a/tools/perf/util/strlist.h b/tools/perf/util/strlist.h
index 2fb117fb4b67..2fdcfee87586 100644
--- a/tools/perf/util/strlist.h
+++ b/tools/perf/util/strlist.h
@@ -1,7 +1,7 @@
 #ifndef STRLIST_H_
 #define STRLIST_H_
 
-#include "rbtree.h"
+#include <linux/rbtree.h>
 #include <stdbool.h>
 
 struct str_node {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 78c2efde01b7..4683b67b5ee4 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -35,7 +35,7 @@ static struct symbol *symbol__new(u64 start, u64 len,
                 self = ((void *)self) + priv_size;
         }
         self->start = start;
-        self->end   = start + len - 1;
+        self->end   = len ? start + len - 1 : start;
         memcpy(self->name, name, namelen);
 
         return self;
@@ -48,8 +48,12 @@ static void symbol__delete(struct symbol *self, unsigned int priv_size)
 
 static size_t symbol__fprintf(struct symbol *self, FILE *fp)
 {
-        return fprintf(fp, " %llx-%llx %s\n",
+        if (!self->module)
+                return fprintf(fp, " %llx-%llx %s\n",
                        self->start, self->end, self->name);
+        else
+                return fprintf(fp, " %llx-%llx %s \t[%s]\n",
+                       self->start, self->end, self->name, self->module->name);
 }
 
 struct dso *dso__new(const char *name, unsigned int sym_priv_size)
@@ -146,6 +150,7 @@ static int dso__load_kallsyms(struct dso *self, symbol_filter_t filter, int verb
         char *line = NULL;
         size_t n;
         FILE *file = fopen("/proc/kallsyms", "r");
+        int count = 0;
 
         if (file == NULL)
                 goto out_failure;
@@ -188,8 +193,10 @@ static int dso__load_kallsyms(struct dso *self, symbol_filter_t filter, int verb
 
                 if (filter && filter(self, sym))
                         symbol__delete(sym, self->sym_priv_size);
-                else
+                else {
                         dso__insert_symbol(self, sym);
+                        count++;
+                }
         }
 
         /*
@@ -212,7 +219,7 @@ static int dso__load_kallsyms(struct dso *self, symbol_filter_t filter, int verb
         free(line);
         fclose(file);
 
-        return 0;
+        return count;
 
 out_delete_line:
         free(line);
@@ -307,6 +314,26 @@ static inline int elf_sym__is_function(const GElf_Sym *sym)
                sym->st_size != 0;
 }
 
+static inline int elf_sym__is_label(const GElf_Sym *sym)
+{
+        return elf_sym__type(sym) == STT_NOTYPE &&
+                sym->st_name != 0 &&
+                sym->st_shndx != SHN_UNDEF &&
+                sym->st_shndx != SHN_ABS;
+}
+
+static inline const char *elf_sec__name(const GElf_Shdr *shdr,
+                                        const Elf_Data *secstrs)
+{
+        return secstrs->d_buf + shdr->sh_name;
+}
+
+static inline int elf_sec__is_text(const GElf_Shdr *shdr,
+                                        const Elf_Data *secstrs)
+{
+        return strstr(elf_sec__name(shdr, secstrs), "text") != NULL;
+}
+
 static inline const char *elf_sym__name(const GElf_Sym *sym,
                                         const Elf_Data *symstrs)
 {
@@ -448,9 +475,9 @@ static int dso__synthesize_plt_symbols(struct  dso *self, Elf *elf,
 }
 
 static int dso__load_sym(struct dso *self, int fd, const char *name,
-                         symbol_filter_t filter, int verbose)
+                         symbol_filter_t filter, int verbose, struct module *mod)
 {
-        Elf_Data *symstrs;
+        Elf_Data *symstrs, *secstrs;
         uint32_t nr_syms;
         int err = -1;
         uint32_t index;
@@ -458,7 +485,7 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
         GElf_Shdr shdr;
         Elf_Data *syms;
         GElf_Sym sym;
-        Elf_Scn *sec, *sec_dynsym;
+        Elf_Scn *sec, *sec_dynsym, *sec_strndx;
         Elf *elf;
         size_t dynsym_idx;
         int nr = 0;
@@ -517,17 +544,29 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
         if (symstrs == NULL)
                 goto out_elf_end;
 
+        sec_strndx = elf_getscn(elf, ehdr.e_shstrndx);
+        if (sec_strndx == NULL)
+                goto out_elf_end;
+
+        secstrs = elf_getdata(sec_strndx, NULL);
+        if (symstrs == NULL)
+                goto out_elf_end;
+
         nr_syms = shdr.sh_size / shdr.sh_entsize;
 
         memset(&sym, 0, sizeof(sym));
-        self->prelinked = elf_section_by_name(elf, &ehdr, &shdr,
-                                              ".gnu.prelink_undo",
-                                              NULL) != NULL;
+        self->adjust_symbols = (ehdr.e_type == ET_EXEC ||
+                                elf_section_by_name(elf, &ehdr, &shdr,
+                                                     ".gnu.prelink_undo",
+                                                     NULL) != NULL);
         elf_symtab__for_each_symbol(syms, nr_syms, index, sym) {
                 struct symbol *f;
                 u64 obj_start;
+                struct section *section = NULL;
+                int is_label = elf_sym__is_label(&sym);
+                const char *section_name;
 
-                if (!elf_sym__is_function(&sym))
+                if (!is_label && !elf_sym__is_function(&sym))
                         continue;
 
                 sec = elf_getscn(elf, sym.st_shndx);
@@ -535,9 +574,14 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
                         goto out_elf_end;
 
                 gelf_getshdr(sec, &shdr);
+
+                if (is_label && !elf_sec__is_text(&shdr, secstrs))
+                        continue;
+
+                section_name = elf_sec__name(&shdr, secstrs);
                 obj_start = sym.st_value;
 
-                if (self->prelinked) {
+                if (self->adjust_symbols) {
                         if (verbose >= 2)
                                 printf("adjusting symbol: st_value: %Lx sh_addr: %Lx sh_offset: %Lx\n",
                                         (u64)sym.st_value, (u64)shdr.sh_addr, (u64)shdr.sh_offset);
@@ -545,6 +589,17 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
                         sym.st_value -= shdr.sh_addr - shdr.sh_offset;
                 }
 
+                if (mod) {
+                        section = mod->sections->find_section(mod->sections, section_name);
+                        if (section)
+                                sym.st_value += section->vma;
+                        else {
+                                fprintf(stderr, "dso__load_sym() module %s lookup of %s failed\n",
+                                        mod->name, section_name);
+                                goto out_elf_end;
+                        }
+                }
+
                 f = symbol__new(sym.st_value, sym.st_size,
                                 elf_sym__name(&sym, symstrs),
                                 self->sym_priv_size, obj_start, verbose);
@@ -554,6 +609,7 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
                 if (filter && filter(self, f))
                         symbol__delete(f, self->sym_priv_size);
                 else {
+                        f->module = mod;
                         dso__insert_symbol(self, f);
                         nr++;
                 }
@@ -577,7 +633,7 @@ int dso__load(struct dso *self, symbol_filter_t filter, int verbose)
         if (!name)
                 return -1;
 
-        self->prelinked = 0;
+        self->adjust_symbols = 0;
 
         if (strncmp(self->name, "/tmp/perf-", 10) == 0)
                 return dso__load_perf_map(self, filter, verbose);
@@ -603,7 +659,7 @@ more:
                 fd = open(name, O_RDONLY);
         } while (fd < 0);
 
-        ret = dso__load_sym(self, fd, name, filter, verbose);
+        ret = dso__load_sym(self, fd, name, filter, verbose, NULL);
         close(fd);
 
         /*
@@ -617,6 +673,86 @@ out:
         return ret;
 }
 
+static int dso__load_module(struct dso *self, struct mod_dso *mods, const char *name,
+                             symbol_filter_t filter, int verbose)
+{
+        struct module *mod = mod_dso__find_module(mods, name);
+        int err = 0, fd;
+
+        if (mod == NULL || !mod->active)
+                return err;
+
+        fd = open(mod->path, O_RDONLY);
+
+        if (fd < 0)
+                return err;
+
+        err = dso__load_sym(self, fd, name, filter, verbose, mod);
+        close(fd);
+
+        return err;
+}
+
+int dso__load_modules(struct dso *self, symbol_filter_t filter, int verbose)
+{
+        struct mod_dso *mods = mod_dso__new_dso("modules");
+        struct module *pos;
+        struct rb_node *next;
+        int err;
+
+        err = mod_dso__load_modules(mods);
+
+        if (err <= 0)
+                return err;
+
+        /*
+         * Iterate over modules, and load active symbols.
+         */
+        next = rb_first(&mods->mods);
+        while (next) {
+                pos = rb_entry(next, struct module, rb_node);
+                err = dso__load_module(self, mods, pos->name, filter, verbose);
+
+                if (err < 0)
+                        break;
+
+                next = rb_next(&pos->rb_node);
+        }
+
+        if (err < 0) {
+                mod_dso__delete_modules(mods);
+                mod_dso__delete_self(mods);
+        }
+
+        return err;
+}
+
+static inline void dso__fill_symbol_holes(struct dso *self)
+{
+        struct symbol *prev = NULL;
+        struct rb_node *nd;
+
+        for (nd = rb_last(&self->syms); nd; nd = rb_prev(nd)) {
+                struct symbol *pos = rb_entry(nd, struct symbol, rb_node);
+
+                if (prev) {
+                        u64 hole = 0;
+                        int alias = pos->start == prev->start;
+
+                        if (!alias)
+                                hole = prev->start - pos->end - 1;
+
+                        if (hole || alias) {
+                                if (alias)
+                                        pos->end = prev->end;
+                                else if (hole)
+                                        pos->end = prev->start - 1;
+                        }
+                }
+                prev = pos;
+        }
+}
+
 static int dso__load_vmlinux(struct dso *self, const char *vmlinux,
                              symbol_filter_t filter, int verbose)
 {
@@ -625,21 +761,28 @@ static int dso__load_vmlinux(struct dso *self, const char *vmlinux,
         if (fd < 0)
                 return -1;
 
-        err = dso__load_sym(self, fd, vmlinux, filter, verbose);
+        err = dso__load_sym(self, fd, vmlinux, filter, verbose, NULL);
+
+        if (err > 0)
+                dso__fill_symbol_holes(self);
+
         close(fd);
 
         return err;
 }
 
 int dso__load_kernel(struct dso *self, const char *vmlinux,
-                     symbol_filter_t filter, int verbose)
+                     symbol_filter_t filter, int verbose, int modules)
 {
         int err = -1;
 
-        if (vmlinux)
+        if (vmlinux) {
                 err = dso__load_vmlinux(self, vmlinux, filter, verbose);
+                if (err > 0 && modules)
+                        err = dso__load_modules(self, filter, verbose);
+        }
 
-        if (err < 0)
+        if (err <= 0)
                 err = dso__load_kallsyms(self, filter, verbose);
 
         return err;
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 2c48ace8203b..7918cffb23cd 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -3,8 +3,9 @@
 
 #include <linux/types.h>
 #include "types.h"
-#include "list.h"
-#include "rbtree.h"
+#include <linux/list.h>
+#include <linux/rbtree.h>
+#include "module.h"
 
 struct symbol {
         struct rb_node  rb_node;
@@ -13,6 +14,7 @@ struct symbol {
         u64             obj_start;
         u64             hist_sum;
         u64             *hist;
+        struct module   *module;
         void            *priv;
         char            name[0];
 };
@@ -22,7 +24,7 @@ struct dso {
         struct rb_root   syms;
         struct symbol    *(*find_symbol)(struct dso *, u64 ip);
         unsigned int     sym_priv_size;
-        unsigned char    prelinked;
+        unsigned char    adjust_symbols;
         char             name[0];
 };
 
@@ -41,7 +43,8 @@ static inline void *dso__sym_priv(struct dso *self, struct symbol *sym)
 struct symbol *dso__find_symbol(struct dso *self, u64 ip);
 
 int dso__load_kernel(struct dso *self, const char *vmlinux,
-                     symbol_filter_t filter, int verbose);
+                     symbol_filter_t filter, int verbose, int modules);
+int dso__load_modules(struct dso *self, symbol_filter_t filter, int verbose);
 int dso__load(struct dso *self, symbol_filter_t filter, int verbose);
 
 size_t dso__fprintf(struct dso *self, FILE *fp);
diff --git a/tools/perf/util/wrapper.c b/tools/perf/util/wrapper.c
index 6350d65f6d9e..4574ac28396f 100644
--- a/tools/perf/util/wrapper.c
+++ b/tools/perf/util/wrapper.c
@@ -7,7 +7,7 @@
  * There's no pack memory to release - but stay close to the Git
  * version so wrap this away:
  */
-static inline void release_pack_memory(size_t size, int flag)
+static inline void release_pack_memory(size_t size __used, int flag __used)
 {
 }
 
@@ -59,7 +59,8 @@ void *xmemdupz(const void *data, size_t len)
 char *xstrndup(const char *str, size_t len)
 {
         char *p = memchr(str, '\0', len);
-        return xmemdupz(str, p ? p - str : len);
+
+        return xmemdupz(str, p ? (size_t)(p - str) : len);
 }
 
 void *xrealloc(void *ptr, size_t size)