275 files changed, 5049 insertions, 1282 deletions
diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 1f89424c36a6..65bbd2622396 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -272,6 +272,8 @@ printk-formats.txt
        - how to get printk format specifiers right
 prio_tree.txt
        - info on radix-priority-search-tree use for indexing vmas.
+ramoops.txt
+        - documentation of the ramoops oops/panic logging module.
 rbtree.txt
        - info on what red-black trees are and what they are for.
 robust-futex-ABI.txt
diff --git a/Documentation/PCI/MSI-HOWTO.txt b/Documentation/PCI/MSI-HOWTO.txt
index 3f5e0b09bed5..53e6fca146d7 100644
--- a/Documentation/PCI/MSI-HOWTO.txt
+++ b/Documentation/PCI/MSI-HOWTO.txt
@@ -45,7 +45,7 @@ arrived in memory (this becomes more likely with devices behind PCI-PCI
 bridges).  In order to ensure that all the data has arrived in memory,
 the interrupt handler must read a register on the device which raised
 the interrupt.  PCI transaction ordering rules require that all the data
-arrives in memory before the value can be returned from the register.
+arrive in memory before the value may be returned from the register.
 Using MSIs avoids this problem as the interrupt-generating write cannot
 pass the data writes, so by the time the interrupt is raised, the driver
 knows that all the data has arrived in memory.
@@ -86,13 +86,13 @@ device.
 int pci_enable_msi(struct pci_dev *dev)
-A successful call will allocate ONE interrupt to the device, regardless
+A successful call allocates ONE interrupt to the device, regardless
-of how many MSIs the device supports.  The device will be switched from
+of how many MSIs the device supports.  The device is switched from
 pin-based interrupt mode to MSI mode.  The dev->irq number is changed
-to a new number which represents the message signaled interrupt.
+to a new number which represents the message signaled interrupt;
-This function should be called before the driver calls request_irq()
+consequently, this function should be called before the driver calls
-since enabling MSIs disables the pin-based IRQ and the driver will not
+request_irq(), because an MSI is delivered via a vector that is
-receive interrupts on the old interrupt.
+different from the vector of a pin-based interrupt.
 4.2.2 pci_enable_msi_block
@@ -111,20 +111,20 @@ the device are in the range dev->irq to dev->irq + count - 1.
 If this function returns a negative number, it indicates an error and
 the driver should not attempt to request any more MSI interrupts for
-this device.  If this function returns a positive number, it will be
+this device.  If this function returns a positive number, it is
-less than 'count' and indicate the number of interrupts that could have
+less than 'count' and indicates the number of interrupts that could have
-been allocated.  In neither case will the irq value have been
+been allocated.  In neither case is the irq value updated or the device
-updated, nor will the device have been switched into MSI mode.
+switched into MSI mode.
 The device driver must decide what action to take if
-pci_enable_msi_block() returns a value less than the number asked for.
+pci_enable_msi_block() returns a value less than the number requested.
-Some devices can make use of fewer interrupts than the maximum they
+For instance, the driver could still make use of fewer interrupts;
-request; in this case the driver should call pci_enable_msi_block()
+in this case the driver should call pci_enable_msi_block()
 again.  Note that it is not guaranteed to succeed, even when the
 'count' has been reduced to the value returned from a previous call to
 pci_enable_msi_block().  This is because there are multiple constraints
 on the number of vectors that can be allocated; pci_enable_msi_block()
-will return as soon as it finds any constraint that doesn't allow the
+returns as soon as it finds any constraint that doesn't allow the
 call to succeed.
 4.2.3 pci_disable_msi
@@ -137,10 +137,10 @@ interrupt number and frees the previously allocated message signaled
 interrupt(s).  The interrupt may subsequently be assigned to another
 device, so drivers should not cache the value of dev->irq.
-A device driver must always call free_irq() on the interrupt(s)
+Before calling this function, a device driver must always call free_irq()
-for which it has called request_irq() before calling this function.
+on any interrupt for which it previously called request_irq().
-Failure to do so will result in a BUG_ON(), the device will be left with
+Failure to do so results in a BUG_ON(), leaving the device with
-MSI enabled and will leak its vector.
+MSI enabled and thus leaking its vector.
 4.3 Using MSI-X
@@ -155,10 +155,10 @@ struct msix_entry {
 };
 This allows for the device to use these interrupts in a sparse fashion;
-for example it could use interrupts 3 and 1027 and allocate only a
+for example, it could use interrupts 3 and 1027 and yet allocate only a
 two-element array.  The driver is expected to fill in the 'entry' value
-in each element of the array to indicate which entries it wants the kernel
+in each element of the array to indicate for which entries the kernel
-to assign interrupts for.  It is invalid to fill in two entries with the
+should assign interrupts; it is invalid to fill in two entries with the
 same number.
 4.3.1 pci_enable_msix
@@ -168,10 +168,11 @@ int pci_enable_msix(struct pci_dev *dev, struct msix_entry *entries, int nvec)
 Calling this function asks the PCI subsystem to allocate 'nvec' MSIs.
 The 'entries' argument is a pointer to an array of msix_entry structs
 which should be at least 'nvec' entries in size.  On success, the
-function will return 0 and the device will have been switched into
+device is switched into MSI-X mode and the function returns 0.
-MSI-X interrupt mode.  The 'vector' elements in each entry will have
+The 'vector' member in each entry is populated with the interrupt number;
-been filled in with the interrupt number.  The driver should then call
+the driver should then call request_irq() for each 'vector' that it
-request_irq() for each 'vector' that it decides to use.
+decides to use.  The device driver is responsible for keeping track of the
+interrupts assigned to the MSI-X vectors so it can free them again later.
 If this function returns a negative number, it indicates an error and
 the driver should not attempt to allocate any more MSI-X interrupts for
@@ -181,16 +182,14 @@ below.
 This function, in contrast with pci_enable_msi(), does not adjust
 dev->irq.  The device will not generate interrupts for this interrupt
-number once MSI-X is enabled.  The device driver is responsible for
+number once MSI-X is enabled.
-keeping track of the interrupts assigned to the MSI-X vectors so it can
-free them again later.
 Device drivers should normally call this function once per device
 during the initialization phase.
-It is ideal if drivers can cope with a variable number of MSI-X interrupts,
+It is ideal if drivers can cope with a variable number of MSI-X interrupts;
 there are many reasons why the platform may not be able to provide the
-exact number a driver asks for.
+exact number that a driver asks for.
 A request loop to achieve that might look like:
@@ -212,15 +211,15 @@ static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
 void pci_disable_msix(struct pci_dev *dev)
-This API should be used to undo the effect of pci_enable_msix().  It frees
+This function should be used to undo the effect of pci_enable_msix().  It frees
 the previously allocated message signaled interrupts.  The interrupts may
 subsequently be assigned to another device, so drivers should not cache
 the value of the 'vector' elements over a call to pci_disable_msix().
-A device driver must always call free_irq() on the interrupt(s)
+Before calling this function, a device driver must always call free_irq()
-for which it has called request_irq() before calling this function.
+on any interrupt for which it previously called request_irq().
-Failure to do so will result in a BUG_ON(), the device will be left with
+Failure to do so results in a BUG_ON(), leaving the device with
-MSI enabled and will leak its vector.
+MSI-X enabled and thus leaking its vector.
 4.3.3 The MSI-X Table
@@ -232,10 +231,10 @@ mask or unmask an interrupt, it should call disable_irq() / enable_irq().
 4.4 Handling devices implementing both MSI and MSI-X capabilities
 If a device implements both MSI and MSI-X capabilities, it can
-run in either MSI mode or MSI-X mode but not both simultaneously.
+run in either MSI mode or MSI-X mode, but not both simultaneously.
 This is a requirement of the PCI spec, and it is enforced by the
 PCI layer.  Calling pci_enable_msi() when MSI-X is already enabled or
-pci_enable_msix() when MSI is already enabled will result in an error.
+pci_enable_msix() when MSI is already enabled results in an error.
 If a device driver wishes to switch between MSI and MSI-X at runtime,
 it must first quiesce the device, then switch it back to pin-interrupt
 mode, before calling pci_enable_msi() or pci_enable_msix() and resuming
@@ -251,7 +250,7 @@ the MSI-X facilities in preference to the MSI facilities.  As mentioned
 above, MSI-X supports any number of interrupts between 1 and 2048.
 In constrast, MSI is restricted to a maximum of 32 interrupts (and
 must be a power of two).  In addition, the MSI interrupt vectors must
-be allocated consecutively, so the system may not be able to allocate
+be allocated consecutively, so the system might not be able to allocate
 as many vectors for MSI as it could for MSI-X.  On some platforms, MSI
 interrupts must all be targeted at the same set of CPUs whereas MSI-X
 interrupts can all be targeted at different CPUs.
@@ -281,7 +280,7 @@ disabled to enabled and back again.
 Using 'lspci -v' (as root) may show some devices with "MSI", "Message
 Signalled Interrupts" or "MSI-X" capabilities.  Each of these capabilities
-has an 'Enable' flag which will be followed with either "+" (enabled)
+has an 'Enable' flag which is followed with either "+" (enabled)
 or "-" (disabled).
@@ -298,7 +297,7 @@ The PCI stack provides three ways to disable MSIs:
 Some host chipsets simply don't support MSIs properly.  If we're
 lucky, the manufacturer knows this and has indicated it in the ACPI
-FADT table.  In this case, Linux will automatically disable MSIs.
+FADT table.  In this case, Linux automatically disables MSIs.
 Some boards don't include this information in the table and so we have
 to detect them ourselves.  The complete list of these is found near the
 quirk_disable_all_msi() function in drivers/pci/quirks.c.
@@ -317,7 +316,7 @@ Some bridges allow you to enable MSIs by changing some bits in their
 PCI configuration space (especially the Hypertransport chipsets such
 as the nVidia nForce and Serverworks HT2000).  As with host chipsets,
 Linux mostly knows about them and automatically enables MSIs if it can.
-If you have a bridge which Linux doesn't yet know about, you can enable
+If you have a bridge unknown to Linux, you can enable
 MSIs in configuration space using whatever method you know works, then
 enable MSIs on that bridge by doing:
@@ -327,7 +326,7 @@ where $bridge is the PCI address of the bridge you've enabled (eg
 0000:00:0e.0).
 To disable MSIs, echo 0 instead of 1.  Changing this value should be
-done with caution as it can break interrupt handling for all devices
+done with caution as it could break interrupt handling for all devices
 below this bridge.
 Again, please notify linux-pci@vger.kernel.org of any bridges that need
@@ -336,7 +335,7 @@ special handling.
 5.3. Disabling MSIs on a single device
 Some devices are known to have faulty MSI implementations.  Usually this
-is handled in the individual device driver but occasionally it's necessary
+is handled in the individual device driver, but occasionally it's necessary
 to handle this with a quirk.  Some drivers have an option to disable use
 of MSI.  While this is a convenient workaround for the driver author,
 it is not good practise, and should not be emulated.
@@ -350,7 +349,7 @@ for your machine.  You should also check your .config to be sure you
 have enabled CONFIG_PCI_MSI.
 Then, 'lspci -t' gives the list of bridges above a device.  Reading
-/sys/bus/pci/devices/*/msi_bus will tell you whether MSI are enabled (1)
+/sys/bus/pci/devices/*/msi_bus will tell you whether MSIs are enabled (1)
 or disabled (0).  If 0 is found in any of the msi_bus files belonging
 to bridges between the PCI root and the device, MSIs are disabled.
diff --git a/Documentation/SubmittingDrivers b/Documentation/SubmittingDrivers
index 319baa8b60dd..36d16bbf72c6 100644
--- a/Documentation/SubmittingDrivers
+++ b/Documentation/SubmittingDrivers
@@ -130,7 +130,7 @@ Linux kernel master tree:
        ftp.??.kernel.org:/pub/linux/kernel/...
        ?? == your country code, such as "us", "uk", "fr", etc.
-        http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git
+        http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git
 Linux kernel mailing list:
        linux-kernel@vger.kernel.org
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 569f3532e138..4468ce24427c 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -303,7 +303,7 @@ patches that are being emailed around.
 The sign-off is a simple line at the end of the explanation for the
 patch, which certifies that you wrote it or otherwise have the right to
-pass it on as a open-source patch.  The rules are pretty simple: if you
+pass it on as an open-source patch.  The rules are pretty simple: if you
 can certify the below:
        Developer's Certificate of Origin 1.1
diff --git a/Documentation/email-clients.txt b/Documentation/email-clients.txt
index a0b58e29f911..860c29a472ad 100644
--- a/Documentation/email-clients.txt
+++ b/Documentation/email-clients.txt
@@ -199,18 +199,16 @@ to coerce it into behaving.
 To beat some sense out of the internal editor, do this:
- Under account settings, composition and addressing, uncheck "Compose
-  messages in HTML format".
 - Edit your Thunderbird config settings so that it won't use format=flowed.
  Go to "edit->preferences->advanced->config editor" to bring up the
  thunderbird's registry editor, and set "mailnews.send_plaintext_flowed" to
  "false".
- Enable "preformat" mode: Shft-click on the Write icon to bring up the HTML
+- Disable HTML Format: Set "mail.identity.id1.compose_html" to "false".
-  composer, select "Preformat" from the drop-down box just under the subject
-  line, then close the message without saving.  (This setting also applies to
+- Enable "preformat" mode: Set "editor.quotesPreformatted" to "true".
-  the text composer, but the only control for it is in the HTML composer.)
+- Enable UTF8: Set "prefs.converted-to-utf8" to "true".
 - Install the "toggle wordwrap" extension.  Download the file from:
    https://addons.mozilla.org/thunderbird/addon/2351/
diff --git a/Documentation/filesystems/befs.txt b/Documentation/filesystems/befs.txt
index 6e49c363938e..da45e6c842b8 100644
--- a/Documentation/filesystems/befs.txt
+++ b/Documentation/filesystems/befs.txt
@@ -27,7 +27,7 @@ His original code can still be found at:
 Does anyone know of a more current email address for Makoto? He doesn't
 respond to the address given above...
-Current maintainer: Sergey S. Kostyliov <rathamahata@php4.ru>
+This filesystem doesn't have a maintainer.
 WHAT IS THIS DRIVER?
 ==================
diff --git a/Documentation/kernel-docs.txt b/Documentation/kernel-docs.txt
index 9a8674629a07..0e0734b509d8 100644
--- a/Documentation/kernel-docs.txt
+++ b/Documentation/kernel-docs.txt
@@ -620,17 +620,6 @@
       (including this document itself) have been moved there, and might
       be more up to date than the web version.
-     * Name: "Linux Source Driver"
-       URL: http://lsd.linux.cz
-       Keywords: Browsing source code.
-       Description: "Linux Source Driver (LSD) is an application, which
-       can make browsing source codes of Linux kernel easier than you can
-       imagine. You can select between multiple versions of kernel (e.g.
-       0.01, 1.0.0, 2.0.33, 2.0.34pre13, 2.0.0, 2.1.101 etc.). With LSD
-       you can search Linux kernel (fulltext, macros, types, functions
-       and variables) and LSD can generate patches for you on the fly
-       (files, directories or kernel)".
     * Name: "Linux Kernel Source Reference"
       Author: Thomas Graichen.
       URL: http://marc.info/?l=linux-kernel&m=96446640102205&w=4
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e279b7242912..6ca1f5cb71e0 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -40,6 +40,7 @@ parameter is applicable:
        ALSA    ALSA sound support is enabled.
        APIC    APIC support is enabled.
        APM     Advanced Power Management support is enabled.
+        ARM     ARM architecture is enabled.
        AVR32   AVR32 architecture is enabled.
        AX25    Appropriate AX.25 support is enabled.
        BLACKFIN Blackfin architecture is enabled.
@@ -49,6 +50,7 @@ parameter is applicable:
        EFI     EFI Partitioning (GPT) is enabled
        EIDE    EIDE/ATAPI support is enabled.
        FB      The frame buffer device is enabled.
+        FTRACE  Function tracing enabled.
        GCOV    GCOV profiling is enabled.
        HW      Appropriate hardware is enabled.
        IA-64   IA-64 architecture is enabled.
@@ -69,6 +71,7 @@ parameter is applicable:
                        Documentation/m68k/kernel-options.txt.
        MCA     MCA bus support is enabled.
        MDA     MDA console support is enabled.
+        MIPS    MIPS architecture is enabled.
        MOUSE   Appropriate mouse support is enabled.
        MSI     Message Signaled Interrupts (PCI).
        MTD     MTD (Memory Technology Device) support is enabled.
@@ -100,7 +103,6 @@ parameter is applicable:
        SPARC   Sparc architecture is enabled.
        SWSUSP  Software suspend (hibernation) is enabled.
        SUSPEND System suspend states are enabled.
-        FTRACE  Function tracing enabled.
        TPM     TPM drivers are enabled.
        TS      Appropriate touchscreen support is enabled.
        UMS     USB Mass Storage support is enabled.
@@ -115,7 +117,7 @@ parameter is applicable:
        X86-64  X86-64 architecture is enabled.
                        More X86-64 boot options can be found in
                        Documentation/x86/x86_64/boot-options.txt .
-        X86     Either 32bit or 64bit x86 (same as X86-32+X86-64)
+        X86     Either 32-bit or 64-bit x86 (same as X86-32+X86-64)
        XEN     Xen support is enabled
 In addition, the following text indicates that the option:
@@ -376,7 +378,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        atkbd.softrepeat= [HW]
                        Use software keyboard repeat
-        autotest        [IA64]
+        autotest        [IA-64]
        baycom_epp=     [HW,AX25]
                        Format: <io>,<mode>
@@ -681,8 +683,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                uart[8250],mmio32,<addr>[,options]
                        Start an early, polled-mode console on the 8250/16550
                        UART at the specified I/O port or MMIO address.
-                        MMIO inter-register address stride is either 8bit (mmio)
+                        MMIO inter-register address stride is either 8-bit
-                        or 32bit (mmio32).
+                        (mmio) or 32-bit (mmio32).
                        The options are the same as for ttyS, above.
        earlyprintk=    [X86,SH,BLACKFIN]
@@ -725,7 +727,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        See Documentation/block/as-iosched.txt and
                        Documentation/block/deadline-iosched.txt for details.
-        elfcorehdr=     [IA64,PPC,SH,X86]
+        elfcorehdr=     [IA-64,PPC,SH,X86]
                        Specifies physical address of start of kernel core
                        image elf header. Generally kexec loader will
                        pass this option to capture kernel.
@@ -791,7 +793,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        tracer at boot up. function-list is a comma separated
                        list of functions. This list can be changed at run
                        time by the set_ftrace_filter file in the debugfs
-                        tracing directory. 
+                        tracing directory.
        ftrace_notrace=[function-list]
                        [FTRACE] Do not trace the functions specified in
@@ -829,7 +831,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        hashdist=       [KNL,NUMA] Large hashes allocated during boot
                        are distributed across NUMA nodes.  Defaults on
-                        for 64bit NUMA, off otherwise.
+                        for 64-bit NUMA, off otherwise.
                        Format: 0 | 1 (for off | on)
        hcl=            [IA-64] SGI's Hardware Graph compatibility layer
@@ -998,10 +1000,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        DMA.
                forcedac [x86_64]
                        With this option iommu will not optimize to look
-                        for io virtual address below 32 bit forcing dual
+                        for io virtual address below 32-bit forcing dual
                        address cycle on pci bus for cards supporting greater
-                        than 32 bit addressing. The default is to look
+                        than 32-bit addressing. The default is to look
-                        for translation below 32 bit and if not available
+                        for translation below 32-bit and if not available
                        then look in the higher range.
                strict [Default Off]
                        With this option on every unmap_single operation will
@@ -1017,7 +1019,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        off     disable Interrupt Remapping
                        nosid   disable Source ID checking
-        inttest=        [IA64]
+        inttest=        [IA-64]
        iomem=          Disable strict checking of access to MMIO memory
                strict  regions from userspace.
@@ -1034,7 +1036,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                nomerge
                forcesac
                soft
-                pt      [x86, IA64]
+                pt      [x86, IA-64]
        io7=            [HW] IO7 for Marvel based alpha systems
                        See comment before marvel_specify_io7 in
@@ -1165,7 +1167,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        kvm-amd.npt=    [KVM,AMD] Disable nested paging (virtualized MMU)
                        for all guests.
-                        Default is 1 (enabled) if in 64bit or 32bit-PAE mode
+                        Default is 1 (enabled) if in 64-bit or 32-bit PAE mode.
        kvm-intel.ept=  [KVM,Intel] Disable extended page tables
                        (virtualized MMU) support on capable Intel chips.
@@ -1202,10 +1204,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        libata.dma=0      Disable all PATA and SATA DMA
                        libata.dma=1      PATA and SATA Disk DMA only
                        libata.dma=2      ATAPI (CDROM) DMA only
-                        libata.dma=4      Compact Flash DMA only 
+                        libata.dma=4      Compact Flash DMA only
                        Combinations also work, so libata.dma=3 enables DMA
                        for disks and CDROMs, but not CFs.
-        
        libata.ignore_hpa=      [LIBATA] Ignore HPA limit
                        libata.ignore_hpa=0       keep BIOS limits (default)
                        libata.ignore_hpa=1       ignore limits, using full disk
@@ -1331,7 +1333,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        ltpc=           [NET]
                        Format: <io>,<irq>,<dma>
-        machvec=        [IA64] Force the use of a particular machine-vector
+        machvec=        [IA-64] Force the use of a particular machine-vector
                        (machvec) in a generic kernel.
                        Example: machvec=hpzx1_swiotlb
@@ -1734,7 +1736,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        nointroute      [IA-64]
-        nojitter        [IA64] Disables jitter checking for ITC timers.
+        nojitter        [IA-64] Disables jitter checking for ITC timers.
        no-kvmclock     [X86,KVM] Disable paravirtualized KVM clock driver
@@ -1800,7 +1802,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        nox2apic        [X86-64,APIC] Do not enable x2APIC mode.
-        nptcg=          [IA64] Override max number of concurrent global TLB
+        nptcg=          [IA-64] Override max number of concurrent global TLB
                        purges which is reported from either PAL_VM_SUMMARY or
                        SAL PALO.
@@ -2077,7 +2079,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        Format: { parport<nr> | timid | 0 }
                        See also Documentation/parport.txt.
-        pmtmr=          [X86] Manual setup of pmtmr I/O Port. 
+        pmtmr=          [X86] Manual setup of pmtmr I/O Port.
                        Override pmtimer IOPort with a hex value.
                        e.g. pmtmr=0x508
@@ -2635,6 +2637,16 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                                        medium is write-protected).
                        Example: quirks=0419:aaf5:rl,0421:0433:rc
+        user_debug=     [KNL,ARM]
+                        Format: <int>
+                        See arch/arm/Kconfig.debug help text.
+                                 1 - undefined instruction events
+                                 2 - system calls
+                                 4 - invalid data aborts
+                                 8 - SIGSEGV faults
+                                16 - SIGBUS faults
+                        Example: user_debug=31
        userpte=
                        [X86] Flags controlling user PTE allocations.
@@ -2680,6 +2692,27 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        vmpoff=         [KNL,S390] Perform z/VM CP command after power off.
                        Format: <command>
+        vsyscall=       [X86-64]
+                        Controls the behavior of vsyscalls (i.e. calls to
+                        fixed addresses of 0xffffffffff600x00 from legacy
+                        code).  Most statically-linked binaries and older
+                        versions of glibc use these calls.  Because these
+                        functions are at fixed addresses, they make nice
+                        targets for exploits that can control RIP.
+                        emulate     [default] Vsyscalls turn into traps and are
+                                    emulated reasonably safely.
+                        native      Vsyscalls are native syscall instructions.
+                                    This is a little bit faster than trapping
+                                    and makes a few dynamic recompilers work
+                                    better than they would in emulation mode.
+                                    It also makes exploits much easier to write.
+                        none        Vsyscalls don't work at all.  This makes
+                                    them quite hard to use for exploits but
+                                    might break your system.
        vt.cur_default= [VT] Default cursor shape.
                        Format: 0xCCBBAA, where AA, BB, and CC are the same as
                        the parameters of the <Esc>[?A;B;Cc escape sequence;
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 5dd960d75174..91df678fb7f8 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -238,6 +238,18 @@ ad_select
        This option was added in bonding version 3.4.0.
+all_slaves_active
+        Specifies that duplicate frames (received on inactive ports) should be
+        dropped (0) or delivered (1).
+        Normally, bonding will drop duplicate frames (received on inactive
+        ports), which is desirable for most users. But there are some times
+        it is nice to allow duplicate frames to be delivered.
+        The default value is 0 (drop duplicate frames received on inactive
+        ports).
 arp_interval
        Specifies the ARP link monitoring frequency in milliseconds.
@@ -433,6 +445,23 @@ miimon
        determined.  See the High Availability section for additional
        information.  The default value is 0.
+min_links
+        Specifies the minimum number of links that must be active before
+        asserting carrier. It is similar to the Cisco EtherChannel min-links
+        feature. This allows setting the minimum number of member ports that
+        must be up (link-up state) before marking the bond device as up
+        (carrier on). This is useful for situations where higher level services
+        such as clustering want to ensure a minimum number of low bandwidth
+        links are active before switchover. This option only affect 802.3ad
+        mode.
+        The default value is 0. This will cause carrier to be asserted (for
+        802.3ad mode) whenever there is an active aggregator, regardless of the
+        number of available links in that aggregator. Note that, because an
+        aggregator cannot be active without at least one available link,
+        setting this option to 0 or to 1 has the exact same effect.
 mode
        Specifies one of the bonding policies. The default is
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
new file mode 100644
index 000000000000..7254b4b5910e
--- /dev/null
+++ b/Documentation/networking/scaling.txt
@@ -0,0 +1,371 @@
+Scaling in the Linux Networking Stack
+Introduction
+============
+This document describes a set of complementary techniques in the Linux
+networking stack to increase parallelism and improve performance for
+multi-processor systems.
+The following technologies are described:
+  RSS: Receive Side Scaling
+  RPS: Receive Packet Steering
+  RFS: Receive Flow Steering
+  Accelerated Receive Flow Steering
+  XPS: Transmit Packet Steering
+RSS: Receive Side Scaling
+=========================
+Contemporary NICs support multiple receive and transmit descriptor queues
+(multi-queue). On reception, a NIC can send different packets to different
+queues to distribute processing among CPUs. The NIC distributes packets by
+applying a filter to each packet that assigns it to one of a small number
+of logical flows. Packets for each flow are steered to a separate receive
+queue, which in turn can be processed by separate CPUs. This mechanism is
+generally known as “Receive-side Scaling” (RSS). The goal of RSS and
+the other scaling techniques to increase performance uniformly.
+Multi-queue distribution can also be used for traffic prioritization, but
+that is not the focus of these techniques.
+The filter used in RSS is typically a hash function over the network
+and/or transport layer headers-- for example, a 4-tuple hash over
+IP addresses and TCP ports of a packet. The most common hardware
+implementation of RSS uses a 128-entry indirection table where each entry
+stores a queue number. The receive queue for a packet is determined
+by masking out the low order seven bits of the computed hash for the
+packet (usually a Toeplitz hash), taking this number as a key into the
+indirection table and reading the corresponding value.
+Some advanced NICs allow steering packets to queues based on
+programmable filters. For example, webserver bound TCP port 80 packets
+can be directed to their own receive queue. Such “n-tuple” filters can
+be configured from ethtool (--config-ntuple).
+==== RSS Configuration
+The driver for a multi-queue capable NIC typically provides a kernel
+module parameter for specifying the number of hardware queues to
+configure. In the bnx2x driver, for instance, this parameter is called
+num_queues. A typical RSS configuration would be to have one receive queue
+for each CPU if the device supports enough queues, or otherwise at least
+one for each cache domain at a particular cache level (L1, L2, etc.).
+The indirection table of an RSS device, which resolves a queue by masked
+hash, is usually programmed by the driver at initialization. The
+default mapping is to distribute the queues evenly in the table, but the
+indirection table can be retrieved and modified at runtime using ethtool
+commands (--show-rxfh-indir and --set-rxfh-indir). Modifying the
+indirection table could be done to give different queues different
+relative weights.
+== RSS IRQ Configuration
+Each receive queue has a separate IRQ associated with it. The NIC triggers
+this to notify a CPU when new packets arrive on the given queue. The
+signaling path for PCIe devices uses message signaled interrupts (MSI-X),
+that can route each interrupt to a particular CPU. The active mapping
+of queues to IRQs can be determined from /proc/interrupts. By default,
+an IRQ may be handled on any CPU. Because a non-negligible part of packet
+processing takes place in receive interrupt handling, it is advantageous
+to spread receive interrupts between CPUs. To manually adjust the IRQ
+affinity of each interrupt see Documentation/IRQ-affinity. Some systems
+will be running irqbalance, a daemon that dynamically optimizes IRQ
+assignments and as a result may override any manual settings.
+== Suggested Configuration
+RSS should be enabled when latency is a concern or whenever receive
+interrupt processing forms a bottleneck. Spreading load between CPUs
+decreases queue length. For low latency networking, the optimal setting
+is to allocate as many queues as there are CPUs in the system (or the
+NIC maximum, if lower). Because the aggregate number of interrupts grows
+with each additional queue, the most efficient high-rate configuration
+is likely the one with the smallest number of receive queues where no
+CPU that processes receive interrupts reaches 100% utilization. Per-cpu
+load can be observed using the mpstat utility.
+RPS: Receive Packet Steering
+============================
+Receive Packet Steering (RPS) is logically a software implementation of
+RSS. Being in software, it is necessarily called later in the datapath.
+Whereas RSS selects the queue and hence CPU that will run the hardware
+interrupt handler, RPS selects the CPU to perform protocol processing
+above the interrupt handler. This is accomplished by placing the packet
+on the desired CPU’s backlog queue and waking up the CPU for processing.
+RPS has some advantages over RSS: 1) it can be used with any NIC,
+2) software filters can easily be added to hash over new protocols,
+3) it does not increase hardware device interrupt rate (although it does
+introduce inter-processor interrupts (IPIs)).
+RPS is called during bottom half of the receive interrupt handler, when
+a driver sends a packet up the network stack with netif_rx() or
+netif_receive_skb(). These call the get_rps_cpu() function, which
+selects the queue that should process a packet.
+The first step in determining the target CPU for RPS is to calculate a
+flow hash over the packet’s addresses or ports (2-tuple or 4-tuple hash
+depending on the protocol). This serves as a consistent hash of the
+associated flow of the packet. The hash is either provided by hardware
+or will be computed in the stack. Capable hardware can pass the hash in
+the receive descriptor for the packet; this would usually be the same
+hash used for RSS (e.g. computed Toeplitz hash). The hash is saved in
+skb->rx_hash and can be used elsewhere in the stack as a hash of the
+packet’s flow.
+Each receive hardware queue has an associated list of CPUs to which
+RPS may enqueue packets for processing. For each received packet,
+an index into the list is computed from the flow hash modulo the size
+of the list. The indexed CPU is the target for processing the packet,
+and the packet is queued to the tail of that CPU’s backlog queue. At
+the end of the bottom half routine, IPIs are sent to any CPUs for which
+packets have been queued to their backlog queue. The IPI wakes backlog
+processing on the remote CPU, and any queued packets are then processed
+up the networking stack.
+==== RPS Configuration
+RPS requires a kernel compiled with the CONFIG_RPS kconfig symbol (on
+by default for SMP). Even when compiled in, RPS remains disabled until
+explicitly configured. The list of CPUs to which RPS may forward traffic
+can be configured for each receive queue using a sysfs file entry:
+ /sys/class/net/<dev>/queues/rx-<n>/rps_cpus
+This file implements a bitmap of CPUs. RPS is disabled when it is zero
+(the default), in which case packets are processed on the interrupting
+CPU. Documentation/IRQ-affinity.txt explains how CPUs are assigned to
+the bitmap.
+== Suggested Configuration
+For a single queue device, a typical RPS configuration would be to set
+the rps_cpus to the CPUs in the same cache domain of the interrupting
+CPU. If NUMA locality is not an issue, this could also be all CPUs in
+the system. At high interrupt rate, it might be wise to exclude the
+interrupting CPU from the map since that already performs much work.
+For a multi-queue system, if RSS is configured so that a hardware
+receive queue is mapped to each CPU, then RPS is probably redundant
+and unnecessary. If there are fewer hardware queues than CPUs, then
+RPS might be beneficial if the rps_cpus for each queue are the ones that
+share the same cache domain as the interrupting CPU for that queue.
+RFS: Receive Flow Steering
+==========================
+While RPS steers packets solely based on hash, and thus generally
+provides good load distribution, it does not take into account
+application locality. This is accomplished by Receive Flow Steering
+(RFS). The goal of RFS is to increase datacache hitrate by steering
+kernel processing of packets to the CPU where the application thread
+consuming the packet is running. RFS relies on the same RPS mechanisms
+to enqueue packets onto the backlog of another CPU and to wake up that
+CPU.
+In RFS, packets are not forwarded directly by the value of their hash,
+but the hash is used as index into a flow lookup table. This table maps
+flows to the CPUs where those flows are being processed. The flow hash
+(see RPS section above) is used to calculate the index into this table.
+The CPU recorded in each entry is the one which last processed the flow.
+If an entry does not hold a valid CPU, then packets mapped to that entry
+are steered using plain RPS. Multiple table entries may point to the
+same CPU. Indeed, with many flows and few CPUs, it is very likely that
+a single application thread handles flows with many different flow hashes.
+rps_sock_table is a global flow table that contains the *desired* CPU for
+flows: the CPU that is currently processing the flow in userspace. Each
+table value is a CPU index that is updated during calls to recvmsg and
+sendmsg (specifically, inet_recvmsg(), inet_sendmsg(), inet_sendpage()
+and tcp_splice_read()).
+When the scheduler moves a thread to a new CPU while it has outstanding
+receive packets on the old CPU, packets may arrive out of order. To
+avoid this, RFS uses a second flow table to track outstanding packets
+for each flow: rps_dev_flow_table is a table specific to each hardware
+receive queue of each device. Each table value stores a CPU index and a
+counter. The CPU index represents the *current* CPU onto which packets
+for this flow are enqueued for further kernel processing. Ideally, kernel
+and userspace processing occur on the same CPU, and hence the CPU index
+in both tables is identical. This is likely false if the scheduler has
+recently migrated a userspace thread while the kernel still has packets
+enqueued for kernel processing on the old CPU.
+The counter in rps_dev_flow_table values records the length of the current
+CPU's backlog when a packet in this flow was last enqueued. Each backlog
+queue has a head counter that is incremented on dequeue. A tail counter
+is computed as head counter + queue length. In other words, the counter
+in rps_dev_flow_table[i] records the last element in flow i that has
+been enqueued onto the currently designated CPU for flow i (of course,
+entry i is actually selected by hash and multiple flows may hash to the
+same entry i).
+And now the trick for avoiding out of order packets: when selecting the
+CPU for packet processing (from get_rps_cpu()) the rps_sock_flow table
+and the rps_dev_flow table of the queue that the packet was received on
+are compared. If the desired CPU for the flow (found in the
+rps_sock_flow table) matches the current CPU (found in the rps_dev_flow
+table), the packet is enqueued onto that CPU’s backlog. If they differ,
+the current CPU is updated to match the desired CPU if one of the
+following is true:
+- The current CPU's queue head counter >= the recorded tail counter
+  value in rps_dev_flow[i]
+- The current CPU is unset (equal to NR_CPUS)
+- The current CPU is offline
+After this check, the packet is sent to the (possibly updated) current
+CPU. These rules aim to ensure that a flow only moves to a new CPU when
+there are no packets outstanding on the old CPU, as the outstanding
+packets could arrive later than those about to be processed on the new
+CPU.
+==== RFS Configuration
+RFS is only available if the kconfig symbol CONFIG_RFS is enabled (on
+by default for SMP). The functionality remains disabled until explicitly
+configured. The number of entries in the global flow table is set through:
+ /proc/sys/net/core/rps_sock_flow_entries
+The number of entries in the per-queue flow table are set through:
+ /sys/class/net/<dev>/queues/tx-<n>/rps_flow_cnt
+== Suggested Configuration
+Both of these need to be set before RFS is enabled for a receive queue.
+Values for both are rounded up to the nearest power of two. The
+suggested flow count depends on the expected number of active connections
+at any given time, which may be significantly less than the number of open
+connections. We have found that a value of 32768 for rps_sock_flow_entries
+works fairly well on a moderately loaded server.
+For a single queue device, the rps_flow_cnt value for the single queue
+would normally be configured to the same value as rps_sock_flow_entries.
+For a multi-queue device, the rps_flow_cnt for each queue might be
+configured as rps_sock_flow_entries / N, where N is the number of
+queues. So for instance, if rps_flow_entries is set to 32768 and there
+are 16 configured receive queues, rps_flow_cnt for each queue might be
+configured as 2048.
+Accelerated RFS
+===============
+Accelerated RFS is to RFS what RSS is to RPS: a hardware-accelerated load
+balancing mechanism that uses soft state to steer flows based on where
+the application thread consuming the packets of each flow is running.
+Accelerated RFS should perform better than RFS since packets are sent
+directly to a CPU local to the thread consuming the data. The target CPU
+will either be the same CPU where the application runs, or at least a CPU
+which is local to the application thread’s CPU in the cache hierarchy.
+To enable accelerated RFS, the networking stack calls the
+ndo_rx_flow_steer driver function to communicate the desired hardware
+queue for packets matching a particular flow. The network stack
+automatically calls this function every time a flow entry in
+rps_dev_flow_table is updated. The driver in turn uses a device specific
+method to program the NIC to steer the packets.
+The hardware queue for a flow is derived from the CPU recorded in
+rps_dev_flow_table. The stack consults a CPU to hardware queue map which
+is maintained by the NIC driver. This is an auto-generated reverse map of
+the IRQ affinity table shown by /proc/interrupts. Drivers can use
+functions in the cpu_rmap (“CPU affinity reverse map”) kernel library
+to populate the map. For each CPU, the corresponding queue in the map is
+set to be one whose processing CPU is closest in cache locality.
+==== Accelerated RFS Configuration
+Accelerated RFS is only available if the kernel is compiled with
+CONFIG_RFS_ACCEL and support is provided by the NIC device and driver.
+It also requires that ntuple filtering is enabled via ethtool. The map
+of CPU to queues is automatically deduced from the IRQ affinities
+configured for each receive queue by the driver, so no additional
+configuration should be necessary.
+== Suggested Configuration
+This technique should be enabled whenever one wants to use RFS and the
+NIC supports hardware acceleration.
+XPS: Transmit Packet Steering
+=============================
+Transmit Packet Steering is a mechanism for intelligently selecting
+which transmit queue to use when transmitting a packet on a multi-queue
+device. To accomplish this, a mapping from CPU to hardware queue(s) is
+recorded. The goal of this mapping is usually to assign queues
+exclusively to a subset of CPUs, where the transmit completions for
+these queues are processed on a CPU within this set. This choice
+provides two benefits. First, contention on the device queue lock is
+significantly reduced since fewer CPUs contend for the same queue
+(contention can be eliminated completely if each CPU has its own
+transmit queue). Secondly, cache miss rate on transmit completion is
+reduced, in particular for data cache lines that hold the sk_buff
+structures.
+XPS is configured per transmit queue by setting a bitmap of CPUs that
+may use that queue to transmit. The reverse mapping, from CPUs to
+transmit queues, is computed and maintained for each network device.
+When transmitting the first packet in a flow, the function
+get_xps_queue() is called to select a queue. This function uses the ID
+of the running CPU as a key into the CPU-to-queue lookup table. If the
+ID matches a single queue, that is used for transmission. If multiple
+queues match, one is selected by using the flow hash to compute an index
+into the set.
+The queue chosen for transmitting a particular flow is saved in the
+corresponding socket structure for the flow (e.g. a TCP connection).
+This transmit queue is used for subsequent packets sent on the flow to
+prevent out of order (ooo) packets. The choice also amortizes the cost
+of calling get_xps_queues() over all packets in the connection. To avoid
+ooo packets, the queue for a flow can subsequently only be changed if
+skb->ooo_okay is set for a packet in the flow. This flag indicates that
+there are no outstanding packets in the flow, so the transmit queue can
+change without the risk of generating out of order packets. The
+transport layer is responsible for setting ooo_okay appropriately. TCP,
+for instance, sets the flag when all data for a connection has been
+acknowledged.
+==== XPS Configuration
+XPS is only available if the kconfig symbol CONFIG_XPS is enabled (on by
+default for SMP). The functionality remains disabled until explicitly
+configured. To enable XPS, the bitmap of CPUs that may use a transmit
+queue is configured using the sysfs file entry:
+/sys/class/net/<dev>/queues/tx-<n>/xps_cpus
+== Suggested Configuration
+For a network device with a single transmission queue, XPS configuration
+has no effect, since there is no choice in this case. In a multi-queue
+system, XPS is preferably configured so that each CPU maps onto one queue.
+If there are as many queues as there are CPUs in the system, then each
+queue can also map onto one CPU, resulting in exclusive pairings that
+experience no contention. If there are fewer queues than CPUs, then the
+best CPUs to share a given queue are probably those that share the cache
+with the CPU that processes transmit completions for that queue
+(transmit interrupts).
+Further Information
+===================
+RPS and RFS were introduced in kernel 2.6.35. XPS was incorporated into
+2.6.38. Original patches were submitted by Tom Herbert
+(therbert@google.com)
+Accelerated RFS was introduced in 2.6.35. Original patches were
+submitted by Ben Hutchings (bhutchings@solarflare.com)
+Authors:
+Tom Herbert (therbert@google.com)
+Willem de Bruijn (willemb@google.com)
diff --git a/Documentation/ramoops.txt b/Documentation/ramoops.txt
new file mode 100644
index 000000000000..8fb1ba7fe7bf
--- /dev/null
+++ b/Documentation/ramoops.txt
@@ -0,0 +1,76 @@
+Ramoops oops/panic logger
+=========================
+Sergiu Iordache <sergiu@chromium.org>
+Updated: 8 August 2011
+0. Introduction
+Ramoops is an oops/panic logger that writes its logs to RAM before the system
+crashes. It works by logging oopses and panics in a circular buffer. Ramoops
+needs a system with persistent RAM so that the content of that area can
+survive after a restart.
+1. Ramoops concepts
+Ramoops uses a predefined memory area to store the dump. The start and size of
+the memory area are set using two variables:
+  * "mem_address" for the start
+  * "mem_size" for the size. The memory size will be rounded down to a
+  power of two.
+The memory area is divided into "record_size" chunks (also rounded down to
+power of two) and each oops/panic writes a "record_size" chunk of
+information.
+Dumping both oopses and panics can be done by setting 1 in the "dump_oops"
+variable while setting 0 in that variable dumps only the panics.
+The module uses a counter to record multiple dumps but the counter gets reset
+on restart (i.e. new dumps after the restart will overwrite old ones).
+2. Setting the parameters
+Setting the ramoops parameters can be done in 2 different manners:
+ 1. Use the module parameters (which have the names of the variables described
+ as before).
+ 2. Use a platform device and set the platform data. The parameters can then
+ be set through that platform data. An example of doing that is:
+#include <linux/ramoops.h>
+[...]
+static struct ramoops_platform_data ramoops_data = {
+        .mem_size               = <...>,
+        .mem_address            = <...>,
+        .record_size            = <...>,
+        .dump_oops              = <...>,
+};
+static struct platform_device ramoops_dev = {
+        .name = "ramoops",
+        .dev = {
+                .platform_data = &ramoops_data,
+        },
+};
+[... inside a function ...]
+int ret;
+ret = platform_device_register(&ramoops_dev);
+if (ret) {
+        printk(KERN_ERR "unable to register platform device\n");
+        return ret;
+}
+3. Dump format
+The data dump begins with a header, currently defined as "====" followed by a
+timestamp and a new line. The dump then continues with the actual data.
+4. Reading the data
+The dump data can be read from memory (through /dev/mem or other means).
+Getting the module parameters, which are needed in order to parse the data, can
+be done through /sys/module/ramoops/parameters/* .
diff --git a/Documentation/virtual/00-INDEX b/Documentation/virtual/00-INDEX
index fe0251c4cfb7..8e601991d91c 100644
--- a/Documentation/virtual/00-INDEX
+++ b/Documentation/virtual/00-INDEX
@@ -8,3 +8,6 @@ lguest/
        - Extremely simple hypervisor for experimental/educational use.
 uml/
        - User Mode Linux, builds/runs Linux kernel as a userspace program.
+virtio.txt
+        - Text version of draft virtio spec.
+          See http://ozlabs.org/~rusty/virtio-spec
diff --git a/Documentation/virtual/lguest/lguest.c b/Documentation/virtual/lguest/lguest.c
index 043bd7df3139..d928c134dee6 100644
--- a/Documentation/virtual/lguest/lguest.c
+++ b/Documentation/virtual/lguest/lguest.c
@@ -1996,6 +1996,9 @@ int main(int argc, char *argv[])
        /* We use a simple helper to copy the arguments separated by spaces. */
        concat((char *)(boot + 1), argv+optind+2);
+        /* Set kernel alignment to 16M (CONFIG_PHYSICAL_ALIGN) */
+        boot->hdr.kernel_alignment = 0x1000000;
        /* Boot protocol version: 2.07 supports the fields for lguest. */
        boot->hdr.version = 0x207;
diff --git a/Documentation/virtual/virtio-spec.txt b/Documentation/virtual/virtio-spec.txt
new file mode 100644
index 000000000000..a350ae135b8c
--- /dev/null
+++ b/Documentation/virtual/virtio-spec.txt
@@ -0,0 +1,2200 @@
+[Generated file: see http://ozlabs.org/~rusty/virtio-spec/]
+Virtio PCI Card Specification
+v0.9.1 DRAFT
+-
+Rusty Russell <rusty@rustcorp.com.au>IBM Corporation (Editor)
+2011 August 1.
+Purpose and Description
+This document describes the specifications of the “virtio” family
+of PCI[LaTeX Command: nomenclature] devices. These are devices
+are found in virtual environments[LaTeX Command: nomenclature],
+yet by design they are not all that different from physical PCI
+devices, and this document treats them as such. This allows the
+guest to use standard PCI drivers and discovery mechanisms.
+The purpose of virtio and this specification is that virtual
+environments and guests should have a straightforward, efficient,
+standard and extensible mechanism for virtual devices, rather
+than boutique per-environment or per-OS mechanisms.
+  Straightforward: Virtio PCI devices use normal PCI mechanisms
+  of interrupts and DMA which should be familiar to any device
+  driver author. There is no exotic page-flipping or COW
+  mechanism: it's just a PCI device.[footnote:
+This lack of page-sharing implies that the implementation of the
+device (e.g. the hypervisor or host) needs full access to the
+guest memory. Communication with untrusted parties (i.e.
+inter-guest communication) requires copying.
+]
+  Efficient: Virtio PCI devices consist of rings of descriptors
+  for input and output, which are neatly separated to avoid cache
+  effects from both guest and device writing to the same cache
+  lines.
+  Standard: Virtio PCI makes no assumptions about the environment
+  in which it operates, beyond supporting PCI. In fact the virtio
+  devices specified in the appendices do not require PCI at all:
+  they have been implemented on non-PCI buses.[footnote:
+The Linux implementation further separates the PCI virtio code
+from the specific virtio drivers: these drivers are shared with
+the non-PCI implementations (currently lguest and S/390).
+]
+  Extensible: Virtio PCI devices contain feature bits which are
+  acknowledged by the guest operating system during device setup.
+  This allows forwards and backwards compatibility: the device
+  offers all the features it knows about, and the driver
+  acknowledges those it understands and wishes to use.
+  Virtqueues
+The mechanism for bulk data transport on virtio PCI devices is
+pretentiously called a virtqueue. Each device can have zero or
+more virtqueues: for example, the network device has one for
+transmit and one for receive.
+Each virtqueue occupies two or more physically-contiguous pages
+(defined, for the purposes of this specification, as 4096 bytes),
+and consists of three parts:
+-------------------+-----------------------------------+-----------+
+| Descriptor Table  |   Available Ring     (padding)    | Used Ring |
+-------------------+-----------------------------------+-----------+
+When the driver wants to send buffers to the device, it puts them
+in one or more slots in the descriptor table, and writes the
+descriptor indices into the available ring. It then notifies the
+device. When the device has finished with the buffers, it writes
+the descriptors into the used ring, and sends an interrupt.
+Specification
+  PCI Discovery
+Any PCI device with Vendor ID 0x1AF4, and Device ID 0x1000
+through 0x103F inclusive is a virtio device[footnote:
+The actual value within this range is ignored
+]. The device must also have a Revision ID of 0 to match this
+specification.
+The Subsystem Device ID indicates which virtio device is
+supported by the device. The Subsystem Vendor ID should reflect
+the PCI Vendor ID of the environment (it's currently only used
+for informational purposes by the guest).
+----------------------+--------------------+---------------+
+| Subsystem Device ID  |   Virtio Device    | Specification |
+----------------------+--------------------+---------------+
+----------------------+--------------------+---------------+
+|          1           |   network card     |  Appendix C   |
+----------------------+--------------------+---------------+
+|          2           |   block device     |  Appendix D   |
+----------------------+--------------------+---------------+
+|          3           |      console       |  Appendix E   |
+----------------------+--------------------+---------------+
+|          4           |  entropy source    |  Appendix F   |
+----------------------+--------------------+---------------+
+|          5           | memory ballooning  |  Appendix G   |
+----------------------+--------------------+---------------+
+|          6           |     ioMemory       |       -       |
+----------------------+--------------------+---------------+
+|          9           |   9P transport     |       -       |
+----------------------+--------------------+---------------+
+  Device Configuration
+To configure the device, we use the first I/O region of the PCI
+device. This contains a virtio header followed by a
+device-specific region.
+There may be different widths of accesses to the I/O region; the “
+natural” access method for each field in the virtio header must
+be used (i.e. 32-bit accesses for 32-bit fields, etc), but the
+device-specific region can be accessed using any width accesses,
+and should obtain the same results.
+Note that this is possible because while the virtio header is PCI
+(i.e. little) endian, the device-specific region is encoded in
+the native endian of the guest (where such distinction is
+applicable).
+  Device Initialization Sequence
+We start with an overview of device initialization, then expand
+on the details of the device and how each step is preformed.
+  Reset the device. This is not required on initial start up.
+  The ACKNOWLEDGE status bit is set: we have noticed the device.
+  The DRIVER status bit is set: we know how to drive the device.
+  Device-specific setup, including reading the Device Feature
+  Bits, discovery of virtqueues for the device, optional MSI-X
+  setup, and reading and possibly writing the virtio
+  configuration space.
+  The subset of Device Feature Bits understood by the driver is
+  written to the device.
+  The DRIVER_OK status bit is set.
+  The device can now be used (ie. buffers added to the
+  virtqueues)[footnote:
+Historically, drivers have used the device before steps 5 and 6.
+This is only allowed if the driver does not use any features
+which would alter this early use of the device.
+]
+If any of these steps go irrecoverably wrong, the guest should
+set the FAILED status bit to indicate that it has given up on the
+device (it can reset the device later to restart if desired).
+We now cover the fields required for general setup in detail.
+  Virtio Header
+The virtio header looks as follows:
+------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+| Bits       || 32                  | 32                  | 32       | 16     | 16      | 16      | 8       | 8      |
+------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+| Read/Write || R                   | R+W                 | R+W      | R      | R+W     | R+W     | R+W     | R      |
+------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+| Purpose    || Device              | Guest               | Queue    | Queue  | Queue   | Queue   | Device  | ISR    |
+|            || Features bits 0:31  | Features bits 0:31  | Address  | Size   | Select  | Notify  | Status  | Status |
+------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+If MSI-X is enabled for the device, two additional fields
+immediately follow this header:
+------------++----------------+--------+
+| Bits       || 16             | 16     |
+              +----------------+--------+
+------------++----------------+--------+
+| Read/Write || R+W            | R+W    |
+------------++----------------+--------+
+| Purpose    || Configuration  | Queue  |
+| (MSI-X)    || Vector         | Vector |
+------------++----------------+--------+
+Finally, if feature bits (VIRTIO_F_FEATURES_HI) this is
+immediately followed by two additional fields:
+------------++----------------------+----------------------
+| Bits       || 32                   | 32
+------------++----------------------+----------------------
+| Read/Write || R                    | R+W
+------------++----------------------+----------------------
+| Purpose    || Device               | Guest
+|            || Features bits 32:63  | Features bits 32:63
+------------++----------------------+----------------------
+Immediately following these general headers, there may be
+device-specific headers:
+------------++--------------------+
+| Bits       || Device Specific    |
+              +--------------------+
+------------++--------------------+
+| Read/Write || Device Specific    |
+------------++--------------------+
+| Purpose    || Device Specific... |
+|            ||                    |
+------------++--------------------+
+  Device Status
+The Device Status field is updated by the guest to indicate its
+progress. This provides a simple low-level diagnostic: it's most
+useful to imagine them hooked up to traffic lights on the console
+indicating the status of each device.
+The device can be reset by writing a 0 to this field, otherwise
+at least one bit should be set:
+  ACKNOWLEDGE (1) Indicates that the guest OS has found the
+  device and recognized it as a valid virtio device.
+  DRIVER (2) Indicates that the guest OS knows how to drive the
+  device. Under Linux, drivers can be loadable modules so there
+  may be a significant (or infinite) delay before setting this
+  bit.
+  DRIVER_OK (3) Indicates that the driver is set up and ready to
+  drive the device.
+  FAILED (8) Indicates that something went wrong in the guest,
+  and it has given up on the device. This could be an internal
+  error, or the driver didn't like the device for some reason, or
+  even a fatal error during device operation. The device must be
+  reset before attempting to re-initialize.
+  Feature Bits
+The least significant 31 bits of the first configuration field
+indicates the features that the device supports (the high bit is
+reserved, and will be used to indicate the presence of future
+feature bits elsewhere). If more than 31 feature bits are
+supported, the device indicates so by setting feature bit 31 (see
+[cha:Reserved-Feature-Bits]). The bits are allocated as follows:
+  0 to 23 Feature bits for the specific device type
+  24 to 40 Feature bits reserved for extensions to the queue and
+  feature negotiation mechanisms
+  41 to 63 Feature bits reserved for future extensions
+For example, feature bit 0 for a network device (i.e. Subsystem
+Device ID 1) indicates that the device supports checksumming of
+packets.
+The feature bits are negotiated: the device lists all the
+features it understands in the Device Features field, and the
+guest writes the subset that it understands into the Guest
+Features field. The only way to renegotiate is to reset the
+device.
+In particular, new fields in the device configuration header are
+indicated by offering a feature bit, so the guest can check
+before accessing that part of the configuration space.
+This allows for forwards and backwards compatibility: if the
+device is enhanced with a new feature bit, older guests will not
+write that feature bit back to the Guest Features field and it
+can go into backwards compatibility mode. Similarly, if a guest
+is enhanced with a feature that the device doesn't support, it
+will not see that feature bit in the Device Features field and
+can go into backwards compatibility mode (or, for poor
+implementations, set the FAILED Device Status bit).
+Access to feature bits 32 to 63 is enabled by Guest by setting
+feature bit 31. If this bit is unset, Device must assume that all
+feature bits > 31 are unset.
+  Configuration/Queue Vectors
+When MSI-X capability is present and enabled in the device
+(through standard PCI configuration space) 4 bytes at byte offset
+20 are used to map configuration change and queue interrupts to
+MSI-X vectors. In this case, the ISR Status field is unused, and
+device specific configuration starts at byte offset 24 in virtio
+header structure. When MSI-X capability is not enabled, device
+specific configuration starts at byte offset 20 in virtio header.
+Writing a valid MSI-X Table entry number, 0 to 0x7FF, to one of
+Configuration/Queue Vector registers, maps interrupts triggered
+by the configuration change/selected queue events respectively to
+the corresponding MSI-X vector. To disable interrupts for a
+specific event type, unmap it by writing a special NO_VECTOR
+value:
+/* Vector value used to disable MSI for queue */
+#define VIRTIO_MSI_NO_VECTOR            0xffff
+Reading these registers returns vector mapped to a given event,
+or NO_VECTOR if unmapped. All queue and configuration change
+events are unmapped by default.
+Note that mapping an event to vector might require allocating
+internal device resources, and might fail. Devices report such
+failures by returning the NO_VECTOR value when the relevant
+Vector field is read. After mapping an event to vector, the
+driver must verify success by reading the Vector field value: on
+success, the previously written value is returned, and on
+failure, NO_VECTOR is returned. If a mapping failure is detected,
+the driver can retry mapping with fewervectors, or disable MSI-X.
+  Virtqueue Configuration
+As a device can have zero or more virtqueues for bulk data
+transport (for example, the network driver has two), the driver
+needs to configure them as part of the device-specific
+configuration.
+This is done as follows, for each virtqueue a device has:
+  Write the virtqueue index (first queue is 0) to the Queue
+  Select field.
+  Read the virtqueue size from the Queue Size field, which is
+  always a power of 2. This controls how big the virtqueue is
+  (see below). If this field is 0, the virtqueue does not exist.
+  Allocate and zero virtqueue in contiguous physical memory, on a
+  4096 byte alignment. Write the physical address, divided by
+  4096 to the Queue Address field.[footnote:
+The 4096 is based on the x86 page size, but it's also large
+enough to ensure that the separate parts of the virtqueue are on
+separate cache lines.
+]
+  Optionally, if MSI-X capability is present and enabled on the
+  device, select a vector to use to request interrupts triggered
+  by virtqueue events. Write the MSI-X Table entry number
+  corresponding to this vector in Queue Vector field. Read the
+  Queue Vector field: on success, previously written value is
+  returned; on failure, NO_VECTOR value is returned.
+The Queue Size field controls the total number of bytes required
+for the virtqueue according to the following formula:
+#define ALIGN(x) (((x) + 4095) & ~4095)
+static inline unsigned vring_size(unsigned int qsz)
+{
+     return ALIGN(sizeof(struct vring_desc)*qsz + sizeof(u16)*(2
+ qsz))
+          + ALIGN(sizeof(struct vring_used_elem)*qsz);
+}
+This currently wastes some space with padding, but also allows
+future extensions. The virtqueue layout structure looks like this
+(qsz is the Queue Size field, which is a variable, so this code
+won't compile):
+struct vring {
+    /* The actual descriptors (16 bytes each) */
+    struct vring_desc desc[qsz];
+    /* A ring of available descriptor heads with free-running
+index. */
+    struct vring_avail avail;
+    // Padding to the next 4096 boundary.
+    char pad[];
+    // A ring of used descriptor heads with free-running index.
+    struct vring_used used;
+};
+  A Note on Virtqueue Endianness
+Note that the endian of these fields and everything else in the
+virtqueue is the native endian of the guest, not little-endian as
+PCI normally is. This makes for simpler guest code, and it is
+assumed that the host already has to be deeply aware of the guest
+endian so such an “endian-aware” device is not a significant
+issue.
+  Descriptor Table
+The descriptor table refers to the buffers the guest is using for
+the device. The addresses are physical addresses, and the buffers
+can be chained via the next field. Each descriptor describes a
+buffer which is read-only or write-only, but a chain of
+descriptors can contain both read-only and write-only buffers.
+No descriptor chain may be more than 2^32 bytes long in total.struct vring_desc {
+    /* Address (guest-physical). */
+    u64 addr;
+    /* Length. */
+    u32 len;
+/* This marks a buffer as continuing via the next field. */
+#define VRING_DESC_F_NEXT   1
+/* This marks a buffer as write-only (otherwise read-only). */
+#define VRING_DESC_F_WRITE     2
+/* This means the buffer contains a list of buffer descriptors.
+*/
+#define VRING_DESC_F_INDIRECT   4
+    /* The flags as indicated above. */
+    u16 flags;
+    /* Next field if flags & NEXT */
+    u16 next;
+};
+The number of descriptors in the table is specified by the Queue
+Size field for this virtqueue.
+  <sub:Indirect-Descriptors>Indirect Descriptors
+Some devices benefit by concurrently dispatching a large number
+of large requests. The VIRTIO_RING_F_INDIRECT_DESC feature can be
+used to allow this (see [cha:Reserved-Feature-Bits]). To increase
+ring capacity it is possible to store a table of indirect
+descriptors anywhere in memory, and insert a descriptor in main
+virtqueue (with flags&INDIRECT on) that refers to memory buffer
+containing this indirect descriptor table; fields addr and len
+refer to the indirect table address and length in bytes,
+respectively. The indirect table layout structure looks like this
+(len is the length of the descriptor that refers to this table,
+which is a variable, so this code won't compile):
+struct indirect_descriptor_table {
+    /* The actual descriptors (16 bytes each) */
+    struct vring_desc desc[len / 16];
+};
+The first indirect descriptor is located at start of the indirect
+descriptor table (index 0), additional indirect descriptors are
+chained by next field. An indirect descriptor without next field
+(with flags&NEXT off) signals the end of the indirect descriptor
+table, and transfers control back to the main virtqueue. An
+indirect descriptor can not refer to another indirect descriptor
+table (flags&INDIRECT must be off). A single indirect descriptor
+table can include both read-only and write-only descriptors;
+write-only flag (flags&WRITE) in the descriptor that refers to it
+is ignored.
+  Available Ring
+The available ring refers to what descriptors we are offering the
+device: it refers to the head of a descriptor chain. The “flags”
+field is currently 0 or 1: 1 indicating that we do not need an
+interrupt when the device consumes a descriptor from the
+available ring. Alternatively, the guest can ask the device to
+delay interrupts until an entry with an index specified by the “
+used_event” field is written in the used ring (equivalently,
+until the idx field in the used ring will reach the value
+used_event + 1). The method employed by the device is controlled
+by the VIRTIO_RING_F_EVENT_IDX feature bit (see [cha:Reserved-Feature-Bits]
+). This interrupt suppression is merely an optimization; it may
+not suppress interrupts entirely.
+The “idx” field indicates where we would put the next descriptor
+entry (modulo the ring size). This starts at 0, and increases.
+struct vring_avail {
+#define VRING_AVAIL_F_NO_INTERRUPT      1
+   u16 flags;
+   u16 idx;
+   u16 ring[qsz]; /* qsz is the Queue Size field read from device
+*/
+   u16 used_event;
+};
+  Used Ring
+The used ring is where the device returns buffers once it is done
+with them. The flags field can be used by the device to hint that
+no notification is necessary when the guest adds to the available
+ring. Alternatively, the “avail_event” field can be used by the
+device to hint that no notification is necessary until an entry
+with an index specified by the “avail_event” is written in the
+available ring (equivalently, until the idx field in the
+available ring will reach the value avail_event + 1). The method
+employed by the device is controlled by the guest through the
+VIRTIO_RING_F_EVENT_IDX feature bit (see [cha:Reserved-Feature-Bits]
+). [footnote:
+These fields are kept here because this is the only part of the
+virtqueue written by the device
+].
+Each entry in the ring is a pair: the head entry of the
+descriptor chain describing the buffer (this matches an entry
+placed in the available ring by the guest earlier), and the total
+of bytes written into the buffer. The latter is extremely useful
+for guests using untrusted buffers: if you do not know exactly
+how much has been written by the device, you usually have to zero
+the buffer to ensure no data leakage occurs.
+/* u32 is used here for ids for padding reasons. */
+struct vring_used_elem {
+    /* Index of start of used descriptor chain. */
+    u32 id;
+    /* Total length of the descriptor chain which was used
+(written to) */
+    u32 len;
+};
+struct vring_used {
+#define VRING_USED_F_NO_NOTIFY  1
+    u16 flags;
+    u16 idx;
+    struct vring_used_elem ring[qsz];
+    u16 avail_event;
+};
+  Helpers for Managing Virtqueues
+The Linux Kernel Source code contains the definitions above and
+helper routines in a more usable form, in
+include/linux/virtio_ring.h. This was explicitly licensed by IBM
+and Red Hat under the (3-clause) BSD license so that it can be
+freely used by all other projects, and is reproduced (with slight
+variation to remove Linux assumptions) in Appendix A.
+  Device Operation
+There are two parts to device operation: supplying new buffers to
+the device, and processing used buffers from the device. As an
+example, the virtio network device has two virtqueues: the
+transmit virtqueue and the receive virtqueue. The driver adds
+outgoing (read-only) packets to the transmit virtqueue, and then
+frees them after they are used. Similarly, incoming (write-only)
+buffers are added to the receive virtqueue, and processed after
+they are used.
+  Supplying Buffers to The Device
+Actual transfer of buffers from the guest OS to the device
+operates as follows:
+  Place the buffer(s) into free descriptor(s).
+  If there are no free descriptors, the guest may choose to
+    notify the device even if notifications are suppressed (to
+    reduce latency).[footnote:
+The Linux drivers do this only for read-only buffers: for
+write-only buffers, it is assumed that the driver is merely
+trying to keep the receive buffer ring full, and no notification
+of this expected condition is necessary.
+]
+  Place the id of the buffer in the next ring entry of the
+  available ring.
+  The steps (1) and (2) may be performed repeatedly if batching
+  is possible.
+  A memory barrier should be executed to ensure the device sees
+  the updated descriptor table and available ring before the next
+  step.
+  The available “idx” field should be increased by the number of
+  entries added to the available ring.
+  A memory barrier should be executed to ensure that we update
+  the idx field before checking for notification suppression.
+  If notifications are not suppressed, the device should be
+  notified of the new buffers.
+Note that the above code does not take precautions against the
+available ring buffer wrapping around: this is not possible since
+the ring buffer is the same size as the descriptor table, so step
+(1) will prevent such a condition.
+In addition, the maximum queue size is 32768 (it must be a power
+of 2 which fits in 16 bits), so the 16-bit “idx” value can always
+distinguish between a full and empty buffer.
+Here is a description of each stage in more detail.
+  Placing Buffers Into The Descriptor Table
+A buffer consists of zero or more read-only physically-contiguous
+elements followed by zero or more physically-contiguous
+write-only elements (it must have at least one element). This
+algorithm maps it into the descriptor table:
+  for each buffer element, b:
+  Get the next free descriptor table entry, d
+  Set d.addr to the physical address of the start of b
+  Set d.len to the length of b.
+  If b is write-only, set d.flags to VRING_DESC_F_WRITE,
+    otherwise 0.
+  If there is a buffer element after this:
+    Set d.next to the index of the next free descriptor element.
+    Set the VRING_DESC_F_NEXT bit in d.flags.
+In practice, the d.next fields are usually used to chain free
+descriptors, and a separate count kept to check there are enough
+free descriptors before beginning the mappings.
+  Updating The Available Ring
+The head of the buffer we mapped is the first d in the algorithm
+above. A naive implementation would do the following:
+avail->ring[avail->idx % qsz] = head;
+However, in general we can add many descriptors before we update
+the “idx” field (at which point they become visible to the
+device), so we keep a counter of how many we've added:
+avail->ring[(avail->idx + added++) % qsz] = head;
+  Updating The Index Field
+Once the idx field of the virtqueue is updated, the device will
+be able to access the descriptor entries we've created and the
+memory they refer to. This is why a memory barrier is generally
+used before the idx update, to ensure it sees the most up-to-date
+copy.
+The idx field always increments, and we let it wrap naturally at
+65536:
+avail->idx += added;
+  <sub:Notifying-The-Device>Notifying The Device
+Device notification occurs by writing the 16-bit virtqueue index
+of this virtqueue to the Queue Notify field of the virtio header
+in the first I/O region of the PCI device. This can be expensive,
+however, so the device can suppress such notifications if it
+doesn't need them. We have to be careful to expose the new idx
+value before checking the suppression flag: it's OK to notify
+gratuitously, but not to omit a required notification. So again,
+we use a memory barrier here before reading the flags or the
+avail_event field.
+If the VIRTIO_F_RING_EVENT_IDX feature is not negotiated, and if
+the VRING_USED_F_NOTIFY flag is not set, we go ahead and write to
+the PCI configuration space.
+If the VIRTIO_F_RING_EVENT_IDX feature is negotiated, we read the
+avail_event field in the available ring structure. If the
+available index crossed_the avail_event field value since the
+last notification, we go ahead and write to the PCI configuration
+space. The avail_event field wraps naturally at 65536 as well:
+(u16)(new_idx - avail_event - 1) < (u16)(new_idx - old_idx)
+  <sub:Receiving-Used-Buffers>Receiving Used Buffers From The
+  Device
+Once the device has used a buffer (read from or written to it, or
+parts of both, depending on the nature of the virtqueue and the
+device), it sends an interrupt, following an algorithm very
+similar to the algorithm used for the driver to send the device a
+buffer:
+  Write the head descriptor number to the next field in the used
+  ring.
+  Update the used ring idx.
+  Determine whether an interrupt is necessary:
+  If the VIRTIO_F_RING_EVENT_IDX feature is not negotiated: check
+    if f the VRING_AVAIL_F_NO_INTERRUPT flag is not set in avail-
+    >flags
+  If the VIRTIO_F_RING_EVENT_IDX feature is negotiated: check
+    whether the used index crossed the used_event field value
+    since the last update. The used_event field wraps naturally
+    at 65536 as well:(u16)(new_idx - used_event - 1) < (u16)(new_idx - old_idx)
+  If an interrupt is necessary:
+  If MSI-X capability is disabled:
+    Set the lower bit of the ISR Status field for the device.
+    Send the appropriate PCI interrupt for the device.
+  If MSI-X capability is enabled:
+    Request the appropriate MSI-X interrupt message for the
+      device, Queue Vector field sets the MSI-X Table entry
+      number.
+    If Queue Vector field value is NO_VECTOR, no interrupt
+      message is requested for this event.
+The guest interrupt handler should:
+  If MSI-X capability is disabled: read the ISR Status field,
+  which will reset it to zero. If the lower bit is zero, the
+  interrupt was not for this device. Otherwise, the guest driver
+  should look through the used rings of each virtqueue for the
+  device, to see if any progress has been made by the device
+  which requires servicing.
+  If MSI-X capability is enabled: look through the used rings of
+  each virtqueue mapped to the specific MSI-X vector for the
+  device, to see if any progress has been made by the device
+  which requires servicing.
+For each ring, guest should then disable interrupts by writing
+VRING_AVAIL_F_NO_INTERRUPT flag in avail structure, if required.
+It can then process used ring entries finally enabling interrupts
+by clearing the VRING_AVAIL_F_NO_INTERRUPT flag or updating the
+EVENT_IDX field in the available structure, Guest should then
+execute a memory barrier, and then recheck the ring empty
+condition. This is necessary to handle the case where, after the
+last check and before enabling interrupts, an interrupt has been
+suppressed by the device:
+vring_disable_interrupts(vq);
+for (;;) {
+    if (vq->last_seen_used != vring->used.idx) {
+                vring_enable_interrupts(vq);
+                mb();
+                if (vq->last_seen_used != vring->used.idx)
+                        break;
+    }
+    struct vring_used_elem *e =
+vring.used->ring[vq->last_seen_used%vsz];
+    process_buffer(e);
+    vq->last_seen_used++;
+}
+  Dealing With Configuration Changes
+Some virtio PCI devices can change the device configuration
+state, as reflected in the virtio header in the PCI configuration
+space. In this case:
+  If MSI-X capability is disabled: an interrupt is delivered and
+  the second highest bit is set in the ISR Status field to
+  indicate that the driver should re-examine the configuration
+  space.Note that a single interrupt can indicate both that one
+  or more virtqueue has been used and that the configuration
+  space has changed: even if the config bit is set, virtqueues
+  must be scanned.
+  If MSI-X capability is enabled: an interrupt message is
+  requested. The Configuration Vector field sets the MSI-X Table
+  entry number to use. If Configuration Vector field value is
+  NO_VECTOR, no interrupt message is requested for this event.
+Creating New Device Types
+Various considerations are necessary when creating a new device
+type:
+  How Many Virtqueues?
+It is possible that a very simple device will operate entirely
+through its configuration space, but most will need at least one
+virtqueue in which it will place requests. A device with both
+input and output (eg. console and network devices described here)
+need two queues: one which the driver fills with buffers to
+receive input, and one which the driver places buffers to
+transmit output.
+  What Configuration Space Layout?
+Configuration space is generally used for rarely-changing or
+initialization-time parameters. But it is a limited resource, so
+it might be better to use a virtqueue to update configuration
+information (the network device does this for filtering,
+otherwise the table in the config space could potentially be very
+large).
+Note that this space is generally the guest's native endian,
+rather than PCI's little-endian.
+  What Device Number?
+Currently device numbers are assigned quite freely: a simple
+request mail to the author of this document or the Linux
+virtualization mailing list[footnote:
+https://lists.linux-foundation.org/mailman/listinfo/virtualization
+] will be sufficient to secure a unique one.
+Meanwhile for experimental drivers, use 65535 and work backwards.
+  How many MSI-X vectors?
+Using the optional MSI-X capability devices can speed up
+interrupt processing by removing the need to read ISR Status
+register by guest driver (which might be an expensive operation),
+reducing interrupt sharing between devices and queues within the
+device, and handling interrupts from multiple CPUs. However, some
+systems impose a limit (which might be as low as 256) on the
+total number of MSI-X vectors that can be allocated to all
+devices. Devices and/or device drivers should take this into
+account, limiting the number of vectors used unless the device is
+expected to cause a high volume of interrupts. Devices can
+control the number of vectors used by limiting the MSI-X Table
+Size or not presenting MSI-X capability in PCI configuration
+space. Drivers can control this by mapping events to as small
+number of vectors as possible, or disabling MSI-X capability
+altogether.
+  Message Framing
+The descriptors used for a buffer should not effect the semantics
+of the message, except for the total length of the buffer. For
+example, a network buffer consists of a 10 byte header followed
+by the network packet. Whether this is presented in the ring
+descriptor chain as (say) a 10 byte buffer and a 1514 byte
+buffer, or a single 1524 byte buffer, or even three buffers,
+should have no effect.
+In particular, no implementation should use the descriptor
+boundaries to determine the size of any header in a request.[footnote:
+The current qemu device implementations mistakenly insist that
+the first descriptor cover the header in these cases exactly, so
+a cautious driver should arrange it so.
+]
+  Device Improvements
+Any change to configuration space, or new virtqueues, or
+behavioural changes, should be indicated by negotiation of a new
+feature bit. This establishes clarity[footnote:
+Even if it does mean documenting design or implementation
+mistakes!
+] and avoids future expansion problems.
+Clusters of functionality which are always implemented together
+can use a single bit, but if one feature makes sense without the
+others they should not be gratuitously grouped together to
+conserve feature bits. We can always extend the spec when the
+first person needs more than 24 feature bits for their device.
+[LaTeX Command: printnomenclature]
+Appendix A: virtio_ring.h
+#ifndef VIRTIO_RING_H
+#define VIRTIO_RING_H
+/* An interface for efficient virtio implementation.
+ *
+ * This header is BSD licensed so anyone can use the definitions
+ * to implement compatible drivers/servers.
+ *
+ * Copyright 2007, 2009, IBM Corporation
+ * Copyright 2011, Red Hat, Inc
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or
+without
+ * modification, are permitted provided that the following
+conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above
+copyright
+ *    notice, this list of conditions and the following
+disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+copyright
+ *    notice, this list of conditions and the following
+disclaimer in the
+ *    documentation and/or other materials provided with the
+distribution.
+ * 3. Neither the name of IBM nor the names of its contributors
+ *    may be used to endorse or promote products derived from
+this software
+ *    without specific prior written permission.
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL IBM OR CONTRIBUTORS BE
+LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/* This marks a buffer as continuing via the next field. */
+#define VRING_DESC_F_NEXT       1
+/* This marks a buffer as write-only (otherwise read-only). */
+#define VRING_DESC_F_WRITE      2
+/* The Host uses this in used->flags to advise the Guest: don't
+kick me
+ * when you add a buffer.  It's unreliable, so it's simply an
+ * optimization.  Guest will still kick if it's out of buffers.
+*/
+#define VRING_USED_F_NO_NOTIFY  1
+/* The Guest uses this in avail->flags to advise the Host: don't
+ * interrupt me when you consume a buffer.  It's unreliable, so
+it's
+ * simply an optimization.  */
+#define VRING_AVAIL_F_NO_INTERRUPT      1
+/* Virtio ring descriptors: 16 bytes.
+ * These can chain together via "next". */
+struct vring_desc {
+        /* Address (guest-physical). */
+        uint64_t addr;
+        /* Length. */
+        uint32_t len;
+        /* The flags as indicated above. */
+        uint16_t flags;
+        /* We chain unused descriptors via this, too */
+        uint16_t next;
+};
+struct vring_avail {
+        uint16_t flags;
+        uint16_t idx;
+        uint16_t ring[];
+        uint16_t used_event;
+};
+/* u32 is used here for ids for padding reasons. */
+struct vring_used_elem {
+        /* Index of start of used descriptor chain. */
+        uint32_t id;
+        /* Total length of the descriptor chain which was written
+to. */
+        uint32_t len;
+};
+struct vring_used {
+        uint16_t flags;
+        uint16_t idx;
+        struct vring_used_elem ring[];
+        uint16_t avail_event;
+};
+struct vring {
+        unsigned int num;
+        struct vring_desc *desc;
+        struct vring_avail *avail;
+        struct vring_used *used;
+};
+/* The standard layout for the ring is a continuous chunk of
+memory which
+ * looks like this.  We assume num is a power of 2.
+ *
+ * struct vring {
+ *      // The actual descriptors (16 bytes each)
+ *      struct vring_desc desc[num];
+ *
+ *      // A ring of available descriptor heads with free-running
+index.
+ *      __u16 avail_flags;
+ *      __u16 avail_idx;
+ *      __u16 available[num];
+ *
+ *      // Padding to the next align boundary.
+ *      char pad[];
+ *
+ *      // A ring of used descriptor heads with free-running
+index.
+ *      __u16 used_flags;
+ *      __u16 EVENT_IDX;
+ *      struct vring_used_elem used[num];
+ * };
+ * Note: for virtio PCI, align is 4096.
+ */
+static inline void vring_init(struct vring *vr, unsigned int num,
+void *p,
+                              unsigned long align)
+{
+        vr->num = num;
+        vr->desc = p;
+        vr->avail = p + num*sizeof(struct vring_desc);
+        vr->used = (void *)(((unsigned long)&vr->avail->ring[num]
+                              + align-1)
+                            & ~(align - 1));
+}
+static inline unsigned vring_size(unsigned int num, unsigned long
+align)
+{
+        return ((sizeof(struct vring_desc)*num +
+sizeof(uint16_t)*(2+num)
+                 + align - 1) & ~(align - 1))
+                + sizeof(uint16_t)*3 + sizeof(struct
+vring_used_elem)*num;
+}
+static inline int vring_need_event(uint16_t event_idx, uint16_t
+new_idx, uint16_t old_idx)
+{
+         return (uint16_t)(new_idx - event_idx - 1) <
+(uint16_t)(new_idx - old_idx);
+}
+#endif /* VIRTIO_RING_H */
+<cha:Reserved-Feature-Bits>Appendix B: Reserved Feature Bits
+Currently there are five device-independent feature bits defined:
+  VIRTIO_F_NOTIFY_ON_EMPTY (24) Negotiating this feature
+  indicates that the driver wants an interrupt if the device runs
+  out of available descriptors on a virtqueue, even though
+  interrupts are suppressed using the VRING_AVAIL_F_NO_INTERRUPT
+  flag or the used_event field. An example of this is the
+  networking driver: it doesn't need to know every time a packet
+  is transmitted, but it does need to free the transmitted
+  packets a finite time after they are transmitted. It can avoid
+  using a timer if the device interrupts it when all the packets
+  are transmitted.
+  VIRTIO_F_RING_INDIRECT_DESC (28) Negotiating this feature
+  indicates that the driver can use descriptors with the
+  VRING_DESC_F_INDIRECT flag set, as described in [sub:Indirect-Descriptors]
+  .
+  VIRTIO_F_RING_EVENT_IDX(29) This feature enables the used_event
+  and the avail_event fields. If set, it indicates that the
+  device should ignore the flags field in the available ring
+  structure. Instead, the used_event field in this structure is
+  used by guest to suppress device interrupts. Further, the
+  driver should ignore the flags field in the used ring
+  structure. Instead, the avail_event field in this structure is
+  used by the device to suppress notifications. If unset, the
+  driver should ignore the used_event field; the device should
+  ignore the avail_event field; the flags field is used
+  VIRTIO_F_BAD_FEATURE(30) This feature should never be
+  negotiated by the guest; doing so is an indication that the
+  guest is faulty[footnote:
+An experimental virtio PCI driver contained in Linux version
+2.6.25 had this problem, and this feature bit can be used to
+detect it.
+]
+  VIRTIO_F_FEATURES_HIGH(31) This feature indicates that the
+  device supports feature bits 32:63. If unset, feature bits
+  32:63 are unset.
+Appendix C: Network Device
+The virtio network device is a virtual ethernet card, and is the
+most complex of the devices supported so far by virtio. It has
+enhanced rapidly and demonstrates clearly how support for new
+features should be added to an existing device. Empty buffers are
+placed in one virtqueue for receiving packets, and outgoing
+packets are enqueued into another for transmission in that order.
+A third command queue is used to control advanced filtering
+features.
+  Configuration
+  Subsystem Device ID 1
+  Virtqueues 0:receiveq. 1:transmitq. 2:controlq[footnote:
+Only if VIRTIO_NET_F_CTRL_VQ set
+]
+  Feature bits
+  VIRTIO_NET_F_CSUM (0) Device handles packets with partial
+    checksum
+  VIRTIO_NET_F_GUEST_CSUM (1) Guest handles packets with partial
+    checksum
+  VIRTIO_NET_F_MAC (5) Device has given MAC address.
+  VIRTIO_NET_F_GSO (6) (Deprecated) device handles packets with
+    any GSO type.[footnote:
+It was supposed to indicate segmentation offload support, but
+upon further investigation it became clear that multiple bits
+were required.
+]
+  VIRTIO_NET_F_GUEST_TSO4 (7) Guest can receive TSOv4.
+  VIRTIO_NET_F_GUEST_TSO6 (8) Guest can receive TSOv6.
+  VIRTIO_NET_F_GUEST_ECN (9) Guest can receive TSO with ECN.
+  VIRTIO_NET_F_GUEST_UFO (10) Guest can receive UFO.
+  VIRTIO_NET_F_HOST_TSO4 (11) Device can receive TSOv4.
+  VIRTIO_NET_F_HOST_TSO6 (12) Device can receive TSOv6.
+  VIRTIO_NET_F_HOST_ECN (13) Device can receive TSO with ECN.
+  VIRTIO_NET_F_HOST_UFO (14) Device can receive UFO.
+  VIRTIO_NET_F_MRG_RXBUF (15) Guest can merge receive buffers.
+  VIRTIO_NET_F_STATUS (16) Configuration status field is
+    available.
+  VIRTIO_NET_F_CTRL_VQ (17) Control channel is available.
+  VIRTIO_NET_F_CTRL_RX (18) Control channel RX mode support.
+  VIRTIO_NET_F_CTRL_VLAN (19) Control channel VLAN filtering.
+  Device configuration layout Two configuration fields are
+  currently defined. The mac address field always exists (though
+  is only valid if VIRTIO_NET_F_MAC is set), and the status field
+  only exists if VIRTIO_NET_F_STATUS is set. Only one bit is
+  currently defined for the status field: VIRTIO_NET_S_LINK_UP. #define VIRTIO_NET_S_LINK_UP    1
+struct virtio_net_config {
+    u8 mac[6];
+    u16 status;
+};
+  Device Initialization
+  The initialization routine should identify the receive and
+  transmission virtqueues.
+  If the VIRTIO_NET_F_MAC feature bit is set, the configuration
+  space “mac” entry indicates the “physical” address of the the
+  network card, otherwise a private MAC address should be
+  assigned. All guests are expected to negotiate this feature if
+  it is set.
+  If the VIRTIO_NET_F_CTRL_VQ feature bit is negotiated, identify
+  the control virtqueue.
+  If the VIRTIO_NET_F_STATUS feature bit is negotiated, the link
+  status can be read from the bottom bit of the “status” config
+  field. Otherwise, the link should be assumed active.
+  The receive virtqueue should be filled with receive buffers.
+  This is described in detail below in “Setting Up Receive
+  Buffers”.
+  A driver can indicate that it will generate checksumless
+  packets by negotating the VIRTIO_NET_F_CSUM feature. This “
+  checksum offload” is a common feature on modern network cards.
+  If that feature is negotiated, a driver can use TCP or UDP
+  segmentation offload by negotiating the VIRTIO_NET_F_HOST_TSO4
+  (IPv4 TCP), VIRTIO_NET_F_HOST_TSO6 (IPv6 TCP) and
+  VIRTIO_NET_F_HOST_UFO (UDP fragmentation) features. It should
+  not send TCP packets requiring segmentation offload which have
+  the Explicit Congestion Notification bit set, unless the
+  VIRTIO_NET_F_HOST_ECN feature is negotiated.[footnote:
+This is a common restriction in real, older network cards.
+]
+  The converse features are also available: a driver can save the
+  virtual device some work by negotiating these features.[footnote:
+For example, a network packet transported between two guests on
+the same system may not require checksumming at all, nor
+segmentation, if both guests are amenable.
+] The VIRTIO_NET_F_GUEST_CSUM feature indicates that partially
+  checksummed packets can be received, and if it can do that then
+  the VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
+  VIRTIO_NET_F_GUEST_UFO and VIRTIO_NET_F_GUEST_ECN are the input
+  equivalents of the features described above. See “Receiving
+  Packets” below.
+  Device Operation
+Packets are transmitted by placing them in the transmitq, and
+buffers for incoming packets are placed in the receiveq. In each
+case, the packet itself is preceeded by a header:
+struct virtio_net_hdr {
+#define VIRTIO_NET_HDR_F_NEEDS_CSUM    1
+        u8 flags;
+#define VIRTIO_NET_HDR_GSO_NONE        0
+#define VIRTIO_NET_HDR_GSO_TCPV4       1
+#define VIRTIO_NET_HDR_GSO_UDP           3
+#define VIRTIO_NET_HDR_GSO_TCPV6       4
+#define VIRTIO_NET_HDR_GSO_ECN      0x80
+        u8 gso_type;
+        u16 hdr_len;
+        u16 gso_size;
+        u16 csum_start;
+        u16 csum_offset;
+/* Only if VIRTIO_NET_F_MRG_RXBUF: */
+        u16 num_buffers
+};
+The controlq is used to control device features such as
+filtering.
+  Packet Transmission
+Transmitting a single packet is simple, but varies depending on
+the different features the driver negotiated.
+  If the driver negotiated VIRTIO_NET_F_CSUM, and the packet has
+  not been fully checksummed, then the virtio_net_hdr's fields
+  are set as follows. Otherwise, the packet must be fully
+  checksummed, and flags is zero.
+  flags has the VIRTIO_NET_HDR_F_NEEDS_CSUM set,
+  <ite:csum_start-is-set>csum_start is set to the offset within
+    the packet to begin checksumming, and
+  csum_offset indicates how many bytes after the csum_start the
+    new (16 bit ones' complement) checksum should be placed.[footnote:
+For example, consider a partially checksummed TCP (IPv4) packet.
+It will have a 14 byte ethernet header and 20 byte IP header
+followed by the TCP header (with the TCP checksum field 16 bytes
+into that header). csum_start will be 14+20 = 34 (the TCP
+checksum includes the header), and csum_offset will be 16. The
+value in the TCP checksum field will be the sum of the TCP pseudo
+header, so that replacing it by the ones' complement checksum of
+the TCP header and body will give the correct result.
+]
+  <enu:If-the-driver>If the driver negotiated
+  VIRTIO_NET_F_HOST_TSO4, TSO6 or UFO, and the packet requires
+  TCP segmentation or UDP fragmentation, then the “gso_type”
+  field is set to VIRTIO_NET_HDR_GSO_TCPV4, TCPV6 or UDP.
+  (Otherwise, it is set to VIRTIO_NET_HDR_GSO_NONE). In this
+  case, packets larger than 1514 bytes can be transmitted: the
+  metadata indicates how to replicate the packet header to cut it
+  into smaller packets. The other gso fields are set:
+  hdr_len is a hint to the device as to how much of the header
+    needs to be kept to copy into each packet, usually set to the
+    length of the headers, including the transport header.[footnote:
+Due to various bugs in implementations, this field is not useful
+as a guarantee of the transport header size.
+]
+  gso_size is the size of the packet beyond that header (ie.
+    MSS).
+  If the driver negotiated the VIRTIO_NET_F_HOST_ECN feature, the
+    VIRTIO_NET_HDR_GSO_ECN bit may be set in “gso_type” as well,
+    indicating that the TCP packet has the ECN bit set.[footnote:
+This case is not handled by some older hardware, so is called out
+specifically in the protocol.
+]
+  If the driver negotiated the VIRTIO_NET_F_MRG_RXBUF feature,
+  the num_buffers field is set to zero.
+  The header and packet are added as one output buffer to the
+  transmitq, and the device is notified of the new entry (see [sub:Notifying-The-Device]
+  ).[footnote:
+Note that the header will be two bytes longer for the
+VIRTIO_NET_F_MRG_RXBUF case.
+]
+  Packet Transmission Interrupt
+Often a driver will suppress transmission interrupts using the
+VRING_AVAIL_F_NO_INTERRUPT flag (see [sub:Receiving-Used-Buffers]
+) and check for used packets in the transmit path of following
+packets. However, it will still receive interrupts if the
+VIRTIO_F_NOTIFY_ON_EMPTY feature is negotiated, indicating that
+the transmission queue is completely emptied.
+The normal behavior in this interrupt handler is to retrieve and
+new descriptors from the used ring and free the corresponding
+headers and packets.
+  Setting Up Receive Buffers
+It is generally a good idea to keep the receive virtqueue as
+fully populated as possible: if it runs out, network performance
+will suffer.
+If the VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6 or
+VIRTIO_NET_F_GUEST_UFO features are used, the Guest will need to
+accept packets of up to 65550 bytes long (the maximum size of a
+TCP or UDP packet, plus the 14 byte ethernet header), otherwise
+1514 bytes. So unless VIRTIO_NET_F_MRG_RXBUF is negotiated, every
+buffer in the receive queue needs to be at least this length [footnote:
+Obviously each one can be split across multiple descriptor
+elements.
+].
+If VIRTIO_NET_F_MRG_RXBUF is negotiated, each buffer must be at
+least the size of the struct virtio_net_hdr.
+  Packet Receive Interrupt
+When a packet is copied into a buffer in the receiveq, the
+optimal path is to disable further interrupts for the receiveq
+(see [sub:Receiving-Used-Buffers]) and process packets until no
+more are found, then re-enable them.
+Processing packet involves:
+  If the driver negotiated the VIRTIO_NET_F_MRG_RXBUF feature,
+  then the “num_buffers” field indicates how many descriptors
+  this packet is spread over (including this one). This allows
+  receipt of large packets without having to allocate large
+  buffers. In this case, there will be at least “num_buffers” in
+  the used ring, and they should be chained together to form a
+  single packet. The other buffers will not begin with a struct
+  virtio_net_hdr.
+  If the VIRTIO_NET_F_MRG_RXBUF feature was not negotiated, or
+  the “num_buffers” field is one, then the entire packet will be
+  contained within this buffer, immediately following the struct
+  virtio_net_hdr.
+  If the VIRTIO_NET_F_GUEST_CSUM feature was negotiated, the
+  VIRTIO_NET_HDR_F_NEEDS_CSUM bit in the “flags” field may be
+  set: if so, the checksum on the packet is incomplete and the “
+  csum_start” and “csum_offset” fields indicate how to calculate
+  it (see [ite:csum_start-is-set]).
+  If the VIRTIO_NET_F_GUEST_TSO4, TSO6 or UFO options were
+  negotiated, then the “gso_type” may be something other than
+  VIRTIO_NET_HDR_GSO_NONE, and the “gso_size” field indicates the
+  desired MSS (see [enu:If-the-driver]).Control Virtqueue
+The driver uses the control virtqueue (if VIRTIO_NET_F_VTRL_VQ is
+negotiated) to send commands to manipulate various features of
+the device which would not easily map into the configuration
+space.
+All commands are of the following form:
+struct virtio_net_ctrl {
+        u8 class;
+        u8 command;
+        u8 command-specific-data[];
+        u8 ack;
+};
+/* ack values */
+#define VIRTIO_NET_OK     0
+#define VIRTIO_NET_ERR    1
+The class, command and command-specific-data are set by the
+driver, and the device sets the ack byte. There is little it can
+do except issue a diagnostic if the ack byte is not
+VIRTIO_NET_OK.
+  Packet Receive Filtering
+If the VIRTIO_NET_F_CTRL_RX feature is negotiated, the driver can
+send control commands for promiscuous mode, multicast receiving,
+and filtering of MAC addresses.
+Note that in general, these commands are best-effort: unwanted
+packets may still arrive.
+  Setting Promiscuous Mode
+#define VIRTIO_NET_CTRL_RX    0
+ #define VIRTIO_NET_CTRL_RX_PROMISC      0
+ #define VIRTIO_NET_CTRL_RX_ALLMULTI     1
+The class VIRTIO_NET_CTRL_RX has two commands:
+VIRTIO_NET_CTRL_RX_PROMISC turns promiscuous mode on and off, and
+VIRTIO_NET_CTRL_RX_ALLMULTI turns all-multicast receive on and
+off. The command-specific-data is one byte containing 0 (off) or
+1 (on).
+  Setting MAC Address Filtering
+struct virtio_net_ctrl_mac {
+        u32 entries;
+        u8 macs[entries][ETH_ALEN];
+};
+#define VIRTIO_NET_CTRL_MAC    1
+ #define VIRTIO_NET_CTRL_MAC_TABLE_SET        0
+The device can filter incoming packets by any number of
+destination MAC addresses.[footnote:
+Since there are no guarentees, it can use a hash filter
+orsilently switch to allmulti or promiscuous mode if it is given
+too many addresses.
+] This table is set using the class VIRTIO_NET_CTRL_MAC and the
+command VIRTIO_NET_CTRL_MAC_TABLE_SET. The command-specific-data
+is two variable length tables of 6-byte MAC addresses. The first
+table contains unicast addresses, and the second contains
+multicast addresses.
+  VLAN Filtering
+If the driver negotiates the VIRTION_NET_F_CTRL_VLAN feature, it
+can control a VLAN filter table in the device.
+#define VIRTIO_NET_CTRL_VLAN       2
+ #define VIRTIO_NET_CTRL_VLAN_ADD             0
+ #define VIRTIO_NET_CTRL_VLAN_DEL             1
+Both the VIRTIO_NET_CTRL_VLAN_ADD and VIRTIO_NET_CTRL_VLAN_DEL
+command take a 16-bit VLAN id as the command-specific-data.
+Appendix D: Block Device
+The virtio block device is a simple virtual block device (ie.
+disk). Read and write requests (and other exotic requests) are
+placed in the queue, and serviced (probably out of order) by the
+device except where noted.
+  Configuration
+  Subsystem Device ID 2
+  Virtqueues 0:requestq.
+  Feature bits
+  VIRTIO_BLK_F_BARRIER (0) Host supports request barriers.
+  VIRTIO_BLK_F_SIZE_MAX (1) Maximum size of any single segment is
+    in “size_max”.
+  VIRTIO_BLK_F_SEG_MAX (2) Maximum number of segments in a
+    request is in “seg_max”.
+  VIRTIO_BLK_F_GEOMETRY (4) Disk-style geometry specified in “
+    geometry”.
+  VIRTIO_BLK_F_RO (5) Device is read-only.
+  VIRTIO_BLK_F_BLK_SIZE (6) Block size of disk is in “blk_size”.
+  VIRTIO_BLK_F_SCSI (7) Device supports scsi packet commands.
+  VIRTIO_BLK_F_FLUSH (9) Cache flush command support.
+  Device configuration layout The capacity of the device
+  (expressed in 512-byte sectors) is always present. The
+  availability of the others all depend on various feature bits
+  as indicated above. struct virtio_blk_config {
+        u64 capacity;
+        u32 size_max;
+        u32 seg_max;
+        struct virtio_blk_geometry {
+                u16 cylinders;
+                u8 heads;
+                u8 sectors;
+        } geometry;
+        u32 blk_size;
+};
+  Device Initialization
+  The device size should be read from the “capacity”
+  configuration field. No requests should be submitted which goes
+  beyond this limit.
+  If the VIRTIO_BLK_F_BLK_SIZE feature is negotiated, the
+  blk_size field can be read to determine the optimal sector size
+  for the driver to use. This does not effect the units used in
+  the protocol (always 512 bytes), but awareness of the correct
+  value can effect performance.
+  If the VIRTIO_BLK_F_RO feature is set by the device, any write
+  requests will fail.
+  Device Operation
+The driver queues requests to the virtqueue, and they are used by
+the device (not necessarily in order). Each request is of form:
+struct virtio_blk_req {
+        u32 type;
+        u32 ioprio;
+        u64 sector;
+        char data[][512];
+        u8 status;
+};
+If the device has VIRTIO_BLK_F_SCSI feature, it can also support
+scsi packet command requests, each of these requests is of form:struct virtio_scsi_pc_req {
+        u32 type;
+        u32 ioprio;
+        u64 sector;
+    char cmd[];
+        char data[][512];
+#define SCSI_SENSE_BUFFERSIZE   96
+    u8 sense[SCSI_SENSE_BUFFERSIZE];
+    u32 errors;
+    u32 data_len;
+    u32 sense_len;
+    u32 residual;
+        u8 status;
+};
+The type of the request is either a read (VIRTIO_BLK_T_IN), a
+write (VIRTIO_BLK_T_OUT), a scsi packet command
+(VIRTIO_BLK_T_SCSI_CMD or VIRTIO_BLK_T_SCSI_CMD_OUT[footnote:
+the SCSI_CMD and SCSI_CMD_OUT types are equivalent, the device
+does not distinguish between them
+]) or a flush (VIRTIO_BLK_T_FLUSH or VIRTIO_BLK_T_FLUSH_OUT[footnote:
+the FLUSH and FLUSH_OUT types are equivalent, the device does not
+distinguish between them
+]). If the device has VIRTIO_BLK_F_BARRIER feature the high bit
+(VIRTIO_BLK_T_BARRIER) indicates that this request acts as a
+barrier and that all preceeding requests must be complete before
+this one, and all following requests must not be started until
+this is complete. Note that a barrier does not flush caches in
+the underlying backend device in host, and thus does not serve as
+data consistency guarantee. Driver must use FLUSH request to
+flush the host cache.
+#define VIRTIO_BLK_T_IN           0
+#define VIRTIO_BLK_T_OUT          1
+#define VIRTIO_BLK_T_SCSI_CMD     2
+#define VIRTIO_BLK_T_SCSI_CMD_OUT 3
+#define VIRTIO_BLK_T_FLUSH        4
+#define VIRTIO_BLK_T_FLUSH_OUT    5
+#define VIRTIO_BLK_T_BARRIER     0x80000000
+The ioprio field is a hint about the relative priorities of
+requests to the device: higher numbers indicate more important
+requests.
+The sector number indicates the offset (multiplied by 512) where
+the read or write is to occur. This field is unused and set to 0
+for scsi packet commands and for flush commands.
+The cmd field is only present for scsi packet command requests,
+and indicates the command to perform. This field must reside in a
+single, separate read-only buffer; command length can be derived
+from the length of this buffer.
+Note that these first three (four for scsi packet commands)
+fields are always read-only: the data field is either read-only
+or write-only, depending on the request. The size of the read or
+write can be derived from the total size of the request buffers.
+The sense field is only present for scsi packet command requests,
+and indicates the buffer for scsi sense data.
+The data_len field is only present for scsi packet command
+requests, this field is deprecated, and should be ignored by the
+driver. Historically, devices copied data length there.
+The sense_len field is only present for scsi packet command
+requests and indicates the number of bytes actually written to
+the sense buffer.
+The residual field is only present for scsi packet command
+requests and indicates the residual size, calculated as data
+length - number of bytes actually transferred.
+The final status byte is written by the device: either
+VIRTIO_BLK_S_OK for success, VIRTIO_BLK_S_IOERR for host or guest
+error or VIRTIO_BLK_S_UNSUPP for a request unsupported by host:#define VIRTIO_BLK_S_OK        0
+#define VIRTIO_BLK_S_IOERR     1
+#define VIRTIO_BLK_S_UNSUPP    2
+Historically, devices assumed that the fields type, ioprio and
+sector reside in a single, separate read-only buffer; the fields
+errors, data_len, sense_len and residual reside in a single,
+separate write-only buffer; the sense field in a separate
+write-only buffer of size 96 bytes, by itself; the fields errors,
+data_len, sense_len and residual in a single write-only buffer;
+and the status field is a separate read-only buffer of size 1
+byte, by itself.
+Appendix E: Console Device
+The virtio console device is a simple device for data input and
+output. A device may have one or more ports. Each port has a pair
+of input and output virtqueues. Moreover, a device has a pair of
+control IO virtqueues. The control virtqueues are used to
+communicate information between the device and the driver about
+ports being opened and closed on either side of the connection,
+indication from the host about whether a particular port is a
+console port, adding new ports, port hot-plug/unplug, etc., and
+indication from the guest about whether a port or a device was
+successfully added, port open/close, etc.. For data IO, one or
+more empty buffers are placed in the receive queue for incoming
+data and outgoing characters are placed in the transmit queue.
+  Configuration
+  Subsystem Device ID 3
+  Virtqueues 0:receiveq(port0). 1:transmitq(port0), 2:control
+  receiveq[footnote:
+Ports 2 onwards only if VIRTIO_CONSOLE_F_MULTIPORT is set
+], 3:control transmitq, 4:receiveq(port1), 5:transmitq(port1),
+  ...
+  Feature bits
+  VIRTIO_CONSOLE_F_SIZE (0) Configuration cols and rows fields
+    are valid.
+  VIRTIO_CONSOLE_F_MULTIPORT(1) Device has support for multiple
+    ports; configuration fields nr_ports and max_nr_ports are
+    valid and control virtqueues will be used.
+  Device configuration layout The size of the console is supplied
+  in the configuration space if the VIRTIO_CONSOLE_F_SIZE feature
+  is set. Furthermore, if the VIRTIO_CONSOLE_F_MULTIPORT feature
+  is set, the maximum number of ports supported by the device can
+  be fetched.struct virtio_console_config {
+        u16 cols;
+        u16 rows;
+        u32 max_nr_ports;
+};
+  Device Initialization
+  If the VIRTIO_CONSOLE_F_SIZE feature is negotiated, the driver
+  can read the console dimensions from the configuration fields.
+  If the VIRTIO_CONSOLE_F_MULTIPORT feature is negotiated, the
+  driver can spawn multiple ports, not all of which may be
+  attached to a console. Some could be generic ports. In this
+  case, the control virtqueues are enabled and according to the
+  max_nr_ports configuration-space value, the appropriate number
+  of virtqueues are created. A control message indicating the
+  driver is ready is sent to the host. The host can then send
+  control messages for adding new ports to the device. After
+  creating and initializing each port, a
+  VIRTIO_CONSOLE_PORT_READY control message is sent to the host
+  for that port so the host can let us know of any additional
+  configuration options set for that port.
+  The receiveq for each port is populated with one or more
+  receive buffers.
+  Device Operation
+  For output, a buffer containing the characters is placed in the
+  port's transmitq.[footnote:
+Because this is high importance and low bandwidth, the current
+Linux implementation polls for the buffer to be used, rather than
+waiting for an interrupt, simplifying the implementation
+significantly. However, for generic serial ports with the
+O_NONBLOCK flag set, the polling limitation is relaxed and the
+consumed buffers are freed upon the next write or poll call or
+when a port is closed or hot-unplugged.
+]
+  When a buffer is used in the receiveq (signalled by an
+  interrupt), the contents is the input to the port associated
+  with the virtqueue for which the notification was received.
+  If the driver negotiated the VIRTIO_CONSOLE_F_SIZE feature, a
+  configuration change interrupt may occur. The updated size can
+  be read from the configuration fields.
+  If the driver negotiated the VIRTIO_CONSOLE_F_MULTIPORT
+  feature, active ports are announced by the host using the
+  VIRTIO_CONSOLE_PORT_ADD control message. The same message is
+  used for port hot-plug as well.
+  If the host specified a port `name', a sysfs attribute is
+  created with the name filled in, so that udev rules can be
+  written that can create a symlink from the port's name to the
+  char device for port discovery by applications in the guest.
+  Changes to ports' state are effected by control messages.
+  Appropriate action is taken on the port indicated in the
+  control message. The layout of the structure of the control
+  buffer and the events associated are:struct virtio_console_control {
+        uint32_t id;    /* Port number */
+        uint16_t event; /* The kind of control event */
+        uint16_t value; /* Extra information for the event */
+};
+/* Some events for the internal messages (control packets) */
+#define VIRTIO_CONSOLE_DEVICE_READY     0
+#define VIRTIO_CONSOLE_PORT_ADD         1
+#define VIRTIO_CONSOLE_PORT_REMOVE      2
+#define VIRTIO_CONSOLE_PORT_READY       3
+#define VIRTIO_CONSOLE_CONSOLE_PORT     4
+#define VIRTIO_CONSOLE_RESIZE           5
+#define VIRTIO_CONSOLE_PORT_OPEN        6
+#define VIRTIO_CONSOLE_PORT_NAME        7
+Appendix F: Entropy Device
+The virtio entropy device supplies high-quality randomness for
+guest use.
+  Configuration
+  Subsystem Device ID 4
+  Virtqueues 0:requestq.
+  Feature bits None currently defined
+  Device configuration layout None currently defined.
+  Device Initialization
+  The virtqueue is initialized
+  Device Operation
+When the driver requires random bytes, it places the descriptor
+of one or more buffers in the queue. It will be completely filled
+by random data by the device.
+Appendix G: Memory Balloon Device
+The virtio memory balloon device is a primitive device for
+managing guest memory: the device asks for a certain amount of
+memory, and the guest supplies it (or withdraws it, if the device
+has more than it asks for). This allows the guest to adapt to
+changes in allowance of underlying physical memory. If the
+feature is negotiated, the device can also be used to communicate
+guest memory statistics to the host.
+  Configuration
+  Subsystem Device ID 5
+  Virtqueues 0:inflateq. 1:deflateq. 2:statsq.[footnote:
+Only if VIRTIO_BALLON_F_STATS_VQ set
+]
+  Feature bits
+  VIRTIO_BALLOON_F_MUST_TELL_HOST (0) Host must be told before
+    pages from the balloon are used.
+  VIRTIO_BALLOON_F_STATS_VQ (1) A virtqueue for reporting guest
+    memory statistics is present.
+  Device configuration layout Both fields of this configuration
+  are always available. Note that they are little endian, despite
+  convention that device fields are guest endian:struct virtio_balloon_config {
+        u32 num_pages;
+        u32 actual;
+};
+  Device Initialization
+  The inflate and deflate virtqueues are identified.
+  If the VIRTIO_BALLOON_F_STATS_VQ feature bit is negotiated:
+  Identify the stats virtqueue.
+  Add one empty buffer to the stats virtqueue and notify the
+    host.
+Device operation begins immediately.
+  Device Operation
+  Memory Ballooning The device is driven by the receipt of a
+  configuration change interrupt.
+  The “num_pages” configuration field is examined. If this is
+  greater than the “actual” number of pages, memory must be given
+  to the balloon. If it is less than the “actual” number of
+  pages, memory may be taken back from the balloon for general
+  use.
+  To supply memory to the balloon (aka. inflate):
+  The driver constructs an array of addresses of unused memory
+    pages. These addresses are divided by 4096[footnote:
+This is historical, and independent of the guest page size
+] and the descriptor describing the resulting 32-bit array is
+    added to the inflateq.
+  To remove memory from the balloon (aka. deflate):
+  The driver constructs an array of addresses of memory pages it
+    has previously given to the balloon, as described above. This
+    descriptor is added to the deflateq.
+  If the VIRTIO_BALLOON_F_MUST_TELL_HOST feature is set, the
+    guest may not use these requested pages until that descriptor
+    in the deflateq has been used by the device.
+  Otherwise, the guest may begin to re-use pages previously given
+    to the balloon before the device has acknowledged their
+    withdrawl. [footnote:
+In this case, deflation advice is merely a courtesy
+]
+  In either case, once the device has completed the inflation or
+  deflation, the “actual” field of the configuration should be
+  updated to reflect the new number of pages in the balloon.[footnote:
+As updates to configuration space are not atomic, this field
+isn't particularly reliable, but can be used to diagnose buggy
+guests.
+]
+  Memory Statistics
+The stats virtqueue is atypical because communication is driven
+by the device (not the driver). The channel becomes active at
+driver initialization time when the driver adds an empty buffer
+and notifies the device. A request for memory statistics proceeds
+as follows:
+  The device pushes the buffer onto the used ring and sends an
+  interrupt.
+  The driver pops the used buffer and discards it.
+  The driver collects memory statistics and writes them into a
+  new buffer.
+  The driver adds the buffer to the virtqueue and notifies the
+  device.
+  The device pops the buffer (retaining it to initiate a
+  subsequent request) and consumes the statistics.
+  Memory Statistics Format Each statistic consists of a 16 bit
+  tag and a 64 bit value. Both quantities are represented in the
+  native endian of the guest. All statistics are optional and the
+  driver may choose which ones to supply. To guarantee backwards
+  compatibility, unsupported statistics should be omitted.
+  struct virtio_balloon_stat {
+#define VIRTIO_BALLOON_S_SWAP_IN  0
+#define VIRTIO_BALLOON_S_SWAP_OUT 1
+#define VIRTIO_BALLOON_S_MAJFLT   2
+#define VIRTIO_BALLOON_S_MINFLT   3
+#define VIRTIO_BALLOON_S_MEMFREE  4
+#define VIRTIO_BALLOON_S_MEMTOT   5
+        u16 tag;
+        u64 val;
+} __attribute__((packed));
+  Tags
+  VIRTIO_BALLOON_S_SWAP_IN The amount of memory that has been
+  swapped in (in bytes).
+  VIRTIO_BALLOON_S_SWAP_OUT The amount of memory that has been
+  swapped out to disk (in bytes).
+  VIRTIO_BALLOON_S_MAJFLT The number of major page faults that
+  have occurred.
+  VIRTIO_BALLOON_S_MINFLT The number of minor page faults that
+  have occurred.
+  VIRTIO_BALLOON_S_MEMFREE The amount of memory not being used
+  for any purpose (in bytes).
+  VIRTIO_BALLOON_S_MEMTOT The total amount of memory available
+  (in bytes).
diff --git a/MAINTAINERS b/MAINTAINERS
index 1e55e1eeb811..069ee3b5c651 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4604,7 +4604,7 @@ F:	arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
 F:      arch/arm/mach-omap2/clockdomain44xx.c
 OMAP AUDIO SUPPORT
-M:      Jarkko Nikula <jhnikula@gmail.com>
+M:      Jarkko Nikula <jarkko.nikula@bitmer.com>
 L:      alsa-devel@alsa-project.org (subscribers-only)
 L:      linux-omap@vger.kernel.org
 S:      Maintained
@@ -4971,7 +4971,7 @@ M:	Paul Mackerras <paulus@samba.org>
 M:      Ingo Molnar <mingo@elte.hu>
 M:      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
 S:      Supported
-F:      kernel/perf_event*.c
+F:      kernel/events/*
 F:      include/linux/perf_event.h
 F:      arch/*/kernel/perf_event*.c
 F:      arch/*/kernel/*/perf_event*.c
diff --git a/Makefile b/Makefile
index b4ca4e111c9a..3241d41dfbff 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 3
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
-NAME = Sneaky Weasel
+NAME = Wet Seal
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S
index 7fa3bb0d2397..a08783823b32 100644
--- a/arch/arm/kernel/iwmmxt.S
+++ b/arch/arm/kernel/iwmmxt.S
@@ -195,10 +195,10 @@ ENTRY(iwmmxt_task_disable)
        @ enable access to CP0 and CP1
        XSC(mrc p15, 0, r4, c15, c1, 0)
-        XSC(orr r4, r4, #0xf)
+        XSC(orr r4, r4, #0x3)
        XSC(mcr p15, 0, r4, c15, c1, 0)
        PJ4(mrc p15, 0, r4, c1, c0, 2)
-        PJ4(orr r4, r4, #0x3)
+        PJ4(orr r4, r4, #0xf)
        PJ4(mcr p15, 0, r4, c1, c0, 2)
        mov     r0, #0                          @ nothing to load
@@ -313,7 +313,7 @@ ENTRY(iwmmxt_task_switch)
        teq     r2, r3                          @ next task owns it?
        movne   pc, lr                          @ no: leave Concan disabled
-1:      @ flip Conan access
+1:      @ flip Concan access
        XSC(eor r1, r1, #0x3)
        XSC(mcr p15, 0, r1, c15, c1, 0)
        PJ4(eor r1, r1, #0xf)
diff --git a/arch/arm/mach-imx/clock-imx25.c b/arch/arm/mach-imx/clock-imx25.c
index 0fc7ba56d616..e63e23504fe5 100644
--- a/arch/arm/mach-imx/clock-imx25.c
+++ b/arch/arm/mach-imx/clock-imx25.c
@@ -331,6 +331,9 @@ int __init mx25_clocks_init(void)
        __raw_writel(__raw_readl(CRM_BASE+0x64) | (1 << 7) | (1 << 0),
                        CRM_BASE + 0x64);
+        /* Clock source for gpt is ahb_div */
+        __raw_writel(__raw_readl(CRM_BASE+0x64) & ~(1 << 5), CRM_BASE + 0x64);
        mxc_timer_init(&gpt_clk, MX25_IO_ADDRESS(MX25_GPT1_BASE_ADDR), 54);
        return 0;
diff --git a/arch/arm/mach-imx/mach-imx27_visstrim_m10.c b/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
index 6707de0ab716..6778f8193bc6 100644
--- a/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
+++ b/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
@@ -30,6 +30,7 @@
 #include <linux/input.h>
 #include <linux/gpio.h>
 #include <linux/delay.h>
+#include <sound/tlv320aic32x4.h>
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/time.h>
@@ -196,6 +197,17 @@ static struct pca953x_platform_data visstrim_m10_pca9555_pdata = {
        .invert = 0,
 };
+static struct aic32x4_pdata visstrim_m10_aic32x4_pdata = {
+        .power_cfg = AIC32X4_PWR_MICBIAS_2075_LDOIN |
+                     AIC32X4_PWR_AVDD_DVDD_WEAK_DISABLE |
+                     AIC32X4_PWR_AIC32X4_LDO_ENABLE |
+                     AIC32X4_PWR_CMMODE_LDOIN_RANGE_18_36 |
+                     AIC32X4_PWR_CMMODE_HP_LDOIN_POWERED,
+        .micpga_routing = AIC32X4_MICPGA_ROUTE_LMIC_IN2R_10K |
+                         AIC32X4_MICPGA_ROUTE_RMIC_IN1L_10K,
+        .swapdacs = false,
+};
 static struct i2c_board_info visstrim_m10_i2c_devices[] = {
        {
                I2C_BOARD_INFO("pca9555", 0x20),
@@ -203,6 +215,7 @@ static struct i2c_board_info visstrim_m10_i2c_devices[] = {
        },
        {
                I2C_BOARD_INFO("tlv320aic32x4", 0x18),
+                .platform_data = &visstrim_m10_aic32x4_pdata,
        }
 };
diff --git a/arch/arm/mach-imx/mach-mx31ads.c b/arch/arm/mach-imx/mach-mx31ads.c
index 0ce49478a479..29ca8907a780 100644
--- a/arch/arm/mach-imx/mach-mx31ads.c
+++ b/arch/arm/mach-imx/mach-mx31ads.c
@@ -468,7 +468,7 @@ static struct i2c_board_info __initdata mx31ads_i2c1_devices[] = {
 #endif
 };
-static void mxc_init_i2c(void)
+static void __init mxc_init_i2c(void)
 {
        i2c_register_board_info(1, mx31ads_i2c1_devices,
                                ARRAY_SIZE(mx31ads_i2c1_devices));
@@ -486,7 +486,7 @@ static unsigned int ssi_pins[] = {
        MX31_PIN_STXD5__STXD5,
 };
-static void mxc_init_audio(void)
+static void __init mxc_init_audio(void)
 {
        imx31_add_imx_ssi(0, NULL);
        mxc_iomux_setup_multiple_pins(ssi_pins, ARRAY_SIZE(ssi_pins), "ssi");
diff --git a/arch/arm/mach-imx/mach-mx31lilly.c b/arch/arm/mach-imx/mach-mx31lilly.c
index 750368ddf0f9..126913ad106a 100644
--- a/arch/arm/mach-imx/mach-mx31lilly.c
+++ b/arch/arm/mach-imx/mach-mx31lilly.c
@@ -192,7 +192,7 @@ static struct mxc_usbh_platform_data usbh2_pdata __initdata = {
        .portsc = MXC_EHCI_MODE_ULPI | MXC_EHCI_UTMI_8BIT,
 };
-static void lilly1131_usb_init(void)
+static void __init lilly1131_usb_init(void)
 {
        imx31_add_mxc_ehci_hs(1, &usbh1_pdata);
diff --git a/arch/arm/mach-mmp/gplugd.c b/arch/arm/mach-mmp/gplugd.c
index c070c24255f4..98e25d9aaab6 100644
--- a/arch/arm/mach-mmp/gplugd.c
+++ b/arch/arm/mach-mmp/gplugd.c
@@ -16,16 +16,18 @@
 #include <mach/gpio.h>
 #include <mach/pxa168.h>
 #include <mach/mfp-pxa168.h>
-#include <mach/mfp-gplugd.h>
 #include "common.h"
 static unsigned long gplugd_pin_config[] __initdata = {
        /* UART3 */
-        GPIO8_UART3_SOUT,
+        GPIO8_UART3_TXD,
-        GPIO9_UART3_SIN,
+        GPIO9_UART3_RXD,
-        GPI1O_UART3_CTS,
+        GPIO1O_UART3_CTS,
-        GPI11_UART3_RTS,
+        GPIO11_UART3_RTS,
+        /* USB OTG PEN */
+        GPIO18_GPIO,
        /* MMC2 */
        GPIO28_MMC2_CMD,
@@ -109,6 +111,12 @@ static unsigned long gplugd_pin_config[] __initdata = {
        GPIO105_CI2C_SDA,
        GPIO106_CI2C_SCL,
+        /* SPI NOR Flash on SSP2 */
+        GPIO107_SSP2_RXD,
+        GPIO108_SSP2_TXD,
+        GPIO110_GPIO,     /* SPI_CSn */
+        GPIO111_SSP2_CLK,
        /* Select JTAG */
        GPIO109_GPIO,
@@ -154,7 +162,7 @@ static void __init select_disp_freq(void)
                                "frequency\n");
        } else {
                gpio_direction_output(35, 1);
-                gpio_free(104);
+                gpio_free(35);
        }
        if (unlikely(gpio_request(85, "DISP_FREQ_SEL_2"))) {
@@ -162,7 +170,7 @@ static void __init select_disp_freq(void)
                                "frequency\n");
        } else {
                gpio_direction_output(85, 0);
-                gpio_free(104);
+                gpio_free(85);
        }
 }
diff --git a/arch/arm/mach-mmp/include/mach/mfp-gplugd.h b/arch/arm/mach-mmp/include/mach/mfp-gplugd.h
deleted file mode 100644
index b8cf38d85600..000000000000
--- a/arch/arm/mach-mmp/include/mach/mfp-gplugd.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * linux/arch/arm/mach-mmp/include/mach/mfp-gplugd.h
- *
- *   MFP definitions used in gplugD
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef __MACH_MFP_GPLUGD_H
-#define __MACH_MFP_GPLUGD_H
-#include <plat/mfp.h>
-#include <mach/mfp.h>
-/* UART3 */
-#define GPIO8_UART3_SOUT       MFP_CFG(GPIO8, AF2)
-#define GPIO9_UART3_SIN        MFP_CFG(GPIO9, AF2)
-#define GPI1O_UART3_CTS        MFP_CFG(GPIO10, AF2)
-#define GPI11_UART3_RTS        MFP_CFG(GPIO11, AF2)
-/* MMC2 */
-#define GPIO28_MMC2_CMD         MFP_CFG_DRV(GPIO28, AF6, FAST)
-#define GPIO29_MMC2_CLK         MFP_CFG_DRV(GPIO29, AF6, FAST)
-#define GPIO30_MMC2_DAT0        MFP_CFG_DRV(GPIO30, AF6, FAST)
-#define GPIO31_MMC2_DAT1        MFP_CFG_DRV(GPIO31, AF6, FAST)
-#define GPIO32_MMC2_DAT2        MFP_CFG_DRV(GPIO32, AF6, FAST)
-#define GPIO33_MMC2_DAT3        MFP_CFG_DRV(GPIO33, AF6, FAST)
-/* I2S */
-#undef GPIO114_I2S_FRM
-#undef GPIO115_I2S_BCLK
-#define GPIO114_I2S_FRM         MFP_CFG_DRV(GPIO114, AF1, FAST)
-#define GPIO115_I2S_BCLK        MFP_CFG_DRV(GPIO115, AF1, FAST)
-#define GPIO116_I2S_TXD         MFP_CFG_DRV(GPIO116, AF1, FAST)
-/* MMC4 */
-#define GPIO125_MMC4_DAT3       MFP_CFG_DRV(GPIO125, AF7, FAST)
-#define GPIO126_MMC4_DAT2       MFP_CFG_DRV(GPIO126, AF7, FAST)
-#define GPIO127_MMC4_DAT1       MFP_CFG_DRV(GPIO127, AF7, FAST)
-#define GPIO0_2_MMC4_DAT0       MFP_CFG_DRV(GPIO0_2, AF7, FAST)
-#define GPIO1_2_MMC4_CMD        MFP_CFG_DRV(GPIO1_2, AF7, FAST)
-#define GPIO2_2_MMC4_CLK        MFP_CFG_DRV(GPIO2_2, AF7, FAST)
-/* OTG GPIO */
-#define GPIO_USB_OTG_PEN        18
-#define GPIO_USB_OIDIR          20
-/* Other GPIOs are 35, 84, 85 */
-#endif /* __MACH_MFP_GPLUGD_H */
diff --git a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
index 8c782328b21c..92aaa3c19d61 100644
--- a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
+++ b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
@@ -203,6 +203,10 @@
 #define GPIO33_CF_nCD2          MFP_CFG(GPIO33, AF3)
 /* UART */
+#define GPIO8_UART3_TXD         MFP_CFG(GPIO8, AF2)
+#define GPIO9_UART3_RXD         MFP_CFG(GPIO9, AF2)
+#define GPIO1O_UART3_CTS        MFP_CFG(GPIO10, AF2)
+#define GPIO11_UART3_RTS        MFP_CFG(GPIO11, AF2)
 #define GPIO88_UART2_TXD        MFP_CFG(GPIO88, AF2)
 #define GPIO89_UART2_RXD        MFP_CFG(GPIO89, AF2)
 #define GPIO107_UART1_TXD       MFP_CFG_DRV(GPIO107, AF1, FAST)
@@ -232,6 +236,22 @@
 #define GPIO53_MMC1_CD          MFP_CFG(GPIO53, AF1)
 #define GPIO46_MMC1_WP          MFP_CFG(GPIO46, AF1)
+/* MMC2 */
+#define GPIO28_MMC2_CMD         MFP_CFG_DRV(GPIO28, AF6, FAST)
+#define GPIO29_MMC2_CLK         MFP_CFG_DRV(GPIO29, AF6, FAST)
+#define GPIO30_MMC2_DAT0        MFP_CFG_DRV(GPIO30, AF6, FAST)
+#define GPIO31_MMC2_DAT1        MFP_CFG_DRV(GPIO31, AF6, FAST)
+#define GPIO32_MMC2_DAT2        MFP_CFG_DRV(GPIO32, AF6, FAST)
+#define GPIO33_MMC2_DAT3        MFP_CFG_DRV(GPIO33, AF6, FAST)
+/* MMC4 */
+#define GPIO125_MMC4_DAT3       MFP_CFG_DRV(GPIO125, AF7, FAST)
+#define GPIO126_MMC4_DAT2       MFP_CFG_DRV(GPIO126, AF7, FAST)
+#define GPIO127_MMC4_DAT1       MFP_CFG_DRV(GPIO127, AF7, FAST)
+#define GPIO0_2_MMC4_DAT0       MFP_CFG_DRV(GPIO0_2, AF7, FAST)
+#define GPIO1_2_MMC4_CMD        MFP_CFG_DRV(GPIO1_2, AF7, FAST)
+#define GPIO2_2_MMC4_CLK        MFP_CFG_DRV(GPIO2_2, AF7, FAST)
 /* LCD */
 #define GPIO84_LCD_CS           MFP_CFG(GPIO84, AF1)
 #define GPIO60_LCD_DD0          MFP_CFG(GPIO60, AF1)
@@ -269,11 +289,12 @@
 #define GPIO106_CI2C_SCL        MFP_CFG(GPIO106, AF1)
 /* I2S */
-#define GPIO113_I2S_MCLK        MFP_CFG(GPIO113,AF6)
+#define GPIO113_I2S_MCLK        MFP_CFG(GPIO113, AF6)
-#define GPIO114_I2S_FRM         MFP_CFG(GPIO114,AF1)
+#define GPIO114_I2S_FRM         MFP_CFG(GPIO114, AF1)
-#define GPIO115_I2S_BCLK        MFP_CFG(GPIO115,AF1)
+#define GPIO115_I2S_BCLK        MFP_CFG(GPIO115, AF1)
-#define GPIO116_I2S_RXD         MFP_CFG(GPIO116,AF2)
+#define GPIO116_I2S_RXD         MFP_CFG(GPIO116, AF2)
-#define GPIO117_I2S_TXD         MFP_CFG(GPIO117,AF2)
+#define GPIO116_I2S_TXD         MFP_CFG(GPIO116, AF1)
+#define GPIO117_I2S_TXD         MFP_CFG(GPIO117, AF2)
 /* PWM */
 #define GPIO96_PWM3_OUT         MFP_CFG(GPIO96, AF1)
@@ -324,4 +345,10 @@
 #define GPIO101_MII_MDIO        MFP_CFG(GPIO101, AF5)
 #define GPIO103_RX_DV           MFP_CFG(GPIO103, AF5)
+/* SSP2 */
+#define GPIO107_SSP2_RXD        MFP_CFG(GPIO107, AF4)
+#define GPIO108_SSP2_TXD        MFP_CFG(GPIO108, AF4)
+#define GPIO111_SSP2_CLK        MFP_CFG(GPIO111, AF4)
+#define GPIO112_SSP2_FRM        MFP_CFG(GPIO112, AF4)
 #endif /* __ASM_MACH_MFP_PXA168_H */
diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c
index 99833b9485cf..4e91ee6e27c8 100644
--- a/arch/arm/mach-mmp/time.c
+++ b/arch/arm/mach-mmp/time.c
@@ -51,12 +51,12 @@ static inline uint32_t timer_read(void)
 {
        int delay = 100;
-        __raw_writel(1, TIMERS_VIRT_BASE + TMR_CVWR(0));
+        __raw_writel(1, TIMERS_VIRT_BASE + TMR_CVWR(1));
        while (delay--)
                cpu_relax();
-        return __raw_readl(TIMERS_VIRT_BASE + TMR_CVWR(0));
+        return __raw_readl(TIMERS_VIRT_BASE + TMR_CVWR(1));
 }
 unsigned long long notrace sched_clock(void)
@@ -75,28 +75,51 @@ static irqreturn_t timer_interrupt(int irq, void *dev_id)
 {
        struct clock_event_device *c = dev_id;
-        /* disable and clear pending interrupt status */
+        /*
-        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_IER(0));
+         * Clear pending interrupt status.
-        __raw_writel(0x1, TIMERS_VIRT_BASE + TMR_ICR(0));
+         */
+        __raw_writel(0x01, TIMERS_VIRT_BASE + TMR_ICR(0));
+        /*
+         * Disable timer 0.
+         */
+        __raw_writel(0x02, TIMERS_VIRT_BASE + TMR_CER);
        c->event_handler(c);
        return IRQ_HANDLED;
 }
 static int timer_set_next_event(unsigned long delta,
                                struct clock_event_device *dev)
 {
-        unsigned long flags, next;
+        unsigned long flags;
        local_irq_save(flags);
-        /* clear pending interrupt status and enable */
+        /*
+         * Disable timer 0.
+         */
+        __raw_writel(0x02, TIMERS_VIRT_BASE + TMR_CER);
+        /*
+         * Clear and enable timer match 0 interrupt.
+         */
        __raw_writel(0x01, TIMERS_VIRT_BASE + TMR_ICR(0));
        __raw_writel(0x01, TIMERS_VIRT_BASE + TMR_IER(0));
-        next = timer_read() + delta;
+        /*
-        __raw_writel(next, TIMERS_VIRT_BASE + TMR_TN_MM(0, 0));
+         * Setup new clockevent timer value.
+         */
+        __raw_writel(delta - 1, TIMERS_VIRT_BASE + TMR_TN_MM(0, 0));
+        /*
+         * Enable timer 0.
+         */
+        __raw_writel(0x03, TIMERS_VIRT_BASE + TMR_CER);
        local_irq_restore(flags);
        return 0;
 }
@@ -145,23 +168,26 @@ static struct clocksource cksrc = {
 static void __init timer_config(void)
 {
        uint32_t ccr = __raw_readl(TIMERS_VIRT_BASE + TMR_CCR);
-        uint32_t cer = __raw_readl(TIMERS_VIRT_BASE + TMR_CER);
-        uint32_t cmr = __raw_readl(TIMERS_VIRT_BASE + TMR_CMR);
-        __raw_writel(cer & ~0x1, TIMERS_VIRT_BASE + TMR_CER); /* disable */
+        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_CER); /* disable */
-        ccr &= (cpu_is_mmp2()) ? TMR_CCR_CS_0(0) : TMR_CCR_CS_0(3);
+        ccr &= (cpu_is_mmp2()) ? (TMR_CCR_CS_0(0) | TMR_CCR_CS_1(0)) :
+                (TMR_CCR_CS_0(3) | TMR_CCR_CS_1(3));
        __raw_writel(ccr, TIMERS_VIRT_BASE + TMR_CCR);
-        /* free-running mode */
+        /* set timer 0 to periodic mode, and timer 1 to free-running mode */
-        __raw_writel(cmr | 0x01, TIMERS_VIRT_BASE + TMR_CMR);
+        __raw_writel(0x2, TIMERS_VIRT_BASE + TMR_CMR);
-        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_PLCR(0)); /* free-running */
+        __raw_writel(0x1, TIMERS_VIRT_BASE + TMR_PLCR(0)); /* periodic */
        __raw_writel(0x7, TIMERS_VIRT_BASE + TMR_ICR(0));  /* clear status */
        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_IER(0));
-        /* enable timer counter */
+        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_PLCR(1)); /* free-running */
-        __raw_writel(cer | 0x01, TIMERS_VIRT_BASE + TMR_CER);
+        __raw_writel(0x7, TIMERS_VIRT_BASE + TMR_ICR(1));  /* clear status */
+        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_IER(1));
+        /* enable timer 1 counter */
+        __raw_writel(0x2, TIMERS_VIRT_BASE + TMR_CER);
 }
 static struct irqaction timer_irq = {
diff --git a/arch/arm/mach-mx5/board-cpuimx51.c b/arch/arm/mach-mx5/board-cpuimx51.c
index 7c893fa70266..68934ea8725a 100644
--- a/arch/arm/mach-mx5/board-cpuimx51.c
+++ b/arch/arm/mach-mx5/board-cpuimx51.c
@@ -81,7 +81,7 @@ static struct plat_serial8250_port serial_platform_data[] = {
                .flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_IOREMAP,
        }, {
                .mapbase = (unsigned long)(MX51_CS1_BASE_ADDR + 0x2000000),
-                .irq = irq_to_gpio(CPUIMX51_QUARTD_GPIO),
+                .irq = gpio_to_irq(CPUIMX51_QUARTD_GPIO),
                .irqflags = IRQF_TRIGGER_HIGH,
                .uartclk = CPUIMX51_QUART_XTAL,
                .regshift = CPUIMX51_QUART_REGSHIFT,
diff --git a/arch/arm/mach-mx5/board-mx51_babbage.c b/arch/arm/mach-mx5/board-mx51_babbage.c
index e400b09109ce..11b0ff67f89d 100644
--- a/arch/arm/mach-mx5/board-mx51_babbage.c
+++ b/arch/arm/mach-mx5/board-mx51_babbage.c
@@ -369,7 +369,7 @@ static void __init mx51_babbage_init(void)
                                        ARRAY_SIZE(mx51babbage_pads));
        imx51_add_imx_uart(0, &uart_pdata);
-        imx51_add_imx_uart(1, &uart_pdata);
+        imx51_add_imx_uart(1, NULL);
        imx51_add_imx_uart(2, &uart_pdata);
        babbage_fec_reset();
diff --git a/arch/arm/mach-mx5/board-mx51_efikamx.c b/arch/arm/mach-mx5/board-mx51_efikamx.c
index f70700dc0ec1..551daf85ff8c 100644
--- a/arch/arm/mach-mx5/board-mx51_efikamx.c
+++ b/arch/arm/mach-mx5/board-mx51_efikamx.c
@@ -108,9 +108,9 @@ static void __init mx51_efikamx_board_id(void)
        gpio_request(EFIKAMX_PCBID2, "pcbid2");
        gpio_direction_input(EFIKAMX_PCBID2);
-        id = gpio_get_value(EFIKAMX_PCBID0);
+        id = gpio_get_value(EFIKAMX_PCBID0) ? 1 : 0;
-        id |= gpio_get_value(EFIKAMX_PCBID1) << 1;
+        id |= (gpio_get_value(EFIKAMX_PCBID1) ? 1 : 0) << 1;
-        id |= gpio_get_value(EFIKAMX_PCBID2) << 2;
+        id |= (gpio_get_value(EFIKAMX_PCBID2) ? 1 : 0) << 2;
        switch (id) {
        case 7:
diff --git a/arch/arm/mach-mx5/board-mx51_efikasb.c b/arch/arm/mach-mx5/board-mx51_efikasb.c
index 2e4d9d32a87c..8a9bca22beb5 100644
--- a/arch/arm/mach-mx5/board-mx51_efikasb.c
+++ b/arch/arm/mach-mx5/board-mx51_efikasb.c
@@ -156,23 +156,24 @@ static struct gpio_keys_button mx51_efikasb_keys[] = {
        {
                .code = KEY_POWER,
                .gpio = EFIKASB_PWRKEY,
-                .type = EV_PWR,
+                .type = EV_KEY,
                .desc = "Power Button",
                .wakeup = 1,
-                .debounce_interval = 10, /* ms */
+                .active_low = 1,
        },
        {
                .code = SW_LID,
                .gpio = EFIKASB_LID,
                .type = EV_SW,
                .desc = "Lid Switch",
+                .active_low = 1,
        },
        {
-                /* SW_RFKILLALL vs KEY_RFKILL ? */
+                .code = KEY_RFKILL,
-                .code = SW_RFKILL_ALL,
                .gpio = EFIKASB_RFKILL,
-                .type = EV_SW,
+                .type = EV_KEY,
                .desc = "rfkill",
+                .active_low = 1,
        },
 };
@@ -224,8 +225,8 @@ static void __init mx51_efikasb_board_id(void)
        gpio_request(EFIKASB_PCBID1, "pcb id1");
        gpio_direction_input(EFIKASB_PCBID1);
-        id = gpio_get_value(EFIKASB_PCBID0);
+        id = gpio_get_value(EFIKASB_PCBID0) ? 1 : 0;
-        id |= gpio_get_value(EFIKASB_PCBID1) << 1;
+        id |= (gpio_get_value(EFIKASB_PCBID1) ? 1 : 0) << 1;
        switch (id) {
        default:
diff --git a/arch/arm/mach-mx5/clock-mx51-mx53.c b/arch/arm/mach-mx5/clock-mx51-mx53.c
index 7f20308c4dbd..f7bf996f463b 100644
--- a/arch/arm/mach-mx5/clock-mx51-mx53.c
+++ b/arch/arm/mach-mx5/clock-mx51-mx53.c
@@ -271,7 +271,11 @@ static int _clk_pll_enable(struct clk *clk)
        int i = 0;
        pllbase = _get_pll_base(clk);
-        reg = __raw_readl(pllbase + MXC_PLL_DP_CTL) | MXC_PLL_DP_CTL_UPEN;
+        reg = __raw_readl(pllbase + MXC_PLL_DP_CTL);
+        if (reg & MXC_PLL_DP_CTL_UPEN)
+                return 0;
+        reg |= MXC_PLL_DP_CTL_UPEN;
        __raw_writel(reg, pllbase + MXC_PLL_DP_CTL);
        /* Wait for lock */
diff --git a/arch/arm/mach-mx5/mx51_efika.c b/arch/arm/mach-mx5/mx51_efika.c
index 4435e03cea5d..c9209454807a 100644
--- a/arch/arm/mach-mx5/mx51_efika.c
+++ b/arch/arm/mach-mx5/mx51_efika.c
@@ -186,7 +186,7 @@ static int initialize_usbh1_port(struct platform_device *pdev)
        mdelay(10);
-        return mx51_initialize_usb_hw(0, MXC_EHCI_ITC_NO_THRESHOLD);
+        return mx51_initialize_usb_hw(pdev->id, MXC_EHCI_ITC_NO_THRESHOLD);
 }
 static struct mxc_usbh_platform_data usbh1_config = {
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 4ae6257b39a4..57b66d590c52 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -7,7 +7,6 @@ config ARCH_OMAP2PLUS_TYPICAL
        default y
        select AEABI
        select REGULATOR
-        select PM
        select PM_RUNTIME
        select VFP
        select NEON if ARCH_OMAP3 || ARCH_OMAP4
diff --git a/arch/arm/mach-omap2/board-am3517crane.c b/arch/arm/mach-omap2/board-am3517crane.c
index 5f2b55ff04ff..933e9353cb37 100644
--- a/arch/arm/mach-omap2/board-am3517crane.c
+++ b/arch/arm/mach-omap2/board-am3517crane.c
@@ -45,8 +45,6 @@ static struct omap_board_config_kernel am3517_crane_config[] __initdata = {
 static struct omap_board_mux board_mux[] __initdata = {
        { .reg_offset = OMAP_MUX_TERMINATOR },
 };
-#else
-#define board_mux       NULL
 #endif
 static void __init am3517_crane_init_early(void)
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index 32f5f895568a..3ae16b4e3f52 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -491,23 +491,22 @@ static void __init beagle_opp_init(void)
        /* Custom OPP enabled for all xM versions */
        if (cpu_is_omap3630()) {
-                struct omap_hwmod *mh = omap_hwmod_lookup("mpu");
+                struct device *mpu_dev, *iva_dev;
-                struct omap_hwmod *dh = omap_hwmod_lookup("iva");
-                struct device *dev;
-                if (!mh || !dh) {
+                mpu_dev = omap2_get_mpuss_device();
+                iva_dev = omap2_get_iva_device();
+                if (!mpu_dev || !iva_dev) {
                        pr_err("%s: Aiee.. no mpu/dsp devices? %p %p\n",
-                                __func__, mh, dh);
+                                __func__, mpu_dev, iva_dev);
                        return;
                }
                /* Enable MPU 1GHz and lower opps */
-                dev = &mh->od->pdev.dev;
+                r = opp_enable(mpu_dev, 800000000);
-                r = opp_enable(dev, 800000000);
                /* TODO: MPU 1GHz needs SR and ABB */
                /* Enable IVA 800MHz and lower opps */
-                dev = &dh->od->pdev.dev;
+                r |= opp_enable(iva_dev, 660000000);
-                r |= opp_enable(dev, 660000000);
                /* TODO: DSP 800MHz needs SR and ABB */
                if (r) {
                        pr_err("%s: failed to enable higher opp %d\n",
@@ -516,10 +515,8 @@ static void __init beagle_opp_init(void)
                         * Cleanup - disable the higher freqs - we dont care
                         * about the results
                         */
-                        dev = &mh->od->pdev.dev;
+                        opp_disable(mpu_dev, 800000000);
-                        opp_disable(dev, 800000000);
+                        opp_disable(iva_dev, 660000000);
-                        dev = &dh->od->pdev.dev;
-                        opp_disable(dev, 660000000);
                }
        }
        return;
diff --git a/arch/arm/mach-omap2/cminst44xx.h b/arch/arm/mach-omap2/cminst44xx.h
index f2ea6453ade0..a018a7327879 100644
--- a/arch/arm/mach-omap2/cminst44xx.h
+++ b/arch/arm/mach-omap2/cminst44xx.h
@@ -18,13 +18,36 @@ extern void omap4_cminst_clkdm_force_sleep(u8 part, s16 inst, u16 cdoffs);
 extern void omap4_cminst_clkdm_force_wakeup(u8 part, s16 inst, u16 cdoffs);
 extern int omap4_cminst_wait_module_ready(u8 part, u16 inst, s16 cdoffs, u16 clkctrl_offs);
-extern int omap4_cminst_wait_module_idle(u8 part, u16 inst, s16 cdoffs, u16 clkctrl_offs);
+# ifdef CONFIG_ARCH_OMAP4
+extern int omap4_cminst_wait_module_idle(u8 part, u16 inst, s16 cdoffs,
+                                         u16 clkctrl_offs);
 extern void omap4_cminst_module_enable(u8 mode, u8 part, u16 inst, s16 cdoffs,
                                       u16 clkctrl_offs);
 extern void omap4_cminst_module_disable(u8 part, u16 inst, s16 cdoffs,
                                        u16 clkctrl_offs);
+# else
+static inline int omap4_cminst_wait_module_idle(u8 part, u16 inst, s16 cdoffs,
+                                        u16 clkctrl_offs)
+{
+        return 0;
+}
+static inline void omap4_cminst_module_enable(u8 mode, u8 part, u16 inst,
+                                s16 cdoffs, u16 clkctrl_offs)
+{
+}
+static inline void omap4_cminst_module_disable(u8 part, u16 inst, s16 cdoffs,
+                                 u16 clkctrl_offs)
+{
+}
+# endif
 /*
 * In an ideal world, we would not export these low-level functions,
 * but this will probably take some time to fix properly
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index c7fb22abc219..655e9480eb98 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -821,11 +821,10 @@ static void __init omap_mux_set_cmdline_signals(void)
        if (!omap_mux_options)
                return;
-        options = kmalloc(strlen(omap_mux_options) + 1, GFP_KERNEL);
+        options = kstrdup(omap_mux_options, GFP_KERNEL);
        if (!options)
                return;
-        strcpy(options, omap_mux_options);
        next_opt = options;
        while ((token = strsep(&next_opt, ",")) != NULL) {
@@ -855,24 +854,19 @@ static int __init omap_mux_copy_names(struct omap_mux *src,
        for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
                if (src->muxnames[i]) {
-                        dst->muxnames[i] =
+                        dst->muxnames[i] = kstrdup(src->muxnames[i],
-                                kmalloc(strlen(src->muxnames[i]) + 1,
+                                                   GFP_KERNEL);
-                                        GFP_KERNEL);
                        if (!dst->muxnames[i])
                                goto free;
-                        strcpy(dst->muxnames[i], src->muxnames[i]);
                }
        }
 #ifdef CONFIG_DEBUG_FS
        for (i = 0; i < OMAP_MUX_NR_SIDES; i++) {
                if (src->balls[i]) {
-                        dst->balls[i] =
+                        dst->balls[i] = kstrdup(src->balls[i], GFP_KERNEL);
-                                kmalloc(strlen(src->balls[i]) + 1,
-                                        GFP_KERNEL);
                        if (!dst->balls[i])
                                goto free;
-                        strcpy(dst->balls[i], src->balls[i]);
                }
        }
 #endif
diff --git a/arch/arm/mach-omap2/smartreflex.c b/arch/arm/mach-omap2/smartreflex.c
index 2ce2fb7664bc..34c01a7de810 100644
--- a/arch/arm/mach-omap2/smartreflex.c
+++ b/arch/arm/mach-omap2/smartreflex.c
@@ -621,7 +621,7 @@ void sr_disable(struct voltagedomain *voltdm)
                        sr_v2_disable(sr);
        }
-        pm_runtime_put_sync(&sr->pdev->dev);
+        pm_runtime_put_sync_suspend(&sr->pdev->dev);
 }
 /**
@@ -860,6 +860,7 @@ static int __init omap_sr_probe(struct platform_device *pdev)
        irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
        pm_runtime_enable(&pdev->dev);
+        pm_runtime_irq_safe(&pdev->dev);
        sr_info->pdev = pdev;
        sr_info->srid = pdev->id;
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index e9640728239b..cf1de7d2630d 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -293,7 +293,8 @@ static void __init omap2_gp_clocksource_init(int gptimer_id,
        pr_info("OMAP clocksource: GPTIMER%d at %lu Hz\n",
                gptimer_id, clksrc.rate);
-        __omap_dm_timer_load_start(clksrc.io_base, OMAP_TIMER_CTRL_ST, 0, 1);
+        __omap_dm_timer_load_start(clksrc.io_base,
+                        OMAP_TIMER_CTRL_ST | OMAP_TIMER_CTRL_AR, 0, 1);
        init_sched_clock(&cd, dmtimer_update_sched_clock, 32, clksrc.rate);
        if (clocksource_register_hz(&clocksource_gpt, clksrc.rate))
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 2543342dbccb..daa056ed8738 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -48,14 +48,7 @@ void __init omap_pmic_init(int bus, u32 clkrate,
        omap_register_i2c_bus(bus, clkrate, &pmic_i2c_board_info, 1);
 }
-static struct twl4030_usb_data omap4_usb_pdata = {
+#if defined(CONFIG_ARCH_OMAP3)
-        .phy_init       = omap4430_phy_init,
-        .phy_exit       = omap4430_phy_exit,
-        .phy_power      = omap4430_phy_power,
-        .phy_set_clock  = omap4430_phy_set_clk,
-        .phy_suspend    = omap4430_phy_suspend,
-};
 static struct twl4030_usb_data omap3_usb_pdata = {
        .usb_mode       = T2_USB_MODE_ULPI,
 };
@@ -122,6 +115,45 @@ static struct regulator_init_data omap3_vpll2_idata = {
        .consumer_supplies              = omap3_vpll2_supplies,
 };
+void __init omap3_pmic_get_config(struct twl4030_platform_data *pmic_data,
+                                  u32 pdata_flags, u32 regulators_flags)
+{
+        if (!pmic_data->irq_base)
+                pmic_data->irq_base = TWL4030_IRQ_BASE;
+        if (!pmic_data->irq_end)
+                pmic_data->irq_end = TWL4030_IRQ_END;
+        /* Common platform data configurations */
+        if (pdata_flags & TWL_COMMON_PDATA_USB && !pmic_data->usb)
+                pmic_data->usb = &omap3_usb_pdata;
+        if (pdata_flags & TWL_COMMON_PDATA_BCI && !pmic_data->bci)
+                pmic_data->bci = &omap3_bci_pdata;
+        if (pdata_flags & TWL_COMMON_PDATA_MADC && !pmic_data->madc)
+                pmic_data->madc = &omap3_madc_pdata;
+        if (pdata_flags & TWL_COMMON_PDATA_AUDIO && !pmic_data->audio)
+                pmic_data->audio = &omap3_audio_pdata;
+        /* Common regulator configurations */
+        if (regulators_flags & TWL_COMMON_REGULATOR_VDAC && !pmic_data->vdac)
+                pmic_data->vdac = &omap3_vdac_idata;
+        if (regulators_flags & TWL_COMMON_REGULATOR_VPLL2 && !pmic_data->vpll2)
+                pmic_data->vpll2 = &omap3_vpll2_idata;
+}
+#endif /* CONFIG_ARCH_OMAP3 */
+#if defined(CONFIG_ARCH_OMAP4)
+static struct twl4030_usb_data omap4_usb_pdata = {
+        .phy_init       = omap4430_phy_init,
+        .phy_exit       = omap4430_phy_exit,
+        .phy_power      = omap4430_phy_power,
+        .phy_set_clock  = omap4430_phy_set_clk,
+        .phy_suspend    = omap4430_phy_suspend,
+};
 static struct regulator_init_data omap4_vdac_idata = {
        .constraints = {
                .min_uV                 = 1800000,
@@ -273,32 +305,4 @@ void __init omap4_pmic_get_config(struct twl4030_platform_data *pmic_data,
            !pmic_data->clk32kg)
                pmic_data->clk32kg = &omap4_clk32kg_idata;
 }
+#endif /* CONFIG_ARCH_OMAP4 */
-void __init omap3_pmic_get_config(struct twl4030_platform_data *pmic_data,
-                                  u32 pdata_flags, u32 regulators_flags)
-{
-        if (!pmic_data->irq_base)
-                pmic_data->irq_base = TWL4030_IRQ_BASE;
-        if (!pmic_data->irq_end)
-                pmic_data->irq_end = TWL4030_IRQ_END;
-        /* Common platform data configurations */
-        if (pdata_flags & TWL_COMMON_PDATA_USB && !pmic_data->usb)
-                pmic_data->usb = &omap3_usb_pdata;
-        if (pdata_flags & TWL_COMMON_PDATA_BCI && !pmic_data->bci)
-                pmic_data->bci = &omap3_bci_pdata;
-        if (pdata_flags & TWL_COMMON_PDATA_MADC && !pmic_data->madc)
-                pmic_data->madc = &omap3_madc_pdata;
-        if (pdata_flags & TWL_COMMON_PDATA_AUDIO && !pmic_data->audio)
-                pmic_data->audio = &omap3_audio_pdata;
-        /* Common regulator configurations */
-        if (regulators_flags & TWL_COMMON_REGULATOR_VDAC && !pmic_data->vdac)
-                pmic_data->vdac = &omap3_vdac_idata;
-        if (regulators_flags & TWL_COMMON_REGULATOR_VPLL2 && !pmic_data->vpll2)
-                pmic_data->vpll2 = &omap3_vpll2_idata;
-}
diff --git a/arch/arm/mach-sa1100/pci-nanoengine.c b/arch/arm/mach-sa1100/pci-nanoengine.c
index 964c6c3cd7a6..dd39fee59549 100644
--- a/arch/arm/mach-sa1100/pci-nanoengine.c
+++ b/arch/arm/mach-sa1100/pci-nanoengine.c
@@ -28,6 +28,7 @@
 #include <asm/mach-types.h>
 #include <mach/nanoengine.h>
+#include <mach/hardware.h>
 static DEFINE_SPINLOCK(nano_lock);
diff --git a/arch/arm/plat-mxc/include/mach/debug-macro.S b/arch/arm/plat-mxc/include/mach/debug-macro.S
index 91fc7cdb5dc9..e4dde91f0231 100644
--- a/arch/arm/plat-mxc/include/mach/debug-macro.S
+++ b/arch/arm/plat-mxc/include/mach/debug-macro.S
@@ -44,6 +44,14 @@
 #define UART_PADDR      MX51_UART1_BASE_ADDR
 #endif
+/* iMX50/53 have same addresses, but not iMX51 */
+#if defined(CONFIG_SOC_IMX50) || defined(CONFIG_SOC_IMX53)
+#ifdef UART_PADDR
+#error "CONFIG_DEBUG_LL is incompatible with multiple archs"
+#endif
+#define UART_PADDR      MX53_UART1_BASE_ADDR
+#endif
 #define UART_VADDR      IMX_IO_ADDRESS(UART_PADDR)
                .macro  addruart, rp, rv
diff --git a/arch/arm/plat-mxc/include/mach/iomux-mx53.h b/arch/arm/plat-mxc/include/mach/iomux-mx53.h
index 9440b9e00e89..5408fd1fc736 100644
--- a/arch/arm/plat-mxc/include/mach/iomux-mx53.h
+++ b/arch/arm/plat-mxc/include/mach/iomux-mx53.h
@@ -30,6 +30,9 @@
 #define MX53_SDHC_PAD_CTRL      (PAD_CTL_HYS | PAD_CTL_PKE | PAD_CTL_PUE | \
                                PAD_CTL_PUS_47K_UP | PAD_CTL_DSE_HIGH | \
                                PAD_CTL_SRE_FAST)
+#define PAD_CTRL_I2C    (PAD_CTL_SRE_FAST | PAD_CTL_ODE | PAD_CTL_PKE | \
+                        PAD_CTL_PUE | PAD_CTL_DSE_HIGH | PAD_CTL_PUS_100K_UP \
+                        | PAD_CTL_HYS)
 #define _MX53_PAD_GPIO_19__KPP_COL_5            IOMUX_PAD(0x348, 0x20, 0, 0x840, 0, 0)
 #define _MX53_PAD_GPIO_19__GPIO4_5              IOMUX_PAD(0x348, 0x20, 1, 0x0, 0, 0)
@@ -1256,7 +1259,7 @@
 #define MX53_PAD_KEY_COL3__GPIO4_12             (_MX53_PAD_KEY_COL3__GPIO4_12 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__USBOH3_H2_DP         (_MX53_PAD_KEY_COL3__USBOH3_H2_DP | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__SPDIF_IN1            (_MX53_PAD_KEY_COL3__SPDIF_IN1 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_KEY_COL3__I2C2_SCL             (_MX53_PAD_KEY_COL3__I2C2_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_KEY_COL3__I2C2_SCL             (_MX53_PAD_KEY_COL3__I2C2_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_KEY_COL3__ECSPI1_SS3           (_MX53_PAD_KEY_COL3__ECSPI1_SS3 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__FEC_CRS              (_MX53_PAD_KEY_COL3__FEC_CRS | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__USBPHY1_SIECLOCK             (_MX53_PAD_KEY_COL3__USBPHY1_SIECLOCK | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1264,7 +1267,7 @@
 #define MX53_PAD_KEY_ROW3__GPIO4_13             (_MX53_PAD_KEY_ROW3__GPIO4_13 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__USBOH3_H2_DM         (_MX53_PAD_KEY_ROW3__USBOH3_H2_DM | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__CCM_ASRC_EXT_CLK             (_MX53_PAD_KEY_ROW3__CCM_ASRC_EXT_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_KEY_ROW3__I2C2_SDA             (_MX53_PAD_KEY_ROW3__I2C2_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_KEY_ROW3__I2C2_SDA             (_MX53_PAD_KEY_ROW3__I2C2_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_KEY_ROW3__OSC32K_32K_OUT               (_MX53_PAD_KEY_ROW3__OSC32K_32K_OUT | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__CCM_PLL4_BYP         (_MX53_PAD_KEY_ROW3__CCM_PLL4_BYP | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__USBPHY1_LINESTATE_0          (_MX53_PAD_KEY_ROW3__USBPHY1_LINESTATE_0 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1536,7 +1539,7 @@
 #define MX53_PAD_CSI0_DAT8__KPP_COL_7           (_MX53_PAD_CSI0_DAT8__KPP_COL_7 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT8__ECSPI2_SCLK         (_MX53_PAD_CSI0_DAT8__ECSPI2_SCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT8__USBOH3_USBH3_OC             (_MX53_PAD_CSI0_DAT8__USBOH3_USBH3_OC | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_CSI0_DAT8__I2C1_SDA            (_MX53_PAD_CSI0_DAT8__I2C1_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_CSI0_DAT8__I2C1_SDA            (_MX53_PAD_CSI0_DAT8__I2C1_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_CSI0_DAT8__EMI_EMI_DEBUG_37            (_MX53_PAD_CSI0_DAT8__EMI_EMI_DEBUG_37 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT8__TPIU_TRACE_5                (_MX53_PAD_CSI0_DAT8__TPIU_TRACE_5 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__IPU_CSI0_D_9                (_MX53_PAD_CSI0_DAT9__IPU_CSI0_D_9 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1544,7 +1547,7 @@
 #define MX53_PAD_CSI0_DAT9__KPP_ROW_7           (_MX53_PAD_CSI0_DAT9__KPP_ROW_7 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__ECSPI2_MOSI         (_MX53_PAD_CSI0_DAT9__ECSPI2_MOSI | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__USBOH3_USBH3_PWR            (_MX53_PAD_CSI0_DAT9__USBOH3_USBH3_PWR | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_CSI0_DAT9__I2C1_SCL            (_MX53_PAD_CSI0_DAT9__I2C1_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_CSI0_DAT9__I2C1_SCL            (_MX53_PAD_CSI0_DAT9__I2C1_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_CSI0_DAT9__EMI_EMI_DEBUG_38            (_MX53_PAD_CSI0_DAT9__EMI_EMI_DEBUG_38 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__TPIU_TRACE_6                (_MX53_PAD_CSI0_DAT9__TPIU_TRACE_6 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT10__IPU_CSI0_D_10              (_MX53_PAD_CSI0_DAT10__IPU_CSI0_D_10 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1631,25 +1634,25 @@
 #define MX53_PAD_EIM_EB2__CCM_DI1_EXT_CLK               (_MX53_PAD_EIM_EB2__CCM_DI1_EXT_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_EB2__IPU_SER_DISP1_CS              (_MX53_PAD_EIM_EB2__IPU_SER_DISP1_CS | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_EB2__ECSPI1_SS0            (_MX53_PAD_EIM_EB2__ECSPI1_SS0 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_EB2__I2C2_SCL              (_MX53_PAD_EIM_EB2__I2C2_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_EB2__I2C2_SCL              (_MX53_PAD_EIM_EB2__I2C2_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D16__EMI_WEIM_D_16         (_MX53_PAD_EIM_D16__EMI_WEIM_D_16 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__GPIO3_16              (_MX53_PAD_EIM_D16__GPIO3_16 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__IPU_DI0_PIN5          (_MX53_PAD_EIM_D16__IPU_DI0_PIN5 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__IPU_DISPB1_SER_CLK            (_MX53_PAD_EIM_D16__IPU_DISPB1_SER_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__ECSPI1_SCLK           (_MX53_PAD_EIM_D16__ECSPI1_SCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D16__I2C2_SDA              (_MX53_PAD_EIM_D16__I2C2_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D16__I2C2_SDA              (_MX53_PAD_EIM_D16__I2C2_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D17__EMI_WEIM_D_17         (_MX53_PAD_EIM_D17__EMI_WEIM_D_17 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__GPIO3_17              (_MX53_PAD_EIM_D17__GPIO3_17 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__IPU_DI0_PIN6          (_MX53_PAD_EIM_D17__IPU_DI0_PIN6 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__IPU_DISPB1_SER_DIN            (_MX53_PAD_EIM_D17__IPU_DISPB1_SER_DIN | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__ECSPI1_MISO           (_MX53_PAD_EIM_D17__ECSPI1_MISO | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D17__I2C3_SCL              (_MX53_PAD_EIM_D17__I2C3_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D17__I2C3_SCL              (_MX53_PAD_EIM_D17__I2C3_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D18__EMI_WEIM_D_18         (_MX53_PAD_EIM_D18__EMI_WEIM_D_18 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__GPIO3_18              (_MX53_PAD_EIM_D18__GPIO3_18 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__IPU_DI0_PIN7          (_MX53_PAD_EIM_D18__IPU_DI0_PIN7 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__IPU_DISPB1_SER_DIO            (_MX53_PAD_EIM_D18__IPU_DISPB1_SER_DIO | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__ECSPI1_MOSI           (_MX53_PAD_EIM_D18__ECSPI1_MOSI | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D18__I2C3_SDA              (_MX53_PAD_EIM_D18__I2C3_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D18__I2C3_SDA              (_MX53_PAD_EIM_D18__I2C3_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D18__IPU_DI1_D0_CS         (_MX53_PAD_EIM_D18__IPU_DI1_D0_CS | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D19__EMI_WEIM_D_19         (_MX53_PAD_EIM_D19__EMI_WEIM_D_19 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D19__GPIO3_19              (_MX53_PAD_EIM_D19__GPIO3_19 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1672,7 +1675,7 @@
 #define MX53_PAD_EIM_D21__IPU_DI0_PIN17         (_MX53_PAD_EIM_D21__IPU_DI0_PIN17 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D21__IPU_DISPB0_SER_CLK            (_MX53_PAD_EIM_D21__IPU_DISPB0_SER_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D21__CSPI_SCLK             (_MX53_PAD_EIM_D21__CSPI_SCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D21__I2C1_SCL              (_MX53_PAD_EIM_D21__I2C1_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D21__I2C1_SCL              (_MX53_PAD_EIM_D21__I2C1_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D21__USBOH3_USBOTG_OC              (_MX53_PAD_EIM_D21__USBOH3_USBOTG_OC | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D22__EMI_WEIM_D_22         (_MX53_PAD_EIM_D22__EMI_WEIM_D_22 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D22__GPIO3_22              (_MX53_PAD_EIM_D22__GPIO3_22 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1732,7 +1735,7 @@
 #define MX53_PAD_EIM_D28__UART2_CTS             (_MX53_PAD_EIM_D28__UART2_CTS | MUX_PAD_CTRL(MX53_UART_PAD_CTRL))
 #define MX53_PAD_EIM_D28__IPU_DISPB0_SER_DIO            (_MX53_PAD_EIM_D28__IPU_DISPB0_SER_DIO | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D28__CSPI_MOSI             (_MX53_PAD_EIM_D28__CSPI_MOSI | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D28__I2C1_SDA              (_MX53_PAD_EIM_D28__I2C1_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D28__I2C1_SDA              (_MX53_PAD_EIM_D28__I2C1_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D28__IPU_EXT_TRIG          (_MX53_PAD_EIM_D28__IPU_EXT_TRIG | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D28__IPU_DI0_PIN13         (_MX53_PAD_EIM_D28__IPU_DI0_PIN13 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D29__EMI_WEIM_D_29         (_MX53_PAD_EIM_D29__EMI_WEIM_D_29 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2297,7 +2300,7 @@
 #define MX53_PAD_GPIO_9__SCC_FAIL_STATE         (_MX53_PAD_GPIO_9__SCC_FAIL_STATE | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__ESAI1_HCKR             (_MX53_PAD_GPIO_3__ESAI1_HCKR | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__GPIO1_3                (_MX53_PAD_GPIO_3__GPIO1_3 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_3__I2C3_SCL               (_MX53_PAD_GPIO_3__I2C3_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_3__I2C3_SCL               (_MX53_PAD_GPIO_3__I2C3_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_3__DPLLIP1_TOG_EN         (_MX53_PAD_GPIO_3__DPLLIP1_TOG_EN | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__CCM_CLKO2              (_MX53_PAD_GPIO_3__CCM_CLKO2 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__OBSERVE_MUX_OBSRV_INT_OUT0             (_MX53_PAD_GPIO_3__OBSERVE_MUX_OBSRV_INT_OUT0 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2305,7 +2308,7 @@
 #define MX53_PAD_GPIO_3__MLB_MLBCLK             (_MX53_PAD_GPIO_3__MLB_MLBCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__ESAI1_SCKT             (_MX53_PAD_GPIO_6__ESAI1_SCKT | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__GPIO1_6                (_MX53_PAD_GPIO_6__GPIO1_6 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_6__I2C3_SDA               (_MX53_PAD_GPIO_6__I2C3_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_6__I2C3_SDA               (_MX53_PAD_GPIO_6__I2C3_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_6__CCM_CCM_OUT_0          (_MX53_PAD_GPIO_6__CCM_CCM_OUT_0 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__CSU_CSU_INT_DEB                (_MX53_PAD_GPIO_6__CSU_CSU_INT_DEB | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__OBSERVE_MUX_OBSRV_INT_OUT1             (_MX53_PAD_GPIO_6__OBSERVE_MUX_OBSRV_INT_OUT1 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2333,7 +2336,7 @@
 #define MX53_PAD_GPIO_5__CCM_CLKO               (_MX53_PAD_GPIO_5__CCM_CLKO | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_5__CSU_CSU_ALARM_AUT_2            (_MX53_PAD_GPIO_5__CSU_CSU_ALARM_AUT_2 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_5__OBSERVE_MUX_OBSRV_INT_OUT4             (_MX53_PAD_GPIO_5__OBSERVE_MUX_OBSRV_INT_OUT4 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_5__I2C3_SCL               (_MX53_PAD_GPIO_5__I2C3_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_5__I2C3_SCL               (_MX53_PAD_GPIO_5__I2C3_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_5__CCM_PLL1_BYP           (_MX53_PAD_GPIO_5__CCM_PLL1_BYP | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_7__ESAI1_TX4_RX1          (_MX53_PAD_GPIO_7__ESAI1_TX4_RX1 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_7__GPIO1_7                (_MX53_PAD_GPIO_7__GPIO1_7 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2356,7 +2359,7 @@
 #define MX53_PAD_GPIO_16__TZIC_PWRFAIL_INT              (_MX53_PAD_GPIO_16__TZIC_PWRFAIL_INT | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_16__RTC_CE_RTC_EXT_TRIG1          (_MX53_PAD_GPIO_16__RTC_CE_RTC_EXT_TRIG1 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_16__SPDIF_IN1             (_MX53_PAD_GPIO_16__SPDIF_IN1 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_16__I2C3_SDA              (_MX53_PAD_GPIO_16__I2C3_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_16__I2C3_SDA              (_MX53_PAD_GPIO_16__I2C3_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_16__SJC_DE_B              (_MX53_PAD_GPIO_16__SJC_DE_B | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_17__ESAI1_TX0             (_MX53_PAD_GPIO_17__ESAI1_TX0 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_17__GPIO7_12              (_MX53_PAD_GPIO_17__GPIO7_12 | MUX_PAD_CTRL(NO_PAD_CTRL))
diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig
index 6e6735f04ee3..bb8f4a6b3e37 100644
--- a/arch/arm/plat-omap/Kconfig
+++ b/arch/arm/plat-omap/Kconfig
@@ -13,6 +13,7 @@ config ARCH_OMAP1
        bool "TI OMAP1"
        select CLKDEV_LOOKUP
        select CLKSRC_MMIO
+        select GENERIC_IRQ_CHIP
        help
          "Systems based on omap7xx, omap15xx or omap16xx"
diff --git a/arch/arm/plat-omap/include/plat/dma.h b/arch/arm/plat-omap/include/plat/dma.h
index d1c916fcf770..dc562a5c0a8a 100644
--- a/arch/arm/plat-omap/include/plat/dma.h
+++ b/arch/arm/plat-omap/include/plat/dma.h
@@ -195,6 +195,11 @@
 #define OMAP36XX_DMA_UART4_TX           81      /* S_DMA_80 */
 #define OMAP36XX_DMA_UART4_RX           82      /* S_DMA_81 */
+/* Only for AM35xx */
+#define AM35XX_DMA_UART4_TX             54
+#define AM35XX_DMA_UART4_RX             55
 /*----------------------------------------------------------------------------*/
 #define OMAP1_DMA_TOUT_IRQ              (1 << 0)
diff --git a/arch/arm/plat-omap/include/plat/irqs.h b/arch/arm/plat-omap/include/plat/irqs.h
index 926d25c780f3..30e10719b774 100644
--- a/arch/arm/plat-omap/include/plat/irqs.h
+++ b/arch/arm/plat-omap/include/plat/irqs.h
@@ -357,6 +357,7 @@
 #define INT_35XX_EMAC_C0_TX_PULSE_IRQ   69
 #define INT_35XX_EMAC_C0_MISC_PULSE_IRQ 70
 #define INT_35XX_USBOTG_IRQ             71
+#define INT_35XX_UART4                  84
 #define INT_35XX_CCDC_VD0_IRQ           88
 #define INT_35XX_CCDC_VD1_IRQ           92
 #define INT_35XX_CCDC_VD2_IRQ           93
diff --git a/arch/arm/plat-omap/include/plat/serial.h b/arch/arm/plat-omap/include/plat/serial.h
index 2723f9166ea2..de3b10c18127 100644
--- a/arch/arm/plat-omap/include/plat/serial.h
+++ b/arch/arm/plat-omap/include/plat/serial.h
@@ -56,6 +56,9 @@
 #define TI816X_UART2_BASE       0x48022000
 #define TI816X_UART3_BASE       0x48024000
+/* AM3505/3517 UART4 */
+#define AM35XX_UART4_BASE       0x4809E000      /* Only on AM3505/3517 */
 /* External port on Zoom2/3 */
 #define ZOOM_UART_BASE          0x10000000
 #define ZOOM_UART_VIRT          0xfa400000
diff --git a/arch/arm/plat-omap/iovmm.c b/arch/arm/plat-omap/iovmm.c
index c60737c49a32..79e7fedb8602 100644
--- a/arch/arm/plat-omap/iovmm.c
+++ b/arch/arm/plat-omap/iovmm.c
@@ -423,9 +423,6 @@ static void sgtable_fill_kmalloc(struct sg_table *sgt, u32 pa, u32 da,
 {
        unsigned int i;
        struct scatterlist *sg;
-        void *va;
-        va = phys_to_virt(pa);
        for_each_sg(sgt->sgl, sg, sgt->nents, i) {
                unsigned bytes;
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 3b3776d0a1a7..fff68d0d521b 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -910,7 +910,7 @@ omapl138_case_a3	MACH_OMAPL138_CASE_A3	OMAPL138_CASE_A3	3280
 uemd                    MACH_UEMD               UEMD                    3281
 ccwmx51mut              MACH_CCWMX51MUT         CCWMX51MUT              3282
 rockhopper              MACH_ROCKHOPPER         ROCKHOPPER              3283
-nookcolor               MACH_NOOKCOLOR          NOOKCOLOR               3284
+encore                  MACH_ENCORE             ENCORE                  3284
 hkdkc100                MACH_HKDKC100           HKDKC100                3285
 ts42xx                  MACH_TS42XX             TS42XX                  3286
 aebl                    MACH_AEBL               AEBL                    3287
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 124854714958..3ff7785b3beb 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -162,7 +162,6 @@ config IA64_GENERIC
        select ACPI_NUMA
        select SWIOTLB
        select PCI_MSI
-        select DMAR
        help
          This selects the system type of your hardware.  A "generic" kernel
          will run on any supported IA-64 system.  However, if you configure
diff --git a/arch/ia64/configs/generic_defconfig b/arch/ia64/configs/generic_defconfig
index 1d7bca0a396d..0e5cd1405e0e 100644
--- a/arch/ia64/configs/generic_defconfig
+++ b/arch/ia64/configs/generic_defconfig
@@ -234,3 +234,4 @@ CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRC_T10DIF=y
 CONFIG_MISC_DEVICES=y
+CONFIG_DMAR=y
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 42c67beadcae..1a6f20d4e7e6 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -55,6 +55,7 @@ config SPARC64
        select PERF_USE_VMALLOC
        select IRQ_PREFLOW_FASTEOI
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
+        select HAVE_C_RECORDMCOUNT
 config ARCH_DEFCONFIG
        string
diff --git a/arch/sparc/include/asm/spinlock_32.h b/arch/sparc/include/asm/spinlock_32.h
index 5f5b8bf3f50d..bcc98fc35281 100644
--- a/arch/sparc/include/asm/spinlock_32.h
+++ b/arch/sparc/include/asm/spinlock_32.h
@@ -131,6 +131,15 @@ static inline void arch_write_lock(arch_rwlock_t *rw)
        *(volatile __u32 *)&lp->lock = ~0U;
 }
+static void inline arch_write_unlock(arch_rwlock_t *lock)
+{
+        __asm__ __volatile__(
+"       st              %%g0, [%0]"
+        : /* no outputs */
+        : "r" (lock)
+        : "memory");
+}
 static inline int arch_write_trylock(arch_rwlock_t *rw)
 {
        unsigned int val;
@@ -175,8 +184,6 @@ static inline int __arch_read_trylock(arch_rwlock_t *rw)
        res; \
 })
-#define arch_write_unlock(rw)   do { (rw)->lock = 0; } while(0)
 #define arch_spin_lock_flags(lock, flags) arch_spin_lock(lock)
 #define arch_read_lock_flags(rw, flags)   arch_read_lock(rw)
 #define arch_write_lock_flags(rw, flags)  arch_write_lock(rw)
diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
index 073936a8b275..968917694978 100644
--- a/arch/sparc/include/asm/spinlock_64.h
+++ b/arch/sparc/include/asm/spinlock_64.h
@@ -210,14 +210,8 @@ static int inline arch_write_trylock(arch_rwlock_t *lock)
        return result;
 }
-#define arch_read_lock(p)       arch_read_lock(p)
 #define arch_read_lock_flags(p, f) arch_read_lock(p)
-#define arch_read_trylock(p)    arch_read_trylock(p)
-#define arch_read_unlock(p)     arch_read_unlock(p)
-#define arch_write_lock(p)      arch_write_lock(p)
 #define arch_write_lock_flags(p, f) arch_write_lock(p)
-#define arch_write_unlock(p)    arch_write_unlock(p)
-#define arch_write_trylock(p)   arch_write_trylock(p)
 #define arch_read_can_lock(rw)          (!((rw)->lock & 0x80000000UL))
 #define arch_write_can_lock(rw) (!(rw)->lock)
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index 7b439d9aea2a..41935fadfdfc 100644
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -27,8 +27,8 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
        desc->base2             = (info->base_addr & 0xff000000) >> 24;
        /*
-         * Don't allow setting of the lm bit. It is useless anyway
+         * Don't allow setting of the lm bit. It would confuse
-         * because 64bit system calls require __USER_CS:
+         * user_64bit_mode and would get overridden by sysret anyway.
         */
        desc->l                 = 0;
 }
diff --git a/arch/x86/include/asm/irq_vectors.h b/arch/x86/include/asm/irq_vectors.h
index f9a320984a10..7e50f06393aa 100644
--- a/arch/x86/include/asm/irq_vectors.h
+++ b/arch/x86/include/asm/irq_vectors.h
@@ -17,7 +17,6 @@
 *  Vectors   0 ...  31 : system traps and exceptions - hardcoded events
 *  Vectors  32 ... 127 : device interrupts
 *  Vector  128         : legacy int80 syscall interface
- *  Vector  204         : legacy x86_64 vsyscall emulation
 *  Vectors 129 ... INVALIDATE_TLB_VECTOR_START-1 except 204 : device interrupts
 *  Vectors INVALIDATE_TLB_VECTOR_START ... 255 : special interrupts
 *
@@ -51,9 +50,6 @@
 #ifdef CONFIG_X86_32
 # define SYSCALL_VECTOR                 0x80
 #endif
-#ifdef CONFIG_X86_64
-# define VSYSCALL_EMU_VECTOR            0xcc
-#endif
 /*
 * Vectors 0x30-0x3f are used for ISA interrupts.
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 2c7652163111..8e8b9a4987ee 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -41,6 +41,7 @@
 #include <asm/desc_defs.h>
 #include <asm/kmap_types.h>
+#include <asm/pgtable_types.h>
 struct page;
 struct thread_struct;
@@ -63,6 +64,11 @@ struct paravirt_callee_save {
 struct pv_info {
        unsigned int kernel_rpl;
        int shared_kernel_pmd;
+#ifdef CONFIG_X86_64
+        u16 extra_user_64bit_cs;  /* __USER_CS if none */
+#endif
        int paravirt_enabled;
        const char *name;
 };
diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index 94e7618fcac8..35664547125b 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -131,6 +131,9 @@ struct pt_regs {
 #ifdef __KERNEL__
 #include <linux/init.h>
+#ifdef CONFIG_PARAVIRT
+#include <asm/paravirt_types.h>
+#endif
 struct cpuinfo_x86;
 struct task_struct;
@@ -187,6 +190,22 @@ static inline int v8086_mode(struct pt_regs *regs)
 #endif
 }
+#ifdef CONFIG_X86_64
+static inline bool user_64bit_mode(struct pt_regs *regs)
+{
+#ifndef CONFIG_PARAVIRT
+        /*
+         * On non-paravirt systems, this is the only long mode CPL 3
+         * selector.  We do not allow long mode selectors in the LDT.
+         */
+        return regs->cs == __USER_CS;
+#else
+        /* Headers are too twisted for this to go in paravirt.h. */
+        return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
+#endif
+}
+#endif
 /*
 * X86_32 CPUs don't save ss and esp if the CPU is already in kernel mode
 * when it traps.  The previous stack will be directly underneath the saved
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 2bae0a513b40..0012d0902c5f 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -40,7 +40,6 @@ asmlinkage void alignment_check(void);
 asmlinkage void machine_check(void);
 #endif /* CONFIG_X86_MCE */
 asmlinkage void simd_coprocessor_error(void);
-asmlinkage void emulate_vsyscall(void);
 dotraplinkage void do_divide_error(struct pt_regs *, long);
 dotraplinkage void do_debug(struct pt_regs *, long);
@@ -67,7 +66,6 @@ dotraplinkage void do_alignment_check(struct pt_regs *, long);
 dotraplinkage void do_machine_check(struct pt_regs *, long);
 #endif
 dotraplinkage void do_simd_coprocessor_error(struct pt_regs *, long);
-dotraplinkage void do_emulate_vsyscall(struct pt_regs *, long);
 #ifdef CONFIG_X86_32
 dotraplinkage void do_iret_error(struct pt_regs *, long);
 #endif
diff --git a/arch/x86/include/asm/unistd_64.h b/arch/x86/include/asm/unistd_64.h
index 705bf139288c..d92641cc7acc 100644
--- a/arch/x86/include/asm/unistd_64.h
+++ b/arch/x86/include/asm/unistd_64.h
@@ -681,6 +681,8 @@ __SYSCALL(__NR_syncfs, sys_syncfs)
 __SYSCALL(__NR_sendmmsg, sys_sendmmsg)
 #define __NR_setns                              308
 __SYSCALL(__NR_setns, sys_setns)
+#define __NR_getcpu                             309
+__SYSCALL(__NR_getcpu, sys_getcpu)
 #ifndef __NO_STUBS
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h
index 60107072c28b..eaea1d31f753 100644
--- a/arch/x86/include/asm/vsyscall.h
+++ b/arch/x86/include/asm/vsyscall.h
@@ -27,6 +27,12 @@ extern struct timezone sys_tz;
 extern void map_vsyscall(void);
+/*
+ * Called on instruction fetch fault in vsyscall page.
+ * Returns true if handled.
+ */
+extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address);
 #endif /* __KERNEL__ */
 #endif /* _ASM_X86_VSYSCALL_H */
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 04105574c8e9..82f2912155a5 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -17,19 +17,6 @@ CFLAGS_REMOVE_ftrace.o = -pg
 CFLAGS_REMOVE_early_printk.o = -pg
 endif
-#
-# vsyscalls (which work on the user stack) should have
-# no stack-protector checks:
-#
-nostackp := $(call cc-option, -fno-stack-protector)
-CFLAGS_vsyscall_64.o    := $(PROFILING) -g0 $(nostackp)
-CFLAGS_hpet.o           := $(nostackp)
-CFLAGS_paravirt.o       := $(nostackp)
-GCOV_PROFILE_vsyscall_64.o      := n
-GCOV_PROFILE_hpet.o             := n
-GCOV_PROFILE_tsc.o              := n
-GCOV_PROFILE_paravirt.o         := n
 obj-y                   := process_$(BITS).o signal.o entry_$(BITS).o
 obj-y                   += traps.o irq.o irq_$(BITS).o dumpstack_$(BITS).o
 obj-y                   += time.o ioport.o ldt.o dumpstack.o
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index e13329d800c8..6419bb05ecd5 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1111,7 +1111,6 @@ zeroentry spurious_interrupt_bug do_spurious_interrupt_bug
 zeroentry coprocessor_error do_coprocessor_error
 errorentry alignment_check do_alignment_check
 zeroentry simd_coprocessor_error do_simd_coprocessor_error
-zeroentry emulate_vsyscall do_emulate_vsyscall
        /* Reload gs selector with exception handling */
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 613a7931ecc1..d90272e6bc40 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -307,6 +307,10 @@ struct pv_info pv_info = {
        .paravirt_enabled = 0,
        .kernel_rpl = 0,
        .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
+#ifdef CONFIG_X86_64
+        .extra_user_64bit_cs = __USER_CS,
+#endif
 };
 struct pv_init_ops pv_init_ops = {
diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
index 7977f0cfe339..c346d1161488 100644
--- a/arch/x86/kernel/step.c
+++ b/arch/x86/kernel/step.c
@@ -74,7 +74,7 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
 #ifdef CONFIG_X86_64
                case 0x40 ... 0x4f:
-                        if (regs->cs != __USER_CS)
+                        if (!user_64bit_mode(regs))
                                /* 32-bit mode: register increment */
                                return 0;
                        /* 64-bit mode: REX prefix */
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 9682ec50180c..6913369c234c 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -872,12 +872,6 @@ void __init trap_init(void)
        set_bit(SYSCALL_VECTOR, used_vectors);
 #endif
-#ifdef CONFIG_X86_64
-        BUG_ON(test_bit(VSYSCALL_EMU_VECTOR, used_vectors));
-        set_system_intr_gate(VSYSCALL_EMU_VECTOR, &emulate_vsyscall);
-        set_bit(VSYSCALL_EMU_VECTOR, used_vectors);
-#endif
        /*
         * Should be a barrier for any external CPU state:
         */
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 4aa9c54a9b76..0f703f10901a 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -71,7 +71,6 @@ PHDRS {
        text PT_LOAD FLAGS(5);          /* R_E */
        data PT_LOAD FLAGS(6);          /* RW_ */
 #ifdef CONFIG_X86_64
-        user PT_LOAD FLAGS(5);          /* R_E */
 #ifdef CONFIG_SMP
        percpu PT_LOAD FLAGS(6);        /* RW_ */
 #endif
@@ -154,44 +153,16 @@ SECTIONS
 #ifdef CONFIG_X86_64
-#define VSYSCALL_ADDR (-10*1024*1024)
+        . = ALIGN(PAGE_SIZE);
-#define VLOAD_OFFSET (VSYSCALL_ADDR - __vsyscall_0 + LOAD_OFFSET)
-#define VLOAD(x) (ADDR(x) - VLOAD_OFFSET)
-#define VVIRT_OFFSET (VSYSCALL_ADDR - __vsyscall_0)
-#define VVIRT(x) (ADDR(x) - VVIRT_OFFSET)
-        . = ALIGN(4096);
-        __vsyscall_0 = .;
-        . = VSYSCALL_ADDR;
-        .vsyscall : AT(VLOAD(.vsyscall)) {
-                *(.vsyscall_0)
-                . = 1024;
-                *(.vsyscall_1)
-                . = 2048;
-                *(.vsyscall_2)
-                . = 4096;  /* Pad the whole page. */
-        } :user =0xcc
-        . = ALIGN(__vsyscall_0 + PAGE_SIZE, PAGE_SIZE);
-#undef VSYSCALL_ADDR
-#undef VLOAD_OFFSET
-#undef VLOAD
-#undef VVIRT_OFFSET
-#undef VVIRT
        __vvar_page = .;
        .vvar : AT(ADDR(.vvar) - LOAD_OFFSET) {
+                /* work around gold bug 13023 */
+                __vvar_beginning_hack = .;
-              /* Place all vvars at the offsets in asm/vvar.h. */
+                /* Place all vvars at the offsets in asm/vvar.h. */
-#define EMIT_VVAR(name, offset)                 \
+#define EMIT_VVAR(name, offset)                         \
-                . = offset;             \
+                . = __vvar_beginning_hack + offset;     \
                *(.vvar_ ## name)
 #define __VVAR_KERNEL_LDS
 #include <asm/vvar.h>
diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
index dda7dff9cef7..18ae83dd1cd7 100644
--- a/arch/x86/kernel/vsyscall_64.c
+++ b/arch/x86/kernel/vsyscall_64.c
@@ -18,9 +18,6 @@
 *  use the vDSO.
 */
-/* Disable profiling for userspace code: */
-#define DISABLE_BRANCH_PROFILING
 #include <linux/time.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -50,12 +47,36 @@
 #include <asm/vgtod.h>
 #include <asm/traps.h>
+#define CREATE_TRACE_POINTS
+#include "vsyscall_trace.h"
 DEFINE_VVAR(int, vgetcpu_mode);
 DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
 {
        .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
 };
+static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
+static int __init vsyscall_setup(char *str)
+{
+        if (str) {
+                if (!strcmp("emulate", str))
+                        vsyscall_mode = EMULATE;
+                else if (!strcmp("native", str))
+                        vsyscall_mode = NATIVE;
+                else if (!strcmp("none", str))
+                        vsyscall_mode = NONE;
+                else
+                        return -EINVAL;
+                return 0;
+        }
+        return -EINVAL;
+}
+early_param("vsyscall", vsyscall_setup);
 void update_vsyscall_tz(void)
 {
        unsigned long flags;
@@ -100,7 +121,7 @@ static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
        printk("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
               level, tsk->comm, task_pid_nr(tsk),
-               message, regs->ip - 2, regs->cs,
+               message, regs->ip, regs->cs,
               regs->sp, regs->ax, regs->si, regs->di);
 }
@@ -118,46 +139,39 @@ static int addr_to_vsyscall_nr(unsigned long addr)
        return nr;
 }
-void dotraplinkage do_emulate_vsyscall(struct pt_regs *regs, long error_code)
+bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
 {
        struct task_struct *tsk;
        unsigned long caller;
        int vsyscall_nr;
        long ret;
-        local_irq_enable();
        /*
-         * Real 64-bit user mode code has cs == __USER_CS.  Anything else
+         * No point in checking CS -- the only way to get here is a user mode
-         * is bogus.
+         * trap to a high address, which means that we're in 64-bit user code.
         */
-        if (regs->cs != __USER_CS) {
-                /*
-                 * If we trapped from kernel mode, we might as well OOPS now
-                 * instead of returning to some random address and OOPSing
-                 * then.
-                 */
-                BUG_ON(!user_mode(regs));
-                /* Compat mode and non-compat 32-bit CS should both segfault. */
+        WARN_ON_ONCE(address != regs->ip);
-                warn_bad_vsyscall(KERN_WARNING, regs,
-                                  "illegal int 0xcc from 32-bit mode");
+        if (vsyscall_mode == NONE) {
-                goto sigsegv;
+                warn_bad_vsyscall(KERN_INFO, regs,
+                                  "vsyscall attempted with vsyscall=none");
+                return false;
        }
-        /*
+        vsyscall_nr = addr_to_vsyscall_nr(address);
-         * x86-ism here: regs->ip points to the instruction after the int 0xcc,
-         * and int 0xcc is two bytes long.
+        trace_emulate_vsyscall(vsyscall_nr);
-         */
-        vsyscall_nr = addr_to_vsyscall_nr(regs->ip - 2);
        if (vsyscall_nr < 0) {
                warn_bad_vsyscall(KERN_WARNING, regs,
-                                  "illegal int 0xcc (exploit attempt?)");
+                                  "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround");
                goto sigsegv;
        }
        if (get_user(caller, (unsigned long __user *)regs->sp) != 0) {
-                warn_bad_vsyscall(KERN_WARNING, regs, "int 0xcc with bad stack (exploit attempt?)");
+                warn_bad_vsyscall(KERN_WARNING, regs,
+                                  "vsyscall with bad stack (exploit attempt?)");
                goto sigsegv;
        }
@@ -202,13 +216,11 @@ void dotraplinkage do_emulate_vsyscall(struct pt_regs *regs, long error_code)
        regs->ip = caller;
        regs->sp += 8;
-        local_irq_disable();
+        return true;
-        return;
 sigsegv:
-        regs->ip -= 2;  /* The faulting instruction should be the int 0xcc. */
        force_sig(SIGSEGV, current);
-        local_irq_disable();
+        return true;
 }
 /*
@@ -256,15 +268,21 @@ cpu_vsyscall_notifier(struct notifier_block *n, unsigned long action, void *arg)
 void __init map_vsyscall(void)
 {
-        extern char __vsyscall_0;
+        extern char __vsyscall_page;
-        unsigned long physaddr_page0 = __pa_symbol(&__vsyscall_0);
+        unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
        extern char __vvar_page;
        unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page);
-        /* Note that VSYSCALL_MAPPED_PAGES must agree with the code below. */
+        __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall,
-        __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_page0, PAGE_KERNEL_VSYSCALL);
+                     vsyscall_mode == NATIVE
+                     ? PAGE_KERNEL_VSYSCALL
+                     : PAGE_KERNEL_VVAR);
+        BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_FIRST_PAGE) !=
+                     (unsigned long)VSYSCALL_START);
        __set_fixmap(VVAR_PAGE, physaddr_vvar_page, PAGE_KERNEL_VVAR);
-        BUILD_BUG_ON((unsigned long)__fix_to_virt(VVAR_PAGE) != (unsigned long)VVAR_ADDRESS);
+        BUILD_BUG_ON((unsigned long)__fix_to_virt(VVAR_PAGE) !=
+                     (unsigned long)VVAR_ADDRESS);
 }
 static int __init vsyscall_init(void)
diff --git a/arch/x86/kernel/vsyscall_emu_64.S b/arch/x86/kernel/vsyscall_emu_64.S
index ffa845eae5ca..c9596a9af159 100644
--- a/arch/x86/kernel/vsyscall_emu_64.S
+++ b/arch/x86/kernel/vsyscall_emu_64.S
@@ -7,21 +7,31 @@
 */
 #include <linux/linkage.h>
 #include <asm/irq_vectors.h>
+#include <asm/page_types.h>
+#include <asm/unistd_64.h>
+__PAGE_ALIGNED_DATA
+        .globl __vsyscall_page
+        .balign PAGE_SIZE, 0xcc
+        .type __vsyscall_page, @object
+__vsyscall_page:
+        mov $__NR_gettimeofday, %rax
+        syscall
+        ret
-/* The unused parts of the page are filled with 0xcc by the linker script. */
+        .balign 1024, 0xcc
+        mov $__NR_time, %rax
+        syscall
+        ret
-.section .vsyscall_0, "a"
+        .balign 1024, 0xcc
-ENTRY(vsyscall_0)
+        mov $__NR_getcpu, %rax
-        int $VSYSCALL_EMU_VECTOR
+        syscall
-END(vsyscall_0)
+        ret
-.section .vsyscall_1, "a"
+        .balign 4096, 0xcc
-ENTRY(vsyscall_1)
-        int $VSYSCALL_EMU_VECTOR
-END(vsyscall_1)
-.section .vsyscall_2, "a"
+        .size __vsyscall_page, 4096
-ENTRY(vsyscall_2)
-        int $VSYSCALL_EMU_VECTOR
-END(vsyscall_2)
diff --git a/arch/x86/kernel/vsyscall_trace.h b/arch/x86/kernel/vsyscall_trace.h
new file mode 100644
index 000000000000..a8b2edec54fe
--- /dev/null
+++ b/arch/x86/kernel/vsyscall_trace.h
@@ -0,0 +1,29 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM vsyscall
+#if !defined(__VSYSCALL_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define __VSYSCALL_TRACE_H
+#include <linux/tracepoint.h>
+TRACE_EVENT(emulate_vsyscall,
+            TP_PROTO(int nr),
+            TP_ARGS(nr),
+            TP_STRUCT__entry(__field(int, nr)),
+            TP_fast_assign(
+                           __entry->nr = nr;
+                           ),
+            TP_printk("nr = %d", __entry->nr)
+);
+#endif
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH ../../arch/x86/kernel
+#define TRACE_INCLUDE_FILE vsyscall_trace
+#include <trace/define_trace.h>
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 988724b236b6..ff5790d8e990 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -22,6 +22,8 @@ config KVM
        depends on HAVE_KVM
        # for device assignment:
        depends on PCI
+        # for TASKSTATS/TASK_DELAY_ACCT:
+        depends on NET
        select PREEMPT_NOTIFIERS
        select MMU_NOTIFIER
        select ANON_INODES
@@ -31,6 +33,7 @@ config KVM
        select KVM_ASYNC_PF
        select USER_RETURN_NOTIFIER
        select KVM_MMIO
+        select TASKSTATS
        select TASK_DELAY_ACCT
        ---help---
          Support hosting fully virtualized guest machines using hardware
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 4d09df054e39..0d17c8c50acd 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -17,6 +17,7 @@
 #include <asm/traps.h>                  /* dotraplinkage, ...           */
 #include <asm/pgalloc.h>                /* pgd_*(), ...                 */
 #include <asm/kmemcheck.h>              /* kmemcheck_*(), ...           */
+#include <asm/vsyscall.h>
 /*
 * Page fault error code bits:
@@ -105,7 +106,7 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
                 * but for now it's good enough to assume that long
                 * mode only uses well known segments or kernel.
                 */
-                return (!user_mode(regs)) || (regs->cs == __USER_CS);
+                return (!user_mode(regs) || user_64bit_mode(regs));
 #endif
        case 0x60:
                /* 0x64 thru 0x67 are valid prefixes in all modes. */
@@ -720,6 +721,18 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
                if (is_errata100(regs, address))
                        return;
+#ifdef CONFIG_X86_64
+                /*
+                 * Instruction fetch faults in the vsyscall page might need
+                 * emulation.
+                 */
+                if (unlikely((error_code & PF_INSTR) &&
+                             ((address & ~0xfff) == VSYSCALL_START))) {
+                        if (emulate_vsyscall(regs, address))
+                                return;
+                }
+#endif
                if (unlikely(show_unhandled_signals))
                        show_signal_msg(regs, error_code, address, tsk);
diff --git a/arch/x86/vdso/vdso.S b/arch/x86/vdso/vdso.S
index 1b979c12ba85..01f5e3b4613c 100644
--- a/arch/x86/vdso/vdso.S
+++ b/arch/x86/vdso/vdso.S
@@ -9,6 +9,7 @@ __PAGE_ALIGNED_DATA
 vdso_start:
        .incbin "arch/x86/vdso/vdso.so"
 vdso_end:
+        .align PAGE_SIZE /* extra data here leaks to userspace. */
 .previous
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 974a528458a0..e2345af01af0 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -951,6 +951,10 @@ static const struct pv_info xen_info __initconst = {
        .paravirt_enabled = 1,
        .shared_kernel_pmd = 0,
+#ifdef CONFIG_X86_64
+        .extra_user_64bit_cs = FLAT_USER_CS64,
+#endif
        .name = "Xen",
 };
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index f987bde77c49..8cce339db5e7 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1916,6 +1916,7 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 # endif
 #else
        case VSYSCALL_LAST_PAGE ... VSYSCALL_FIRST_PAGE:
+        case VVAR_PAGE:
 #endif
        case FIX_TEXT_POKE0:
        case FIX_TEXT_POKE1:
@@ -1956,7 +1957,8 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 #ifdef CONFIG_X86_64
        /* Replicate changes to map the vsyscall page into the user
           pagetable vsyscall mapping. */
-        if (idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) {
+        if ((idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) ||
+            idx == VVAR_PAGE) {
                unsigned long vaddr = __fix_to_virt(idx);
                set_pte_vaddr_pud(level3_user_vsyscall, vaddr, pte);
        }
diff --git a/drivers/base/regmap/regmap-i2c.c b/drivers/base/regmap/regmap-i2c.c
index c2231ff06cbc..c4f7a45cd2c3 100644
--- a/drivers/base/regmap/regmap-i2c.c
+++ b/drivers/base/regmap/regmap-i2c.c
@@ -113,3 +113,4 @@ struct regmap *regmap_init_i2c(struct i2c_client *i2c,
 }
 EXPORT_SYMBOL_GPL(regmap_init_i2c);
+MODULE_LICENSE("GPL");
diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c
index 4deba0621bc7..f8396945d6ed 100644
--- a/drivers/base/regmap/regmap-spi.c
+++ b/drivers/base/regmap/regmap-spi.c
@@ -13,6 +13,7 @@
 #include <linux/regmap.h>
 #include <linux/spi/spi.h>
 #include <linux/init.h>
+#include <linux/module.h>
 static int regmap_spi_write(struct device *dev, const void *data, size_t count)
 {
@@ -70,3 +71,5 @@ struct regmap *regmap_init_spi(struct spi_device *spi,
        return regmap_init(&spi->dev, &regmap_spi, config);
 }
 EXPORT_SYMBOL_GPL(regmap_init_spi);
+MODULE_LICENSE("GPL");
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index cf3565cae93d..0eef4da1ac61 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -317,7 +317,7 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
                u8[0] |= map->bus->read_flag_mask;
        ret = map->bus->read(map->dev, map->work_buf, map->format.reg_bytes,
-                             val, map->format.val_bytes);
+                             val, val_len);
        if (ret != 0)
                return ret;
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index e6ad3bb6c1a6..4799393247c8 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -216,15 +216,33 @@ struct inbound_phy_packet_event {
        struct fw_cdev_event_phy_packet phy_packet;
 };
-static inline void __user *u64_to_uptr(__u64 value)
+#ifdef CONFIG_COMPAT
+static void __user *u64_to_uptr(u64 value)
+{
+        if (is_compat_task())
+                return compat_ptr(value);
+        else
+                return (void __user *)(unsigned long)value;
+}
+static u64 uptr_to_u64(void __user *ptr)
+{
+        if (is_compat_task())
+                return ptr_to_compat(ptr);
+        else
+                return (u64)(unsigned long)ptr;
+}
+#else
+static inline void __user *u64_to_uptr(u64 value)
 {
        return (void __user *)(unsigned long)value;
 }
-static inline __u64 uptr_to_u64(void __user *ptr)
+static inline u64 uptr_to_u64(void __user *ptr)
 {
-        return (__u64)(unsigned long)ptr;
+        return (u64)(unsigned long)ptr;
 }
+#endif /* CONFIG_COMPAT */
 static int fw_device_op_open(struct inode *inode, struct file *file)
 {
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index bcf792fac442..57cd3a406edf 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2179,8 +2179,13 @@ static int ohci_enable(struct fw_card *card,
                        ohci_driver_name, ohci)) {
                fw_error("Failed to allocate interrupt %d.\n", dev->irq);
                pci_disable_msi(dev);
-                dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
-                                  ohci->config_rom, ohci->config_rom_bus);
+                if (config_rom) {
+                        dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+                                          ohci->next_config_rom,
+                                          ohci->next_config_rom_bus);
+                        ohci->next_config_rom = NULL;
+                }
                return -EIO;
        }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index a8ab6263e0d7..3c395a59da35 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -499,7 +499,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
        seq_printf(m, "Interrupts received: %d\n",
                   atomic_read(&dev_priv->irq_received));
        for (i = 0; i < I915_NUM_RINGS; i++) {
-                if (IS_GEN6(dev)) {
+                if (IS_GEN6(dev) || IS_GEN7(dev)) {
                        seq_printf(m, "Graphics Interrupt mask (%s):    %08x\n",
                                   dev_priv->ring[i].name,
                                   I915_READ_IMR(&dev_priv->ring[i]));
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index feb4f164fd1b..7916bd97d5c1 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -36,6 +36,7 @@
 #include <linux/io-mapping.h>
 #include <linux/i2c.h>
 #include <drm/intel-gtt.h>
+#include <linux/backlight.h>
 /* General customization:
 */
@@ -690,6 +691,7 @@ typedef struct drm_i915_private {
        int child_dev_num;
        struct child_device_config *child_dev;
        struct drm_connector *int_lvds_connector;
+        struct drm_connector *int_edp_connector;
        bool mchbar_need_disable;
@@ -723,6 +725,8 @@ typedef struct drm_i915_private {
        /* list of fbdev register on this device */
        struct intel_fbdev *fbdev;
+        struct backlight_device *backlight;
        struct drm_property *broadcast_rgb_property;
        struct drm_property *force_audio_property;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 02f96fd0d52d..9cbb0cd8f46a 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2058,8 +2058,10 @@ void intel_irq_init(struct drm_device *dev)
                dev->driver->get_vblank_counter = gm45_get_vblank_counter;
        }
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
-        dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
+                dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
+        else
+                dev->driver->get_vblank_timestamp = NULL;
        dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
        if (IS_IVYBRIDGE(dev)) {
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index d1331f771e2f..5baaef4a0c5d 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1318,6 +1318,7 @@
 #define   ADPA_PIPE_SELECT_MASK (1<<30)
 #define   ADPA_PIPE_A_SELECT    0
 #define   ADPA_PIPE_B_SELECT    (1<<30)
+#define   ADPA_PIPE_SELECT(pipe) ((pipe) << 30)
 #define   ADPA_USE_VGA_HVPOLARITY (1<<15)
 #define   ADPA_SETS_HVPOLARITY  0
 #define   ADPA_VSYNC_CNTL_DISABLE (1<<11)
@@ -1460,6 +1461,7 @@
 /* Selects pipe B for LVDS data.  Must be set on pre-965. */
 #define   LVDS_PIPEB_SELECT             (1 << 30)
 #define   LVDS_PIPE_MASK                (1 << 30)
+#define   LVDS_PIPE(pipe)               ((pipe) << 30)
 /* LVDS dithering flag on 965/g4x platform */
 #define   LVDS_ENABLE_DITHER            (1 << 25)
 /* LVDS sync polarity flags. Set to invert (i.e. negative) */
@@ -1499,9 +1501,6 @@
 #define   LVDS_B0B3_POWER_DOWN          (0 << 2)
 #define   LVDS_B0B3_POWER_UP            (3 << 2)
-#define LVDS_PIPE_ENABLED(V, P) \
-        (((V) & (LVDS_PIPE_MASK | LVDS_PORT_EN)) == ((P) << 30 | LVDS_PORT_EN))
 /* Video Data Island Packet control */
 #define VIDEO_DIP_DATA          0x61178
 #define VIDEO_DIP_CTL           0x61170
@@ -3256,14 +3255,12 @@
 #define  ADPA_CRT_HOTPLUG_VOLREF_475MV  (1<<17)
 #define  ADPA_CRT_HOTPLUG_FORCE_TRIGGER (1<<16)
-#define ADPA_PIPE_ENABLED(V, P) \
-        (((V) & (ADPA_TRANS_SELECT_MASK | ADPA_DAC_ENABLE)) == ((P) << 30 | ADPA_DAC_ENABLE))
 /* or SDVOB */
 #define HDMIB   0xe1140
 #define  PORT_ENABLE    (1 << 31)
 #define  TRANSCODER_A   (0)
 #define  TRANSCODER_B   (1 << 30)
+#define  TRANSCODER(pipe)       ((pipe) << 30)
 #define  TRANSCODER_MASK   (1 << 30)
 #define  COLOR_FORMAT_8bpc      (0)
 #define  COLOR_FORMAT_12bpc     (3 << 26)
@@ -3280,9 +3277,6 @@
 #define  HSYNC_ACTIVE_HIGH      (1 << 3)
 #define  PORT_DETECTED          (1 << 2)
-#define HDMI_PIPE_ENABLED(V, P) \
-        (((V) & (TRANSCODER_MASK | PORT_ENABLE)) == ((P) << 30 | PORT_ENABLE))
 /* PCH SDVOB multiplex with HDMIB */
 #define PCH_SDVOB       HDMIB
@@ -3349,6 +3343,7 @@
 #define  PORT_TRANS_B_SEL_CPT   (1<<29)
 #define  PORT_TRANS_C_SEL_CPT   (2<<29)
 #define  PORT_TRANS_SEL_MASK    (3<<29)
+#define  PORT_TRANS_SEL_CPT(pipe)       ((pipe) << 29)
 #define TRANS_DP_CTL_A          0xe0300
 #define TRANS_DP_CTL_B          0xe1300
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 87677d60d0df..f10742359ec9 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -871,7 +871,8 @@ int i915_restore_state(struct drm_device *dev)
        }
        mutex_unlock(&dev->struct_mutex);
-        intel_init_clock_gating(dev);
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                intel_init_clock_gating(dev);
        if (IS_IRONLAKE_M(dev)) {
                ironlake_enable_drps(dev);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 35364e68a091..ee1d701317f7 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -980,8 +980,8 @@ static void assert_transcoder_disabled(struct drm_i915_private *dev_priv,
             pipe_name(pipe));
 }
-static bool dp_pipe_enabled(struct drm_i915_private *dev_priv, enum pipe pipe,
+static bool dp_pipe_enabled(struct drm_i915_private *dev_priv,
-                            int reg, u32 port_sel, u32 val)
+                            enum pipe pipe, u32 port_sel, u32 val)
 {
        if ((val & DP_PORT_EN) == 0)
                return false;
@@ -998,11 +998,58 @@ static bool dp_pipe_enabled(struct drm_i915_private *dev_priv, enum pipe pipe,
        return true;
 }
+static bool hdmi_pipe_enabled(struct drm_i915_private *dev_priv,
+                              enum pipe pipe, u32 val)
+{
+        if ((val & PORT_ENABLE) == 0)
+                return false;
+        if (HAS_PCH_CPT(dev_priv->dev)) {
+                if ((val & PORT_TRANS_SEL_MASK) != PORT_TRANS_SEL_CPT(pipe))
+                        return false;
+        } else {
+                if ((val & TRANSCODER_MASK) != TRANSCODER(pipe))
+                        return false;
+        }
+        return true;
+}
+static bool lvds_pipe_enabled(struct drm_i915_private *dev_priv,
+                              enum pipe pipe, u32 val)
+{
+        if ((val & LVDS_PORT_EN) == 0)
+                return false;
+        if (HAS_PCH_CPT(dev_priv->dev)) {
+                if ((val & PORT_TRANS_SEL_MASK) != PORT_TRANS_SEL_CPT(pipe))
+                        return false;
+        } else {
+                if ((val & LVDS_PIPE_MASK) != LVDS_PIPE(pipe))
+                        return false;
+        }
+        return true;
+}
+static bool adpa_pipe_enabled(struct drm_i915_private *dev_priv,
+                              enum pipe pipe, u32 val)
+{
+        if ((val & ADPA_DAC_ENABLE) == 0)
+                return false;
+        if (HAS_PCH_CPT(dev_priv->dev)) {
+                if ((val & PORT_TRANS_SEL_MASK) != PORT_TRANS_SEL_CPT(pipe))
+                        return false;
+        } else {
+                if ((val & ADPA_PIPE_SELECT_MASK) != ADPA_PIPE_SELECT(pipe))
+                        return false;
+        }
+        return true;
+}
 static void assert_pch_dp_disabled(struct drm_i915_private *dev_priv,
                                   enum pipe pipe, int reg, u32 port_sel)
 {
        u32 val = I915_READ(reg);
-        WARN(dp_pipe_enabled(dev_priv, pipe, reg, port_sel, val),
+        WARN(dp_pipe_enabled(dev_priv, pipe, port_sel, val),
             "PCH DP (0x%08x) enabled on transcoder %c, should be disabled\n",
             reg, pipe_name(pipe));
 }
@@ -1011,7 +1058,7 @@ static void assert_pch_hdmi_disabled(struct drm_i915_private *dev_priv,
                                     enum pipe pipe, int reg)
 {
        u32 val = I915_READ(reg);
-        WARN(HDMI_PIPE_ENABLED(val, pipe),
+        WARN(hdmi_pipe_enabled(dev_priv, val, pipe),
             "PCH DP (0x%08x) enabled on transcoder %c, should be disabled\n",
             reg, pipe_name(pipe));
 }
@@ -1028,13 +1075,13 @@ static void assert_pch_ports_disabled(struct drm_i915_private *dev_priv,
        reg = PCH_ADPA;
        val = I915_READ(reg);
-        WARN(ADPA_PIPE_ENABLED(val, pipe),
+        WARN(adpa_pipe_enabled(dev_priv, val, pipe),
             "PCH VGA enabled on transcoder %c, should be disabled\n",
             pipe_name(pipe));
        reg = PCH_LVDS;
        val = I915_READ(reg);
-        WARN(LVDS_PIPE_ENABLED(val, pipe),
+        WARN(lvds_pipe_enabled(dev_priv, val, pipe),
             "PCH LVDS enabled on transcoder %c, should be disabled\n",
             pipe_name(pipe));
@@ -1360,7 +1407,7 @@ static void disable_pch_dp(struct drm_i915_private *dev_priv,
                           enum pipe pipe, int reg, u32 port_sel)
 {
        u32 val = I915_READ(reg);
-        if (dp_pipe_enabled(dev_priv, pipe, reg, port_sel, val)) {
+        if (dp_pipe_enabled(dev_priv, pipe, port_sel, val)) {
                DRM_DEBUG_KMS("Disabling pch dp %x on pipe %d\n", reg, pipe);
                I915_WRITE(reg, val & ~DP_PORT_EN);
        }
@@ -1370,7 +1417,7 @@ static void disable_pch_hdmi(struct drm_i915_private *dev_priv,
                             enum pipe pipe, int reg)
 {
        u32 val = I915_READ(reg);
-        if (HDMI_PIPE_ENABLED(val, pipe)) {
+        if (hdmi_pipe_enabled(dev_priv, val, pipe)) {
                DRM_DEBUG_KMS("Disabling pch HDMI %x on pipe %d\n",
                              reg, pipe);
                I915_WRITE(reg, val & ~PORT_ENABLE);
@@ -1392,12 +1439,13 @@ static void intel_disable_pch_ports(struct drm_i915_private *dev_priv,
        reg = PCH_ADPA;
        val = I915_READ(reg);
-        if (ADPA_PIPE_ENABLED(val, pipe))
+        if (adpa_pipe_enabled(dev_priv, val, pipe))
                I915_WRITE(reg, val & ~ADPA_DAC_ENABLE);
        reg = PCH_LVDS;
        val = I915_READ(reg);
-        if (LVDS_PIPE_ENABLED(val, pipe)) {
+        if (lvds_pipe_enabled(dev_priv, val, pipe)) {
+                DRM_DEBUG_KMS("disable lvds on pipe %d val 0x%08x\n", pipe, val);
                I915_WRITE(reg, val & ~LVDS_PORT_EN);
                POSTING_READ(reg);
                udelay(100);
@@ -5049,6 +5097,81 @@ static int i9xx_crtc_mode_set(struct drm_crtc *crtc,
        return ret;
 }
+static void ironlake_update_pch_refclk(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_mode_config *mode_config = &dev->mode_config;
+        struct drm_crtc *crtc;
+        struct intel_encoder *encoder;
+        struct intel_encoder *has_edp_encoder = NULL;
+        u32 temp;
+        bool has_lvds = false;
+        /* We need to take the global config into account */
+        list_for_each_entry(crtc, &mode_config->crtc_list, head) {
+                if (!crtc->enabled)
+                        continue;
+                list_for_each_entry(encoder, &mode_config->encoder_list,
+                                    base.head) {
+                        if (encoder->base.crtc != crtc)
+                                continue;
+                        switch (encoder->type) {
+                        case INTEL_OUTPUT_LVDS:
+                                has_lvds = true;
+                        case INTEL_OUTPUT_EDP:
+                                has_edp_encoder = encoder;
+                                break;
+                        }
+                }
+        }
+        /* Ironlake: try to setup display ref clock before DPLL
+         * enabling. This is only under driver's control after
+         * PCH B stepping, previous chipset stepping should be
+         * ignoring this setting.
+         */
+        temp = I915_READ(PCH_DREF_CONTROL);
+        /* Always enable nonspread source */
+        temp &= ~DREF_NONSPREAD_SOURCE_MASK;
+        temp |= DREF_NONSPREAD_SOURCE_ENABLE;
+        temp &= ~DREF_SSC_SOURCE_MASK;
+        temp |= DREF_SSC_SOURCE_ENABLE;
+        I915_WRITE(PCH_DREF_CONTROL, temp);
+        POSTING_READ(PCH_DREF_CONTROL);
+        udelay(200);
+        if (has_edp_encoder) {
+                if (intel_panel_use_ssc(dev_priv)) {
+                        temp |= DREF_SSC1_ENABLE;
+                        I915_WRITE(PCH_DREF_CONTROL, temp);
+                        POSTING_READ(PCH_DREF_CONTROL);
+                        udelay(200);
+                }
+                temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
+                /* Enable CPU source on CPU attached eDP */
+                if (!intel_encoder_is_pch_edp(&has_edp_encoder->base)) {
+                        if (intel_panel_use_ssc(dev_priv))
+                                temp |= DREF_CPU_SOURCE_OUTPUT_DOWNSPREAD;
+                        else
+                                temp |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
+                } else {
+                        /* Enable SSC on PCH eDP if needed */
+                        if (intel_panel_use_ssc(dev_priv)) {
+                                DRM_ERROR("enabling SSC on PCH\n");
+                                temp |= DREF_SUPERSPREAD_SOURCE_ENABLE;
+                        }
+                }
+                I915_WRITE(PCH_DREF_CONTROL, temp);
+                POSTING_READ(PCH_DREF_CONTROL);
+                udelay(200);
+        }
+}
 static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
                                  struct drm_display_mode *mode,
                                  struct drm_display_mode *adjusted_mode,
@@ -5244,49 +5367,7 @@ static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
        ironlake_compute_m_n(intel_crtc->bpp, lane, target_clock, link_bw,
                             &m_n);
-        /* Ironlake: try to setup display ref clock before DPLL
+        ironlake_update_pch_refclk(dev);
-         * enabling. This is only under driver's control after
-         * PCH B stepping, previous chipset stepping should be
-         * ignoring this setting.
-         */
-        temp = I915_READ(PCH_DREF_CONTROL);
-        /* Always enable nonspread source */
-        temp &= ~DREF_NONSPREAD_SOURCE_MASK;
-        temp |= DREF_NONSPREAD_SOURCE_ENABLE;
-        temp &= ~DREF_SSC_SOURCE_MASK;
-        temp |= DREF_SSC_SOURCE_ENABLE;
-        I915_WRITE(PCH_DREF_CONTROL, temp);
-        POSTING_READ(PCH_DREF_CONTROL);
-        udelay(200);
-        if (has_edp_encoder) {
-                if (intel_panel_use_ssc(dev_priv)) {
-                        temp |= DREF_SSC1_ENABLE;
-                        I915_WRITE(PCH_DREF_CONTROL, temp);
-                        POSTING_READ(PCH_DREF_CONTROL);
-                        udelay(200);
-                }
-                temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
-                /* Enable CPU source on CPU attached eDP */
-                if (!intel_encoder_is_pch_edp(&has_edp_encoder->base)) {
-                        if (intel_panel_use_ssc(dev_priv))
-                                temp |= DREF_CPU_SOURCE_OUTPUT_DOWNSPREAD;
-                        else
-                                temp |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
-                } else {
-                        /* Enable SSC on PCH eDP if needed */
-                        if (intel_panel_use_ssc(dev_priv)) {
-                                DRM_ERROR("enabling SSC on PCH\n");
-                                temp |= DREF_SUPERSPREAD_SOURCE_ENABLE;
-                        }
-                }
-                I915_WRITE(PCH_DREF_CONTROL, temp);
-                POSTING_READ(PCH_DREF_CONTROL);
-                udelay(200);
-        }
        fp = clock.n << 16 | clock.m1 << 8 | clock.m2;
        if (has_reduced_clock)
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 0feae908bb37..44fef5e1c490 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1841,6 +1841,11 @@ done:
 static void
 intel_dp_destroy (struct drm_connector *connector)
 {
+        struct drm_device *dev = connector->dev;
+        if (intel_dpd_is_edp(dev))
+                intel_panel_destroy_backlight(dev);
        drm_sysfs_connector_remove(connector);
        drm_connector_cleanup(connector);
        kfree(connector);
@@ -2072,6 +2077,8 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                                        DRM_MODE_TYPE_PREFERRED;
                        }
                }
+                dev_priv->int_edp_connector = connector;
+                intel_panel_setup_backlight(dev);
        }
        intel_dp_add_properties(intel_dp, connector);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 7b330e76a435..0b2ee9d39980 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -297,9 +297,10 @@ extern void intel_pch_panel_fitting(struct drm_device *dev,
 extern u32 intel_panel_get_max_backlight(struct drm_device *dev);
 extern u32 intel_panel_get_backlight(struct drm_device *dev);
 extern void intel_panel_set_backlight(struct drm_device *dev, u32 level);
-extern void intel_panel_setup_backlight(struct drm_device *dev);
+extern int intel_panel_setup_backlight(struct drm_device *dev);
 extern void intel_panel_enable_backlight(struct drm_device *dev);
 extern void intel_panel_disable_backlight(struct drm_device *dev);
+extern void intel_panel_destroy_backlight(struct drm_device *dev);
 extern enum drm_connector_status intel_panel_detect(struct drm_device *dev);
 extern void intel_crtc_load_lut(struct drm_crtc *crtc);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 2e8ddfcba40c..31da77f5c051 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -72,14 +72,16 @@ static void intel_lvds_enable(struct intel_lvds *intel_lvds)
 {
        struct drm_device *dev = intel_lvds->base.base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 ctl_reg, lvds_reg;
+        u32 ctl_reg, lvds_reg, stat_reg;
        if (HAS_PCH_SPLIT(dev)) {
                ctl_reg = PCH_PP_CONTROL;
                lvds_reg = PCH_LVDS;
+                stat_reg = PCH_PP_STATUS;
        } else {
                ctl_reg = PP_CONTROL;
                lvds_reg = LVDS;
+                stat_reg = PP_STATUS;
        }
        I915_WRITE(lvds_reg, I915_READ(lvds_reg) | LVDS_PORT_EN);
@@ -94,17 +96,16 @@ static void intel_lvds_enable(struct intel_lvds *intel_lvds)
                DRM_DEBUG_KMS("applying panel-fitter: %x, %x\n",
                              intel_lvds->pfit_control,
                              intel_lvds->pfit_pgm_ratios);
-                if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000)) {
-                        DRM_ERROR("timed out waiting for panel to power off\n");
+                I915_WRITE(PFIT_PGM_RATIOS, intel_lvds->pfit_pgm_ratios);
-                } else {
+                I915_WRITE(PFIT_CONTROL, intel_lvds->pfit_control);
-                        I915_WRITE(PFIT_PGM_RATIOS, intel_lvds->pfit_pgm_ratios);
+                intel_lvds->pfit_dirty = false;
-                        I915_WRITE(PFIT_CONTROL, intel_lvds->pfit_control);
-                        intel_lvds->pfit_dirty = false;
-                }
        }
        I915_WRITE(ctl_reg, I915_READ(ctl_reg) | POWER_TARGET_ON);
        POSTING_READ(lvds_reg);
+        if (wait_for((I915_READ(stat_reg) & PP_ON) != 0, 1000))
+                DRM_ERROR("timed out waiting for panel to power on\n");
        intel_panel_enable_backlight(dev);
 }
@@ -113,24 +114,25 @@ static void intel_lvds_disable(struct intel_lvds *intel_lvds)
 {
        struct drm_device *dev = intel_lvds->base.base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 ctl_reg, lvds_reg;
+        u32 ctl_reg, lvds_reg, stat_reg;
        if (HAS_PCH_SPLIT(dev)) {
                ctl_reg = PCH_PP_CONTROL;
                lvds_reg = PCH_LVDS;
+                stat_reg = PCH_PP_STATUS;
        } else {
                ctl_reg = PP_CONTROL;
                lvds_reg = LVDS;
+                stat_reg = PP_STATUS;
        }
        intel_panel_disable_backlight(dev);
        I915_WRITE(ctl_reg, I915_READ(ctl_reg) & ~POWER_TARGET_ON);
+        if (wait_for((I915_READ(stat_reg) & PP_ON) == 0, 1000))
+                DRM_ERROR("timed out waiting for panel to power off\n");
        if (intel_lvds->pfit_control) {
-                if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000))
-                        DRM_ERROR("timed out waiting for panel to power off\n");
                I915_WRITE(PFIT_CONTROL, 0);
                intel_lvds->pfit_dirty = true;
        }
@@ -398,53 +400,21 @@ out:
 static void intel_lvds_prepare(struct drm_encoder *encoder)
 {
-        struct drm_device *dev = encoder->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
-        /* We try to do the minimum that is necessary in order to unlock
+        /*
-         * the registers for mode setting.
-         *
-         * On Ironlake, this is quite simple as we just set the unlock key
-         * and ignore all subtleties. (This may cause some issues...)
-         *
         * Prior to Ironlake, we must disable the pipe if we want to adjust
         * the panel fitter. However at all other times we can just reset
         * the registers regardless.
         */
+        if (!HAS_PCH_SPLIT(encoder->dev) && intel_lvds->pfit_dirty)
-        if (HAS_PCH_SPLIT(dev)) {
+                intel_lvds_disable(intel_lvds);
-                I915_WRITE(PCH_PP_CONTROL,
-                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
-        } else if (intel_lvds->pfit_dirty) {
-                I915_WRITE(PP_CONTROL,
-                           (I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS)
-                           & ~POWER_TARGET_ON);
-        } else {
-                I915_WRITE(PP_CONTROL,
-                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
-        }
 }
 static void intel_lvds_commit(struct drm_encoder *encoder)
 {
-        struct drm_device *dev = encoder->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
-        /* Undo any unlocking done in prepare to prevent accidental
-         * adjustment of the registers.
-         */
-        if (HAS_PCH_SPLIT(dev)) {
-                u32 val = I915_READ(PCH_PP_CONTROL);
-                if ((val & PANEL_UNLOCK_REGS) == PANEL_UNLOCK_REGS)
-                        I915_WRITE(PCH_PP_CONTROL, val & 0x3);
-        } else {
-                u32 val = I915_READ(PP_CONTROL);
-                if ((val & PANEL_UNLOCK_REGS) == PANEL_UNLOCK_REGS)
-                        I915_WRITE(PP_CONTROL, val & 0x3);
-        }
        /* Always do a full power on as we do not know what state
         * we were left in.
         */
@@ -582,6 +552,8 @@ static void intel_lvds_destroy(struct drm_connector *connector)
        struct drm_device *dev = connector->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
+        intel_panel_destroy_backlight(dev);
        if (dev_priv->lid_notifier.notifier_call)
                acpi_lid_notifier_unregister(&dev_priv->lid_notifier);
        drm_sysfs_connector_remove(connector);
@@ -1040,6 +1012,19 @@ out:
                pwm = I915_READ(BLC_PWM_PCH_CTL1);
                pwm |= PWM_PCH_ENABLE;
                I915_WRITE(BLC_PWM_PCH_CTL1, pwm);
+                /*
+                 * Unlock registers and just
+                 * leave them unlocked
+                 */
+                I915_WRITE(PCH_PP_CONTROL,
+                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
+        } else {
+                /*
+                 * Unlock registers and just
+                 * leave them unlocked
+                 */
+                I915_WRITE(PP_CONTROL,
+                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
        }
        dev_priv->lid_notifier.notifier_call = intel_lid_notify;
        if (acpi_lid_notifier_register(&dev_priv->lid_notifier)) {
@@ -1049,6 +1034,9 @@ out:
        /* keep the LVDS connector */
        dev_priv->int_lvds_connector = connector;
        drm_sysfs_connector_add(connector);
+        intel_panel_setup_backlight(dev);
        return true;
 failed:
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index b7c5ddb564d1..b8e8158bb16e 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -227,7 +227,6 @@ void intel_opregion_asle_intr(struct drm_device *dev)
        asle->aslc = asle_stat;
 }
-/* Only present on Ironlake+ */
 void intel_opregion_gse_intr(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 05f500cd9c24..a9e0c7bcd317 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -277,7 +277,7 @@ void intel_panel_enable_backlight(struct drm_device *dev)
        dev_priv->backlight_enabled = true;
 }
-void intel_panel_setup_backlight(struct drm_device *dev)
+static void intel_panel_init_backlight(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -309,3 +309,73 @@ intel_panel_detect(struct drm_device *dev)
        return connector_status_unknown;
 }
+#ifdef CONFIG_BACKLIGHT_CLASS_DEVICE
+static int intel_panel_update_status(struct backlight_device *bd)
+{
+        struct drm_device *dev = bl_get_data(bd);
+        intel_panel_set_backlight(dev, bd->props.brightness);
+        return 0;
+}
+static int intel_panel_get_brightness(struct backlight_device *bd)
+{
+        struct drm_device *dev = bl_get_data(bd);
+        return intel_panel_get_backlight(dev);
+}
+static const struct backlight_ops intel_panel_bl_ops = {
+        .update_status = intel_panel_update_status,
+        .get_brightness = intel_panel_get_brightness,
+};
+int intel_panel_setup_backlight(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct backlight_properties props;
+        struct drm_connector *connector;
+        intel_panel_init_backlight(dev);
+        if (dev_priv->int_lvds_connector)
+                connector = dev_priv->int_lvds_connector;
+        else if (dev_priv->int_edp_connector)
+                connector = dev_priv->int_edp_connector;
+        else
+                return -ENODEV;
+        props.type = BACKLIGHT_RAW;
+        props.max_brightness = intel_panel_get_max_backlight(dev);
+        dev_priv->backlight =
+                backlight_device_register("intel_backlight",
+                                          &connector->kdev, dev,
+                                          &intel_panel_bl_ops, &props);
+        if (IS_ERR(dev_priv->backlight)) {
+                DRM_ERROR("Failed to register backlight: %ld\n",
+                          PTR_ERR(dev_priv->backlight));
+                dev_priv->backlight = NULL;
+                return -ENODEV;
+        }
+        dev_priv->backlight->props.brightness = intel_panel_get_backlight(dev);
+        return 0;
+}
+void intel_panel_destroy_backlight(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (dev_priv->backlight)
+                backlight_device_unregister(dev_priv->backlight);
+}
+#else
+int intel_panel_setup_backlight(struct drm_device *dev)
+{
+        intel_panel_init_backlight(dev);
+        return 0;
+}
+void intel_panel_destroy_backlight(struct drm_device *dev)
+{
+        return;
+}
+#endif
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 645b84b3d203..7ad43c6b1db7 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -613,6 +613,18 @@ static bool radeon_dp_get_link_status(struct radeon_connector *radeon_connector,
        return true;
 }
+bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector)
+{
+        u8 link_status[DP_LINK_STATUS_SIZE];
+        struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
+        if (!radeon_dp_get_link_status(radeon_connector, link_status))
+                return false;
+        if (dp_channel_eq_ok(link_status, dig->dp_lane_count))
+                return false;
+        return true;
+}
 struct radeon_dp_link_train_info {
        struct radeon_device *rdev;
        struct drm_encoder *encoder;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 14dce9f22172..fb5fa0898868 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -743,7 +743,7 @@ static void evergreen_program_watermarks(struct radeon_device *rdev,
                    !evergreen_average_bandwidth_vs_available_bandwidth(&wm) ||
                    !evergreen_check_latency_hiding(&wm) ||
                    (rdev->disp_priority == 2)) {
-                        DRM_INFO("force priority to high\n");
+                        DRM_DEBUG_KMS("force priority to high\n");
                        priority_a_cnt |= PRIORITY_ALWAYS_ON;
                        priority_b_cnt |= PRIORITY_ALWAYS_ON;
                }
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 6d6b5f16bc09..7f65940f918f 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -60,18 +60,20 @@ void radeon_connector_hotplug(struct drm_connector *connector)
        radeon_hpd_set_polarity(rdev, radeon_connector->hpd.hpd);
-        /* powering up/down the eDP panel generates hpd events which
+        /* if the connector is already off, don't turn it back on */
-         * can interfere with modesetting.
+        if (connector->dpms != DRM_MODE_DPMS_ON)
-         */
-        if (connector->connector_type == DRM_MODE_CONNECTOR_eDP)
                return;
-        /* pre-r600 did not always have the hpd pins mapped accurately to connectors */
+        /* just deal with DP (not eDP) here. */
-        if (rdev->family >= CHIP_R600) {
+        if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
-                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd))
+                int saved_dpms = connector->dpms;
+                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) &&
+                    radeon_dp_needs_link_train(radeon_connector))
                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                else
                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                connector->dpms = saved_dpms;
        }
 }
@@ -474,11 +476,19 @@ static void radeon_fixup_lvds_native_mode(struct drm_encoder *encoder,
 {
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
        struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+        struct drm_display_mode *t, *mode;
+        /* If the EDID preferred mode doesn't match the native mode, use it */
+        list_for_each_entry_safe(mode, t, &connector->probed_modes, head) {
+                if (mode->type & DRM_MODE_TYPE_PREFERRED) {
+                        if (mode->hdisplay != native_mode->hdisplay ||
+                            mode->vdisplay != native_mode->vdisplay)
+                                memcpy(native_mode, mode, sizeof(*mode));
+                }
+        }
        /* Try to get native mode details from EDID if necessary */
        if (!native_mode->clock) {
-                struct drm_display_mode *t, *mode;
                list_for_each_entry_safe(mode, t, &connector->probed_modes, head) {
                        if (mode->hdisplay == native_mode->hdisplay &&
                            mode->vdisplay == native_mode->vdisplay) {
@@ -489,6 +499,7 @@ static void radeon_fixup_lvds_native_mode(struct drm_encoder *encoder,
                        }
                }
        }
        if (!native_mode->clock) {
                DRM_DEBUG_KMS("No LVDS native mode details, disabling RMX\n");
                radeon_encoder->rmx_type = RMX_OFF;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 440e6ecccc40..a3b011b49465 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -32,6 +32,7 @@
 #include <drm/radeon_drm.h>
 #include <linux/vgaarb.h>
 #include <linux/vga_switcheroo.h>
+#include <linux/efi.h>
 #include "radeon_reg.h"
 #include "radeon.h"
 #include "atom.h"
@@ -348,6 +349,9 @@ bool radeon_card_posted(struct radeon_device *rdev)
 {
        uint32_t reg;
+        if (efi_enabled && rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
+                return false;
        /* first check CRTCs */
        if (ASIC_IS_DCE41(rdev)) {
                reg = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET) |
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index b293487e5aa3..319d85d7e759 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -2323,6 +2323,9 @@ radeon_add_atom_encoder(struct drm_device *dev,
        default:
                encoder->possible_crtcs = 0x3;
                break;
+        case 4:
+                encoder->possible_crtcs = 0xf;
+                break;
        case 6:
                encoder->possible_crtcs = 0x3f;
                break;
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index d09031c03e26..68820f5f6303 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -479,6 +479,7 @@ extern void radeon_dp_set_link_config(struct drm_connector *connector,
                                      struct drm_display_mode *mode);
 extern void radeon_dp_link_train(struct drm_encoder *encoder,
                                 struct drm_connector *connector);
+extern bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector);
 extern u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector);
 extern bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector);
 extern void atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mode);
diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
index 1a409c5bc9bc..c316294c48b4 100644
--- a/drivers/hwmon/ibmaem.c
+++ b/drivers/hwmon/ibmaem.c
@@ -432,13 +432,15 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg,
        aem_send_message(ipmi);
        res = wait_for_completion_timeout(&ipmi->read_complete, IPMI_TIMEOUT);
-        if (!res)
+        if (!res) {
-                return -ETIMEDOUT;
+                res = -ETIMEDOUT;
+                goto out;
+        }
        if (ipmi->rx_result || ipmi->rx_msg_len != rs_size ||
            memcmp(&rs_resp->id, &system_x_id, sizeof(system_x_id))) {
-                kfree(rs_resp);
+                res = -ENOENT;
-                return -ENOENT;
+                goto out;
        }
        switch (size) {
@@ -463,8 +465,11 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg,
                break;
        }
        }
+        res = 0;
-        return 0;
+out:
+        kfree(rs_resp);
+        return res;
 }
 /* Update AEM energy registers */
diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c
index d4bc114572de..ac254fba551b 100644
--- a/drivers/hwmon/pmbus/lm25066.c
+++ b/drivers/hwmon/pmbus/lm25066.c
@@ -161,6 +161,17 @@ static int lm25066_write_word_data(struct i2c_client *client, int page, int reg,
        return ret;
 }
+static int lm25066_write_byte(struct i2c_client *client, int page, u8 value)
+{
+        if (page > 1)
+                return -EINVAL;
+        if (page == 0)
+                return pmbus_write_byte(client, 0, value);
+        return 0;
+}
 static int lm25066_probe(struct i2c_client *client,
                          const struct i2c_device_id *id)
 {
@@ -204,6 +215,7 @@ static int lm25066_probe(struct i2c_client *client,
        info->read_word_data = lm25066_read_word_data;
        info->write_word_data = lm25066_write_word_data;
+        info->write_byte = lm25066_write_byte;
        switch (id->driver_data) {
        case lm25066:
diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h
index 0808d986d75b..a6ae20ffef6b 100644
--- a/drivers/hwmon/pmbus/pmbus.h
+++ b/drivers/hwmon/pmbus/pmbus.h
@@ -325,6 +325,7 @@ struct pmbus_driver_info {
        int (*read_word_data)(struct i2c_client *client, int page, int reg);
        int (*write_word_data)(struct i2c_client *client, int page, int reg,
                               u16 word);
+        int (*write_byte)(struct i2c_client *client, int page, u8 value);
        /*
         * The identify function determines supported PMBus functionality.
         * This function is only necessary if a chip driver supports multiple
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 5c1b6cf31701..a561c3a0e916 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -182,6 +182,24 @@ int pmbus_write_byte(struct i2c_client *client, int page, u8 value)
 }
 EXPORT_SYMBOL_GPL(pmbus_write_byte);
+/*
+ * _pmbus_write_byte() is similar to pmbus_write_byte(), but checks if
+ * a device specific mapping funcion exists and calls it if necessary.
+ */
+static int _pmbus_write_byte(struct i2c_client *client, int page, u8 value)
+{
+        struct pmbus_data *data = i2c_get_clientdata(client);
+        const struct pmbus_driver_info *info = data->info;
+        int status;
+        if (info->write_byte) {
+                status = info->write_byte(client, page, value);
+                if (status != -ENODATA)
+                        return status;
+        }
+        return pmbus_write_byte(client, page, value);
+}
 int pmbus_write_word_data(struct i2c_client *client, u8 page, u8 reg, u16 word)
 {
        int rv;
@@ -281,7 +299,7 @@ static int _pmbus_read_byte_data(struct i2c_client *client, int page, int reg)
 static void pmbus_clear_fault_page(struct i2c_client *client, int page)
 {
-        pmbus_write_byte(client, page, PMBUS_CLEAR_FAULTS);
+        _pmbus_write_byte(client, page, PMBUS_CLEAR_FAULTS);
 }
 void pmbus_clear_faults(struct i2c_client *client)
diff --git a/drivers/misc/cb710/core.c b/drivers/misc/cb710/core.c
index efec4139c3f6..68cd05b6d829 100644
--- a/drivers/misc/cb710/core.c
+++ b/drivers/misc/cb710/core.c
@@ -33,7 +33,7 @@ EXPORT_SYMBOL_GPL(cb710_pci_update_config_reg);
 static int __devinit cb710_pci_configure(struct pci_dev *pdev)
 {
        unsigned int devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
-        struct pci_dev *pdev0 = pci_get_slot(pdev->bus, devfn);
+        struct pci_dev *pdev0;
        u32 val;
        cb710_pci_update_config_reg(pdev, 0x48,
@@ -43,6 +43,7 @@ static int __devinit cb710_pci_configure(struct pci_dev *pdev)
        if (val & 0x80000000)
                return 0;
+        pdev0 = pci_get_slot(pdev->bus, devfn);
        if (!pdev0)
                return -ENODEV;
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index 006a5e9f8ab8..2bf229acd3b8 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -224,7 +224,7 @@ static void mmc_test_prepare_mrq(struct mmc_test_card *test,
 static int mmc_test_busy(struct mmc_command *cmd)
 {
        return !(cmd->resp[0] & R1_READY_FOR_DATA) ||
-                (R1_CURRENT_STATE(cmd->resp[0]) == 7);
+                (R1_CURRENT_STATE(cmd->resp[0]) == R1_STATE_PRG);
 }
 /*
@@ -2900,7 +2900,7 @@ static const struct file_operations mmc_test_fops_testlist = {
        .release        = single_release,
 };
-static void mmc_test_free_file_test(struct mmc_card *card)
+static void mmc_test_free_dbgfs_file(struct mmc_card *card)
 {
        struct mmc_test_dbgfs_file *df, *dfs;
@@ -2917,34 +2917,21 @@ static void mmc_test_free_file_test(struct mmc_card *card)
        mutex_unlock(&mmc_test_lock);
 }
-static int mmc_test_register_file_test(struct mmc_card *card)
+static int __mmc_test_register_dbgfs_file(struct mmc_card *card,
+        const char *name, mode_t mode, const struct file_operations *fops)
 {
        struct dentry *file = NULL;
        struct mmc_test_dbgfs_file *df;
-        int ret = 0;
-        mutex_lock(&mmc_test_lock);
-        if (card->debugfs_root)
-                file = debugfs_create_file("test", S_IWUSR | S_IRUGO,
-                        card->debugfs_root, card, &mmc_test_fops_test);
-        if (IS_ERR_OR_NULL(file)) {
-                dev_err(&card->dev,
-                        "Can't create test. Perhaps debugfs is disabled.\n");
-                ret = -ENODEV;
-                goto err;
-        }
        if (card->debugfs_root)
-                file = debugfs_create_file("testlist", S_IRUGO,
+                file = debugfs_create_file(name, mode, card->debugfs_root,
-                        card->debugfs_root, card, &mmc_test_fops_testlist);
+                        card, fops);
        if (IS_ERR_OR_NULL(file)) {
                dev_err(&card->dev,
-                        "Can't create testlist. Perhaps debugfs is disabled.\n");
+                        "Can't create %s. Perhaps debugfs is disabled.\n",
-                ret = -ENODEV;
+                        name);
-                goto err;
+                return -ENODEV;
        }
        df = kmalloc(sizeof(struct mmc_test_dbgfs_file), GFP_KERNEL);
@@ -2952,14 +2939,31 @@ static int mmc_test_register_file_test(struct mmc_card *card)
                debugfs_remove(file);
                dev_err(&card->dev,
                        "Can't allocate memory for internal usage.\n");
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto err;
        }
        df->card = card;
        df->file = file;
        list_add(&df->link, &mmc_test_file_test);
+        return 0;
+}
+static int mmc_test_register_dbgfs_file(struct mmc_card *card)
+{
+        int ret;
+        mutex_lock(&mmc_test_lock);
+        ret = __mmc_test_register_dbgfs_file(card, "test", S_IWUSR | S_IRUGO,
+                &mmc_test_fops_test);
+        if (ret)
+                goto err;
+        ret = __mmc_test_register_dbgfs_file(card, "testlist", S_IRUGO,
+                &mmc_test_fops_testlist);
+        if (ret)
+                goto err;
 err:
        mutex_unlock(&mmc_test_lock);
@@ -2974,7 +2978,7 @@ static int mmc_test_probe(struct mmc_card *card)
        if (!mmc_card_mmc(card) && !mmc_card_sd(card))
                return -ENODEV;
-        ret = mmc_test_register_file_test(card);
+        ret = mmc_test_register_dbgfs_file(card);
        if (ret)
                return ret;
@@ -2986,7 +2990,7 @@ static int mmc_test_probe(struct mmc_card *card)
 static void mmc_test_remove(struct mmc_card *card)
 {
        mmc_test_free_result(card);
-        mmc_test_free_file_test(card);
+        mmc_test_free_dbgfs_file(card);
 }
 static struct mmc_driver mmc_driver = {
@@ -3006,7 +3010,7 @@ static void __exit mmc_test_exit(void)
 {
        /* Clear stalled data if card is still plugged */
        mmc_test_free_result(NULL);
-        mmc_test_free_file_test(NULL);
+        mmc_test_free_dbgfs_file(NULL);
        mmc_unregister_driver(&mmc_driver);
 }
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 89bdeaec7182..91a0a7460ebb 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1502,7 +1502,7 @@ static int mmc_do_erase(struct mmc_card *card, unsigned int from,
                        goto out;
                }
        } while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||
-                 R1_CURRENT_STATE(cmd.resp[0]) == 7);
+                 R1_CURRENT_STATE(cmd.resp[0]) == R1_STATE_PRG);
 out:
        return err;
 }
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index aa7d1d79b8c5..5700b1cbdfec 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -259,7 +259,7 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
        }
        card->ext_csd.rev = ext_csd[EXT_CSD_REV];
-        if (card->ext_csd.rev > 5) {
+        if (card->ext_csd.rev > 6) {
                printk(KERN_ERR "%s: unrecognised EXT_CSD revision %d\n",
                        mmc_hostname(card->host), card->ext_csd.rev);
                err = -EINVAL;
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index 845ce7c533b9..770c3d06f5dc 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -407,7 +407,7 @@ int mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
                        break;
                if (mmc_host_is_spi(card->host))
                        break;
-        } while (R1_CURRENT_STATE(status) == 7);
+        } while (R1_CURRENT_STATE(status) == R1_STATE_PRG);
        if (mmc_host_is_spi(card->host)) {
                if (status & R1_SPI_ILLEGAL_COMMAND)
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 77f0b6b1681d..ff0f714b012c 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -62,7 +62,7 @@ struct idmac_desc {
        u32             des1;   /* Buffer sizes */
 #define IDMAC_SET_BUFFER1_SIZE(d, s) \
-        ((d)->des1 = ((d)->des1 & 0x03ffc000) | ((s) & 0x3fff))
+        ((d)->des1 = ((d)->des1 & 0x03ffe000) | ((s) & 0x1fff))
        u32             des2;   /* buffer 1 physical address */
@@ -699,7 +699,7 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
        }
        /* DDR mode set */
-        if (ios->ddr) {
+        if (ios->timing == MMC_TIMING_UHS_DDR50) {
                regs = mci_readl(slot->host, UHS_REG);
                regs |= (0x1 << slot->id) << 16;
                mci_writel(slot->host, UHS_REG, regs);
@@ -1646,7 +1646,7 @@ static int __init dw_mci_init_slot(struct dw_mci *host, unsigned int id)
                        mmc->caps |= MMC_CAP_4_BIT_DATA;
        if (host->pdata->quirks & DW_MCI_QUIRK_HIGHSPEED)
-                mmc->caps |= MMC_CAP_SD_HIGHSPEED;
+                mmc->caps |= MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED;
 #ifdef CONFIG_MMC_DW_IDMAC
        mmc->max_segs = host->ring_size;
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 9ebfb4b482f5..0e9780f5a4a9 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -27,6 +27,7 @@
 #include "sdhci-pltfm.h"
 #include "sdhci-esdhc.h"
+#define SDHCI_CTRL_D3CD                 0x08
 /* VENDOR SPEC register */
 #define SDHCI_VENDOR_SPEC               0xC0
 #define  SDHCI_VENDOR_SPEC_SDIO_QUIRK   0x00000002
@@ -141,13 +142,32 @@ static void esdhc_writel_le(struct sdhci_host *host, u32 val, int reg)
        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
        struct pltfm_imx_data *imx_data = pltfm_host->priv;
        struct esdhc_platform_data *boarddata = &imx_data->boarddata;
+        u32 data;
-        if (unlikely((reg == SDHCI_INT_ENABLE || reg == SDHCI_SIGNAL_ENABLE)
-                        && (boarddata->cd_type == ESDHC_CD_GPIO)))
+        if (unlikely(reg == SDHCI_INT_ENABLE || reg == SDHCI_SIGNAL_ENABLE)) {
-                /*
+                if (boarddata->cd_type == ESDHC_CD_GPIO)
-                 * these interrupts won't work with a custom card_detect gpio
+                        /*
-                 */
+                         * These interrupts won't work with a custom
-                val &= ~(SDHCI_INT_CARD_REMOVE | SDHCI_INT_CARD_INSERT);
+                         * card_detect gpio (only applied to mx25/35)
+                         */
+                        val &= ~(SDHCI_INT_CARD_REMOVE | SDHCI_INT_CARD_INSERT);
+                if (val & SDHCI_INT_CARD_INT) {
+                        /*
+                         * Clear and then set D3CD bit to avoid missing the
+                         * card interrupt.  This is a eSDHC controller problem
+                         * so we need to apply the following workaround: clear
+                         * and set D3CD bit will make eSDHC re-sample the card
+                         * interrupt. In case a card interrupt was lost,
+                         * re-sample it by the following steps.
+                         */
+                        data = readl(host->ioaddr + SDHCI_HOST_CONTROL);
+                        data &= ~SDHCI_CTRL_D3CD;
+                        writel(data, host->ioaddr + SDHCI_HOST_CONTROL);
+                        data |= SDHCI_CTRL_D3CD;
+                        writel(data, host->ioaddr + SDHCI_HOST_CONTROL);
+                }
+        }
        if (unlikely((imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT)
                                && (reg == SDHCI_INT_STATUS)
@@ -217,8 +237,10 @@ static void esdhc_writeb_le(struct sdhci_host *host, u8 val, int reg)
                 */
                return;
        case SDHCI_HOST_CONTROL:
-                /* FSL messed up here, so we can just keep those two */
+                /* FSL messed up here, so we can just keep those three */
-                new_val = val & (SDHCI_CTRL_LED | SDHCI_CTRL_4BITBUS);
+                new_val = val & (SDHCI_CTRL_LED | \
+                                SDHCI_CTRL_4BITBUS | \
+                                SDHCI_CTRL_D3CD);
                /* ensure the endianess */
                new_val |= ESDHC_HOST_CONTROL_LE;
                /* DMA mode bits are shifted */
diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
index 4198dbbc5c20..fc7e4a515629 100644
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -195,7 +195,8 @@ static int __devinit sdhci_pxav3_probe(struct platform_device *pdev)
        clk_enable(clk);
        host->quirks = SDHCI_QUIRK_BROKEN_TIMEOUT_VAL
-                | SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC;
+                | SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC
+                | SDHCI_QUIRK_32BIT_ADMA_SIZE;
        /* enable 1/8V DDR capable */
        host->mmc->caps |= MMC_CAP_1_8V_DDR;
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 460ffaf0f6d7..2bd7bf4fece7 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -19,6 +19,7 @@
 #include <linux/clk.h>
 #include <linux/io.h>
 #include <linux/gpio.h>
+#include <linux/module.h>
 #include <linux/mmc/host.h>
@@ -502,6 +503,9 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        /* This host supports the Auto CMD12 */
        host->quirks |= SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12;
+        /* Samsung SoCs need BROKEN_ADMA_ZEROLEN_DESC */
+        host->quirks |= SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC;
        if (pdata->cd_type == S3C_SDHCI_CD_NONE ||
            pdata->cd_type == S3C_SDHCI_CD_PERMANENT)
                host->quirks |= SDHCI_QUIRK_BROKEN_CARD_DETECTION;
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index c31a3343340d..0e02cc1df12e 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -628,12 +628,11 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
        /* timeout in us */
        if (!data)
                target_timeout = cmd->cmd_timeout_ms * 1000;
-        else
+        else {
-                target_timeout = data->timeout_ns / 1000 +
+                target_timeout = data->timeout_ns / 1000;
-                        data->timeout_clks / host->clock;
+                if (host->clock)
+                        target_timeout += data->timeout_clks / host->clock;
-        if (host->quirks & SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)
+        }
-                host->timeout_clk = host->clock / 1000;
        /*
         * Figure out needed cycles.
@@ -645,7 +644,6 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
         *     =>
         *     (1) / (2) > 2^6
         */
-        BUG_ON(!host->timeout_clk);
        count = 0;
        current_timeout = (1 << 13) * 1000 / host->timeout_clk;
        while (current_timeout < target_timeout) {
@@ -1867,9 +1865,6 @@ static void sdhci_tasklet_finish(unsigned long param)
        del_timer(&host->timer);
-        if (host->version >= SDHCI_SPEC_300)
-                del_timer(&host->tuning_timer);
        mrq = host->mrq;
        /*
@@ -2461,22 +2456,6 @@ int sdhci_add_host(struct sdhci_host *host)
                host->max_clk = host->ops->get_max_clock(host);
        }
-        host->timeout_clk =
-                (caps[0] & SDHCI_TIMEOUT_CLK_MASK) >> SDHCI_TIMEOUT_CLK_SHIFT;
-        if (host->timeout_clk == 0) {
-                if (host->ops->get_timeout_clock) {
-                        host->timeout_clk = host->ops->get_timeout_clock(host);
-                } else if (!(host->quirks &
-                                SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)) {
-                        printk(KERN_ERR
-                               "%s: Hardware doesn't specify timeout clock "
-                               "frequency.\n", mmc_hostname(mmc));
-                        return -ENODEV;
-                }
-        }
-        if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT)
-                host->timeout_clk *= 1000;
        /*
         * In case of Host Controller v3.00, find out whether clock
         * multiplier is supported.
@@ -2509,10 +2488,26 @@ int sdhci_add_host(struct sdhci_host *host)
        } else
                mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
+        host->timeout_clk =
+                (caps[0] & SDHCI_TIMEOUT_CLK_MASK) >> SDHCI_TIMEOUT_CLK_SHIFT;
+        if (host->timeout_clk == 0) {
+                if (host->ops->get_timeout_clock) {
+                        host->timeout_clk = host->ops->get_timeout_clock(host);
+                } else if (!(host->quirks &
+                                SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)) {
+                        printk(KERN_ERR
+                               "%s: Hardware doesn't specify timeout clock "
+                               "frequency.\n", mmc_hostname(mmc));
+                        return -ENODEV;
+                }
+        }
+        if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT)
+                host->timeout_clk *= 1000;
        if (host->quirks & SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)
-                mmc->max_discard_to = (1 << 27) / (mmc->f_max / 1000);
+                host->timeout_clk = mmc->f_max / 1000;
-        else
-                mmc->max_discard_to = (1 << 27) / host->timeout_clk;
+        mmc->max_discard_to = (1 << 27) / host->timeout_clk;
        mmc->caps |= MMC_CAP_SDIO_IRQ | MMC_CAP_ERASE | MMC_CAP_CMD23;
diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
index 8d185de90d20..44a9668c4b7a 100644
--- a/drivers/mmc/host/tmio_mmc.c
+++ b/drivers/mmc/host/tmio_mmc.c
@@ -27,7 +27,6 @@
 static int tmio_mmc_suspend(struct platform_device *dev, pm_message_t state)
 {
        const struct mfd_cell *cell = mfd_get_cell(dev);
-        struct mmc_host *mmc = platform_get_drvdata(dev);
        int ret;
        ret = tmio_mmc_host_suspend(&dev->dev);
@@ -42,7 +41,6 @@ static int tmio_mmc_suspend(struct platform_device *dev, pm_message_t state)
 static int tmio_mmc_resume(struct platform_device *dev)
 {
        const struct mfd_cell *cell = mfd_get_cell(dev);
-        struct mmc_host *mmc = platform_get_drvdata(dev);
        int ret = 0;
        /* Tell the MFD core we are ready to be enabled */
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index d724a18b5285..37e5790681ad 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -63,8 +63,9 @@ static inline void bnx2x_bz_fp(struct bnx2x *bp, int index)
        fp->disable_tpa = ((bp->flags & TPA_ENABLE_FLAG) == 0);
 #ifdef BCM_CNIC
-        /* We don't want TPA on FCoE, FWD and OOO L2 rings */
+        /* We don't want TPA on an FCoE L2 ring */
-        bnx2x_fcoe(bp, disable_tpa) = 1;
+        if (IS_FCOE_FP(fp))
+                fp->disable_tpa = 1;
 #endif
 }
@@ -1404,10 +1405,9 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
 u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
        struct bnx2x *bp = netdev_priv(dev);
 #ifdef BCM_CNIC
-        if (NO_FCOE(bp))
+        if (!NO_FCOE(bp)) {
-                return skb_tx_hash(dev, skb);
-        else {
                struct ethhdr *hdr = (struct ethhdr *)skb->data;
                u16 ether_type = ntohs(hdr->h_proto);
@@ -1424,8 +1424,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
                        return bnx2x_fcoe_tx(bp, txq_index);
        }
 #endif
-        /* Select a none-FCoE queue:  if FCoE is enabled, exclude FCoE L2 ring
+        /* select a non-FCoE queue */
-         */
        return __skb_tx_hash(dev, skb, BNX2X_NUM_ETH_QUEUES(bp));
 }
@@ -1448,6 +1447,28 @@ void bnx2x_set_num_queues(struct bnx2x *bp)
        bp->num_queues += NON_ETH_CONTEXT_USE;
 }
+/**
+ * bnx2x_set_real_num_queues - configure netdev->real_num_[tx,rx]_queues
+ *
+ * @bp:         Driver handle
+ *
+ * We currently support for at most 16 Tx queues for each CoS thus we will
+ * allocate a multiple of 16 for ETH L2 rings according to the value of the
+ * bp->max_cos.
+ *
+ * If there is an FCoE L2 queue the appropriate Tx queue will have the next
+ * index after all ETH L2 indices.
+ *
+ * If the actual number of Tx queues (for each CoS) is less than 16 then there
+ * will be the holes at the end of each group of 16 ETh L2 indices (0..15,
+ * 16..31,...) with indicies that are not coupled with any real Tx queue.
+ *
+ * The proper configuration of skb->queue_mapping is handled by
+ * bnx2x_select_queue() and __skb_tx_hash().
+ *
+ * bnx2x_setup_tc() takes care of the proper TC mappings so that __skb_tx_hash()
+ * will return a proper Tx index if TC is enabled (netdev->num_tc > 0).
+ */
 static inline int bnx2x_set_real_num_queues(struct bnx2x *bp)
 {
        int rc, tx, rx;
diff --git a/drivers/net/bnx2x/bnx2x_dcb.c b/drivers/net/bnx2x/bnx2x_dcb.c
index a4ea35f6a456..a1e004a82f7a 100644
--- a/drivers/net/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/bnx2x/bnx2x_dcb.c
@@ -920,7 +920,7 @@ static void bnx2x_dcbx_admin_mib_updated_params(struct bnx2x *bp,
 void bnx2x_dcbx_set_state(struct bnx2x *bp, bool dcb_on, u32 dcbx_enabled)
 {
-        if (!CHIP_IS_E1x(bp)) {
+        if (!CHIP_IS_E1x(bp) && !CHIP_IS_E3(bp)) {
                bp->dcb_state = dcb_on;
                bp->dcbx_enabled = dcbx_enabled;
        } else {
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index 150709111548..f74582a22c68 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -5798,6 +5798,12 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
        DP(BNX2X_MSG_MCP, "starting common init  func %d\n", BP_ABS_FUNC(bp));
+        /*
+         * take the UNDI lock to protect undi_unload flow from accessing
+         * registers while we're resetting the chip
+         */
+        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
        bnx2x_reset_common(bp);
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET, 0xffffffff);
@@ -5808,6 +5814,8 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
        }
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET, val);
+        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
        bnx2x_init_block(bp, BLOCK_MISC, PHASE_COMMON);
        if (!CHIP_IS_E1x(bp)) {
@@ -10251,10 +10259,17 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
        /* clean indirect addresses */
        pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
                               PCICFG_VENDOR_ID_OFFSET);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F0 + BP_PORT(bp)*16, 0);
+        /* Clean the following indirect addresses for all functions since it
-        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F0 + BP_PORT(bp)*16, 0);
+         * is not used by the driver.
-        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F0 + BP_PORT(bp)*16, 0);
+         */
-        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F0 + BP_PORT(bp)*16, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F1, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F1, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F1, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F1, 0);
        /*
         * Enable internal target-read (in case we are probed after PF FLR).
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 27b5ecb11830..40266c14e6dc 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -3007,11 +3007,27 @@
 /* [R 6] Debug only: Number of used entries in the data FIFO */
 #define PXP2_REG_HST_DATA_FIFO_STATUS                            0x12047c
 /* [R 7] Debug only: Number of used entries in the header FIFO */
-#define PXP2_REG_HST_HEADER_FIFO_STATUS                          0x120478
+#define PXP2_REG_HST_HEADER_FIFO_STATUS                          0x120478
-#define PXP2_REG_PGL_ADDR_88_F0                                  0x120534
+#define PXP2_REG_PGL_ADDR_88_F0                                  0x120534
-#define PXP2_REG_PGL_ADDR_8C_F0                                  0x120538
+/* [R 32] GRC address for configuration access to PCIE config address 0x88.
-#define PXP2_REG_PGL_ADDR_90_F0                                  0x12053c
+ * any write to this PCIE address will cause a GRC write access to the
-#define PXP2_REG_PGL_ADDR_94_F0                                  0x120540
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_88_F1                                  0x120544
+#define PXP2_REG_PGL_ADDR_8C_F0                                  0x120538
+/* [R 32] GRC address for configuration access to PCIE config address 0x8c.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_8C_F1                                  0x120548
+#define PXP2_REG_PGL_ADDR_90_F0                                  0x12053c
+/* [R 32] GRC address for configuration access to PCIE config address 0x90.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_90_F1                                  0x12054c
+#define PXP2_REG_PGL_ADDR_94_F0                                  0x120540
+/* [R 32] GRC address for configuration access to PCIE config address 0x94.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_94_F1                                  0x120550
 #define PXP2_REG_PGL_CONTROL0                                    0x120490
 #define PXP2_REG_PGL_CONTROL1                                    0x120514
 #define PXP2_REG_PGL_DEBUG                                       0x120520
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index f523f1cc5142..4b70b7e8bdeb 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -197,7 +197,7 @@ static void slc_bump(struct slcan *sl)
        skb->ip_summed = CHECKSUM_UNNECESSARY;
        memcpy(skb_put(skb, sizeof(struct can_frame)),
               &cf, sizeof(struct can_frame));
-        netif_rx(skb);
+        netif_rx_ni(skb);
        sl->dev->stats.rx_packets++;
        sl->dev->stats.rx_bytes += cf.can_dlc;
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 480f2592f8a5..536b3a55c45f 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -2085,7 +2085,8 @@ struct e1000_info e1000_82574_info = {
                                  | FLAG_HAS_AMT
                                  | FLAG_HAS_CTRLEXT_ON_LOAD,
        .flags2                   = FLAG2_CHECK_PHY_HANG
-                                  | FLAG2_DISABLE_ASPM_L0S,
+                                  | FLAG2_DISABLE_ASPM_L0S
+                                  | FLAG2_NO_DISABLE_RX,
        .pba                    = 32,
        .max_hw_frame_size      = DEFAULT_JUMBO,
        .get_variants           = e1000_get_variants_82571,
@@ -2104,7 +2105,8 @@ struct e1000_info e1000_82583_info = {
                                  | FLAG_HAS_AMT
                                  | FLAG_HAS_JUMBO_FRAMES
                                  | FLAG_HAS_CTRLEXT_ON_LOAD,
-        .flags2                 = FLAG2_DISABLE_ASPM_L0S,
+        .flags2                 = FLAG2_DISABLE_ASPM_L0S
+                                  | FLAG2_NO_DISABLE_RX,
        .pba                    = 32,
        .max_hw_frame_size      = DEFAULT_JUMBO,
        .get_variants           = e1000_get_variants_82571,
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 638d175792cf..35916f485028 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -453,6 +453,7 @@ struct e1000_info {
 #define FLAG2_DISABLE_ASPM_L0S            (1 << 7)
 #define FLAG2_DISABLE_AIM                 (1 << 8)
 #define FLAG2_CHECK_PHY_HANG              (1 << 9)
+#define FLAG2_NO_DISABLE_RX               (1 << 10)
 #define E1000_RX_DESC_PS(R, i)      \
        (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index 06d88f316dce..6a0526a59a8a 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -1206,7 +1206,8 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
        rx_ring->next_to_clean = 0;
        rctl = er32(RCTL);
-        ew32(RCTL, rctl & ~E1000_RCTL_EN);
+        if (!(adapter->flags2 & FLAG2_NO_DISABLE_RX))
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
        ew32(RDBAL, ((u64) rx_ring->dma & 0xFFFFFFFF));
        ew32(RDBAH, ((u64) rx_ring->dma >> 32));
        ew32(RDLEN, rx_ring->size);
diff --git a/drivers/net/e1000e/lib.c b/drivers/net/e1000e/lib.c
index 7898a67d6505..0893ab107adf 100644
--- a/drivers/net/e1000e/lib.c
+++ b/drivers/net/e1000e/lib.c
@@ -190,7 +190,8 @@ s32 e1000_check_alt_mac_addr_generic(struct e1000_hw *hw)
        /* Check for LOM (vs. NIC) or one of two valid mezzanine cards */
        if (!((nvm_data & NVM_COMPAT_LOM) ||
              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_DUAL) ||
-              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD)))
+              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD) ||
+              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES)))
                goto out;
        ret_val = e1000_read_nvm(hw, NVM_ALT_MAC_ADDR_PTR, 1,
@@ -200,10 +201,10 @@ s32 e1000_check_alt_mac_addr_generic(struct e1000_hw *hw)
                goto out;
        }
-        if (nvm_alt_mac_addr_offset == 0xFFFF) {
+        if ((nvm_alt_mac_addr_offset == 0xFFFF) ||
+            (nvm_alt_mac_addr_offset == 0x0000))
                /* There is no Alternate MAC Address */
                goto out;
-        }
        if (hw->bus.func == E1000_FUNC_1)
                nvm_alt_mac_addr_offset += E1000_ALT_MAC_ADDRESS_OFFSET_LAN1;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index ab4be80f7ab5..362f70382cdd 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -56,7 +56,7 @@
 #define DRV_EXTRAVERSION "-k"
-#define DRV_VERSION "1.3.16" DRV_EXTRAVERSION
+#define DRV_VERSION "1.4.4" DRV_EXTRAVERSION
 char e1000e_driver_name[] = "e1000e";
 const char e1000e_driver_version[] = DRV_VERSION;
@@ -2915,7 +2915,8 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
        /* disable receives while setting up the descriptors */
        rctl = er32(RCTL);
-        ew32(RCTL, rctl & ~E1000_RCTL_EN);
+        if (!(adapter->flags2 & FLAG2_NO_DISABLE_RX))
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
        e1e_flush();
        usleep_range(10000, 20000);
@@ -3394,7 +3395,8 @@ void e1000e_down(struct e1000_adapter *adapter)
        /* disable receives in the hardware */
        rctl = er32(RCTL);
-        ew32(RCTL, rctl & ~E1000_RCTL_EN);
+        if (!(adapter->flags2 & FLAG2_NO_DISABLE_RX))
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
        /* flush and sleep below */
        netif_stop_queue(netdev);
@@ -3403,6 +3405,7 @@ void e1000e_down(struct e1000_adapter *adapter)
        tctl = er32(TCTL);
        tctl &= ~E1000_TCTL_EN;
        ew32(TCTL, tctl);
        /* flush both disables and wait for them to finish */
        e1e_flush();
        usleep_range(10000, 20000);
diff --git a/drivers/net/gianfar_ptp.c b/drivers/net/gianfar_ptp.c
index 1c97861596f0..f67b8aebc89c 100644
--- a/drivers/net/gianfar_ptp.c
+++ b/drivers/net/gianfar_ptp.c
@@ -193,14 +193,9 @@ static void set_alarm(struct etsects *etsects)
 /* Caller must hold etsects->lock. */
 static void set_fipers(struct etsects *etsects)
 {
-        u32 tmr_ctrl = gfar_read(&etsects->regs->tmr_ctrl);
+        set_alarm(etsects);
-        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl & (~TE));
-        gfar_write(&etsects->regs->tmr_prsc,   etsects->tmr_prsc);
        gfar_write(&etsects->regs->tmr_fiper1, etsects->tmr_fiper1);
        gfar_write(&etsects->regs->tmr_fiper2, etsects->tmr_fiper2);
-        set_alarm(etsects);
-        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl|TE);
 }
 /*
@@ -511,7 +506,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
        gfar_write(&etsects->regs->tmr_fiper1, etsects->tmr_fiper1);
        gfar_write(&etsects->regs->tmr_fiper2, etsects->tmr_fiper2);
        set_alarm(etsects);
-        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl|FS|RTPE|TE);
+        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl|FS|RTPE|TE|FRD);
        spin_unlock_irqrestore(&etsects->lock, flags);
diff --git a/drivers/net/irda/sh_irda.c b/drivers/net/irda/sh_irda.c
index 4488bd581eca..82660672dcd9 100644
--- a/drivers/net/irda/sh_irda.c
+++ b/drivers/net/irda/sh_irda.c
@@ -22,6 +22,8 @@
 *  - DMA transfer support
 *  - FIFO mode support
 */
+#include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 52a7c86af663..ed7d7d62bf68 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -12,6 +12,8 @@
 * published by the Free Software Foundation.
 */
+#include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
@@ -511,7 +513,7 @@ static void sh_sir_tx(struct sh_sir_self *self, int phase)
 static int sh_sir_read_data(struct sh_sir_self *self)
 {
-        u16 val;
+        u16 val = 0;
        int timeout = 1024;
        while (timeout--) {
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index 8b3090dc4bcd..80b6f36a8074 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -82,7 +82,7 @@ static int cards_found;
 /*
 * VLB I/O addresses
 */
-static unsigned int pcnet32_portlist[] __initdata =
+static unsigned int pcnet32_portlist[] =
    { 0x300, 0x320, 0x340, 0x360, 0 };
 static int pcnet32_debug;
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 2cd8dc5847b4..cb6e0b486b1e 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -34,8 +34,7 @@
 #define PAGESEL         0x13
 #define LAYER4          0x02
 #define LAYER2          0x01
-#define MAX_RXTS        4
+#define MAX_RXTS        64
-#define MAX_TXTS        4
 #define N_EXT_TS        1
 #define PSF_PTPVER      2
 #define PSF_EVNT        0x4000
@@ -218,7 +217,7 @@ static void phy2rxts(struct phy_rxts *p, struct rxts *rxts)
        rxts->seqid = p->seqid;
        rxts->msgtype = (p->msgtype >> 12) & 0xf;
        rxts->hash = p->msgtype & 0x0fff;
-        rxts->tmo = jiffies + HZ;
+        rxts->tmo = jiffies + 2;
 }
 static u64 phy2txts(struct phy_txts *p)
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index f11b3f3df24f..4c617534f937 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -367,7 +367,7 @@ static void sl_bump(struct slip *sl)
        memcpy(skb_put(skb, count), sl->rbuff, count);
        skb_reset_mac_header(skb);
        skb->protocol = htons(ETH_P_IP);
-        netif_rx(skb);
+        netif_rx_ni(skb);
        dev->stats.rx_packets++;
 }
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 041fb7d43c4f..ef3b236b5145 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -977,7 +977,6 @@ static void rtl8150_disconnect(struct usb_interface *intf)
        usb_set_intfdata(intf, NULL);
        if (dev) {
                set_bit(RTL8150_UNPLUG, &dev->flags);
-                tasklet_disable(&dev->tl);
                tasklet_kill(&dev->tl);
                unregister_netdev(dev->netdev);
                unlink_all_urbs(dev);
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index f54dff44ed50..c3119a6caace 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1735,6 +1735,8 @@ ath5k_beacon_setup(struct ath5k_hw *ah, struct ath5k_buf *bf)
        if (dma_mapping_error(ah->dev, bf->skbaddr)) {
                ATH5K_ERR(ah, "beacon DMA mapping failed\n");
+                dev_kfree_skb_any(skb);
+                bf->skb = NULL;
                return -EIO;
        }
@@ -1819,8 +1821,6 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
        ath5k_txbuf_free_skb(ah, avf->bbuf);
        avf->bbuf->skb = skb;
        ret = ath5k_beacon_setup(ah, avf->bbuf);
-        if (ret)
-                avf->bbuf->skb = NULL;
 out:
        return ret;
 }
@@ -1840,6 +1840,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
        struct ath5k_vif *avf;
        struct ath5k_buf *bf;
        struct sk_buff *skb;
+        int err;
        ATH5K_DBG_UNLIMIT(ah, ATH5K_DEBUG_BEACON, "in beacon_send\n");
@@ -1888,11 +1889,6 @@ ath5k_beacon_send(struct ath5k_hw *ah)
        avf = (void *)vif->drv_priv;
        bf = avf->bbuf;
-        if (unlikely(bf->skb == NULL || ah->opmode == NL80211_IFTYPE_STATION ||
-                     ah->opmode == NL80211_IFTYPE_MONITOR)) {
-                ATH5K_WARN(ah, "bf=%p bf_skb=%p\n", bf, bf ? bf->skb : NULL);
-                return;
-        }
        /*
         * Stop any current dma and put the new frame on the queue.
@@ -1906,8 +1902,17 @@ ath5k_beacon_send(struct ath5k_hw *ah)
        /* refresh the beacon for AP or MESH mode */
        if (ah->opmode == NL80211_IFTYPE_AP ||
-            ah->opmode == NL80211_IFTYPE_MESH_POINT)
+            ah->opmode == NL80211_IFTYPE_MESH_POINT) {
-                ath5k_beacon_update(ah->hw, vif);
+                err = ath5k_beacon_update(ah->hw, vif);
+                if (err)
+                        return;
+        }
+        if (unlikely(bf->skb == NULL || ah->opmode == NL80211_IFTYPE_STATION ||
+                     ah->opmode == NL80211_IFTYPE_MONITOR)) {
+                ATH5K_WARN(ah, "bf=%p bf_skb=%p\n", bf, bf->skb);
+                return;
+        }
        trace_ath5k_tx(ah, bf->skb, &ah->txqs[ah->bhalq]);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index d109c25417f4..c34bef1bf2b0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -307,7 +307,7 @@ static const struct ar9300_eeprom ar9300_default = {
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
-                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
@@ -884,7 +884,7 @@ static const struct ar9300_eeprom ar9300_x113 = {
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
-                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
@@ -2040,7 +2040,7 @@ static const struct ar9300_eeprom ar9300_x112 = {
                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
-                { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
@@ -3734,7 +3734,7 @@ static void ar9003_hw_internal_regulator_apply(struct ath_hw *ah)
                                }
                        } else {
                                reg_pmu_set = (5 << 1) | (7 << 4) |
-                                              (1 << 8) | (2 << 14) |
+                                              (2 << 8) | (2 << 14) |
                                              (6 << 17) | (1 << 20) |
                                              (3 << 24) | (1 << 28);
                        }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 6de3f0bc18e6..5c590429f120 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -850,7 +850,7 @@
 #define AR_PHY_TPC_11_B1         (AR_SM1_BASE + 0x220)
 #define AR_PHY_PDADC_TAB_1       (AR_SM1_BASE + 0x240)
 #define AR_PHY_TX_IQCAL_STATUS_B1   (AR_SM1_BASE + 0x48c)
-#define AR_PHY_TX_IQCAL_CORR_COEFF_B1(_i)    (AR_SM_BASE + 0x450 + ((_i) << 2))
+#define AR_PHY_TX_IQCAL_CORR_COEFF_B1(_i)    (AR_SM1_BASE + 0x450 + ((_i) << 2))
 /*
 * Channel 2 Register Map
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 83cba22ac6e8..481e534534eb 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -795,9 +795,23 @@ static u64 supported_dma_mask(struct b43_wldev *dev)
        u32 tmp;
        u16 mmio_base;
-        tmp = b43_read32(dev, SSB_TMSHIGH);
+        switch (dev->dev->bus_type) {
-        if (tmp & SSB_TMSHIGH_DMA64)
+#ifdef CONFIG_B43_BCMA
-                return DMA_BIT_MASK(64);
+        case B43_BUS_BCMA:
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
+                if (tmp & BCMA_IOST_DMA64)
+                        return DMA_BIT_MASK(64);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
+                if (tmp & SSB_TMSHIGH_DMA64)
+                        return DMA_BIT_MASK(64);
+                break;
+#endif
+        }
        mmio_base = b43_dmacontroller_base(0, 0);
        b43_write32(dev, mmio_base + B43_DMA32_TXCTL, B43_DMA32_TXADDREXT_MASK);
        tmp = b43_read32(dev, mmio_base + B43_DMA32_TXCTL);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 507559361d87..939563162fb3 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -921,6 +921,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
        { USB_DEVICE(0x07d1, 0x3c16) },
        /* Draytek */
        { USB_DEVICE(0x07fa, 0x7712) },
+        /* DVICO */
+        { USB_DEVICE(0x0fe9, 0xb307) },
        /* Edimax */
        { USB_DEVICE(0x7392, 0x7711) },
        { USB_DEVICE(0x7392, 0x7717) },
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 6a93939f44e8..0baeb894f093 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2420,6 +2420,7 @@ static struct usb_device_id rt73usb_device_table[] = {
        /* Buffalo */
        { USB_DEVICE(0x0411, 0x00d8) },
        { USB_DEVICE(0x0411, 0x00d9) },
+        { USB_DEVICE(0x0411, 0x00e6) },
        { USB_DEVICE(0x0411, 0x00f4) },
        { USB_DEVICE(0x0411, 0x0116) },
        { USB_DEVICE(0x0411, 0x0119) },
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 942f7a3969a7..ef63c0df006a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -281,6 +281,8 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
        {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817d, rtl92cu_hal_cfg)},
        /* 8188CE-VAU USB minCard (b/g mode only) */
        {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817e, rtl92cu_hal_cfg)},
+        /* 8188RU in Alfa AWUS036NHR */
+        {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817f, rtl92cu_hal_cfg)},
        /* 8188 Combo for BC4 */
        {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8754, rtl92cu_hal_cfg)},
@@ -303,20 +305,23 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
        {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
        /* HP - Lite-On ,8188CUS Slim Combo */
        {RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
        {RTL_USB_DEVICE(0x2001, 0x3308, rtl92cu_hal_cfg)}, /*D-Link - Alpha*/
        {RTL_USB_DEVICE(0x2019, 0xab2a, rtl92cu_hal_cfg)}, /*Planex - Abocom*/
        {RTL_USB_DEVICE(0x2019, 0xed17, rtl92cu_hal_cfg)}, /*PCI - Edimax*/
        {RTL_USB_DEVICE(0x20f4, 0x648b, rtl92cu_hal_cfg)}, /*TRENDnet - Cameo*/
        {RTL_USB_DEVICE(0x7392, 0x7811, rtl92cu_hal_cfg)}, /*Edimax - Edimax*/
-        {RTL_USB_DEVICE(0x3358, 0x13d3, rtl92cu_hal_cfg)}, /*Azwave 8188CE-VAU*/
+        {RTL_USB_DEVICE(0x13d3, 0x3358, rtl92cu_hal_cfg)}, /*Azwave 8188CE-VAU*/
        /* Russian customer -Azwave (8188CE-VAU  b/g mode only) */
-        {RTL_USB_DEVICE(0x3359, 0x13d3, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(0x13d3, 0x3359, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(0x4855, 0x0090, rtl92cu_hal_cfg)}, /* Feixun */
+        {RTL_USB_DEVICE(0x4855, 0x0091, rtl92cu_hal_cfg)}, /* NetweeN-Feixun */
+        {RTL_USB_DEVICE(0x9846, 0x9041, rtl92cu_hal_cfg)}, /* Netgear Cameo */
        /****** 8192CU ********/
        {RTL_USB_DEVICE(0x0586, 0x341f, rtl92cu_hal_cfg)}, /*Zyxel -Abocom*/
        {RTL_USB_DEVICE(0x07aa, 0x0056, rtl92cu_hal_cfg)}, /*ATKK-Gemtek*/
        {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
-        {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Abocom -Abocom*/
        {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
        {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
        {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
diff --git a/drivers/net/wireless/wl1251/acx.c b/drivers/net/wireless/wl1251/acx.c
index ef8370edace7..ad87a1ac6462 100644
--- a/drivers/net/wireless/wl1251/acx.c
+++ b/drivers/net/wireless/wl1251/acx.c
@@ -140,8 +140,6 @@ int wl1251_acx_sleep_auth(struct wl1251 *wl, u8 sleep_auth)
        auth->sleep_auth = sleep_auth;
        ret = wl1251_cmd_configure(wl, ACX_SLEEP_AUTH, auth, sizeof(*auth));
-        if (ret < 0)
-                return ret;
 out:
        kfree(auth);
@@ -681,10 +679,8 @@ int wl1251_acx_cca_threshold(struct wl1251 *wl)
        ret = wl1251_cmd_configure(wl, ACX_CCA_THRESHOLD,
                                   detection, sizeof(*detection));
-        if (ret < 0) {
+        if (ret < 0)
                wl1251_warning("failed to set cca threshold: %d", ret);
-                return ret;
-        }
 out:
        kfree(detection);
diff --git a/drivers/net/wireless/wl1251/cmd.c b/drivers/net/wireless/wl1251/cmd.c
index 81f164bc4888..d14d69d733a0 100644
--- a/drivers/net/wireless/wl1251/cmd.c
+++ b/drivers/net/wireless/wl1251/cmd.c
@@ -241,7 +241,7 @@ int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
        if (ret < 0) {
                wl1251_error("tx %s cmd for channel %d failed",
                             enable ? "start" : "stop", channel);
-                return ret;
+                goto out;
        }
        wl1251_debug(DEBUG_BOOT, "tx %s cmd channel %d",
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 3195dbd3ec34..44e91e598f8d 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -639,7 +639,7 @@ EXPORT_SYMBOL_GPL(rtc_irq_unregister);
 static int rtc_update_hrtimer(struct rtc_device *rtc, int enabled)
 {
        /*
-         * We unconditionally cancel the timer here, because otherwise
+         * We always cancel the timer here first, because otherwise
         * we could run into BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
         * when we manage to start the timer before the callback
         * returns HRTIMER_RESTART.
@@ -708,7 +708,7 @@ int rtc_irq_set_freq(struct rtc_device *rtc, struct rtc_task *task, int freq)
        int err = 0;
        unsigned long flags;
-        if (freq <= 0 || freq > 5000)
+        if (freq <= 0 || freq > RTC_MAX_FREQ)
                return -EINVAL;
 retry:
        spin_lock_irqsave(&rtc->irq_task_lock, flags);
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
index c01c0cb0af4e..b99a11a9dd69 100644
--- a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
@@ -812,7 +812,7 @@ int AthCreateCommandList(struct ps_cmd_packet **HciPacketList, u32 *numPackets)
    for(count = 0; count < Patch_Count; count++) {
        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Freeing Patch Buffer %d \r\n",count));
-        kfree(RamPatch[Patch_Count].Data);
+        kfree(RamPatch[count].Data);
    }
    for(count = 0; count < Tag_Count; count++) {
diff --git a/drivers/staging/dt3155v4l/dt3155v4l.c b/drivers/staging/dt3155v4l/dt3155v4l.c
index fe02d22274b4..05aa41cf875b 100644
--- a/drivers/staging/dt3155v4l/dt3155v4l.c
+++ b/drivers/staging/dt3155v4l/dt3155v4l.c
@@ -22,6 +22,7 @@
 #include <linux/stringify.h>
 #include <linux/delay.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include <media/v4l2-dev.h>
 #include <media/v4l2-ioctl.h>
 #include <media/videobuf2-dma-contig.h>
diff --git a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
index 627a98b4ec30..9e728b3415e3 100644
--- a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
+++ b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
@@ -22,6 +22,7 @@
 #include <linux/string.h>
 #include <linux/vmalloc.h>
 #include <linux/netdevice.h>
+#include <asm/io.h>
 #include <asm/uaccess.h>
 #include "ft1000.h"
diff --git a/drivers/staging/gma500/mdfld_dsi_dbi.c b/drivers/staging/gma500/mdfld_dsi_dbi.c
index 02e17c9c8637..fd211f3467c4 100644
--- a/drivers/staging/gma500/mdfld_dsi_dbi.c
+++ b/drivers/staging/gma500/mdfld_dsi_dbi.c
@@ -711,10 +711,11 @@ struct mdfld_dsi_encoder *mdfld_dsi_dbi_init(struct drm_device *dev,
        /* Create drm encoder object */
        connector = &dsi_connector->base.base;
        encoder = &dbi_output->base.base;
+        /* Review this if we ever get MIPI-HDMI bridges or similar */
        drm_encoder_init(dev,
                        encoder,
                        p_funcs->encoder_funcs,
-                        DRM_MODE_ENCODER_MIPI);
+                        DRM_MODE_ENCODER_LVDS);
        drm_encoder_helper_add(encoder, p_funcs->encoder_helper_funcs);
        /* Attach to given connector */
diff --git a/drivers/staging/gma500/mdfld_dsi_dbi.h b/drivers/staging/gma500/mdfld_dsi_dbi.h
index dc6242c51d0b..f0fa986fd934 100644
--- a/drivers/staging/gma500/mdfld_dsi_dbi.h
+++ b/drivers/staging/gma500/mdfld_dsi_dbi.h
@@ -42,9 +42,6 @@
 #include "mdfld_dsi_output.h"
 #include "mdfld_output.h"
-#define DRM_MODE_ENCODER_MIPI  5
 /*
 * DBI encoder which inherits from mdfld_dsi_encoder
 */
diff --git a/drivers/staging/gma500/mdfld_dsi_dpi.c b/drivers/staging/gma500/mdfld_dsi_dpi.c
index 6e03a91e947e..e685f1217baa 100644
--- a/drivers/staging/gma500/mdfld_dsi_dpi.c
+++ b/drivers/staging/gma500/mdfld_dsi_dpi.c
@@ -777,10 +777,15 @@ struct mdfld_dsi_encoder *mdfld_dsi_dpi_init(struct drm_device *dev,
        /* Create drm encoder object */
        connector = &dsi_connector->base.base;
        encoder = &dpi_output->base.base;
+        /*
+         * On existing hardware this will be a panel of some form,
+         * if future devices also have HDMI bridges this will need
+         * revisiting
+         */
        drm_encoder_init(dev,
                        encoder,
                        p_funcs->encoder_funcs,
-                        DRM_MODE_ENCODER_MIPI);
+                        DRM_MODE_ENCODER_LVDS);
        drm_encoder_helper_add(encoder,
                                p_funcs->encoder_helper_funcs);
        
diff --git a/drivers/staging/gma500/mdfld_dsi_output.c b/drivers/staging/gma500/mdfld_dsi_output.c
index 7536095c30a0..9050c0f78b15 100644
--- a/drivers/staging/gma500/mdfld_dsi_output.c
+++ b/drivers/staging/gma500/mdfld_dsi_output.c
@@ -955,7 +955,9 @@ void mdfld_dsi_output_init(struct drm_device *dev,
        psb_output->type = (pipe == 0) ? INTEL_OUTPUT_MIPI : INTEL_OUTPUT_MIPI2;
        connector = &psb_output->base;
-        drm_connector_init(dev, connector, &mdfld_dsi_connector_funcs, DRM_MODE_CONNECTOR_MIPI);
+        /* Revisit type if MIPI/HDMI bridges ever appear on Medfield */
+        drm_connector_init(dev, connector, &mdfld_dsi_connector_funcs,
+                                                DRM_MODE_CONNECTOR_LVDS);
        drm_connector_helper_add(connector, &mdfld_dsi_connector_helper_funcs);
        
        connector->display_info.subpixel_order = SubPixelHorizontalRGB;
diff --git a/drivers/staging/gma500/medfield.h b/drivers/staging/gma500/medfield.h
index 38165e8367e5..09e9687431f1 100644
--- a/drivers/staging/gma500/medfield.h
+++ b/drivers/staging/gma500/medfield.h
@@ -21,8 +21,6 @@
 * DEALINGS IN THE SOFTWARE.
 */
-#define DRM_MODE_ENCODER_MIPI  5
 /* Medfield DSI controller registers */
 #define MIPIA_DEVICE_READY_REG                          0xb000
diff --git a/drivers/staging/gma500/psb_drv.h b/drivers/staging/gma500/psb_drv.h
index 72f487a2a1b7..fd4732dd783a 100644
--- a/drivers/staging/gma500/psb_drv.h
+++ b/drivers/staging/gma500/psb_drv.h
@@ -35,7 +35,6 @@
 /* Append new drm mode definition here, align with libdrm definition */
 #define DRM_MODE_SCALE_NO_SCALE         2
-#define DRM_MODE_CONNECTOR_MIPI         15
 enum {
        CHIP_PSB_8108 = 0,              /* Poulsbo */
diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
index 3612574ca520..d286b2223181 100644
--- a/drivers/staging/hv/blkvsc_drv.c
+++ b/drivers/staging/hv/blkvsc_drv.c
@@ -325,7 +325,7 @@ static int blkvsc_do_operation(struct block_device_context *blkdev,
        page_buf = alloc_page(GFP_KERNEL);
        if (!page_buf) {
-                kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
+                kmem_cache_free(blkdev->request_pool, blkvsc_req);
                return -ENOMEM;
        }
@@ -422,7 +422,7 @@ cleanup:
        __free_page(page_buf);
-        kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
+        kmem_cache_free(blkdev->request_pool, blkvsc_req);
        return ret;
 }
diff --git a/drivers/staging/iio/accel/adis16203_core.c b/drivers/staging/iio/accel/adis16203_core.c
index bf1988884e93..cf5d15da76ad 100644
--- a/drivers/staging/iio/accel/adis16203_core.c
+++ b/drivers/staging/iio/accel/adis16203_core.c
@@ -311,13 +311,17 @@ static int adis16203_read_raw(struct iio_dev *indio_dev,
                mutex_lock(&indio_dev->mlock);
                addr = adis16203_addresses[chan->address][0];
                ret = adis16203_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                        return ret;
+                }
                if (val16 & ADIS16203_ERROR_ACTIVE) {
                        ret = adis16203_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                return ret;
+                        }
                }
                val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/accel/adis16204_core.c b/drivers/staging/iio/accel/adis16204_core.c
index cfd09b3b9937..3e2b62654b7d 100644
--- a/drivers/staging/iio/accel/adis16204_core.c
+++ b/drivers/staging/iio/accel/adis16204_core.c
@@ -341,13 +341,17 @@ static int adis16204_read_raw(struct iio_dev *indio_dev,
                mutex_lock(&indio_dev->mlock);
                addr = adis16204_addresses[chan->address][0];
                ret = adis16204_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                        return ret;
+                }
                if (val16 & ADIS16204_ERROR_ACTIVE) {
                        ret = adis16204_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                return ret;
+                        }
                }
                val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/accel/adis16209_core.c b/drivers/staging/iio/accel/adis16209_core.c
index 55f3a7bcaf0a..bec1fa8de9b9 100644
--- a/drivers/staging/iio/accel/adis16209_core.c
+++ b/drivers/staging/iio/accel/adis16209_core.c
@@ -337,13 +337,17 @@ static int adis16209_read_raw(struct iio_dev *indio_dev,
                mutex_lock(&indio_dev->mlock);
                addr = adis16209_addresses[chan->address][0];
                ret = adis16209_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                        return ret;
+                }
                if (val16 & ADIS16209_ERROR_ACTIVE) {
                        ret = adis16209_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                return ret;
+                        }
                }
                val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/accel/adis16240_core.c b/drivers/staging/iio/accel/adis16240_core.c
index 4a4eafc58630..aee8b69173c4 100644
--- a/drivers/staging/iio/accel/adis16240_core.c
+++ b/drivers/staging/iio/accel/adis16240_core.c
@@ -370,13 +370,17 @@ static int adis16240_read_raw(struct iio_dev *indio_dev,
                mutex_lock(&indio_dev->mlock);
                addr = adis16240_addresses[chan->address][0];
                ret = adis16240_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                        return ret;
+                }
                if (val16 & ADIS16240_ERROR_ACTIVE) {
                        ret = adis16240_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                return ret;
+                        }
                }
                val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/gyro/adis16260_core.c b/drivers/staging/iio/gyro/adis16260_core.c
index 05797f404bea..f2d43cfcc493 100644
--- a/drivers/staging/iio/gyro/adis16260_core.c
+++ b/drivers/staging/iio/gyro/adis16260_core.c
@@ -446,13 +446,17 @@ static int adis16260_read_raw(struct iio_dev *indio_dev,
                mutex_lock(&indio_dev->mlock);
                addr = adis16260_addresses[chan->address][0];
                ret = adis16260_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                        return ret;
+                }
                if (val16 & ADIS16260_ERROR_ACTIVE) {
                        ret = adis16260_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                return ret;
+                        }
                }
                val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/nvec/TODO b/drivers/staging/nvec/TODO
index 77b47f763f22..649d6b70deaa 100644
--- a/drivers/staging/nvec/TODO
+++ b/drivers/staging/nvec/TODO
@@ -4,5 +4,7 @@ ToDo list (incomplete, unordered)
        - add compile as module support
        - move nvec devices to mfd cells?
        - adjust to kernel style
+        - fix clk usage
+          should not be using clk_get_sys(), but clk_get(&pdev->dev, conn)
+          where conn is either NULL if the device only has one clock, or
+          the device specific name if it has multiple clocks.
diff --git a/drivers/staging/rtl8192u/r819xU_firmware.c b/drivers/staging/rtl8192u/r819xU_firmware.c
index 6766f468639f..4bb5fffca5b9 100644
--- a/drivers/staging/rtl8192u/r819xU_firmware.c
+++ b/drivers/staging/rtl8192u/r819xU_firmware.c
@@ -399,10 +399,7 @@ download_firmware_fail:
 }
+MODULE_FIRMWARE("RTL8192U/boot.img");
+MODULE_FIRMWARE("RTL8192U/main.img");
+MODULE_FIRMWARE("RTL8192U/data.img");
diff --git a/drivers/staging/rts_pstor/rtsx.c b/drivers/staging/rts_pstor/rtsx.c
index 5ff59f27d101..16c73fbff51f 100644
--- a/drivers/staging/rts_pstor/rtsx.c
+++ b/drivers/staging/rts_pstor/rtsx.c
@@ -66,12 +66,6 @@ static int msi_en;
 module_param(msi_en, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(msi_en, "enable msi");
-/* These are used to make sure the module doesn't unload before all the
- * threads have exited.
- */
-static atomic_t total_threads = ATOMIC_INIT(0);
-static DECLARE_COMPLETION(threads_gone);
 static irqreturn_t rtsx_interrupt(int irq, void *dev_id);
 /***********************************************************************
@@ -192,7 +186,7 @@ static int queuecommand_lck(struct scsi_cmnd *srb,
        /* enqueue the command and wake up the control thread */
        srb->scsi_done = done;
        chip->srb = srb;
-        up(&(dev->sema));
+        complete(&dev->cmnd_ready);
        return 0;
 }
@@ -475,7 +469,7 @@ static int rtsx_control_thread(void *__dev)
        current->flags |= PF_NOFREEZE;
        for (;;) {
-                if (down_interruptible(&dev->sema))
+                if (wait_for_completion_interruptible(&dev->cmnd_ready))
                        break;
                /* lock the device pointers */
@@ -557,8 +551,6 @@ SkipForAbort:
                mutex_unlock(&dev->dev_mutex);
        } /* for (;;) */
-        scsi_host_put(host);
        /* notify the exit routine that we're actually exiting now
         *
         * complete()/wait_for_completion() is similar to up()/down(),
@@ -573,7 +565,7 @@ SkipForAbort:
         * This is important in preemption kernels, which transfer the flow
         * of execution immediately upon a complete().
         */
-        complete_and_exit(&threads_gone, 0);
+        complete_and_exit(&dev->control_exit, 0);
 }
@@ -581,7 +573,6 @@ static int rtsx_polling_thread(void *__dev)
 {
        struct rtsx_dev *dev = (struct rtsx_dev *)__dev;
        struct rtsx_chip *chip = dev->chip;
-        struct Scsi_Host *host = rtsx_to_host(dev);
        struct sd_info *sd_card = &(chip->sd_card);
        struct xd_info *xd_card = &(chip->xd_card);
        struct ms_info *ms_card = &(chip->ms_card);
@@ -621,8 +612,7 @@ static int rtsx_polling_thread(void *__dev)
                mutex_unlock(&dev->dev_mutex);
        }
-        scsi_host_put(host);
+        complete_and_exit(&dev->polling_exit, 0);
-        complete_and_exit(&threads_gone, 0);
 }
 /*
@@ -699,29 +689,38 @@ static void rtsx_release_resources(struct rtsx_dev *dev)
 {
        printk(KERN_INFO "-- %s\n", __func__);
+        /* Tell the control thread to exit.  The SCSI host must
+         * already have been removed so it won't try to queue
+         * any more commands.
+         */
+        printk(KERN_INFO "-- sending exit command to thread\n");
+        complete(&dev->cmnd_ready);
+        if (dev->ctl_thread)
+                wait_for_completion(&dev->control_exit);
+        if (dev->polling_thread)
+                wait_for_completion(&dev->polling_exit);
+        wait_timeout(200);
        if (dev->rtsx_resv_buf) {
-                dma_free_coherent(&(dev->pci->dev), HOST_CMDS_BUF_LEN,
+                dma_free_coherent(&(dev->pci->dev), RTSX_RESV_BUF_LEN,
                                dev->rtsx_resv_buf, dev->rtsx_resv_buf_addr);
                dev->chip->host_cmds_ptr = NULL;
                dev->chip->host_sg_tbl_ptr = NULL;
        }
-        pci_disable_device(dev->pci);
+        if (dev->irq > 0)
-        pci_release_regions(dev->pci);
-        if (dev->irq > 0) {
                free_irq(dev->irq, (void *)dev);
-        }
+        if (dev->chip->msi_en)
-        if (dev->chip->msi_en) {
                pci_disable_msi(dev->pci);
-        }
+        if (dev->remap_addr)
+                iounmap(dev->remap_addr);
-        /* Tell the control thread to exit.  The SCSI host must
+        pci_disable_device(dev->pci);
-         * already have been removed so it won't try to queue
+        pci_release_regions(dev->pci);
-         * any more commands.
-         */
+        rtsx_release_chip(dev->chip);
-        printk(KERN_INFO "-- sending exit command to thread\n");
+        kfree(dev->chip);
-        up(&dev->sema);
 }
 /* First stage of disconnect processing: stop all commands and remove
@@ -739,6 +738,7 @@ static void quiesce_and_remove_host(struct rtsx_dev *dev)
        scsi_unlock(host);
        mutex_unlock(&dev->dev_mutex);
        wake_up(&dev->delay_wait);
+        wait_for_completion(&dev->scanning_done);
        /* Wait some time to let other threads exist */
        wait_timeout(100);
@@ -793,8 +793,7 @@ static int rtsx_scan_thread(void *__dev)
                /* Should we unbind if no devices were detected? */
        }
-        scsi_host_put(rtsx_to_host(dev));
+        complete_and_exit(&dev->scanning_done, 0);
-        complete_and_exit(&threads_gone, 0);
 }
 static void rtsx_init_options(struct rtsx_chip *chip)
@@ -941,8 +940,11 @@ static int __devinit rtsx_probe(struct pci_dev *pci, const struct pci_device_id
        spin_lock_init(&dev->reg_lock);
        mutex_init(&(dev->dev_mutex));
-        sema_init(&(dev->sema), 0);
+        init_completion(&dev->cmnd_ready);
+        init_completion(&dev->control_exit);
+        init_completion(&dev->polling_exit);
        init_completion(&(dev->notify));
+        init_completion(&dev->scanning_done);
        init_waitqueue_head(&dev->delay_wait);
        dev->pci = pci;
@@ -992,28 +994,22 @@ static int __devinit rtsx_probe(struct pci_dev *pci, const struct pci_device_id
        pci_set_master(pci);
        synchronize_irq(dev->irq);
-        err = scsi_add_host(host, &pci->dev);
-        if (err) {
-                printk(KERN_ERR "Unable to add the scsi host\n");
-                goto errout;
-        }
        rtsx_init_chip(dev->chip);
        /* Start up our control thread */
-        th = kthread_create(rtsx_control_thread, dev, CR_DRIVER_NAME);
+        th = kthread_run(rtsx_control_thread, dev, CR_DRIVER_NAME);
        if (IS_ERR(th)) {
                printk(KERN_ERR "Unable to start control thread\n");
                err = PTR_ERR(th);
                goto errout;
        }
+        dev->ctl_thread = th;
-        /* Take a reference to the host for the control thread and
+        err = scsi_add_host(host, &pci->dev);
-         * count it among all the threads we have launched.  Then
+        if (err) {
-         * start it up. */
+                printk(KERN_ERR "Unable to add the scsi host\n");
-        scsi_host_get(rtsx_to_host(dev));
+                goto errout;
-        atomic_inc(&total_threads);
+        }
-        wake_up_process(th);
        /* Start up the thread for delayed SCSI-device scanning */
        th = kthread_create(rtsx_scan_thread, dev, "rtsx-scan");
@@ -1024,28 +1020,17 @@ static int __devinit rtsx_probe(struct pci_dev *pci, const struct pci_device_id
                goto errout;
        }
-        /* Take a reference to the host for the scanning thread and
-         * count it among all the threads we have launched.  Then
-         * start it up. */
-        scsi_host_get(rtsx_to_host(dev));
-        atomic_inc(&total_threads);
        wake_up_process(th);
        /* Start up the thread for polling thread */
-        th = kthread_create(rtsx_polling_thread, dev, "rtsx-polling");
+        th = kthread_run(rtsx_polling_thread, dev, "rtsx-polling");
        if (IS_ERR(th)) {
                printk(KERN_ERR "Unable to start the device-polling thread\n");
                quiesce_and_remove_host(dev);
                err = PTR_ERR(th);
                goto errout;
        }
+        dev->polling_thread = th;
-        /* Take a reference to the host for the polling thread and
-         * count it among all the threads we have launched.  Then
-         * start it up. */
-        scsi_host_get(rtsx_to_host(dev));
-        atomic_inc(&total_threads);
-        wake_up_process(th);
        pci_set_drvdata(pci, dev);
@@ -1108,16 +1093,6 @@ static void __exit rtsx_exit(void)
        pci_unregister_driver(&driver);
-        /* Don't return until all of our control and scanning threads
-         * have exited.  Since each thread signals threads_gone as its
-         * last act, we have to call wait_for_completion the right number
-         * of times.
-         */
-        while (atomic_read(&total_threads) > 0) {
-                wait_for_completion(&threads_gone);
-                atomic_dec(&total_threads);
-        }
        printk(KERN_INFO "%s module exit\n", CR_DRIVER_NAME);
 }
diff --git a/drivers/staging/rts_pstor/rtsx.h b/drivers/staging/rts_pstor/rtsx.h
index 247615ba1d2a..86e47c2e3e3c 100644
--- a/drivers/staging/rts_pstor/rtsx.h
+++ b/drivers/staging/rts_pstor/rtsx.h
@@ -112,9 +112,16 @@ struct rtsx_dev {
        /* locks */
        spinlock_t              reg_lock;
+        struct task_struct      *ctl_thread;     /* the control thread   */
+        struct task_struct      *polling_thread; /* the polling thread   */
        /* mutual exclusion and synchronization structures */
-        struct semaphore        sema;            /* to sleep thread on      */
+        struct completion       cmnd_ready;      /* to sleep thread on      */
+        struct completion       control_exit;    /* control thread exit     */
+        struct completion       polling_exit;    /* polling thread exit     */
        struct completion       notify;          /* thread begin/end        */
+        struct completion       scanning_done;   /* wait for scan thread    */
        wait_queue_head_t       delay_wait;      /* wait during scan, reset */
        struct mutex            dev_mutex;
diff --git a/drivers/staging/solo6x10/core.c b/drivers/staging/solo6x10/core.c
index 76779949f141..f974f6412ad7 100644
--- a/drivers/staging/solo6x10/core.c
+++ b/drivers/staging/solo6x10/core.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 #include <linux/videodev2.h>
 #include "solo6x10.h"
 #include "tw28.h"
diff --git a/drivers/staging/solo6x10/enc.c b/drivers/staging/solo6x10/enc.c
index 285f7f350062..de502599bb19 100644
--- a/drivers/staging/solo6x10/enc.c
+++ b/drivers/staging/solo6x10/enc.c
@@ -18,6 +18,7 @@
 */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include "solo6x10.h"
 #include "osd-font.h"
diff --git a/drivers/staging/solo6x10/g723.c b/drivers/staging/solo6x10/g723.c
index bd8eb92c94b1..59274bfca95b 100644
--- a/drivers/staging/solo6x10/g723.c
+++ b/drivers/staging/solo6x10/g723.c
@@ -21,6 +21,7 @@
 #include <linux/mempool.h>
 #include <linux/poll.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include <linux/freezer.h>
 #include <sound/core.h>
 #include <sound/initval.h>
diff --git a/drivers/staging/solo6x10/p2m.c b/drivers/staging/solo6x10/p2m.c
index 5717eabb04a4..56210f0fc5ec 100644
--- a/drivers/staging/solo6x10/p2m.c
+++ b/drivers/staging/solo6x10/p2m.c
@@ -18,6 +18,7 @@
 */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/scatterlist.h>
 #include "solo6x10.h"
diff --git a/drivers/staging/solo6x10/solo6x10.h b/drivers/staging/solo6x10/solo6x10.h
index 17c06bd6cc91..abee7213202f 100644
--- a/drivers/staging/solo6x10/solo6x10.h
+++ b/drivers/staging/solo6x10/solo6x10.h
@@ -28,6 +28,7 @@
 #include <linux/list.h>
 #include <linux/wait.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <linux/atomic.h>
 #include <linux/videodev2.h>
diff --git a/drivers/staging/speakup/devsynth.c b/drivers/staging/speakup/devsynth.c
index 39dc586fc8bb..940769ef883f 100644
--- a/drivers/staging/speakup/devsynth.c
+++ b/drivers/staging/speakup/devsynth.c
@@ -18,13 +18,14 @@ static ssize_t speakup_file_write(struct file *fp, const char *buffer,
 {
        size_t count = nbytes;
        const char *ptr = buffer;
-        int bytes;
+        size_t bytes;
        unsigned long flags;
        u_char buf[256];
        if (synth == NULL)
                return -ENODEV;
        while (count > 0) {
-                bytes = min_t(size_t, count, sizeof(buf));
+                bytes = min(count, sizeof(buf));
                if (copy_from_user(buf, ptr, bytes))
                        return -EFAULT;
                count -= bytes;
diff --git a/drivers/staging/zcache/Makefile b/drivers/staging/zcache/Makefile
index f5ec64f94470..60daa272c204 100644
--- a/drivers/staging/zcache/Makefile
+++ b/drivers/staging/zcache/Makefile
@@ -1,3 +1,3 @@
-zcache-y        :=      tmem.o
+zcache-y        :=      zcache-main.o tmem.o
 obj-$(CONFIG_ZCACHE)    +=      zcache.o
diff --git a/drivers/staging/zcache/zcache.c b/drivers/staging/zcache/zcache-main.c
index 65a81a0d7c49..855a5bb56a47 100644
--- a/drivers/staging/zcache/zcache.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -19,6 +19,7 @@
 *   http://marc.info/?l=linux-mm&m=127811271605009
 */
+#include <linux/module.h>
 #include <linux/cpu.h>
 #include <linux/highmem.h>
 #include <linux/list.h>
@@ -27,6 +28,7 @@
 #include <linux/spinlock.h>
 #include <linux/types.h>
 #include <linux/atomic.h>
+#include <linux/math64.h>
 #include "tmem.h"
 #include "../zram/xvmalloc.h" /* if built in drivers/staging */
@@ -53,6 +55,9 @@
 #define MAX_CLIENTS 16
 #define LOCAL_CLIENT ((uint16_t)-1)
+MODULE_LICENSE("GPL");
 struct zcache_client {
        struct tmem_pool *tmem_pools[MAX_POOLS_PER_CLIENT];
        struct xv_pool *xvpool;
@@ -1158,6 +1163,7 @@ static void *zcache_pampd_create(char *data, size_t size, bool raw, int eph,
        uint16_t client_id = get_client_id_from_client(cli);
        unsigned long zv_mean_zsize;
        unsigned long curr_pers_pampd_count;
+        u64 total_zsize;
        if (eph) {
                ret = zcache_compress(page, &cdata, &clen);
@@ -1190,8 +1196,9 @@ static void *zcache_pampd_create(char *data, size_t size, bool raw, int eph,
                }
                /* reject if mean compression is too poor */
                if ((clen > zv_max_mean_zsize) && (curr_pers_pampd_count > 0)) {
-                        zv_mean_zsize = xv_get_total_size_bytes(cli->xvpool) /
+                        total_zsize = xv_get_total_size_bytes(cli->xvpool);
-                                                curr_pers_pampd_count;
+                        zv_mean_zsize = div_u64(total_zsize,
+                                                curr_pers_pampd_count);
                        if (zv_mean_zsize > zv_max_mean_zsize) {
                                zcache_mean_compress_poor++;
                                goto out;
@@ -1929,9 +1936,9 @@ __setup("nofrontswap", no_frontswap);
 static int __init zcache_init(void)
 {
-#ifdef CONFIG_SYSFS
        int ret = 0;
+#ifdef CONFIG_SYSFS
        ret = sysfs_create_group(mm_kobj, &zcache_attr_group);
        if (ret) {
                pr_err("zcache: can't create sysfs\n");
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 385acb895ab3..3f94ac34dce3 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -268,7 +268,7 @@ usbtmc_abort_bulk_in_status:
                                dev_err(dev, "usb_bulk_msg returned %d\n", rv);
                                goto exit;
                        }
-                } while ((actual = max_size) &&
+                } while ((actual == max_size) &&
                         (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
        if (actual == max_size) {
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index c962608b4b9a..26678cadfb21 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -123,10 +123,11 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
        }
        if (usb_endpoint_xfer_isoc(&ep->desc))
-                max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1) *
+                max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
-                        (desc->bmAttributes + 1);
+                        le16_to_cpu(ep->desc.wMaxPacketSize);
        else if (usb_endpoint_xfer_int(&ep->desc))
-                max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1);
+                max_tx = le16_to_cpu(ep->desc.wMaxPacketSize) *
+                        (desc->bMaxBurst + 1);
        else
                max_tx = 999999;
        if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) {
@@ -134,10 +135,10 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                                "config %d interface %d altsetting %d ep %d: "
                                "setting to %d\n",
                                usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int",
-                                desc->wBytesPerInterval,
+                                le16_to_cpu(desc->wBytesPerInterval),
                                cfgno, inum, asnum, ep->desc.bEndpointAddress,
                                max_tx);
-                ep->ss_ep_comp.wBytesPerInterval = max_tx;
+                ep->ss_ep_comp.wBytesPerInterval = cpu_to_le16(max_tx);
        }
 }
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 44b6b40aafb4..5a084b9cfa3c 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -310,7 +310,7 @@ config USB_PXA_U2O
 # musb builds in ../musb along with host support
 config USB_GADGET_MUSB_HDRC
        tristate "Inventra HDRC USB Peripheral (TI, ADI, ...)"
-        depends on USB_MUSB_HDRC && (USB_MUSB_PERIPHERAL || USB_MUSB_OTG)
+        depends on USB_MUSB_HDRC
        select USB_GADGET_DUALSPEED
        help
          This OTG-capable silicon IP is used in dual designs including
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 98cbc06c30fd..ddb118a76807 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -35,6 +35,7 @@
 #include <linux/list.h>
 #include <linux/interrupt.h>
 #include <linux/proc_fs.h>
+#include <linux/prefetch.h>
 #include <linux/clk.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 5ef87794fd32..aef47414f5d5 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1079,10 +1079,12 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                        cdev->desc.bMaxPacketSize0 =
                                cdev->gadget->ep0->maxpacket;
                        if (gadget_is_superspeed(gadget)) {
-                                if (gadget->speed >= USB_SPEED_SUPER)
+                                if (gadget->speed >= USB_SPEED_SUPER) {
                                        cdev->desc.bcdUSB = cpu_to_le16(0x0300);
-                                else
+                                        cdev->desc.bMaxPacketSize0 = 9;
+                                } else {
                                        cdev->desc.bcdUSB = cpu_to_le16(0x0210);
+                                }
                        }
                        value = min(w_length, (u16) sizeof cdev->desc);
diff --git a/drivers/usb/gadget/f_hid.c b/drivers/usb/gadget/f_hid.c
index 403a48bcf560..83a266bdb40e 100644
--- a/drivers/usb/gadget/f_hid.c
+++ b/drivers/usb/gadget/f_hid.c
@@ -367,6 +367,13 @@ static int hidg_setup(struct usb_function *f,
        case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8
                  | USB_REQ_GET_DESCRIPTOR):
                switch (value >> 8) {
+                case HID_DT_HID:
+                        VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: HID\n");
+                        length = min_t(unsigned short, length,
+                                                   hidg_desc.bLength);
+                        memcpy(req->buf, &hidg_desc, length);
+                        goto respond;
+                        break;
                case HID_DT_REPORT:
                        VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: REPORT\n");
                        length = min_t(unsigned short, length,
diff --git a/drivers/usb/gadget/fusb300_udc.c b/drivers/usb/gadget/fusb300_udc.c
index 24a924330c81..4ec888f90002 100644
--- a/drivers/usb/gadget/fusb300_udc.c
+++ b/drivers/usb/gadget/fusb300_udc.c
@@ -609,107 +609,6 @@ void fusb300_rdcxf(struct fusb300 *fusb300,
        }
 }
-#if 0
-static void fusb300_dbg_fifo(struct fusb300_ep *ep,
-                                u8 entry, u16 length)
-{
-        u32 reg;
-        u32 i = 0;
-        u32 j = 0;
-        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_GTM);
-        reg &= ~(FUSB300_GTM_TST_EP_ENTRY(0xF) |
-                FUSB300_GTM_TST_EP_NUM(0xF) | FUSB300_GTM_TST_FIFO_DEG);
-        reg |= (FUSB300_GTM_TST_EP_ENTRY(entry) |
-                FUSB300_GTM_TST_EP_NUM(ep->epnum) | FUSB300_GTM_TST_FIFO_DEG);
-        iowrite32(reg, ep->fusb300->reg + FUSB300_OFFSET_GTM);
-        for (i = 0; i < (length >> 2); i++) {
-                if (i * 4 == 1024)
-                        break;
-                reg = ioread32(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i * 4);
-                printk(KERN_DEBUG"  0x%-8x", reg);
-                j++;
-                if ((j % 4)  == 0)
-                        printk(KERN_DEBUG "\n");
-        }
-        if (length % 4) {
-                reg = ioread32(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i * 4);
-                printk(KERN_DEBUG "  0x%x\n", reg);
-        }
-        if ((j % 4)  != 0)
-                printk(KERN_DEBUG "\n");
-        fusb300_disable_bit(ep->fusb300, FUSB300_OFFSET_GTM,
-                FUSB300_GTM_TST_FIFO_DEG);
-}
-static void fusb300_cmp_dbg_fifo(struct fusb300_ep *ep,
-                                u8 entry, u16 length, u8 *golden)
-{
-        u32 reg;
-        u32 i = 0;
-        u32 golden_value;
-        u8 *tmp;
-        tmp = golden;
-        printk(KERN_DEBUG "fusb300_cmp_dbg_fifo (entry %d) : start\n", entry);
-        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_GTM);
-        reg &= ~(FUSB300_GTM_TST_EP_ENTRY(0xF) |
-                FUSB300_GTM_TST_EP_NUM(0xF) | FUSB300_GTM_TST_FIFO_DEG);
-        reg |= (FUSB300_GTM_TST_EP_ENTRY(entry) |
-                FUSB300_GTM_TST_EP_NUM(ep->epnum) | FUSB300_GTM_TST_FIFO_DEG);
-        iowrite32(reg, ep->fusb300->reg + FUSB300_OFFSET_GTM);
-        for (i = 0; i < (length >> 2); i++) {
-                if (i * 4 == 1024)
-                        break;
-                golden_value = *tmp | *(tmp + 1) << 8 |
-                                *(tmp + 2) << 16 | *(tmp + 3) << 24;
-                reg = ioread32(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i*4);
-                if (reg != golden_value) {
-                        printk(KERN_DEBUG "0x%x  :  ", (u32)(ep->fusb300->reg +
-                                FUSB300_OFFSET_BUFDBG_START + i*4));
-                        printk(KERN_DEBUG "    golden = 0x%x, reg = 0x%x\n",
-                                golden_value, reg);
-                }
-                tmp += 4;
-        }
-        switch (length % 4) {
-        case 1:
-                golden_value = *tmp;
-        case 2:
-                golden_value = *tmp | *(tmp + 1) << 8;
-        case 3:
-                golden_value = *tmp | *(tmp + 1) << 8 | *(tmp + 2) << 16;
-        default:
-                break;
-        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_BUFDBG_START + i*4);
-        if (reg != golden_value) {
-                printk(KERN_DEBUG "0x%x:", (u32)(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i*4));
-                printk(KERN_DEBUG "  golden = 0x%x, reg = 0x%x\n",
-                        golden_value, reg);
-        }
-        }
-        printk(KERN_DEBUG "fusb300_cmp_dbg_fifo : end\n");
-        fusb300_disable_bit(ep->fusb300, FUSB300_OFFSET_GTM,
-                FUSB300_GTM_TST_FIFO_DEG);
-}
-#endif
 static void fusb300_rdfifo(struct fusb300_ep *ep,
                          struct fusb300_request *req,
                          u32 length)
diff --git a/drivers/usb/gadget/net2272.c b/drivers/usb/gadget/net2272.c
index 7c7b0e120d88..ab98ea926a11 100644
--- a/drivers/usb/gadget/net2272.c
+++ b/drivers/usb/gadget/net2272.c
@@ -27,13 +27,13 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/ioport.h>
-#include <linux/irq.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/pci.h>
 #include <linux/platform_device.h>
+#include <linux/prefetch.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/timer.h>
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index 85c1b0d66293..8d31848aab09 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -2060,6 +2060,7 @@ static int s3c2410_udc_resume(struct platform_device *pdev)
 static const struct platform_device_id s3c_udc_ids[] = {
        { "s3c2410-usbgadget", },
        { "s3c2440-usbgadget", },
+        { }
 };
 MODULE_DEVICE_TABLE(platform, s3c_udc_ids);
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index bf2c8f65e1ae..e051b30c1847 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -1046,7 +1046,19 @@ static int ehci_hub_control (
                        if (!selector || selector > 5)
                                goto error;
                        ehci_quiesce(ehci);
+                        /* Put all enabled ports into suspend */
+                        while (ports--) {
+                                u32 __iomem *sreg =
+                                                &ehci->regs->port_status[ports];
+                                temp = ehci_readl(ehci, sreg) & ~PORT_RWC_BITS;
+                                if (temp & PORT_PE)
+                                        ehci_writel(ehci, temp | PORT_SUSPEND,
+                                                        sreg);
+                        }
                        ehci_halt(ehci);
+                        temp = ehci_readl(ehci, status_reg);
                        temp |= selector << 16;
                        ehci_writel(ehci, temp, status_reg);
                        break;
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index 0c058be35a38..555a73c864b5 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -24,6 +24,7 @@
 #include <linux/usb/ulpi.h>
 #include <linux/slab.h>
+#include <mach/hardware.h>
 #include <mach/mxc_ehci.h>
 #include <asm/mach-types.h>
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 55a57c23dd0f..45240321ca09 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -98,6 +98,18 @@ static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
        }
 }
+static void disable_put_regulator(
+                struct ehci_hcd_omap_platform_data *pdata)
+{
+        int i;
+        for (i = 0 ; i < OMAP3_HS_USB_PORTS ; i++) {
+                if (pdata->regulator[i]) {
+                        regulator_disable(pdata->regulator[i]);
+                        regulator_put(pdata->regulator[i]);
+                }
+        }
+}
 /* configure so an HC device and id are always provided */
 /* always called with process context; sleeping is OK */
@@ -231,9 +243,11 @@ err_add_hcd:
        omap_usbhs_disable(dev);
 err_enable:
+        disable_put_regulator(pdata);
        usb_put_hcd(hcd);
 err_io:
+        iounmap(regs);
        return ret;
 }
@@ -253,6 +267,8 @@ static int ehci_hcd_omap_remove(struct platform_device *pdev)
        usb_remove_hcd(hcd);
        omap_usbhs_disable(dev);
+        disable_put_regulator(dev->platform_data);
+        iounmap(hcd->regs);
        usb_put_hcd(hcd);
        return 0;
 }
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index 55d3d5859ac5..840beda66dd9 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -1583,6 +1583,9 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
        int retval = 0;
        spin_lock_irqsave(&priv->lock, spinflags);
+        retval = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (retval)
+                goto out;
        qh = urb->ep->hcpriv;
        if (!qh) {
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index a9d315906e3d..629a96813fd6 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -535,7 +535,7 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
        iounmap(base);
 }
-static const struct dmi_system_id __initconst ehci_dmi_nohandoff_table[] = {
+static const struct dmi_system_id __devinitconst ehci_dmi_nohandoff_table[] = {
        {
                /*  Pegatron Lucid (ExoPC) */
                .matches = {
@@ -817,7 +817,7 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
        /* If the BIOS owns the HC, signal that the OS wants it, and wait */
        if (val & XHCI_HC_BIOS_OWNED) {
-                writel(val & XHCI_HC_OS_OWNED, base + ext_cap_offset);
+                writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
                /* Wait for 5 seconds with 10 microsecond polling interval */
                timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 763f484bc092..1c4432d8fc10 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -345,7 +345,8 @@ static void xhci_event_ring_work(unsigned long arg)
        spin_lock_irqsave(&xhci->lock, flags);
        temp = xhci_readl(xhci, &xhci->op_regs->status);
        xhci_dbg(xhci, "op reg status = 0x%x\n", temp);
-        if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
+        if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                xhci_dbg(xhci, "HW died, polling stopped.\n");
                spin_unlock_irqrestore(&xhci->lock, flags);
                return;
@@ -939,8 +940,11 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
                return 0;
        }
+        xhci = hcd_to_xhci(hcd);
+        if (xhci->xhc_state & XHCI_STATE_HALTED)
+                return -ENODEV;
        if (check_virt_dev) {
-                xhci = hcd_to_xhci(hcd);
                if (!udev->slot_id || !xhci->devs
                        || !xhci->devs[udev->slot_id]) {
                        printk(KERN_DEBUG "xHCI %s called with unaddressed "
@@ -1242,7 +1246,8 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                xhci_urb_free_priv(xhci, urb_priv);
                return ret;
        }
-        if (xhci->xhc_state & XHCI_STATE_DYING) {
+        if ((xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                xhci_dbg(xhci, "Ep 0x%x: URB %p to be canceled on "
                                "non-responsive xHCI host.\n",
                                urb->ep->desc.bEndpointAddress, urb);
@@ -2665,7 +2670,10 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
        int i, ret;
        ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
-        if (ret <= 0)
+        /* If the host is halted due to driver unload, we still need to free the
+         * device.
+         */
+        if (ret <= 0 && ret != -ENODEV)
                return;
        virt_dev = xhci->devs[udev->slot_id];
@@ -2679,7 +2687,8 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
        spin_lock_irqsave(&xhci->lock, flags);
        /* Don't disable the slot if the host controller is dead. */
        state = xhci_readl(xhci, &xhci->op_regs->status);
-        if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
+        if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                xhci_free_virt_device(xhci, udev->slot_id);
                spin_unlock_irqrestore(&xhci->lock, flags);
                return;
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 6192b45959f4..fc34b8b11910 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -3,9 +3,6 @@
 # for silicon based on Mentor Graphics INVENTRA designs
 #
-comment "Enable Host or Gadget support to see Inventra options"
-        depends on !USB && USB_GADGET=n
 # (M)HDRC = (Multipoint) Highspeed Dual-Role Controller
 config USB_MUSB_HDRC
        depends on USB && USB_GADGET
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index b67a062f556b..8c41a2e6ea77 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1698,6 +1698,8 @@ static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
        is_on = !!is_on;
+        pm_runtime_get_sync(musb->controller);
        /* NOTE: this assumes we are sensing vbus; we'd rather
         * not pullup unless the B-session is active.
         */
@@ -1707,6 +1709,9 @@ static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
                musb_pullup(musb, is_on);
        }
        spin_unlock_irqrestore(&musb->lock, flags);
+        pm_runtime_put(musb->controller);
        return 0;
 }
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index c784e6c03aac..07c8a73dfe41 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -89,7 +89,7 @@ static inline int tusb_omap_use_shared_dmareq(struct tusb_omap_dma_ch *chdat)
        u32             reg = musb_readl(chdat->tbase, TUSB_DMA_EP_MAP);
        if (reg != 0) {
-                dev_dbg(musb->controller, "ep%i dmareq0 is busy for ep%i\n",
+                dev_dbg(chdat->musb->controller, "ep%i dmareq0 is busy for ep%i\n",
                        chdat->epnum, reg & 0xf);
                return -EAGAIN;
        }
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index ba79dbf5adbc..cb2d451d511e 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -14,6 +14,7 @@
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 *
 */
+#include <linux/dma-mapping.h>
 #include <linux/io.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
@@ -76,7 +77,7 @@ struct usbhsg_recip_handle {
                struct usbhsg_gpriv, mod)
 #define __usbhsg_for_each_uep(start, pos, g, i) \
-        for (i = start, pos = (g)->uep;         \
+        for (i = start, pos = (g)->uep + i;     \
             i < (g)->uep_size;                 \
             i++, pos = (g)->uep + i)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 2e06b90aa1f8..78a2cf9551cc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -151,6 +151,7 @@ static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
 * /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
 */
 static struct usb_device_id id_table_combined [] = {
+        { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
@@ -1171,7 +1172,7 @@ static __u32 get_ftdi_divisor(struct tty_struct *tty,
        case FT2232H: /* FT2232H chip */
        case FT4232H: /* FT4232H chip */
        case FT232H:  /* FT232H chip */
-                if ((baud <= 12000000) & (baud >= 1200)) {
+                if ((baud <= 12000000) && (baud >= 1200)) {
                        div_value = ftdi_2232h_baud_to_divisor(baud);
                } else if (baud < 1200) {
                        div_value = ftdi_232bm_baud_to_divisor(baud);
@@ -1205,7 +1206,10 @@ static int change_speed(struct tty_struct *tty, struct usb_serial_port *port)
        urb_index_value = get_ftdi_divisor(tty, port);
        urb_value = (__u16)urb_index_value;
        urb_index = (__u16)(urb_index_value >> 16);
-        if (priv->interface) {  /* FT2232C */
+        if ((priv->chip_type == FT2232C) || (priv->chip_type == FT2232H) ||
+                (priv->chip_type == FT4232H) || (priv->chip_type == FT232H)) {
+                /* Probably the BM type needs the MSB of the encoded fractional
+                 * divider also moved like for the chips above. Any infos? */
                urb_index = (__u16)((urb_index << 8) | priv->interface);
        }
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 19156d1049fe..bf5227ad3ef7 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1159,4 +1159,8 @@
 /* USB-Nano-485*/
 #define FTDI_CTI_NANO_PID       0xF60B
+/*
+ * ZeitControl cardsystems GmbH rfid-readers http://zeitconrol.de
+ */
+/* TagTracer MIFARE*/
+#define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID    0xF7C0
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 60b25d8ea0e2..815656198914 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -148,6 +148,10 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_E14AC                    0x14AC
+#define HUAWEI_PRODUCT_K3770                    0x14C9
+#define HUAWEI_PRODUCT_K3771                    0x14CA
+#define HUAWEI_PRODUCT_K4510                    0x14CB
+#define HUAWEI_PRODUCT_K4511                    0x14CC
 #define HUAWEI_PRODUCT_ETS1220                  0x1803
 #define HUAWEI_PRODUCT_E353                     0x1506
@@ -547,6 +551,14 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x32) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 54a9dab1f33b..aeccc7f0a93c 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -45,6 +45,7 @@ static const struct usb_device_id id_table[] = {
        {USB_DEVICE(0x05c6, 0x9203)},   /* Generic Gobi Modem device */
        {USB_DEVICE(0x05c6, 0x9222)},   /* Generic Gobi Modem device */
        {USB_DEVICE(0x05c6, 0x9008)},   /* Generic Gobi QDL device */
+        {USB_DEVICE(0x05c6, 0x9009)},   /* Generic Gobi Modem device */
        {USB_DEVICE(0x05c6, 0x9201)},   /* Generic Gobi QDL device */
        {USB_DEVICE(0x05c6, 0x9221)},   /* Generic Gobi QDL device */
        {USB_DEVICE(0x05c6, 0x9231)},   /* Generic Gobi QDL device */
@@ -78,6 +79,7 @@ static const struct usb_device_id id_table[] = {
        {USB_DEVICE(0x1199, 0x9008)},   /* Sierra Wireless Gobi 2000 Modem device (VT773) */
        {USB_DEVICE(0x1199, 0x9009)},   /* Sierra Wireless Gobi 2000 Modem device (VT773) */
        {USB_DEVICE(0x1199, 0x900a)},   /* Sierra Wireless Gobi 2000 Modem device (VT773) */
+        {USB_DEVICE(0x1199, 0x9011)},   /* Sierra Wireless Gobi 2000 Modem device (MC8305) */
        {USB_DEVICE(0x16d8, 0x8001)},   /* CMDTech Gobi 2000 QDL device (VU922) */
        {USB_DEVICE(0x16d8, 0x8002)},   /* CMDTech Gobi 2000 Modem device (VU922) */
        {USB_DEVICE(0x05c6, 0x9204)},   /* Gobi 2000 QDL device */
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index ccff3483eebc..3041a974faf3 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1988,6 +1988,16 @@ UNUSUAL_DEV(  0x4146, 0xba01, 0x0100, 0x0100,
                "Micro Mini 1GB",
                USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ),
+/*
+ * Nick Bowler <nbowler@elliptictech.com>
+ * SCSI stack spams (otherwise harmless) error messages.
+ */
+UNUSUAL_DEV(  0xc251, 0x4003, 0x0100, 0x0100,
+                "Keil Software, Inc.",
+                "V2M MotherBoard",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NOT_LOCKABLE),
 /* Reported by Andrew Simmons <andrew.simmons@gmail.com> */
 UNUSUAL_DEV(  0xed06, 0x4500, 0x0001, 0x0001,
                "DataStor",
diff --git a/drivers/xen/xen-selfballoon.c b/drivers/xen/xen-selfballoon.c
index 1b4afd81f872..6ea852e25162 100644
--- a/drivers/xen/xen-selfballoon.c
+++ b/drivers/xen/xen-selfballoon.c
@@ -70,6 +70,7 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/mman.h>
+#include <linux/module.h>
 #include <linux/workqueue.h>
 #include <xen/balloon.h>
 #include <xen/tmem.h>
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 2fe3cf13b2e9..6d40656e1e29 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -176,7 +176,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
 #ifdef CONFIG_CIFS_STATS2
                        seq_printf(m, " In Send: %d In MaxReq Wait: %d",
-                                atomic_read(&server->inSend),
+                                atomic_read(&server->in_send),
                                atomic_read(&server->num_waiters));
 #endif
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 21de1d6d5849..d0f59faefb78 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -991,24 +991,6 @@ struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
        return pntsd;
 }
-static int set_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, __u16 fid,
-                struct cifs_ntsd *pnntsd, u32 acllen)
-{
-        int xid, rc;
-        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
-        if (IS_ERR(tlink))
-                return PTR_ERR(tlink);
-        xid = GetXid();
-        rc = CIFSSMBSetCIFSACL(xid, tlink_tcon(tlink), fid, pnntsd, acllen);
-        FreeXid(xid);
-        cifs_put_tlink(tlink);
-        cFYI(DBG2, "SetCIFSACL rc = %d", rc);
-        return rc;
-}
 static int set_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, const char *path,
                struct cifs_ntsd *pnntsd, u32 acllen)
 {
@@ -1047,18 +1029,10 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
                                struct inode *inode, const char *path)
 {
        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
-        struct cifsFileInfo *open_file;
-        int rc;
        cFYI(DBG2, "set ACL for %s from mode 0x%x", path, inode->i_mode);
-        open_file = find_readable_file(CIFS_I(inode), true);
+        return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
-        if (!open_file)
-                return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
-        rc = set_cifs_acl_by_fid(cifs_sb, open_file->netfid, pnntsd, acllen);
-        cifsFileInfo_put(open_file);
-        return rc;
 }
 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 38ce6d44b145..95dad9d14cf1 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -291,7 +291,7 @@ struct TCP_Server_Info {
        struct fscache_cookie   *fscache; /* client index cache cookie */
 #endif
 #ifdef CONFIG_CIFS_STATS2
-        atomic_t inSend; /* requests trying to send */
+        atomic_t in_send; /* requests trying to send */
        atomic_t num_waiters;   /* blocked waiting to get in sendrecv */
 #endif
 };
@@ -672,12 +672,54 @@ struct mid_q_entry {
        bool multiEnd:1;        /* both received */
 };
-struct oplock_q_entry {
+/*      Make code in transport.c a little cleaner by moving
-        struct list_head qhead;
+        update of optional stats into function below */
-        struct inode *pinode;
+#ifdef CONFIG_CIFS_STATS2
-        struct cifs_tcon *tcon;
-        __u16 netfid;
+static inline void cifs_in_send_inc(struct TCP_Server_Info *server)
-};
+{
+        atomic_inc(&server->in_send);
+}
+static inline void cifs_in_send_dec(struct TCP_Server_Info *server)
+{
+        atomic_dec(&server->in_send);
+}
+static inline void cifs_num_waiters_inc(struct TCP_Server_Info *server)
+{
+        atomic_inc(&server->num_waiters);
+}
+static inline void cifs_num_waiters_dec(struct TCP_Server_Info *server)
+{
+        atomic_dec(&server->num_waiters);
+}
+static inline void cifs_save_when_sent(struct mid_q_entry *mid)
+{
+        mid->when_sent = jiffies;
+}
+#else
+static inline void cifs_in_send_inc(struct TCP_Server_Info *server)
+{
+}
+static inline void cifs_in_send_dec(struct TCP_Server_Info *server)
+{
+}
+static inline void cifs_num_waiters_inc(struct TCP_Server_Info *server)
+{
+}
+static inline void cifs_num_waiters_dec(struct TCP_Server_Info *server)
+{
+}
+static inline void cifs_save_when_sent(struct mid_q_entry *mid)
+{
+}
+#endif
 /* for pending dnotify requests */
 struct dir_notify_req {
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index c1b9c4b10739..10ca6b2c26b7 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -266,15 +266,11 @@ static int wait_for_free_request(struct TCP_Server_Info *server,
        while (1) {
                if (atomic_read(&server->inFlight) >= cifs_max_pending) {
                        spin_unlock(&GlobalMid_Lock);
-#ifdef CONFIG_CIFS_STATS2
+                        cifs_num_waiters_inc(server);
-                        atomic_inc(&server->num_waiters);
-#endif
                        wait_event(server->request_q,
                                   atomic_read(&server->inFlight)
                                     < cifs_max_pending);
-#ifdef CONFIG_CIFS_STATS2
+                        cifs_num_waiters_dec(server);
-                        atomic_dec(&server->num_waiters);
-#endif
                        spin_lock(&GlobalMid_Lock);
                } else {
                        if (server->tcpStatus == CifsExiting) {
@@ -381,15 +377,13 @@ cifs_call_async(struct TCP_Server_Info *server, struct kvec *iov,
        mid->callback = callback;
        mid->callback_data = cbdata;
        mid->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
-        atomic_inc(&server->inSend);
+        cifs_in_send_inc(server);
-#endif
        rc = smb_sendv(server, iov, nvec);
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_dec(server);
-        atomic_dec(&server->inSend);
+        cifs_save_when_sent(mid);
-        mid->when_sent = jiffies;
-#endif
        mutex_unlock(&server->srv_mutex);
        if (rc)
                goto out_err;
@@ -575,14 +569,10 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
        }
        midQ->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_inc(ses->server);
-        atomic_inc(&ses->server->inSend);
-#endif
        rc = smb_sendv(ses->server, iov, n_vec);
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_dec(ses->server);
-        atomic_dec(&ses->server->inSend);
+        cifs_save_when_sent(midQ);
-        midQ->when_sent = jiffies;
-#endif
        mutex_unlock(&ses->server->srv_mutex);
@@ -703,14 +693,11 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
        }
        midQ->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
-        atomic_inc(&ses->server->inSend);
+        cifs_in_send_inc(ses->server);
-#endif
        rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_dec(ses->server);
-        atomic_dec(&ses->server->inSend);
+        cifs_save_when_sent(midQ);
-        midQ->when_sent = jiffies;
-#endif
        mutex_unlock(&ses->server->srv_mutex);
        if (rc < 0)
@@ -843,14 +830,10 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
        }
        midQ->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_inc(ses->server);
-        atomic_inc(&ses->server->inSend);
-#endif
        rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_dec(ses->server);
-        atomic_dec(&ses->server->inSend);
+        cifs_save_when_sent(midQ);
-        midQ->when_sent = jiffies;
-#endif
        mutex_unlock(&ses->server->srv_mutex);
        if (rc < 0) {
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 8be086e9abe4..51352de88ef1 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1003,6 +1003,7 @@ COMPATIBLE_IOCTL(PPPIOCCONNECT)
 COMPATIBLE_IOCTL(PPPIOCDISCONN)
 COMPATIBLE_IOCTL(PPPIOCATTCHAN)
 COMPATIBLE_IOCTL(PPPIOCGCHAN)
+COMPATIBLE_IOCTL(PPPIOCGL2TPSTATS)
 /* PPPOX */
 COMPATIBLE_IOCTL(PPPOEIOCSFWD)
 COMPATIBLE_IOCTL(PPPOEIOCDFWD)
diff --git a/fs/jfs/jfs_umount.c b/fs/jfs/jfs_umount.c
index adcf92d3b603..7971f37534a3 100644
--- a/fs/jfs/jfs_umount.c
+++ b/fs/jfs/jfs_umount.c
@@ -68,7 +68,7 @@ int jfs_umount(struct super_block *sb)
                /*
                 * Wait for outstanding transactions to be written to log:
                 */
-                jfs_flush_journal(log, 1);
+                jfs_flush_journal(log, 2);
        /*
         * close fileset inode allocation map (aka fileset inode)
@@ -146,7 +146,7 @@ int jfs_umount_rw(struct super_block *sb)
         *
         * remove file system from log active file system list.
         */
-        jfs_flush_journal(log, 1);
+        jfs_flush_journal(log, 2);
        /*
         * Make sure all metadata makes it to disk
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index d1fe74506c4c..c57836dc778f 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -596,7 +596,7 @@ _xfs_buf_read(
        bp->b_flags |= flags & (XBF_READ | XBF_ASYNC | XBF_READ_AHEAD);
        status = xfs_buf_iorequest(bp);
-        if (status || XFS_BUF_ISERROR(bp) || (flags & XBF_ASYNC))
+        if (status || bp->b_error || (flags & XBF_ASYNC))
                return status;
        return xfs_buf_iowait(bp);
 }
@@ -679,7 +679,6 @@ xfs_buf_read_uncached(
        /* set up the buffer for a read IO */
        XFS_BUF_SET_ADDR(bp, daddr);
        XFS_BUF_READ(bp);
-        XFS_BUF_BUSY(bp);
        xfsbdstrat(mp, bp);
        error = xfs_buf_iowait(bp);
@@ -1069,7 +1068,7 @@ xfs_bioerror(
        /*
         * No need to wait until the buffer is unpinned, we aren't flushing it.
         */
-        XFS_BUF_ERROR(bp, EIO);
+        xfs_buf_ioerror(bp, EIO);
        /*
         * We're calling xfs_buf_ioend, so delete XBF_DONE flag.
@@ -1094,7 +1093,7 @@ STATIC int
 xfs_bioerror_relse(
        struct xfs_buf  *bp)
 {
-        int64_t         fl = XFS_BUF_BFLAGS(bp);
+        int64_t         fl = bp->b_flags;
        /*
         * No need to wait until the buffer is unpinned.
         * We aren't flushing it.
@@ -1115,7 +1114,7 @@ xfs_bioerror_relse(
                 * There's no reason to mark error for
                 * ASYNC buffers.
                 */
-                XFS_BUF_ERROR(bp, EIO);
+                xfs_buf_ioerror(bp, EIO);
                XFS_BUF_FINISH_IOWAIT(bp);
        } else {
                xfs_buf_relse(bp);
@@ -1324,7 +1323,7 @@ xfs_buf_offset(
        struct page             *page;
        if (bp->b_flags & XBF_MAPPED)
-                return XFS_BUF_PTR(bp) + offset;
+                return bp->b_addr + offset;
        offset += bp->b_offset;
        page = bp->b_pages[offset >> PAGE_SHIFT];
@@ -1484,7 +1483,7 @@ xfs_setsize_buftarg_flags(
        if (set_blocksize(btp->bt_bdev, sectorsize)) {
                xfs_warn(btp->bt_mount,
                        "Cannot set_blocksize to %u on device %s\n",
-                        sectorsize, XFS_BUFTARG_NAME(btp));
+                        sectorsize, xfs_buf_target_name(btp));
                return EINVAL;
        }
@@ -1681,7 +1680,7 @@ xfs_buf_delwri_split(
        list_for_each_entry_safe(bp, n, dwq, b_list) {
                ASSERT(bp->b_flags & XBF_DELWRI);
-                if (!XFS_BUF_ISPINNED(bp) && xfs_buf_trylock(bp)) {
+                if (!xfs_buf_ispinned(bp) && xfs_buf_trylock(bp)) {
                        if (!force &&
                            time_before(jiffies, bp->b_queuetime + age)) {
                                xfs_buf_unlock(bp);
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 6a83b46b4bcf..620972b8094d 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -228,11 +228,15 @@ extern void xfs_buf_delwri_promote(xfs_buf_t *);
 extern int xfs_buf_init(void);
 extern void xfs_buf_terminate(void);
-#define xfs_buf_target_name(target)     \
+static inline const char *
-        ({ char __b[BDEVNAME_SIZE]; bdevname((target)->bt_bdev, __b); __b; })
+xfs_buf_target_name(struct xfs_buftarg *target)
+{
+        static char __b[BDEVNAME_SIZE];
+        return bdevname(target->bt_bdev, __b);
+}
-#define XFS_BUF_BFLAGS(bp)      ((bp)->b_flags)
 #define XFS_BUF_ZEROFLAGS(bp) \
        ((bp)->b_flags &= ~(XBF_READ|XBF_WRITE|XBF_ASYNC|XBF_DELWRI| \
                            XBF_SYNCIO|XBF_FUA|XBF_FLUSH))
@@ -251,23 +255,14 @@ void xfs_buf_stale(struct xfs_buf *bp);
 #define XFS_BUF_UNDELAYWRITE(bp)        xfs_buf_delwri_dequeue(bp)
 #define XFS_BUF_ISDELAYWRITE(bp)        ((bp)->b_flags & XBF_DELWRI)
-#define XFS_BUF_ERROR(bp,no)    xfs_buf_ioerror(bp,no)
-#define XFS_BUF_GETERROR(bp)    xfs_buf_geterror(bp)
-#define XFS_BUF_ISERROR(bp)     (xfs_buf_geterror(bp) ? 1 : 0)
 #define XFS_BUF_DONE(bp)        ((bp)->b_flags |= XBF_DONE)
 #define XFS_BUF_UNDONE(bp)      ((bp)->b_flags &= ~XBF_DONE)
 #define XFS_BUF_ISDONE(bp)      ((bp)->b_flags & XBF_DONE)
-#define XFS_BUF_BUSY(bp)        do { } while (0)
-#define XFS_BUF_UNBUSY(bp)      do { } while (0)
-#define XFS_BUF_ISBUSY(bp)      (1)
 #define XFS_BUF_ASYNC(bp)       ((bp)->b_flags |= XBF_ASYNC)
 #define XFS_BUF_UNASYNC(bp)     ((bp)->b_flags &= ~XBF_ASYNC)
 #define XFS_BUF_ISASYNC(bp)     ((bp)->b_flags & XBF_ASYNC)
-#define XFS_BUF_HOLD(bp)        xfs_buf_hold(bp)
 #define XFS_BUF_READ(bp)        ((bp)->b_flags |= XBF_READ)
 #define XFS_BUF_UNREAD(bp)      ((bp)->b_flags &= ~XBF_READ)
 #define XFS_BUF_ISREAD(bp)      ((bp)->b_flags & XBF_READ)
@@ -276,10 +271,6 @@ void xfs_buf_stale(struct xfs_buf *bp);
 #define XFS_BUF_UNWRITE(bp)     ((bp)->b_flags &= ~XBF_WRITE)
 #define XFS_BUF_ISWRITE(bp)     ((bp)->b_flags & XBF_WRITE)
-#define XFS_BUF_SET_START(bp)                   do { } while (0)
-#define XFS_BUF_PTR(bp)                 (xfs_caddr_t)((bp)->b_addr)
-#define XFS_BUF_SET_PTR(bp, val, cnt)   xfs_buf_associate_memory(bp, val, cnt)
 #define XFS_BUF_ADDR(bp)                ((bp)->b_bn)
 #define XFS_BUF_SET_ADDR(bp, bno)       ((bp)->b_bn = (xfs_daddr_t)(bno))
 #define XFS_BUF_OFFSET(bp)              ((bp)->b_file_offset)
@@ -299,14 +290,13 @@ xfs_buf_set_ref(
 #define XFS_BUF_SET_VTYPE_REF(bp, type, ref)    xfs_buf_set_ref(bp, ref)
 #define XFS_BUF_SET_VTYPE(bp, type)             do { } while (0)
-#define XFS_BUF_ISPINNED(bp)    atomic_read(&((bp)->b_pin_count))
+static inline int xfs_buf_ispinned(struct xfs_buf *bp)
+{
+        return atomic_read(&bp->b_pin_count);
+}
 #define XFS_BUF_FINISH_IOWAIT(bp)       complete(&bp->b_iowait);
-#define XFS_BUF_SET_TARGET(bp, target)  ((bp)->b_target = (target))
-#define XFS_BUF_TARGET(bp)              ((bp)->b_target)
-#define XFS_BUFTARG_NAME(target)        xfs_buf_target_name(target)
 static inline void xfs_buf_relse(xfs_buf_t *bp)
 {
        xfs_buf_unlock(bp);
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index e4c938afb910..4604f90f86a3 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -332,7 +332,7 @@ xfs_sync_fsdata(
         * between there and here.
         */
        bp = xfs_getsb(mp, 0);
-        if (XFS_BUF_ISPINNED(bp))
+        if (xfs_buf_ispinned(bp))
                xfs_log_force(mp, 0);
        return xfs_bwrite(mp, bp);
diff --git a/fs/xfs/quota/xfs_dquot.c b/fs/xfs/quota/xfs_dquot.c
index 837f31158d43..db62959bed13 100644
--- a/fs/xfs/quota/xfs_dquot.c
+++ b/fs/xfs/quota/xfs_dquot.c
@@ -318,10 +318,9 @@ xfs_qm_init_dquot_blk(
        int             curid, i;
        ASSERT(tp);
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(xfs_buf_islocked(bp));
-        d = (xfs_dqblk_t *)XFS_BUF_PTR(bp);
+        d = bp->b_addr;
        /*
         * ID of the first dquot in the block - id's are zero based.
@@ -403,7 +402,7 @@ xfs_qm_dqalloc(
                               dqp->q_blkno,
                               mp->m_quotainfo->qi_dqchunklen,
                               0);
-        if (!bp || (error = XFS_BUF_GETERROR(bp)))
+        if (!bp || (error = xfs_buf_geterror(bp)))
                goto error1;
        /*
         * Make a chunk of dquots out of this buffer and log
@@ -534,13 +533,12 @@ xfs_qm_dqtobp(
                        return XFS_ERROR(error);
        }
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(xfs_buf_islocked(bp));
        /*
         * calculate the location of the dquot inside the buffer.
         */
-        ddq = (struct xfs_disk_dquot *)(XFS_BUF_PTR(bp) + dqp->q_bufoffset);
+        ddq = bp->b_addr + dqp->q_bufoffset;
        /*
         * A simple sanity check in case we got a corrupted dquot...
@@ -553,7 +551,6 @@ xfs_qm_dqtobp(
                        xfs_trans_brelse(tp, bp);
                        return XFS_ERROR(EIO);
                }
-                XFS_BUF_BUSY(bp); /* We dirtied this */
        }
        *O_bpp = bp;
@@ -622,7 +619,6 @@ xfs_qm_dqread(
         * this particular dquot was repaired. We still aren't afraid to
         * brelse it because we have the changes incore.
         */
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(xfs_buf_islocked(bp));
        xfs_trans_brelse(tp, bp);
@@ -1204,7 +1200,7 @@ xfs_qm_dqflush(
        /*
         * Calculate the location of the dquot inside the buffer.
         */
-        ddqp = (struct xfs_disk_dquot *)(XFS_BUF_PTR(bp) + dqp->q_bufoffset);
+        ddqp = bp->b_addr + dqp->q_bufoffset;
        /*
         * A simple sanity check in case we got a corrupted dquot..
@@ -1240,7 +1236,7 @@ xfs_qm_dqflush(
         * If the buffer is pinned then push on the log so we won't
         * get stuck waiting in the write for too long.
         */
-        if (XFS_BUF_ISPINNED(bp)) {
+        if (xfs_buf_ispinned(bp)) {
                trace_xfs_dqflush_force(dqp);
                xfs_log_force(mp, 0);
        }
@@ -1447,7 +1443,7 @@ xfs_qm_dqflock_pushbuf_wait(
                goto out_lock;
        if (XFS_BUF_ISDELAYWRITE(bp)) {
-                if (XFS_BUF_ISPINNED(bp))
+                if (xfs_buf_ispinned(bp))
                        xfs_log_force(mp, 0);
                xfs_buf_delwri_promote(bp);
                wake_up_process(bp->b_target->bt_task);
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 46e54ad9a2dc..9a0aa76facdf 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1240,7 +1240,7 @@ xfs_qm_reset_dqcounts(
        do_div(j, sizeof(xfs_dqblk_t));
        ASSERT(mp->m_quotainfo->qi_dqperchunk == j);
 #endif
-        ddq = (xfs_disk_dquot_t *)XFS_BUF_PTR(bp);
+        ddq = bp->b_addr;
        for (j = 0; j < mp->m_quotainfo->qi_dqperchunk; j++) {
                /*
                 * Do a sanity check, and if needed, repair the dqblk. Don't
diff --git a/fs/xfs/xfs_ag.h b/fs/xfs/xfs_ag.h
index 6530769a999b..4805f009f923 100644
--- a/fs/xfs/xfs_ag.h
+++ b/fs/xfs/xfs_ag.h
@@ -103,7 +103,7 @@ typedef struct xfs_agf {
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGF_DADDR(mp)       ((xfs_daddr_t)(1 << (mp)->m_sectbb_log))
 #define XFS_AGF_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGF_DADDR(mp))
-#define XFS_BUF_TO_AGF(bp)      ((xfs_agf_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_AGF(bp)      ((xfs_agf_t *)((bp)->b_addr))
 extern int xfs_read_agf(struct xfs_mount *mp, struct xfs_trans *tp,
                        xfs_agnumber_t agno, int flags, struct xfs_buf **bpp);
@@ -156,7 +156,7 @@ typedef struct xfs_agi {
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGI_DADDR(mp)       ((xfs_daddr_t)(2 << (mp)->m_sectbb_log))
 #define XFS_AGI_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGI_DADDR(mp))
-#define XFS_BUF_TO_AGI(bp)      ((xfs_agi_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_AGI(bp)      ((xfs_agi_t *)((bp)->b_addr))
 extern int xfs_read_agi(struct xfs_mount *mp, struct xfs_trans *tp,
                                xfs_agnumber_t agno, struct xfs_buf **bpp);
@@ -168,7 +168,7 @@ extern int xfs_read_agi(struct xfs_mount *mp, struct xfs_trans *tp,
 #define XFS_AGFL_DADDR(mp)      ((xfs_daddr_t)(3 << (mp)->m_sectbb_log))
 #define XFS_AGFL_BLOCK(mp)      XFS_HDR_BLOCK(mp, XFS_AGFL_DADDR(mp))
 #define XFS_AGFL_SIZE(mp)       ((mp)->m_sb.sb_sectsize / sizeof(xfs_agblock_t))
-#define XFS_BUF_TO_AGFL(bp)     ((xfs_agfl_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_AGFL(bp)     ((xfs_agfl_t *)((bp)->b_addr))
 typedef struct xfs_agfl {
        __be32          agfl_bno[1];    /* actually XFS_AGFL_SIZE(mp) */
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 1e00b3ef6274..bdd9cb54d63b 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -451,8 +451,7 @@ xfs_alloc_read_agfl(
                        XFS_FSS_TO_BB(mp, 1), 0, &bp);
        if (error)
                return error;
-        ASSERT(bp);
+        ASSERT(!xfs_buf_geterror(bp));
-        ASSERT(!XFS_BUF_GETERROR(bp));
        XFS_BUF_SET_VTYPE_REF(bp, B_FS_AGFL, XFS_AGFL_REF);
        *bpp = bp;
        return 0;
@@ -2116,7 +2115,7 @@ xfs_read_agf(
        if (!*bpp)
                return 0;
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!(*bpp)->b_error);
        agf = XFS_BUF_TO_AGF(*bpp);
        /*
@@ -2168,7 +2167,7 @@ xfs_alloc_read_agf(
                return error;
        if (!*bpp)
                return 0;
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!(*bpp)->b_error);
        agf = XFS_BUF_TO_AGF(*bpp);
        pag = xfs_perag_get(mp, agno);
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index cbae424fe1ba..160bcdc34a6e 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -2121,8 +2121,7 @@ xfs_attr_rmtval_set(xfs_da_args_t *args)
                bp = xfs_buf_get(mp->m_ddev_targp, dblkno, blkcnt,
                                 XBF_LOCK | XBF_DONT_BLOCK);
-                ASSERT(bp);
+                ASSERT(!xfs_buf_geterror(bp));
-                ASSERT(!XFS_BUF_GETERROR(bp));
                tmp = (valuelen < XFS_BUF_SIZE(bp)) ? valuelen :
                                                        XFS_BUF_SIZE(bp);
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index ab3e5c6c4642..452a291383ab 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -3383,8 +3383,7 @@ xfs_bmap_local_to_extents(
                ASSERT(args.len == 1);
                *firstblock = args.fsbno;
                bp = xfs_btree_get_bufl(args.mp, tp, args.fsbno, 0);
-                memcpy((char *)XFS_BUF_PTR(bp), ifp->if_u1.if_data,
+                memcpy(bp->b_addr, ifp->if_u1.if_data, ifp->if_bytes);
-                        ifp->if_bytes);
                xfs_trans_log_buf(tp, bp, 0, ifp->if_bytes - 1);
                xfs_bmap_forkoff_reset(args.mp, ip, whichfork);
                xfs_idata_realloc(ip, -ifp->if_bytes, whichfork);
diff --git a/fs/xfs/xfs_btree.c b/fs/xfs/xfs_btree.c
index cabf4b5604aa..2b9fd385e27d 100644
--- a/fs/xfs/xfs_btree.c
+++ b/fs/xfs/xfs_btree.c
@@ -275,8 +275,7 @@ xfs_btree_dup_cursor(
                                return error;
                        }
                        new->bc_bufs[i] = bp;
-                        ASSERT(bp);
+                        ASSERT(!xfs_buf_geterror(bp));
-                        ASSERT(!XFS_BUF_GETERROR(bp));
                } else
                        new->bc_bufs[i] = NULL;
        }
@@ -467,8 +466,7 @@ xfs_btree_get_bufl(
        ASSERT(fsbno != NULLFSBLOCK);
        d = XFS_FSB_TO_DADDR(mp, fsbno);
        bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, d, mp->m_bsize, lock);
-        ASSERT(bp);
+        ASSERT(!xfs_buf_geterror(bp));
-        ASSERT(!XFS_BUF_GETERROR(bp));
        return bp;
 }
@@ -491,8 +489,7 @@ xfs_btree_get_bufs(
        ASSERT(agbno != NULLAGBLOCK);
        d = XFS_AGB_TO_DADDR(mp, agno, agbno);
        bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, d, mp->m_bsize, lock);
-        ASSERT(bp);
+        ASSERT(!xfs_buf_geterror(bp));
-        ASSERT(!XFS_BUF_GETERROR(bp));
        return bp;
 }
@@ -632,7 +629,7 @@ xfs_btree_read_bufl(
                        mp->m_bsize, lock, &bp))) {
                return error;
        }
-        ASSERT(!bp || !XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
        if (bp)
                XFS_BUF_SET_VTYPE_REF(bp, B_FS_MAP, refval);
        *bpp = bp;
@@ -973,8 +970,7 @@ xfs_btree_get_buf_block(
        *bpp = xfs_trans_get_buf(cur->bc_tp, mp->m_ddev_targp, d,
                                 mp->m_bsize, flags);
-        ASSERT(*bpp);
+        ASSERT(!xfs_buf_geterror(*bpp));
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
        *block = XFS_BUF_TO_BLOCK(*bpp);
        return 0;
@@ -1006,8 +1002,7 @@ xfs_btree_read_buf_block(
        if (error)
                return error;
-        ASSERT(*bpp != NULL);
+        ASSERT(!xfs_buf_geterror(*bpp));
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
        xfs_btree_set_refs(cur, *bpp);
        *block = XFS_BUF_TO_BLOCK(*bpp);
diff --git a/fs/xfs/xfs_btree.h b/fs/xfs/xfs_btree.h
index 8d05a6a46ce3..5b240de104c0 100644
--- a/fs/xfs/xfs_btree.h
+++ b/fs/xfs/xfs_btree.h
@@ -262,7 +262,7 @@ typedef struct xfs_btree_cur
 /*
 * Convert from buffer to btree block header.
 */
-#define XFS_BUF_TO_BLOCK(bp)    ((struct xfs_btree_block *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_BLOCK(bp)    ((struct xfs_btree_block *)((bp)->b_addr))
 /*
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 88492916c3dc..cac2ecfa6746 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -124,9 +124,9 @@ xfs_buf_item_log_check(
        bp = bip->bli_buf;
        ASSERT(XFS_BUF_COUNT(bp) > 0);
-        ASSERT(XFS_BUF_PTR(bp) != NULL);
+        ASSERT(bp->b_addr != NULL);
        orig = bip->bli_orig;
-        buffer = XFS_BUF_PTR(bp);
+        buffer = bp->b_addr;
        for (x = 0; x < XFS_BUF_COUNT(bp); x++) {
                if (orig[x] != buffer[x] && !btst(bip->bli_logged, x)) {
                        xfs_emerg(bp->b_mount,
@@ -371,7 +371,6 @@ xfs_buf_item_pin(
 {
        struct xfs_buf_log_item *bip = BUF_ITEM(lip);
-        ASSERT(XFS_BUF_ISBUSY(bip->bli_buf));
        ASSERT(atomic_read(&bip->bli_refcount) > 0);
        ASSERT((bip->bli_flags & XFS_BLI_LOGGED) ||
               (bip->bli_flags & XFS_BLI_STALE));
@@ -479,13 +478,13 @@ xfs_buf_item_trylock(
        struct xfs_buf_log_item *bip = BUF_ITEM(lip);
        struct xfs_buf          *bp = bip->bli_buf;
-        if (XFS_BUF_ISPINNED(bp))
+        if (xfs_buf_ispinned(bp))
                return XFS_ITEM_PINNED;
        if (!xfs_buf_trylock(bp))
                return XFS_ITEM_LOCKED;
        /* take a reference to the buffer.  */
-        XFS_BUF_HOLD(bp);
+        xfs_buf_hold(bp);
        ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
        trace_xfs_buf_item_trylock(bip);
@@ -726,7 +725,7 @@ xfs_buf_item_init(
         * to have logged.
         */
        bip->bli_orig = (char *)kmem_alloc(XFS_BUF_COUNT(bp), KM_SLEEP);
-        memcpy(bip->bli_orig, XFS_BUF_PTR(bp), XFS_BUF_COUNT(bp));
+        memcpy(bip->bli_orig, bp->b_addr, XFS_BUF_COUNT(bp));
        bip->bli_logged = (char *)kmem_zalloc(XFS_BUF_COUNT(bp) / NBBY, KM_SLEEP);
 #endif
@@ -895,7 +894,6 @@ xfs_buf_attach_iodone(
 {
        xfs_log_item_t  *head_lip;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(xfs_buf_islocked(bp));
        lip->li_cb = cb;
@@ -960,7 +958,7 @@ xfs_buf_iodone_callbacks(
        static ulong            lasttime;
        static xfs_buftarg_t    *lasttarg;
-        if (likely(!XFS_BUF_GETERROR(bp)))
+        if (likely(!xfs_buf_geterror(bp)))
                goto do_callbacks;
        /*
@@ -973,14 +971,14 @@ xfs_buf_iodone_callbacks(
                goto do_callbacks;
        }
-        if (XFS_BUF_TARGET(bp) != lasttarg ||
+        if (bp->b_target != lasttarg ||
            time_after(jiffies, (lasttime + 5*HZ))) {
                lasttime = jiffies;
                xfs_alert(mp, "Device %s: metadata write error block 0x%llx",
-                        XFS_BUFTARG_NAME(XFS_BUF_TARGET(bp)),
+                        xfs_buf_target_name(bp->b_target),
                      (__uint64_t)XFS_BUF_ADDR(bp));
        }
-        lasttarg = XFS_BUF_TARGET(bp);
+        lasttarg = bp->b_target;
        /*
         * If the write was asynchronous then no one will be looking for the
@@ -991,12 +989,11 @@ xfs_buf_iodone_callbacks(
         * around.
         */
        if (XFS_BUF_ISASYNC(bp)) {
-                XFS_BUF_ERROR(bp, 0); /* errno of 0 unsets the flag */
+                xfs_buf_ioerror(bp, 0); /* errno of 0 unsets the flag */
                if (!XFS_BUF_ISSTALE(bp)) {
                        XFS_BUF_DELAYWRITE(bp);
                        XFS_BUF_DONE(bp);
-                        XFS_BUF_SET_START(bp);
                }
                ASSERT(bp->b_iodone != NULL);
                trace_xfs_buf_item_iodone_async(bp, _RET_IP_);
@@ -1013,7 +1010,6 @@ xfs_buf_iodone_callbacks(
        XFS_BUF_UNDELAYWRITE(bp);
        trace_xfs_buf_error_relse(bp, _RET_IP_);
-        xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
 do_callbacks:
        xfs_buf_do_callbacks(bp);
diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c
index 5bfcb8779f9f..ee9d5427fcd4 100644
--- a/fs/xfs/xfs_da_btree.c
+++ b/fs/xfs/xfs_da_btree.c
@@ -2050,7 +2050,7 @@ xfs_da_do_buf(
                case 0:
                        bp = xfs_trans_get_buf(trans, mp->m_ddev_targp,
                                mappedbno, nmapped, 0);
-                        error = bp ? XFS_BUF_GETERROR(bp) : XFS_ERROR(EIO);
+                        error = bp ? bp->b_error : XFS_ERROR(EIO);
                        break;
                case 1:
                case 2:
@@ -2268,7 +2268,7 @@ xfs_da_buf_make(int nbuf, xfs_buf_t **bps)
                dabuf->nbuf = 1;
                bp = bps[0];
                dabuf->bbcount = (short)BTOBB(XFS_BUF_COUNT(bp));
-                dabuf->data = XFS_BUF_PTR(bp);
+                dabuf->data = bp->b_addr;
                dabuf->bps[0] = bp;
        } else {
                dabuf->nbuf = nbuf;
@@ -2279,7 +2279,7 @@ xfs_da_buf_make(int nbuf, xfs_buf_t **bps)
                dabuf->data = kmem_alloc(BBTOB(dabuf->bbcount), KM_SLEEP);
                for (i = off = 0; i < nbuf; i++, off += XFS_BUF_COUNT(bp)) {
                        bp = bps[i];
-                        memcpy((char *)dabuf->data + off, XFS_BUF_PTR(bp),
+                        memcpy((char *)dabuf->data + off, bp->b_addr,
                                XFS_BUF_COUNT(bp));
                }
        }
@@ -2302,8 +2302,8 @@ xfs_da_buf_clean(xfs_dabuf_t *dabuf)
                for (i = off = 0; i < dabuf->nbuf;
                                i++, off += XFS_BUF_COUNT(bp)) {
                        bp = dabuf->bps[i];
-                        memcpy(XFS_BUF_PTR(bp), (char *)dabuf->data + off,
+                        memcpy(bp->b_addr, dabuf->data + off,
-                                XFS_BUF_COUNT(bp));
+                                                XFS_BUF_COUNT(bp));
                }
        }
 }
@@ -2340,7 +2340,7 @@ xfs_da_log_buf(xfs_trans_t *tp, xfs_dabuf_t *dabuf, uint first, uint last)
        ASSERT(dabuf->nbuf && dabuf->data && dabuf->bbcount && dabuf->bps[0]);
        if (dabuf->nbuf == 1) {
-                ASSERT(dabuf->data == (void *)XFS_BUF_PTR(dabuf->bps[0]));
+                ASSERT(dabuf->data == dabuf->bps[0]->b_addr);
                xfs_trans_log_buf(tp, dabuf->bps[0], first, last);
                return;
        }
diff --git a/fs/xfs/xfs_dinode.h b/fs/xfs/xfs_dinode.h
index dffba9ba0db6..a3721633abc8 100644
--- a/fs/xfs/xfs_dinode.h
+++ b/fs/xfs/xfs_dinode.h
@@ -148,7 +148,7 @@ typedef enum xfs_dinode_fmt {
                be32_to_cpu((dip)->di_nextents) : \
                be16_to_cpu((dip)->di_anextents))
-#define XFS_BUF_TO_DINODE(bp)   ((xfs_dinode_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_DINODE(bp)   ((xfs_dinode_t *)((bp)->b_addr))
 /*
 * For block and character special files the 32bit dev_t is stored at the
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index dd5628bd8d0b..9f24ec28283b 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -202,8 +202,7 @@ xfs_ialloc_inode_init(
                fbuf = xfs_trans_get_buf(tp, mp->m_ddev_targp, d,
                                         mp->m_bsize * blks_per_cluster,
                                         XBF_LOCK);
-                ASSERT(fbuf);
+                ASSERT(!xfs_buf_geterror(fbuf));
-                ASSERT(!XFS_BUF_GETERROR(fbuf));
                /*
                 * Initialize all inodes in this buffer and then log them.
@@ -1486,7 +1485,7 @@ xfs_read_agi(
        if (error)
                return error;
-        ASSERT(*bpp && !XFS_BUF_GETERROR(*bpp));
+        ASSERT(!xfs_buf_geterror(*bpp));
        agi = XFS_BUF_TO_AGI(*bpp);
        /*
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 2fcca4b03ed3..0239a7c7c886 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2473,7 +2473,7 @@ cluster_corrupt_out:
                if (bp->b_iodone) {
                        XFS_BUF_UNDONE(bp);
                        XFS_BUF_STALE(bp);
-                        XFS_BUF_ERROR(bp,EIO);
+                        xfs_buf_ioerror(bp, EIO);
                        xfs_buf_ioend(bp, 0);
                } else {
                        XFS_BUF_STALE(bp);
@@ -2585,7 +2585,7 @@ xfs_iflush(
         * If the buffer is pinned then push on the log now so we won't
         * get stuck waiting in the write for too long.
         */
-        if (XFS_BUF_ISPINNED(bp))
+        if (xfs_buf_ispinned(bp))
                xfs_log_force(mp, 0);
        /*
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 06ff8437ed8e..3a8d4f66d702 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -878,7 +878,7 @@ xlog_iodone(xfs_buf_t *bp)
        /*
         * Race to shutdown the filesystem if we see an error.
         */
-        if (XFS_TEST_ERROR((XFS_BUF_GETERROR(bp)), l->l_mp,
+        if (XFS_TEST_ERROR((xfs_buf_geterror(bp)), l->l_mp,
                        XFS_ERRTAG_IODONE_IOERR, XFS_RANDOM_IODONE_IOERR)) {
                xfs_ioerror_alert("xlog_iodone", l->l_mp, bp, XFS_BUF_ADDR(bp));
                XFS_BUF_STALE(bp);
@@ -1051,7 +1051,6 @@ xlog_alloc_log(xfs_mount_t	*mp,
        if (!bp)
                goto out_free_log;
        bp->b_iodone = xlog_iodone;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(xfs_buf_islocked(bp));
        log->l_xbuf = bp;
@@ -1108,7 +1107,6 @@ xlog_alloc_log(xfs_mount_t	*mp,
                iclog->ic_callback_tail = &(iclog->ic_callback);
                iclog->ic_datap = (char *)iclog->ic_data + log->l_iclog_hsize;
-                ASSERT(XFS_BUF_ISBUSY(iclog->ic_bp));
                ASSERT(xfs_buf_islocked(iclog->ic_bp));
                init_waitqueue_head(&iclog->ic_force_wait);
                init_waitqueue_head(&iclog->ic_write_wait);
@@ -1248,7 +1246,7 @@ xlog_bdstrat(
        struct xlog_in_core     *iclog = bp->b_fspriv;
        if (iclog->ic_state & XLOG_STATE_IOERROR) {
-                XFS_BUF_ERROR(bp, EIO);
+                xfs_buf_ioerror(bp, EIO);
                XFS_BUF_STALE(bp);
                xfs_buf_ioend(bp, 0);
                /*
@@ -1355,7 +1353,6 @@ xlog_sync(xlog_t		*log,
        XFS_BUF_SET_COUNT(bp, count);
        bp->b_fspriv = iclog;
        XFS_BUF_ZEROFLAGS(bp);
-        XFS_BUF_BUSY(bp);
        XFS_BUF_ASYNC(bp);
        bp->b_flags |= XBF_SYNCIO;
@@ -1398,16 +1395,15 @@ xlog_sync(xlog_t		*log,
        if (split) {
                bp = iclog->ic_log->l_xbuf;
                XFS_BUF_SET_ADDR(bp, 0);             /* logical 0 */
-                XFS_BUF_SET_PTR(bp, (xfs_caddr_t)((__psint_t)&(iclog->ic_header)+
+                xfs_buf_associate_memory(bp,
-                                            (__psint_t)count), split);
+                                (char *)&iclog->ic_header + count, split);
                bp->b_fspriv = iclog;
                XFS_BUF_ZEROFLAGS(bp);
-                XFS_BUF_BUSY(bp);
                XFS_BUF_ASYNC(bp);
                bp->b_flags |= XBF_SYNCIO;
                if (log->l_mp->m_flags & XFS_MOUNT_BARRIER)
                        bp->b_flags |= XBF_FUA;
-                dptr = XFS_BUF_PTR(bp);
+                dptr = bp->b_addr;
                /*
                 * Bump the cycle numbers at the start of each block
                 * since this part of the buffer is at the start of
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 052a2c0ec5fb..a199dbcee7d8 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -147,7 +147,7 @@ xlog_align(
        xfs_daddr_t     offset = blk_no & ((xfs_daddr_t)log->l_sectBBsize - 1);
        ASSERT(BBTOB(offset + nbblks) <= XFS_BUF_SIZE(bp));
-        return XFS_BUF_PTR(bp) + BBTOB(offset);
+        return bp->b_addr + BBTOB(offset);
 }
@@ -178,9 +178,7 @@ xlog_bread_noalign(
        XFS_BUF_SET_ADDR(bp, log->l_logBBstart + blk_no);
        XFS_BUF_READ(bp);
-        XFS_BUF_BUSY(bp);
        XFS_BUF_SET_COUNT(bp, BBTOB(nbblks));
-        XFS_BUF_SET_TARGET(bp, log->l_mp->m_logdev_targp);
        xfsbdstrat(log->l_mp, bp);
        error = xfs_buf_iowait(bp);
@@ -220,18 +218,18 @@ xlog_bread_offset(
        xfs_buf_t       *bp,
        xfs_caddr_t     offset)
 {
-        xfs_caddr_t     orig_offset = XFS_BUF_PTR(bp);
+        xfs_caddr_t     orig_offset = bp->b_addr;
        int             orig_len = bp->b_buffer_length;
        int             error, error2;
-        error = XFS_BUF_SET_PTR(bp, offset, BBTOB(nbblks));
+        error = xfs_buf_associate_memory(bp, offset, BBTOB(nbblks));
        if (error)
                return error;
        error = xlog_bread_noalign(log, blk_no, nbblks, bp);
        /* must reset buffer pointer even on error */
-        error2 = XFS_BUF_SET_PTR(bp, orig_offset, orig_len);
+        error2 = xfs_buf_associate_memory(bp, orig_offset, orig_len);
        if (error)
                return error;
        return error2;
@@ -266,11 +264,9 @@ xlog_bwrite(
        XFS_BUF_SET_ADDR(bp, log->l_logBBstart + blk_no);
        XFS_BUF_ZEROFLAGS(bp);
-        XFS_BUF_BUSY(bp);
+        xfs_buf_hold(bp);
-        XFS_BUF_HOLD(bp);
        xfs_buf_lock(bp);
        XFS_BUF_SET_COUNT(bp, BBTOB(nbblks));
-        XFS_BUF_SET_TARGET(bp, log->l_mp->m_logdev_targp);
        if ((error = xfs_bwrite(log->l_mp, bp)))
                xfs_ioerror_alert("xlog_bwrite", log->l_mp,
@@ -360,7 +356,7 @@ STATIC void
 xlog_recover_iodone(
        struct xfs_buf  *bp)
 {
-        if (XFS_BUF_GETERROR(bp)) {
+        if (bp->b_error) {
                /*
                 * We're not going to bother about retrying
                 * this during recovery. One strike!
@@ -1262,7 +1258,7 @@ xlog_write_log_records(
                 */
                ealign = round_down(end_block, sectbb);
                if (j == 0 && (start_block + endcount > ealign)) {
-                        offset = XFS_BUF_PTR(bp) + BBTOB(ealign - start_block);
+                        offset = bp->b_addr + BBTOB(ealign - start_block);
                        error = xlog_bread_offset(log, ealign, sectbb,
                                                        bp, offset);
                        if (error)
@@ -2135,15 +2131,16 @@ xlog_recover_buffer_pass2(
        bp = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno, buf_f->blf_len,
                          buf_flags);
-        if (XFS_BUF_ISERROR(bp)) {
+        if (!bp)
+                return XFS_ERROR(ENOMEM);
+        error = bp->b_error;
+        if (error) {
                xfs_ioerror_alert("xlog_recover_do..(read#1)", mp,
                                  bp, buf_f->blf_blkno);
-                error = XFS_BUF_GETERROR(bp);
                xfs_buf_relse(bp);
                return error;
        }
-        error = 0;
        if (buf_f->blf_flags & XFS_BLF_INODE_BUF) {
                error = xlog_recover_do_inode_buffer(mp, item, bp, buf_f);
        } else if (buf_f->blf_flags &
@@ -2227,14 +2224,17 @@ xlog_recover_inode_pass2(
        bp = xfs_buf_read(mp->m_ddev_targp, in_f->ilf_blkno, in_f->ilf_len,
                          XBF_LOCK);
-        if (XFS_BUF_ISERROR(bp)) {
+        if (!bp) {
+                error = ENOMEM;
+                goto error;
+        }
+        error = bp->b_error;
+        if (error) {
                xfs_ioerror_alert("xlog_recover_do..(read#2)", mp,
                                  bp, in_f->ilf_blkno);
-                error = XFS_BUF_GETERROR(bp);
                xfs_buf_relse(bp);
                goto error;
        }
-        error = 0;
        ASSERT(in_f->ilf_fields & XFS_ILOG_CORE);
        dip = (xfs_dinode_t *)xfs_buf_offset(bp, in_f->ilf_boffset);
@@ -3437,7 +3437,7 @@ xlog_do_recovery_pass(
                        /*
                         * Check for header wrapping around physical end-of-log
                         */
-                        offset = XFS_BUF_PTR(hbp);
+                        offset = hbp->b_addr;
                        split_hblks = 0;
                        wrapped_hblks = 0;
                        if (blk_no + hblks <= log->l_logBBsize) {
@@ -3497,7 +3497,7 @@ xlog_do_recovery_pass(
                        } else {
                                /* This log record is split across the
                                 * physical end of log */
-                                offset = XFS_BUF_PTR(dbp);
+                                offset = dbp->b_addr;
                                split_bblks = 0;
                                if (blk_no != log->l_logBBsize) {
                                        /* some data is before the physical
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 092e16ae4d9d..0081657ad985 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1615,7 +1615,7 @@ xfs_unmountfs_writesb(xfs_mount_t *mp)
                XFS_BUF_UNDELAYWRITE(sbp);
                XFS_BUF_WRITE(sbp);
                XFS_BUF_UNASYNC(sbp);
-                ASSERT(XFS_BUF_TARGET(sbp) == mp->m_ddev_targp);
+                ASSERT(sbp->b_target == mp->m_ddev_targp);
                xfsbdstrat(mp, sbp);
                error = xfs_buf_iowait(sbp);
                if (error)
@@ -1938,7 +1938,7 @@ xfs_getsb(
                xfs_buf_lock(bp);
        }
-        XFS_BUF_HOLD(bp);
+        xfs_buf_hold(bp);
        ASSERT(XFS_BUF_ISDONE(bp));
        return bp;
 }
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 8f76fdff4f46..35561a511b57 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -168,7 +168,7 @@ error_cancel:
                                xfs_trans_cancel(tp, cancelflags);
                                goto error;
                        }
-                        memset(XFS_BUF_PTR(bp), 0, mp->m_sb.sb_blocksize);
+                        memset(bp->b_addr, 0, mp->m_sb.sb_blocksize);
                        xfs_trans_log_buf(tp, bp, 0, mp->m_sb.sb_blocksize - 1);
                        /*
                         * Commit the transaction.
@@ -883,7 +883,7 @@ xfs_rtbuf_get(
        if (error) {
                return error;
        }
-        ASSERT(bp && !XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
        *bpp = bp;
        return 0;
 }
@@ -943,7 +943,7 @@ xfs_rtcheck_range(
        if (error) {
                return error;
        }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
        /*
         * Compute the starting word's address, and starting bit.
         */
@@ -994,7 +994,7 @@ xfs_rtcheck_range(
                        if (error) {
                                return error;
                        }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                        word = 0;
                } else {
                        /*
@@ -1040,7 +1040,7 @@ xfs_rtcheck_range(
                        if (error) {
                                return error;
                        }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                        word = 0;
                } else {
                        /*
@@ -1158,7 +1158,7 @@ xfs_rtfind_back(
        if (error) {
                return error;
        }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
        /*
         * Get the first word's index & point to it.
         */
@@ -1210,7 +1210,7 @@ xfs_rtfind_back(
                        if (error) {
                                return error;
                        }
-                        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        bufp = bp->b_addr;
                        word = XFS_BLOCKWMASK(mp);
                        b = &bufp[word];
                } else {
@@ -1256,7 +1256,7 @@ xfs_rtfind_back(
                        if (error) {
                                return error;
                        }
-                        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        bufp = bp->b_addr;
                        word = XFS_BLOCKWMASK(mp);
                        b = &bufp[word];
                } else {
@@ -1333,7 +1333,7 @@ xfs_rtfind_forw(
        if (error) {
                return error;
        }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
        /*
         * Get the first word's index & point to it.
         */
@@ -1384,7 +1384,7 @@ xfs_rtfind_forw(
                        if (error) {
                                return error;
                        }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                        word = 0;
                } else {
                        /*
@@ -1429,7 +1429,7 @@ xfs_rtfind_forw(
                        if (error) {
                                return error;
                        }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                        word = 0;
                } else {
                        /*
@@ -1649,7 +1649,7 @@ xfs_rtmodify_range(
        if (error) {
                return error;
        }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
        /*
         * Compute the starting word's address, and starting bit.
         */
@@ -1694,7 +1694,7 @@ xfs_rtmodify_range(
                        if (error) {
                                return error;
                        }
-                        first = b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        first = b = bufp = bp->b_addr;
                        word = 0;
                } else {
                        /*
@@ -1734,7 +1734,7 @@ xfs_rtmodify_range(
                        if (error) {
                                return error;
                        }
-                        first = b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        first = b = bufp = bp->b_addr;
                        word = 0;
                } else {
                        /*
@@ -1832,8 +1832,8 @@ xfs_rtmodify_summary(
         */
        sp = XFS_SUMPTR(mp, bp, so);
        *sp += delta;
-        xfs_trans_log_buf(tp, bp, (uint)((char *)sp - (char *)XFS_BUF_PTR(bp)),
+        xfs_trans_log_buf(tp, bp, (uint)((char *)sp - (char *)bp->b_addr),
-                (uint)((char *)sp - (char *)XFS_BUF_PTR(bp) + sizeof(*sp) - 1));
+                (uint)((char *)sp - (char *)bp->b_addr + sizeof(*sp) - 1));
        return 0;
 }
diff --git a/fs/xfs/xfs_rtalloc.h b/fs/xfs/xfs_rtalloc.h
index 09e1f4f35e97..f7f3a359c1c5 100644
--- a/fs/xfs/xfs_rtalloc.h
+++ b/fs/xfs/xfs_rtalloc.h
@@ -47,7 +47,7 @@ struct xfs_trans;
 #define XFS_SUMOFFSTOBLOCK(mp,s)        \
        (((s) * (uint)sizeof(xfs_suminfo_t)) >> (mp)->m_sb.sb_blocklog)
 #define XFS_SUMPTR(mp,bp,so)    \
-        ((xfs_suminfo_t *)((char *)XFS_BUF_PTR(bp) + \
+        ((xfs_suminfo_t *)((bp)->b_addr + \
                (((so) * (uint)sizeof(xfs_suminfo_t)) & XFS_BLOCKMASK(mp))))
 #define XFS_BITTOBLOCK(mp,bi)   ((bi) >> (mp)->m_blkbit_log)
diff --git a/fs/xfs/xfs_rw.c b/fs/xfs/xfs_rw.c
index d6d6fdfe9422..c96a8a05ac03 100644
--- a/fs/xfs/xfs_rw.c
+++ b/fs/xfs/xfs_rw.c
@@ -104,9 +104,9 @@ xfs_ioerror_alert(
        xfs_alert(mp,
                 "I/O error occurred: meta-data dev %s block 0x%llx"
                 "       (\"%s\") error %d buf count %zd",
-                XFS_BUFTARG_NAME(XFS_BUF_TARGET(bp)),
+                xfs_buf_target_name(bp->b_target),
                (__uint64_t)blkno, func,
-                XFS_BUF_GETERROR(bp), XFS_BUF_COUNT(bp));
+                bp->b_error, XFS_BUF_COUNT(bp));
 }
 /*
@@ -137,8 +137,8 @@ xfs_read_buf(
        bp = xfs_buf_read(target, blkno, len, flags);
        if (!bp)
                return XFS_ERROR(EIO);
-        error = XFS_BUF_GETERROR(bp);
+        error = bp->b_error;
-        if (bp && !error && !XFS_FORCED_SHUTDOWN(mp)) {
+        if (!error && !XFS_FORCED_SHUTDOWN(mp)) {
                *bpp = bp;
        } else {
                *bpp = NULL;
diff --git a/fs/xfs/xfs_sb.h b/fs/xfs/xfs_sb.h
index 1eb2ba586814..cb6ae715814a 100644
--- a/fs/xfs/xfs_sb.h
+++ b/fs/xfs/xfs_sb.h
@@ -509,7 +509,7 @@ static inline int xfs_sb_version_hasprojid32bit(xfs_sb_t *sbp)
 #define XFS_SB_DADDR            ((xfs_daddr_t)0) /* daddr in filesystem/ag */
 #define XFS_SB_BLOCK(mp)        XFS_HDR_BLOCK(mp, XFS_SB_DADDR)
-#define XFS_BUF_TO_SBP(bp)      ((xfs_dsb_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_SBP(bp)      ((xfs_dsb_t *)((bp)->b_addr))
 #define XFS_HDR_BLOCK(mp,d)     ((xfs_agblock_t)XFS_BB_TO_FSBT(mp,d))
 #define XFS_DADDR_TO_FSB(mp,d)  XFS_AGB_TO_FSB(mp, \
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index 43233e92f0f6..c15aa29fa169 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -299,7 +299,7 @@ xfs_trans_ail_cursor_last(
 * Splice the log item list into the AIL at the given LSN. We splice to the
 * tail of the given LSN to maintain insert order for push traversals. The
 * cursor is optional, allowing repeated updates to the same LSN to avoid
- * repeated traversals.
+ * repeated traversals.  This should not be called with an empty list.
 */
 static void
 xfs_ail_splice(
@@ -308,50 +308,39 @@ xfs_ail_splice(
        struct list_head        *list,
        xfs_lsn_t               lsn)
 {
-        struct xfs_log_item     *lip = cur ? cur->item : NULL;
+        struct xfs_log_item     *lip;
-        struct xfs_log_item     *next_lip;
+        ASSERT(!list_empty(list));
        /*
-         * Get a new cursor if we don't have a placeholder or the existing one
+         * Use the cursor to determine the insertion point if one is
-         * has been invalidated.
+         * provided.  If not, or if the one we got is not valid,
+         * find the place in the AIL where the items belong.
         */
-        if (!lip || (__psint_t)lip & 1) {
+        lip = cur ? cur->item : NULL;
+        if (!lip || (__psint_t) lip & 1)
                lip = __xfs_trans_ail_cursor_last(ailp, lsn);
-                if (!lip) {
+        /*
-                        /* The list is empty, so just splice and return.  */
+         * If a cursor is provided, we know we're processing the AIL
-                        if (cur)
+         * in lsn order, and future items to be spliced in will
-                                cur->item = NULL;
+         * follow the last one being inserted now.  Update the
-                        list_splice(list, &ailp->xa_ail);
+         * cursor to point to that last item, now while we have a
-                        return;
+         * reliable pointer to it.
-                }
+         */
-        }
+        if (cur)
+                cur->item = list_entry(list->prev, struct xfs_log_item, li_ail);
        /*
-         * Our cursor points to the item we want to insert _after_, so we have
+         * Finally perform the splice.  Unless the AIL was empty,
-         * to update the cursor to point to the end of the list we are splicing
+         * lip points to the item in the AIL _after_ which the new
-         * in so that it points to the correct location for the next splice.
+         * items should go.  If lip is null the AIL was empty, so
-         * i.e. before the splice
+         * the new items go at the head of the AIL.
-         *
-         *  lsn -> lsn -> lsn + x -> lsn + x ...
-         *          ^
-         *          | cursor points here
-         *
-         * After the splice we have:
-         *
-         *  lsn -> lsn -> lsn -> lsn -> .... -> lsn -> lsn + x -> lsn + x ...
-         *          ^                            ^
-         *          | cursor points here         | needs to move here
-         *
-         * So we set the cursor to the last item in the list to be spliced
-         * before we execute the splice, resulting in the cursor pointing to
-         * the correct item after the splice occurs.
         */
-        if (cur) {
+        if (lip)
-                next_lip = list_entry(list->prev, struct xfs_log_item, li_ail);
+                list_splice(list, &lip->li_ail);
-                cur->item = next_lip;
+        else
-        }
+                list_splice(list, &ailp->xa_ail);
-        list_splice(list, &lip->li_ail);
 }
 /*
@@ -682,6 +671,7 @@ xfs_trans_ail_update_bulk(
        int                     i;
        LIST_HEAD(tmp);
+        ASSERT(nr_items > 0);           /* Not required, but true. */
        mlip = xfs_ail_min(ailp);
        for (i = 0; i < nr_items; i++) {
@@ -701,7 +691,8 @@ xfs_trans_ail_update_bulk(
                list_add(&lip->li_ail, &tmp);
        }
-        xfs_ail_splice(ailp, cur, &tmp, lsn);
+        if (!list_empty(&tmp))
+                xfs_ail_splice(ailp, cur, &tmp, lsn);
        if (!mlip_changed) {
                spin_unlock(&ailp->xa_lock);
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index 15584fc3ed7d..137e2b9e2948 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -54,7 +54,7 @@ xfs_trans_buf_item_match(
        list_for_each_entry(lidp, &tp->t_items, lid_trans) {
                blip = (struct xfs_buf_log_item *)lidp->lid_item;
                if (blip->bli_item.li_type == XFS_LI_BUF &&
-                    XFS_BUF_TARGET(blip->bli_buf) == target &&
+                    blip->bli_buf->b_target == target &&
                    XFS_BUF_ADDR(blip->bli_buf) == blkno &&
                    XFS_BUF_COUNT(blip->bli_buf) == len)
                        return blip->bli_buf;
@@ -80,7 +80,6 @@ _xfs_trans_bjoin(
 {
        struct xfs_buf_log_item *bip;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(bp->b_transp == NULL);
        /*
@@ -194,7 +193,7 @@ xfs_trans_get_buf(xfs_trans_t	*tp,
                return NULL;
        }
-        ASSERT(!XFS_BUF_GETERROR(bp));
+        ASSERT(!bp->b_error);
        _xfs_trans_bjoin(tp, bp, 1);
        trace_xfs_trans_get_buf(bp->b_fspriv);
@@ -293,10 +292,10 @@ xfs_trans_read_buf(
                        return (flags & XBF_TRYLOCK) ?
                                        EAGAIN : XFS_ERROR(ENOMEM);
-                if (XFS_BUF_GETERROR(bp) != 0) {
+                if (bp->b_error) {
+                        error = bp->b_error;
                        xfs_ioerror_alert("xfs_trans_read_buf", mp,
                                          bp, blkno);
-                        error = XFS_BUF_GETERROR(bp);
                        xfs_buf_relse(bp);
                        return error;
                }
@@ -330,7 +329,7 @@ xfs_trans_read_buf(
                ASSERT(xfs_buf_islocked(bp));
                ASSERT(bp->b_transp == tp);
                ASSERT(bp->b_fspriv != NULL);
-                ASSERT((XFS_BUF_ISERROR(bp)) == 0);
+                ASSERT(!bp->b_error);
                if (!(XFS_BUF_ISDONE(bp))) {
                        trace_xfs_trans_read_buf_io(bp, _RET_IP_);
                        ASSERT(!XFS_BUF_ISASYNC(bp));
@@ -386,10 +385,9 @@ xfs_trans_read_buf(
                return (flags & XBF_TRYLOCK) ?
                                        0 : XFS_ERROR(ENOMEM);
        }
-        if (XFS_BUF_GETERROR(bp) != 0) {
+        if (bp->b_error) {
-            XFS_BUF_SUPER_STALE(bp);
+                error = bp->b_error;
-                error = XFS_BUF_GETERROR(bp);
+                XFS_BUF_SUPER_STALE(bp);
                xfs_ioerror_alert("xfs_trans_read_buf", mp,
                                  bp, blkno);
                if (tp->t_flags & XFS_TRANS_DIRTY)
@@ -430,7 +428,7 @@ shutdown_abort:
        if (XFS_BUF_ISSTALE(bp) && XFS_BUF_ISDELAYWRITE(bp))
                xfs_notice(mp, "about to pop assert, bp == 0x%p", bp);
 #endif
-        ASSERT((XFS_BUF_BFLAGS(bp) & (XBF_STALE|XBF_DELWRI)) !=
+        ASSERT((bp->b_flags & (XBF_STALE|XBF_DELWRI)) !=
                                     (XBF_STALE|XBF_DELWRI));
        trace_xfs_trans_read_buf_shut(bp, _RET_IP_);
@@ -581,7 +579,6 @@ xfs_trans_bhold(xfs_trans_t	*tp,
 {
        xfs_buf_log_item_t      *bip = bp->b_fspriv;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(bp->b_transp == tp);
        ASSERT(bip != NULL);
        ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
@@ -602,7 +599,6 @@ xfs_trans_bhold_release(xfs_trans_t	*tp,
 {
        xfs_buf_log_item_t      *bip = bp->b_fspriv;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(bp->b_transp == tp);
        ASSERT(bip != NULL);
        ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
@@ -631,7 +627,6 @@ xfs_trans_log_buf(xfs_trans_t	*tp,
 {
        xfs_buf_log_item_t      *bip = bp->b_fspriv;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(bp->b_transp == tp);
        ASSERT(bip != NULL);
        ASSERT((first <= last) && (last < XFS_BUF_COUNT(bp)));
@@ -702,7 +697,6 @@ xfs_trans_binval(
 {
        xfs_buf_log_item_t      *bip = bp->b_fspriv;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(bp->b_transp == tp);
        ASSERT(bip != NULL);
        ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -774,7 +768,6 @@ xfs_trans_inode_buf(
 {
        xfs_buf_log_item_t      *bip = bp->b_fspriv;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(bp->b_transp == tp);
        ASSERT(bip != NULL);
        ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -798,7 +791,6 @@ xfs_trans_stale_inode_buf(
 {
        xfs_buf_log_item_t      *bip = bp->b_fspriv;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(bp->b_transp == tp);
        ASSERT(bip != NULL);
        ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -823,7 +815,6 @@ xfs_trans_inode_alloc_buf(
 {
        xfs_buf_log_item_t      *bip = bp->b_fspriv;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(bp->b_transp == tp);
        ASSERT(bip != NULL);
        ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -851,7 +842,6 @@ xfs_trans_dquot_buf(
 {
        xfs_buf_log_item_t      *bip = bp->b_fspriv;
-        ASSERT(XFS_BUF_ISBUSY(bp));
        ASSERT(bp->b_transp == tp);
        ASSERT(bip != NULL);
        ASSERT(type == XFS_BLF_UDQUOT_BUF ||
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 9322e13f0c63..51fc429527bc 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -83,7 +83,9 @@ xfs_readlink_bmap(
                bp = xfs_buf_read(mp->m_ddev_targp, d, BTOBB(byte_cnt),
                                  XBF_LOCK | XBF_MAPPED | XBF_DONT_BLOCK);
-                error = XFS_BUF_GETERROR(bp);
+                if (!bp)
+                        return XFS_ERROR(ENOMEM);
+                error = bp->b_error;
                if (error) {
                        xfs_ioerror_alert("xfs_readlink",
                                  ip->i_mount, bp, XFS_BUF_ADDR(bp));
@@ -94,7 +96,7 @@ xfs_readlink_bmap(
                        byte_cnt = pathlen;
                pathlen -= byte_cnt;
-                memcpy(link, XFS_BUF_PTR(bp), byte_cnt);
+                memcpy(link, bp->b_addr, byte_cnt);
                xfs_buf_relse(bp);
        }
@@ -1648,13 +1650,13 @@ xfs_symlink(
                        byte_cnt = XFS_FSB_TO_B(mp, mval[n].br_blockcount);
                        bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, d,
                                               BTOBB(byte_cnt), 0);
-                        ASSERT(bp && !XFS_BUF_GETERROR(bp));
+                        ASSERT(!xfs_buf_geterror(bp));
                        if (pathlen < byte_cnt) {
                                byte_cnt = pathlen;
                        }
                        pathlen -= byte_cnt;
-                        memcpy(XFS_BUF_PTR(bp), cur_chunk, byte_cnt);
+                        memcpy(bp->b_addr, cur_chunk, byte_cnt);
                        cur_chunk += byte_cnt;
                        xfs_trans_log_buf(tp, bp, 0, byte_cnt - 1);
@@ -1999,7 +2001,7 @@ xfs_zero_remaining_bytes(
                                          mp, bp, XFS_BUF_ADDR(bp));
                        break;
                }
-                memset(XFS_BUF_PTR(bp) +
+                memset(bp->b_addr +
                        (offset - XFS_FSB_TO_B(mp, imap.br_startoff)),
                      0, lastoffset - offset + 1);
                XFS_BUF_UNDONE(bp);
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 87a06f345bd2..59517300a315 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -23,6 +23,7 @@
 #include <linux/errno.h>
 #include <linux/topology.h>
 #include <linux/wait.h>
+#include <linux/module.h>
 #include <asm/irq.h>
 #include <asm/ptrace.h>
@@ -547,7 +548,15 @@ static inline struct msi_desc *irq_data_get_msi(struct irq_data *d)
        return d->msi_desc;
 }
-int irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node);
+int __irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
+                struct module *owner);
+static inline int irq_alloc_descs(int irq, unsigned int from, unsigned int cnt,
+                int node)
+{
+        return __irq_alloc_descs(irq, from, cnt, node, THIS_MODULE);
+}
 void irq_free_descs(unsigned int irq, unsigned int cnt);
 int irq_reserve_irqs(unsigned int from, unsigned int cnt);
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index 2d921b35212c..150134ac709a 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -66,6 +66,7 @@ struct irq_desc {
 #ifdef CONFIG_PROC_FS
        struct proc_dir_entry   *dir;
 #endif
+        struct module           *owner;
        const char              *name;
 } ____cacheline_internodealigned_in_smp;
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index 0f83858147a6..1d09562ccf73 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -56,8 +56,6 @@ struct mmc_ios {
 #define MMC_TIMING_UHS_SDR104   4
 #define MMC_TIMING_UHS_DDR50    5
-        unsigned char   ddr;                    /* dual data rate used */
 #define MMC_SDR_MODE            0
 #define MMC_1_2V_DDR_MODE       1
 #define MMC_1_8V_DDR_MODE       2
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 2e17c5dbdcb8..180540a84d37 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -29,7 +29,7 @@
 #define MAX_LINKS 32            
 struct sockaddr_nl {
-        sa_family_t     nl_family;      /* AF_NETLINK   */
+        __kernel_sa_family_t    nl_family;      /* AF_NETLINK   */
        unsigned short  nl_pad;         /* zero         */
        __u32           nl_pid;         /* port ID      */
        __u32           nl_groups;      /* multicast groups mask */
diff --git a/include/linux/of.h b/include/linux/of.h
index 0085bb01c041..9180dc5cb00b 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -256,6 +256,13 @@ static inline int of_property_read_string(struct device_node *np,
        return -ENOSYS;
 }
+static inline const void *of_get_property(const struct device_node *node,
+                                const char *name,
+                                int *lenp)
+{
+        return NULL;
+}
 #endif /* CONFIG_OF */
 static inline int of_property_read_u32(const struct device_node *np,
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index b27ebea25660..93f4d035076b 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -97,6 +97,9 @@ struct rtc_pll_info {
 #define RTC_AF 0x20     /* Alarm interrupt */
 #define RTC_UF 0x10     /* Update interrupt for 1Hz RTC */
+#define RTC_MAX_FREQ    8192
 #ifdef __KERNEL__
 #include <linux/types.h>
diff --git a/include/linux/socket.h b/include/linux/socket.h
index e17f82266639..d0e77f607a79 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -8,8 +8,10 @@
 #define _K_SS_ALIGNSIZE (__alignof__ (struct sockaddr *))
                                /* Implementation specific desired alignment */
+typedef unsigned short __kernel_sa_family_t;
 struct __kernel_sockaddr_storage {
-        unsigned short  ss_family;              /* address family */
+        __kernel_sa_family_t    ss_family;              /* address family */
        /* Following field(s) are implementation specific */
        char            __data[_K_SS_MAXSIZE - sizeof(unsigned short)];
                                /* space to achieve desired size, */
@@ -35,7 +37,7 @@ struct seq_file;
 extern void socket_seq_show(struct seq_file *seq);
 #endif
-typedef unsigned short  sa_family_t;
+typedef __kernel_sa_family_t    sa_family_t;
 /*
 *      1003.1g requires sa_family_t and that sa_data is char.
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index caaff5f5f39f..b897d6e6d0a5 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -238,7 +238,7 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
 {
        __u8 flags = 0;
-        if (inet_sk(sk)->transparent)
+        if (inet_sk(sk)->transparent || inet_sk(sk)->hdrincl)
                flags |= FLOWI_FLAG_ANYSRC;
        if (sk->sk_protocol == IPPROTO_TCP)
                flags |= FLOWI_FLAG_PRECOW_METRICS;
diff --git a/include/sound/tlv320aic3x.h b/include/sound/tlv320aic3x.h
index 99e0308bf2c2..ffd9bc793105 100644
--- a/include/sound/tlv320aic3x.h
+++ b/include/sound/tlv320aic3x.h
@@ -1,7 +1,7 @@
 /*
 * Platform data for Texas Instruments TLV320AIC3x codec
 *
- * Author: Jarkko Nikula <jhnikula@gmail.com>
+ * Author: Jarkko Nikula <jarkko.nikula@bitmer.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
index 3a2cab407b93..e38544dddb18 100644
--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -246,7 +246,7 @@ void irq_setup_generic_chip(struct irq_chip_generic *gc, u32 msk,
                gc->mask_cache = irq_reg_readl(gc->reg_base + ct->regs.mask);
        for (i = gc->irq_base; msk; msk >>= 1, i++) {
-                if (!msk & 0x01)
+                if (!(msk & 0x01))
                        continue;
                if (flags & IRQ_GC_INIT_NESTED_LOCK)
@@ -301,7 +301,7 @@ void irq_remove_generic_chip(struct irq_chip_generic *gc, u32 msk,
        raw_spin_unlock(&gc_lock);
        for (; msk; msk >>= 1, i++) {
-                if (!msk & 0x01)
+                if (!(msk & 0x01))
                        continue;
                /* Remove handler first. That will mask the irq line */
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 4c60a50e66b2..cb65d0360e31 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -70,7 +70,8 @@ static inline void desc_smp_init(struct irq_desc *desc, int node) { }
 static inline int desc_node(struct irq_desc *desc) { return 0; }
 #endif
-static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node)
+static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node,
+                struct module *owner)
 {
        int cpu;
@@ -86,6 +87,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node)
        desc->irq_count = 0;
        desc->irqs_unhandled = 0;
        desc->name = NULL;
+        desc->owner = owner;
        for_each_possible_cpu(cpu)
                *per_cpu_ptr(desc->kstat_irqs, cpu) = 0;
        desc_smp_init(desc, node);
@@ -128,7 +130,7 @@ static void free_masks(struct irq_desc *desc)
 static inline void free_masks(struct irq_desc *desc) { }
 #endif
-static struct irq_desc *alloc_desc(int irq, int node)
+static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
 {
        struct irq_desc *desc;
        gfp_t gfp = GFP_KERNEL;
@@ -147,7 +149,7 @@ static struct irq_desc *alloc_desc(int irq, int node)
        raw_spin_lock_init(&desc->lock);
        lockdep_set_class(&desc->lock, &irq_desc_lock_class);
-        desc_set_defaults(irq, desc, node);
+        desc_set_defaults(irq, desc, node, owner);
        return desc;
@@ -173,13 +175,14 @@ static void free_desc(unsigned int irq)
        kfree(desc);
 }
-static int alloc_descs(unsigned int start, unsigned int cnt, int node)
+static int alloc_descs(unsigned int start, unsigned int cnt, int node,
+                       struct module *owner)
 {
        struct irq_desc *desc;
        int i;
        for (i = 0; i < cnt; i++) {
-                desc = alloc_desc(start + i, node);
+                desc = alloc_desc(start + i, node, owner);
                if (!desc)
                        goto err;
                mutex_lock(&sparse_irq_lock);
@@ -227,7 +230,7 @@ int __init early_irq_init(void)
                nr_irqs = initcnt;
        for (i = 0; i < initcnt; i++) {
-                desc = alloc_desc(i, node);
+                desc = alloc_desc(i, node, NULL);
                set_bit(i, allocated_irqs);
                irq_insert_desc(i, desc);
        }
@@ -261,7 +264,7 @@ int __init early_irq_init(void)
                alloc_masks(&desc[i], GFP_KERNEL, node);
                raw_spin_lock_init(&desc[i].lock);
                lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
-                desc_set_defaults(i, &desc[i], node);
+                desc_set_defaults(i, &desc[i], node, NULL);
        }
        return arch_early_irq_init();
 }
@@ -276,8 +279,16 @@ static void free_desc(unsigned int irq)
        dynamic_irq_cleanup(irq);
 }
-static inline int alloc_descs(unsigned int start, unsigned int cnt, int node)
+static inline int alloc_descs(unsigned int start, unsigned int cnt, int node,
+                              struct module *owner)
 {
+        u32 i;
+        for (i = 0; i < cnt; i++) {
+                struct irq_desc *desc = irq_to_desc(start + i);
+                desc->owner = owner;
+        }
        return start;
 }
@@ -337,7 +348,8 @@ EXPORT_SYMBOL_GPL(irq_free_descs);
 * Returns the first irq number or error code
 */
 int __ref
-irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node)
+__irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
+                  struct module *owner)
 {
        int start, ret;
@@ -366,13 +378,13 @@ irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node)
        bitmap_set(allocated_irqs, start, cnt);
        mutex_unlock(&sparse_irq_lock);
-        return alloc_descs(start, cnt, node);
+        return alloc_descs(start, cnt, node, owner);
 err:
        mutex_unlock(&sparse_irq_lock);
        return ret;
 }
-EXPORT_SYMBOL_GPL(irq_alloc_descs);
+EXPORT_SYMBOL_GPL(__irq_alloc_descs);
 /**
 * irq_reserve_irqs - mark irqs allocated
@@ -440,7 +452,7 @@ void dynamic_irq_cleanup(unsigned int irq)
        unsigned long flags;
        raw_spin_lock_irqsave(&desc->lock, flags);
-        desc_set_defaults(irq, desc, desc_node(desc));
+        desc_set_defaults(irq, desc, desc_node(desc), NULL);
        raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 0a7840aeb0fb..2e9425889fa8 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -883,6 +883,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
        if (desc->irq_data.chip == &no_irq_chip)
                return -ENOSYS;
+        if (!try_module_get(desc->owner))
+                return -ENODEV;
        /*
         * Some drivers like serial.c use request_irq() heavily,
         * so we have to be careful not to interfere with a
@@ -906,8 +908,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
         */
        nested = irq_settings_is_nested_thread(desc);
        if (nested) {
-                if (!new->thread_fn)
+                if (!new->thread_fn) {
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out_mput;
+                }
                /*
                 * Replace the primary handler which was provided from
                 * the driver for non nested interrupt handling by the
@@ -929,8 +933,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                t = kthread_create(irq_thread, new, "irq/%d-%s", irq,
                                   new->name);
-                if (IS_ERR(t))
+                if (IS_ERR(t)) {
-                        return PTR_ERR(t);
+                        ret = PTR_ERR(t);
+                        goto out_mput;
+                }
                /*
                 * We keep the reference to the task struct even if
                 * the thread dies to avoid that the interrupt code
@@ -1095,6 +1101,8 @@ out_thread:
                        kthread_stop(t);
                put_task_struct(t);
        }
+out_mput:
+        module_put(desc->owner);
        return ret;
 }
@@ -1203,6 +1211,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
                put_task_struct(action->thread);
        }
+        module_put(desc->owner);
        return action;
 }
@@ -1322,6 +1331,7 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
                if (!thread_fn)
                        return -EINVAL;
                handler = irq_default_primary_handler;
+                irqflags |= IRQF_ONESHOT;
        }
        action = kzalloc(sizeof(struct irqaction), GFP_KERNEL);
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 8c24294e477f..91d67ce3a8d5 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -3111,7 +3111,13 @@ static int match_held_lock(struct held_lock *hlock, struct lockdep_map *lock)
                if (!class)
                        class = look_up_lock_class(lock, 0);
-                if (DEBUG_LOCKS_WARN_ON(!class))
+                /*
+                 * If look_up_lock_class() failed to find a class, we're trying
+                 * to test if we hold a lock that has never yet been acquired.
+                 * Clearly if the lock hasn't been acquired _ever_, we're not
+                 * holding it either, so report failure.
+                 */
+                if (!class)
                        return 0;
                if (DEBUG_LOCKS_WARN_ON(!hlock->nest_lock))
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 464621d18eb2..7ef0903058ee 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -725,9 +725,10 @@ static void free_unmap_vmap_area_addr(unsigned long addr)
 #define VMAP_BBMAP_BITS_MIN     (VMAP_MAX_ALLOC*2)
 #define VMAP_MIN(x, y)          ((x) < (y) ? (x) : (y)) /* can't use min() */
 #define VMAP_MAX(x, y)          ((x) > (y) ? (x) : (y)) /* can't use max() */
-#define VMAP_BBMAP_BITS         VMAP_MIN(VMAP_BBMAP_BITS_MAX,           \
+#define VMAP_BBMAP_BITS         \
-                                        VMAP_MAX(VMAP_BBMAP_BITS_MIN,   \
+                VMAP_MIN(VMAP_BBMAP_BITS_MAX,   \
-                                                VMALLOC_PAGES / NR_CPUS / 16))
+                VMAP_MAX(VMAP_BBMAP_BITS_MIN,   \
+                        VMALLOC_PAGES / roundup_pow_of_two(NR_CPUS) / 16))
 #define VMAP_BLOCK_SIZE         (VMAP_BBMAP_BITS * PAGE_SIZE)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 3176e2e13d9b..2cdf0070419f 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -417,6 +417,7 @@ put_back:
 int br_del_if(struct net_bridge *br, struct net_device *dev)
 {
        struct net_bridge_port *p;
+        bool changed_addr;
        p = br_port_get_rtnl(dev);
        if (!p || p->br != br)
@@ -425,9 +426,12 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
        del_nbp(p);
        spin_lock_bh(&br->lock);
-        br_stp_recalculate_bridge_id(br);
+        changed_addr = br_stp_recalculate_bridge_id(br);
        spin_unlock_bh(&br->lock);
+        if (changed_addr)
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
        netdev_update_features(br->dev);
        return 0;
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 6545ee9591d1..a76b62135558 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -34,6 +34,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
        struct net_device *dev = ptr;
        struct net_bridge_port *p;
        struct net_bridge *br;
+        bool changed_addr;
        int err;
        /* register of bridge completed, add sysfs entries */
@@ -57,8 +58,12 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
        case NETDEV_CHANGEADDR:
                spin_lock_bh(&br->lock);
                br_fdb_changeaddr(p, dev->dev_addr);
-                br_stp_recalculate_bridge_id(br);
+                changed_addr = br_stp_recalculate_bridge_id(br);
                spin_unlock_bh(&br->lock);
+                if (changed_addr)
+                        call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
                break;
        case NETDEV_CHANGE:
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 2b5ca1a0054d..5864cc491369 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1198,7 +1198,8 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table)
        if (table->check && table->check(newinfo, table->valid_hooks)) {
                BUGPRINT("The table doesn't like its own initial data, lol\n");
-                return ERR_PTR(-EINVAL);
+                ret = -EINVAL;
+                goto free_chainstack;
        }
        table->private = newinfo;
diff --git a/net/core/scm.c b/net/core/scm.c
index 4c1ef026d695..811b53fb330e 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -192,7 +192,7 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                                        goto error;
                                cred->uid = cred->euid = p->creds.uid;
-                                cred->gid = cred->egid = p->creds.uid;
+                                cred->gid = cred->egid = p->creds.gid;
                                put_cred(p->cred);
                                p->cred = cred;
                        }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 77d3eded665a..8c6563361ab5 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -122,6 +122,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
        newskb->pkt_type = PACKET_LOOPBACK;
        newskb->ip_summed = CHECKSUM_UNNECESSARY;
        WARN_ON(!skb_dst(newskb));
+        skb_dst_force(newskb);
        netif_rx_ni(newskb);
        return 0;
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ab0c9efd1efa..8905e92f896a 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1067,7 +1067,7 @@ EXPORT_SYMBOL(compat_ip_setsockopt);
 */
 static int do_ip_getsockopt(struct sock *sk, int level, int optname,
-                            char __user *optval, int __user *optlen)
+                            char __user *optval, int __user *optlen, unsigned flags)
 {
        struct inet_sock *inet = inet_sk(sk);
        int val;
@@ -1240,7 +1240,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                msg.msg_control = optval;
                msg.msg_controllen = len;
-                msg.msg_flags = 0;
+                msg.msg_flags = flags;
                if (inet->cmsg_flags & IP_CMSG_PKTINFO) {
                        struct in_pktinfo info;
@@ -1294,7 +1294,7 @@ int ip_getsockopt(struct sock *sk, int level,
 {
        int err;
-        err = do_ip_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ip_getsockopt(sk, level, optname, optval, optlen, 0);
 #ifdef CONFIG_NETFILTER
        /* we need to exclude all possible ENOPROTOOPTs except default case */
        if (err == -ENOPROTOOPT && optname != IP_PKTOPTIONS &&
@@ -1327,7 +1327,8 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
                return compat_mc_getsockopt(sk, level, optname, optval, optlen,
                        ip_getsockopt);
-        err = do_ip_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ip_getsockopt(sk, level, optname, optval, optlen,
+                MSG_CMSG_COMPAT);
 #ifdef CONFIG_NETFILTER
        /* we need to exclude all possible ENOPROTOOPTs except default case */
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 2e97e3ec1eb7..929b27bdeb79 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -18,17 +18,15 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
        struct rtable *rt;
        struct flowi4 fl4 = {};
        __be32 saddr = iph->saddr;
-        __u8 flags = 0;
+        __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
        unsigned int hh_len;
-        if (!skb->sk && addr_type != RTN_LOCAL) {
+        if (addr_type == RTN_UNSPEC)
-                if (addr_type == RTN_UNSPEC)
+                addr_type = inet_addr_type(net, saddr);
-                        addr_type = inet_addr_type(net, saddr);
+        if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
-                if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
+                flags |= FLOWI_FLAG_ANYSRC;
-                        flags |= FLOWI_FLAG_ANYSRC;
+        else
-                else
+                saddr = 0;
-                        saddr = 0;
-        }
        /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
         * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
@@ -38,7 +36,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
        fl4.flowi4_tos = RT_TOS(iph->tos);
        fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
        fl4.flowi4_mark = skb->mark;
-        fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags;
+        fl4.flowi4_flags = flags;
        rt = ip_route_output_key(net, &fl4);
        if (IS_ERR(rt))
                return -1;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 1457acb39cec..61714bd52925 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -563,7 +563,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                           RT_SCOPE_UNIVERSE,
                           inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           FLOWI_FLAG_CAN_SLEEP, daddr, saddr, 0, 0);
+                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP,
+                           daddr, saddr, 0, 0);
        if (!inet->hdrincl) {
                err = raw_probe_proto_opt(&fl4, msg);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e3dec1c9f09d..075212e41b83 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -722,7 +722,7 @@ static inline bool compare_hash_inputs(const struct rtable *rt1,
 {
        return ((((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
                ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0);
+                (rt1->rt_route_iif ^ rt2->rt_route_iif)) == 0);
 }
 static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
@@ -731,8 +731,8 @@ static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
                ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
                (rt1->rt_mark ^ rt2->rt_mark) |
                (rt1->rt_key_tos ^ rt2->rt_key_tos) |
-                (rt1->rt_oif ^ rt2->rt_oif) |
+                (rt1->rt_route_iif ^ rt2->rt_route_iif) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0;
+                (rt1->rt_oif ^ rt2->rt_oif)) == 0;
 }
 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
@@ -2320,8 +2320,7 @@ int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
             rth = rcu_dereference(rth->dst.rt_next)) {
                if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
                     ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
-                     (rth->rt_iif ^ iif) |
+                     (rth->rt_route_iif ^ iif) |
-                     rth->rt_oif |
                     (rth->rt_key_tos ^ tos)) == 0 &&
                    rth->rt_mark == skb->mark &&
                    net_eq(dev_net(rth->dst.dev), net) &&
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 92bb9434b338..3bc5c8f7c71b 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -276,7 +276,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
        int mss;
        struct rtable *rt;
        __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
        if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                goto out;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 89d5bf806222..ac838965ff34 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -165,7 +165,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        int mss;
        struct dst_entry *dst;
        __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
        if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                goto out;
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 5b466cd1272f..84d0fd47636a 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -312,6 +312,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
                }
                break;
        case NF_STOLEN:
+                break;
        default:
                kfree_skb(skb);
        }
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 58107d060846..9c24de10a657 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -341,11 +341,11 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
        if (entry == NULL)
-                return -ENOMEM;
+                goto out_entry;
        if (domain != NULL) {
                entry->domain = kstrdup(domain, GFP_ATOMIC);
                if (entry->domain == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_domain;
        }
        if (addr == NULL && mask == NULL) {
@@ -354,13 +354,13 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
        } else if (addr != NULL && mask != NULL) {
                addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                if (addrmap == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_addrmap;
                INIT_LIST_HEAD(&addrmap->list4);
                INIT_LIST_HEAD(&addrmap->list6);
                addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                if (addrinfo == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_addrinfo;
                addrinfo->type_def.cipsov4 = doi_def;
                addrinfo->type = NETLBL_NLTYPE_CIPSOV4;
                addrinfo->list.addr = addr->s_addr & mask->s_addr;
@@ -374,7 +374,7 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                entry->type = NETLBL_NLTYPE_ADDRSELECT;
        } else {
                ret_val = -EINVAL;
-                goto cfg_cipsov4_map_add_failure;
+                goto out_addrmap;
        }
        ret_val = netlbl_domhsh_add(entry, audit_info);
@@ -384,11 +384,15 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
        return 0;
 cfg_cipsov4_map_add_failure:
-        cipso_v4_doi_putdef(doi_def);
+        kfree(addrinfo);
+out_addrinfo:
+        kfree(addrmap);
+out_addrmap:
        kfree(entry->domain);
+out_domain:
        kfree(entry);
-        kfree(addrmap);
+out_entry:
-        kfree(addrinfo);
+        cipso_v4_doi_putdef(doi_def);
        return ret_val;
 }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 2a318f2dc3e5..b5d56a22b1d2 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -112,7 +112,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc *sch)
        for (prio = 0; prio < q->bands; prio++) {
                struct Qdisc *qdisc = q->queues[prio];
-                struct sk_buff *skb = qdisc->dequeue(qdisc);
+                struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
                if (skb) {
                        qdisc_bstats_update(sch, skb);
                        sch->q.qlen--;
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index e4d76a270c9f..579fc0dce128 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -2625,16 +2625,19 @@ snd_azf3328_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)
        int err;
        snd_azf3328_dbgcallenter();
-        if (dev >= SNDRV_CARDS)
+        if (dev >= SNDRV_CARDS) {
-                return -ENODEV;
+                err = -ENODEV;
+                goto out;
+        }
        if (!enable[dev]) {
                dev++;
-                return -ENOENT;
+                err = -ENOENT;
+                goto out;
        }
        err = snd_card_create(index[dev], id[dev], THIS_MODULE, 0, &card);
        if (err < 0)
-                return err;
+                goto out;
        strcpy(card->driver, "AZF3328");
        strcpy(card->shortname, "Aztech AZF3328 (PCI168)");
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index aa376b59c006..5145b663ef6e 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -673,6 +673,7 @@ static int stac92xx_smux_enum_put(struct snd_kcontrol *kcontrol,
        return 0;
 }
+#ifdef CONFIG_SND_HDA_POWER_SAVE
 static int stac_vrefout_set(struct hda_codec *codec,
                                        hda_nid_t nid, unsigned int new_vref)
 {
@@ -696,6 +697,7 @@ static int stac_vrefout_set(struct hda_codec *codec,
        return 1;
 }
+#endif
 static unsigned int stac92xx_vref_set(struct hda_codec *codec,
                                        hda_nid_t nid, unsigned int new_vref)
diff --git a/sound/soc/codecs/wm8750.c b/sound/soc/codecs/wm8750.c
index 38f38fddd190..d0003cc3bcd6 100644
--- a/sound/soc/codecs/wm8750.c
+++ b/sound/soc/codecs/wm8750.c
@@ -778,11 +778,19 @@ static int __devexit wm8750_spi_remove(struct spi_device *spi)
        return 0;
 }
+static const struct spi_device_id wm8750_spi_ids[] = {
+        { "wm8750", 0 },
+        { "wm8987", 0 },
+        { },
+};
+MODULE_DEVICE_TABLE(spi, wm8750_spi_ids);
 static struct spi_driver wm8750_spi_driver = {
        .driver = {
                .name   = "wm8750-codec",
                .owner  = THIS_MODULE,
        },
+        .id_table       = wm8750_spi_ids,
        .probe          = wm8750_spi_probe,
        .remove         = __devexit_p(wm8750_spi_remove),
 };
diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
index 43e3d760766f..4ad8ebd290e3 100644
--- a/sound/soc/codecs/wm8903.c
+++ b/sound/soc/codecs/wm8903.c
@@ -2046,8 +2046,13 @@ static int wm8903_probe(struct snd_soc_codec *codec)
 /* power down chip */
 static int wm8903_remove(struct snd_soc_codec *codec)
 {
+        struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
        wm8903_free_gpio(codec);
        wm8903_set_bias_level(codec, SND_SOC_BIAS_OFF);
+        if (wm8903->irq)
+                free_irq(wm8903->irq, codec);
        return 0;
 }
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 09e680ae88b2..b393f9fac97a 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -2981,6 +2981,7 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
                        wm8994->hubs.dcs_readback_mode = 1;
                        break;
                }
+                break;
        case WM8958:
                wm8994->hubs.dcs_readback_mode = 1;
diff --git a/sound/soc/omap/n810.c b/sound/soc/omap/n810.c
index 83d213bfd3d1..62e292f49313 100644
--- a/sound/soc/omap/n810.c
+++ b/sound/soc/omap/n810.c
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2008 Nokia Corporation
 *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
@@ -402,6 +402,6 @@ static void __exit n810_soc_exit(void)
 module_init(n810_soc_init);
 module_exit(n810_soc_exit);
-MODULE_AUTHOR("Jarkko Nikula <jhnikula@gmail.com>");
+MODULE_AUTHOR("Jarkko Nikula <jarkko.nikula@bitmer.com>");
 MODULE_DESCRIPTION("ALSA SoC Nokia N810");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index 07b772357244..ebcc2d4d2b18 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2008 Nokia Corporation
 *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
 *          Peter Ujfalusi <peter.ujfalusi@ti.com>
 *
 * This program is free software; you can redistribute it and/or
@@ -780,6 +780,6 @@ static void __exit snd_omap_mcbsp_exit(void)
 }
 module_exit(snd_omap_mcbsp_exit);
-MODULE_AUTHOR("Jarkko Nikula <jhnikula@gmail.com>");
+MODULE_AUTHOR("Jarkko Nikula <jarkko.nikula@bitmer.com>");
 MODULE_DESCRIPTION("OMAP I2S SoC Interface");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/omap/omap-mcbsp.h b/sound/soc/omap/omap-mcbsp.h
index 9a7dedd6f5a9..65cde9d3807b 100644
--- a/sound/soc/omap/omap-mcbsp.h
+++ b/sound/soc/omap/omap-mcbsp.h
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2008 Nokia Corporation
 *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
 *          Peter Ujfalusi <peter.ujfalusi@ti.com>
 *
 * This program is free software; you can redistribute it and/or
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index b2f5751edae3..9b5c88ac35b9 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2008 Nokia Corporation
 *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
 *          Peter Ujfalusi <peter.ujfalusi@ti.com>
 *
 * This program is free software; you can redistribute it and/or
@@ -436,6 +436,6 @@ static void __exit snd_omap_pcm_exit(void)
 }
 module_exit(snd_omap_pcm_exit);
-MODULE_AUTHOR("Jarkko Nikula <jhnikula@gmail.com>");
+MODULE_AUTHOR("Jarkko Nikula <jarkko.nikula@bitmer.com>");
 MODULE_DESCRIPTION("OMAP PCM DMA module");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/omap/omap-pcm.h b/sound/soc/omap/omap-pcm.h
index a0ed1dbb52d6..f95fe3064172 100644
--- a/sound/soc/omap/omap-pcm.h
+++ b/sound/soc/omap/omap-pcm.h
@@ -3,7 +3,7 @@
 *
 * Copyright (C) 2008 Nokia Corporation
 *
- * Contact: Jarkko Nikula <jhnikula@gmail.com>
+ * Contact: Jarkko Nikula <jarkko.nikula@bitmer.com>
 *          Peter Ujfalusi <peter.ujfalusi@ti.com>
 *
 * This program is free software; you can redistribute it and/or
diff --git a/sound/soc/omap/rx51.c b/sound/soc/omap/rx51.c
index 0aae998b6540..893300a53bab 100644
--- a/sound/soc/omap/rx51.c
+++ b/sound/soc/omap/rx51.c
@@ -5,7 +5,7 @@
 *
 * Contact: Peter Ujfalusi <peter.ujfalusi@ti.com>
 *          Eduardo Valentin <eduardo.valentin@nokia.com>
- *          Jarkko Nikula <jhnikula@gmail.com>
+ *          Jarkko Nikula <jarkko.nikula@bitmer.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/sound/soc/samsung/Makefile b/sound/soc/samsung/Makefile
index 9eb3b12eb72f..8509d3c4366e 100644
--- a/sound/soc/samsung/Makefile
+++ b/sound/soc/samsung/Makefile
@@ -1,5 +1,6 @@
 # S3c24XX Platform Support
 snd-soc-s3c24xx-objs := dma.o
+snd-soc-idma-objs := idma.o
 snd-soc-s3c24xx-i2s-objs := s3c24xx-i2s.o
 snd-soc-s3c2412-i2s-objs := s3c2412-i2s.o
 snd-soc-ac97-objs := ac97.o
@@ -16,6 +17,7 @@ obj-$(CONFIG_SND_S3C_I2SV2_SOC) += snd-soc-s3c-i2s-v2.o
 obj-$(CONFIG_SND_SAMSUNG_SPDIF) += snd-soc-samsung-spdif.o
 obj-$(CONFIG_SND_SAMSUNG_PCM) += snd-soc-pcm.o
 obj-$(CONFIG_SND_SAMSUNG_I2S) += snd-soc-i2s.o
+obj-$(CONFIG_SND_SAMSUNG_I2S) += snd-soc-idma.o
 # S3C24XX Machine Support
 snd-soc-jive-wm8750-objs := jive_wm8750.o
diff --git a/sound/soc/samsung/idma.c b/sound/soc/samsung/idma.c
new file mode 100644
index 000000000000..ebde0740ab19
--- /dev/null
+++ b/sound/soc/samsung/idma.c
@@ -0,0 +1,453 @@
+/*
+ * sound/soc/samsung/idma.c
+ *
+ * Copyright (c) 2011 Samsung Electronics Co., Ltd.
+ *              http://www.samsung.com
+ *
+ * I2S0's Internal DMA driver
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "i2s.h"
+#include "idma.h"
+#include "dma.h"
+#include "i2s-regs.h"
+#define ST_RUNNING              (1<<0)
+#define ST_OPENED               (1<<1)
+static const struct snd_pcm_hardware idma_hardware = {
+        .info = SNDRV_PCM_INFO_INTERLEAVED |
+                    SNDRV_PCM_INFO_BLOCK_TRANSFER |
+                    SNDRV_PCM_INFO_MMAP |
+                    SNDRV_PCM_INFO_MMAP_VALID |
+                    SNDRV_PCM_INFO_PAUSE |
+                    SNDRV_PCM_INFO_RESUME,
+        .formats = SNDRV_PCM_FMTBIT_S16_LE |
+                    SNDRV_PCM_FMTBIT_U16_LE |
+                    SNDRV_PCM_FMTBIT_S24_LE |
+                    SNDRV_PCM_FMTBIT_U24_LE |
+                    SNDRV_PCM_FMTBIT_U8 |
+                    SNDRV_PCM_FMTBIT_S8,
+        .channels_min = 2,
+        .channels_max = 2,
+        .buffer_bytes_max = MAX_IDMA_BUFFER,
+        .period_bytes_min = 128,
+        .period_bytes_max = MAX_IDMA_PERIOD,
+        .periods_min = 1,
+        .periods_max = 2,
+};
+struct idma_ctrl {
+        spinlock_t      lock;
+        int             state;
+        dma_addr_t      start;
+        dma_addr_t      pos;
+        dma_addr_t      end;
+        dma_addr_t      period;
+        dma_addr_t      periodsz;
+        void            *token;
+        void            (*cb)(void *dt, int bytes_xfer);
+};
+static struct idma_info {
+        spinlock_t      lock;
+        void             __iomem  *regs;
+        dma_addr_t      lp_tx_addr;
+} idma;
+static void idma_getpos(dma_addr_t *src)
+{
+        *src = idma.lp_tx_addr +
+                (readl(idma.regs + I2STRNCNT) & 0xffffff) * 4;
+}
+static int idma_enqueue(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+        u32 val;
+        spin_lock(&prtd->lock);
+        prtd->token = (void *) substream;
+        spin_unlock(&prtd->lock);
+        /* Internal DMA Level0 Interrupt Address */
+        val = idma.lp_tx_addr + prtd->periodsz;
+        writel(val, idma.regs + I2SLVL0ADDR);
+        /* Start address0 of I2S internal DMA operation. */
+        val = idma.lp_tx_addr;
+        writel(val, idma.regs + I2SSTR0);
+        /*
+         * Transfer block size for I2S internal DMA.
+         * Should decide transfer size before start dma operation
+         */
+        val = readl(idma.regs + I2SSIZE);
+        val &= ~(I2SSIZE_TRNMSK << I2SSIZE_SHIFT);
+        val |= (((runtime->dma_bytes >> 2) &
+                        I2SSIZE_TRNMSK) << I2SSIZE_SHIFT);
+        writel(val, idma.regs + I2SSIZE);
+        val = readl(idma.regs + I2SAHB);
+        val |= AHB_INTENLVL0;
+        writel(val, idma.regs + I2SAHB);
+        return 0;
+}
+static void idma_setcallbk(struct snd_pcm_substream *substream,
+                                void (*cb)(void *, int))
+{
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+        spin_lock(&prtd->lock);
+        prtd->cb = cb;
+        spin_unlock(&prtd->lock);
+}
+static void idma_control(int op)
+{
+        u32 val = readl(idma.regs + I2SAHB);
+        spin_lock(&idma.lock);
+        switch (op) {
+        case LPAM_DMA_START:
+                val |= (AHB_INTENLVL0 | AHB_DMAEN);
+                break;
+        case LPAM_DMA_STOP:
+                val &= ~(AHB_INTENLVL0 | AHB_DMAEN);
+                break;
+        default:
+                spin_unlock(&idma.lock);
+                return;
+        }
+        writel(val, idma.regs + I2SAHB);
+        spin_unlock(&idma.lock);
+}
+static void idma_done(void *id, int bytes_xfer)
+{
+        struct snd_pcm_substream *substream = id;
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+        if (prtd && (prtd->state & ST_RUNNING))
+                snd_pcm_period_elapsed(substream);
+}
+static int idma_hw_params(struct snd_pcm_substream *substream,
+                                struct snd_pcm_hw_params *params)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+        u32 mod = readl(idma.regs + I2SMOD);
+        u32 ahb = readl(idma.regs + I2SAHB);
+        ahb |= (AHB_DMARLD | AHB_INTMASK);
+        mod |= MOD_TXS_IDMA;
+        writel(ahb, idma.regs + I2SAHB);
+        writel(mod, idma.regs + I2SMOD);
+        snd_pcm_set_runtime_buffer(substream, &substream->dma_buffer);
+        runtime->dma_bytes = params_buffer_bytes(params);
+        prtd->start = prtd->pos = runtime->dma_addr;
+        prtd->period = params_periods(params);
+        prtd->periodsz = params_period_bytes(params);
+        prtd->end = runtime->dma_addr + runtime->dma_bytes;
+        idma_setcallbk(substream, idma_done);
+        return 0;
+}
+static int idma_hw_free(struct snd_pcm_substream *substream)
+{
+        snd_pcm_set_runtime_buffer(substream, NULL);
+        return 0;
+}
+static int idma_prepare(struct snd_pcm_substream *substream)
+{
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+        prtd->pos = prtd->start;
+        /* flush the DMA channel */
+        idma_control(LPAM_DMA_STOP);
+        idma_enqueue(substream);
+        return 0;
+}
+static int idma_trigger(struct snd_pcm_substream *substream, int cmd)
+{
+        struct idma_ctrl *prtd = substream->runtime->private_data;
+        int ret = 0;
+        spin_lock(&prtd->lock);
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_RESUME:
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                prtd->state |= ST_RUNNING;
+                idma_control(LPAM_DMA_START);
+                break;
+        case SNDRV_PCM_TRIGGER_SUSPEND:
+        case SNDRV_PCM_TRIGGER_STOP:
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+                prtd->state &= ~ST_RUNNING;
+                idma_control(LPAM_DMA_STOP);
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+        spin_unlock(&prtd->lock);
+        return ret;
+}
+static snd_pcm_uframes_t
+        idma_pointer(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd = runtime->private_data;
+        dma_addr_t src;
+        unsigned long res;
+        spin_lock(&prtd->lock);
+        idma_getpos(&src);
+        res = src - prtd->start;
+        spin_unlock(&prtd->lock);
+        return bytes_to_frames(substream->runtime, res);
+}
+static int idma_mmap(struct snd_pcm_substream *substream,
+        struct vm_area_struct *vma)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        unsigned long size, offset;
+        int ret;
+        /* From snd_pcm_lib_mmap_iomem */
+        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+        vma->vm_flags |= VM_IO;
+        size = vma->vm_end - vma->vm_start;
+        offset = vma->vm_pgoff << PAGE_SHIFT;
+        ret = io_remap_pfn_range(vma, vma->vm_start,
+                        (runtime->dma_addr + offset) >> PAGE_SHIFT,
+                        size, vma->vm_page_prot);
+        return ret;
+}
+static irqreturn_t iis_irq(int irqno, void *dev_id)
+{
+        struct idma_ctrl *prtd = (struct idma_ctrl *)dev_id;
+        u32 iiscon, iisahb, val, addr;
+        iisahb  = readl(idma.regs + I2SAHB);
+        iiscon  = readl(idma.regs + I2SCON);
+        val = (iisahb & AHB_LVL0INT) ? AHB_CLRLVL0INT : 0;
+        if (val) {
+                iisahb |= val;
+                writel(iisahb, idma.regs + I2SAHB);
+                addr = readl(idma.regs + I2SLVL0ADDR) - idma.lp_tx_addr;
+                addr += prtd->periodsz;
+                addr %= (prtd->end - prtd->start);
+                addr += idma.lp_tx_addr;
+                writel(addr, idma.regs + I2SLVL0ADDR);
+                if (prtd->cb)
+                        prtd->cb(prtd->token, prtd->period);
+        }
+        return IRQ_HANDLED;
+}
+static int idma_open(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd;
+        int ret;
+        snd_soc_set_runtime_hwparams(substream, &idma_hardware);
+        prtd = kzalloc(sizeof(struct idma_ctrl), GFP_KERNEL);
+        if (prtd == NULL)
+                return -ENOMEM;
+        ret = request_irq(IRQ_I2S0, iis_irq, 0, "i2s", prtd);
+        if (ret < 0) {
+                pr_err("fail to claim i2s irq , ret = %d\n", ret);
+                kfree(prtd);
+                return ret;
+        }
+        spin_lock_init(&prtd->lock);
+        runtime->private_data = prtd;
+        return 0;
+}
+static int idma_close(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct idma_ctrl *prtd = runtime->private_data;
+        free_irq(IRQ_I2S0, prtd);
+        if (!prtd)
+                pr_err("idma_close called with prtd == NULL\n");
+        kfree(prtd);
+        return 0;
+}
+static struct snd_pcm_ops idma_ops = {
+        .open           = idma_open,
+        .close          = idma_close,
+        .ioctl          = snd_pcm_lib_ioctl,
+        .trigger        = idma_trigger,
+        .pointer        = idma_pointer,
+        .mmap           = idma_mmap,
+        .hw_params      = idma_hw_params,
+        .hw_free        = idma_hw_free,
+        .prepare        = idma_prepare,
+};
+static void idma_free(struct snd_pcm *pcm)
+{
+        struct snd_pcm_substream *substream;
+        struct snd_dma_buffer *buf;
+        substream = pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream;
+        if (!substream)
+                return;
+        buf = &substream->dma_buffer;
+        if (!buf->area)
+                return;
+        iounmap(buf->area);
+        buf->area = NULL;
+        buf->addr = 0;
+}
+static int preallocate_idma_buffer(struct snd_pcm *pcm, int stream)
+{
+        struct snd_pcm_substream *substream = pcm->streams[stream].substream;
+        struct snd_dma_buffer *buf = &substream->dma_buffer;
+        buf->dev.dev = pcm->card->dev;
+        buf->private_data = NULL;
+        /* Assign PCM buffer pointers */
+        buf->dev.type = SNDRV_DMA_TYPE_CONTINUOUS;
+        buf->addr = idma.lp_tx_addr;
+        buf->bytes = idma_hardware.buffer_bytes_max;
+        buf->area = (unsigned char *)ioremap(buf->addr, buf->bytes);
+        return 0;
+}
+static u64 idma_mask = DMA_BIT_MASK(32);
+static int idma_new(struct snd_soc_pcm_runtime *rtd)
+{
+        struct snd_card *card = rtd->card->snd_card;
+        struct snd_soc_dai *dai = rtd->cpu_dai;
+        struct snd_pcm *pcm = rtd->pcm;
+        int ret = 0;
+        if (!card->dev->dma_mask)
+                card->dev->dma_mask = &idma_mask;
+        if (!card->dev->coherent_dma_mask)
+                card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
+        if (dai->driver->playback.channels_min)
+                ret = preallocate_idma_buffer(pcm,
+                                SNDRV_PCM_STREAM_PLAYBACK);
+        return ret;
+}
+void idma_reg_addr_init(void *regs, dma_addr_t addr)
+{
+        spin_lock_init(&idma.lock);
+        idma.regs = regs;
+        idma.lp_tx_addr = addr;
+}
+struct snd_soc_platform_driver asoc_idma_platform = {
+        .ops = &idma_ops,
+        .pcm_new = idma_new,
+        .pcm_free = idma_free,
+};
+static int __devinit asoc_idma_platform_probe(struct platform_device *pdev)
+{
+        return snd_soc_register_platform(&pdev->dev, &asoc_idma_platform);
+}
+static int __devexit asoc_idma_platform_remove(struct platform_device *pdev)
+{
+        snd_soc_unregister_platform(&pdev->dev);
+        return 0;
+}
+static struct platform_driver asoc_idma_driver = {
+        .driver = {
+                .name = "samsung-idma",
+                .owner = THIS_MODULE,
+        },
+        .probe = asoc_idma_platform_probe,
+        .remove = __devexit_p(asoc_idma_platform_remove),
+};
+static int __init asoc_idma_init(void)
+{
+        return platform_driver_register(&asoc_idma_driver);
+}
+module_init(asoc_idma_init);
+static void __exit asoc_idma_exit(void)
+{
+        platform_driver_unregister(&asoc_idma_driver);
+}
+module_exit(asoc_idma_exit);
+MODULE_AUTHOR("Jaswinder Singh, <jassisinghbrar@gmail.com>");
+MODULE_DESCRIPTION("Samsung ASoC IDMA Driver");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/samsung/idma.h b/sound/soc/samsung/idma.h
new file mode 100644
index 000000000000..48273216166e
--- /dev/null
+++ b/sound/soc/samsung/idma.h
@@ -0,0 +1,26 @@
+/*
+ * sound/soc/samsung/idma.h
+ *
+ * Copyright (c) 2011 Samsung Electronics Co., Ltd
+ *              http://www.samsung.com
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+#ifndef __SND_SOC_SAMSUNG_IDMA_H_
+#define __SND_SOC_SAMSUNG_IDMA_H_
+extern void idma_reg_addr_init(void *regs, dma_addr_t addr);
+/* dma_state */
+#define LPAM_DMA_STOP   0
+#define LPAM_DMA_START  1
+#define MAX_IDMA_PERIOD (128 * 1024)
+#define MAX_IDMA_BUFFER (160 * 1024)
+#endif /* __SND_SOC_SAMSUNG_IDMA_H_ */
diff --git a/sound/soc/samsung/jive_wm8750.c b/sound/soc/samsung/jive_wm8750.c
index 3b53ad54bc33..14eb6ea69e7c 100644
--- a/sound/soc/samsung/jive_wm8750.c
+++ b/sound/soc/samsung/jive_wm8750.c
@@ -131,7 +131,7 @@ static struct snd_soc_dai_link jive_dai = {
        .cpu_dai_name   = "s3c2412-i2s",
        .codec_dai_name = "wm8750-hifi",
        .platform_name  = "samsung-audio",
-        .codec_name     = "wm8750-codec.0-0x1a",
+        .codec_name     = "wm8750-codec.0-001a",
        .init           = jive_wm8750_init,
        .ops            = &jive_ops,
 };
diff --git a/sound/soc/samsung/speyside_wm8962.c b/sound/soc/samsung/speyside_wm8962.c
index 8ac42bf82090..0b9eb5f7ec4c 100644
--- a/sound/soc/samsung/speyside_wm8962.c
+++ b/sound/soc/samsung/speyside_wm8962.c
@@ -37,7 +37,7 @@ static int speyside_wm8962_set_bias_level(struct snd_soc_card *card,
                                                     44100 * 256,
                                                     SND_SOC_CLOCK_IN);
                        if (ret < 0) {
-                                pr_err("Failed to set SYSCLK: %d\n");
+                                pr_err("Failed to set SYSCLK: %d\n", ret);
                                return ret;
                        }
                }
diff --git a/sound/soc/tegra/tegra_pcm.c b/sound/soc/tegra/tegra_pcm.c
index ff86e5e3db68..c7cfd96e991e 100644
--- a/sound/soc/tegra/tegra_pcm.c
+++ b/sound/soc/tegra/tegra_pcm.c
@@ -309,9 +309,14 @@ static int tegra_pcm_preallocate_dma_buffer(struct snd_pcm *pcm, int stream)
 static void tegra_pcm_deallocate_dma_buffer(struct snd_pcm *pcm, int stream)
 {
-        struct snd_pcm_substream *substream = pcm->streams[stream].substream;
+        struct snd_pcm_substream *substream;
-        struct snd_dma_buffer *buf = &substream->dma_buffer;
+        struct snd_dma_buffer *buf;
+        substream = pcm->streams[stream].substream;
+        if (!substream)
+                return;
+        buf = &substream->dma_buffer;
        if (!buf->area)
                return;
diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c
index a42e9ac30f28..661373c2352a 100644
--- a/sound/soc/tegra/tegra_wm8903.c
+++ b/sound/soc/tegra/tegra_wm8903.c
@@ -56,6 +56,7 @@
 #define GPIO_HP_MUTE    BIT(1)
 #define GPIO_INT_MIC_EN BIT(2)
 #define GPIO_EXT_MIC_EN BIT(3)
+#define GPIO_HP_DET     BIT(4)
 struct tegra_wm8903 {
        struct tegra_asoc_utils_data util_data;
@@ -304,6 +305,7 @@ static int tegra_wm8903_init(struct snd_soc_pcm_runtime *rtd)
                snd_soc_jack_add_gpios(&tegra_wm8903_hp_jack,
                                        1,
                                        &tegra_wm8903_hp_jack_gpio);
+                machine->gpio_requested |= GPIO_HP_DET;
        }
        snd_soc_jack_new(codec, "Mic Jack", SND_JACK_MICROPHONE,
@@ -429,10 +431,10 @@ static int __devexit tegra_wm8903_driver_remove(struct platform_device *pdev)
        struct tegra_wm8903 *machine = snd_soc_card_get_drvdata(card);
        struct tegra_wm8903_platform_data *pdata = machine->pdata;
-        snd_soc_unregister_card(card);
+        if (machine->gpio_requested & GPIO_HP_DET)
+                snd_soc_jack_free_gpios(&tegra_wm8903_hp_jack,
-        tegra_asoc_utils_fini(&machine->util_data);
+                                        1,
+                                        &tegra_wm8903_hp_jack_gpio);
        if (machine->gpio_requested & GPIO_EXT_MIC_EN)
                gpio_free(pdata->gpio_ext_mic_en);
        if (machine->gpio_requested & GPIO_INT_MIC_EN)
@@ -441,6 +443,11 @@ static int __devexit tegra_wm8903_driver_remove(struct platform_device *pdev)
                gpio_free(pdata->gpio_hp_mute);
        if (machine->gpio_requested & GPIO_SPKR_EN)
                gpio_free(pdata->gpio_spkr_en);
+        machine->gpio_requested = 0;
+        snd_soc_unregister_card(card);
+        tegra_asoc_utils_fini(&machine->util_data);
        kfree(machine);
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index d0d493ca28ae..aa52b3e13bb5 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -614,6 +614,7 @@ static void read_completed(struct urb *urb)
        struct snd_usb_caiaqdev *dev;
        struct urb *out;
        int frame, len, send_it = 0, outframe = 0;
+        size_t offset = 0;
        if (urb->status || !info)
                return;
@@ -634,7 +635,8 @@ static void read_completed(struct urb *urb)
                len = urb->iso_frame_desc[outframe].actual_length;
                out->iso_frame_desc[outframe].length = len;
                out->iso_frame_desc[outframe].actual_length = 0;
-                out->iso_frame_desc[outframe].offset = BYTES_PER_FRAME * frame;
+                out->iso_frame_desc[outframe].offset = offset;
+                offset += len;
                if (len > 0) {
                        spin_lock(&dev->spinlock);
@@ -650,7 +652,7 @@ static void read_completed(struct urb *urb)
        }
        if (send_it) {
-                out->number_of_packets = FRAMES_PER_URB;
+                out->number_of_packets = outframe;
                out->transfer_flags = URB_ISO_ASAP;
                usb_submit_urb(out, GFP_ATOMIC);
        }
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 4d4f86552a23..a42e3ef3832d 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -1707,6 +1707,40 @@ YAMAHA_DEVICE(0x7010, "UB99"),
                }
        }
 },
+{
+        USB_DEVICE(0x0582, 0x0130),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                /* .vendor_name = "BOSS", */
+                /* .product_name = "MICRO BR-80", */
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_IGNORE_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 3,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = & (const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables  = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
 /* Guillemot devices */
 {
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index f6426b496f4a..6b0519f885e4 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -45,7 +45,7 @@ static int			freq				=   1000;
 static int                      output;
 static int                      pipe_output                     =      0;
 static const char               *output_name                    = NULL;
-static int                      group                           =      0;
+static bool                     group                           =  false;
 static int                      realtime_prio                   =      0;
 static bool                     nodelay                         =  false;
 static bool                     raw_samples                     =  false;
@@ -753,6 +753,8 @@ const struct option record_options[] = {
                    "child tasks do not inherit counters"),
        OPT_UINTEGER('F', "freq", &user_freq, "profile at this frequency"),
        OPT_UINTEGER('m', "mmap-pages", &mmap_pages, "number of mmap data pages"),
+        OPT_BOOLEAN(0, "group", &group,
+                    "put the counters into a counter group"),
        OPT_BOOLEAN('g', "call-graph", &call_graph,
                    "do call-graph (stack chain/backtrace) recording"),
        OPT_INCR('v', "verbose", &verbose,
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 1ad04ce29c34..5deb17d9e795 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -193,6 +193,7 @@ static int			big_num_opt			=  -1;
 static const char               *cpu_list;
 static const char               *csv_sep                        = NULL;
 static bool                     csv_output                      = false;
+static bool                     group                           = false;
 static volatile int done = 0;
@@ -280,14 +281,14 @@ static int create_perf_stat_counter(struct perf_evsel *evsel)
        attr->inherit = !no_inherit;
        if (system_wide)
-                return perf_evsel__open_per_cpu(evsel, evsel_list->cpus, false);
+                return perf_evsel__open_per_cpu(evsel, evsel_list->cpus, group);
        if (target_pid == -1 && target_tid == -1) {
                attr->disabled = 1;
                attr->enable_on_exec = 1;
        }
-        return perf_evsel__open_per_thread(evsel, evsel_list->threads, false);
+        return perf_evsel__open_per_thread(evsel, evsel_list->threads, group);
 }
 /*
@@ -1043,6 +1044,8 @@ static const struct option options[] = {
                    "stat events on existing thread id"),
        OPT_BOOLEAN('a', "all-cpus", &system_wide,
                    "system-wide collection from all CPUs"),
+        OPT_BOOLEAN('g', "group", &group,
+                    "put the counters into a counter group"),
        OPT_BOOLEAN('c', "scale", &scale,
                    "scale/normalize counters"),
        OPT_INCR('v', "verbose", &verbose,
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index e03e7bc8205e..c12bd476c6f7 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -85,10 +85,19 @@ int perf_evlist__add_default(struct perf_evlist *evlist)
        struct perf_evsel *evsel = perf_evsel__new(&attr, 0);
        if (evsel == NULL)
-                return -ENOMEM;
+                goto error;
+        /* use strdup() because free(evsel) assumes name is allocated */
+        evsel->name = strdup("cycles");
+        if (!evsel->name)
+                goto error_free;
        perf_evlist__add(evlist, evsel);
        return 0;
+error_free:
+        perf_evsel__delete(evsel);
+error:
+        return -ENOMEM;
 }
 void perf_evlist__disable(struct perf_evlist *evlist)
diff --git a/tools/perf/util/include/linux/compiler.h b/tools/perf/util/include/linux/compiler.h
index 791f9dd27ebf..547628e97f3d 100644
--- a/tools/perf/util/include/linux/compiler.h
+++ b/tools/perf/util/include/linux/compiler.h
@@ -5,7 +5,9 @@
 #define __always_inline inline
 #endif
 #define __user
+#ifndef __attribute_const__
 #define __attribute_const__
+#endif
 #define __used          __attribute__((__unused__))
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 4ea7e19f5251..928918b796b2 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -697,7 +697,11 @@ parse_raw_event(const char **strp, struct perf_event_attr *attr)
                return EVT_FAILED;
        n = hex2u64(str + 1, &config);
        if (n > 0) {
-                *strp = str + n + 1;
+                const char *end = str + n + 1;
+                if (*end != '\0' && *end != ',' && *end != ':')
+                        return EVT_FAILED;
+                *strp = end;
                attr->type = PERF_TYPE_RAW;
                attr->config = config;
                return EVT_HANDLED;
@@ -1097,6 +1101,4 @@ void print_events(const char *event_glob)
        printf("\n");
        print_tracepoint_events(NULL, NULL);
-        exit(129);
 }