320 files changed, 10067 insertions, 1944 deletions

diff --git a/CREDITS b/CREDITS
index 2b88fb37ad50..e76d300e9fe4 100644
--- a/CREDITS
+++ b/CREDITS
@@ -1856,7 +1856,7 @@ E: rfkoenig@immd4.informatik.uni-erlangen.de
 D: The Linux Support Team Erlangen
 
 N: Andreas Koensgen
-E: ajk@iehk.rwth-aachen.de
+E: ajk@comnets.uni-bremen.de
 D: 6pack driver for AX.25
 
 N: Harald Koerfgen
diff --git a/Documentation/RCU/rculist_nulls.txt b/Documentation/RCU/rculist_nulls.txt
index 93cb28d05dcd..18f9651ff23d 100644
--- a/Documentation/RCU/rculist_nulls.txt
+++ b/Documentation/RCU/rculist_nulls.txt
@@ -83,11 +83,12 @@ not detect it missed following items in original chain.
 obj = kmem_cache_alloc(...);
 lock_chain(); // typically a spin_lock()
 obj->key = key;
-atomic_inc(&obj->refcnt);
 /*
  * we need to make sure obj->key is updated before obj->next
+ * or obj->refcnt
  */
 smp_wmb();
+atomic_set(&obj->refcnt, 1);
 hlist_add_head_rcu(&obj->obj_node, list);
 unlock_chain(); // typically a spin_unlock()
 
@@ -159,6 +160,10 @@ out:
 obj = kmem_cache_alloc(cachep);
 lock_chain(); // typically a spin_lock()
 obj->key = key;
+/*
+ * changes to obj->key must be visible before refcnt one
+ */
+smp_wmb();
 atomic_set(&obj->refcnt, 1);
 /*
  * insert obj in RCU way (readers might be traversing chain)
diff --git a/Documentation/connector/cn_test.c b/Documentation/connector/cn_test.c
index f688eba87704..6a5be5d5c8e4 100644
--- a/Documentation/connector/cn_test.c
+++ b/Documentation/connector/cn_test.c
@@ -1,7 +1,7 @@
 /*
  *      cn_test.c
  * 
- * 2004-2005 Copyright (c) Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * 2004+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
  * All rights reserved.
  * 
  * This program is free software; you can redistribute it and/or modify
@@ -194,5 +194,5 @@ module_init(cn_test_init);
 module_exit(cn_test_fini);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Connector's test module");
diff --git a/Documentation/connector/ucon.c b/Documentation/connector/ucon.c
index d738cde2a8d5..c5092ad0ce4b 100644
--- a/Documentation/connector/ucon.c
+++ b/Documentation/connector/ucon.c
@@ -1,7 +1,7 @@
 /*
  *      ucon.c
  *
- * Copyright (c) 2004+ Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004+ Evgeniy Polyakov <zbr@ioremap.net>
  *
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/Documentation/networking/6pack.txt b/Documentation/networking/6pack.txt
index d0777a1200e1..8f339428fdf4 100644
--- a/Documentation/networking/6pack.txt
+++ b/Documentation/networking/6pack.txt
@@ -1,7 +1,7 @@
 This is the 6pack-mini-HOWTO, written by
 
 Andreas Könsgen DG3KQ
-Internet: ajk@iehk.rwth-aachen.de
+Internet: ajk@comnets.uni-bremen.de
 AMPR-net: dg3kq@db0pra.ampr.org
 AX.25:    dg3kq@db0ach.#nrw.deu.eu
 
diff --git a/Documentation/sound/alsa/Procfile.txt b/Documentation/sound/alsa/Procfile.txt
index 381908d8ca42..719a819f8cc2 100644
--- a/Documentation/sound/alsa/Procfile.txt
+++ b/Documentation/sound/alsa/Procfile.txt
@@ -101,6 +101,8 @@ card*/pcm*/xrun_debug
           bit 0 = Enable XRUN/jiffies debug messages
           bit 1 = Show stack trace at XRUN / jiffies check
           bit 2 = Enable additional jiffies check
+          bit 3 = Log hwptr update at each period interrupt
+          bit 4 = Log hwptr update at each snd_pcm_update_hw_ptr()
 
         When the bit 0 is set, the driver will show the messages to
         kernel log when an xrun is detected.  The debug message is
@@ -117,6 +119,9 @@ card*/pcm*/xrun_debug
         buggy) hardware that doesn't give smooth pointer updates.
         This feature is enabled via the bit 2.
 
+        Bits 3 and 4 are for logging the hwptr records.  Note that
+        these will give flood of kernel messages.
+
 card*/pcm*/sub*/info
         The general information of this PCM sub-stream.
 
diff --git a/Documentation/video4linux/CARDLIST.em28xx b/Documentation/video4linux/CARDLIST.em28xx
index 014d255231fc..68c236c01846 100644
--- a/Documentation/video4linux/CARDLIST.em28xx
+++ b/Documentation/video4linux/CARDLIST.em28xx
@@ -20,7 +20,7 @@
  19 -> EM2860/SAA711X Reference Design          (em2860)
  20 -> AMD ATI TV Wonder HD 600                 (em2880)        [0438:b002]
  21 -> eMPIA Technology, Inc. GrabBeeX+ Video Encoder (em2800)        [eb1a:2801]
- 22 -> Unknown EM2750/EM2751 webcam grabber     (em2750)        [eb1a:2750,eb1a:2751]
+ 22 -> EM2710/EM2750/EM2751 webcam grabber      (em2750)        [eb1a:2750,eb1a:2751]
  23 -> Huaqi DLCW-130                           (em2750)
  24 -> D-Link DUB-T210 TV Tuner                 (em2820/em2840) [2001:f112]
  25 -> Gadmei UTV310                            (em2820/em2840)
diff --git a/Documentation/video4linux/gspca.txt b/Documentation/video4linux/gspca.txt
index 2bcf78896e22..573f95b58807 100644
--- a/Documentation/video4linux/gspca.txt
+++ b/Documentation/video4linux/gspca.txt
@@ -44,7 +44,9 @@ zc3xx		0458:7007	Genius VideoCam V2
 zc3xx           0458:700c       Genius VideoCam V3
 zc3xx           0458:700f       Genius VideoCam Web V2
 sonixj          0458:7025       Genius Eye 311Q
+sn9c20x         0458:7029       Genius Look 320s
 sonixj          0458:702e       Genius Slim 310 NB
+sn9c20x         045e:00f4       LifeCam VX-6000 (SN9C20x + OV9650)
 sonixj          045e:00f5       MicroSoft VX3000
 sonixj          045e:00f7       MicroSoft VX1000
 ov519           045e:028c       Micro$oft xbox cam
@@ -282,6 +284,28 @@ sonixj		0c45:613a	Microdia Sonix PC Camera
 sonixj          0c45:613b       Surfer SN-206
 sonixj          0c45:613c       Sonix Pccam168
 sonixj          0c45:6143       Sonix Pccam168
+sn9c20x         0c45:6240       PC Camera (SN9C201 + MT9M001)
+sn9c20x         0c45:6242       PC Camera (SN9C201 + MT9M111)
+sn9c20x         0c45:6248       PC Camera (SN9C201 + OV9655)
+sn9c20x         0c45:624e       PC Camera (SN9C201 + SOI968)
+sn9c20x         0c45:624f       PC Camera (SN9C201 + OV9650)
+sn9c20x         0c45:6251       PC Camera (SN9C201 + OV9650)
+sn9c20x         0c45:6253       PC Camera (SN9C201 + OV9650)
+sn9c20x         0c45:6260       PC Camera (SN9C201 + OV7670)
+sn9c20x         0c45:6270       PC Camera (SN9C201 + MT9V011/MT9V111/MT9V112)
+sn9c20x         0c45:627b       PC Camera (SN9C201 + OV7660)
+sn9c20x         0c45:627c       PC Camera (SN9C201 + HV7131R)
+sn9c20x         0c45:627f       PC Camera (SN9C201 + OV9650)
+sn9c20x         0c45:6280       PC Camera (SN9C202 + MT9M001)
+sn9c20x         0c45:6282       PC Camera (SN9C202 + MT9M111)
+sn9c20x         0c45:6288       PC Camera (SN9C202 + OV9655)
+sn9c20x         0c45:628e       PC Camera (SN9C202 + SOI968)
+sn9c20x         0c45:628f       PC Camera (SN9C202 + OV9650)
+sn9c20x         0c45:62a0       PC Camera (SN9C202 + OV7670)
+sn9c20x         0c45:62b0       PC Camera (SN9C202 + MT9V011/MT9V111/MT9V112)
+sn9c20x         0c45:62b3       PC Camera (SN9C202 + OV9655)
+sn9c20x         0c45:62bb       PC Camera (SN9C202 + OV7660)
+sn9c20x         0c45:62bc       PC Camera (SN9C202 + HV7131R)
 sunplus         0d64:0303       Sunplus FashionCam DXG
 etoms           102c:6151       Qcam Sangha CIF
 etoms           102c:6251       Qcam xxxxxx VGA
@@ -290,6 +314,7 @@ spca561		10fd:7e50	FlyCam Usb 100
 zc3xx           10fd:8050       Typhoon Webshot II USB 300k
 ov534           1415:2000       Sony HD Eye for PS3 (SLEH 00201)
 pac207          145f:013a       Trust WB-1300N
+sn9c20x         145f:013d       Trust WB-3600R
 vc032x          15b8:6001       HP 2.0 Megapixel
 vc032x          15b8:6002       HP 2.0 Megapixel rz406aa
 spca501         1776:501c       Arowana 300K CMOS Camera
@@ -300,4 +325,11 @@ spca500		2899:012c	Toptro Industrial
 spca508         8086:0110       Intel Easy PC Camera
 spca500         8086:0630       Intel Pocket PC Camera
 spca506         99fa:8988       Grandtec V.cap
+sn9c20x         a168:0610       Dino-Lite Digital Microscope (SN9C201 + HV7131R)
+sn9c20x         a168:0611       Dino-Lite Digital Microscope (SN9C201 + HV7131R)
+sn9c20x         a168:0613       Dino-Lite Digital Microscope (SN9C201 + HV7131R)
+sn9c20x         a168:0618       Dino-Lite Digital Microscope (SN9C201 + HV7131R)
+sn9c20x         a168:0614       Dino-Lite Digital Microscope (SN9C201 + MT9M111)
+sn9c20x         a168:0615       Dino-Lite Digital Microscope (SN9C201 + MT9M111)
+sn9c20x         a168:0617       Dino-Lite Digital Microscope (SN9C201 + MT9M111)
 spca561         abcd:cdee       Petcam
diff --git a/MAINTAINERS b/MAINTAINERS
index 18c3f0c41c95..ebc269152faf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -150,7 +150,7 @@ F:	drivers/scsi/53c700*
 
 6PACK NETWORK DRIVER FOR AX.25
 P:      Andreas Koensgen
-M:      ajk@iehk.rwth-aachen.de
+M:      ajk@comnets.uni-bremen.de
 L:      linux-hams@vger.kernel.org
 S:      Maintained
 F:      drivers/net/hamradio/6pack.c
@@ -1612,6 +1612,13 @@ S:	Supported
 F:      fs/configfs/
 F:      include/linux/configfs.h
 
+CONNECTOR
+P:      Evgeniy Polyakov
+M:      zbr@ioremap.net
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/connector/
+
 CONTROL GROUPS (CGROUPS)
 P:      Paul Menage
 M:      menage@google.com
@@ -4089,6 +4096,7 @@ L:	netfilter@vger.kernel.org
 L:      coreteam@netfilter.org
 W:      http://www.netfilter.org/
 W:      http://www.iptables.org/
+T:      git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.git
 S:      Supported
 F:      include/linux/netfilter*
 F:      include/linux/netfilter/
@@ -5586,7 +5594,6 @@ S:	Odd Fixes
 F:      drivers/net/starfire*
 
 STARMODE RADIO IP (STRIP) PROTOCOL DRIVER
-W:      http://mosquitonet.Stanford.EDU/strip.html
 S:      Orphan
 F:      drivers/net/wireless/strip.c
 F:      include/linux/if_strip.h
diff --git a/Makefile b/Makefile
index 79957b338770..063d738405ed 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 31
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Man-Eating Seals of Antiquity
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/tlb.h b/arch/alpha/include/asm/tlb.h
index c13636575fba..42866759f3fa 100644
--- a/arch/alpha/include/asm/tlb.h
+++ b/arch/alpha/include/asm/tlb.h
@@ -9,7 +9,7 @@
 
 #include <asm-generic/tlb.h>
 
-#define __pte_free_tlb(tlb, pte)                        pte_free((tlb)->mm, pte)
-#define __pmd_free_tlb(tlb, pmd)                        pmd_free((tlb)->mm, pmd)
+#define __pte_free_tlb(tlb, pte, address)               pte_free((tlb)->mm, pte)
+#define __pmd_free_tlb(tlb, pmd, address)               pmd_free((tlb)->mm, pmd)
  
 #endif
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 321c83e43a1e..f41a6f57cd12 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -102,8 +102,8 @@ tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vma)
 }
 
 #define tlb_remove_page(tlb,page)       free_page_and_swap_cache(page)
-#define pte_free_tlb(tlb, ptep)         pte_free((tlb)->mm, ptep)
-#define pmd_free_tlb(tlb, pmdp)         pmd_free((tlb)->mm, pmdp)
+#define pte_free_tlb(tlb, ptep, addr)   pte_free((tlb)->mm, ptep)
+#define pmd_free_tlb(tlb, pmdp, addr)   pmd_free((tlb)->mm, pmdp)
 
 #define tlb_migrate_finish(mm)          do { } while (0)
 
diff --git a/arch/avr32/include/asm/pgalloc.h b/arch/avr32/include/asm/pgalloc.h
index 640821323943..92ecd8446ef8 100644
--- a/arch/avr32/include/asm/pgalloc.h
+++ b/arch/avr32/include/asm/pgalloc.h
@@ -83,7 +83,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         quicklist_free_page(QUICK_PT, NULL, pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,addr)                    \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), pte);                    \
diff --git a/arch/cris/include/asm/pgalloc.h b/arch/cris/include/asm/pgalloc.h
index a1ba761d0573..6da975db112f 100644
--- a/arch/cris/include/asm/pgalloc.h
+++ b/arch/cris/include/asm/pgalloc.h
@@ -47,7 +47,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,address)                 \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), pte);                    \
diff --git a/arch/frv/include/asm/pgalloc.h b/arch/frv/include/asm/pgalloc.h
index 971e6addb009..416d19a632f2 100644
--- a/arch/frv/include/asm/pgalloc.h
+++ b/arch/frv/include/asm/pgalloc.h
@@ -49,7 +49,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,address)                 \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb),(pte));                   \
@@ -62,7 +62,7 @@ do {							\
  */
 #define pmd_alloc_one(mm, addr)         ({ BUG(); ((pmd_t *) 2); })
 #define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb,x)           do { } while (0)
+#define __pmd_free_tlb(tlb,x,a)         do { } while (0)
 
 #endif /* CONFIG_MMU */
 
diff --git a/arch/frv/include/asm/pgtable.h b/arch/frv/include/asm/pgtable.h
index 33233011b1c1..22c60692b551 100644
--- a/arch/frv/include/asm/pgtable.h
+++ b/arch/frv/include/asm/pgtable.h
@@ -225,7 +225,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
  */
 #define pud_alloc_one(mm, address)              NULL
 #define pud_free(mm, x)                         do { } while (0)
-#define __pud_free_tlb(tlb, x)                  do { } while (0)
+#define __pud_free_tlb(tlb, x, address)         do { } while (0)
 
 /*
  * The "pud_xxx()" functions here are trivial for a folded two-level
diff --git a/arch/ia64/include/asm/pgalloc.h b/arch/ia64/include/asm/pgalloc.h
index b9ac1a6fc216..96a8d927db28 100644
--- a/arch/ia64/include/asm/pgalloc.h
+++ b/arch/ia64/include/asm/pgalloc.h
@@ -48,7 +48,7 @@ static inline void pud_free(struct mm_struct *mm, pud_t *pud)
 {
         quicklist_free(0, NULL, pud);
 }
-#define __pud_free_tlb(tlb, pud)        pud_free((tlb)->mm, pud)
+#define __pud_free_tlb(tlb, pud, address)       pud_free((tlb)->mm, pud)
 #endif /* CONFIG_PGTABLE_4 */
 
 static inline void
@@ -67,7 +67,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
         quicklist_free(0, NULL, pmd);
 }
 
-#define __pmd_free_tlb(tlb, pmd)        pmd_free((tlb)->mm, pmd)
+#define __pmd_free_tlb(tlb, pmd, address)       pmd_free((tlb)->mm, pmd)
 
 static inline void
 pmd_populate(struct mm_struct *mm, pmd_t * pmd_entry, pgtable_t pte)
@@ -117,6 +117,6 @@ static inline void check_pgt_cache(void)
         quicklist_trim(0, NULL, 25, 16);
 }
 
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, pte)
+#define __pte_free_tlb(tlb, pte, address)       pte_free((tlb)->mm, pte)
 
 #endif                          /* _ASM_IA64_PGALLOC_H */
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index 20d8a39680c2..85d965cb19a0 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -236,22 +236,22 @@ do {							\
         __tlb_remove_tlb_entry(tlb, ptep, addr);        \
 } while (0)
 
-#define pte_free_tlb(tlb, ptep)                         \
+#define pte_free_tlb(tlb, ptep, address)                \
 do {                                                    \
         tlb->need_flush = 1;                            \
-        __pte_free_tlb(tlb, ptep);                      \
+        __pte_free_tlb(tlb, ptep, address);             \
 } while (0)
 
-#define pmd_free_tlb(tlb, ptep)                         \
+#define pmd_free_tlb(tlb, ptep, address)                \
 do {                                                    \
         tlb->need_flush = 1;                            \
-        __pmd_free_tlb(tlb, ptep);                      \
+        __pmd_free_tlb(tlb, ptep, address);             \
 } while (0)
 
-#define pud_free_tlb(tlb, pudp)                         \
+#define pud_free_tlb(tlb, pudp, address)                \
 do {                                                    \
         tlb->need_flush = 1;                            \
-        __pud_free_tlb(tlb, pudp);                      \
+        __pud_free_tlb(tlb, pudp, address);             \
 } while (0)
 
 #endif /* _ASM_IA64_TLB_H */
diff --git a/arch/m32r/include/asm/pgalloc.h b/arch/m32r/include/asm/pgalloc.h
index f11a2b909cdb..0fc736198979 100644
--- a/arch/m32r/include/asm/pgalloc.h
+++ b/arch/m32r/include/asm/pgalloc.h
@@ -58,7 +58,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, (pte))
+#define __pte_free_tlb(tlb, pte, addr)  pte_free((tlb)->mm, (pte))
 
 /*
  * allocating and freeing a pmd is trivial: the 1-entry pmd is
@@ -68,7 +68,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
 
 #define pmd_alloc_one(mm, addr)         ({ BUG(); ((pmd_t *)2); })
 #define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb, x)          do { } while (0)
+#define __pmd_free_tlb(tlb, x, addr)    do { } while (0)
 #define pgd_populate(mm, pmd, pte)      BUG()
 
 #define check_pgt_cache()       do { } while (0)
diff --git a/arch/m68k/include/asm/motorola_pgalloc.h b/arch/m68k/include/asm/motorola_pgalloc.h
index d08bf6261df8..15ee4c74a9f0 100644
--- a/arch/m68k/include/asm/motorola_pgalloc.h
+++ b/arch/m68k/include/asm/motorola_pgalloc.h
@@ -54,7 +54,8 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t page)
         __free_page(page);
 }
 
-static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page)
+static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page,
+                                  unsigned long address)
 {
         pgtable_page_dtor(page);
         cache_page(kmap(page));
@@ -73,7 +74,8 @@ static inline int pmd_free(struct mm_struct *mm, pmd_t *pmd)
         return free_pointer_table(pmd);
 }
 
-static inline int __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
+static inline int __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+                                 unsigned long address)
 {
         return free_pointer_table(pmd);
 }
diff --git a/arch/m68k/include/asm/sun3_pgalloc.h b/arch/m68k/include/asm/sun3_pgalloc.h
index d4c83f143816..48d80d5a666f 100644
--- a/arch/m68k/include/asm/sun3_pgalloc.h
+++ b/arch/m68k/include/asm/sun3_pgalloc.h
@@ -32,7 +32,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t page)
         __free_page(page);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,addr)                    \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), pte);                    \
@@ -80,7 +80,7 @@ static inline void pmd_populate(struct mm_struct *mm, pmd_t *pmd, pgtable_t page
  * inside the pgd, so has no extra memory associated with it.
  */
 #define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb, x)          do { } while (0)
+#define __pmd_free_tlb(tlb, x, addr)    do { } while (0)
 
 static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 {
diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
index d0bcf80a1136..8439598d4655 100644
--- a/arch/microblaze/Makefile
+++ b/arch/microblaze/Makefile
@@ -6,14 +6,16 @@ endif
 
 # What CPU vesion are we building for, and crack it open
 # as major.minor.rev
-CPU_VER=$(subst ",,$(CONFIG_XILINX_MICROBLAZE0_HW_VER) )
-CPU_MAJOR=$(shell echo $(CPU_VER) | cut -d '.' -f 1)
-CPU_MINOR=$(shell echo $(CPU_VER) | cut -d '.' -f 2)
-CPU_REV=$(shell echo $(CPU_VER) | cut -d '.' -f 3)
+CPU_VER   := $(shell echo $(CONFIG_XILINX_MICROBLAZE0_HW_VER))
+CPU_MAJOR := $(shell echo $(CPU_VER) | cut -d '.' -f 1)
+CPU_MINOR := $(shell echo $(CPU_VER) | cut -d '.' -f 2)
+CPU_REV   := $(shell echo $(CPU_VER) | cut -d '.' -f 3)
 
 export CPU_VER CPU_MAJOR CPU_MINOR CPU_REV
 
 # Use cpu-related CONFIG_ vars to set compile options.
+# The various CONFIG_XILINX cpu features options are integers 0/1/2...
+# rather than bools y/n
 
 # Work out HW multipler support.  This is icky.
 # 1. Spartan2 has no HW multiplers.
@@ -34,30 +36,29 @@ CPUFLAGS-$(CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR) += -mxl-pattern-compare
 
 CPUFLAGS-1 += $(call cc-option,-mcpu=v$(CPU_VER))
 
-# The various CONFIG_XILINX cpu features options are integers 0/1/2...
-# rather than bools y/n
-
 # r31 holds current when in kernel mode
-CFLAGS_KERNEL += -ffixed-r31 $(CPUFLAGS-1) $(CPUFLAGS-2)
+KBUILD_KERNEL += -ffixed-r31 $(CPUFLAGS-1) $(CPUFLAGS-2)
 
 LDFLAGS         :=
 LDFLAGS_vmlinux :=
-LDFLAGS_BLOB := --format binary --oformat elf32-microblaze
 
-LIBGCC := $(shell $(CC) $(CFLAGS_KERNEL) -print-libgcc-file-name)
+LIBGCC := $(shell $(CC) $(KBUILD_KERNEL) -print-libgcc-file-name)
 
-head-y          := arch/microblaze/kernel/head.o
-libs-y          += arch/microblaze/lib/ $(LIBGCC)
-core-y          += arch/microblaze/kernel/ arch/microblaze/mm/ \
-                   arch/microblaze/platform/
+head-y := arch/microblaze/kernel/head.o
+libs-y += arch/microblaze/lib/
+libs-y += $(LIBGCC)
+core-y += arch/microblaze/kernel/
+core-y += arch/microblaze/mm/
+core-y += arch/microblaze/platform/
 
-boot := arch/$(ARCH)/boot
+boot := arch/microblaze/boot
 
 # defines filename extension depending memory management type
 ifeq ($(CONFIG_MMU),)
-MMUEXT          := -nommu
+MMU := -nommu
 endif
-export  MMUEXT
+
+export MMU
 
 all: linux.bin
 
diff --git a/arch/microblaze/include/asm/io.h b/arch/microblaze/include/asm/io.h
index 5c173424d074..7c3ec13b44d8 100644
--- a/arch/microblaze/include/asm/io.h
+++ b/arch/microblaze/include/asm/io.h
@@ -14,7 +14,6 @@
 #include <asm/byteorder.h>
 #include <asm/page.h>
 #include <linux/types.h>
-#include <asm/byteorder.h>
 #include <linux/mm.h>          /* Get struct page {...} */
 
 
diff --git a/arch/microblaze/include/asm/pgalloc.h b/arch/microblaze/include/asm/pgalloc.h
index 59a757e46ba5..b0131da1387b 100644
--- a/arch/microblaze/include/asm/pgalloc.h
+++ b/arch/microblaze/include/asm/pgalloc.h
@@ -180,7 +180,7 @@ extern inline void pte_free(struct mm_struct *mm, struct page *ptepage)
         __free_page(ptepage);
 }
 
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, (pte))
+#define __pte_free_tlb(tlb, pte, addr)  pte_free((tlb)->mm, (pte))
 
 #define pmd_populate(mm, pmd, pte)      (pmd_val(*(pmd)) = page_address(pte))
 
@@ -193,7 +193,7 @@ extern inline void pte_free(struct mm_struct *mm, struct page *ptepage)
  */
 #define pmd_alloc_one(mm, address)      ({ BUG(); ((pmd_t *)2); })
 /*#define pmd_free(mm, x)                       do { } while (0)*/
-#define __pmd_free_tlb(tlb, x)          do { } while (0)
+#define __pmd_free_tlb(tlb, x, addr)    do { } while (0)
 #define pgd_populate(mm, pmd, pte)      BUG()
 
 extern int do_check_pgt_cache(int, int);
diff --git a/arch/microblaze/include/asm/pgtable.h b/arch/microblaze/include/asm/pgtable.h
index 4c57a586a989..cc3a4dfc3eaa 100644
--- a/arch/microblaze/include/asm/pgtable.h
+++ b/arch/microblaze/include/asm/pgtable.h
@@ -185,6 +185,7 @@ static inline pte_t pte_mkspecial(pte_t pte)	{ return pte; }
 
 /* Definitions for MicroBlaze. */
 #define _PAGE_GUARDED   0x001   /* G: page is guarded from prefetch */
+#define _PAGE_FILE      0x001   /* when !present: nonlinear file mapping */
 #define _PAGE_PRESENT   0x002   /* software: PTE contains a translation */
 #define _PAGE_NO_CACHE  0x004   /* I: caching is inhibited */
 #define _PAGE_WRITETHRU 0x008   /* W: caching is write-through */
@@ -320,8 +321,7 @@ static inline int pte_write(pte_t pte) { return pte_val(pte) & _PAGE_RW; }
 static inline int pte_exec(pte_t pte)  { return pte_val(pte) & _PAGE_EXEC; }
 static inline int pte_dirty(pte_t pte) { return pte_val(pte) & _PAGE_DIRTY; }
 static inline int pte_young(pte_t pte) { return pte_val(pte) & _PAGE_ACCESSED; }
-/* FIXME */
-static inline int pte_file(pte_t pte)           { return 0; }
+static inline int pte_file(pte_t pte)  { return pte_val(pte) & _PAGE_FILE; }
 
 static inline void pte_uncache(pte_t pte) { pte_val(pte) |= _PAGE_NO_CACHE; }
 static inline void pte_cache(pte_t pte)   { pte_val(pte) &= ~_PAGE_NO_CACHE; }
@@ -488,7 +488,7 @@ static inline pmd_t *pmd_offset(pgd_t *dir, unsigned long address)
 /* Encode and decode a nonlinear file mapping entry */
 #define PTE_FILE_MAX_BITS       29
 #define pte_to_pgoff(pte)       (pte_val(pte) >> 3)
-#define pgoff_to_pte(off)       ((pte_t) { ((off) << 3) })
+#define pgoff_to_pte(off)       ((pte_t) { ((off) << 3) | _PAGE_FILE })
 
 extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 
diff --git a/arch/microblaze/include/asm/prom.h b/arch/microblaze/include/asm/prom.h
index 20f7b3a926e8..37e6f305a68e 100644
--- a/arch/microblaze/include/asm/prom.h
+++ b/arch/microblaze/include/asm/prom.h
@@ -16,6 +16,18 @@
 #define _ASM_MICROBLAZE_PROM_H
 #ifdef __KERNEL__
 
+/* Definitions used by the flattened device tree */
+#define OF_DT_HEADER            0xd00dfeed /* marker */
+#define OF_DT_BEGIN_NODE        0x1 /* Start of node, full name */
+#define OF_DT_END_NODE          0x2 /* End node */
+#define OF_DT_PROP              0x3 /* Property: name off, size, content */
+#define OF_DT_NOP               0x4 /* nop */
+#define OF_DT_END               0x9
+
+#define OF_DT_VERSION           0x10
+
+#ifndef __ASSEMBLY__
+
 #include <linux/types.h>
 #include <linux/proc_fs.h>
 #include <linux/platform_device.h>
@@ -29,16 +41,6 @@
 #define of_prop_cmp(s1, s2)             strcmp((s1), (s2))
 #define of_node_cmp(s1, s2)             strcasecmp((s1), (s2))
 
-/* Definitions used by the flattened device tree */
-#define OF_DT_HEADER            0xd00dfeed /* marker */
-#define OF_DT_BEGIN_NODE        0x1 /* Start of node, full name */
-#define OF_DT_END_NODE          0x2 /* End node */
-#define OF_DT_PROP              0x3 /* Property: name off, size, content */
-#define OF_DT_NOP               0x4 /* nop */
-#define OF_DT_END               0x9
-
-#define OF_DT_VERSION           0x10
-
 /*
  * This is what gets passed to the kernel by prom_init or kexec
  *
@@ -309,5 +311,6 @@ extern void __iomem *of_iomap(struct device_node *device, int index);
  */
 #include <linux/of.h>
 
+#endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 #endif /* _ASM_MICROBLAZE_PROM_H */
diff --git a/arch/microblaze/include/asm/tlb.h b/arch/microblaze/include/asm/tlb.h
index c472d2801132..e8abd4a0349c 100644
--- a/arch/microblaze/include/asm/tlb.h
+++ b/arch/microblaze/include/asm/tlb.h
@@ -11,7 +11,7 @@
 #ifndef _ASM_MICROBLAZE_TLB_H
 #define _ASM_MICROBLAZE_TLB_H
 
-#define tlb_flush(tlb)  do {} while (0)
+#define tlb_flush(tlb)  flush_tlb_mm((tlb)->mm)
 
 #include <asm-generic/tlb.h>
 
diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
index 65adad61e7e9..5431b4631a7a 100644
--- a/arch/microblaze/include/asm/uaccess.h
+++ b/arch/microblaze/include/asm/uaccess.h
@@ -189,7 +189,7 @@ extern long strnlen_user(const char *src, long count);
 
 #define __put_user(x, ptr)                                              \
 ({                                                                      \
-        __typeof__(*(ptr)) __gu_val = x;                                \
+        __typeof__(*(ptr)) volatile __gu_val = (x);                     \
         long __gu_err = 0;                                              \
         switch (sizeof(__gu_val)) {                                     \
         case 1:                                                         \
diff --git a/arch/microblaze/kernel/Makefile b/arch/microblaze/kernel/Makefile
index f4a5e19a20eb..d487729683de 100644
--- a/arch/microblaze/kernel/Makefile
+++ b/arch/microblaze/kernel/Makefile
@@ -17,4 +17,4 @@ obj-$(CONFIG_HEART_BEAT)	+= heartbeat.o
 obj-$(CONFIG_MODULES)           += microblaze_ksyms.o module.o
 obj-$(CONFIG_MMU)               += misc.o
 
-obj-y   += entry$(MMUEXT).o
+obj-y   += entry$(MMU).o
diff --git a/arch/microblaze/kernel/cpu/cpuinfo-pvr-full.c b/arch/microblaze/kernel/cpu/cpuinfo-pvr-full.c
index 153f57c57b6d..c259786e7faa 100644
--- a/arch/microblaze/kernel/cpu/cpuinfo-pvr-full.c
+++ b/arch/microblaze/kernel/cpu/cpuinfo-pvr-full.c
@@ -22,7 +22,7 @@
 
 #define CI(c, p) { ci->c = PVR_##p(pvr); }
 #define err_printk(x) \
-        early_printk("ERROR: Microblaze " x " - different for PVR and DTS\n");
+        early_printk("ERROR: Microblaze " x "-different for PVR and DTS\n");
 
 void set_cpuinfo_pvr_full(struct cpuinfo *ci, struct device_node *cpu)
 {
diff --git a/arch/microblaze/kernel/cpu/cpuinfo-static.c b/arch/microblaze/kernel/cpu/cpuinfo-static.c
index 450ca6bb828d..adb448f93d5f 100644
--- a/arch/microblaze/kernel/cpu/cpuinfo-static.c
+++ b/arch/microblaze/kernel/cpu/cpuinfo-static.c
@@ -18,7 +18,7 @@ static const char family_string[] = CONFIG_XILINX_MICROBLAZE0_FAMILY;
 static const char cpu_ver_string[] = CONFIG_XILINX_MICROBLAZE0_HW_VER;
 
 #define err_printk(x) \
-        early_printk("ERROR: Microblaze " x "- different for kernel and DTS\n");
+        early_printk("ERROR: Microblaze " x "-different for kernel and DTS\n");
 
 void __init set_cpuinfo_static(struct cpuinfo *ci, struct device_node *cpu)
 {
diff --git a/arch/microblaze/kernel/cpu/cpuinfo.c b/arch/microblaze/kernel/cpu/cpuinfo.c
index a10bea119b94..c411c6757deb 100644
--- a/arch/microblaze/kernel/cpu/cpuinfo.c
+++ b/arch/microblaze/kernel/cpu/cpuinfo.c
@@ -26,6 +26,8 @@ const struct cpu_ver_key cpu_ver_lookup[] = {
         {"7.10.b", 0x09},
         {"7.10.c", 0x0a},
         {"7.10.d", 0x0b},
+        {"7.20.a", 0x0c},
+        {"7.20.b", 0x0d},
         /* FIXME There is no keycode defined in MBV for these versions */
         {"2.10.a", 0x10},
         {"3.00.a", 0x20},
diff --git a/arch/microblaze/kernel/head.S b/arch/microblaze/kernel/head.S
index e568d6ec621b..e41c6ce2a7be 100644
--- a/arch/microblaze/kernel/head.S
+++ b/arch/microblaze/kernel/head.S
@@ -31,6 +31,7 @@
 #include <linux/linkage.h>
 #include <asm/thread_info.h>
 #include <asm/page.h>
+#include <asm/prom.h>           /* for OF_DT_HEADER */
 
 #ifdef CONFIG_MMU
 #include <asm/setup.h> /* COMMAND_LINE_SIZE */
@@ -54,11 +55,19 @@ ENTRY(_start)
         andi    r1, r1, ~2
         mts     rmsr, r1
 
-/* save fdt to kernel location */
-/* r7 stores pointer to fdt blob */
-        beqi    r7, no_fdt_arg
+/* r7 may point to an FDT, or there may be one linked in.
+   if it's in r7, we've got to save it away ASAP.
+   We ensure r7 points to a valid FDT, just in case the bootloader
+   is broken or non-existent */
+        beqi    r7, no_fdt_arg                  /* NULL pointer?  don't copy */
+        lw      r11, r0, r7                     /* Does r7 point to a */
+        rsubi   r11, r11, OF_DT_HEADER          /* valid FDT? */
+        beqi    r11, _prepare_copy_fdt
+        or      r7, r0, r0              /* clear R7 when not valid DTB */
+        bnei    r11, no_fdt_arg                 /* No - get out of here */
+_prepare_copy_fdt:
         or      r11, r0, r0 /* incremment */
-        ori     r4, r0, TOPHYS(_fdt_start) /* save bram context */
+        ori     r4, r0, TOPHYS(_fdt_start)
         ori     r3, r0, (0x4000 - 4)
 _copy_fdt:
         lw      r12, r7, r11 /* r12 = r7 + r11 */
diff --git a/arch/microblaze/kernel/hw_exception_handler.S b/arch/microblaze/kernel/hw_exception_handler.S
index 9d591cd74fc2..3288c9737671 100644
--- a/arch/microblaze/kernel/hw_exception_handler.S
+++ b/arch/microblaze/kernel/hw_exception_handler.S
@@ -74,6 +74,7 @@
 
 #include <asm/mmu.h>
 #include <asm/pgtable.h>
+#include <asm/signal.h>
 #include <asm/asm-offsets.h>
 
 /* Helpful Macros */
@@ -428,19 +429,9 @@ handle_unaligned_ex:
         mfs     r17, rbtr;      /* ESR[DS] set - return address in BTR */
         nop
 _no_delayslot:
-#endif
-
-#ifdef CONFIG_MMU
-        /* Check if unaligned address is last on a 4k page */
-                andi    r5, r4, 0xffc
-                xori    r5, r5, 0xffc
-                bnei    r5, _unaligned_ex2
-        _unaligned_ex1:
-                RESTORE_STATE;
-/* Another page must be accessed or physical address not in page table */
-                bri     unaligned_data_trap
-
-        _unaligned_ex2:
+        /* jump to high level unaligned handler */
+        RESTORE_STATE;
+        bri     unaligned_data_trap
 #endif
         andi    r6, r3, 0x3E0; /* Mask and extract the register operand */
         srl     r6, r6; /* r6 >> 5 */
@@ -450,45 +441,6 @@ _no_delayslot:
         srl     r6, r6;
         /* Store the register operand in a temporary location */
         sbi     r6, r0, TOPHYS(ex_reg_op);
-#ifdef CONFIG_MMU
-        /* Get physical address */
-        /* If we are faulting a kernel address, we have to use the
-         * kernel page tables.
-         */
-        ori     r5, r0, CONFIG_KERNEL_START
-        cmpu    r5, r4, r5
-        bgti    r5, _unaligned_ex3
-        ori     r5, r0, swapper_pg_dir
-        bri     _unaligned_ex4
-
-        /* Get the PGD for the current thread. */
-_unaligned_ex3: /* user thread */
-        addi    r5 ,CURRENT_TASK, TOPHYS(0); /* get current task address */
-        lwi     r5, r5, TASK_THREAD + PGDIR
-_unaligned_ex4:
-        tophys(r5,r5)
-        BSRLI(r6,r4,20)                 /* Create L1 (pgdir/pmd) address */
-        andi    r6, r6, 0xffc
-/* Assume pgdir aligned on 4K boundary, no need for "andi r5,r5,0xfffff003" */
-        or      r5, r5, r6
-        lwi     r6, r5, 0               /* Get L1 entry */
-        andi    r5, r6, 0xfffff000      /* Extract L2 (pte) base address. */
-        beqi    r5, _unaligned_ex1      /* Bail if no table */
-
-        tophys(r5,r5)
-        BSRLI(r6,r4,10)                 /* Compute PTE address */
-        andi    r6, r6, 0xffc
-        andi    r5, r5, 0xfffff003
-        or      r5, r5, r6
-        lwi     r5, r5, 0               /* Get Linux PTE */
-
-        andi    r6, r5, _PAGE_PRESENT
-        beqi    r6, _unaligned_ex1      /* Bail if no page */
-
-        andi    r5, r5, 0xfffff000      /* Extract RPN */
-        andi    r4, r4, 0x00000fff      /* Extract offset */
-        or      r4, r4, r5              /* Create physical address */
-#endif /* CONFIG_MMU */
 
         andi    r6, r3, 0x400; /* Extract ESR[S] */
         bnei    r6, ex_sw;
@@ -959,15 +911,15 @@ _unaligned_data_exception:
         andi    r6, r3, 0x800;  /* Extract ESR[W] - delay slot */
 ex_lw_vm:
         beqid   r6, ex_lhw_vm;
-        lbui    r5, r4, 0;      /* Exception address in r4 - delay slot */
+load1:  lbui    r5, r4, 0;      /* Exception address in r4 - delay slot */
 /* Load a word, byte-by-byte from destination address and save it in tmp space*/
         la      r6, r0, ex_tmp_data_loc_0;
         sbi     r5, r6, 0;
-        lbui    r5, r4, 1;
+load2:  lbui    r5, r4, 1;
         sbi     r5, r6, 1;
-        lbui    r5, r4, 2;
+load3:  lbui    r5, r4, 2;
         sbi     r5, r6, 2;
-        lbui    r5, r4, 3;
+load4:  lbui    r5, r4, 3;
         sbi     r5, r6, 3;
         brid    ex_lw_tail_vm;
 /* Get the destination register value into r3 - delay slot */
@@ -977,7 +929,7 @@ ex_lhw_vm:
          * save it in tmp space */
         la      r6, r0, ex_tmp_data_loc_0;
         sbi     r5, r6, 0;
-        lbui    r5, r4, 1;
+load5:  lbui    r5, r4, 1;
         sbi     r5, r6, 1;
         lhui    r3, r6, 0;      /* Get the destination register value into r3 */
 ex_lw_tail_vm:
@@ -996,22 +948,53 @@ ex_sw_tail_vm:
         swi     r3, r5, 0;      /* Get the word - delay slot */
         /* Store the word, byte-by-byte into destination address */
         lbui    r3, r5, 0;
-        sbi     r3, r4, 0;
+store1: sbi     r3, r4, 0;
         lbui    r3, r5, 1;
-        sbi     r3, r4, 1;
+store2: sbi     r3, r4, 1;
         lbui    r3, r5, 2;
-        sbi     r3, r4, 2;
+store3: sbi     r3, r4, 2;
         lbui    r3, r5, 3;
         brid    ret_from_exc;
-        sbi     r3, r4, 3;      /* Delay slot */
+store4: sbi     r3, r4, 3;      /* Delay slot */
 ex_shw_vm:
         /* Store the lower half-word, byte-by-byte into destination address */
         lbui    r3, r5, 2;
-        sbi     r3, r4, 0;
+store5: sbi     r3, r4, 0;
         lbui    r3, r5, 3;
         brid    ret_from_exc;
-        sbi     r3, r4, 1;      /* Delay slot */
+store6: sbi     r3, r4, 1;      /* Delay slot */
 ex_sw_end_vm:                   /* Exception handling of store word, ends. */
+
+/* We have to prevent cases that get/put_user macros get unaligned pointer
+ * to bad page area. We have to find out which origin instruction caused it
+ * and called fixup for that origin instruction not instruction in unaligned
+ * handler */
+ex_unaligned_fixup:
+        ori     r5, r7, 0 /* setup pointer to pt_regs */
+        lwi     r6, r7, PT_PC; /* faulting address is one instruction above */
+        addik   r6, r6, -4 /* for finding proper fixup */
+        swi     r6, r7, PT_PC; /* a save back it to PT_PC */
+        addik   r7, r0, SIGSEGV
+        /* call bad_page_fault for finding aligned fixup, fixup address is saved
+         * in PT_PC which is used as return address from exception */
+        la      r15, r0, ret_from_exc-8 /* setup return address */
+        brid    bad_page_fault
+        nop
+
+/* We prevent all load/store because it could failed any attempt to access */
+.section __ex_table,"a";
+        .word   load1,ex_unaligned_fixup;
+        .word   load2,ex_unaligned_fixup;
+        .word   load3,ex_unaligned_fixup;
+        .word   load4,ex_unaligned_fixup;
+        .word   load5,ex_unaligned_fixup;
+        .word   store1,ex_unaligned_fixup;
+        .word   store2,ex_unaligned_fixup;
+        .word   store3,ex_unaligned_fixup;
+        .word   store4,ex_unaligned_fixup;
+        .word   store5,ex_unaligned_fixup;
+        .word   store6,ex_unaligned_fixup;
+.previous;
 .end _unaligned_data_exception
 #endif /* CONFIG_MMU */
 
diff --git a/arch/microblaze/kernel/module.c b/arch/microblaze/kernel/module.c
index 51414171326f..5a45b1adfef1 100644
--- a/arch/microblaze/kernel/module.c
+++ b/arch/microblaze/kernel/module.c
@@ -57,7 +57,6 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
         Elf32_Rela *rela = (void *)sechdrs[relsec].sh_addr;
         Elf32_Sym *sym;
         unsigned long int *location;
-        unsigned long int locoffs;
         unsigned long int value;
 #if __GNUC__ < 4
         unsigned long int old_value;
@@ -113,10 +112,12 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                         break;
 
                 case R_MICROBLAZE_64_PCREL:
-                        locoffs = (location[0] & 0xFFFF) << 16 |
+#if __GNUC__ < 4
+                        old_value = (location[0] & 0xFFFF) << 16 |
                                 (location[1] & 0xFFFF);
-                        value -= (unsigned long int)(location) + 4 +
-                                locoffs;
+                        value -= old_value;
+#endif
+                        value -= (unsigned long int)(location) + 4;
                         location[0] = (location[0] & 0xFFFF0000) |
                                         (value >> 16);
                         location[1] = (location[1] & 0xFFFF0000) |
@@ -125,6 +126,14 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                                 value);
                         break;
 
+                case R_MICROBLAZE_32_PCREL_LO:
+                        pr_debug("R_MICROBLAZE_32_PCREL_LO\n");
+                        break;
+
+                case R_MICROBLAZE_64_NONE:
+                        pr_debug("R_MICROBLAZE_NONE\n");
+                        break;
+
                 case R_MICROBLAZE_NONE:
                         pr_debug("R_MICROBLAZE_NONE\n");
                         break;
@@ -133,7 +142,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                         printk(KERN_ERR "module %s: "
                                 "Unknown relocation: %u\n",
                                 module->name,
-                                ELF32_R_TYPE(rela->r_info));
+                                ELF32_R_TYPE(rela[i].r_info));
                         return -ENOEXEC;
                 }
         }
diff --git a/arch/microblaze/kernel/setup.c b/arch/microblaze/kernel/setup.c
index 8709bea09604..2a97bf513b64 100644
--- a/arch/microblaze/kernel/setup.c
+++ b/arch/microblaze/kernel/setup.c
@@ -138,8 +138,12 @@ void __init machine_early_init(const char *cmdline, unsigned int ram,
         setup_early_printk(NULL);
 #endif
 
-        early_printk("Ramdisk addr 0x%08x, FDT 0x%08x\n", ram, fdt);
-        printk(KERN_NOTICE "Found FDT at 0x%08x\n", fdt);
+        early_printk("Ramdisk addr 0x%08x, ", ram);
+        if (fdt)
+                early_printk("FDT at 0x%08x\n", fdt);
+        else
+                early_printk("Compiled-in FDT at 0x%08x\n",
+                                        (unsigned int)_fdt_start);
 
 #ifdef CONFIG_MTD_UCLINUX
         early_printk("Found romfs @ 0x%08x (0x%08x)\n",
diff --git a/arch/microblaze/kernel/sys_microblaze.c b/arch/microblaze/kernel/sys_microblaze.c
index e000bce09b2b..b96f1682bb24 100644
--- a/arch/microblaze/kernel/sys_microblaze.c
+++ b/arch/microblaze/kernel/sys_microblaze.c
@@ -33,105 +33,6 @@
 #include <linux/unistd.h>
 
 #include <asm/syscalls.h>
-/*
- * sys_ipc() is the de-multiplexer for the SysV IPC calls..
- *
- * This is really horribly ugly. This will be remove with new toolchain.
- */
-asmlinkage long
-sys_ipc(uint call, int first, int second, int third, void *ptr, long fifth)
-{
-        int version, ret;
-
-        version = call >> 16; /* hack for backward compatibility */
-        call &= 0xffff;
-
-        ret = -EINVAL;
-        switch (call) {
-        case SEMOP:
-                ret = sys_semop(first, (struct sembuf *)ptr, second);
-                break;
-        case SEMGET:
-                ret = sys_semget(first, second, third);
-                break;
-        case SEMCTL:
-        {
-                union semun fourth;
-
-                if (!ptr)
-                        break;
-                ret = (access_ok(VERIFY_READ, ptr, sizeof(long)) ? 0 : -EFAULT)
-                                || (get_user(fourth.__pad, (void **)ptr)) ;
-                if (ret)
-                        break;
-                ret = sys_semctl(first, second, third, fourth);
-                break;
-        }
-        case MSGSND:
-                ret = sys_msgsnd(first, (struct msgbuf *) ptr, second, third);
-                break;
-        case MSGRCV:
-                switch (version) {
-                case 0: {
-                        struct ipc_kludge tmp;
-
-                        if (!ptr)
-                                break;
-                        ret = (access_ok(VERIFY_READ, ptr, sizeof(tmp))
-                                ? 0 : -EFAULT) || copy_from_user(&tmp,
-                                (struct ipc_kludge *) ptr, sizeof(tmp));
-                        if (ret)
-                                break;
-                        ret = sys_msgrcv(first, tmp.msgp, second, tmp.msgtyp,
-                                        third);
-                        break;
-                        }
-                default:
-                        ret = sys_msgrcv(first, (struct msgbuf *) ptr,
-                                        second, fifth, third);
-                        break;
-                }
-                break;
-        case MSGGET:
-                ret = sys_msgget((key_t) first, second);
-                break;
-        case MSGCTL:
-                ret = sys_msgctl(first, second, (struct msqid_ds *) ptr);
-                break;
-        case SHMAT:
-                switch (version) {
-                default: {
-                        ulong raddr;
-                        ret = access_ok(VERIFY_WRITE, (ulong *) third,
-                                        sizeof(ulong)) ? 0 : -EFAULT;
-                        if (ret)
-                                break;
-                        ret = do_shmat(first, (char *) ptr, second, &raddr);
-                        if (ret)
-                                break;
-                        ret = put_user(raddr, (ulong *) third);
-                        break;
-                        }
-                case 1: /* iBCS2 emulator entry point */
-                        if (!segment_eq(get_fs(), get_ds()))
-                                break;
-                        ret = do_shmat(first, (char *) ptr, second,
-                                        (ulong *) third);
-                        break;
-                }
-                break;
-        case SHMDT:
-                ret = sys_shmdt((char *)ptr);
-                break;
-        case SHMGET:
-                ret = sys_shmget(first, second, third);
-                break;
-        case SHMCTL:
-                ret = sys_shmctl(first, second, (struct shmid_ds *) ptr);
-                break;
-        }
-        return ret;
-}
 
 asmlinkage long microblaze_vfork(struct pt_regs *regs)
 {
diff --git a/arch/microblaze/kernel/syscall_table.S b/arch/microblaze/kernel/syscall_table.S
index 31b32a6c5f4e..216db817beb6 100644
--- a/arch/microblaze/kernel/syscall_table.S
+++ b/arch/microblaze/kernel/syscall_table.S
@@ -121,7 +121,7 @@ ENTRY(sys_call_table)
         .long sys_wait4
         .long sys_swapoff               /* 115 */
         .long sys_sysinfo
-        .long sys_ipc
+        .long sys_ni_syscall            /* old sys_ipc */
         .long sys_fsync
         .long sys_ni_syscall            /* sys_sigreturn_wrapper */
         .long sys_clone         /* 120 */
diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c
index 956607a63f4c..d9d249a66ff2 100644
--- a/arch/microblaze/mm/fault.c
+++ b/arch/microblaze/mm/fault.c
@@ -69,7 +69,7 @@ static int store_updates_sp(struct pt_regs *regs)
  * It is called from do_page_fault above and from some of the procedures
  * in traps.c.
  */
-static void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
+void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
 {
         const struct exception_table_entry *fixup;
 /* MS: no context */
@@ -122,15 +122,10 @@ void do_page_fault(struct pt_regs *regs, unsigned long address,
         }
 #endif /* CONFIG_KGDB */
 
-        if (in_atomic() || mm == NULL) {
-                /* FIXME */
-                if (kernel_mode(regs)) {
-                        printk(KERN_EMERG
-                                "Page fault in kernel mode - Oooou!!! pid %d\n",
-                                current->pid);
-                        _exception(SIGSEGV, regs, code, address);
-                        return;
-                }
+        if (in_atomic() || !mm) {
+                if (kernel_mode(regs))
+                        goto bad_area_nosemaphore;
+
                 /* in_atomic() in user mode is really bad,
                    as is current->mm == NULL. */
                 printk(KERN_EMERG "Page fault in user mode with "
diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
index 1275831dda29..3738f4b48cbd 100644
--- a/arch/mips/include/asm/pgalloc.h
+++ b/arch/mips/include/asm/pgalloc.h
@@ -98,23 +98,12 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_pages(pte, PTE_ORDER);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,address)                 \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), pte);                    \
 } while (0)
 
-#ifdef CONFIG_32BIT
-
-/*
- * allocating and freeing a pmd is trivial: the 1-entry pmd is
- * inside the pgd, so has no extra memory associated with it.
- */
-#define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb, x)          do { } while (0)
-
-#endif
-
 #ifdef CONFIG_64BIT
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
@@ -132,7 +121,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
         free_pages((unsigned long)pmd, PMD_ORDER);
 }
 
-#define __pmd_free_tlb(tlb, x)  pmd_free((tlb)->mm, x)
+#define __pmd_free_tlb(tlb, x, addr)    pmd_free((tlb)->mm, x)
 
 #endif
 
diff --git a/arch/mn10300/include/asm/pgalloc.h b/arch/mn10300/include/asm/pgalloc.h
index ec057e1bd4cf..a19f11327cd8 100644
--- a/arch/mn10300/include/asm/pgalloc.h
+++ b/arch/mn10300/include/asm/pgalloc.h
@@ -51,6 +51,6 @@ static inline void pte_free(struct mm_struct *mm, struct page *pte)
 }
 
 
-#define __pte_free_tlb(tlb, pte) tlb_remove_page((tlb), (pte))
+#define __pte_free_tlb(tlb, pte, addr) tlb_remove_page((tlb), (pte))
 
 #endif /* _ASM_PGALLOC_H */
diff --git a/arch/parisc/include/asm/tlb.h b/arch/parisc/include/asm/tlb.h
index 383b1db310ee..07924903989e 100644
--- a/arch/parisc/include/asm/tlb.h
+++ b/arch/parisc/include/asm/tlb.h
@@ -21,7 +21,7 @@ do {	if (!(tlb)->fullmm)	\
 
 #include <asm-generic/tlb.h>
 
-#define __pmd_free_tlb(tlb, pmd)        pmd_free((tlb)->mm, pmd)
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, pte)
+#define __pmd_free_tlb(tlb, pmd, addr)  pmd_free((tlb)->mm, pmd)
+#define __pte_free_tlb(tlb, pte, addr)  pte_free((tlb)->mm, pte)
 
 #endif
diff --git a/arch/powerpc/include/asm/pgalloc-32.h b/arch/powerpc/include/asm/pgalloc-32.h
index 0815eb40acae..c9500d666a1d 100644
--- a/arch/powerpc/include/asm/pgalloc-32.h
+++ b/arch/powerpc/include/asm/pgalloc-32.h
@@ -16,7 +16,7 @@ extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
  */
 /* #define pmd_alloc_one(mm,address)       ({ BUG(); ((pmd_t *)2); }) */
 #define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb,x)           do { } while (0)
+#define __pmd_free_tlb(tlb,x,a)         do { } while (0)
 /* #define pgd_populate(mm, pmd, pte)      BUG() */
 
 #ifndef CONFIG_BOOKE
diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
index afda2bdd860f..e6f069c4f713 100644
--- a/arch/powerpc/include/asm/pgalloc-64.h
+++ b/arch/powerpc/include/asm/pgalloc-64.h
@@ -118,11 +118,11 @@ static inline void pgtable_free(pgtable_free_t pgf)
                 kmem_cache_free(pgtable_cache[cachenum], p);
 }
 
-#define __pmd_free_tlb(tlb, pmd)        \
+#define __pmd_free_tlb(tlb, pmd,addr)                 \
         pgtable_free_tlb(tlb, pgtable_free_cache(pmd, \
                 PMD_CACHE_NUM, PMD_TABLE_SIZE-1))
 #ifndef CONFIG_PPC_64K_PAGES
-#define __pud_free_tlb(tlb, pud)        \
+#define __pud_free_tlb(tlb, pud, addr)                \
         pgtable_free_tlb(tlb, pgtable_free_cache(pud, \
                 PUD_CACHE_NUM, PUD_TABLE_SIZE-1))
 #endif /* CONFIG_PPC_64K_PAGES */
diff --git a/arch/powerpc/include/asm/pgalloc.h b/arch/powerpc/include/asm/pgalloc.h
index 5d8480265a77..1730e5e298d6 100644
--- a/arch/powerpc/include/asm/pgalloc.h
+++ b/arch/powerpc/include/asm/pgalloc.h
@@ -38,14 +38,14 @@ static inline pgtable_free_t pgtable_free_cache(void *p, int cachenum,
 extern void pgtable_free_tlb(struct mmu_gather *tlb, pgtable_free_t pgf);
 
 #ifdef CONFIG_SMP
-#define __pte_free_tlb(tlb,ptepage)     \
+#define __pte_free_tlb(tlb,ptepage,address)             \
 do { \
         pgtable_page_dtor(ptepage); \
         pgtable_free_tlb(tlb, pgtable_free_cache(page_address(ptepage), \
-                PTE_NONCACHE_NUM, PTE_TABLE_SIZE-1)); \
+                                        PTE_NONCACHE_NUM, PTE_TABLE_SIZE-1)); \
 } while (0)
 #else
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, (pte))
+#define __pte_free_tlb(tlb, pte, address)       pte_free((tlb)->mm, (pte))
 #endif
 
 
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 9920d6a7cf29..c46ef2ffa3d9 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -305,7 +305,7 @@ static void hugetlb_free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
 
         pmd = pmd_offset(pud, start);
         pud_clear(pud);
-        pmd_free_tlb(tlb, pmd);
+        pmd_free_tlb(tlb, pmd, start);
 }
 
 static void hugetlb_free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
@@ -348,7 +348,7 @@ static void hugetlb_free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
 
         pud = pud_offset(pgd, start);
         pgd_clear(pgd);
-        pud_free_tlb(tlb, pud);
+        pud_free_tlb(tlb, pud, start);
 }
 
 /*
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index 3d8a96d39d9d..81150b053689 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -96,7 +96,8 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
  * pte_free_tlb frees a pte table and clears the CRSTE for the
  * page table from the tlb.
  */
-static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte)
+static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
+                                unsigned long address)
 {
         if (!tlb->fullmm) {
                 tlb->array[tlb->nr_ptes++] = pte;
@@ -113,7 +114,8 @@ static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte)
  * as the pgd. pmd_free_tlb checks the asce_limit against 2GB
  * to avoid the double free of the pmd in this case.
  */
-static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
+static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+                                unsigned long address)
 {
 #ifdef __s390x__
         if (tlb->mm->context.asce_limit <= (1UL << 31))
@@ -134,7 +136,8 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
  * as the pgd. pud_free_tlb checks the asce_limit against 4TB
  * to avoid the double free of the pud in this case.
  */
-static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
+static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
+                                unsigned long address)
 {
 #ifdef __s390x__
         if (tlb->mm->context.asce_limit <= (1UL << 42))
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index f9b144049dc9..8d15314381e0 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -210,7 +210,7 @@ static noinline __init void detect_machine_type(void)
                 machine_flags |= MACHINE_FLAG_VM;
 }
 
-static void early_pgm_check_handler(void)
+static __init void early_pgm_check_handler(void)
 {
         unsigned long addr;
         const struct exception_table_entry *fixup;
@@ -222,7 +222,7 @@ static void early_pgm_check_handler(void)
         S390_lowcore.program_old_psw.addr = fixup->fixup | PSW_ADDR_AMODE;
 }
 
-void setup_lowcore_early(void)
+static noinline __init void setup_lowcore_early(void)
 {
         psw_t psw;
 
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 2270730f5354..be2cae083406 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -687,13 +687,14 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 #ifndef CONFIG_64BIT
         if (MACHINE_HAS_IEEE)
                 lowcore->extended_save_area_addr = (u32) save_area;
-#else
-        if (vdso_alloc_per_cpu(smp_processor_id(), lowcore))
-                BUG();
 #endif
         set_prefix((u32)(unsigned long) lowcore);
         local_mcck_enable();
         local_irq_enable();
+#ifdef CONFIG_64BIT
+        if (vdso_alloc_per_cpu(smp_processor_id(), &S390_lowcore))
+                BUG();
+#endif
         for_each_possible_cpu(cpu)
                 if (cpu != smp_processor_id())
                         smp_create_idle(cpu);
diff --git a/arch/s390/kernel/vdso64/clock_gettime.S b/arch/s390/kernel/vdso64/clock_gettime.S
index 79dbfee831ec..49106c6e6f88 100644
--- a/arch/s390/kernel/vdso64/clock_gettime.S
+++ b/arch/s390/kernel/vdso64/clock_gettime.S
@@ -88,10 +88,17 @@ __kernel_clock_gettime:
         llilh   %r4,0x0100
         sar     %a4,%r4
         lghi    %r4,0
+        epsw    %r5,0
         sacf    512                             /* Magic ectg instruction */
         .insn   ssf,0xc80100000000,__VDSO_ECTG_BASE(4),__VDSO_ECTG_USER(4),4
-        sacf    0
-        sar     %a4,%r2
+        tml     %r5,0x4000
+        jo      11f
+        tml     %r5,0x8000
+        jno     10f
+        sacf    256
+        j       11f
+10:     sacf    0
+11:     sar     %a4,%r2
         algr    %r1,%r0                         /* r1 = cputime as TOD value */
         mghi    %r1,1000                        /* convert to nanoseconds */
         srlg    %r1,%r1,12                      /* r1 = cputime in nanosec */
diff --git a/arch/s390/power/swsusp.c b/arch/s390/power/swsusp.c
index e6a4fe9f5f24..bd1f5c6b0b8c 100644
--- a/arch/s390/power/swsusp.c
+++ b/arch/s390/power/swsusp.c
@@ -7,24 +7,36 @@
  *
  */
 
+#include <asm/system.h>
 
-/*
- * save CPU registers before creating a hibernation image and before
- * restoring the memory state from it
- */
 void save_processor_state(void)
 {
-        /* implentation contained in the
-         * swsusp_arch_suspend function
+        /* swsusp_arch_suspend() actually saves all cpu register contents.
+         * Machine checks must be disabled since swsusp_arch_suspend() stores
+         * register contents to their lowcore save areas. That's the same
+         * place where register contents on machine checks would be saved.
+         * To avoid register corruption disable machine checks.
+         * We must also disable machine checks in the new psw mask for
+         * program checks, since swsusp_arch_suspend() may generate program
+         * checks. Disabling machine checks for all other new psw masks is
+         * just paranoia.
          */
+        local_mcck_disable();
+        /* Disable lowcore protection */
+        __ctl_clear_bit(0,28);
+        S390_lowcore.external_new_psw.mask &= ~PSW_MASK_MCHECK;
+        S390_lowcore.svc_new_psw.mask &= ~PSW_MASK_MCHECK;
+        S390_lowcore.io_new_psw.mask &= ~PSW_MASK_MCHECK;
+        S390_lowcore.program_new_psw.mask &= ~PSW_MASK_MCHECK;
 }
 
-/*
- * restore the contents of CPU registers
- */
 void restore_processor_state(void)
 {
-        /* implentation contained in the
-         * swsusp_arch_resume function
-         */
+        S390_lowcore.external_new_psw.mask |= PSW_MASK_MCHECK;
+        S390_lowcore.svc_new_psw.mask |= PSW_MASK_MCHECK;
+        S390_lowcore.io_new_psw.mask |= PSW_MASK_MCHECK;
+        S390_lowcore.program_new_psw.mask |= PSW_MASK_MCHECK;
+        /* Enable lowcore protection */
+        __ctl_set_bit(0,28);
+        local_mcck_enable();
 }
diff --git a/arch/s390/power/swsusp_asm64.S b/arch/s390/power/swsusp_asm64.S
index 76d688da32fa..b26df5c5933e 100644
--- a/arch/s390/power/swsusp_asm64.S
+++ b/arch/s390/power/swsusp_asm64.S
@@ -32,19 +32,14 @@ swsusp_arch_suspend:
         /* Deactivate DAT */
         stnsm   __SF_EMPTY(%r15),0xfb
 
-        /* Switch off lowcore protection */
-        stctg   %c0,%c0,__SF_EMPTY(%r15)
-        ni      __SF_EMPTY+4(%r15),0xef
-        lctlg   %c0,%c0,__SF_EMPTY(%r15)
-
         /* Store prefix register on stack */
         stpx    __SF_EMPTY(%r15)
 
-        /* Setup base register for lowcore (absolute 0) */
-        llgf    %r1,__SF_EMPTY(%r15)
+        /* Save prefix register contents for lowcore */
+        llgf    %r4,__SF_EMPTY(%r15)
 
         /* Get pointer to save area */
-        aghi    %r1,0x1000
+        lghi    %r1,0x1000
 
         /* Store registers */
         mvc     0x318(4,%r1),__SF_EMPTY(%r15)   /* move prefix to lowcore */
@@ -79,17 +74,15 @@ swsusp_arch_suspend:
         xc      __SF_EMPTY(4,%r15),__SF_EMPTY(%r15)
         spx     __SF_EMPTY(%r15)
 
-        /* Setup lowcore */
-        brasl   %r14,setup_lowcore_early
+        lghi    %r2,0
+        lghi    %r3,2*PAGE_SIZE
+        lghi    %r5,2*PAGE_SIZE
+1:      mvcle   %r2,%r4,0
+        jo      1b
 
         /* Save image */
         brasl   %r14,swsusp_save
 
-        /* Switch on lowcore protection */
-        stctg   %c0,%c0,__SF_EMPTY(%r15)
-        oi      __SF_EMPTY+4(%r15),0x10
-        lctlg   %c0,%c0,__SF_EMPTY(%r15)
-
         /* Restore prefix register and return */
         lghi    %r1,0x1000
         spx     0x318(%r1)
@@ -117,11 +110,6 @@ swsusp_arch_resume:
         /* Deactivate DAT */
         stnsm   __SF_EMPTY(%r15),0xfb
 
-        /* Switch off lowcore protection */
-        stctg   %c0,%c0,__SF_EMPTY(%r15)
-        ni      __SF_EMPTY+4(%r15),0xef
-        lctlg   %c0,%c0,__SF_EMPTY(%r15)
-
         /* Set prefix page to zero */
         xc      __SF_EMPTY(4,%r15),__SF_EMPTY(%r15)
         spx     __SF_EMPTY(%r15)
@@ -175,7 +163,7 @@ swsusp_arch_resume:
         /* Load old stack */
         lg      %r15,0x2f8(%r13)
 
-        /* Pointer to save arae */
+        /* Pointer to save area */
         lghi    %r13,0x1000
 
 #ifdef CONFIG_SMP
@@ -187,11 +175,6 @@ swsusp_arch_resume:
         /* Restore prefix register */
         spx     0x318(%r13)
 
-        /* Switch on lowcore protection */
-        stctg   %c0,%c0,__SF_EMPTY(%r15)
-        oi      __SF_EMPTY+4(%r15),0x10
-        lctlg   %c0,%c0,__SF_EMPTY(%r15)
-
         /* Activate DAT */
         stosm   __SF_EMPTY(%r15),0x04
 
diff --git a/arch/sh/include/asm/pgalloc.h b/arch/sh/include/asm/pgalloc.h
index 84dd2db7104c..63ca37bd9a95 100644
--- a/arch/sh/include/asm/pgalloc.h
+++ b/arch/sh/include/asm/pgalloc.h
@@ -73,20 +73,12 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         quicklist_free_page(QUICK_PT, NULL, pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte,addr)                    \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb), (pte));                  \
 } while (0)
 
-/*
- * allocating and freeing a pmd is trivial: the 1-entry pmd is
- * inside the pgd, so has no extra memory associated with it.
- */
-
-#define pmd_free(mm, x)                 do { } while (0)
-#define __pmd_free_tlb(tlb,x)           do { } while (0)
-
 static inline void check_pgt_cache(void)
 {
         quicklist_trim(QUICK_PGD, NULL, 25, 16);
diff --git a/arch/sh/include/asm/tlb.h b/arch/sh/include/asm/tlb.h
index 9c16f737074a..da8fe7ab8728 100644
--- a/arch/sh/include/asm/tlb.h
+++ b/arch/sh/include/asm/tlb.h
@@ -91,9 +91,9 @@ tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vma)
 }
 
 #define tlb_remove_page(tlb,page)       free_page_and_swap_cache(page)
-#define pte_free_tlb(tlb, ptep)         pte_free((tlb)->mm, ptep)
-#define pmd_free_tlb(tlb, pmdp)         pmd_free((tlb)->mm, pmdp)
-#define pud_free_tlb(tlb, pudp)         pud_free((tlb)->mm, pudp)
+#define pte_free_tlb(tlb, ptep, addr)   pte_free((tlb)->mm, ptep)
+#define pmd_free_tlb(tlb, pmdp, addr)   pmd_free((tlb)->mm, pmdp)
+#define pud_free_tlb(tlb, pudp, addr)   pud_free((tlb)->mm, pudp)
 
 #define tlb_migrate_finish(mm)          do { } while (0)
 
diff --git a/arch/sparc/include/asm/pgalloc_32.h b/arch/sparc/include/asm/pgalloc_32.h
index 681582d26969..ca2b34456c4b 100644
--- a/arch/sparc/include/asm/pgalloc_32.h
+++ b/arch/sparc/include/asm/pgalloc_32.h
@@ -44,8 +44,8 @@ BTFIXUPDEF_CALL(pmd_t *, pmd_alloc_one, struct mm_struct *, unsigned long)
 BTFIXUPDEF_CALL(void, free_pmd_fast, pmd_t *)
 #define free_pmd_fast(pmd)      BTFIXUP_CALL(free_pmd_fast)(pmd)
 
-#define pmd_free(mm, pmd)       free_pmd_fast(pmd)
-#define __pmd_free_tlb(tlb, pmd) pmd_free((tlb)->mm, pmd)
+#define pmd_free(mm, pmd)               free_pmd_fast(pmd)
+#define __pmd_free_tlb(tlb, pmd, addr)  pmd_free((tlb)->mm, pmd)
 
 BTFIXUPDEF_CALL(void, pmd_populate, pmd_t *, struct page *)
 #define pmd_populate(MM, PMD, PTE)        BTFIXUP_CALL(pmd_populate)(PMD, PTE)
@@ -62,7 +62,7 @@ BTFIXUPDEF_CALL(void, free_pte_fast, pte_t *)
 #define pte_free_kernel(mm, pte)        BTFIXUP_CALL(free_pte_fast)(pte)
 
 BTFIXUPDEF_CALL(void, pte_free, pgtable_t )
-#define pte_free(mm, pte)       BTFIXUP_CALL(pte_free)(pte)
-#define __pte_free_tlb(tlb, pte)        pte_free((tlb)->mm, pte)
+#define pte_free(mm, pte)               BTFIXUP_CALL(pte_free)(pte)
+#define __pte_free_tlb(tlb, pte, addr)  pte_free((tlb)->mm, pte)
 
 #endif /* _SPARC_PGALLOC_H */
diff --git a/arch/sparc/include/asm/tlb_64.h b/arch/sparc/include/asm/tlb_64.h
index ee38e731bfa6..dca406b9b6fc 100644
--- a/arch/sparc/include/asm/tlb_64.h
+++ b/arch/sparc/include/asm/tlb_64.h
@@ -100,9 +100,9 @@ static inline void tlb_remove_page(struct mmu_gather *mp, struct page *page)
 }
 
 #define tlb_remove_tlb_entry(mp,ptep,addr) do { } while (0)
-#define pte_free_tlb(mp, ptepage) pte_free((mp)->mm, ptepage)
-#define pmd_free_tlb(mp, pmdp) pmd_free((mp)->mm, pmdp)
-#define pud_free_tlb(tlb,pudp) __pud_free_tlb(tlb,pudp)
+#define pte_free_tlb(mp, ptepage, addr) pte_free((mp)->mm, ptepage)
+#define pmd_free_tlb(mp, pmdp, addr) pmd_free((mp)->mm, pmdp)
+#define pud_free_tlb(tlb,pudp, addr) __pud_free_tlb(tlb,pudp,addr)
 
 #define tlb_migrate_finish(mm)  do { } while (0)
 #define tlb_start_vma(tlb, vma) do { } while (0)
diff --git a/arch/um/include/asm/pgalloc.h b/arch/um/include/asm/pgalloc.h
index 718984359f8c..32c8ce4e1515 100644
--- a/arch/um/include/asm/pgalloc.h
+++ b/arch/um/include/asm/pgalloc.h
@@ -40,7 +40,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-#define __pte_free_tlb(tlb,pte)                         \
+#define __pte_free_tlb(tlb,pte, address)                \
 do {                                                    \
         pgtable_page_dtor(pte);                         \
         tlb_remove_page((tlb),(pte));                   \
@@ -53,7 +53,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
         free_page((unsigned long)pmd);
 }
 
-#define __pmd_free_tlb(tlb,x)   tlb_remove_page((tlb),virt_to_page(x))
+#define __pmd_free_tlb(tlb,x, address)   tlb_remove_page((tlb),virt_to_page(x))
 #endif
 
 #define check_pgt_cache()       do { } while (0)
diff --git a/arch/um/include/asm/tlb.h b/arch/um/include/asm/tlb.h
index 5240fa1c5e08..660caedac9eb 100644
--- a/arch/um/include/asm/tlb.h
+++ b/arch/um/include/asm/tlb.h
@@ -116,11 +116,11 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
                 __tlb_remove_tlb_entry(tlb, ptep, address);     \
         } while (0)
 
-#define pte_free_tlb(tlb, ptep) __pte_free_tlb(tlb, ptep)
+#define pte_free_tlb(tlb, ptep, addr) __pte_free_tlb(tlb, ptep, addr)
 
-#define pud_free_tlb(tlb, pudp) __pud_free_tlb(tlb, pudp)
+#define pud_free_tlb(tlb, pudp, addr) __pud_free_tlb(tlb, pudp, addr)
 
-#define pmd_free_tlb(tlb, pmdp) __pmd_free_tlb(tlb, pmdp)
+#define pmd_free_tlb(tlb, pmdp, addr) __pmd_free_tlb(tlb, pmdp, addr)
 
 #define tlb_migrate_finish(mm) do {} while (0)
 
diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
index dd14c54ac718..0e8c2a0fd922 100644
--- a/arch/x86/include/asm/pgalloc.h
+++ b/arch/x86/include/asm/pgalloc.h
@@ -46,7 +46,13 @@ static inline void pte_free(struct mm_struct *mm, struct page *pte)
         __free_page(pte);
 }
 
-extern void __pte_free_tlb(struct mmu_gather *tlb, struct page *pte);
+extern void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte);
+
+static inline void __pte_free_tlb(struct mmu_gather *tlb, struct page *pte,
+                                  unsigned long address)
+{
+        ___pte_free_tlb(tlb, pte);
+}
 
 static inline void pmd_populate_kernel(struct mm_struct *mm,
                                        pmd_t *pmd, pte_t *pte)
@@ -78,7 +84,13 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
         free_page((unsigned long)pmd);
 }
 
-extern void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd);
+extern void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd);
+
+static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+                                  unsigned long adddress)
+{
+        ___pmd_free_tlb(tlb, pmd);
+}
 
 #ifdef CONFIG_X86_PAE
 extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
@@ -108,7 +120,14 @@ static inline void pud_free(struct mm_struct *mm, pud_t *pud)
         free_page((unsigned long)pud);
 }
 
-extern void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud);
+extern void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud);
+
+static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
+                                  unsigned long address)
+{
+        ___pud_free_tlb(tlb, pud);
+}
+
 #endif  /* PAGETABLE_LEVELS > 3 */
 #endif  /* PAGETABLE_LEVELS > 2 */
 
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 20e6a795e160..d2c6c930b491 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -212,9 +212,9 @@ extern int __get_user_bad(void);
                      : "A" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
 #else
 #define __put_user_asm_u64(x, ptr, retval, errret) \
-        __put_user_asm(x, ptr, retval, "q", "", "Zr", errret)
+        __put_user_asm(x, ptr, retval, "q", "", "er", errret)
 #define __put_user_asm_ex_u64(x, addr)  \
-        __put_user_asm_ex(x, addr, "q", "", "Zr")
+        __put_user_asm_ex(x, addr, "q", "", "er")
 #define __put_user_x8(x, ptr, __ret_pu) __put_user_x(8, x, ptr, __ret_pu)
 #endif
 
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 8cc687326eb8..db24b215fc50 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -88,11 +88,11 @@ int __copy_to_user(void __user *dst, const void *src, unsigned size)
                               ret, "l", "k", "ir", 4);
                 return ret;
         case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
-                              ret, "q", "", "ir", 8);
+                              ret, "q", "", "er", 8);
                 return ret;
         case 10:
                 __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-                               ret, "q", "", "ir", 10);
+                               ret, "q", "", "er", 10);
                 if (unlikely(ret))
                         return ret;
                 asm("":::"memory");
@@ -101,12 +101,12 @@ int __copy_to_user(void __user *dst, const void *src, unsigned size)
                 return ret;
         case 16:
                 __put_user_asm(*(u64 *)src, (u64 __user *)dst,
-                               ret, "q", "", "ir", 16);
+                               ret, "q", "", "er", 16);
                 if (unlikely(ret))
                         return ret;
                 asm("":::"memory");
                 __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
-                               ret, "q", "", "ir", 8);
+                               ret, "q", "", "er", 8);
                 return ret;
         default:
                 return copy_user_generic((__force void *)dst, src, size);
@@ -157,7 +157,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
                                ret, "q", "", "=r", 8);
                 if (likely(!ret))
                         __put_user_asm(tmp, (u64 __user *)dst,
-                                       ret, "q", "", "ir", 8);
+                                       ret, "q", "", "er", 8);
                 return ret;
         }
         default:
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 28e5f5956042..e2485b03f1cf 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -356,7 +356,7 @@ static void __cpuinit early_init_amd(struct cpuinfo_x86 *c)
 #endif
 #if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_PCI)
         /* check CPU config space for extended APIC ID */
-        if (c->x86 >= 0xf) {
+        if (cpu_has_apic && c->x86 >= 0xf) {
                 unsigned int val;
                 val = read_pci_config(0, 24, 0, 0x68);
                 if ((val & ((1 << 17) | (1 << 18))) == ((1 << 17) | (1 << 18)))
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 484c1e5f658e..1cfb623ce11c 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1692,17 +1692,15 @@ static ssize_t set_trigger(struct sys_device *s, struct sysdev_attribute *attr,
                                 const char *buf, size_t siz)
 {
         char *p;
-        int len;
 
         strncpy(mce_helper, buf, sizeof(mce_helper));
         mce_helper[sizeof(mce_helper)-1] = 0;
-        len = strlen(mce_helper);
         p = strchr(mce_helper, '\n');
 
-        if (*p)
+        if (p)
                 *p = 0;
 
-        return len;
+        return strlen(mce_helper) + !!p;
 }
 
 static ssize_t set_ignore_ce(struct sys_device *s,
diff --git a/arch/x86/kernel/cpu/perf_counter.c b/arch/x86/kernel/cpu/perf_counter.c
index 36c3dc7b8991..a7aa8f900954 100644
--- a/arch/x86/kernel/cpu/perf_counter.c
+++ b/arch/x86/kernel/cpu/perf_counter.c
@@ -66,6 +66,52 @@ static DEFINE_PER_CPU(struct cpu_hw_counters, cpu_hw_counters) = {
 };
 
 /*
+ * Not sure about some of these
+ */
+static const u64 p6_perfmon_event_map[] =
+{
+  [PERF_COUNT_HW_CPU_CYCLES]            = 0x0079,
+  [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,
+  [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0000,
+  [PERF_COUNT_HW_CACHE_MISSES]          = 0x0000,
+  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c4,
+  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c5,
+  [PERF_COUNT_HW_BUS_CYCLES]            = 0x0062,
+};
+
+static u64 p6_pmu_event_map(int event)
+{
+        return p6_perfmon_event_map[event];
+}
+
+/*
+ * Counter setting that is specified not to count anything.
+ * We use this to effectively disable a counter.
+ *
+ * L2_RQSTS with 0 MESI unit mask.
+ */
+#define P6_NOP_COUNTER                  0x0000002EULL
+
+static u64 p6_pmu_raw_event(u64 event)
+{
+#define P6_EVNTSEL_EVENT_MASK           0x000000FFULL
+#define P6_EVNTSEL_UNIT_MASK            0x0000FF00ULL
+#define P6_EVNTSEL_EDGE_MASK            0x00040000ULL
+#define P6_EVNTSEL_INV_MASK             0x00800000ULL
+#define P6_EVNTSEL_COUNTER_MASK         0xFF000000ULL
+
+#define P6_EVNTSEL_MASK                 \
+        (P6_EVNTSEL_EVENT_MASK |        \
+         P6_EVNTSEL_UNIT_MASK  |        \
+         P6_EVNTSEL_EDGE_MASK  |        \
+         P6_EVNTSEL_INV_MASK   |        \
+         P6_EVNTSEL_COUNTER_MASK)
+
+        return event & P6_EVNTSEL_MASK;
+}
+
+
+/*
  * Intel PerfMon v3. Used on Core2 and later.
  */
 static const u64 intel_perfmon_event_map[] =
@@ -666,6 +712,7 @@ static int __hw_perf_counter_init(struct perf_counter *counter)
 {
         struct perf_counter_attr *attr = &counter->attr;
         struct hw_perf_counter *hwc = &counter->hw;
+        u64 config;
         int err;
 
         if (!x86_pmu_initialized())
@@ -718,14 +765,40 @@ static int __hw_perf_counter_init(struct perf_counter *counter)
 
         if (attr->config >= x86_pmu.max_events)
                 return -EINVAL;
+
         /*
          * The generic map:
          */
-        hwc->config |= x86_pmu.event_map(attr->config);
+        config = x86_pmu.event_map(attr->config);
+
+        if (config == 0)
+                return -ENOENT;
+
+        if (config == -1LL)
+                return -EINVAL;
+
+        hwc->config |= config;
 
         return 0;
 }
 
+static void p6_pmu_disable_all(void)
+{
+        struct cpu_hw_counters *cpuc = &__get_cpu_var(cpu_hw_counters);
+        u64 val;
+
+        if (!cpuc->enabled)
+                return;
+
+        cpuc->enabled = 0;
+        barrier();
+
+        /* p6 only has one enable register */
+        rdmsrl(MSR_P6_EVNTSEL0, val);
+        val &= ~ARCH_PERFMON_EVENTSEL0_ENABLE;
+        wrmsrl(MSR_P6_EVNTSEL0, val);
+}
+
 static void intel_pmu_disable_all(void)
 {
         wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, 0);
@@ -767,6 +840,23 @@ void hw_perf_disable(void)
         return x86_pmu.disable_all();
 }
 
+static void p6_pmu_enable_all(void)
+{
+        struct cpu_hw_counters *cpuc = &__get_cpu_var(cpu_hw_counters);
+        unsigned long val;
+
+        if (cpuc->enabled)
+                return;
+
+        cpuc->enabled = 1;
+        barrier();
+
+        /* p6 only has one enable register */
+        rdmsrl(MSR_P6_EVNTSEL0, val);
+        val |= ARCH_PERFMON_EVENTSEL0_ENABLE;
+        wrmsrl(MSR_P6_EVNTSEL0, val);
+}
+
 static void intel_pmu_enable_all(void)
 {
         wrmsrl(MSR_CORE_PERF_GLOBAL_CTRL, x86_pmu.intel_ctrl);
@@ -784,13 +874,13 @@ static void amd_pmu_enable_all(void)
         barrier();
 
         for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+                struct perf_counter *counter = cpuc->counters[idx];
                 u64 val;
 
                 if (!test_bit(idx, cpuc->active_mask))
                         continue;
-                rdmsrl(MSR_K7_EVNTSEL0 + idx, val);
-                if (val & ARCH_PERFMON_EVENTSEL0_ENABLE)
-                        continue;
+
+                val = counter->hw.config;
                 val |= ARCH_PERFMON_EVENTSEL0_ENABLE;
                 wrmsrl(MSR_K7_EVNTSEL0 + idx, val);
         }
@@ -819,16 +909,13 @@ static inline void intel_pmu_ack_status(u64 ack)
 
 static inline void x86_pmu_enable_counter(struct hw_perf_counter *hwc, int idx)
 {
-        int err;
-        err = checking_wrmsrl(hwc->config_base + idx,
+        (void)checking_wrmsrl(hwc->config_base + idx,
                               hwc->config | ARCH_PERFMON_EVENTSEL0_ENABLE);
 }
 
 static inline void x86_pmu_disable_counter(struct hw_perf_counter *hwc, int idx)
 {
-        int err;
-        err = checking_wrmsrl(hwc->config_base + idx,
-                              hwc->config);
+        (void)checking_wrmsrl(hwc->config_base + idx, hwc->config);
 }
 
 static inline void
@@ -836,13 +923,24 @@ intel_pmu_disable_fixed(struct hw_perf_counter *hwc, int __idx)
 {
         int idx = __idx - X86_PMC_IDX_FIXED;
         u64 ctrl_val, mask;
-        int err;
 
         mask = 0xfULL << (idx * 4);
 
         rdmsrl(hwc->config_base, ctrl_val);
         ctrl_val &= ~mask;
-        err = checking_wrmsrl(hwc->config_base, ctrl_val);
+        (void)checking_wrmsrl(hwc->config_base, ctrl_val);
+}
+
+static inline void
+p6_pmu_disable_counter(struct hw_perf_counter *hwc, int idx)
+{
+        struct cpu_hw_counters *cpuc = &__get_cpu_var(cpu_hw_counters);
+        u64 val = P6_NOP_COUNTER;
+
+        if (cpuc->enabled)
+                val |= ARCH_PERFMON_EVENTSEL0_ENABLE;
+
+        (void)checking_wrmsrl(hwc->config_base + idx, val);
 }
 
 static inline void
@@ -943,6 +1041,19 @@ intel_pmu_enable_fixed(struct hw_perf_counter *hwc, int __idx)
         err = checking_wrmsrl(hwc->config_base, ctrl_val);
 }
 
+static void p6_pmu_enable_counter(struct hw_perf_counter *hwc, int idx)
+{
+        struct cpu_hw_counters *cpuc = &__get_cpu_var(cpu_hw_counters);
+        u64 val;
+
+        val = hwc->config;
+        if (cpuc->enabled)
+                val |= ARCH_PERFMON_EVENTSEL0_ENABLE;
+
+        (void)checking_wrmsrl(hwc->config_base + idx, val);
+}
+
+
 static void intel_pmu_enable_counter(struct hw_perf_counter *hwc, int idx)
 {
         if (unlikely(hwc->config_base == MSR_ARCH_PERFMON_FIXED_CTR_CTRL)) {
@@ -959,8 +1070,6 @@ static void amd_pmu_enable_counter(struct hw_perf_counter *hwc, int idx)
 
         if (cpuc->enabled)
                 x86_pmu_enable_counter(hwc, idx);
-        else
-                x86_pmu_disable_counter(hwc, idx);
 }
 
 static int
@@ -1176,6 +1285,49 @@ static void intel_pmu_reset(void)
         local_irq_restore(flags);
 }
 
+static int p6_pmu_handle_irq(struct pt_regs *regs)
+{
+        struct perf_sample_data data;
+        struct cpu_hw_counters *cpuc;
+        struct perf_counter *counter;
+        struct hw_perf_counter *hwc;
+        int idx, handled = 0;
+        u64 val;
+
+        data.regs = regs;
+        data.addr = 0;
+
+        cpuc = &__get_cpu_var(cpu_hw_counters);
+
+        for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+                if (!test_bit(idx, cpuc->active_mask))
+                        continue;
+
+                counter = cpuc->counters[idx];
+                hwc = &counter->hw;
+
+                val = x86_perf_counter_update(counter, hwc, idx);
+                if (val & (1ULL << (x86_pmu.counter_bits - 1)))
+                        continue;
+
+                /*
+                 * counter overflow
+                 */
+                handled         = 1;
+                data.period     = counter->hw.last_period;
+
+                if (!x86_perf_counter_set_period(counter, hwc, idx))
+                        continue;
+
+                if (perf_counter_overflow(counter, 1, &data))
+                        p6_pmu_disable_counter(hwc, idx);
+        }
+
+        if (handled)
+                inc_irq_stat(apic_perf_irqs);
+
+        return handled;
+}
 
 /*
  * This handler is triggered by the local APIC, so the APIC IRQ handling
@@ -1185,14 +1337,13 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
 {
         struct perf_sample_data data;
         struct cpu_hw_counters *cpuc;
-        int bit, cpu, loops;
+        int bit, loops;
         u64 ack, status;
 
         data.regs = regs;
         data.addr = 0;
 
-        cpu = smp_processor_id();
-        cpuc = &per_cpu(cpu_hw_counters, cpu);
+        cpuc = &__get_cpu_var(cpu_hw_counters);
 
         perf_disable();
         status = intel_pmu_get_status();
@@ -1249,14 +1400,13 @@ static int amd_pmu_handle_irq(struct pt_regs *regs)
         struct cpu_hw_counters *cpuc;
         struct perf_counter *counter;
         struct hw_perf_counter *hwc;
-        int cpu, idx, handled = 0;
+        int idx, handled = 0;
         u64 val;
 
         data.regs = regs;
         data.addr = 0;
 
-        cpu = smp_processor_id();
-        cpuc = &per_cpu(cpu_hw_counters, cpu);
+        cpuc = &__get_cpu_var(cpu_hw_counters);
 
         for (idx = 0; idx < x86_pmu.num_counters; idx++) {
                 if (!test_bit(idx, cpuc->active_mask))
@@ -1353,6 +1503,32 @@ static __read_mostly struct notifier_block perf_counter_nmi_notifier = {
         .priority               = 1
 };
 
+static struct x86_pmu p6_pmu = {
+        .name                   = "p6",
+        .handle_irq             = p6_pmu_handle_irq,
+        .disable_all            = p6_pmu_disable_all,
+        .enable_all             = p6_pmu_enable_all,
+        .enable                 = p6_pmu_enable_counter,
+        .disable                = p6_pmu_disable_counter,
+        .eventsel               = MSR_P6_EVNTSEL0,
+        .perfctr                = MSR_P6_PERFCTR0,
+        .event_map              = p6_pmu_event_map,
+        .raw_event              = p6_pmu_raw_event,
+        .max_events             = ARRAY_SIZE(p6_perfmon_event_map),
+        .max_period             = (1ULL << 31) - 1,
+        .version                = 0,
+        .num_counters           = 2,
+        /*
+         * Counters have 40 bits implemented. However they are designed such
+         * that bits [32-39] are sign extensions of bit 31. As such the
+         * effective width of a counter for P6-like PMU is 32 bits only.
+         *
+         * See IA-32 Intel Architecture Software developer manual Vol 3B
+         */
+        .counter_bits           = 32,
+        .counter_mask           = (1ULL << 32) - 1,
+};
+
 static struct x86_pmu intel_pmu = {
         .name                   = "Intel",
         .handle_irq             = intel_pmu_handle_irq,
@@ -1392,6 +1568,37 @@ static struct x86_pmu amd_pmu = {
         .max_period             = (1ULL << 47) - 1,
 };
 
+static int p6_pmu_init(void)
+{
+        switch (boot_cpu_data.x86_model) {
+        case 1:
+        case 3:  /* Pentium Pro */
+        case 5:
+        case 6:  /* Pentium II */
+        case 7:
+        case 8:
+        case 11: /* Pentium III */
+                break;
+        case 9:
+        case 13:
+                /* Pentium M */
+                break;
+        default:
+                pr_cont("unsupported p6 CPU model %d ",
+                        boot_cpu_data.x86_model);
+                return -ENODEV;
+        }
+
+        if (!cpu_has_apic) {
+                pr_info("no Local APIC, try rebooting with lapic");
+                return -ENODEV;
+        }
+
+        x86_pmu                         = p6_pmu;
+
+        return 0;
+}
+
 static int intel_pmu_init(void)
 {
         union cpuid10_edx edx;
@@ -1400,8 +1607,14 @@ static int intel_pmu_init(void)
         unsigned int ebx;
         int version;
 
-        if (!cpu_has(&boot_cpu_data, X86_FEATURE_ARCH_PERFMON))
+        if (!cpu_has(&boot_cpu_data, X86_FEATURE_ARCH_PERFMON)) {
+                /* check for P6 processor family */
+           if (boot_cpu_data.x86 == 6) {
+                return p6_pmu_init();
+           } else {
                 return -ENODEV;
+           }
+        }
 
         /*
          * Check whether the Architectural PerfMon supports
diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c
index 696f0e475c2d..92b7703d3d58 100644
--- a/arch/x86/kernel/irqinit.c
+++ b/arch/x86/kernel/irqinit.c
@@ -187,7 +187,7 @@ static void __init apic_intr_init(void)
 #ifdef CONFIG_X86_THERMAL_VECTOR
         alloc_intr_gate(THERMAL_APIC_VECTOR, thermal_interrupt);
 #endif
-#ifdef CONFIG_X86_THRESHOLD
+#ifdef CONFIG_X86_MCE_THRESHOLD
         alloc_intr_gate(THRESHOLD_APIC_VECTOR, threshold_interrupt);
 #endif
 #if defined(CONFIG_X86_NEW_MCE) && defined(CONFIG_X86_LOCAL_APIC)
diff --git a/arch/x86/kernel/mfgpt_32.c b/arch/x86/kernel/mfgpt_32.c
index 846510b78a09..2a62d843f015 100644
--- a/arch/x86/kernel/mfgpt_32.c
+++ b/arch/x86/kernel/mfgpt_32.c
@@ -347,7 +347,7 @@ static irqreturn_t mfgpt_tick(int irq, void *dev_id)
 
 static struct irqaction mfgptirq  = {
         .handler = mfgpt_tick,
-        .flags = IRQF_DISABLED | IRQF_NOBALANCING,
+        .flags = IRQF_DISABLED | IRQF_NOBALANCING | IRQF_TIMER,
         .name = "mfgpt-timer"
 };
 
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index d2d1ce8170f0..508e982dd072 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -249,6 +249,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "VGN-Z540N"),
                 },
         },
+        {       /* Handle problems with rebooting on CompuLab SBC-FITPC2 */
+                .callback = set_bios_reboot,
+                .ident = "CompuLab SBC-FITPC2",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "CompuLab"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SBC-FITPC2"),
+                },
+        },
         { }
 };
 
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index de2cab132844..63f32d220ef2 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -672,6 +672,19 @@ static struct dmi_system_id __initdata bad_bios_dmi_table[] = {
                         DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies"),
                 },
         },
+        {
+        /*
+         * AMI BIOS with low memory corruption was found on Intel DG45ID board.
+         * It hase different DMI_BIOS_VENDOR = "Intel Corp.", for now we will
+         * match only DMI_BOARD_NAME and see if there is more bad products
+         * with this vendor.
+         */
+                .callback = dmi_low_memory_corruption,
+                .ident = "AMI BIOS",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_NAME, "DG45ID"),
+                },
+        },
 #endif
         {}
 };
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 367e87882041..59f31d2dd435 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -112,11 +112,6 @@ SECTIONS
                 _sdata = .;
                 DATA_DATA
                 CONSTRUCTORS
-
-#ifdef CONFIG_X86_64
-                /* End of data section */
-                _edata = .;
-#endif
         } :data
 
 #ifdef CONFIG_X86_32
@@ -156,10 +151,8 @@ SECTIONS
         .data.read_mostly : AT(ADDR(.data.read_mostly) - LOAD_OFFSET) {
                 *(.data.read_mostly)
 
-#ifdef CONFIG_X86_32
                 /* End of data section */
                 _edata = .;
-#endif
         }
 
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 8e43bdd45456..af8f9650058c 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -25,7 +25,7 @@ pgtable_t pte_alloc_one(struct mm_struct *mm, unsigned long address)
         return pte;
 }
 
-void __pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
+void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
 {
         pgtable_page_dtor(pte);
         paravirt_release_pte(page_to_pfn(pte));
@@ -33,14 +33,14 @@ void __pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
 }
 
 #if PAGETABLE_LEVELS > 2
-void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
+void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
 {
         paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
         tlb_remove_page(tlb, virt_to_page(pmd));
 }
 
 #if PAGETABLE_LEVELS > 3
-void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
+void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
 {
         paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
         tlb_remove_page(tlb, virt_to_page(pud));
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index 2dfcbf9df2ae..dbb5381f7b3b 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -79,8 +79,10 @@ static __init void bad_srat(void)
         acpi_numa = -1;
         for (i = 0; i < MAX_LOCAL_APIC; i++)
                 apicid_to_node[i] = NUMA_NO_NODE;
-        for (i = 0; i < MAX_NUMNODES; i++)
-                nodes_add[i].start = nodes[i].end = 0;
+        for (i = 0; i < MAX_NUMNODES; i++) {
+                nodes[i].start = nodes[i].end = 0;
+                nodes_add[i].start = nodes_add[i].end = 0;
+        }
         remove_all_active_ranges();
 }
 
diff --git a/arch/xtensa/include/asm/tlb.h b/arch/xtensa/include/asm/tlb.h
index 31c220faca02..0d766f9c1083 100644
--- a/arch/xtensa/include/asm/tlb.h
+++ b/arch/xtensa/include/asm/tlb.h
@@ -42,6 +42,6 @@
 
 #include <asm-generic/tlb.h>
 
-#define __pte_free_tlb(tlb, pte)                pte_free((tlb)->mm, pte)
+#define __pte_free_tlb(tlb, pte, address)       pte_free((tlb)->mm, pte)
 
 #endif  /* _XTENSA_TLB_H */
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index b1cd04087d6a..418d63619680 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -16,9 +16,9 @@ struct queue_sysfs_entry {
 };
 
 static ssize_t
-queue_var_show(unsigned int var, char *page)
+queue_var_show(unsigned long var, char *page)
 {
-        return sprintf(page, "%d\n", var);
+        return sprintf(page, "%lu\n", var);
 }
 
 static ssize_t
@@ -77,7 +77,8 @@ queue_requests_store(struct request_queue *q, const char *page, size_t count)
 
 static ssize_t queue_ra_show(struct request_queue *q, char *page)
 {
-        int ra_kb = q->backing_dev_info.ra_pages << (PAGE_CACHE_SHIFT - 10);
+        unsigned long ra_kb = q->backing_dev_info.ra_pages <<
+                                        (PAGE_CACHE_SHIFT - 10);
 
         return queue_var_show(ra_kb, (page));
 }
@@ -189,9 +190,9 @@ static ssize_t queue_nomerges_store(struct request_queue *q, const char *page,
 
 static ssize_t queue_rq_affinity_show(struct request_queue *q, char *page)
 {
-        unsigned int set = test_bit(QUEUE_FLAG_SAME_COMP, &q->queue_flags);
+        bool set = test_bit(QUEUE_FLAG_SAME_COMP, &q->queue_flags);
 
-        return queue_var_show(set != 0, page);
+        return queue_var_show(set, page);
 }
 
 static ssize_t
diff --git a/block/elevator.c b/block/elevator.c
index 6f2375339a99..2d511f9105e1 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -101,11 +101,16 @@ int elv_rq_merge_ok(struct request *rq, struct bio *bio)
                 return 0;
 
         /*
-         * Don't merge if failfast settings don't match
+         * Don't merge if failfast settings don't match.
+         *
+         * FIXME: The negation in front of each condition is necessary
+         * because bio and request flags use different bit positions
+         * and the accessors return those bits directly.  This
+         * ugliness will soon go away.
          */
-        if (bio_failfast_dev(bio)       != blk_failfast_dev(rq)         ||
-            bio_failfast_transport(bio) != blk_failfast_transport(rq)   ||
-            bio_failfast_driver(bio)    != blk_failfast_driver(rq))
+        if (!bio_failfast_dev(bio)       != !blk_failfast_dev(rq)       ||
+            !bio_failfast_transport(bio) != !blk_failfast_transport(rq) ||
+            !bio_failfast_driver(bio)    != !blk_failfast_driver(rq))
                 return 0;
 
         if (!elv_iosched_allow_merge(rq, bio))
diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
index f5e7180d7f47..3ff02941b3dd 100644
--- a/drivers/block/ataflop.c
+++ b/drivers/block/ataflop.c
@@ -1627,7 +1627,7 @@ static int fd_ioctl(struct block_device *bdev, fmode_t mode,
                                 drive, dtp->blocks, dtp->spt, dtp->stretch);
 
                 /* sanity check */
-                if (!dtp || setprm.track != dtp->blocks/dtp->spt/2 ||
+                if (setprm.track != dtp->blocks/dtp->spt/2 ||
                     setprm.head != 2) {
                         redo_fd_request();
                         return -EINVAL;
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index fbeefb68a31f..aa1a3d5a3e2b 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -427,7 +427,12 @@ static unsigned int features[] = {
         VIRTIO_BLK_F_SCSI, VIRTIO_BLK_F_IDENTIFY
 };
 
-static struct virtio_driver virtio_blk = {
+/*
+ * virtio_blk causes spurious section mismatch warning by
+ * simultaneously referring to a __devinit and a __devexit function.
+ * Use __refdata to avoid this warning.
+ */
+static struct virtio_driver __refdata virtio_blk = {
         .feature_table = features,
         .feature_table_size = ARRAY_SIZE(features),
         .driver.name =  KBUILD_MODNAME,
diff --git a/drivers/block/z2ram.c b/drivers/block/z2ram.c
index 4575171e5beb..b2590409f25e 100644
--- a/drivers/block/z2ram.c
+++ b/drivers/block/z2ram.c
@@ -374,7 +374,7 @@ err:
 static void __exit z2_exit(void)
 {
     int i, j;
-    blk_unregister_region(MKDEV(Z2RAM_MAJOR, 0), 256);
+    blk_unregister_region(MKDEV(Z2RAM_MAJOR, 0), Z2MINOR_COUNT);
     unregister_blkdev(Z2RAM_MAJOR, DEVICE_NAME);
     del_gendisk(z2ram_gendisk);
     put_disk(z2ram_gendisk);
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 6e6942c45f5b..3850a68f265a 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -52,6 +52,7 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
                 return;
         tty->link->packet = 0;
         set_bit(TTY_OTHER_CLOSED, &tty->link->flags);
+        tty_flip_buffer_push(tty->link);
         wake_up_interruptible(&tty->link->read_wait);
         wake_up_interruptible(&tty->link->write_wait);
         if (tty->driver->subtype == PTY_TYPE_MASTER) {
@@ -207,6 +208,7 @@ static int pty_open(struct tty_struct *tty, struct file *filp)
         clear_bit(TTY_OTHER_CLOSED, &tty->link->flags);
         set_bit(TTY_THROTTLED, &tty->flags);
         retval = 0;
+        tty->low_latency = 1;
 out:
         return retval;
 }
diff --git a/drivers/connector/cn_queue.c b/drivers/connector/cn_queue.c
index c769ef269fb5..408c2af25d50 100644
--- a/drivers/connector/cn_queue.c
+++ b/drivers/connector/cn_queue.c
@@ -1,7 +1,7 @@
 /*
  *      cn_queue.c
  *
- * 2004-2005 Copyright (c) Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * 2004+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index fd336c5a9057..08b2500f21ec 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -1,7 +1,7 @@
 /*
  *      connector.c
  *
- * 2004-2005 Copyright (c) Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * 2004+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
  * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -33,7 +33,7 @@
 #include <net/sock.h>
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Generic userspace <-> kernelspace connector.");
 
 static u32 cn_idx = CN_IDX_CONNECTOR;
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 858fe6037223..24964c1d0af9 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -970,7 +970,7 @@ static void amd64_read_dct_base_mask(struct amd64_pvt *pvt)
         }
 
         for (cs = 0; cs < pvt->num_dcsm; cs++) {
-                reg = K8_DCSB0 + (cs * 4);
+                reg = K8_DCSM0 + (cs * 4);
                 err = pci_read_config_dword(pvt->dram_f2_ctl, reg,
                                         &pvt->dcsm0[cs]);
                 if (unlikely(err))
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f2c21d5d24e8..5eb10c2ce665 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1075,14 +1075,16 @@ EXPORT_SYMBOL_GPL(hid_report_raw_event);
  */
 int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int interrupt)
 {
-        struct hid_report_enum *report_enum = hid->report_enum + type;
-        struct hid_driver *hdrv = hid->driver;
+        struct hid_report_enum *report_enum;
+        struct hid_driver *hdrv;
         struct hid_report *report;
         unsigned int i;
         int ret;
 
         if (!hid || !hid->driver)
                 return -ENODEV;
+        report_enum = hid->report_enum + type;
+        hdrv = hid->driver;
 
         if (!size) {
                 dbg_hid("empty report\n");
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 9e9421525fb9..215b2addddbb 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -527,8 +527,10 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
                         goto goodreturn;
 
                 case HIDIOCGCOLLECTIONINDEX:
+                        i = field->usage[uref->usage_index].collection_index;
+                        unlock_kernel();
                         kfree(uref_multi);
-                        return field->usage[uref->usage_index].collection_index;
+                        return i;
                 case HIDIOCGUSAGES:
                         for (i = 0; i < uref_multi->num_values; i++)
                                 uref_multi->values[i] =
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index bff0103610c1..fe4fa29c9219 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -593,7 +593,11 @@ static int atk_add_sensor(struct atk_data *data, union acpi_object *obj)
         sensor->data = data;
         sensor->id = flags->integer.value;
         sensor->limit1 = limit1->integer.value;
-        sensor->limit2 = limit2->integer.value;
+        if (data->old_interface)
+                sensor->limit2 = limit2->integer.value;
+        else
+                /* The upper limit is expressed as delta from lower limit */
+                sensor->limit2 = sensor->limit1 + limit2->integer.value;
 
         snprintf(sensor->input_attr_name, ATTR_NAME_SIZE,
                         "%s%d_input", base_name, start + *num);
diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
index a92dbb97ee99..ba75bfcf14ce 100644
--- a/drivers/hwmon/smsc47m1.c
+++ b/drivers/hwmon/smsc47m1.c
@@ -86,6 +86,7 @@ superio_exit(void)
 #define SUPERIO_REG_ACT         0x30
 #define SUPERIO_REG_BASE        0x60
 #define SUPERIO_REG_DEVID       0x20
+#define SUPERIO_REG_DEVREV      0x21
 
 /* Logical device registers */
 
@@ -429,6 +430,9 @@ static int __init smsc47m1_find(unsigned short *addr,
          * The LPC47M292 (device id 0x6B) is somewhat compatible, but it
          * supports a 3rd fan, and the pin configuration registers are
          * unfortunately different.
+         * The LPC47M233 has the same device id (0x6B) but is not compatible.
+         * We check the high bit of the device revision register to
+         * differentiate them.
          */
         switch (val) {
         case 0x51:
@@ -448,6 +452,13 @@ static int __init smsc47m1_find(unsigned short *addr,
                 sio_data->type = smsc47m1;
                 break;
         case 0x6B:
+                if (superio_inb(SUPERIO_REG_DEVREV) & 0x80) {
+                        pr_debug(DRVNAME ": "
+                                 "Found SMSC LPC47M233, unsupported\n");
+                        superio_exit();
+                        return -ENODEV;
+                }
+
                 pr_info(DRVNAME ": Found SMSC LPC47M292\n");
                 sio_data->type = smsc47m2;
                 break;
diff --git a/drivers/i2c/chips/tsl2550.c b/drivers/i2c/chips/tsl2550.c
index 1a9cc135219f..b96f3025e588 100644
--- a/drivers/i2c/chips/tsl2550.c
+++ b/drivers/i2c/chips/tsl2550.c
@@ -27,7 +27,7 @@
 #include <linux/delay.h>
 
 #define TSL2550_DRV_NAME        "tsl2550"
-#define DRIVER_VERSION          "1.1.1"
+#define DRIVER_VERSION          "1.1.2"
 
 /*
  * Defines
@@ -189,13 +189,16 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
         u8 r = 128;
 
         /* Avoid division by 0 and count 1 cannot be greater than count 0 */
-        if (c0 && (c1 <= c0))
-                r = c1 * 128 / c0;
+        if (c1 <= c0)
+                if (c0) {
+                        r = c1 * 128 / c0;
+
+                        /* Calculate LUX */
+                        lux = ((c0 - c1) * ratio_lut[r]) / 256;
+                } else
+                        lux = 0;
         else
-                return -1;
-
-        /* Calculate LUX */
-        lux = ((c0 - c1) * ratio_lut[r]) / 256;
+                return -EAGAIN;
 
         /* LUX range check */
         return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index 695181120cdb..7f878017b736 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -455,6 +455,7 @@ static void idedisk_prepare_flush(struct request_queue *q, struct request *rq)
 
         rq->cmd_type = REQ_TYPE_ATA_TASKFILE;
         rq->special = cmd;
+        cmd->rq = rq;
 }
 
 ide_devset_get(multcount, mult_count);
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 013dc595fab6..bc5fb12b913c 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -1064,6 +1064,7 @@ static int idetape_blkdev_ioctl(ide_drive_t *drive, unsigned int cmd,
                 tape->best_dsc_rw_freq = config.dsc_rw_frequency;
                 break;
         case 0x0350:
+                memset(&config, 0, sizeof(config));
                 config.dsc_rw_frequency = (int) tape->best_dsc_rw_freq;
                 config.nr_stages = 1;
                 if (copy_to_user(argp, &config, sizeof(config)))
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 114efd8dc8f5..1148140d08a1 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -608,8 +608,7 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                                                     p, compat_mode);
 
                         if (_IOC_NR(cmd) == _IOC_NR(EVIOCGNAME(0)))
-                                return str_to_user(dev_name(&evdev->dev),
-                                                   _IOC_SIZE(cmd), p);
+                                return str_to_user(dev->name, _IOC_SIZE(cmd), p);
 
                         if (_IOC_NR(cmd) == _IOC_NR(EVIOCGPHYS(0)))
                                 return str_to_user(dev->phys, _IOC_SIZE(cmd), p);
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 0e12f89276a3..4cfd084fa897 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -536,7 +536,7 @@ static int joydev_ioctl_common(struct joydev *joydev,
         default:
                 if ((cmd & ~IOCSIZE_MASK) == JSIOCGNAME(0)) {
                         int len;
-                        const char *name = dev_name(&dev->dev);
+                        const char *name = dev->name;
 
                         if (!name)
                                 return 0;
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index b868b8d5fbb3..f155ad8cdae7 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -470,20 +470,20 @@ static void xpad_irq_out(struct urb *urb)
         status = urb->status;
 
         switch (status) {
-                case 0:
+        case 0:
                 /* success */
-                break;
-                case -ECONNRESET:
-                case -ENOENT:
-                case -ESHUTDOWN:
-                        /* this urb is terminated, clean up */
-                        dbg("%s - urb shutting down with status: %d",
-                                __func__, status);
-                        return;
-                default:
-                        dbg("%s - nonzero urb status received: %d",
-                                __func__, status);
-                        goto exit;
+                return;
+
+        case -ECONNRESET:
+        case -ENOENT:
+        case -ESHUTDOWN:
+                /* this urb is terminated, clean up */
+                dbg("%s - urb shutting down with status: %d", __func__, status);
+                return;
+
+        default:
+                dbg("%s - nonzero urb status received: %d", __func__, status);
+                goto exit;
         }
 
 exit:
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index df3f8aa68115..95fe0452dae4 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -895,6 +895,13 @@ static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = {
 };
 
 /*
+ * Amilo Pi 3525 key release for Fn+Volume keys not working
+ */
+static unsigned int atkbd_amilo_pi3525_forced_release_keys[] = {
+        0x20, 0xa0, 0x2e, 0xae, 0x30, 0xb0, -1U
+};
+
+/*
  * Amilo Xi 3650 key release for light touch bar not working
  */
 static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
@@ -902,6 +909,13 @@ static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
 };
 
 /*
+ * Soltech TA12 system with broken key release on volume keys and mute key
+ */
+static unsigned int atkdb_soltech_ta12_forced_release_keys[] = {
+        0xa0, 0xae, 0xb0, -1U
+};
+
+/*
  * atkbd_set_keycode_table() initializes keyboard's keycode table
  * according to the selected scancode set
  */
@@ -1568,6 +1582,15 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                 .driver_data = atkbd_amilo_pa1510_forced_release_keys,
         },
         {
+                .ident = "Fujitsu Amilo Pi 3525",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pi 3525"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_amilo_pi3525_forced_release_keys,
+        },
+        {
                 .ident = "Fujitsu Amilo Xi 3650",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
@@ -1576,6 +1599,15 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                 .callback = atkbd_setup_forced_release,
                 .driver_data = atkbd_amilo_xi3650_forced_release_keys,
         },
+        {
+                .ident = "Soltech Corporation TA12",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Soltech Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TA12"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkdb_soltech_ta12_forced_release_keys,
+        },
         { }
 };
 
diff --git a/drivers/input/misc/pcspkr.c b/drivers/input/misc/pcspkr.c
index 6d67af5387ad..21cb755a54fb 100644
--- a/drivers/input/misc/pcspkr.c
+++ b/drivers/input/misc/pcspkr.c
@@ -114,7 +114,7 @@ static int __devexit pcspkr_remove(struct platform_device *dev)
         return 0;
 }
 
-static int pcspkr_suspend(struct platform_device *dev, pm_message_t state)
+static int pcspkr_suspend(struct device *dev)
 {
         pcspkr_event(NULL, EV_SND, SND_BELL, 0);
 
@@ -127,14 +127,18 @@ static void pcspkr_shutdown(struct platform_device *dev)
         pcspkr_event(NULL, EV_SND, SND_BELL, 0);
 }
 
+static struct dev_pm_ops pcspkr_pm_ops = {
+        .suspend = pcspkr_suspend,
+};
+
 static struct platform_driver pcspkr_platform_driver = {
         .driver         = {
                 .name   = "pcspkr",
                 .owner  = THIS_MODULE,
+                .pm     = &pcspkr_pm_ops,
         },
         .probe          = pcspkr_probe,
         .remove         = __devexit_p(pcspkr_remove),
-        .suspend        = pcspkr_suspend,
         .shutdown       = pcspkr_shutdown,
 };
 
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 7c8957dd22c0..26e17a9a22eb 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -646,6 +646,15 @@ static struct dmi_system_id dmi_ids[] __initdata = {
         },
         {
                 .callback = dmi_matched,
+                .ident = "Maxdata Pro 7000 DX",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "MAXDATA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Pro 7000"),
+                },
+                .driver_data = keymap_fs_amilo_pro_v2000
+        },
+        {
+                .callback = dmi_matched,
                 .ident = "Fujitsu N3510",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index 990e6a7e6674..c3b661a666cb 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -731,10 +731,10 @@ l1oip_socket_thread(void *data)
         while (!signal_pending(current)) {
                 struct kvec iov = {
                         .iov_base = recvbuf,
-                        .iov_len = sizeof(recvbuf),
+                        .iov_len = recvbuf_size,
                 };
                 recvlen = kernel_recvmsg(socket, &msg, &iov, 1,
-                                         sizeof(recvbuf), 0);
+                                         recvbuf_size, 0);
                 if (recvlen > 0) {
                         l1oip_socket_parse(hc, &sin_rx, recvbuf, recvlen);
                 } else {
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 529e2ba505c3..ed1038164019 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1318,7 +1318,7 @@ static int crypt_iterate_devices(struct dm_target *ti,
 {
         struct crypt_config *cc = ti->private;
 
-        return fn(ti, cc->dev, cc->start, data);
+        return fn(ti, cc->dev, cc->start, ti->len, data);
 }
 
 static struct target_type crypt_target = {
diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 4e5b843cd4d7..ebe7381f47c8 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -324,12 +324,12 @@ static int delay_iterate_devices(struct dm_target *ti,
         struct delay_c *dc = ti->private;
         int ret = 0;
 
-        ret = fn(ti, dc->dev_read, dc->start_read, data);
+        ret = fn(ti, dc->dev_read, dc->start_read, ti->len, data);
         if (ret)
                 goto out;
 
         if (dc->dev_write)
-                ret = fn(ti, dc->dev_write, dc->start_write, data);
+                ret = fn(ti, dc->dev_write, dc->start_write, ti->len, data);
 
 out:
         return ret;
diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
index 9184b6deb868..82f7d6e6b1ea 100644
--- a/drivers/md/dm-linear.c
+++ b/drivers/md/dm-linear.c
@@ -139,7 +139,7 @@ static int linear_iterate_devices(struct dm_target *ti,
 {
         struct linear_c *lc = ti->private;
 
-        return fn(ti, lc->dev, lc->start, data);
+        return fn(ti, lc->dev, lc->start, ti->len, data);
 }
 
 static struct target_type linear_target = {
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index c70604a20897..6f0d90d4a541 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1453,7 +1453,7 @@ static int multipath_iterate_devices(struct dm_target *ti,
 
         list_for_each_entry(pg, &m->priority_groups, list) {
                 list_for_each_entry(p, &pg->pgpaths, list) {
-                        ret = fn(ti, p->path.dev, ti->begin, data);
+                        ret = fn(ti, p->path.dev, ti->begin, ti->len, data);
                         if (ret)
                                 goto out;
                 }
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index ce8868c768cc..9726577cde49 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -638,6 +638,7 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
                 spin_lock_irq(&ms->lock);
                 bio_list_merge(&ms->writes, &requeue);
                 spin_unlock_irq(&ms->lock);
+                delayed_wake(ms);
         }
 
         /*
@@ -1292,7 +1293,7 @@ static int mirror_iterate_devices(struct dm_target *ti,
 
         for (i = 0; !ret && i < ms->nr_mirrors; i++)
                 ret = fn(ti, ms->mirror[i].dev,
-                         ms->mirror[i].offset, data);
+                         ms->mirror[i].offset, ti->len, data);
 
         return ret;
 }
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index b240e85ae39a..4e0e5937e42a 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -320,10 +320,11 @@ static int stripe_iterate_devices(struct dm_target *ti,
         int ret = 0;
         unsigned i = 0;
 
-        do
+        do {
                 ret = fn(ti, sc->stripe[i].dev,
-                         sc->stripe[i].physical_start, data);
-        while (!ret && ++i < sc->stripes);
+                         sc->stripe[i].physical_start,
+                         sc->stripe_width, data);
+        } while (!ret && ++i < sc->stripes);
 
         return ret;
 }
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 2cba557d9e61..d952b3441913 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -346,7 +346,7 @@ static void close_dev(struct dm_dev_internal *d, struct mapped_device *md)
  * If possible, this checks an area of a destination device is valid.
  */
 static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
-                                sector_t start, void *data)
+                                sector_t start, sector_t len, void *data)
 {
         struct queue_limits *limits = data;
         struct block_device *bdev = dev->bdev;
@@ -359,7 +359,7 @@ static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
         if (!dev_size)
                 return 1;
 
-        if ((start >= dev_size) || (start + ti->len > dev_size)) {
+        if ((start >= dev_size) || (start + len > dev_size)) {
                 DMWARN("%s: %s too small for target",
                        dm_device_name(ti->table->md), bdevname(bdev, b));
                 return 0;
@@ -377,11 +377,11 @@ static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
                 return 0;
         }
 
-        if (ti->len & (logical_block_size_sectors - 1)) {
+        if (len & (logical_block_size_sectors - 1)) {
                 DMWARN("%s: len=%llu not aligned to h/w "
                        "logical block size %hu of %s",
                        dm_device_name(ti->table->md),
-                       (unsigned long long)ti->len,
+                       (unsigned long long)len,
                        limits->logical_block_size, bdevname(bdev, b));
                 return 0;
         }
@@ -482,7 +482,7 @@ static int __table_get_device(struct dm_table *t, struct dm_target *ti,
 #define min_not_zero(l, r) (l == 0) ? r : ((r == 0) ? l : min(l, r))
 
 int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
-                         sector_t start, void *data)
+                         sector_t start, sector_t len, void *data)
 {
         struct queue_limits *limits = data;
         struct block_device *bdev = dev->bdev;
@@ -830,11 +830,6 @@ unsigned dm_table_get_type(struct dm_table *t)
         return t->type;
 }
 
-bool dm_table_bio_based(struct dm_table *t)
-{
-        return dm_table_get_type(t) == DM_TYPE_BIO_BASED;
-}
-
 bool dm_table_request_based(struct dm_table *t)
 {
         return dm_table_get_type(t) == DM_TYPE_REQUEST_BASED;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 9acd54a5cffb..8a311ea0d441 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2203,16 +2203,6 @@ int dm_swap_table(struct mapped_device *md, struct dm_table *table)
                 goto out;
         }
 
-        /*
-         * It is enought that blk_queue_ordered() is called only once when
-         * the first bio-based table is bound.
-         *
-         * This setting should be moved to alloc_dev() when request-based dm
-         * supports barrier.
-         */
-        if (!md->map && dm_table_bio_based(table))
-                blk_queue_ordered(md->queue, QUEUE_ORDERED_DRAIN, NULL);
-
         __unbind(md);
         r = __bind(md, table, &limits);
 
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 23278ae80f08..a7663eba17e2 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -61,7 +61,6 @@ int dm_table_any_congested(struct dm_table *t, int bdi_bits);
 int dm_table_any_busy_target(struct dm_table *t);
 int dm_table_set_type(struct dm_table *t);
 unsigned dm_table_get_type(struct dm_table *t);
-bool dm_table_bio_based(struct dm_table *t);
 bool dm_table_request_based(struct dm_table *t);
 int dm_table_alloc_md_mempools(struct dm_table *t);
 void dm_table_free_md_mempools(struct dm_table *t);
diff --git a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
index efb4a6c2b57a..9a6307a347b2 100644
--- a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
+++ b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
@@ -20,8 +20,14 @@
 #include "tuner-simple.h"
 #include "stv0297.h"
 
+
+/* Can we use the specified front-end?  Remember that if we are compiled
+ * into the kernel we can't call code that's in modules.  */
+#define FE_SUPPORTED(fe) (defined(CONFIG_DVB_##fe) || \
+        (defined(CONFIG_DVB_##fe##_MODULE) && defined(MODULE)))
+
 /* lnb control */
-#if defined(CONFIG_DVB_MT312_MODULE) || defined(CONFIG_DVB_STV0299_MODULE)
+#if FE_SUPPORTED(MT312) || FE_SUPPORTED(STV0299)
 static int flexcop_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
 {
         struct flexcop_device *fc = fe->dvb->priv;
@@ -49,8 +55,7 @@ static int flexcop_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage
 }
 #endif
 
-#if defined(CONFIG_DVB_S5H1420_MODULE) || defined(CONFIG_DVB_STV0299_MODULE) \
-        || defined(CONFIG_DVB_MT312_MODULE)
+#if FE_SUPPORTED(S5H1420) || FE_SUPPORTED(STV0299) || FE_SUPPORTED(MT312)
 static int flexcop_sleep(struct dvb_frontend* fe)
 {
         struct flexcop_device *fc = fe->dvb->priv;
@@ -61,7 +66,7 @@ static int flexcop_sleep(struct dvb_frontend* fe)
 #endif
 
 /* SkyStar2 DVB-S rev 2.3 */
-#if defined(CONFIG_DVB_MT312_MODULE)
+#if FE_SUPPORTED(MT312)
 static int flexcop_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
 {
 /* u16 wz_half_period_for_45_mhz[] = { 0x01ff, 0x0154, 0x00ff, 0x00cc }; */
@@ -193,10 +198,12 @@ static int skystar2_rev23_attach(struct flexcop_device *fc,
         }
         return 0;
 }
+#else
+#define skystar2_rev23_attach NULL
 #endif
 
 /* SkyStar2 DVB-S rev 2.6 */
-#if defined(CONFIG_DVB_STV0299_MODULE)
+#if FE_SUPPORTED(STV0299)
 static int samsung_tbmu24112_set_symbol_rate(struct dvb_frontend *fe,
         u32 srate, u32 ratio)
 {
@@ -321,10 +328,12 @@ static int skystar2_rev26_attach(struct flexcop_device *fc,
         }
         return 0;
 }
+#else
+#define skystar2_rev26_attach NULL
 #endif
 
 /* SkyStar2 DVB-S rev 2.7 */
-#if defined(CONFIG_DVB_S5H1420_MODULE)
+#if FE_SUPPORTED(S5H1420) && FE_SUPPORTED(ISL6421) && FE_SUPPORTED(TUNER_ITD1000)
 static struct s5h1420_config skystar2_rev2_7_s5h1420_config = {
         .demod_address = 0x53,
         .invert = 1,
@@ -385,10 +394,12 @@ fail:
         fc->fc_i2c_adap[0].no_base_addr = 0;
         return 0;
 }
+#else
+#define skystar2_rev27_attach NULL
 #endif
 
 /* SkyStar2 rev 2.8 */
-#if defined(CONFIG_DVB_CX24123_MODULE)
+#if FE_SUPPORTED(CX24123) && FE_SUPPORTED(ISL6421) && FE_SUPPORTED(TUNER_CX24113)
 static struct cx24123_config skystar2_rev2_8_cx24123_config = {
         .demod_address = 0x55,
         .dont_use_pll = 1,
@@ -433,10 +444,12 @@ static int skystar2_rev28_attach(struct flexcop_device *fc,
          * IR-receiver (PIC16F818) - but the card has no input for that ??? */
         return 1;
 }
+#else
+#define skystar2_rev28_attach NULL
 #endif
 
 /* AirStar DVB-T */
-#if defined(CONFIG_DVB_MT352_MODULE)
+#if FE_SUPPORTED(MT352)
 static int samsung_tdtc9251dh0_demod_init(struct dvb_frontend *fe)
 {
         static u8 mt352_clock_config[] = { 0x89, 0x18, 0x2d };
@@ -495,10 +508,12 @@ static int airstar_dvbt_attach(struct flexcop_device *fc,
         }
         return 0;
 }
+#else
+#define airstar_dvbt_attach NULL
 #endif
 
 /* AirStar ATSC 1st generation */
-#if defined(CONFIG_DVB_BCM3510_MODULE)
+#if FE_SUPPORTED(BCM3510)
 static int flexcop_fe_request_firmware(struct dvb_frontend *fe,
         const struct firmware **fw, char* name)
 {
@@ -517,10 +532,12 @@ static int airstar_atsc1_attach(struct flexcop_device *fc,
         fc->fe = dvb_attach(bcm3510_attach, &air2pc_atsc_first_gen_config, i2c);
         return fc->fe != NULL;
 }
+#else
+#define airstar_atsc1_attach NULL
 #endif
 
 /* AirStar ATSC 2nd generation */
-#if defined(CONFIG_DVB_NXT200X_MODULE)
+#if FE_SUPPORTED(NXT200X) && FE_SUPPORTED(PLL)
 static struct nxt200x_config samsung_tbmv_config = {
         .demod_address = 0x0a,
 };
@@ -535,10 +552,12 @@ static int airstar_atsc2_attach(struct flexcop_device *fc,
         return !!dvb_attach(dvb_pll_attach, fc->fe, 0x61, NULL,
                             DVB_PLL_SAMSUNG_TBMV);
 }
+#else
+#define airstar_atsc2_attach NULL
 #endif
 
 /* AirStar ATSC 3rd generation */
-#if defined(CONFIG_DVB_LGDT330X_MODULE)
+#if FE_SUPPORTED(LGDT330X)
 static struct lgdt330x_config air2pc_atsc_hd5000_config = {
         .demod_address       = 0x59,
         .demod_chip          = LGDT3303,
@@ -556,10 +575,12 @@ static int airstar_atsc3_attach(struct flexcop_device *fc,
         return !!dvb_attach(simple_tuner_attach, fc->fe, i2c, 0x61,
                             TUNER_LG_TDVS_H06XF);
 }
+#else
+#define airstar_atsc3_attach NULL
 #endif
 
 /* CableStar2 DVB-C */
-#if defined(CONFIG_DVB_STV0297_MODULE)
+#if FE_SUPPORTED(STV0297)
 static int alps_tdee4_stv0297_tuner_set_params(struct dvb_frontend* fe,
                 struct dvb_frontend_parameters *fep)
 {
@@ -698,39 +719,23 @@ static int cablestar2_attach(struct flexcop_device *fc,
         fc->fe->ops.tuner_ops.set_params = alps_tdee4_stv0297_tuner_set_params;
         return 1;
 }
+#else
+#define cablestar2_attach NULL
 #endif
 
 static struct {
         flexcop_device_type_t type;
         int (*attach)(struct flexcop_device *, struct i2c_adapter *);
 } flexcop_frontends[] = {
-#if defined(CONFIG_DVB_S5H1420_MODULE)
         { FC_SKY_REV27, skystar2_rev27_attach },
-#endif
-#if defined(CONFIG_DVB_CX24123_MODULE)
         { FC_SKY_REV28, skystar2_rev28_attach },
-#endif
-#if defined(CONFIG_DVB_STV0299_MODULE)
         { FC_SKY_REV26, skystar2_rev26_attach },
-#endif
-#if defined(CONFIG_DVB_MT352_MODULE)
         { FC_AIR_DVBT, airstar_dvbt_attach },
-#endif
-#if defined(CONFIG_DVB_NXT200X_MODULE)
         { FC_AIR_ATSC2, airstar_atsc2_attach },
-#endif
-#if defined(CONFIG_DVB_LGDT330X_MODULE)
         { FC_AIR_ATSC3, airstar_atsc3_attach },
-#endif
-#if defined(CONFIG_DVB_BCM3510_MODULE)
         { FC_AIR_ATSC1, airstar_atsc1_attach },
-#endif
-#if defined(CONFIG_DVB_STV0297_MODULE)
         { FC_CABLE, cablestar2_attach },
-#endif
-#if defined(CONFIG_DVB_MT312_MODULE)
         { FC_SKY_REV23, skystar2_rev23_attach },
-#endif
 };
 
 /* try to figure out the frontend */
@@ -738,6 +743,8 @@ int flexcop_frontend_init(struct flexcop_device *fc)
 {
         int i;
         for (i = 0; i < ARRAY_SIZE(flexcop_frontends); i++) {
+                if (!flexcop_frontends[i].attach)
+                        continue;
                 /* type needs to be set before, because of some workarounds
                  * done based on the probed card type */
                 fc->dev_type = flexcop_frontends[i].type;
diff --git a/drivers/media/dvb/frontends/af9013.c b/drivers/media/dvb/frontends/af9013.c
index 136c5863d81b..12e018b4107d 100644
--- a/drivers/media/dvb/frontends/af9013.c
+++ b/drivers/media/dvb/frontends/af9013.c
@@ -527,6 +527,10 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
         u8 i, buf[3] = {0, 0, 0};
         *auto_mode = 0; /* set if parameters are requested to auto set */
 
+        /* Try auto-detect transmission parameters in case of AUTO requested or
+           garbage parameters given by application for compatibility.
+           MPlayer seems to provide garbage parameters currently. */
+
         switch (params->transmission_mode) {
         case TRANSMISSION_MODE_AUTO:
                 *auto_mode = 1;
@@ -536,7 +540,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[0] |= (1 << 0);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid transmission_mode\n", __func__);
+                *auto_mode = 1;
         }
 
         switch (params->guard_interval) {
@@ -554,7 +559,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[0] |= (3 << 2);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid guard_interval\n", __func__);
+                *auto_mode = 1;
         }
 
         switch (params->hierarchy_information) {
@@ -572,7 +578,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[0] |= (3 << 4);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid hierarchy_information\n", __func__);
+                *auto_mode = 1;
         };
 
         switch (params->constellation) {
@@ -587,7 +594,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[1] |= (2 << 6);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid constellation\n", __func__);
+                *auto_mode = 1;
         }
 
         /* Use HP. How and which case we can switch to LP? */
@@ -611,7 +619,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[2] |= (4 << 0);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid code_rate_HP\n", __func__);
+                *auto_mode = 1;
         }
 
         switch (params->code_rate_LP) {
@@ -638,7 +647,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 if (params->hierarchy_information == HIERARCHY_AUTO)
                         break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid code_rate_LP\n", __func__);
+                *auto_mode = 1;
         }
 
         switch (params->bandwidth) {
@@ -651,7 +661,8 @@ static int af9013_set_ofdm_params(struct af9013_state *state,
                 buf[1] |= (2 << 2);
                 break;
         default:
-                return -EINVAL;
+                deb_info("%s: invalid bandwidth\n", __func__);
+                buf[1] |= (2 << 2); /* cannot auto-detect BW, try 8 MHz */
         }
 
         /* program */
diff --git a/drivers/media/video/bt8xx/bttv-cards.c b/drivers/media/video/bt8xx/bttv-cards.c
index fdb4adff3d28..ca6558c394be 100644
--- a/drivers/media/video/bt8xx/bttv-cards.c
+++ b/drivers/media/video/bt8xx/bttv-cards.c
@@ -3324,8 +3324,6 @@ void __devinit bttv_init_card1(struct bttv *btv)
 /* initialization part two -- after registering i2c bus */
 void __devinit bttv_init_card2(struct bttv *btv)
 {
-        int addr=ADDR_UNSET;
-
         btv->tuner_type = UNSET;
 
         if (BTTV_BOARD_UNKNOWN == btv->c.type) {
@@ -3470,9 +3468,6 @@ void __devinit bttv_init_card2(struct bttv *btv)
         btv->pll.pll_current = -1;
 
         /* tuner configuration (from card list / autodetect / insmod option) */
-        if (ADDR_UNSET != bttv_tvcards[btv->c.type].tuner_addr)
-                addr = bttv_tvcards[btv->c.type].tuner_addr;
-
         if (UNSET != bttv_tvcards[btv->c.type].tuner_type)
                 if (UNSET == btv->tuner_type)
                         btv->tuner_type = bttv_tvcards[btv->c.type].tuner_type;
@@ -3496,40 +3491,6 @@ void __devinit bttv_init_card2(struct bttv *btv)
         if (UNSET == btv->tuner_type)
                 btv->tuner_type = TUNER_ABSENT;
 
-        if (btv->tuner_type != TUNER_ABSENT) {
-                struct tuner_setup tun_setup;
-
-                /* Load tuner module before issuing tuner config call! */
-                if (bttv_tvcards[btv->c.type].has_radio)
-                        v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, "tuner", "tuner",
-                                v4l2_i2c_tuner_addrs(ADDRS_RADIO));
-                v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, "tuner", "tuner",
-                                v4l2_i2c_tuner_addrs(ADDRS_DEMOD));
-                v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
-                                &btv->c.i2c_adap, "tuner", "tuner",
-                                v4l2_i2c_tuner_addrs(ADDRS_TV_WITH_DEMOD));
-
-                tun_setup.mode_mask = T_ANALOG_TV | T_DIGITAL_TV;
-                tun_setup.type = btv->tuner_type;
-                tun_setup.addr = addr;
-
-                if (bttv_tvcards[btv->c.type].has_radio)
-                        tun_setup.mode_mask |= T_RADIO;
-
-                bttv_call_all(btv, tuner, s_type_addr, &tun_setup);
-        }
-
-        if (btv->tda9887_conf) {
-                struct v4l2_priv_tun_config tda9887_cfg;
-
-                tda9887_cfg.tuner = TUNER_TDA9887;
-                tda9887_cfg.priv = &btv->tda9887_conf;
-
-                bttv_call_all(btv, tuner, s_config, &tda9887_cfg);
-        }
-
         btv->dig = bttv_tvcards[btv->c.type].has_dig_in ?
                    bttv_tvcards[btv->c.type].video_inputs - 1 : UNSET;
         btv->svhs = bttv_tvcards[btv->c.type].svhs == NO_SVHS ?
@@ -3540,15 +3501,15 @@ void __devinit bttv_init_card2(struct bttv *btv)
                 btv->has_remote = remote[btv->c.nr];
 
         if (bttv_tvcards[btv->c.type].has_radio)
-                btv->has_radio=1;
+                btv->has_radio = 1;
         if (bttv_tvcards[btv->c.type].has_remote)
-                btv->has_remote=1;
+                btv->has_remote = 1;
         if (!bttv_tvcards[btv->c.type].no_gpioirq)
-                btv->gpioirq=1;
+                btv->gpioirq = 1;
         if (bttv_tvcards[btv->c.type].volume_gpio)
-                btv->volume_gpio=bttv_tvcards[btv->c.type].volume_gpio;
+                btv->volume_gpio = bttv_tvcards[btv->c.type].volume_gpio;
         if (bttv_tvcards[btv->c.type].audio_mode_gpio)
-                btv->audio_mode_gpio=bttv_tvcards[btv->c.type].audio_mode_gpio;
+                btv->audio_mode_gpio = bttv_tvcards[btv->c.type].audio_mode_gpio;
 
         if (btv->tuner_type == TUNER_ABSENT)
                 return;  /* no tuner or related drivers to load */
@@ -3666,6 +3627,49 @@ no_audio:
 }
 
 
+/* initialize the tuner */
+void __devinit bttv_init_tuner(struct bttv *btv)
+{
+        int addr = ADDR_UNSET;
+
+        if (ADDR_UNSET != bttv_tvcards[btv->c.type].tuner_addr)
+                addr = bttv_tvcards[btv->c.type].tuner_addr;
+
+        if (btv->tuner_type != TUNER_ABSENT) {
+                struct tuner_setup tun_setup;
+
+                /* Load tuner module before issuing tuner config call! */
+                if (bttv_tvcards[btv->c.type].has_radio)
+                        v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
+                                &btv->c.i2c_adap, "tuner", "tuner",
+                                v4l2_i2c_tuner_addrs(ADDRS_RADIO));
+                v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
+                                &btv->c.i2c_adap, "tuner", "tuner",
+                                v4l2_i2c_tuner_addrs(ADDRS_DEMOD));
+                v4l2_i2c_new_probed_subdev(&btv->c.v4l2_dev,
+                                &btv->c.i2c_adap, "tuner", "tuner",
+                                v4l2_i2c_tuner_addrs(ADDRS_TV_WITH_DEMOD));
+
+                tun_setup.mode_mask = T_ANALOG_TV | T_DIGITAL_TV;
+                tun_setup.type = btv->tuner_type;
+                tun_setup.addr = addr;
+
+                if (bttv_tvcards[btv->c.type].has_radio)
+                        tun_setup.mode_mask |= T_RADIO;
+
+                bttv_call_all(btv, tuner, s_type_addr, &tun_setup);
+        }
+
+        if (btv->tda9887_conf) {
+                struct v4l2_priv_tun_config tda9887_cfg;
+
+                tda9887_cfg.tuner = TUNER_TDA9887;
+                tda9887_cfg.priv = &btv->tda9887_conf;
+
+                bttv_call_all(btv, tuner, s_config, &tda9887_cfg);
+        }
+}
+
 /* ----------------------------------------------------------------------- */
 
 static void modtec_eeprom(struct bttv *btv)
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index d147d29bb0d3..8cc6dd28d6a7 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -4419,6 +4419,7 @@ static int __devinit bttv_probe(struct pci_dev *dev,
 
         /* some card-specific stuff (needs working i2c) */
         bttv_init_card2(btv);
+        bttv_init_tuner(btv);
         init_irqreg(btv);
 
         /* register video4linux + input */
diff --git a/drivers/media/video/bt8xx/bttv.h b/drivers/media/video/bt8xx/bttv.h
index 3d36daf206f3..3ec2402c6b4a 100644
--- a/drivers/media/video/bt8xx/bttv.h
+++ b/drivers/media/video/bt8xx/bttv.h
@@ -283,6 +283,7 @@ extern struct tvcard bttv_tvcards[];
 extern void bttv_idcard(struct bttv *btv);
 extern void bttv_init_card1(struct bttv *btv);
 extern void bttv_init_card2(struct bttv *btv);
+extern void bttv_init_tuner(struct bttv *btv);
 
 /* card-specific funtions */
 extern void tea5757_set_freq(struct bttv *btv, unsigned short freq);
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index 428f0c45e6b7..e0cf21e0b1bf 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -58,7 +58,8 @@ MODULE_PARM_DESC(v4l_debug, "enable V4L debug messages");
 
 #define dprintk(level, fmt, arg...)\
         do { if (v4l_debug >= level) \
-                printk(KERN_DEBUG "%s: " fmt, dev->name , ## arg);\
+                printk(KERN_DEBUG "%s: " fmt, \
+                (dev) ? dev->name : "cx23885[?]", ## arg); \
         } while (0)
 
 static struct cx23885_tvnorm cx23885_tvnorms[] = {
@@ -1677,6 +1678,7 @@ static struct v4l2_file_operations mpeg_fops = {
         .read          = mpeg_read,
         .poll          = mpeg_poll,
         .mmap          = mpeg_mmap,
+        .ioctl         = video_ioctl2,
 };
 
 static const struct v4l2_ioctl_ops mpeg_ioctl_ops = {
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index ebd24a25fb85..320f1f60276e 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -58,8 +58,6 @@ static unsigned int card[]     = {[0 ... (EM28XX_MAXBOARDS - 1)] = UNSET };
 module_param_array(card,  int, NULL, 0444);
 MODULE_PARM_DESC(card,     "card type");
 
-#define MT9V011_VERSION                 0x8243
-
 /* Bitmask marking allocated devices from 0 to EM28XX_MAXBOARDS */
 static unsigned long em28xx_devused;
 
@@ -159,6 +157,20 @@ static struct em28xx_reg_seq evga_indtube_digital[] = {
         { -1,                   -1,     -1,             -1},
 };
 
+/* Pinnacle Hybrid Pro eb1a:2881 */
+static struct em28xx_reg_seq pinnacle_hybrid_pro_analog[] = {
+        {EM28XX_R08_GPIO,       0xfd,   ~EM_GPIO_4,     10},
+        {       -1,             -1,     -1,             -1},
+};
+
+static struct em28xx_reg_seq pinnacle_hybrid_pro_digital[] = {
+        {EM28XX_R08_GPIO,       0x6e,   ~EM_GPIO_4,     10},
+        {EM2880_R04_GPO,        0x04,   0xff,          100},/* zl10353 reset */
+        {EM2880_R04_GPO,        0x0c,   0xff,            1},
+        {       -1,             -1,     -1,             -1},
+};
+
+
 /* Callback for the most boards */
 static struct em28xx_reg_seq default_tuner_gpio[] = {
         {EM28XX_R08_GPIO,       EM_GPIO_4,      EM_GPIO_4,      10},
@@ -205,13 +217,15 @@ static struct em28xx_reg_seq silvercrest_reg_seq[] = {
  */
 struct em28xx_board em28xx_boards[] = {
         [EM2750_BOARD_UNKNOWN] = {
-                .name          = "Unknown EM2750/EM2751 webcam grabber",
+                .name          = "EM2710/EM2750/EM2751 webcam grabber",
                 .xclk          = EM28XX_XCLK_FREQUENCY_48MHZ,
-                .tuner_type    = TUNER_ABSENT,  /* This is a webcam */
+                .tuner_type    = TUNER_ABSENT,
+                .is_webcam     = 1,
                 .input         = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
                         .amux     = EM28XX_AMUX_VIDEO,
+                        .gpio     = silvercrest_reg_seq,
                 } },
         },
         [EM2800_BOARD_UNKNOWN] = {
@@ -233,13 +247,15 @@ struct em28xx_board em28xx_boards[] = {
         [EM2820_BOARD_UNKNOWN] = {
                 .name          = "Unknown EM2750/28xx video grabber",
                 .tuner_type    = TUNER_ABSENT,
+                .is_webcam     = 1,     /* To enable sensor probe */
         },
         [EM2750_BOARD_DLCW_130] = {
                 /* Beijing Huaqi Information Digital Technology Co., Ltd */
                 .name          = "Huaqi DLCW-130",
                 .valid         = EM28XX_BOARD_NOT_VALIDATED,
                 .xclk          = EM28XX_XCLK_FREQUENCY_48MHZ,
-                .tuner_type    = TUNER_ABSENT,  /* This is a webcam */
+                .tuner_type    = TUNER_ABSENT,
+                .is_webcam     = 1,
                 .input         = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
@@ -440,7 +456,8 @@ struct em28xx_board em28xx_boards[] = {
         [EM2820_BOARD_VIDEOLOGY_20K14XUSB] = {
                 .name         = "Videology 20K14XUSB USB2.0",
                 .valid        = EM28XX_BOARD_NOT_VALIDATED,
-                .tuner_type   = TUNER_ABSENT,   /* This is a webcam */
+                .tuner_type   = TUNER_ABSENT,
+                .is_webcam    = 1,
                 .input        = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
@@ -450,8 +467,7 @@ struct em28xx_board em28xx_boards[] = {
         [EM2820_BOARD_SILVERCREST_WEBCAM] = {
                 .name         = "Silvercrest Webcam 1.3mpix",
                 .tuner_type   = TUNER_ABSENT,
-                .is_27xx      = 1,
-                .decoder      = EM28XX_MT9V011,
+                .is_webcam    = 1,
                 .input        = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
@@ -500,7 +516,8 @@ struct em28xx_board em28xx_boards[] = {
                 /* Beijing Huaqi Information Digital Technology Co., Ltd */
                 .name         = "NetGMBH Cam",
                 .valid        = EM28XX_BOARD_NOT_VALIDATED,
-                .tuner_type   = TUNER_ABSENT,   /* This is a webcam */
+                .tuner_type   = TUNER_ABSENT,
+                .is_webcam    = 1,
                 .input        = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = 0,
@@ -1250,25 +1267,26 @@ struct em28xx_board em28xx_boards[] = {
         },
         [EM2881_BOARD_PINNACLE_HYBRID_PRO] = {
                 .name         = "Pinnacle Hybrid Pro",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
                 .tuner_type   = TUNER_XC2028,
                 .tuner_gpio   = default_tuner_gpio,
                 .decoder      = EM28XX_TVP5150,
+                .has_dvb      = 1,
+                .dvb_gpio     = pinnacle_hybrid_pro_digital,
                 .input        = { {
                         .type     = EM28XX_VMUX_TELEVISION,
                         .vmux     = TVP5150_COMPOSITE0,
                         .amux     = EM28XX_AMUX_VIDEO,
-                        .gpio     = default_analog,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                 }, {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = TVP5150_COMPOSITE1,
                         .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = default_analog,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                 }, {
                         .type     = EM28XX_VMUX_SVIDEO,
                         .vmux     = TVP5150_SVIDEO,
                         .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = default_analog,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                 } },
         },
         [EM2882_BOARD_PINNACLE_HYBRID_PRO] = {
@@ -1638,6 +1656,7 @@ static struct em28xx_hash_table em28xx_eeprom_hash[] = {
         {0x966a0441, EM2880_BOARD_KWORLD_DVB_310U, TUNER_XC2028},
         {0x9567eb1a, EM2880_BOARD_EMPIRE_DUAL_TV, TUNER_XC2028},
         {0xcee44a99, EM2882_BOARD_EVGA_INDTUBE, TUNER_XC2028},
+        {0xb8846b20, EM2881_BOARD_PINNACLE_HYBRID_PRO, TUNER_XC2028},
 };
 
 /* I2C devicelist hash table for devices with generic USB IDs */
@@ -1704,6 +1723,32 @@ static inline void em28xx_set_model(struct em28xx *dev)
                                        EM28XX_I2C_FREQ_100_KHZ;
 }
 
+/* FIXME: Should be replaced by a proper mt9m001 driver */
+static int em28xx_initialize_mt9m001(struct em28xx *dev)
+{
+        int i;
+        unsigned char regs[][3] = {
+                { 0x0d, 0x00, 0x01, },
+                { 0x0d, 0x00, 0x00, },
+                { 0x04, 0x05, 0x00, },  /* hres = 1280 */
+                { 0x03, 0x04, 0x00, },  /* vres = 1024 */
+                { 0x20, 0x11, 0x00, },
+                { 0x06, 0x00, 0x10, },
+                { 0x2b, 0x00, 0x24, },
+                { 0x2e, 0x00, 0x24, },
+                { 0x35, 0x00, 0x24, },
+                { 0x2d, 0x00, 0x20, },
+                { 0x2c, 0x00, 0x20, },
+                { 0x09, 0x0a, 0xd4, },
+                { 0x35, 0x00, 0x57, },
+        };
+
+        for (i = 0; i < ARRAY_SIZE(regs); i++)
+                i2c_master_send(&dev->i2c_client, &regs[i][0], 3);
+
+        return 0;
+}
+
 /* HINT method: webcam I2C chips
  *
  * This method work for webcams with Micron sensors
@@ -1716,9 +1761,6 @@ static int em28xx_hint_sensor(struct em28xx *dev)
         __be16 version_be;
         u16 version;
 
-        if (dev->model != EM2820_BOARD_UNKNOWN)
-                return 0;
-
         dev->i2c_client.addr = 0xba >> 1;
         cmd = 0;
         i2c_master_send(&dev->i2c_client, &cmd, 1);
@@ -1729,16 +1771,38 @@ static int em28xx_hint_sensor(struct em28xx *dev)
         version = be16_to_cpu(version_be);
 
         switch (version) {
-        case MT9V011_VERSION:
+        case 0x8243:            /* mt9v011 640x480 1.3 Mpix sensor */
                 dev->model = EM2820_BOARD_SILVERCREST_WEBCAM;
                 sensor_name = "mt9v011";
+                dev->em28xx_sensor = EM28XX_MT9V011;
+                dev->sensor_xres = 640;
+                dev->sensor_yres = 480;
+                dev->sensor_xtal = 6300000;
+
+                /* probably means GRGB 16 bit bayer */
+                dev->vinmode = 0x0d;
+                dev->vinctl = 0x00;
+
+                break;
+        case 0x8431:
+                dev->model = EM2750_BOARD_UNKNOWN;
+                sensor_name = "mt9m001";
+                dev->em28xx_sensor = EM28XX_MT9M001;
+                em28xx_initialize_mt9m001(dev);
+                dev->sensor_xres = 1280;
+                dev->sensor_yres = 1024;
+
+                /* probably means BGGR 16 bit bayer */
+                dev->vinmode = 0x0c;
+                dev->vinctl = 0x00;
+
                 break;
         default:
-                printk("Unknown Sensor 0x%04x\n", be16_to_cpu(version));
+                printk("Unknown Micron Sensor 0x%04x\n", be16_to_cpu(version));
                 return -EINVAL;
         }
 
-        em28xx_errdev("Sensor is %s, assuming that webcam is %s\n",
+        em28xx_errdev("Sensor is %s, using model %s entry.\n",
                       sensor_name, em28xx_boards[dev->model].name);
 
         return 0;
@@ -1772,10 +1836,7 @@ void em28xx_pre_card_setup(struct em28xx *dev)
                         em28xx_info("chip ID is em2750\n");
                         break;
                 case CHIP_ID_EM2820:
-                        if (dev->board.is_27xx)
-                                em28xx_info("chip is em2710\n");
-                        else
-                                em28xx_info("chip ID is em2820\n");
+                        em28xx_info("chip ID is em2710 or em2820\n");
                         break;
                 case CHIP_ID_EM2840:
                         em28xx_info("chip ID is em2840\n");
@@ -1929,6 +1990,7 @@ static void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
                 ctl->demod = XC3028_FE_ZARLINK456;
                 break;
         case EM2880_BOARD_TERRATEC_HYBRID_XS:
+        case EM2881_BOARD_PINNACLE_HYBRID_PRO:
                 ctl->demod = XC3028_FE_ZARLINK456;
                 break;
         case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900_R2:
@@ -2225,6 +2287,7 @@ void em28xx_card_setup(struct em28xx *dev)
                    em28xx_set_mode() in em28xx_pre_card_setup() was a no-op,
                    so make the call now so the analog GPIOs are set properly
                    before probing the i2c bus. */
+                em28xx_gpio_set(dev, dev->board.tuner_gpio);
                 em28xx_set_mode(dev, EM28XX_ANALOG_MODE);
                 break;
         case EM2820_BOARD_SILVERCREST_WEBCAM:
@@ -2262,9 +2325,14 @@ void em28xx_card_setup(struct em28xx *dev)
                 v4l2_i2c_new_probed_subdev(&dev->v4l2_dev, &dev->i2c_adap,
                         "tvp5150", "tvp5150", tvp5150_addrs);
 
-        if (dev->board.decoder == EM28XX_MT9V011)
-                v4l2_i2c_new_probed_subdev(&dev->v4l2_dev, &dev->i2c_adap,
-                        "mt9v011", "mt9v011", mt9v011_addrs);
+        if (dev->em28xx_sensor == EM28XX_MT9V011) {
+                struct v4l2_subdev *sd;
+
+                sd = v4l2_i2c_new_probed_subdev(&dev->v4l2_dev,
+                         &dev->i2c_adap, "mt9v011", "mt9v011", mt9v011_addrs);
+                v4l2_subdev_call(sd, core, s_config, 0, &dev->sensor_xtal);
+        }
+
 
         if (dev->board.adecoder == EM28XX_TVAUDIO)
                 v4l2_i2c_new_subdev(&dev->v4l2_dev, &dev->i2c_adap,
@@ -2410,7 +2478,19 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                 return errCode;
         }
 
-        em28xx_hint_sensor(dev);
+        /*
+         * Default format, used for tvp5150 or saa711x output formats
+         */
+        dev->vinmode = 0x10;
+        dev->vinctl  = 0x11;
+
+        /*
+         * If the device can be a webcam, seek for a sensor.
+         * If sensor is not found, then it isn't a webcam.
+         */
+        if (dev->board.is_webcam)
+                if (em28xx_hint_sensor(dev) < 0)
+                        dev->board.is_webcam = 0;
 
         /* Do board specific init and eeprom reading */
         em28xx_card_setup(dev);
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 079ab4d563a6..5b78e199abd1 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -648,28 +648,17 @@ int em28xx_capture_start(struct em28xx *dev, int start)
 int em28xx_set_outfmt(struct em28xx *dev)
 {
         int ret;
-        int vinmode, vinctl, outfmt;
-
-        outfmt  = dev->format->reg;
-
-        if (dev->board.is_27xx) {
-                vinmode = 0x0d;
-                vinctl  = 0x00;
-        } else {
-                vinmode = 0x10;
-                vinctl  = 0x11;
-        }
 
         ret = em28xx_write_reg_bits(dev, EM28XX_R27_OUTFMT,
-                                outfmt | 0x20, 0xff);
+                                dev->format->reg | 0x20, 0xff);
         if (ret < 0)
                         return ret;
 
-        ret = em28xx_write_reg(dev, EM28XX_R10_VINMODE, vinmode);
+        ret = em28xx_write_reg(dev, EM28XX_R10_VINMODE, dev->vinmode);
         if (ret < 0)
                 return ret;
 
-        return em28xx_write_reg(dev, EM28XX_R11_VINCTRL, vinctl);
+        return em28xx_write_reg(dev, EM28XX_R11_VINCTRL, dev->vinctl);
 }
 
 static int em28xx_accumulator_set(struct em28xx *dev, u8 xmin, u8 xmax,
@@ -707,10 +696,7 @@ static int em28xx_scaler_set(struct em28xx *dev, u16 h, u16 v)
         u8 mode;
         /* the em2800 scaler only supports scaling down to 50% */
 
-        if (dev->board.is_27xx) {
-                /* FIXME: Don't use the scaler yet */
-                mode = 0;
-        } else if (dev->board.is_em2800) {
+        if (dev->board.is_em2800) {
                 mode = (v ? 0x20 : 0x00) | (h ? 0x10 : 0x00);
         } else {
                 u8 buf[2];
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index 3da97c32b8fa..cf0ac7f2a30d 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -31,6 +31,8 @@
 #include "lgdt330x.h"
 #include "zl10353.h"
 #include "s5h1409.h"
+#include "mt352.h"
+#include "mt352_priv.h" /* FIXME */
 
 MODULE_DESCRIPTION("driver for em28xx based DVB cards");
 MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@infradead.org>");
@@ -243,7 +245,7 @@ static struct s5h1409_config em28xx_s5h1409_with_xc3028 = {
         .mpeg_timing   = S5H1409_MPEGTIMING_CONTINOUS_NONINVERTING_CLOCK
 };
 
-static struct zl10353_config em28xx_terratec_xs_zl10353_xc3028 = {
+static struct zl10353_config em28xx_zl10353_xc3028_no_i2c_gate = {
         .demod_address = (0x1e >> 1),
         .no_tuner = 1,
         .disable_i2c_gate_ctrl = 1,
@@ -258,6 +260,41 @@ static struct drx397xD_config em28xx_drx397xD_with_xc3028 = {
 };
 #endif
 
+static int mt352_terratec_xs_init(struct dvb_frontend *fe)
+{
+        /* Values extracted from a USB trace of the Terratec Windows driver */
+        static u8 clock_config[]   = { CLOCK_CTL,  0x38, 0x2c };
+        static u8 reset[]          = { RESET,      0x80 };
+        static u8 adc_ctl_1_cfg[]  = { ADC_CTL_1,  0x40 };
+        static u8 agc_cfg[]        = { AGC_TARGET, 0x28, 0xa0 };
+        static u8 input_freq_cfg[] = { INPUT_FREQ_1, 0x31, 0xb8 };
+        static u8 rs_err_cfg[]     = { RS_ERR_PER_1, 0x00, 0x4d };
+        static u8 capt_range_cfg[] = { CAPT_RANGE, 0x32 };
+        static u8 trl_nom_cfg[]    = { TRL_NOMINAL_RATE_1, 0x64, 0x00 };
+        static u8 tps_given_cfg[]  = { TPS_GIVEN_1, 0x40, 0x80, 0x50 };
+        static u8 tuner_go[]       = { TUNER_GO, 0x01};
+
+        mt352_write(fe, clock_config,   sizeof(clock_config));
+        udelay(200);
+        mt352_write(fe, reset,          sizeof(reset));
+        mt352_write(fe, adc_ctl_1_cfg,  sizeof(adc_ctl_1_cfg));
+        mt352_write(fe, agc_cfg,        sizeof(agc_cfg));
+        mt352_write(fe, input_freq_cfg, sizeof(input_freq_cfg));
+        mt352_write(fe, rs_err_cfg,     sizeof(rs_err_cfg));
+        mt352_write(fe, capt_range_cfg, sizeof(capt_range_cfg));
+        mt352_write(fe, trl_nom_cfg,    sizeof(trl_nom_cfg));
+        mt352_write(fe, tps_given_cfg,  sizeof(tps_given_cfg));
+        mt352_write(fe, tuner_go,       sizeof(tuner_go));
+        return 0;
+}
+
+static struct mt352_config terratec_xs_mt352_cfg = {
+        .demod_address = (0x1e >> 1),
+        .no_tuner = 1,
+        .if2 = 45600,
+        .demod_init = mt352_terratec_xs_init,
+};
+
 /* ------------------------------------------------------------------ */
 
 static int attach_xc3028(u8 addr, struct em28xx *dev)
@@ -440,7 +477,6 @@ static int dvb_init(struct em28xx *dev)
                         goto out_free;
                 }
                 break;
-        case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
         case EM2880_BOARD_KWORLD_DVB_310U:
         case EM2880_BOARD_EMPIRE_DUAL_TV:
                 dvb->frontend = dvb_attach(zl10353_attach,
@@ -451,20 +487,28 @@ static int dvb_init(struct em28xx *dev)
                         goto out_free;
                 }
                 break;
+        case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
+                dvb->frontend = dvb_attach(zl10353_attach,
+                                           &em28xx_zl10353_xc3028_no_i2c_gate,
+                                           &dev->i2c_adap);
+                if (attach_xc3028(0x61, dev) < 0) {
+                        result = -EINVAL;
+                        goto out_free;
+                }
+                break;
         case EM2880_BOARD_TERRATEC_HYBRID_XS:
+        case EM2881_BOARD_PINNACLE_HYBRID_PRO:
                 dvb->frontend = dvb_attach(zl10353_attach,
-                                           &em28xx_terratec_xs_zl10353_xc3028,
+                                           &em28xx_zl10353_xc3028_no_i2c_gate,
                                            &dev->i2c_adap);
                 if (dvb->frontend == NULL) {
                         /* This board could have either a zl10353 or a mt352.
                            If the chip id isn't for zl10353, try mt352 */
-
-                        /* FIXME: make support for mt352 work */
-                        printk(KERN_ERR "version of this board with mt352 not "
-                               "currently supported\n");
-                        result = -EINVAL;
-                        goto out_free;
+                        dvb->frontend = dvb_attach(mt352_attach,
+                                                   &terratec_xs_mt352_cfg,
+                                                   &dev->i2c_adap);
                 }
+
                 if (attach_xc3028(0x61, dev) < 0) {
                         result = -EINVAL;
                         goto out_free;
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 14316c912179..ff37b4c15f44 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -657,8 +657,8 @@ static void get_scale(struct em28xx *dev,
                         unsigned int width, unsigned int height,
                         unsigned int *hscale, unsigned int *vscale)
 {
-        unsigned int          maxw   = norm_maxw(dev);
-        unsigned int          maxh   = norm_maxh(dev);
+        unsigned int          maxw = norm_maxw(dev);
+        unsigned int          maxh = norm_maxh(dev);
 
         *hscale = (((unsigned long)maxw) << 12) / width - 4096L;
         if (*hscale >= 0x4000)
@@ -726,11 +726,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
                 return -EINVAL;
         }
 
-        if (dev->board.is_27xx) {
-                /* FIXME: This is the only supported fmt */
-                width  = 640;
-                height = 480;
-        } else if (dev->board.is_em2800) {
+        if (dev->board.is_em2800) {
                 /* the em2800 can only scale down to 50% */
                 height = height > (3 * maxh / 4) ? maxh : maxh / 2;
                 width = width > (3 * maxw / 4) ? maxw : maxw / 2;
@@ -767,12 +763,6 @@ static int em28xx_set_video_format(struct em28xx *dev, unsigned int fourcc,
 {
         struct em28xx_fmt     *fmt;
 
-        /* FIXME: This is the only supported fmt */
-        if (dev->board.is_27xx) {
-                width  = 640;
-                height = 480;
-        }
-
         fmt = format_by_fourcc(fourcc);
         if (!fmt)
                 return -EINVAL;
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index d90fef463764..45bd513f62dc 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -358,10 +358,15 @@ struct em28xx_input {
 #define INPUT(nr) (&em28xx_boards[dev->model].input[nr])
 
 enum em28xx_decoder {
-        EM28XX_NODECODER,
+        EM28XX_NODECODER = 0,
         EM28XX_TVP5150,
         EM28XX_SAA711X,
+};
+
+enum em28xx_sensor {
+        EM28XX_NOSENSOR = 0,
         EM28XX_MT9V011,
+        EM28XX_MT9M001,
 };
 
 enum em28xx_adecoder {
@@ -390,7 +395,7 @@ struct em28xx_board {
         unsigned int max_range_640_480:1;
         unsigned int has_dvb:1;
         unsigned int has_snapshot_button:1;
-        unsigned int is_27xx:1;
+        unsigned int is_webcam:1;
         unsigned int valid:1;
 
         unsigned char xclk, i2c_speed;
@@ -474,6 +479,14 @@ struct em28xx {
         struct v4l2_device v4l2_dev;
         struct em28xx_board board;
 
+        /* Webcam specific fields */
+        enum em28xx_sensor em28xx_sensor;
+        int sensor_xres, sensor_yres;
+        int sensor_xtal;
+
+        /* Vinmode/Vinctl used at the driver */
+        int vinmode, vinctl;
+
         unsigned int stream_on:1;       /* Locks streams */
         unsigned int has_audio_class:1;
         unsigned int has_alsa_audio:1;
@@ -754,17 +767,23 @@ static inline int em28xx_gamma_set(struct em28xx *dev, s32 val)
 /*FIXME: maxw should be dependent of alt mode */
 static inline unsigned int norm_maxw(struct em28xx *dev)
 {
+        if (dev->board.is_webcam)
+                return dev->sensor_xres;
+
         if (dev->board.max_range_640_480)
                 return 640;
-        else
-                return 720;
+
+        return 720;
 }
 
 static inline unsigned int norm_maxh(struct em28xx *dev)
 {
+        if (dev->board.is_webcam)
+                return dev->sensor_yres;
+
         if (dev->board.max_range_640_480)
                 return 480;
-        else
-                return (dev->norm & V4L2_STD_625_50) ? 576 : 480;
+
+        return (dev->norm & V4L2_STD_625_50) ? 576 : 480;
 }
 #endif
diff --git a/drivers/media/video/gspca/Kconfig b/drivers/media/video/gspca/Kconfig
index 578dc4ffc965..34f46f2bc040 100644
--- a/drivers/media/video/gspca/Kconfig
+++ b/drivers/media/video/gspca/Kconfig
@@ -102,6 +102,22 @@ config USB_GSPCA_PAC7311
           To compile this driver as a module, choose M here: the
           module will be called gspca_pac7311.
 
+config USB_GSPCA_SN9C20X
+       tristate "SN9C20X USB Camera Driver"
+       depends on VIDEO_V4L2 && USB_GSPCA
+       help
+         Say Y here if you want support for cameras based on the
+         sn9c20x chips (SN9C201 and SN9C202).
+
+         To compile this driver as a module, choose M here: the
+         module will be called gspca_sn9c20x.
+
+config USB_GSPCA_SN9C20X_EVDEV
+       bool "Enable evdev support"
+       depends on USB_GSPCA_SN9C20X
+       ---help---
+         Say Y here in order to enable evdev support for sn9c20x webcam button.
+
 config USB_GSPCA_SONIXB
         tristate "SONIX Bayer USB Camera Driver"
         depends on VIDEO_V4L2 && USB_GSPCA
diff --git a/drivers/media/video/gspca/Makefile b/drivers/media/video/gspca/Makefile
index 8a6643e8eb96..f6d3b86e9ad5 100644
--- a/drivers/media/video/gspca/Makefile
+++ b/drivers/media/video/gspca/Makefile
@@ -8,6 +8,7 @@ obj-$(CONFIG_USB_GSPCA_OV519)    += gspca_ov519.o
 obj-$(CONFIG_USB_GSPCA_OV534)    += gspca_ov534.o
 obj-$(CONFIG_USB_GSPCA_PAC207)   += gspca_pac207.o
 obj-$(CONFIG_USB_GSPCA_PAC7311)  += gspca_pac7311.o
+obj-$(CONFIG_USB_GSPCA_SN9C20X)  += gspca_sn9c20x.o
 obj-$(CONFIG_USB_GSPCA_SONIXB)   += gspca_sonixb.o
 obj-$(CONFIG_USB_GSPCA_SONIXJ)   += gspca_sonixj.o
 obj-$(CONFIG_USB_GSPCA_SPCA500)  += gspca_spca500.o
@@ -35,6 +36,7 @@ gspca_ov519-objs    := ov519.o
 gspca_ov534-objs    := ov534.o
 gspca_pac207-objs   := pac207.o
 gspca_pac7311-objs  := pac7311.o
+gspca_sn9c20x-objs  := sn9c20x.o
 gspca_sonixb-objs   := sonixb.o
 gspca_sonixj-objs   := sonixj.o
 gspca_spca500-objs  := spca500.o
diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index 219cfa6fb877..8d48ea1742c2 100644
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -846,6 +846,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x22);          /* JPEG 411 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 1e89600986c8..b8561dfb6c8c 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -727,6 +727,74 @@ static int gspca_get_mode(struct gspca_dev *gspca_dev,
         return -EINVAL;
 }
 
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int vidioc_g_register(struct file *file, void *priv,
+                        struct v4l2_dbg_register *reg)
+{
+        int ret;
+        struct gspca_dev *gspca_dev = priv;
+
+        if (!gspca_dev->sd_desc->get_chip_ident)
+                return -EINVAL;
+
+        if (!gspca_dev->sd_desc->get_register)
+                return -EINVAL;
+
+        if (mutex_lock_interruptible(&gspca_dev->usb_lock))
+                return -ERESTARTSYS;
+        if (gspca_dev->present)
+                ret = gspca_dev->sd_desc->get_register(gspca_dev, reg);
+        else
+                ret = -ENODEV;
+        mutex_unlock(&gspca_dev->usb_lock);
+
+        return ret;
+}
+
+static int vidioc_s_register(struct file *file, void *priv,
+                        struct v4l2_dbg_register *reg)
+{
+        int ret;
+        struct gspca_dev *gspca_dev = priv;
+
+        if (!gspca_dev->sd_desc->get_chip_ident)
+                return -EINVAL;
+
+        if (!gspca_dev->sd_desc->set_register)
+                return -EINVAL;
+
+        if (mutex_lock_interruptible(&gspca_dev->usb_lock))
+                return -ERESTARTSYS;
+        if (gspca_dev->present)
+                ret = gspca_dev->sd_desc->set_register(gspca_dev, reg);
+        else
+                ret = -ENODEV;
+        mutex_unlock(&gspca_dev->usb_lock);
+
+        return ret;
+}
+#endif
+
+static int vidioc_g_chip_ident(struct file *file, void *priv,
+                        struct v4l2_dbg_chip_ident *chip)
+{
+        int ret;
+        struct gspca_dev *gspca_dev = priv;
+
+        if (!gspca_dev->sd_desc->get_chip_ident)
+                return -EINVAL;
+
+        if (mutex_lock_interruptible(&gspca_dev->usb_lock))
+                return -ERESTARTSYS;
+        if (gspca_dev->present)
+                ret = gspca_dev->sd_desc->get_chip_ident(gspca_dev, chip);
+        else
+                ret = -ENODEV;
+        mutex_unlock(&gspca_dev->usb_lock);
+
+        return ret;
+}
+
 static int vidioc_enum_fmt_vid_cap(struct file *file, void  *priv,
                                 struct v4l2_fmtdesc *fmtdesc)
 {
@@ -1883,6 +1951,11 @@ static const struct v4l2_ioctl_ops dev_ioctl_ops = {
         .vidioc_s_parm          = vidioc_s_parm,
         .vidioc_s_std           = vidioc_s_std,
         .vidioc_enum_framesizes = vidioc_enum_framesizes,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        .vidioc_g_register      = vidioc_g_register,
+        .vidioc_s_register      = vidioc_s_register,
+#endif
+        .vidioc_g_chip_ident    = vidioc_g_chip_ident,
 #ifdef CONFIG_VIDEO_V4L1_COMPAT
         .vidiocgmbuf          = vidiocgmbuf,
 #endif
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index bd1faff88644..46c4effdfcd5 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -69,6 +69,10 @@ typedef void (*cam_v_op) (struct gspca_dev *);
 typedef int (*cam_cf_op) (struct gspca_dev *, const struct usb_device_id *);
 typedef int (*cam_jpg_op) (struct gspca_dev *,
                                 struct v4l2_jpegcompression *);
+typedef int (*cam_reg_op) (struct gspca_dev *,
+                                struct v4l2_dbg_register *);
+typedef int (*cam_ident_op) (struct gspca_dev *,
+                                struct v4l2_dbg_chip_ident *);
 typedef int (*cam_streamparm_op) (struct gspca_dev *,
                                   struct v4l2_streamparm *);
 typedef int (*cam_qmnu_op) (struct gspca_dev *,
@@ -105,6 +109,11 @@ struct sd_desc {
         cam_qmnu_op querymenu;
         cam_streamparm_op get_streamparm;
         cam_streamparm_op set_streamparm;
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        cam_reg_op set_register;
+        cam_reg_op get_register;
+#endif
+        cam_ident_op get_chip_ident;
 };
 
 /* packet types when moving from iso buf to frame buf */
diff --git a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
index 191bcd718979..0163903d1c0f 100644
--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
@@ -476,9 +476,6 @@ static int s5k4aa_set_vflip(struct gspca_dev *gspca_dev, __s32 val)
         err = m5602_write_sensor(sd, S5K4AA_PAGE_MAP, &data, 1);
         if (err < 0)
                 return err;
-        err = m5602_write_sensor(sd, S5K4AA_READ_MODE, &data, 1);
-        if (err < 0)
-                return err;
 
         err = m5602_read_sensor(sd, S5K4AA_READ_MODE, &data, 1);
         if (err < 0)
@@ -524,9 +521,6 @@ static int s5k4aa_set_hflip(struct gspca_dev *gspca_dev, __s32 val)
         err = m5602_write_sensor(sd, S5K4AA_PAGE_MAP, &data, 1);
         if (err < 0)
                 return err;
-        err = m5602_write_sensor(sd, S5K4AA_READ_MODE, &data, 1);
-        if (err < 0)
-                return err;
 
         err = m5602_read_sensor(sd, S5K4AA_READ_MODE, &data, 1);
         if (err < 0)
diff --git a/drivers/media/video/gspca/mars.c b/drivers/media/video/gspca/mars.c
index 75e8d14e4ac7..de769caf013d 100644
--- a/drivers/media/video/gspca/mars.c
+++ b/drivers/media/video/gspca/mars.c
@@ -201,6 +201,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x21);          /* JPEG 422 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
new file mode 100644
index 000000000000..fcfbbd329b4c
--- /dev/null
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -0,0 +1,2434 @@
+/*
+ *      Sonix sn9c201 sn9c202 library
+ *      Copyright (C) 2008-2009 microdia project <microdia@googlegroups.com>
+ *      Copyright (C) 2009 Brian Johnson <brijohn@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+#include <linux/kthread.h>
+#include <linux/freezer.h>
+#include <linux/usb/input.h>
+#include <linux/input.h>
+#endif
+
+#include "gspca.h"
+#include "jpeg.h"
+
+#include <media/v4l2-chip-ident.h>
+
+MODULE_AUTHOR("Brian Johnson <brijohn@gmail.com>, "
+                "microdia project <microdia@googlegroups.com>");
+MODULE_DESCRIPTION("GSPCA/SN9C20X USB Camera Driver");
+MODULE_LICENSE("GPL");
+
+#define MODULE_NAME "sn9c20x"
+
+#define MODE_RAW        0x10
+#define MODE_JPEG       0x20
+#define MODE_SXGA       0x80
+
+#define SENSOR_OV9650   0
+#define SENSOR_OV9655   1
+#define SENSOR_SOI968   2
+#define SENSOR_OV7660   3
+#define SENSOR_OV7670   4
+#define SENSOR_MT9V011  5
+#define SENSOR_MT9V111  6
+#define SENSOR_MT9V112  7
+#define SENSOR_MT9M001  8
+#define SENSOR_MT9M111  9
+#define SENSOR_HV7131R  10
+#define SENSOR_MT9VPRB  20
+
+/* specific webcam descriptor */
+struct sd {
+        struct gspca_dev gspca_dev;
+
+#define MIN_AVG_LUM 80
+#define MAX_AVG_LUM 130
+        atomic_t avg_lum;
+        u8 old_step;
+        u8 older_step;
+        u8 exposure_step;
+
+        u8 brightness;
+        u8 contrast;
+        u8 saturation;
+        s16 hue;
+        u8 gamma;
+        u8 red;
+        u8 blue;
+
+        u8 hflip;
+        u8 vflip;
+        u8 gain;
+        u16 exposure;
+        u8 auto_exposure;
+
+        u8 i2c_addr;
+        u8 sensor;
+        u8 hstart;
+        u8 vstart;
+
+        u8 *jpeg_hdr;
+        u8 quality;
+
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+        struct input_dev *input_dev;
+        u8 input_gpio;
+        struct task_struct *input_task;
+#endif
+};
+
+static int sd_setbrightness(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getbrightness(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setcontrast(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getcontrast(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setsaturation(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getsaturation(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_sethue(struct gspca_dev *gspca_dev, s32 val);
+static int sd_gethue(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setgamma(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getgamma(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setredbalance(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getredbalance(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setbluebalance(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getbluebalance(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setvflip(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getvflip(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_sethflip(struct gspca_dev *gspca_dev, s32 val);
+static int sd_gethflip(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setgain(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getgain(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setexposure(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getexposure(struct gspca_dev *gspca_dev, s32 *val);
+static int sd_setautoexposure(struct gspca_dev *gspca_dev, s32 val);
+static int sd_getautoexposure(struct gspca_dev *gspca_dev, s32 *val);
+
+static struct ctrl sd_ctrls[] = {
+        {
+#define BRIGHTNESS_IDX 0
+            {
+                .id      = V4L2_CID_BRIGHTNESS,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Brightness",
+                .minimum = 0,
+                .maximum = 0xff,
+                .step    = 1,
+#define BRIGHTNESS_DEFAULT 0x7f
+                .default_value = BRIGHTNESS_DEFAULT,
+            },
+            .set = sd_setbrightness,
+            .get = sd_getbrightness,
+        },
+        {
+#define CONTRAST_IDX 1
+            {
+                .id      = V4L2_CID_CONTRAST,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Contrast",
+                .minimum = 0,
+                .maximum = 0xff,
+                .step    = 1,
+#define CONTRAST_DEFAULT 0x7f
+                .default_value = CONTRAST_DEFAULT,
+            },
+            .set = sd_setcontrast,
+            .get = sd_getcontrast,
+        },
+        {
+#define SATURATION_IDX 2
+            {
+                .id      = V4L2_CID_SATURATION,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Saturation",
+                .minimum = 0,
+                .maximum = 0xff,
+                .step    = 1,
+#define SATURATION_DEFAULT 0x7f
+                .default_value = SATURATION_DEFAULT,
+            },
+            .set = sd_setsaturation,
+            .get = sd_getsaturation,
+        },
+        {
+#define HUE_IDX 3
+            {
+                .id      = V4L2_CID_HUE,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Hue",
+                .minimum = -180,
+                .maximum = 180,
+                .step    = 1,
+#define HUE_DEFAULT 0
+                .default_value = HUE_DEFAULT,
+            },
+            .set = sd_sethue,
+            .get = sd_gethue,
+        },
+        {
+#define GAMMA_IDX 4
+            {
+                .id      = V4L2_CID_GAMMA,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Gamma",
+                .minimum = 0,
+                .maximum = 0xff,
+                .step    = 1,
+#define GAMMA_DEFAULT 0x10
+                .default_value = GAMMA_DEFAULT,
+            },
+            .set = sd_setgamma,
+            .get = sd_getgamma,
+        },
+        {
+#define BLUE_IDX 5
+            {
+                .id      = V4L2_CID_BLUE_BALANCE,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Blue Balance",
+                .minimum = 0,
+                .maximum = 0x7f,
+                .step    = 1,
+#define BLUE_DEFAULT 0x28
+                .default_value = BLUE_DEFAULT,
+            },
+            .set = sd_setbluebalance,
+            .get = sd_getbluebalance,
+        },
+        {
+#define RED_IDX 6
+            {
+                .id      = V4L2_CID_RED_BALANCE,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Red Balance",
+                .minimum = 0,
+                .maximum = 0x7f,
+                .step    = 1,
+#define RED_DEFAULT 0x28
+                .default_value = RED_DEFAULT,
+            },
+            .set = sd_setredbalance,
+            .get = sd_getredbalance,
+        },
+        {
+#define HFLIP_IDX 7
+            {
+                .id      = V4L2_CID_HFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Horizontal Flip",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+#define HFLIP_DEFAULT 0
+                .default_value = HFLIP_DEFAULT,
+            },
+            .set = sd_sethflip,
+            .get = sd_gethflip,
+        },
+        {
+#define VFLIP_IDX 8
+            {
+                .id      = V4L2_CID_VFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Vertical Flip",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+#define VFLIP_DEFAULT 0
+                .default_value = VFLIP_DEFAULT,
+            },
+            .set = sd_setvflip,
+            .get = sd_getvflip,
+        },
+        {
+#define EXPOSURE_IDX 9
+            {
+                .id      = V4L2_CID_EXPOSURE,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Exposure",
+                .minimum = 0,
+                .maximum = 0x1780,
+                .step    = 1,
+#define EXPOSURE_DEFAULT 0x33
+                .default_value = EXPOSURE_DEFAULT,
+            },
+            .set = sd_setexposure,
+            .get = sd_getexposure,
+        },
+        {
+#define GAIN_IDX 10
+            {
+                .id      = V4L2_CID_GAIN,
+                .type    = V4L2_CTRL_TYPE_INTEGER,
+                .name    = "Gain",
+                .minimum = 0,
+                .maximum = 28,
+                .step    = 1,
+#define GAIN_DEFAULT 0x00
+                .default_value = GAIN_DEFAULT,
+            },
+            .set = sd_setgain,
+            .get = sd_getgain,
+        },
+        {
+#define AUTOGAIN_IDX 11
+            {
+                .id      = V4L2_CID_AUTOGAIN,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Auto Exposure",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+#define AUTO_EXPOSURE_DEFAULT 1
+                .default_value = AUTO_EXPOSURE_DEFAULT,
+            },
+            .set = sd_setautoexposure,
+            .get = sd_getautoexposure,
+        },
+};
+
+static const struct v4l2_pix_format vga_mode[] = {
+        {160, 120, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 240,
+                .sizeimage = 240 * 120,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 0 | MODE_JPEG},
+        {160, 120, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 160,
+                .sizeimage = 160 * 120,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 0 | MODE_RAW},
+        {160, 120, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 240,
+                .sizeimage = 240 * 120,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 0},
+        {320, 240, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 480,
+                .sizeimage = 480 * 240 ,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 1 | MODE_JPEG},
+        {320, 240, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 320,
+                .sizeimage = 320 * 240 ,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 1 | MODE_RAW},
+        {320, 240, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 480,
+                .sizeimage = 480 * 240 ,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 1},
+        {640, 480, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 960,
+                .sizeimage = 960 * 480,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 2 | MODE_JPEG},
+        {640, 480, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 640,
+                .sizeimage = 640 * 480,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 2 | MODE_RAW},
+        {640, 480, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 960,
+                .sizeimage = 960 * 480,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 2},
+};
+
+static const struct v4l2_pix_format sxga_mode[] = {
+        {160, 120, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 240,
+                .sizeimage = 240 * 120,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 0 | MODE_JPEG},
+        {160, 120, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 160,
+                .sizeimage = 160 * 120,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 0 | MODE_RAW},
+        {160, 120, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 240,
+                .sizeimage = 240 * 120,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 0},
+        {320, 240, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 480,
+                .sizeimage = 480 * 240 ,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 1 | MODE_JPEG},
+        {320, 240, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 320,
+                .sizeimage = 320 * 240 ,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 1 | MODE_RAW},
+        {320, 240, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 480,
+                .sizeimage = 480 * 240 ,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 1},
+        {640, 480, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+                .bytesperline = 960,
+                .sizeimage = 960 * 480,
+                .colorspace = V4L2_COLORSPACE_JPEG,
+                .priv = 2 | MODE_JPEG},
+        {640, 480, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 640,
+                .sizeimage = 640 * 480,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 2 | MODE_RAW},
+        {640, 480, V4L2_PIX_FMT_SN9C20X_I420, V4L2_FIELD_NONE,
+                .bytesperline = 960,
+                .sizeimage = 960 * 480,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 2},
+        {1280, 1024, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+                .bytesperline = 1280,
+                .sizeimage = (1280 * 1024) + 64,
+                .colorspace = V4L2_COLORSPACE_SRGB,
+                .priv = 3 | MODE_RAW | MODE_SXGA},
+};
+
+static const int hsv_red_x[] = {
+        41,  44,  46,  48,  50,  52,  54,  56,
+        58,  60,  62,  64,  66,  68,  70,  72,
+        74,  76,  78,  80,  81,  83,  85,  87,
+        88,  90,  92,  93,  95,  97,  98, 100,
+        101, 102, 104, 105, 107, 108, 109, 110,
+        112, 113, 114, 115, 116, 117, 118, 119,
+        120, 121, 122, 123, 123, 124, 125, 125,
+        126, 127, 127, 128, 128, 129, 129, 129,
+        130, 130, 130, 130, 131, 131, 131, 131,
+        131, 131, 131, 131, 130, 130, 130, 130,
+        129, 129, 129, 128, 128, 127, 127, 126,
+        125, 125, 124, 123, 122, 122, 121, 120,
+        119, 118, 117, 116, 115, 114, 112, 111,
+        110, 109, 107, 106, 105, 103, 102, 101,
+        99,  98,  96,  94,  93,  91,  90,  88,
+        86,  84,  83,  81,  79,  77,  75,  74,
+        72,  70,  68,  66,  64,  62,  60,  58,
+        56,  54,  52,  49,  47,  45,  43,  41,
+        39,  36,  34,  32,  30,  28,  25,  23,
+        21,  19,  16,  14,  12,   9,   7,   5,
+        3,   0,  -1,  -3,  -6,  -8, -10, -12,
+        -15, -17, -19, -22, -24, -26, -28, -30,
+        -33, -35, -37, -39, -41, -44, -46, -48,
+        -50, -52, -54, -56, -58, -60, -62, -64,
+        -66, -68, -70, -72, -74, -76, -78, -80,
+        -81, -83, -85, -87, -88, -90, -92, -93,
+        -95, -97, -98, -100, -101, -102, -104, -105,
+        -107, -108, -109, -110, -112, -113, -114, -115,
+        -116, -117, -118, -119, -120, -121, -122, -123,
+        -123, -124, -125, -125, -126, -127, -127, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -127, -127, -126, -125, -125, -124, -123,
+        -122, -122, -121, -120, -119, -118, -117, -116,
+        -115, -114, -112, -111, -110, -109, -107, -106,
+        -105, -103, -102, -101, -99, -98, -96, -94,
+        -93, -91, -90, -88, -86, -84, -83, -81,
+        -79, -77, -75, -74, -72, -70, -68, -66,
+        -64, -62, -60, -58, -56, -54, -52, -49,
+        -47, -45, -43, -41, -39, -36, -34, -32,
+        -30, -28, -25, -23, -21, -19, -16, -14,
+        -12,  -9,  -7,  -5,  -3,   0,   1,   3,
+        6,   8,  10,  12,  15,  17,  19,  22,
+        24,  26,  28,  30,  33,  35,  37,  39, 41
+};
+
+static const int hsv_red_y[] = {
+        82,  80,  78,  76,  74,  73,  71,  69,
+        67,  65,  63,  61,  58,  56,  54,  52,
+        50,  48,  46,  44,  41,  39,  37,  35,
+        32,  30,  28,  26,  23,  21,  19,  16,
+        14,  12,  10,   7,   5,   3,   0,  -1,
+        -3,  -6,  -8, -10, -13, -15, -17, -19,
+        -22, -24, -26, -29, -31, -33, -35, -38,
+        -40, -42, -44, -46, -48, -51, -53, -55,
+        -57, -59, -61, -63, -65, -67, -69, -71,
+        -73, -75, -77, -79, -81, -82, -84, -86,
+        -88, -89, -91, -93, -94, -96, -98, -99,
+        -101, -102, -104, -105, -106, -108, -109, -110,
+        -112, -113, -114, -115, -116, -117, -119, -120,
+        -120, -121, -122, -123, -124, -125, -126, -126,
+        -127, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -128, -128, -128, -128, -128, -128, -128, -128,
+        -127, -127, -126, -125, -125, -124, -123, -122,
+        -121, -120, -119, -118, -117, -116, -115, -114,
+        -113, -111, -110, -109, -107, -106, -105, -103,
+        -102, -100, -99, -97, -96, -94, -92, -91,
+        -89, -87, -85, -84, -82, -80, -78, -76,
+        -74, -73, -71, -69, -67, -65, -63, -61,
+        -58, -56, -54, -52, -50, -48, -46, -44,
+        -41, -39, -37, -35, -32, -30, -28, -26,
+        -23, -21, -19, -16, -14, -12, -10,  -7,
+        -5,  -3,   0,   1,   3,   6,   8,  10,
+        13,  15,  17,  19,  22,  24,  26,  29,
+        31,  33,  35,  38,  40,  42,  44,  46,
+        48,  51,  53,  55,  57,  59,  61,  63,
+        65,  67,  69,  71,  73,  75,  77,  79,
+        81,  82,  84,  86,  88,  89,  91,  93,
+        94,  96,  98,  99, 101, 102, 104, 105,
+        106, 108, 109, 110, 112, 113, 114, 115,
+        116, 117, 119, 120, 120, 121, 122, 123,
+        124, 125, 126, 126, 127, 128, 128, 129,
+        129, 130, 130, 131, 131, 131, 131, 132,
+        132, 132, 132, 132, 132, 132, 132, 132,
+        132, 132, 132, 131, 131, 131, 130, 130,
+        130, 129, 129, 128, 127, 127, 126, 125,
+        125, 124, 123, 122, 121, 120, 119, 118,
+        117, 116, 115, 114, 113, 111, 110, 109,
+        107, 106, 105, 103, 102, 100,  99,  97,
+        96, 94, 92, 91, 89, 87, 85, 84, 82
+};
+
+static const int hsv_green_x[] = {
+        -124, -124, -125, -125, -125, -125, -125, -125,
+        -125, -126, -126, -125, -125, -125, -125, -125,
+        -125, -124, -124, -124, -123, -123, -122, -122,
+        -121, -121, -120, -120, -119, -118, -117, -117,
+        -116, -115, -114, -113, -112, -111, -110, -109,
+        -108, -107, -105, -104, -103, -102, -100, -99,
+        -98, -96, -95, -93, -92, -91, -89, -87,
+        -86, -84, -83, -81, -79, -77, -76, -74,
+        -72, -70, -69, -67, -65, -63, -61, -59,
+        -57, -55, -53, -51, -49, -47, -45, -43,
+        -41, -39, -37, -35, -33, -30, -28, -26,
+        -24, -22, -20, -18, -15, -13, -11,  -9,
+        -7,  -4,  -2,   0,   1,   3,   6,   8,
+        10,  12,  14,  17,  19,  21,  23,  25,
+        27,  29,  32,  34,  36,  38,  40,  42,
+        44,  46,  48,  50,  52,  54,  56,  58,
+        60,  62,  64,  66,  68,  70,  71,  73,
+        75,  77,  78,  80,  82,  83,  85,  87,
+        88,  90,  91,  93,  94,  96,  97,  98,
+        100, 101, 102, 104, 105, 106, 107, 108,
+        109, 111, 112, 113, 113, 114, 115, 116,
+        117, 118, 118, 119, 120, 120, 121, 122,
+        122, 123, 123, 124, 124, 124, 125, 125,
+        125, 125, 125, 125, 125, 126, 126, 125,
+        125, 125, 125, 125, 125, 124, 124, 124,
+        123, 123, 122, 122, 121, 121, 120, 120,
+        119, 118, 117, 117, 116, 115, 114, 113,
+        112, 111, 110, 109, 108, 107, 105, 104,
+        103, 102, 100,  99,  98,  96,  95,  93,
+        92,  91,  89,  87,  86,  84,  83,  81,
+        79,  77,  76,  74,  72,  70,  69,  67,
+        65,  63,  61,  59,  57,  55,  53,  51,
+        49,  47,  45,  43,  41,  39,  37,  35,
+        33,  30,  28,  26,  24,  22,  20,  18,
+        15,  13,  11,   9,   7,   4,   2,   0,
+        -1,  -3,  -6,  -8, -10, -12, -14, -17,
+        -19, -21, -23, -25, -27, -29, -32, -34,
+        -36, -38, -40, -42, -44, -46, -48, -50,
+        -52, -54, -56, -58, -60, -62, -64, -66,
+        -68, -70, -71, -73, -75, -77, -78, -80,
+        -82, -83, -85, -87, -88, -90, -91, -93,
+        -94, -96, -97, -98, -100, -101, -102, -104,
+        -105, -106, -107, -108, -109, -111, -112, -113,
+        -113, -114, -115, -116, -117, -118, -118, -119,
+        -120, -120, -121, -122, -122, -123, -123, -124, -124
+};
+
+static const int hsv_green_y[] = {
+        -100, -99, -98, -97, -95, -94, -93, -91,
+        -90, -89, -87, -86, -84, -83, -81, -80,
+        -78, -76, -75, -73, -71, -70, -68, -66,
+        -64, -63, -61, -59, -57, -55, -53, -51,
+        -49, -48, -46, -44, -42, -40, -38, -36,
+        -34, -32, -30, -27, -25, -23, -21, -19,
+        -17, -15, -13, -11,  -9,  -7,  -4,  -2,
+        0,   1,   3,   5,   7,   9,  11,  14,
+        16,  18,  20,  22,  24,  26,  28,  30,
+        32,  34,  36,  38,  40,  42,  44,  46,
+        48,  50,  52,  54,  56,  58,  59,  61,
+        63,  65,  67,  68,  70,  72,  74,  75,
+        77,  78,  80,  82,  83,  85,  86,  88,
+        89,  90,  92,  93,  95,  96,  97,  98,
+        100, 101, 102, 103, 104, 105, 106, 107,
+        108, 109, 110, 111, 112, 112, 113, 114,
+        115, 115, 116, 116, 117, 117, 118, 118,
+        119, 119, 119, 120, 120, 120, 120, 120,
+        121, 121, 121, 121, 121, 121, 120, 120,
+        120, 120, 120, 119, 119, 119, 118, 118,
+        117, 117, 116, 116, 115, 114, 114, 113,
+        112, 111, 111, 110, 109, 108, 107, 106,
+        105, 104, 103, 102, 100,  99,  98,  97,
+        95,  94,  93,  91,  90,  89,  87,  86,
+        84,  83,  81,  80,  78,  76,  75,  73,
+        71,  70,  68,  66,  64,  63,  61,  59,
+        57,  55,  53,  51,  49,  48,  46,  44,
+        42,  40,  38,  36,  34,  32,  30,  27,
+        25,  23,  21,  19,  17,  15,  13,  11,
+        9,   7,   4,   2,   0,  -1,  -3,  -5,
+        -7,  -9, -11, -14, -16, -18, -20, -22,
+        -24, -26, -28, -30, -32, -34, -36, -38,
+        -40, -42, -44, -46, -48, -50, -52, -54,
+        -56, -58, -59, -61, -63, -65, -67, -68,
+        -70, -72, -74, -75, -77, -78, -80, -82,
+        -83, -85, -86, -88, -89, -90, -92, -93,
+        -95, -96, -97, -98, -100, -101, -102, -103,
+        -104, -105, -106, -107, -108, -109, -110, -111,
+        -112, -112, -113, -114, -115, -115, -116, -116,
+        -117, -117, -118, -118, -119, -119, -119, -120,
+        -120, -120, -120, -120, -121, -121, -121, -121,
+        -121, -121, -120, -120, -120, -120, -120, -119,
+        -119, -119, -118, -118, -117, -117, -116, -116,
+        -115, -114, -114, -113, -112, -111, -111, -110,
+        -109, -108, -107, -106, -105, -104, -103, -102, -100
+};
+
+static const int hsv_blue_x[] = {
+        112, 113, 114, 114, 115, 116, 117, 117,
+        118, 118, 119, 119, 120, 120, 120, 121,
+        121, 121, 122, 122, 122, 122, 122, 122,
+        122, 122, 122, 122, 122, 122, 121, 121,
+        121, 120, 120, 120, 119, 119, 118, 118,
+        117, 116, 116, 115, 114, 113, 113, 112,
+        111, 110, 109, 108, 107, 106, 105, 104,
+        103, 102, 100,  99,  98,  97,  95,  94,
+        93,  91,  90,  88,  87,  85,  84,  82,
+        80,  79,  77,  76,  74,  72,  70,  69,
+        67,  65,  63,  61,  60,  58,  56,  54,
+        52,  50,  48,  46,  44,  42,  40,  38,
+        36,  34,  32,  30,  28,  26,  24,  22,
+        19,  17,  15,  13,  11,   9,   7,   5,
+        2,   0,  -1,  -3,  -5,  -7,  -9, -12,
+        -14, -16, -18, -20, -22, -24, -26, -28,
+        -31, -33, -35, -37, -39, -41, -43, -45,
+        -47, -49, -51, -53, -54, -56, -58, -60,
+        -62, -64, -66, -67, -69, -71, -73, -74,
+        -76, -78, -79, -81, -83, -84, -86, -87,
+        -89, -90, -92, -93, -94, -96, -97, -98,
+        -99, -101, -102, -103, -104, -105, -106, -107,
+        -108, -109, -110, -111, -112, -113, -114, -114,
+        -115, -116, -117, -117, -118, -118, -119, -119,
+        -120, -120, -120, -121, -121, -121, -122, -122,
+        -122, -122, -122, -122, -122, -122, -122, -122,
+        -122, -122, -121, -121, -121, -120, -120, -120,
+        -119, -119, -118, -118, -117, -116, -116, -115,
+        -114, -113, -113, -112, -111, -110, -109, -108,
+        -107, -106, -105, -104, -103, -102, -100, -99,
+        -98, -97, -95, -94, -93, -91, -90, -88,
+        -87, -85, -84, -82, -80, -79, -77, -76,
+        -74, -72, -70, -69, -67, -65, -63, -61,
+        -60, -58, -56, -54, -52, -50, -48, -46,
+        -44, -42, -40, -38, -36, -34, -32, -30,
+        -28, -26, -24, -22, -19, -17, -15, -13,
+        -11,  -9,  -7,  -5,  -2,   0,   1,   3,
+        5,   7,   9,  12,  14,  16,  18,  20,
+        22,  24,  26,  28,  31,  33,  35,  37,
+        39,  41,  43,  45,  47,  49,  51,  53,
+        54,  56,  58,  60,  62,  64,  66,  67,
+        69,  71,  73,  74,  76,  78,  79,  81,
+        83,  84,  86,  87,  89,  90,  92,  93,
+        94,  96,  97,  98,  99, 101, 102, 103,
+        104, 105, 106, 107, 108, 109, 110, 111, 112
+};
+
+static const int hsv_blue_y[] = {
+        -11, -13, -15, -17, -19, -21, -23, -25,
+        -27, -29, -31, -33, -35, -37, -39, -41,
+        -43, -45, -46, -48, -50, -52, -54, -55,
+        -57, -59, -61, -62, -64, -66, -67, -69,
+        -71, -72, -74, -75, -77, -78, -80, -81,
+        -83, -84, -86, -87, -88, -90, -91, -92,
+        -93, -95, -96, -97, -98, -99, -100, -101,
+        -102, -103, -104, -105, -106, -106, -107, -108,
+        -109, -109, -110, -111, -111, -112, -112, -113,
+        -113, -114, -114, -114, -115, -115, -115, -115,
+        -116, -116, -116, -116, -116, -116, -116, -116,
+        -116, -115, -115, -115, -115, -114, -114, -114,
+        -113, -113, -112, -112, -111, -111, -110, -110,
+        -109, -108, -108, -107, -106, -105, -104, -103,
+        -102, -101, -100, -99, -98, -97, -96, -95,
+        -94, -93, -91, -90, -89, -88, -86, -85,
+        -84, -82, -81, -79, -78, -76, -75, -73,
+        -71, -70, -68, -67, -65, -63, -62, -60,
+        -58, -56, -55, -53, -51, -49, -47, -45,
+        -44, -42, -40, -38, -36, -34, -32, -30,
+        -28, -26, -24, -22, -20, -18, -16, -14,
+        -12, -10,  -8,  -6,  -4,  -2,   0,   1,
+        3,   5,   7,   9,  11,  13,  15,  17,
+        19,  21,  23,  25,  27,  29,  31,  33,
+        35,  37,  39,  41,  43,  45,  46,  48,
+        50,  52,  54,  55,  57,  59,  61,  62,
+        64,  66,  67,  69,  71,  72,  74,  75,
+        77,  78,  80,  81,  83,  84,  86,  87,
+        88,  90,  91,  92,  93,  95,  96,  97,
+        98,  99, 100, 101, 102, 103, 104, 105,
+        106, 106, 107, 108, 109, 109, 110, 111,
+        111, 112, 112, 113, 113, 114, 114, 114,
+        115, 115, 115, 115, 116, 116, 116, 116,
+        116, 116, 116, 116, 116, 115, 115, 115,
+        115, 114, 114, 114, 113, 113, 112, 112,
+        111, 111, 110, 110, 109, 108, 108, 107,
+        106, 105, 104, 103, 102, 101, 100,  99,
+        98,  97,  96,  95,  94,  93,  91,  90,
+        89,  88,  86,  85,  84,  82,  81,  79,
+        78,  76,  75,  73,  71,  70,  68,  67,
+        65,  63,  62,  60,  58,  56,  55,  53,
+        51,  49,  47,  45,  44,  42,  40,  38,
+        36,  34,  32,  30,  28,  26,  24,  22,
+        20,  18,  16,  14,  12,  10,   8,   6,
+        4,   2,   0,  -1,  -3,  -5,  -7,  -9, -11
+};
+
+static u16 i2c_ident[] = {
+        V4L2_IDENT_OV9650,
+        V4L2_IDENT_OV9655,
+        V4L2_IDENT_SOI968,
+        V4L2_IDENT_OV7660,
+        V4L2_IDENT_OV7670,
+        V4L2_IDENT_MT9V011,
+        V4L2_IDENT_MT9V111,
+        V4L2_IDENT_MT9V112,
+        V4L2_IDENT_MT9M001C12ST,
+        V4L2_IDENT_MT9M111,
+        V4L2_IDENT_HV7131R,
+};
+
+static u16 bridge_init[][2] = {
+        {0x1000, 0x78}, {0x1001, 0x40}, {0x1002, 0x1c},
+        {0x1020, 0x80}, {0x1061, 0x01}, {0x1067, 0x40},
+        {0x1068, 0x30}, {0x1069, 0x20}, {0x106a, 0x10},
+        {0x106b, 0x08}, {0x1188, 0x87}, {0x11a1, 0x00},
+        {0x11a2, 0x00}, {0x11a3, 0x6a}, {0x11a4, 0x50},
+        {0x11ab, 0x00}, {0x11ac, 0x00}, {0x11ad, 0x50},
+        {0x11ae, 0x3c}, {0x118a, 0x04}, {0x0395, 0x04},
+        {0x11b8, 0x3a}, {0x118b, 0x0e}, {0x10f7, 0x05},
+        {0x10f8, 0x14}, {0x10fa, 0xff}, {0x10f9, 0x00},
+        {0x11ba, 0x0a}, {0x11a5, 0x2d}, {0x11a6, 0x2d},
+        {0x11a7, 0x3a}, {0x11a8, 0x05}, {0x11a9, 0x04},
+        {0x11aa, 0x3f}, {0x11af, 0x28}, {0x11b0, 0xd8},
+        {0x11b1, 0x14}, {0x11b2, 0xec}, {0x11b3, 0x32},
+        {0x11b4, 0xdd}, {0x11b5, 0x32}, {0x11b6, 0xdd},
+        {0x10e0, 0x2c}, {0x11bc, 0x40}, {0x11bd, 0x01},
+        {0x11be, 0xf0}, {0x11bf, 0x00}, {0x118c, 0x1f},
+        {0x118d, 0x1f}, {0x118e, 0x1f}, {0x118f, 0x1f},
+        {0x1180, 0x01}, {0x1181, 0x00}, {0x1182, 0x01},
+        {0x1183, 0x00}, {0x1184, 0x50}, {0x1185, 0x80}
+};
+
+/* Gain = (bit[3:0] / 16 + 1) * (bit[4] + 1) * (bit[5] + 1) * (bit[6] + 1) */
+static u8 ov_gain[] = {
+        0x00 /* 1x */, 0x04 /* 1.25x */, 0x08 /* 1.5x */, 0x0c /* 1.75x */,
+        0x10 /* 2x */, 0x12 /* 2.25x */, 0x14 /* 2.5x */, 0x16 /* 2.75x */,
+        0x18 /* 3x */, 0x1a /* 3.25x */, 0x1c /* 3.5x */, 0x1e /* 3.75x */,
+        0x30 /* 4x */, 0x31 /* 4.25x */, 0x32 /* 4.5x */, 0x33 /* 4.75x */,
+        0x34 /* 5x */, 0x35 /* 5.25x */, 0x36 /* 5.5x */, 0x37 /* 5.75x */,
+        0x38 /* 6x */, 0x39 /* 6.25x */, 0x3a /* 6.5x */, 0x3b /* 6.75x */,
+        0x3c /* 7x */, 0x3d /* 7.25x */, 0x3e /* 7.5x */, 0x3f /* 7.75x */,
+        0x70 /* 8x */
+};
+
+/* Gain = (bit[8] + 1) * (bit[7] + 1) * (bit[6:0] * 0.03125) */
+static u16 micron1_gain[] = {
+        /* 1x   1.25x   1.5x    1.75x */
+        0x0020, 0x0028, 0x0030, 0x0038,
+        /* 2x   2.25x   2.5x    2.75x */
+        0x00a0, 0x00a4, 0x00a8, 0x00ac,
+        /* 3x   3.25x   3.5x    3.75x */
+        0x00b0, 0x00b4, 0x00b8, 0x00bc,
+        /* 4x   4.25x   4.5x    4.75x */
+        0x00c0, 0x00c4, 0x00c8, 0x00cc,
+        /* 5x   5.25x   5.5x    5.75x */
+        0x00d0, 0x00d4, 0x00d8, 0x00dc,
+        /* 6x   6.25x   6.5x    6.75x */
+        0x00e0, 0x00e4, 0x00e8, 0x00ec,
+        /* 7x   7.25x   7.5x    7.75x */
+        0x00f0, 0x00f4, 0x00f8, 0x00fc,
+        /* 8x */
+        0x01c0
+};
+
+/* mt9m001 sensor uses a different gain formula then other micron sensors */
+/* Gain = (bit[6] + 1) * (bit[5-0] * 0.125) */
+static u16 micron2_gain[] = {
+        /* 1x   1.25x   1.5x    1.75x */
+        0x0008, 0x000a, 0x000c, 0x000e,
+        /* 2x   2.25x   2.5x    2.75x */
+        0x0010, 0x0012, 0x0014, 0x0016,
+        /* 3x   3.25x   3.5x    3.75x */
+        0x0018, 0x001a, 0x001c, 0x001e,
+        /* 4x   4.25x   4.5x    4.75x */
+        0x0020, 0x0051, 0x0052, 0x0053,
+        /* 5x   5.25x   5.5x    5.75x */
+        0x0054, 0x0055, 0x0056, 0x0057,
+        /* 6x   6.25x   6.5x    6.75x */
+        0x0058, 0x0059, 0x005a, 0x005b,
+        /* 7x   7.25x   7.5x    7.75x */
+        0x005c, 0x005d, 0x005e, 0x005f,
+        /* 8x */
+        0x0060
+};
+
+/* Gain = .5 + bit[7:0] / 16 */
+static u8 hv7131r_gain[] = {
+        0x08 /* 1x */, 0x0c /* 1.25x */, 0x10 /* 1.5x */, 0x14 /* 1.75x */,
+        0x18 /* 2x */, 0x1c /* 2.25x */, 0x20 /* 2.5x */, 0x24 /* 2.75x */,
+        0x28 /* 3x */, 0x2c /* 3.25x */, 0x30 /* 3.5x */, 0x34 /* 3.75x */,
+        0x38 /* 4x */, 0x3c /* 4.25x */, 0x40 /* 4.5x */, 0x44 /* 4.75x */,
+        0x48 /* 5x */, 0x4c /* 5.25x */, 0x50 /* 5.5x */, 0x54 /* 5.75x */,
+        0x58 /* 6x */, 0x5c /* 6.25x */, 0x60 /* 6.5x */, 0x64 /* 6.75x */,
+        0x68 /* 7x */, 0x6c /* 7.25x */, 0x70 /* 7.5x */, 0x74 /* 7.75x */,
+        0x78 /* 8x */
+};
+
+static u8 soi968_init[][2] = {
+        {0x12, 0x80}, {0x0c, 0x00}, {0x0f, 0x1f},
+        {0x11, 0x80}, {0x38, 0x52}, {0x1e, 0x00},
+        {0x33, 0x08}, {0x35, 0x8c}, {0x36, 0x0c},
+        {0x37, 0x04}, {0x45, 0x04}, {0x47, 0xff},
+        {0x3e, 0x00}, {0x3f, 0x00}, {0x3b, 0x20},
+        {0x3a, 0x96}, {0x3d, 0x0a}, {0x14, 0x8e},
+        {0x13, 0x8a}, {0x12, 0x40}, {0x17, 0x13},
+        {0x18, 0x63}, {0x19, 0x01}, {0x1a, 0x79},
+        {0x32, 0x24}, {0x03, 0x00}, {0x11, 0x40},
+        {0x2a, 0x10}, {0x2b, 0xe0}, {0x10, 0x32},
+        {0x00, 0x00}, {0x01, 0x80}, {0x02, 0x80},
+};
+
+static u8 ov7660_init[][2] = {
+        {0x0e, 0x80}, {0x0d, 0x08}, {0x0f, 0xc3},
+        {0x04, 0xc3}, {0x10, 0x40}, {0x11, 0x40},
+        {0x12, 0x05}, {0x13, 0xba}, {0x14, 0x2a},
+        {0x37, 0x0f}, {0x38, 0x02}, {0x39, 0x43},
+        {0x3a, 0x00}, {0x69, 0x90}, {0x2d, 0xf6},
+        {0x2e, 0x0b}, {0x01, 0x78}, {0x02, 0x50},
+};
+
+static u8 ov7670_init[][2] = {
+        {0x12, 0x80}, {0x11, 0x80}, {0x3a, 0x04}, {0x12, 0x01},
+        {0x32, 0xb6}, {0x03, 0x0a}, {0x0c, 0x00}, {0x3e, 0x00},
+        {0x70, 0x3a}, {0x71, 0x35}, {0x72, 0x11}, {0x73, 0xf0},
+        {0xa2, 0x02}, {0x13, 0xe0}, {0x00, 0x00}, {0x10, 0x00},
+        {0x0d, 0x40}, {0x14, 0x28}, {0xa5, 0x05}, {0xab, 0x07},
+        {0x24, 0x95}, {0x25, 0x33}, {0x26, 0xe3}, {0x9f, 0x75},
+        {0xa0, 0x65}, {0xa1, 0x0b}, {0xa6, 0xd8}, {0xa7, 0xd8},
+        {0xa8, 0xf0}, {0xa9, 0x90}, {0xaa, 0x94}, {0x13, 0xe5},
+        {0x0e, 0x61}, {0x0f, 0x4b}, {0x16, 0x02}, {0x1e, 0x27},
+        {0x21, 0x02}, {0x22, 0x91}, {0x29, 0x07}, {0x33, 0x0b},
+        {0x35, 0x0b}, {0x37, 0x1d}, {0x38, 0x71}, {0x39, 0x2a},
+        {0x3c, 0x78}, {0x4d, 0x40}, {0x4e, 0x20}, {0x69, 0x00},
+        {0x74, 0x19}, {0x8d, 0x4f}, {0x8e, 0x00}, {0x8f, 0x00},
+        {0x90, 0x00}, {0x91, 0x00}, {0x96, 0x00}, {0x9a, 0x80},
+        {0xb0, 0x84}, {0xb1, 0x0c}, {0xb2, 0x0e}, {0xb3, 0x82},
+        {0xb8, 0x0a}, {0x43, 0x0a}, {0x44, 0xf0}, {0x45, 0x20},
+        {0x46, 0x7d}, {0x47, 0x29}, {0x48, 0x4a}, {0x59, 0x8c},
+        {0x5a, 0xa5}, {0x5b, 0xde}, {0x5c, 0x96}, {0x5d, 0x66},
+        {0x5e, 0x10}, {0x6c, 0x0a}, {0x6d, 0x55}, {0x6e, 0x11},
+        {0x6f, 0x9e}, {0x6a, 0x40}, {0x01, 0x40}, {0x02, 0x40},
+        {0x13, 0xe7}, {0x4f, 0x6e}, {0x50, 0x70}, {0x51, 0x02},
+        {0x52, 0x1d}, {0x53, 0x56}, {0x54, 0x73}, {0x55, 0x0a},
+        {0x56, 0x55}, {0x57, 0x80}, {0x58, 0x9e}, {0x41, 0x08},
+        {0x3f, 0x02}, {0x75, 0x03}, {0x76, 0x63}, {0x4c, 0x04},
+        {0x77, 0x06}, {0x3d, 0x02}, {0x4b, 0x09}, {0xc9, 0x30},
+        {0x41, 0x08}, {0x56, 0x48}, {0x34, 0x11}, {0xa4, 0x88},
+        {0x96, 0x00}, {0x97, 0x30}, {0x98, 0x20}, {0x99, 0x30},
+        {0x9a, 0x84}, {0x9b, 0x29}, {0x9c, 0x03}, {0x9d, 0x99},
+        {0x9e, 0x7f}, {0x78, 0x04}, {0x79, 0x01}, {0xc8, 0xf0},
+        {0x79, 0x0f}, {0xc8, 0x00}, {0x79, 0x10}, {0xc8, 0x7e},
+        {0x79, 0x0a}, {0xc8, 0x80}, {0x79, 0x0b}, {0xc8, 0x01},
+        {0x79, 0x0c}, {0xc8, 0x0f}, {0x79, 0x0d}, {0xc8, 0x20},
+        {0x79, 0x09}, {0xc8, 0x80}, {0x79, 0x02}, {0xc8, 0xc0},
+        {0x79, 0x03}, {0xc8, 0x40}, {0x79, 0x05}, {0xc8, 0x30},
+        {0x79, 0x26}, {0x62, 0x20}, {0x63, 0x00}, {0x64, 0x06},
+        {0x65, 0x00}, {0x66, 0x05}, {0x94, 0x05}, {0x95, 0x0a},
+        {0x17, 0x13}, {0x18, 0x01}, {0x19, 0x02}, {0x1a, 0x7a},
+        {0x46, 0x59}, {0x47, 0x30}, {0x58, 0x9a}, {0x59, 0x84},
+        {0x5a, 0x91}, {0x5b, 0x57}, {0x5c, 0x75}, {0x5d, 0x6d},
+        {0x5e, 0x13}, {0x64, 0x07}, {0x94, 0x07}, {0x95, 0x0d},
+        {0xa6, 0xdf}, {0xa7, 0xdf}, {0x48, 0x4d}, {0x51, 0x00},
+        {0x6b, 0x0a}, {0x11, 0x80}, {0x2a, 0x00}, {0x2b, 0x00},
+        {0x92, 0x00}, {0x93, 0x00}, {0x55, 0x0a}, {0x56, 0x60},
+        {0x4f, 0x6e}, {0x50, 0x70}, {0x51, 0x00}, {0x52, 0x1d},
+        {0x53, 0x56}, {0x54, 0x73}, {0x58, 0x9a}, {0x4f, 0x6e},
+        {0x50, 0x70}, {0x51, 0x00}, {0x52, 0x1d}, {0x53, 0x56},
+        {0x54, 0x73}, {0x58, 0x9a}, {0x3f, 0x01}, {0x7b, 0x03},
+        {0x7c, 0x09}, {0x7d, 0x16}, {0x7e, 0x38}, {0x7f, 0x47},
+        {0x80, 0x53}, {0x81, 0x5e}, {0x82, 0x6a}, {0x83, 0x74},
+        {0x84, 0x80}, {0x85, 0x8c}, {0x86, 0x9b}, {0x87, 0xb2},
+        {0x88, 0xcc}, {0x89, 0xe5}, {0x7a, 0x24}, {0x3b, 0x00},
+        {0x9f, 0x76}, {0xa0, 0x65}, {0x13, 0xe2}, {0x6b, 0x0a},
+        {0x11, 0x80}, {0x2a, 0x00}, {0x2b, 0x00}, {0x92, 0x00},
+        {0x93, 0x00},
+};
+
+static u8 ov9650_init[][2] = {
+        {0x12, 0x80}, {0x00, 0x00}, {0x01, 0x78},
+        {0x02, 0x78}, {0x03, 0x36}, {0x04, 0x03},
+        {0x05, 0x00}, {0x06, 0x00}, {0x08, 0x00},
+        {0x09, 0x01}, {0x0c, 0x00}, {0x0d, 0x00},
+        {0x0e, 0xa0}, {0x0f, 0x52}, {0x10, 0x7c},
+        {0x11, 0x80}, {0x12, 0x45}, {0x13, 0xc2},
+        {0x14, 0x2e}, {0x15, 0x00}, {0x16, 0x07},
+        {0x17, 0x24}, {0x18, 0xc5}, {0x19, 0x00},
+        {0x1a, 0x3c}, {0x1b, 0x00}, {0x1e, 0x04},
+        {0x1f, 0x00}, {0x24, 0x78}, {0x25, 0x68},
+        {0x26, 0xd4}, {0x27, 0x80}, {0x28, 0x80},
+        {0x29, 0x30}, {0x2a, 0x00}, {0x2b, 0x00},
+        {0x2c, 0x80}, {0x2d, 0x00}, {0x2e, 0x00},
+        {0x2f, 0x00}, {0x30, 0x08}, {0x31, 0x30},
+        {0x32, 0x84}, {0x33, 0xe2}, {0x34, 0xbf},
+        {0x35, 0x81}, {0x36, 0xf9}, {0x37, 0x00},
+        {0x38, 0x93}, {0x39, 0x50}, {0x3a, 0x01},
+        {0x3b, 0x01}, {0x3c, 0x73}, {0x3d, 0x19},
+        {0x3e, 0x0b}, {0x3f, 0x80}, {0x40, 0xc1},
+        {0x41, 0x00}, {0x42, 0x08}, {0x67, 0x80},
+        {0x68, 0x80}, {0x69, 0x40}, {0x6a, 0x00},
+        {0x6b, 0x0a}, {0x8b, 0x06}, {0x8c, 0x20},
+        {0x8d, 0x00}, {0x8e, 0x00}, {0x8f, 0xdf},
+        {0x92, 0x00}, {0x93, 0x00}, {0x94, 0x88},
+        {0x95, 0x88}, {0x96, 0x04}, {0xa1, 0x00},
+        {0xa5, 0x80}, {0xa8, 0x80}, {0xa9, 0xb8},
+        {0xaa, 0x92}, {0xab, 0x0a},
+};
+
+static u8 ov9655_init[][2] = {
+        {0x12, 0x80}, {0x12, 0x01}, {0x0d, 0x00}, {0x0e, 0x61},
+        {0x11, 0x80}, {0x13, 0xba}, {0x14, 0x2e}, {0x16, 0x24},
+        {0x1e, 0x04}, {0x1e, 0x04}, {0x1e, 0x04}, {0x27, 0x08},
+        {0x28, 0x08}, {0x29, 0x15}, {0x2c, 0x08}, {0x32, 0xbf},
+        {0x34, 0x3d}, {0x35, 0x00}, {0x36, 0xf8}, {0x38, 0x12},
+        {0x39, 0x57}, {0x3a, 0x00}, {0x3b, 0xcc}, {0x3c, 0x0c},
+        {0x3d, 0x19}, {0x3e, 0x0c}, {0x3f, 0x01}, {0x41, 0x40},
+        {0x42, 0x80}, {0x45, 0x46}, {0x46, 0x62}, {0x47, 0x2a},
+        {0x48, 0x3c}, {0x4a, 0xf0}, {0x4b, 0xdc}, {0x4c, 0xdc},
+        {0x4d, 0xdc}, {0x4e, 0xdc}, {0x69, 0x02}, {0x6c, 0x04},
+        {0x6f, 0x9e}, {0x70, 0x05}, {0x71, 0x78}, {0x77, 0x02},
+        {0x8a, 0x23}, {0x8c, 0x0d}, {0x90, 0x7e}, {0x91, 0x7c},
+        {0x9f, 0x6e}, {0xa0, 0x6e}, {0xa5, 0x68}, {0xa6, 0x60},
+        {0xa8, 0xc1}, {0xa9, 0xfa}, {0xaa, 0x92}, {0xab, 0x04},
+        {0xac, 0x80}, {0xad, 0x80}, {0xae, 0x80}, {0xaf, 0x80},
+        {0xb2, 0xf2}, {0xb3, 0x20}, {0xb5, 0x00}, {0xb6, 0xaf},
+        {0xbb, 0xae}, {0xbc, 0x44}, {0xbd, 0x44}, {0xbe, 0x3b},
+        {0xbf, 0x3a}, {0xc0, 0xe2}, {0xc1, 0xc8}, {0xc2, 0x01},
+        {0xc4, 0x00}, {0xc6, 0x85}, {0xc7, 0x81}, {0xc9, 0xe0},
+        {0xca, 0xe8}, {0xcc, 0xd8}, {0xcd, 0x93}, {0x12, 0x61},
+        {0x36, 0xfa}, {0x8c, 0x8d}, {0xc0, 0xaa}, {0x69, 0x0a},
+        {0x03, 0x12}, {0x17, 0x14}, {0x18, 0x00}, {0x19, 0x01},
+        {0x1a, 0x3d}, {0x32, 0xbf}, {0x11, 0x80}, {0x2a, 0x10},
+        {0x2b, 0x0a}, {0x92, 0x00}, {0x93, 0x00}, {0x1e, 0x04},
+        {0x1e, 0x04}, {0x10, 0x7c}, {0x04, 0x03}, {0xa1, 0x00},
+        {0x2d, 0x00}, {0x2e, 0x00}, {0x00, 0x00}, {0x01, 0x80},
+        {0x02, 0x80}, {0x12, 0x61}, {0x36, 0xfa}, {0x8c, 0x8d},
+        {0xc0, 0xaa}, {0x69, 0x0a}, {0x03, 0x12}, {0x17, 0x14},
+        {0x18, 0x00}, {0x19, 0x01}, {0x1a, 0x3d}, {0x32, 0xbf},
+        {0x11, 0x80}, {0x2a, 0x10}, {0x2b, 0x0a}, {0x92, 0x00},
+        {0x93, 0x00}, {0x04, 0x01}, {0x10, 0x1f}, {0xa1, 0x00},
+        {0x00, 0x0a}, {0xa1, 0x00}, {0x10, 0x5d}, {0x04, 0x03},
+        {0x00, 0x01}, {0xa1, 0x00}, {0x10, 0x7c}, {0x04, 0x03},
+        {0x00, 0x03}, {0x00, 0x0a}, {0x00, 0x10}, {0x00, 0x13},
+};
+
+static u16 mt9v112_init[][2] = {
+        {0xf0, 0x0000}, {0x0d, 0x0021}, {0x0d, 0x0020},
+        {0x34, 0xc019}, {0x0a, 0x0011}, {0x0b, 0x000b},
+        {0x20, 0x0703}, {0x35, 0x2022}, {0xf0, 0x0001},
+        {0x05, 0x0000}, {0x06, 0x340c}, {0x3b, 0x042a},
+        {0x3c, 0x0400}, {0xf0, 0x0002}, {0x2e, 0x0c58},
+        {0x5b, 0x0001}, {0xc8, 0x9f0b}, {0xf0, 0x0001},
+        {0x9b, 0x5300}, {0xf0, 0x0000}, {0x2b, 0x0020},
+        {0x2c, 0x002a}, {0x2d, 0x0032}, {0x2e, 0x0020},
+        {0x09, 0x01dc}, {0x01, 0x000c}, {0x02, 0x0020},
+        {0x03, 0x01e0}, {0x04, 0x0280}, {0x06, 0x000c},
+        {0x05, 0x0098}, {0x20, 0x0703}, {0x09, 0x01f2},
+        {0x2b, 0x00a0}, {0x2c, 0x00a0}, {0x2d, 0x00a0},
+        {0x2e, 0x00a0}, {0x01, 0x000c}, {0x02, 0x0020},
+        {0x03, 0x01e0}, {0x04, 0x0280}, {0x06, 0x000c},
+        {0x05, 0x0098}, {0x09, 0x01c1}, {0x2b, 0x00ae},
+        {0x2c, 0x00ae}, {0x2d, 0x00ae}, {0x2e, 0x00ae},
+};
+
+static u16 mt9v111_init[][2] = {
+        {0x01, 0x0004}, {0x0d, 0x0001}, {0x0d, 0x0000},
+        {0x01, 0x0001}, {0x02, 0x0016}, {0x03, 0x01e1},
+        {0x04, 0x0281}, {0x05, 0x0004}, {0x07, 0x3002},
+        {0x21, 0x0000}, {0x25, 0x4024}, {0x26, 0xff03},
+        {0x27, 0xff10}, {0x2b, 0x7828}, {0x2c, 0xb43c},
+        {0x2d, 0xf0a0}, {0x2e, 0x0c64}, {0x2f, 0x0064},
+        {0x67, 0x4010}, {0x06, 0x301e}, {0x08, 0x0480},
+        {0x01, 0x0004}, {0x02, 0x0016}, {0x03, 0x01e6},
+        {0x04, 0x0286}, {0x05, 0x0004}, {0x06, 0x0000},
+        {0x07, 0x3002}, {0x08, 0x0008}, {0x0c, 0x0000},
+        {0x0d, 0x0000}, {0x0e, 0x0000}, {0x0f, 0x0000},
+        {0x10, 0x0000}, {0x11, 0x0000}, {0x12, 0x00b0},
+        {0x13, 0x007c}, {0x14, 0x0000}, {0x15, 0x0000},
+        {0x16, 0x0000}, {0x17, 0x0000}, {0x18, 0x0000},
+        {0x19, 0x0000}, {0x1a, 0x0000}, {0x1b, 0x0000},
+        {0x1c, 0x0000}, {0x1d, 0x0000}, {0x30, 0x0000},
+        {0x30, 0x0005}, {0x31, 0x0000}, {0x02, 0x0016},
+        {0x03, 0x01e1}, {0x04, 0x0281}, {0x05, 0x0004},
+        {0x06, 0x0000}, {0x07, 0x3002}, {0x06, 0x002d},
+        {0x05, 0x0004}, {0x09, 0x0064}, {0x2b, 0x00a0},
+        {0x2c, 0x00a0}, {0x2d, 0x00a0}, {0x2e, 0x00a0},
+        {0x02, 0x0016}, {0x03, 0x01e1}, {0x04, 0x0281},
+        {0x05, 0x0004}, {0x06, 0x002d}, {0x07, 0x3002},
+        {0x0e, 0x0008}, {0x06, 0x002d}, {0x05, 0x0004},
+};
+
+static u16 mt9v011_init[][2] = {
+        {0x07, 0x0002}, {0x0d, 0x0001}, {0x0d, 0x0000},
+        {0x01, 0x0008}, {0x02, 0x0016}, {0x03, 0x01e1},
+        {0x04, 0x0281}, {0x05, 0x0083}, {0x06, 0x0006},
+        {0x0d, 0x0002}, {0x0a, 0x0000}, {0x0b, 0x0000},
+        {0x0c, 0x0000}, {0x0d, 0x0000}, {0x0e, 0x0000},
+        {0x0f, 0x0000}, {0x10, 0x0000}, {0x11, 0x0000},
+        {0x12, 0x0000}, {0x13, 0x0000}, {0x14, 0x0000},
+        {0x15, 0x0000}, {0x16, 0x0000}, {0x17, 0x0000},
+        {0x18, 0x0000}, {0x19, 0x0000}, {0x1a, 0x0000},
+        {0x1b, 0x0000}, {0x1c, 0x0000}, {0x1d, 0x0000},
+        {0x32, 0x0000}, {0x20, 0x1101}, {0x21, 0x0000},
+        {0x22, 0x0000}, {0x23, 0x0000}, {0x24, 0x0000},
+        {0x25, 0x0000}, {0x26, 0x0000}, {0x27, 0x0024},
+        {0x2f, 0xf7b0}, {0x30, 0x0005}, {0x31, 0x0000},
+        {0x32, 0x0000}, {0x33, 0x0000}, {0x34, 0x0100},
+        {0x3d, 0x068f}, {0x40, 0x01e0}, {0x41, 0x00d1},
+        {0x44, 0x0082}, {0x5a, 0x0000}, {0x5b, 0x0000},
+        {0x5c, 0x0000}, {0x5d, 0x0000}, {0x5e, 0x0000},
+        {0x5f, 0xa31d}, {0x62, 0x0611}, {0x0a, 0x0000},
+        {0x06, 0x0029}, {0x05, 0x0009}, {0x20, 0x1101},
+        {0x20, 0x1101}, {0x09, 0x0064}, {0x07, 0x0003},
+        {0x2b, 0x0033}, {0x2c, 0x00a0}, {0x2d, 0x00a0},
+        {0x2e, 0x0033}, {0x07, 0x0002}, {0x06, 0x0000},
+        {0x06, 0x0029}, {0x05, 0x0009},
+};
+
+static u16 mt9m001_init[][2] = {
+        {0x0d, 0x0001}, {0x0d, 0x0000}, {0x01, 0x000e},
+        {0x02, 0x0014}, {0x03, 0x03c1}, {0x04, 0x0501},
+        {0x05, 0x0083}, {0x06, 0x0006}, {0x0d, 0x0002},
+        {0x0a, 0x0000}, {0x0c, 0x0000}, {0x11, 0x0000},
+        {0x1e, 0x8000}, {0x5f, 0x8904}, {0x60, 0x0000},
+        {0x61, 0x0000}, {0x62, 0x0498}, {0x63, 0x0000},
+        {0x64, 0x0000}, {0x20, 0x111d}, {0x06, 0x00f2},
+        {0x05, 0x0013}, {0x09, 0x10f2}, {0x07, 0x0003},
+        {0x2b, 0x002a}, {0x2d, 0x002a}, {0x2c, 0x002a},
+        {0x2e, 0x0029}, {0x07, 0x0002},
+};
+
+static u16 mt9m111_init[][2] = {
+        {0xf0, 0x0000}, {0x0d, 0x0008}, {0x0d, 0x0009},
+        {0x0d, 0x0008}, {0xf0, 0x0001}, {0x3a, 0x4300},
+        {0x9b, 0x4300}, {0xa1, 0x0280}, {0xa4, 0x0200},
+        {0x06, 0x308e}, {0xf0, 0x0000},
+};
+
+static u8 hv7131r_init[][2] = {
+        {0x02, 0x08}, {0x02, 0x00}, {0x01, 0x08},
+        {0x02, 0x00}, {0x20, 0x00}, {0x21, 0xd0},
+        {0x22, 0x00}, {0x23, 0x09}, {0x01, 0x08},
+        {0x01, 0x08}, {0x01, 0x08}, {0x25, 0x07},
+        {0x26, 0xc3}, {0x27, 0x50}, {0x30, 0x62},
+        {0x31, 0x10}, {0x32, 0x06}, {0x33, 0x10},
+        {0x20, 0x00}, {0x21, 0xd0}, {0x22, 0x00},
+        {0x23, 0x09}, {0x01, 0x08},
+};
+
+int reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length)
+{
+        struct usb_device *dev = gspca_dev->dev;
+        int result;
+        result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+                        0x00,
+                        USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+                        reg,
+                        0x00,
+                        gspca_dev->usb_buf,
+                        length,
+                        500);
+        if (unlikely(result < 0 || result != length)) {
+                err("Read register failed 0x%02X", reg);
+                return -EIO;
+        }
+        return 0;
+}
+
+int reg_w(struct gspca_dev *gspca_dev, u16 reg, const u8 *buffer, int length)
+{
+        struct usb_device *dev = gspca_dev->dev;
+        int result;
+        memcpy(gspca_dev->usb_buf, buffer, length);
+        result = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+                        0x08,
+                        USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+                        reg,
+                        0x00,
+                        gspca_dev->usb_buf,
+                        length,
+                        500);
+        if (unlikely(result < 0 || result != length)) {
+                err("Write register failed index 0x%02X", reg);
+                return -EIO;
+        }
+        return 0;
+}
+
+int reg_w1(struct gspca_dev *gspca_dev, u16 reg, const u8 value)
+{
+        u8 data[1] = {value};
+        return reg_w(gspca_dev, reg, data, 1);
+}
+
+int i2c_w(struct gspca_dev *gspca_dev, const u8 *buffer)
+{
+        int i;
+        reg_w(gspca_dev, 0x10c0, buffer, 8);
+        for (i = 0; i < 5; i++) {
+                reg_r(gspca_dev, 0x10c0, 1);
+                if (gspca_dev->usb_buf[0] & 0x04) {
+                        if (gspca_dev->usb_buf[0] & 0x08)
+                                return -1;
+                        return 0;
+                }
+                msleep(1);
+        }
+        return -1;
+}
+
+int i2c_w1(struct gspca_dev *gspca_dev, u8 reg, u8 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        u8 row[8];
+
+        /*
+         * from the point of view of the bridge, the length
+         * includes the address
+         */
+        row[0] = 0x81 | (2 << 4);
+        row[1] = sd->i2c_addr;
+        row[2] = reg;
+        row[3] = val;
+        row[4] = 0x00;
+        row[5] = 0x00;
+        row[6] = 0x00;
+        row[7] = 0x10;
+
+        return i2c_w(gspca_dev, row);
+}
+
+int i2c_w2(struct gspca_dev *gspca_dev, u8 reg, u16 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 row[8];
+
+        /*
+         * from the point of view of the bridge, the length
+         * includes the address
+         */
+        row[0] = 0x81 | (3 << 4);
+        row[1] = sd->i2c_addr;
+        row[2] = reg;
+        row[3] = (val >> 8) & 0xff;
+        row[4] = val & 0xff;
+        row[5] = 0x00;
+        row[6] = 0x00;
+        row[7] = 0x10;
+
+        return i2c_w(gspca_dev, row);
+}
+
+int i2c_r1(struct gspca_dev *gspca_dev, u8 reg, u8 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 row[8];
+
+        row[0] = 0x81 | 0x10;
+        row[1] = sd->i2c_addr;
+        row[2] = reg;
+        row[3] = 0;
+        row[4] = 0;
+        row[5] = 0;
+        row[6] = 0;
+        row[7] = 0x10;
+        reg_w(gspca_dev, 0x10c0, row, 8);
+        msleep(1);
+        row[0] = 0x81 | (2 << 4) | 0x02;
+        row[2] = 0;
+        reg_w(gspca_dev, 0x10c0, row, 8);
+        msleep(1);
+        reg_r(gspca_dev, 0x10c2, 5);
+        *val = gspca_dev->usb_buf[3];
+        return 0;
+}
+
+int i2c_r2(struct gspca_dev *gspca_dev, u8 reg, u16 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 row[8];
+
+        row[0] = 0x81 | 0x10;
+        row[1] = sd->i2c_addr;
+        row[2] = reg;
+        row[3] = 0;
+        row[4] = 0;
+        row[5] = 0;
+        row[6] = 0;
+        row[7] = 0x10;
+        reg_w(gspca_dev, 0x10c0, row, 8);
+        msleep(1);
+        row[0] = 0x81 | (3 << 4) | 0x02;
+        row[2] = 0;
+        reg_w(gspca_dev, 0x10c0, row, 8);
+        msleep(1);
+        reg_r(gspca_dev, 0x10c2, 5);
+        *val = (gspca_dev->usb_buf[2] << 8) | gspca_dev->usb_buf[3];
+        return 0;
+}
+
+static int ov9650_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(ov9650_init); i++) {
+                if (i2c_w1(gspca_dev, ov9650_init[i][0],
+                                ov9650_init[i][1]) < 0) {
+                        err("OV9650 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        sd->hstart = 1;
+        sd->vstart = 7;
+        return 0;
+}
+
+static int ov9655_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(ov9655_init); i++) {
+                if (i2c_w1(gspca_dev, ov9655_init[i][0],
+                                ov9655_init[i][1]) < 0) {
+                        err("OV9655 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 0;
+        sd->vstart = 7;
+        return 0;
+}
+
+static int soi968_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(soi968_init); i++) {
+                if (i2c_w1(gspca_dev, soi968_init[i][0],
+                                soi968_init[i][1]) < 0) {
+                        err("SOI968 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 60;
+        sd->vstart = 11;
+        return 0;
+}
+
+static int ov7660_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(ov7660_init); i++) {
+                if (i2c_w1(gspca_dev, ov7660_init[i][0],
+                                ov7660_init[i][1]) < 0) {
+                        err("OV7660 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 1;
+        sd->vstart = 1;
+        return 0;
+}
+
+static int ov7670_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(ov7670_init); i++) {
+                if (i2c_w1(gspca_dev, ov7670_init[i][0],
+                                ov7670_init[i][1]) < 0) {
+                        err("OV7670 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 0;
+        sd->vstart = 1;
+        return 0;
+}
+
+static int mt9v_init_sensor(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int i;
+        u16 value;
+        int ret;
+
+        sd->i2c_addr = 0x5d;
+        ret = i2c_r2(gspca_dev, 0xff, &value);
+        if ((ret == 0) && (value == 0x8243)) {
+                for (i = 0; i < ARRAY_SIZE(mt9v011_init); i++) {
+                        if (i2c_w2(gspca_dev, mt9v011_init[i][0],
+                                        mt9v011_init[i][1]) < 0) {
+                                err("MT9V011 sensor initialization failed");
+                                return -ENODEV;
+                        }
+                }
+                sd->hstart = 2;
+                sd->vstart = 2;
+                sd->sensor = SENSOR_MT9V011;
+                info("MT9V011 sensor detected");
+                return 0;
+        }
+
+        sd->i2c_addr = 0x5c;
+        i2c_w2(gspca_dev, 0x01, 0x0004);
+        ret = i2c_r2(gspca_dev, 0xff, &value);
+        if ((ret == 0) && (value == 0x823a)) {
+                for (i = 0; i < ARRAY_SIZE(mt9v111_init); i++) {
+                        if (i2c_w2(gspca_dev, mt9v111_init[i][0],
+                                        mt9v111_init[i][1]) < 0) {
+                                err("MT9V111 sensor initialization failed");
+                                return -ENODEV;
+                        }
+                }
+                sd->hstart = 2;
+                sd->vstart = 2;
+                sd->sensor = SENSOR_MT9V111;
+                info("MT9V111 sensor detected");
+                return 0;
+        }
+
+        sd->i2c_addr = 0x5d;
+        ret = i2c_w2(gspca_dev, 0xf0, 0x0000);
+        if (ret < 0) {
+                sd->i2c_addr = 0x48;
+                i2c_w2(gspca_dev, 0xf0, 0x0000);
+        }
+        ret = i2c_r2(gspca_dev, 0x00, &value);
+        if ((ret == 0) && (value == 0x1229)) {
+                for (i = 0; i < ARRAY_SIZE(mt9v112_init); i++) {
+                        if (i2c_w2(gspca_dev, mt9v112_init[i][0],
+                                        mt9v112_init[i][1]) < 0) {
+                                err("MT9V112 sensor initialization failed");
+                                return -ENODEV;
+                        }
+                }
+                sd->hstart = 6;
+                sd->vstart = 2;
+                sd->sensor = SENSOR_MT9V112;
+                info("MT9V112 sensor detected");
+                return 0;
+        }
+
+        return -ENODEV;
+}
+
+static int mt9m111_init_sensor(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(mt9m111_init); i++) {
+                if (i2c_w2(gspca_dev, mt9m111_init[i][0],
+                                mt9m111_init[i][1]) < 0) {
+                        err("MT9M111 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        sd->hstart = 0;
+        sd->vstart = 2;
+        return 0;
+}
+
+static int mt9m001_init_sensor(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(mt9m001_init); i++) {
+                if (i2c_w2(gspca_dev, mt9m001_init[i][0],
+                                mt9m001_init[i][1]) < 0) {
+                        err("MT9M001 sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        /* disable hflip and vflip */
+        gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX);
+        sd->hstart = 2;
+        sd->vstart = 2;
+        return 0;
+}
+
+static int hv7131r_init_sensor(struct gspca_dev *gspca_dev)
+{
+        int i;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        for (i = 0; i < ARRAY_SIZE(hv7131r_init); i++) {
+                if (i2c_w1(gspca_dev, hv7131r_init[i][0],
+                                hv7131r_init[i][1]) < 0) {
+                        err("HV7131R Sensor initialization failed");
+                        return -ENODEV;
+                }
+        }
+        sd->hstart = 0;
+        sd->vstart = 1;
+        return 0;
+}
+
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+static int input_kthread(void *data)
+{
+        struct gspca_dev *gspca_dev = (struct gspca_dev *)data;
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        DECLARE_WAIT_QUEUE_HEAD(wait);
+        set_freezable();
+        for (;;) {
+                if (kthread_should_stop())
+                        break;
+
+                if (reg_r(gspca_dev, 0x1005, 1) < 0)
+                        continue;
+
+                input_report_key(sd->input_dev,
+                                 KEY_CAMERA,
+                                 gspca_dev->usb_buf[0] & sd->input_gpio);
+                input_sync(sd->input_dev);
+
+                wait_event_freezable_timeout(wait,
+                                             kthread_should_stop(),
+                                             msecs_to_jiffies(100));
+        }
+        return 0;
+}
+
+
+static int sn9c20x_input_init(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        if (sd->input_gpio == 0)
+                return 0;
+
+        sd->input_dev = input_allocate_device();
+        if (!sd->input_dev)
+                return -ENOMEM;
+
+        sd->input_dev->name = "SN9C20X Webcam";
+
+        sd->input_dev->phys = kasprintf(GFP_KERNEL, "usb-%s-%s",
+                                         gspca_dev->dev->bus->bus_name,
+                                         gspca_dev->dev->devpath);
+
+        if (!sd->input_dev->phys)
+                return -ENOMEM;
+
+        usb_to_input_id(gspca_dev->dev, &sd->input_dev->id);
+        sd->input_dev->dev.parent = &gspca_dev->dev->dev;
+
+        set_bit(EV_KEY, sd->input_dev->evbit);
+        set_bit(KEY_CAMERA, sd->input_dev->keybit);
+
+        if (input_register_device(sd->input_dev))
+                return -EINVAL;
+
+        sd->input_task = kthread_run(input_kthread, gspca_dev, "sn9c20x/%d",
+                                     gspca_dev->vdev.minor);
+
+        if (IS_ERR(sd->input_task))
+                return -EINVAL;
+
+        return 0;
+}
+
+static void sn9c20x_input_cleanup(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        if (sd->input_task != NULL && !IS_ERR(sd->input_task))
+                kthread_stop(sd->input_task);
+
+        if (sd->input_dev != NULL) {
+                input_unregister_device(sd->input_dev);
+                kfree(sd->input_dev->phys);
+                input_free_device(sd->input_dev);
+                sd->input_dev = NULL;
+        }
+}
+#endif
+
+static int set_cmatrix(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        s32 hue_coord, hue_index = 180 + sd->hue;
+        u8 cmatrix[21];
+        memset(cmatrix, 0, 21);
+
+        cmatrix[2] = (sd->contrast * 0x25 / 0x100) + 0x26;
+        cmatrix[0] = 0x13 + (cmatrix[2] - 0x26) * 0x13 / 0x25;
+        cmatrix[4] = 0x07 + (cmatrix[2] - 0x26) * 0x07 / 0x25;
+        cmatrix[18] = sd->brightness - 0x80;
+
+        hue_coord = (hsv_red_x[hue_index] * sd->saturation) >> 8;
+        cmatrix[6] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[7] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_red_y[hue_index] * sd->saturation) >> 8;
+        cmatrix[8] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[9] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_green_x[hue_index] * sd->saturation) >> 8;
+        cmatrix[10] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[11] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_green_y[hue_index] * sd->saturation) >> 8;
+        cmatrix[12] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[13] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_blue_x[hue_index] * sd->saturation) >> 8;
+        cmatrix[14] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[15] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        hue_coord = (hsv_blue_y[hue_index] * sd->saturation) >> 8;
+        cmatrix[16] = (unsigned char)(hue_coord & 0xff);
+        cmatrix[17] = (unsigned char)((hue_coord >> 8) & 0x0f);
+
+        return reg_w(gspca_dev, 0x10e1, cmatrix, 21);
+}
+
+static int set_gamma(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 gamma[17];
+        u8 gval = sd->gamma * 0xb8 / 0x100;
+
+
+        gamma[0] = 0x0a;
+        gamma[1] = 0x13 + (gval * (0xcb - 0x13) / 0xb8);
+        gamma[2] = 0x25 + (gval * (0xee - 0x25) / 0xb8);
+        gamma[3] = 0x37 + (gval * (0xfa - 0x37) / 0xb8);
+        gamma[4] = 0x45 + (gval * (0xfc - 0x45) / 0xb8);
+        gamma[5] = 0x55 + (gval * (0xfb - 0x55) / 0xb8);
+        gamma[6] = 0x65 + (gval * (0xfc - 0x65) / 0xb8);
+        gamma[7] = 0x74 + (gval * (0xfd - 0x74) / 0xb8);
+        gamma[8] = 0x83 + (gval * (0xfe - 0x83) / 0xb8);
+        gamma[9] = 0x92 + (gval * (0xfc - 0x92) / 0xb8);
+        gamma[10] = 0xa1 + (gval * (0xfc - 0xa1) / 0xb8);
+        gamma[11] = 0xb0 + (gval * (0xfc - 0xb0) / 0xb8);
+        gamma[12] = 0xbf + (gval * (0xfb - 0xbf) / 0xb8);
+        gamma[13] = 0xce + (gval * (0xfb - 0xce) / 0xb8);
+        gamma[14] = 0xdf + (gval * (0xfd - 0xdf) / 0xb8);
+        gamma[15] = 0xea + (gval * (0xf9 - 0xea) / 0xb8);
+        gamma[16] = 0xf5;
+
+        return reg_w(gspca_dev, 0x1190, gamma, 17);
+}
+
+static int set_redblue(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        reg_w1(gspca_dev, 0x118c, sd->red);
+        reg_w1(gspca_dev, 0x118f, sd->blue);
+        return 0;
+}
+
+static int set_hvflip(struct gspca_dev *gspca_dev)
+{
+        u8 value, tslb;
+        u16 value2;
+        struct sd *sd = (struct sd *) gspca_dev;
+        switch (sd->sensor) {
+        case SENSOR_OV9650:
+                i2c_r1(gspca_dev, 0x1e, &value);
+                value &= ~0x30;
+                tslb = 0x01;
+                if (sd->hflip)
+                        value |= 0x20;
+                if (sd->vflip) {
+                        value |= 0x10;
+                        tslb = 0x49;
+                }
+                i2c_w1(gspca_dev, 0x1e, value);
+                i2c_w1(gspca_dev, 0x3a, tslb);
+                break;
+        case SENSOR_MT9V111:
+        case SENSOR_MT9V011:
+                i2c_r2(gspca_dev, 0x20, &value2);
+                value2 &= ~0xc0a0;
+                if (sd->hflip)
+                        value2 |= 0x8080;
+                if (sd->vflip)
+                        value2 |= 0x4020;
+                i2c_w2(gspca_dev, 0x20, value2);
+                break;
+        case SENSOR_MT9M111:
+        case SENSOR_MT9V112:
+                i2c_r2(gspca_dev, 0x20, &value2);
+                value2 &= ~0x0003;
+                if (sd->hflip)
+                        value2 |= 0x0002;
+                if (sd->vflip)
+                        value2 |= 0x0001;
+                i2c_w2(gspca_dev, 0x20, value2);
+                break;
+        case SENSOR_HV7131R:
+                i2c_r1(gspca_dev, 0x01, &value);
+                value &= ~0x03;
+                if (sd->vflip)
+                        value |= 0x01;
+                if (sd->hflip)
+                        value |= 0x02;
+                i2c_w1(gspca_dev, 0x01, value);
+                break;
+        }
+        return 0;
+}
+
+static int set_exposure(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 exp[8] = {0x81, sd->i2c_addr, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e};
+        switch (sd->sensor) {
+        case SENSOR_OV7660:
+        case SENSOR_OV7670:
+        case SENSOR_SOI968:
+        case SENSOR_OV9655:
+        case SENSOR_OV9650:
+                exp[0] |= (3 << 4);
+                exp[2] = 0x2d;
+                exp[3] = sd->exposure & 0xff;
+                exp[4] = sd->exposure >> 8;
+                break;
+        case SENSOR_MT9M001:
+        case SENSOR_MT9M111:
+        case SENSOR_MT9V112:
+        case SENSOR_MT9V111:
+        case SENSOR_MT9V011:
+                exp[0] |= (3 << 4);
+                exp[2] = 0x09;
+                exp[3] = sd->exposure >> 8;
+                exp[4] = sd->exposure & 0xff;
+                break;
+        case SENSOR_HV7131R:
+                exp[0] |= (4 << 4);
+                exp[2] = 0x25;
+                exp[3] = ((sd->exposure * 0xffffff) / 0xffff) >> 16;
+                exp[4] = ((sd->exposure * 0xffffff) / 0xffff) >> 8;
+                exp[5] = ((sd->exposure * 0xffffff) / 0xffff) & 0xff;
+                break;
+        }
+        i2c_w(gspca_dev, exp);
+        return 0;
+}
+
+static int set_gain(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 gain[8] = {0x81, sd->i2c_addr, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1d};
+        switch (sd->sensor) {
+        case SENSOR_OV7660:
+        case SENSOR_OV7670:
+        case SENSOR_SOI968:
+        case SENSOR_OV9655:
+        case SENSOR_OV9650:
+                gain[0] |= (2 << 4);
+                gain[3] = ov_gain[sd->gain];
+                break;
+        case SENSOR_MT9V011:
+        case SENSOR_MT9V111:
+                gain[0] |= (3 << 4);
+                gain[2] = 0x35;
+                gain[3] = micron1_gain[sd->gain] >> 8;
+                gain[4] = micron1_gain[sd->gain] & 0xff;
+                break;
+        case SENSOR_MT9V112:
+        case SENSOR_MT9M111:
+                gain[0] |= (3 << 4);
+                gain[2] = 0x2f;
+                gain[3] = micron1_gain[sd->gain] >> 8;
+                gain[4] = micron1_gain[sd->gain] & 0xff;
+                break;
+        case SENSOR_MT9M001:
+                gain[0] |= (3 << 4);
+                gain[2] = 0x2f;
+                gain[3] = micron2_gain[sd->gain] >> 8;
+                gain[4] = micron2_gain[sd->gain] & 0xff;
+                break;
+        case SENSOR_HV7131R:
+                gain[0] |= (2 << 4);
+                gain[2] = 0x30;
+                gain[3] = hv7131r_gain[sd->gain];
+                break;
+        }
+        i2c_w(gspca_dev, gain);
+        return 0;
+}
+
+static int sd_setbrightness(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->brightness = val;
+        if (gspca_dev->streaming)
+                return set_cmatrix(gspca_dev);
+        return 0;
+}
+
+static int sd_getbrightness(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->brightness;
+        return 0;
+}
+
+
+static int sd_setcontrast(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->contrast = val;
+        if (gspca_dev->streaming)
+                return set_cmatrix(gspca_dev);
+        return 0;
+}
+
+static int sd_getcontrast(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->contrast;
+        return 0;
+}
+
+static int sd_setsaturation(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->saturation = val;
+        if (gspca_dev->streaming)
+                return set_cmatrix(gspca_dev);
+        return 0;
+}
+
+static int sd_getsaturation(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->saturation;
+        return 0;
+}
+
+static int sd_sethue(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->hue = val;
+        if (gspca_dev->streaming)
+                return set_cmatrix(gspca_dev);
+        return 0;
+}
+
+static int sd_gethue(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->hue;
+        return 0;
+}
+
+static int sd_setgamma(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->gamma = val;
+        if (gspca_dev->streaming)
+                return set_gamma(gspca_dev);
+        return 0;
+}
+
+static int sd_getgamma(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->gamma;
+        return 0;
+}
+
+static int sd_setredbalance(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->red = val;
+        if (gspca_dev->streaming)
+                return set_redblue(gspca_dev);
+        return 0;
+}
+
+static int sd_getredbalance(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->red;
+        return 0;
+}
+
+static int sd_setbluebalance(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->blue = val;
+        if (gspca_dev->streaming)
+                return set_redblue(gspca_dev);
+        return 0;
+}
+
+static int sd_getbluebalance(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->blue;
+        return 0;
+}
+
+static int sd_sethflip(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->hflip = val;
+        if (gspca_dev->streaming)
+                return set_hvflip(gspca_dev);
+        return 0;
+}
+
+static int sd_gethflip(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->hflip;
+        return 0;
+}
+
+static int sd_setvflip(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->vflip = val;
+        if (gspca_dev->streaming)
+                return set_hvflip(gspca_dev);
+        return 0;
+}
+
+static int sd_getvflip(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->vflip;
+        return 0;
+}
+
+static int sd_setexposure(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->exposure = val;
+        if (gspca_dev->streaming)
+                return set_exposure(gspca_dev);
+        return 0;
+}
+
+static int sd_getexposure(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->exposure;
+        return 0;
+}
+
+static int sd_setgain(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        sd->gain = val;
+        if (gspca_dev->streaming)
+                return set_gain(gspca_dev);
+        return 0;
+}
+
+static int sd_getgain(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->gain;
+        return 0;
+}
+
+static int sd_setautoexposure(struct gspca_dev *gspca_dev, s32 val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        sd->auto_exposure = val;
+        return 0;
+}
+
+static int sd_getautoexposure(struct gspca_dev *gspca_dev, s32 *val)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        *val = sd->auto_exposure;
+        return 0;
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int sd_dbg_g_register(struct gspca_dev *gspca_dev,
+                        struct v4l2_dbg_register *reg)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        switch (reg->match.type) {
+        case V4L2_CHIP_MATCH_HOST:
+                if (reg->match.addr != 0)
+                        return -EINVAL;
+                if (reg->reg < 0x1000 || reg->reg > 0x11ff)
+                        return -EINVAL;
+                if (reg_r(gspca_dev, reg->reg, 1) < 0)
+                        return -EINVAL;
+                reg->val = gspca_dev->usb_buf[0];
+                return 0;
+        case V4L2_CHIP_MATCH_I2C_ADDR:
+                if (reg->match.addr != sd->i2c_addr)
+                        return -EINVAL;
+                if (sd->sensor >= SENSOR_MT9V011 &&
+                    sd->sensor <= SENSOR_MT9M111) {
+                        if (i2c_r2(gspca_dev, reg->reg, (u16 *)&reg->val) < 0)
+                                return -EINVAL;
+                } else {
+                        if (i2c_r1(gspca_dev, reg->reg, (u8 *)&reg->val) < 0)
+                                return -EINVAL;
+                }
+                return 0;
+        }
+        return -EINVAL;
+}
+
+static int sd_dbg_s_register(struct gspca_dev *gspca_dev,
+                        struct v4l2_dbg_register *reg)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        switch (reg->match.type) {
+        case V4L2_CHIP_MATCH_HOST:
+                if (reg->match.addr != 0)
+                        return -EINVAL;
+                if (reg->reg < 0x1000 || reg->reg > 0x11ff)
+                        return -EINVAL;
+                if (reg_w1(gspca_dev, reg->reg, reg->val) < 0)
+                        return -EINVAL;
+                return 0;
+        case V4L2_CHIP_MATCH_I2C_ADDR:
+                if (reg->match.addr != sd->i2c_addr)
+                        return -EINVAL;
+                if (sd->sensor >= SENSOR_MT9V011 &&
+                    sd->sensor <= SENSOR_MT9M111) {
+                        if (i2c_w2(gspca_dev, reg->reg, reg->val) < 0)
+                                return -EINVAL;
+                } else {
+                        if (i2c_w1(gspca_dev, reg->reg, reg->val) < 0)
+                                return -EINVAL;
+                }
+                return 0;
+        }
+        return -EINVAL;
+}
+#endif
+
+static int sd_chip_ident(struct gspca_dev *gspca_dev,
+                        struct v4l2_dbg_chip_ident *chip)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+
+        switch (chip->match.type) {
+        case V4L2_CHIP_MATCH_HOST:
+                if (chip->match.addr != 0)
+                        return -EINVAL;
+                chip->revision = 0;
+                chip->ident = V4L2_IDENT_SN9C20X;
+                return 0;
+        case V4L2_CHIP_MATCH_I2C_ADDR:
+                if (chip->match.addr != sd->i2c_addr)
+                        return -EINVAL;
+                chip->revision = 0;
+                chip->ident = i2c_ident[sd->sensor];
+                return 0;
+        }
+        return -EINVAL;
+}
+
+static int sd_config(struct gspca_dev *gspca_dev,
+                        const struct usb_device_id *id)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        struct cam *cam;
+
+        cam = &gspca_dev->cam;
+
+        sd->sensor = (id->driver_info >> 8) & 0xff;
+        sd->i2c_addr = id->driver_info & 0xff;
+
+        switch (sd->sensor) {
+        case SENSOR_OV9650:
+                cam->cam_mode = sxga_mode;
+                cam->nmodes = ARRAY_SIZE(sxga_mode);
+                break;
+        default:
+                cam->cam_mode = vga_mode;
+                cam->nmodes = ARRAY_SIZE(vga_mode);
+        }
+
+        sd->old_step = 0;
+        sd->older_step = 0;
+        sd->exposure_step = 16;
+
+        sd->brightness = BRIGHTNESS_DEFAULT;
+        sd->contrast = CONTRAST_DEFAULT;
+        sd->saturation = SATURATION_DEFAULT;
+        sd->hue = HUE_DEFAULT;
+        sd->gamma = GAMMA_DEFAULT;
+        sd->red = RED_DEFAULT;
+        sd->blue = BLUE_DEFAULT;
+
+        sd->hflip = HFLIP_DEFAULT;
+        sd->vflip = VFLIP_DEFAULT;
+        sd->exposure = EXPOSURE_DEFAULT;
+        sd->gain = GAIN_DEFAULT;
+        sd->auto_exposure = AUTO_EXPOSURE_DEFAULT;
+
+        sd->quality = 95;
+
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+        sd->input_gpio = (id->driver_info >> 16) & 0xff;
+        if (sn9c20x_input_init(gspca_dev) < 0)
+                return -ENODEV;
+#endif
+        return 0;
+}
+
+static int sd_init(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int i;
+        u8 value;
+        u8 i2c_init[9] =
+                {0x80, sd->i2c_addr, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03};
+
+        for (i = 0; i < ARRAY_SIZE(bridge_init); i++) {
+                value = bridge_init[i][1];
+                if (reg_w(gspca_dev, bridge_init[i][0], &value, 1) < 0) {
+                        err("Device initialization failed");
+                        return -ENODEV;
+                }
+        }
+
+        if (reg_w(gspca_dev, 0x10c0, i2c_init, 9) < 0) {
+                err("Device initialization failed");
+                return -ENODEV;
+        }
+
+        switch (sd->sensor) {
+        case SENSOR_OV9650:
+                if (ov9650_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("OV9650 sensor detected");
+                break;
+        case SENSOR_OV9655:
+                if (ov9655_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("OV9655 sensor detected");
+                break;
+        case SENSOR_SOI968:
+                if (soi968_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("SOI968 sensor detected");
+                break;
+        case SENSOR_OV7660:
+                if (ov7660_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("OV7660 sensor detected");
+                break;
+        case SENSOR_OV7670:
+                if (ov7670_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("OV7670 sensor detected");
+                break;
+        case SENSOR_MT9VPRB:
+                if (mt9v_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                break;
+        case SENSOR_MT9M111:
+                if (mt9m111_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("MT9M111 sensor detected");
+                break;
+        case SENSOR_MT9M001:
+                if (mt9m001_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("MT9M001 sensor detected");
+                break;
+        case SENSOR_HV7131R:
+                if (hv7131r_init_sensor(gspca_dev) < 0)
+                        return -ENODEV;
+                info("HV7131R sensor detected");
+                break;
+        default:
+                info("Unsupported Sensor");
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+static void configure_sensor_output(struct gspca_dev *gspca_dev, int mode)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        u8 value;
+        switch (sd->sensor) {
+        case SENSOR_OV9650:
+                if (mode & MODE_SXGA) {
+                        i2c_w1(gspca_dev, 0x17, 0x1b);
+                        i2c_w1(gspca_dev, 0x18, 0xbc);
+                        i2c_w1(gspca_dev, 0x19, 0x01);
+                        i2c_w1(gspca_dev, 0x1a, 0x82);
+                        i2c_r1(gspca_dev, 0x12, &value);
+                        i2c_w1(gspca_dev, 0x12, value & 0x07);
+                } else {
+                        i2c_w1(gspca_dev, 0x17, 0x24);
+                        i2c_w1(gspca_dev, 0x18, 0xc5);
+                        i2c_w1(gspca_dev, 0x19, 0x00);
+                        i2c_w1(gspca_dev, 0x1a, 0x3c);
+                        i2c_r1(gspca_dev, 0x12, &value);
+                        i2c_w1(gspca_dev, 0x12, (value & 0x7) | 0x40);
+                }
+                break;
+        }
+}
+
+#define HW_WIN(mode, hstart, vstart) \
+((const u8 []){hstart & 0xff, hstart >> 8, \
+vstart & 0xff, vstart >> 8, \
+(mode & MODE_SXGA ? 1280 >> 4 : 640 >> 4), \
+(mode & MODE_SXGA ? 1024 >> 3 : 480 >> 3)})
+
+#define CLR_WIN(width, height) \
+((const u8 [])\
+{0, width >> 2, 0, height >> 1,\
+((width >> 10) & 0x01) | ((height >> 8) & 0x6)})
+
+static int sd_start(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int mode = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv;
+        int width = gspca_dev->width;
+        int height = gspca_dev->height;
+        u8 fmt, scale = 0;
+
+        sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (sd->jpeg_hdr == NULL)
+                return -ENOMEM;
+
+        jpeg_define(sd->jpeg_hdr, height, width,
+                        0x21);
+        jpeg_set_qual(sd->jpeg_hdr, sd->quality);
+
+        if (mode & MODE_RAW)
+                fmt = 0x2d;
+        else if (mode & MODE_JPEG)
+                fmt = 0x2c;
+        else
+                fmt = 0x2f;
+
+        switch (mode & 0x0f) {
+        case 3:
+                scale = 0xc0;
+                info("Set 1280x1024");
+                break;
+        case 2:
+                scale = 0x80;
+                info("Set 640x480");
+                break;
+        case 1:
+                scale = 0x90;
+                info("Set 320x240");
+                break;
+        case 0:
+                scale = 0xa0;
+                info("Set 160x120");
+                break;
+        }
+
+        configure_sensor_output(gspca_dev, mode);
+        reg_w(gspca_dev, 0x1100, sd->jpeg_hdr + JPEG_QT0_OFFSET, 64);
+        reg_w(gspca_dev, 0x1140, sd->jpeg_hdr + JPEG_QT1_OFFSET, 64);
+        reg_w(gspca_dev, 0x10fb, CLR_WIN(width, height), 5);
+        reg_w(gspca_dev, 0x1180, HW_WIN(mode, sd->hstart, sd->vstart), 6);
+        reg_w1(gspca_dev, 0x1189, scale);
+        reg_w1(gspca_dev, 0x10e0, fmt);
+
+        set_cmatrix(gspca_dev);
+        set_gamma(gspca_dev);
+        set_redblue(gspca_dev);
+        set_gain(gspca_dev);
+        set_exposure(gspca_dev);
+        set_hvflip(gspca_dev);
+
+        reg_r(gspca_dev, 0x1061, 1);
+        reg_w1(gspca_dev, 0x1061, gspca_dev->usb_buf[0] | 0x02);
+        return 0;
+}
+
+static void sd_stopN(struct gspca_dev *gspca_dev)
+{
+        reg_r(gspca_dev, 0x1061, 1);
+        reg_w1(gspca_dev, 0x1061, gspca_dev->usb_buf[0] & ~0x02);
+}
+
+static void sd_stop0(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        kfree(sd->jpeg_hdr);
+}
+
+static void do_autoexposure(struct gspca_dev *gspca_dev)
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int avg_lum, new_exp;
+
+        if (!sd->auto_exposure)
+                return;
+
+        avg_lum = atomic_read(&sd->avg_lum);
+
+        /*
+         * some hardcoded values are present
+         * like those for maximal/minimal exposure
+         * and exposure steps
+         */
+        if (avg_lum < MIN_AVG_LUM) {
+                if (sd->exposure > 0x1770)
+                        return;
+
+                new_exp = sd->exposure + sd->exposure_step;
+                if (new_exp > 0x1770)
+                        new_exp = 0x1770;
+                if (new_exp < 0x10)
+                        new_exp = 0x10;
+                sd->exposure = new_exp;
+                set_exposure(gspca_dev);
+
+                sd->older_step = sd->old_step;
+                sd->old_step = 1;
+
+                if (sd->old_step ^ sd->older_step)
+                        sd->exposure_step /= 2;
+                else
+                        sd->exposure_step += 2;
+        }
+        if (avg_lum > MAX_AVG_LUM) {
+                if (sd->exposure < 0x10)
+                        return;
+                new_exp = sd->exposure - sd->exposure_step;
+                if (new_exp > 0x1700)
+                        new_exp = 0x1770;
+                if (new_exp < 0x10)
+                        new_exp = 0x10;
+                sd->exposure = new_exp;
+                set_exposure(gspca_dev);
+                sd->older_step = sd->old_step;
+                sd->old_step = 0;
+
+                if (sd->old_step ^ sd->older_step)
+                        sd->exposure_step /= 2;
+                else
+                        sd->exposure_step += 2;
+        }
+}
+
+static void sd_pkt_scan(struct gspca_dev *gspca_dev,
+                        struct gspca_frame *frame,      /* target */
+                        u8 *data,                       /* isoc packet */
+                        int len)                        /* iso packet length */
+{
+        struct sd *sd = (struct sd *) gspca_dev;
+        int avg_lum;
+        static unsigned char frame_header[] =
+                {0xff, 0xff, 0x00, 0xc4, 0xc4, 0x96};
+        if (len == 64 && memcmp(data, frame_header, 6) == 0) {
+                avg_lum = ((data[35] >> 2) & 3) |
+                           (data[20] << 2) |
+                           (data[19] << 10);
+                avg_lum += ((data[35] >> 4) & 3) |
+                            (data[22] << 2) |
+                            (data[21] << 10);
+                avg_lum += ((data[35] >> 6) & 3) |
+                            (data[24] << 2) |
+                            (data[23] << 10);
+                avg_lum += (data[36] & 3) |
+                           (data[26] << 2) |
+                           (data[25] << 10);
+                avg_lum += ((data[36] >> 2) & 3) |
+                            (data[28] << 2) |
+                            (data[27] << 10);
+                avg_lum += ((data[36] >> 4) & 3) |
+                            (data[30] << 2) |
+                            (data[29] << 10);
+                avg_lum += ((data[36] >> 6) & 3) |
+                            (data[32] << 2) |
+                            (data[31] << 10);
+                avg_lum += ((data[44] >> 4) & 3) |
+                            (data[34] << 2) |
+                            (data[33] << 10);
+                avg_lum >>= 9;
+                atomic_set(&sd->avg_lum, avg_lum);
+                gspca_frame_add(gspca_dev, LAST_PACKET,
+                                frame, data, len);
+                return;
+        }
+        if (gspca_dev->last_packet_type == LAST_PACKET) {
+                if (gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv
+                                & MODE_JPEG) {
+                        gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+                                sd->jpeg_hdr, JPEG_HDR_SZ);
+                        gspca_frame_add(gspca_dev, INTER_PACKET, frame,
+                                data, len);
+                } else {
+                        gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+                                data, len);
+                }
+        } else {
+                gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+        }
+}
+
+/* sub-driver description */
+static const struct sd_desc sd_desc = {
+        .name = MODULE_NAME,
+        .ctrls = sd_ctrls,
+        .nctrls = ARRAY_SIZE(sd_ctrls),
+        .config = sd_config,
+        .init = sd_init,
+        .start = sd_start,
+        .stopN = sd_stopN,
+        .stop0 = sd_stop0,
+        .pkt_scan = sd_pkt_scan,
+        .dq_callback = do_autoexposure,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        .set_register = sd_dbg_s_register,
+        .get_register = sd_dbg_g_register,
+#endif
+        .get_chip_ident = sd_chip_ident,
+};
+
+#define SN9C20X(sensor, i2c_addr, button_mask) \
+        .driver_info =  (button_mask << 16) \
+                        | (SENSOR_ ## sensor << 8) \
+                        | (i2c_addr)
+
+static const __devinitdata struct usb_device_id device_table[] = {
+        {USB_DEVICE(0x0c45, 0x6240), SN9C20X(MT9M001, 0x5d, 0)},
+        {USB_DEVICE(0x0c45, 0x6242), SN9C20X(MT9M111, 0x5d, 0)},
+        {USB_DEVICE(0x0c45, 0x6248), SN9C20X(OV9655, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x624e), SN9C20X(SOI968, 0x30, 0x10)},
+        {USB_DEVICE(0x0c45, 0x624f), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x6251), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x6253), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x6260), SN9C20X(OV7670, 0x21, 0)},
+        {USB_DEVICE(0x0c45, 0x6270), SN9C20X(MT9VPRB, 0x00, 0)},
+        {USB_DEVICE(0x0c45, 0x627b), SN9C20X(OV7660, 0x21, 0)},
+        {USB_DEVICE(0x0c45, 0x627c), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0x0c45, 0x627f), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x6280), SN9C20X(MT9M001, 0x5d, 0)},
+        {USB_DEVICE(0x0c45, 0x6282), SN9C20X(MT9M111, 0x5d, 0)},
+        {USB_DEVICE(0x0c45, 0x6288), SN9C20X(OV9655, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x628e), SN9C20X(SOI968, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x628f), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x62a0), SN9C20X(OV7670, 0x21, 0)},
+        {USB_DEVICE(0x0c45, 0x62b0), SN9C20X(MT9VPRB, 0x00, 0)},
+        {USB_DEVICE(0x0c45, 0x62b3), SN9C20X(OV9655, 0x30, 0)},
+        {USB_DEVICE(0x0c45, 0x62bb), SN9C20X(OV7660, 0x21, 0)},
+        {USB_DEVICE(0x0c45, 0x62bc), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0x045e, 0x00f4), SN9C20X(OV9650, 0x30, 0)},
+        {USB_DEVICE(0x145f, 0x013d), SN9C20X(OV7660, 0x21, 0)},
+        {USB_DEVICE(0x0458, 0x7029), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0610), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0611), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0613), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0618), SN9C20X(HV7131R, 0x11, 0)},
+        {USB_DEVICE(0xa168, 0x0614), SN9C20X(MT9M111, 0x5d, 0)},
+        {USB_DEVICE(0xa168, 0x0615), SN9C20X(MT9M111, 0x5d, 0)},
+        {USB_DEVICE(0xa168, 0x0617), SN9C20X(MT9M111, 0x5d, 0)},
+        {}
+};
+MODULE_DEVICE_TABLE(usb, device_table);
+
+/* -- device connect -- */
+static int sd_probe(struct usb_interface *intf,
+                    const struct usb_device_id *id)
+{
+        return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
+                                THIS_MODULE);
+}
+
+static void sd_disconnect(struct usb_interface *intf)
+{
+#ifdef CONFIG_USB_GSPCA_SN9C20X_EVDEV
+        struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
+
+        sn9c20x_input_cleanup(gspca_dev);
+#endif
+
+        gspca_disconnect(intf);
+}
+
+static struct usb_driver sd_driver = {
+        .name = MODULE_NAME,
+        .id_table = device_table,
+        .probe = sd_probe,
+        .disconnect = sd_disconnect,
+#ifdef CONFIG_PM
+        .suspend = gspca_suspend,
+        .resume = gspca_resume,
+        .reset_resume = gspca_resume,
+#endif
+};
+
+/* -- module insert / remove -- */
+static int __init sd_mod_init(void)
+{
+        int ret;
+        ret = usb_register(&sd_driver);
+        if (ret < 0)
+                return ret;
+        info("registered");
+        return 0;
+}
+static void __exit sd_mod_exit(void)
+{
+        usb_deregister(&sd_driver);
+        info("deregistered");
+}
+
+module_init(sd_mod_init);
+module_exit(sd_mod_exit);
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index 0d02f41fa7d0..d6332ab80669 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -1634,6 +1634,8 @@ static void setfreq(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
 
+        if (gspca_dev->ctrl_dis & (1 << FREQ_IDX))
+                return;
         if (sd->sensor == SENSOR_OV7660) {
                 switch (sd->freq) {
                 case 0: /* Banding filter disabled */
@@ -1735,6 +1737,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x21);          /* JPEG 422 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/spca500.c b/drivers/media/video/gspca/spca500.c
index 8806b2ff82be..fab7ef85a6c1 100644
--- a/drivers/media/video/gspca/spca500.c
+++ b/drivers/media/video/gspca/spca500.c
@@ -670,6 +670,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x22);          /* JPEG 411 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/stk014.c b/drivers/media/video/gspca/stk014.c
index f25be20cf1a6..47628964801e 100644
--- a/drivers/media/video/gspca/stk014.c
+++ b/drivers/media/video/gspca/stk014.c
@@ -333,6 +333,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x22);          /* JPEG 411 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx_hdcs.c b/drivers/media/video/gspca/stv06xx/stv06xx_hdcs.c
index 3039ec208f3a..e5024c8496ef 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx_hdcs.c
+++ b/drivers/media/video/gspca/stv06xx/stv06xx_hdcs.c
@@ -64,7 +64,7 @@ static struct v4l2_pix_format hdcs1x00_mode[] = {
         {
                 HDCS_1X00_DEF_WIDTH,
                 HDCS_1X00_DEF_HEIGHT,
-                V4L2_PIX_FMT_SBGGR8,
+                V4L2_PIX_FMT_SGRBG8,
                 V4L2_FIELD_NONE,
                 .sizeimage =
                         HDCS_1X00_DEF_WIDTH * HDCS_1X00_DEF_HEIGHT,
@@ -80,7 +80,7 @@ static struct v4l2_pix_format hdcs1020_mode[] = {
         {
                 HDCS_1020_DEF_WIDTH,
                 HDCS_1020_DEF_HEIGHT,
-                V4L2_PIX_FMT_SBGGR8,
+                V4L2_PIX_FMT_SGRBG8,
                 V4L2_FIELD_NONE,
                 .sizeimage =
                         HDCS_1020_DEF_WIDTH * HDCS_1020_DEF_HEIGHT,
@@ -131,9 +131,11 @@ static int hdcs_reg_write_seq(struct sd *sd, u8 reg, u8 *vals, u8 len)
                      (reg + len > 0xff)))
                 return -EINVAL;
 
-        for (i = 0; i < len; i++, reg++) {
-                regs[2*i] = reg;
-                regs[2*i+1] = vals[i];
+        for (i = 0; i < len; i++) {
+                regs[2 * i] = reg;
+                regs[2 * i + 1] = vals[i];
+                /* All addresses are shifted left one bit as bit 0 toggles r/w */
+                reg += 2;
         }
 
         return stv06xx_write_sensor_bytes(sd, regs, len);
@@ -174,7 +176,9 @@ static int hdcs_set_state(struct sd *sd, enum hdcs_power_state state)
         }
 
         ret = stv06xx_write_sensor(sd, HDCS_REG_CONTROL(sd), val);
-        if (ret < 0)
+
+        /* Update the state if the write succeeded */
+        if (!ret)
                 hdcs->state = state;
 
         return ret;
diff --git a/drivers/media/video/gspca/sunplus.c b/drivers/media/video/gspca/sunplus.c
index 9623f294bdac..5127bbf9dd26 100644
--- a/drivers/media/video/gspca/sunplus.c
+++ b/drivers/media/video/gspca/sunplus.c
@@ -973,6 +973,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x22);          /* JPEG 411 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index 08422d315e68..3d2756f7874a 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -7243,6 +7243,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         /* create the JPEG header */
         sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+        if (!sd->jpeg_hdr)
+                return -ENOMEM;
         jpeg_define(sd->jpeg_hdr, gspca_dev->height, gspca_dev->width,
                         0x21);          /* JPEG 422 */
         jpeg_set_qual(sd->jpeg_hdr, sd->quality);
diff --git a/drivers/media/video/mt9v011.c b/drivers/media/video/mt9v011.c
index 1fe8fc9183a7..b2260de645f0 100644
--- a/drivers/media/video/mt9v011.c
+++ b/drivers/media/video/mt9v011.c
@@ -8,6 +8,7 @@
 #include <linux/i2c.h>
 #include <linux/videodev2.h>
 #include <linux/delay.h>
+#include <asm/div64.h>
 #include <media/v4l2-device.h>
 #include "mt9v011.h"
 #include <media/v4l2-i2c-drv.h>
@@ -57,6 +58,7 @@ static struct v4l2_queryctrl mt9v011_qctrl[] = {
 struct mt9v011 {
         struct v4l2_subdev sd;
         unsigned width, height;
+        unsigned xtal;
 
         u16 global_gain, red_bal, blue_bal;
 };
@@ -131,7 +133,7 @@ static const struct i2c_reg_value mt9v011_init_default[] = {
                 { R1E_MT9V011_DIGITAL_ZOOM,  0x0000 },
                 { R20_MT9V011_READ_MODE, 0x1000 },
 
-                { R07_MT9V011_OUT_CTRL, 0x000a },       /* chip enable */
+                { R07_MT9V011_OUT_CTRL, 0x0002 },       /* chip enable */
 };
 
 static void set_balance(struct v4l2_subdev *sd)
@@ -154,6 +156,31 @@ static void set_balance(struct v4l2_subdev *sd)
         mt9v011_write(sd, R2D_MT9V011_RED_GAIN, red_gain);
 }
 
+static void calc_fps(struct v4l2_subdev *sd)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned height, width, hblank, vblank, speed;
+        unsigned row_time, t_time;
+        u64 frames_per_ms;
+        unsigned tmp;
+
+        height = mt9v011_read(sd, R03_MT9V011_HEIGHT);
+        width = mt9v011_read(sd, R04_MT9V011_WIDTH);
+        hblank = mt9v011_read(sd, R05_MT9V011_HBLANK);
+        vblank = mt9v011_read(sd, R06_MT9V011_VBLANK);
+        speed = mt9v011_read(sd, R0A_MT9V011_CLK_SPEED);
+
+        row_time = (width + 113 + hblank) * (speed + 2);
+        t_time = row_time * (height + vblank + 1);
+
+        frames_per_ms = core->xtal * 1000l;
+        do_div(frames_per_ms, t_time);
+        tmp = frames_per_ms;
+
+        v4l2_dbg(1, debug, sd, "Programmed to %u.%03u fps (%d pixel clcks)\n",
+                tmp / 1000, tmp % 1000, t_time);
+}
+
 static void set_res(struct v4l2_subdev *sd)
 {
         struct mt9v011 *core = to_mt9v011(sd);
@@ -175,10 +202,12 @@ static void set_res(struct v4l2_subdev *sd)
         mt9v011_write(sd, R04_MT9V011_WIDTH, core->width);
         mt9v011_write(sd, R05_MT9V011_HBLANK, 771 - core->width);
 
-        vstart = 8 + (640 - core->height) / 2;
+        vstart = 8 + (480 - core->height) / 2;
         mt9v011_write(sd, R01_MT9V011_ROWSTART, vstart);
         mt9v011_write(sd, R03_MT9V011_HEIGHT, core->height);
         mt9v011_write(sd, R06_MT9V011_VBLANK, 508 - core->height);
+
+        calc_fps(sd);
 };
 
 static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
@@ -215,6 +244,23 @@ static int mt9v011_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
         return -EINVAL;
 }
 
+static int mt9v011_queryctrl(struct v4l2_subdev *sd, struct v4l2_queryctrl *qc)
+{
+        int i;
+
+        v4l2_dbg(1, debug, sd, "queryctrl called\n");
+
+        for (i = 0; i < ARRAY_SIZE(mt9v011_qctrl); i++)
+                if (qc->id && qc->id == mt9v011_qctrl[i].id) {
+                        memcpy(qc, &(mt9v011_qctrl[i]),
+                               sizeof(*qc));
+                        return 0;
+                }
+
+        return -EINVAL;
+}
+
+
 static int mt9v011_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 {
         struct mt9v011 *core = to_mt9v011(sd);
@@ -294,6 +340,22 @@ static int mt9v011_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
         return 0;
 }
 
+static int mt9v011_s_config(struct v4l2_subdev *sd, int dumb, void *data)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned *xtal = data;
+
+        v4l2_dbg(1, debug, sd, "s_config called\n");
+
+        if (xtal) {
+                core->xtal = *xtal;
+                v4l2_dbg(1, debug, sd, "xtal set to %d.%03d MHz\n",
+                         *xtal / 1000000, (*xtal / 1000) % 1000);
+        }
+
+        return 0;
+}
+
 
 #ifdef CONFIG_VIDEO_ADV_DEBUG
 static int mt9v011_g_register(struct v4l2_subdev *sd,
@@ -338,9 +400,11 @@ static int mt9v011_g_chip_ident(struct v4l2_subdev *sd,
 }
 
 static const struct v4l2_subdev_core_ops mt9v011_core_ops = {
+        .queryctrl = mt9v011_queryctrl,
         .g_ctrl = mt9v011_g_ctrl,
         .s_ctrl = mt9v011_s_ctrl,
         .reset = mt9v011_reset,
+        .s_config = mt9v011_s_config,
         .g_chip_ident = mt9v011_g_chip_ident,
 #ifdef CONFIG_VIDEO_ADV_DEBUG
         .g_register = mt9v011_g_register,
@@ -395,6 +459,7 @@ static int mt9v011_probe(struct i2c_client *c,
         core->global_gain = 0x0024;
         core->width  = 640;
         core->height = 480;
+        core->xtal = 27000000;  /* Hz */
 
         v4l_info(c, "chip found @ 0x%02x (%s)\n",
                  c->addr << 1, c->adapter->name);
diff --git a/drivers/mtd/ubi/gluebi.c b/drivers/mtd/ubi/gluebi.c
index 95aaac03f938..b5e478fa2661 100644
--- a/drivers/mtd/ubi/gluebi.c
+++ b/drivers/mtd/ubi/gluebi.c
@@ -332,6 +332,7 @@ static int gluebi_create(struct ubi_device_info *di,
         }
 
         gluebi->vol_id = vi->vol_id;
+        gluebi->ubi_num = vi->ubi_num;
         mtd->type = MTD_UBIVOLUME;
         if (!di->ro_mode)
                 mtd->flags = MTD_WRITEABLE;
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index f60895ee0aeb..a423131b6171 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -781,7 +781,7 @@ static int process_eb(struct ubi_device *ubi, struct ubi_scan_info *si,
                         return -EINVAL;
                 }
 
-                image_seq = be32_to_cpu(ech->ec);
+                image_seq = be32_to_cpu(ech->image_seq);
                 if (!si->image_seq_set) {
                         ubi->image_seq = image_seq;
                         si->image_seq_set = 1;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index c155bd3ec9f1..5f6509a5f640 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1729,6 +1729,13 @@ config KS8842
         help
           This platform driver is for Micrel KSZ8842 chip.
 
+config KS8851
+       tristate "Micrel KS8851 SPI"
+       depends on SPI
+       select MII
+       help
+         SPI driver for Micrel KS8851 SPI attached network chip.
+
 config VIA_RHINE
         tristate "VIA Rhine support"
         depends on NET_PCI && PCI
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 4b58a59f211b..ead8cab3cfe1 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -88,6 +88,7 @@ obj-$(CONFIG_SKGE) += skge.o
 obj-$(CONFIG_SKY2) += sky2.o
 obj-$(CONFIG_SKFP) += skfp/
 obj-$(CONFIG_KS8842)    += ks8842.o
+obj-$(CONFIG_KS8851)    += ks8851.o
 obj-$(CONFIG_VIA_RHINE) += via-rhine.o
 obj-$(CONFIG_VIA_VELOCITY) += via-velocity.o
 obj-$(CONFIG_ADAPTEC_STARFIRE) += starfire.o
diff --git a/drivers/net/arm/Kconfig b/drivers/net/arm/Kconfig
index 2895db13bfa4..c37ee9e6b67b 100644
--- a/drivers/net/arm/Kconfig
+++ b/drivers/net/arm/Kconfig
@@ -63,3 +63,11 @@ config IXP4XX_ETH
         help
           Say Y here if you want to use built-in Ethernet ports
           on IXP4xx processor.
+
+config W90P910_ETH
+        tristate "Nuvoton w90p910 Ethernet support"
+        depends on ARM && ARCH_W90X900
+        select PHYLIB
+        help
+          Say Y here if you want to use built-in Ethernet ports
+          on w90p910 processor.
diff --git a/drivers/net/arm/Makefile b/drivers/net/arm/Makefile
index 811a3ccd14c1..303171f589e6 100644
--- a/drivers/net/arm/Makefile
+++ b/drivers/net/arm/Makefile
@@ -11,3 +11,4 @@ obj-$(CONFIG_ARM_AT91_ETHER)	+= at91_ether.o
 obj-$(CONFIG_ARM_KS8695_ETHER)  += ks8695net.o
 obj-$(CONFIG_EP93XX_ETH)        += ep93xx_eth.o
 obj-$(CONFIG_IXP4XX_ETH)        += ixp4xx_eth.o
+obj-$(CONFIG_W90P910_ETH)       += w90p910_ether.o
diff --git a/drivers/net/arm/at91_ether.c b/drivers/net/arm/at91_ether.c
index 2e7419a61191..5041d10bae9d 100644
--- a/drivers/net/arm/at91_ether.c
+++ b/drivers/net/arm/at91_ether.c
@@ -1228,7 +1228,6 @@ static int at91ether_resume(struct platform_device *pdev)
 #endif
 
 static struct platform_driver at91ether_driver = {
-        .probe          = at91ether_probe,
         .remove         = __devexit_p(at91ether_remove),
         .suspend        = at91ether_suspend,
         .resume         = at91ether_resume,
@@ -1240,7 +1239,7 @@ static struct platform_driver at91ether_driver = {
 
 static int __init at91ether_init(void)
 {
-        return platform_driver_register(&at91ether_driver);
+        return platform_driver_probe(&at91ether_driver, at91ether_probe);
 }
 
 static void __exit at91ether_exit(void)
diff --git a/drivers/net/arm/w90p910_ether.c b/drivers/net/arm/w90p910_ether.c
new file mode 100644
index 000000000000..616fb7985a34
--- /dev/null
+++ b/drivers/net/arm/w90p910_ether.c
@@ -0,0 +1,1105 @@
+/*
+ * Copyright (c) 2008-2009 Nuvoton technology corporation.
+ *
+ * Wan ZongShun <mcuos.com@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation;version 2 of the License.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/mii.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/ethtool.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+
+#define DRV_MODULE_NAME         "w90p910-emc"
+#define DRV_MODULE_VERSION      "0.1"
+
+/* Ethernet MAC Registers */
+#define REG_CAMCMR              0x00
+#define REG_CAMEN               0x04
+#define REG_CAMM_BASE           0x08
+#define REG_CAML_BASE           0x0c
+#define REG_TXDLSA              0x88
+#define REG_RXDLSA              0x8C
+#define REG_MCMDR               0x90
+#define REG_MIID                0x94
+#define REG_MIIDA               0x98
+#define REG_FFTCR               0x9C
+#define REG_TSDR                0xa0
+#define REG_RSDR                0xa4
+#define REG_DMARFC              0xa8
+#define REG_MIEN                0xac
+#define REG_MISTA               0xb0
+#define REG_CTXDSA              0xcc
+#define REG_CTXBSA              0xd0
+#define REG_CRXDSA              0xd4
+#define REG_CRXBSA              0xd8
+
+/* mac controller bit */
+#define MCMDR_RXON              0x01
+#define MCMDR_ACP               (0x01 << 3)
+#define MCMDR_SPCRC             (0x01 << 5)
+#define MCMDR_TXON              (0x01 << 8)
+#define MCMDR_FDUP              (0x01 << 18)
+#define MCMDR_ENMDC             (0x01 << 19)
+#define MCMDR_OPMOD             (0x01 << 20)
+#define SWR                     (0x01 << 24)
+
+/* cam command regiser */
+#define CAMCMR_AUP              0x01
+#define CAMCMR_AMP              (0x01 << 1)
+#define CAMCMR_ABP              (0x01 << 2)
+#define CAMCMR_CCAM             (0x01 << 3)
+#define CAMCMR_ECMP             (0x01 << 4)
+#define CAM0EN                  0x01
+
+/* mac mii controller bit */
+#define MDCCR                   (0x0a << 20)
+#define PHYAD                   (0x01 << 8)
+#define PHYWR                   (0x01 << 16)
+#define PHYBUSY                 (0x01 << 17)
+#define PHYPRESP                (0x01 << 18)
+#define CAM_ENTRY_SIZE          0x08
+
+/* rx and tx status */
+#define TXDS_TXCP               (0x01 << 19)
+#define RXDS_CRCE               (0x01 << 17)
+#define RXDS_PTLE               (0x01 << 19)
+#define RXDS_RXGD               (0x01 << 20)
+#define RXDS_ALIE               (0x01 << 21)
+#define RXDS_RP                 (0x01 << 22)
+
+/* mac interrupt status*/
+#define MISTA_EXDEF             (0x01 << 19)
+#define MISTA_TXBERR            (0x01 << 24)
+#define MISTA_TDU               (0x01 << 23)
+#define MISTA_RDU               (0x01 << 10)
+#define MISTA_RXBERR            (0x01 << 11)
+
+#define ENSTART                 0x01
+#define ENRXINTR                0x01
+#define ENRXGD                  (0x01 << 4)
+#define ENRXBERR                (0x01 << 11)
+#define ENTXINTR                (0x01 << 16)
+#define ENTXCP                  (0x01 << 18)
+#define ENTXABT                 (0x01 << 21)
+#define ENTXBERR                (0x01 << 24)
+#define ENMDC                   (0x01 << 19)
+#define PHYBUSY                 (0x01 << 17)
+#define MDCCR_VAL               0xa00000
+
+/* rx and tx owner bit */
+#define RX_OWEN_DMA             (0x01 << 31)
+#define RX_OWEN_CPU             (~(0x03 << 30))
+#define TX_OWEN_DMA             (0x01 << 31)
+#define TX_OWEN_CPU             (~(0x01 << 31))
+
+/* tx frame desc controller bit */
+#define MACTXINTEN              0x04
+#define CRCMODE                 0x02
+#define PADDINGMODE             0x01
+
+/* fftcr controller bit */
+#define TXTHD                   (0x03 << 8)
+#define BLENGTH                 (0x01 << 20)
+
+/* global setting for driver */
+#define RX_DESC_SIZE            50
+#define TX_DESC_SIZE            10
+#define MAX_RBUFF_SZ            0x600
+#define MAX_TBUFF_SZ            0x600
+#define TX_TIMEOUT              50
+#define DELAY                   1000
+#define CAM0                    0x0
+
+static int w90p910_mdio_read(struct net_device *dev, int phy_id, int reg);
+
+struct w90p910_rxbd {
+        unsigned int sl;
+        unsigned int buffer;
+        unsigned int reserved;
+        unsigned int next;
+};
+
+struct w90p910_txbd {
+        unsigned int mode;
+        unsigned int buffer;
+        unsigned int sl;
+        unsigned int next;
+};
+
+struct recv_pdesc {
+        struct w90p910_rxbd desclist[RX_DESC_SIZE];
+        char recv_buf[RX_DESC_SIZE][MAX_RBUFF_SZ];
+};
+
+struct tran_pdesc {
+        struct w90p910_txbd desclist[TX_DESC_SIZE];
+        char tran_buf[RX_DESC_SIZE][MAX_TBUFF_SZ];
+};
+
+struct  w90p910_ether {
+        struct recv_pdesc *rdesc;
+        struct recv_pdesc *rdesc_phys;
+        struct tran_pdesc *tdesc;
+        struct tran_pdesc *tdesc_phys;
+        struct net_device_stats stats;
+        struct platform_device *pdev;
+        struct sk_buff *skb;
+        struct clk *clk;
+        struct clk *rmiiclk;
+        struct mii_if_info mii;
+        struct timer_list check_timer;
+        void __iomem *reg;
+        unsigned int rxirq;
+        unsigned int txirq;
+        unsigned int cur_tx;
+        unsigned int cur_rx;
+        unsigned int finish_tx;
+        unsigned int rx_packets;
+        unsigned int rx_bytes;
+        unsigned int start_tx_ptr;
+        unsigned int start_rx_ptr;
+        unsigned int linkflag;
+        spinlock_t lock;
+};
+
+static void update_linkspeed_register(struct net_device *dev,
+                                unsigned int speed, unsigned int duplex)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+
+        if (speed == SPEED_100) {
+                /* 100 full/half duplex */
+                if (duplex == DUPLEX_FULL) {
+                        val |= (MCMDR_OPMOD | MCMDR_FDUP);
+                } else {
+                        val |= MCMDR_OPMOD;
+                        val &= ~MCMDR_FDUP;
+                }
+        } else {
+                /* 10 full/half duplex */
+                if (duplex == DUPLEX_FULL) {
+                        val |= MCMDR_FDUP;
+                        val &= ~MCMDR_OPMOD;
+                } else {
+                        val &= ~(MCMDR_FDUP | MCMDR_OPMOD);
+                }
+        }
+
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void update_linkspeed(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct platform_device *pdev;
+        unsigned int bmsr, bmcr, lpa, speed, duplex;
+
+        pdev = ether->pdev;
+
+        if (!mii_link_ok(&ether->mii)) {
+                ether->linkflag = 0x0;
+                netif_carrier_off(dev);
+                dev_warn(&pdev->dev, "%s: Link down.\n", dev->name);
+                return;
+        }
+
+        if (ether->linkflag == 1)
+                return;
+
+        bmsr = w90p910_mdio_read(dev, ether->mii.phy_id, MII_BMSR);
+        bmcr = w90p910_mdio_read(dev, ether->mii.phy_id, MII_BMCR);
+
+        if (bmcr & BMCR_ANENABLE) {
+                if (!(bmsr & BMSR_ANEGCOMPLETE))
+                        return;
+
+                lpa = w90p910_mdio_read(dev, ether->mii.phy_id, MII_LPA);
+
+                if ((lpa & LPA_100FULL) || (lpa & LPA_100HALF))
+                        speed = SPEED_100;
+                else
+                        speed = SPEED_10;
+
+                if ((lpa & LPA_100FULL) || (lpa & LPA_10FULL))
+                        duplex = DUPLEX_FULL;
+                else
+                        duplex = DUPLEX_HALF;
+
+        } else {
+                speed = (bmcr & BMCR_SPEED100) ? SPEED_100 : SPEED_10;
+                duplex = (bmcr & BMCR_FULLDPLX) ? DUPLEX_FULL : DUPLEX_HALF;
+        }
+
+        update_linkspeed_register(dev, speed, duplex);
+
+        dev_info(&pdev->dev, "%s: Link now %i-%s\n", dev->name, speed,
+                        (duplex == DUPLEX_FULL) ? "FullDuplex" : "HalfDuplex");
+        ether->linkflag = 0x01;
+
+        netif_carrier_on(dev);
+}
+
+static void w90p910_check_link(unsigned long dev_id)
+{
+        struct net_device *dev = (struct net_device *) dev_id;
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        update_linkspeed(dev);
+        mod_timer(&ether->check_timer, jiffies + msecs_to_jiffies(1000));
+}
+
+static void w90p910_write_cam(struct net_device *dev,
+                                unsigned int x, unsigned char *pval)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int msw, lsw;
+
+        msw = (pval[0] << 24) | (pval[1] << 16) | (pval[2] << 8) | pval[3];
+
+        lsw = (pval[4] << 24) | (pval[5] << 16);
+
+        __raw_writel(lsw, ether->reg + REG_CAML_BASE + x * CAM_ENTRY_SIZE);
+        __raw_writel(msw, ether->reg + REG_CAMM_BASE + x * CAM_ENTRY_SIZE);
+}
+
+static void w90p910_init_desc(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+        struct w90p910_txbd  *tdesc, *tdesc_phys;
+        struct w90p910_rxbd  *rdesc, *rdesc_phys;
+        unsigned int i, j;
+
+        ether = netdev_priv(dev);
+
+        ether->tdesc = (struct tran_pdesc *)
+                        dma_alloc_coherent(NULL, sizeof(struct tran_pdesc),
+                                (dma_addr_t *) &ether->tdesc_phys, GFP_KERNEL);
+
+        ether->rdesc = (struct recv_pdesc *)
+                        dma_alloc_coherent(NULL, sizeof(struct recv_pdesc),
+                                (dma_addr_t *) &ether->rdesc_phys, GFP_KERNEL);
+
+        for (i = 0; i < TX_DESC_SIZE; i++) {
+                tdesc = &(ether->tdesc->desclist[i]);
+
+                j = ((i + 1) / TX_DESC_SIZE);
+
+                if (j != 0) {
+                        tdesc_phys = &(ether->tdesc_phys->desclist[0]);
+                        ether->start_tx_ptr = (unsigned int)tdesc_phys;
+                        tdesc->next = (unsigned int)ether->start_tx_ptr;
+                } else {
+                        tdesc_phys = &(ether->tdesc_phys->desclist[i+1]);
+                        tdesc->next = (unsigned int)tdesc_phys;
+                }
+
+                tdesc->buffer = (unsigned int)ether->tdesc_phys->tran_buf[i];
+                tdesc->sl = 0;
+                tdesc->mode = 0;
+        }
+
+        for (i = 0; i < RX_DESC_SIZE; i++) {
+                rdesc = &(ether->rdesc->desclist[i]);
+
+                j = ((i + 1) / RX_DESC_SIZE);
+
+                if (j != 0) {
+                        rdesc_phys = &(ether->rdesc_phys->desclist[0]);
+                        ether->start_rx_ptr = (unsigned int)rdesc_phys;
+                        rdesc->next = (unsigned int)ether->start_rx_ptr;
+                } else {
+                        rdesc_phys = &(ether->rdesc_phys->desclist[i+1]);
+                        rdesc->next = (unsigned int)rdesc_phys;
+                }
+
+                rdesc->sl = RX_OWEN_DMA;
+                rdesc->buffer = (unsigned int)ether->rdesc_phys->recv_buf[i];
+          }
+}
+
+static void w90p910_set_fifo_threshold(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = TXTHD | BLENGTH;
+        __raw_writel(val, ether->reg + REG_FFTCR);
+}
+
+static void w90p910_return_default_idle(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+        val |= SWR;
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void w90p910_trigger_rx(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        __raw_writel(ENSTART, ether->reg + REG_RSDR);
+}
+
+static void w90p910_trigger_tx(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        __raw_writel(ENSTART, ether->reg + REG_TSDR);
+}
+
+static void w90p910_enable_mac_interrupt(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = ENTXINTR | ENRXINTR | ENRXGD | ENTXCP;
+        val |= ENTXBERR | ENRXBERR | ENTXABT;
+
+        __raw_writel(val, ether->reg + REG_MIEN);
+}
+
+static void w90p910_get_and_clear_int(struct net_device *dev,
+                                                        unsigned int *val)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        *val = __raw_readl(ether->reg + REG_MISTA);
+        __raw_writel(*val, ether->reg + REG_MISTA);
+}
+
+static void w90p910_set_global_maccmd(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+        val |= MCMDR_SPCRC | MCMDR_ENMDC | MCMDR_ACP | ENMDC;
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void w90p910_enable_cam(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        w90p910_write_cam(dev, CAM0, dev->dev_addr);
+
+        val = __raw_readl(ether->reg + REG_CAMEN);
+        val |= CAM0EN;
+        __raw_writel(val, ether->reg + REG_CAMEN);
+}
+
+static void w90p910_enable_cam_command(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = CAMCMR_ECMP | CAMCMR_ABP | CAMCMR_AMP;
+        __raw_writel(val, ether->reg + REG_CAMCMR);
+}
+
+static void w90p910_enable_tx(struct net_device *dev, unsigned int enable)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+
+        if (enable)
+                val |= MCMDR_TXON;
+        else
+                val &= ~MCMDR_TXON;
+
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void w90p910_enable_rx(struct net_device *dev, unsigned int enable)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        unsigned int val;
+
+        val = __raw_readl(ether->reg + REG_MCMDR);
+
+        if (enable)
+                val |= MCMDR_RXON;
+        else
+                val &= ~MCMDR_RXON;
+
+        __raw_writel(val, ether->reg + REG_MCMDR);
+}
+
+static void w90p910_set_curdest(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        __raw_writel(ether->start_rx_ptr, ether->reg + REG_RXDLSA);
+        __raw_writel(ether->start_tx_ptr, ether->reg + REG_TXDLSA);
+}
+
+static void w90p910_reset_mac(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        spin_lock(&ether->lock);
+
+        w90p910_enable_tx(dev, 0);
+        w90p910_enable_rx(dev, 0);
+        w90p910_set_fifo_threshold(dev);
+        w90p910_return_default_idle(dev);
+
+        if (!netif_queue_stopped(dev))
+                netif_stop_queue(dev);
+
+        w90p910_init_desc(dev);
+
+        dev->trans_start = jiffies;
+        ether->cur_tx = 0x0;
+        ether->finish_tx = 0x0;
+        ether->cur_rx = 0x0;
+
+        w90p910_set_curdest(dev);
+        w90p910_enable_cam(dev);
+        w90p910_enable_cam_command(dev);
+        w90p910_enable_mac_interrupt(dev);
+        w90p910_enable_tx(dev, 1);
+        w90p910_enable_rx(dev, 1);
+        w90p910_trigger_tx(dev);
+        w90p910_trigger_rx(dev);
+
+        dev->trans_start = jiffies;
+
+        if (netif_queue_stopped(dev))
+                netif_wake_queue(dev);
+
+        spin_unlock(&ether->lock);
+}
+
+static void w90p910_mdio_write(struct net_device *dev,
+                                        int phy_id, int reg, int data)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct platform_device *pdev;
+        unsigned int val, i;
+
+        pdev = ether->pdev;
+
+        __raw_writel(data, ether->reg + REG_MIID);
+
+        val = (phy_id << 0x08) | reg;
+        val |= PHYBUSY | PHYWR | MDCCR_VAL;
+        __raw_writel(val, ether->reg + REG_MIIDA);
+
+        for (i = 0; i < DELAY; i++) {
+                if ((__raw_readl(ether->reg + REG_MIIDA) & PHYBUSY) == 0)
+                        break;
+        }
+
+        if (i == DELAY)
+                dev_warn(&pdev->dev, "mdio write timed out\n");
+}
+
+static int w90p910_mdio_read(struct net_device *dev, int phy_id, int reg)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct platform_device *pdev;
+        unsigned int val, i, data;
+
+        pdev = ether->pdev;
+
+        val = (phy_id << 0x08) | reg;
+        val |= PHYBUSY | MDCCR_VAL;
+        __raw_writel(val, ether->reg + REG_MIIDA);
+
+        for (i = 0; i < DELAY; i++) {
+                if ((__raw_readl(ether->reg + REG_MIIDA) & PHYBUSY) == 0)
+                        break;
+        }
+
+        if (i == DELAY) {
+                dev_warn(&pdev->dev, "mdio read timed out\n");
+                data = 0xffff;
+        } else {
+                data = __raw_readl(ether->reg + REG_MIID);
+        }
+
+        return data;
+}
+
+static int set_mac_address(struct net_device *dev, void *addr)
+{
+        struct sockaddr *address = addr;
+
+        if (!is_valid_ether_addr(address->sa_data))
+                return -EADDRNOTAVAIL;
+
+        memcpy(dev->dev_addr, address->sa_data, dev->addr_len);
+        w90p910_write_cam(dev, CAM0, dev->dev_addr);
+
+        return 0;
+}
+
+static int w90p910_ether_close(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        dma_free_writecombine(NULL, sizeof(struct w90p910_rxbd),
+                                ether->rdesc, (dma_addr_t)ether->rdesc_phys);
+        dma_free_writecombine(NULL, sizeof(struct w90p910_txbd),
+                                ether->tdesc, (dma_addr_t)ether->tdesc_phys);
+
+        netif_stop_queue(dev);
+
+        del_timer_sync(&ether->check_timer);
+        clk_disable(ether->rmiiclk);
+        clk_disable(ether->clk);
+
+        free_irq(ether->txirq, dev);
+        free_irq(ether->rxirq, dev);
+
+        return 0;
+}
+
+static struct net_device_stats *w90p910_ether_stats(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+
+        ether = netdev_priv(dev);
+
+        return &ether->stats;
+}
+
+static int w90p910_send_frame(struct net_device *dev,
+                                        unsigned char *data, int length)
+{
+        struct w90p910_ether *ether;
+        struct w90p910_txbd *txbd;
+        struct platform_device *pdev;
+        unsigned char *buffer;
+
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+
+        txbd = &ether->tdesc->desclist[ether->cur_tx];
+        buffer = ether->tdesc->tran_buf[ether->cur_tx];
+        if (length > 1514) {
+                dev_err(&pdev->dev, "send data %d bytes, check it\n", length);
+                length = 1514;
+        }
+
+        txbd->sl = length & 0xFFFF;
+
+        memcpy(buffer, data, length);
+
+        txbd->mode = TX_OWEN_DMA | PADDINGMODE | CRCMODE | MACTXINTEN;
+
+        w90p910_enable_tx(dev, 1);
+
+        w90p910_trigger_tx(dev);
+
+        ether->cur_tx = (ether->cur_tx+1) % TX_DESC_SIZE;
+        txbd = &ether->tdesc->desclist[ether->cur_tx];
+
+        dev->trans_start = jiffies;
+
+        if (txbd->mode & TX_OWEN_DMA)
+                netif_stop_queue(dev);
+
+        return 0;
+}
+
+static int w90p910_ether_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        if (!(w90p910_send_frame(dev, skb->data, skb->len))) {
+                ether->skb = skb;
+                dev_kfree_skb_irq(skb);
+                return 0;
+        }
+        return -1;
+}
+
+static irqreturn_t w90p910_tx_interrupt(int irq, void *dev_id)
+{
+        struct w90p910_ether *ether;
+        struct w90p910_txbd  *txbd;
+        struct platform_device *pdev;
+        struct tran_pdesc *tran_pdesc;
+        struct net_device *dev;
+        unsigned int cur_entry, entry, status;
+
+        dev = (struct net_device *)dev_id;
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+
+        spin_lock(&ether->lock);
+
+        w90p910_get_and_clear_int(dev, &status);
+
+        cur_entry = __raw_readl(ether->reg + REG_CTXDSA);
+
+        tran_pdesc = ether->tdesc_phys;
+        entry = (unsigned int)(&tran_pdesc->desclist[ether->finish_tx]);
+
+        while (entry != cur_entry) {
+                txbd = &ether->tdesc->desclist[ether->finish_tx];
+
+                ether->finish_tx = (ether->finish_tx + 1) % TX_DESC_SIZE;
+
+                if (txbd->sl & TXDS_TXCP) {
+                        ether->stats.tx_packets++;
+                        ether->stats.tx_bytes += txbd->sl & 0xFFFF;
+                } else {
+                        ether->stats.tx_errors++;
+                }
+
+                txbd->sl = 0x0;
+                txbd->mode = 0x0;
+
+                if (netif_queue_stopped(dev))
+                        netif_wake_queue(dev);
+
+                entry = (unsigned int)(&tran_pdesc->desclist[ether->finish_tx]);
+        }
+
+        if (status & MISTA_EXDEF) {
+                dev_err(&pdev->dev, "emc defer exceed interrupt\n");
+        } else if (status & MISTA_TXBERR) {
+                        dev_err(&pdev->dev, "emc bus error interrupt\n");
+                        w90p910_reset_mac(dev);
+                } else if (status & MISTA_TDU) {
+                                if (netif_queue_stopped(dev))
+                                        netif_wake_queue(dev);
+                        }
+
+        spin_unlock(&ether->lock);
+
+        return IRQ_HANDLED;
+}
+
+static void netdev_rx(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+        struct w90p910_rxbd *rxbd;
+        struct platform_device *pdev;
+        struct recv_pdesc *rdesc_phys;
+        struct sk_buff *skb;
+        unsigned char *data;
+        unsigned int length, status, val, entry;
+
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+        rdesc_phys = ether->rdesc_phys;
+
+        rxbd = &ether->rdesc->desclist[ether->cur_rx];
+
+        do {
+                val = __raw_readl(ether->reg + REG_CRXDSA);
+                entry = (unsigned int)&rdesc_phys->desclist[ether->cur_rx];
+
+                if (val == entry)
+                        break;
+
+                status = rxbd->sl;
+                length = status & 0xFFFF;
+
+                if (status & RXDS_RXGD) {
+                        data = ether->rdesc->recv_buf[ether->cur_rx];
+                        skb = dev_alloc_skb(length+2);
+                        if (!skb) {
+                                dev_err(&pdev->dev, "get skb buffer error\n");
+                                ether->stats.rx_dropped++;
+                                return;
+                        }
+
+                        skb->dev = dev;
+                        skb_reserve(skb, 2);
+                        skb_put(skb, length);
+                        skb_copy_to_linear_data(skb, data, length);
+                        skb->protocol = eth_type_trans(skb, dev);
+                        ether->stats.rx_packets++;
+                        ether->stats.rx_bytes += length;
+                        netif_rx(skb);
+                } else {
+                        ether->stats.rx_errors++;
+
+                        if (status & RXDS_RP) {
+                                dev_err(&pdev->dev, "rx runt err\n");
+                                ether->stats.rx_length_errors++;
+                        } else if (status & RXDS_CRCE) {
+                                        dev_err(&pdev->dev, "rx crc err\n");
+                                        ether->stats.rx_crc_errors++;
+                                }
+
+                        if (status & RXDS_ALIE) {
+                                dev_err(&pdev->dev, "rx aligment err\n");
+                                ether->stats.rx_frame_errors++;
+                        } else if (status & RXDS_PTLE) {
+                                        dev_err(&pdev->dev, "rx longer err\n");
+                                        ether->stats.rx_over_errors++;
+                                }
+                        }
+
+                rxbd->sl = RX_OWEN_DMA;
+                rxbd->reserved = 0x0;
+                ether->cur_rx = (ether->cur_rx+1) % RX_DESC_SIZE;
+                rxbd = &ether->rdesc->desclist[ether->cur_rx];
+
+                dev->last_rx = jiffies;
+        } while (1);
+}
+
+static irqreturn_t w90p910_rx_interrupt(int irq, void *dev_id)
+{
+        struct net_device *dev;
+        struct w90p910_ether  *ether;
+        struct platform_device *pdev;
+        unsigned int status;
+
+        dev = (struct net_device *)dev_id;
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+
+        spin_lock(&ether->lock);
+
+        w90p910_get_and_clear_int(dev, &status);
+
+        if (status & MISTA_RDU) {
+                netdev_rx(dev);
+
+                w90p910_trigger_rx(dev);
+
+                spin_unlock(&ether->lock);
+                return IRQ_HANDLED;
+        } else if (status & MISTA_RXBERR) {
+                        dev_err(&pdev->dev, "emc rx bus error\n");
+                        w90p910_reset_mac(dev);
+                }
+
+        netdev_rx(dev);
+        spin_unlock(&ether->lock);
+        return IRQ_HANDLED;
+}
+
+static int w90p910_ether_open(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+        struct platform_device *pdev;
+
+        ether = netdev_priv(dev);
+        pdev = ether->pdev;
+
+        w90p910_reset_mac(dev);
+        w90p910_set_fifo_threshold(dev);
+        w90p910_set_curdest(dev);
+        w90p910_enable_cam(dev);
+        w90p910_enable_cam_command(dev);
+        w90p910_enable_mac_interrupt(dev);
+        w90p910_set_global_maccmd(dev);
+        w90p910_enable_rx(dev, 1);
+
+        ether->rx_packets = 0x0;
+        ether->rx_bytes = 0x0;
+
+        if (request_irq(ether->txirq, w90p910_tx_interrupt,
+                                                0x0, pdev->name, dev)) {
+                dev_err(&pdev->dev, "register irq tx failed\n");
+                return -EAGAIN;
+        }
+
+        if (request_irq(ether->rxirq, w90p910_rx_interrupt,
+                                                0x0, pdev->name, dev)) {
+                dev_err(&pdev->dev, "register irq rx failed\n");
+                return -EAGAIN;
+        }
+
+        mod_timer(&ether->check_timer, jiffies + msecs_to_jiffies(1000));
+        netif_start_queue(dev);
+        w90p910_trigger_rx(dev);
+
+        dev_info(&pdev->dev, "%s is OPENED\n", dev->name);
+
+        return 0;
+}
+
+static void w90p910_ether_set_multicast_list(struct net_device *dev)
+{
+        struct w90p910_ether *ether;
+        unsigned int rx_mode;
+
+        ether = netdev_priv(dev);
+
+        if (dev->flags & IFF_PROMISC)
+                rx_mode = CAMCMR_AUP | CAMCMR_AMP | CAMCMR_ABP | CAMCMR_ECMP;
+        else if ((dev->flags & IFF_ALLMULTI) || dev->mc_list)
+                        rx_mode = CAMCMR_AMP | CAMCMR_ABP | CAMCMR_ECMP;
+                else
+                                rx_mode = CAMCMR_ECMP | CAMCMR_ABP;
+        __raw_writel(rx_mode, ether->reg + REG_CAMCMR);
+}
+
+static int w90p910_ether_ioctl(struct net_device *dev,
+                                                struct ifreq *ifr, int cmd)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct mii_ioctl_data *data = if_mii(ifr);
+
+        return generic_mii_ioctl(&ether->mii, data, cmd, NULL);
+}
+
+static void w90p910_get_drvinfo(struct net_device *dev,
+                                        struct ethtool_drvinfo *info)
+{
+        strcpy(info->driver, DRV_MODULE_NAME);
+        strcpy(info->version, DRV_MODULE_VERSION);
+}
+
+static int w90p910_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        return mii_ethtool_gset(&ether->mii, cmd);
+}
+
+static int w90p910_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        return mii_ethtool_sset(&ether->mii, cmd);
+}
+
+static int w90p910_nway_reset(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        return mii_nway_restart(&ether->mii);
+}
+
+static u32 w90p910_get_link(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        return mii_link_ok(&ether->mii);
+}
+
+static const struct ethtool_ops w90p910_ether_ethtool_ops = {
+        .get_settings   = w90p910_get_settings,
+        .set_settings   = w90p910_set_settings,
+        .get_drvinfo    = w90p910_get_drvinfo,
+        .nway_reset     = w90p910_nway_reset,
+        .get_link       = w90p910_get_link,
+};
+
+static const struct net_device_ops w90p910_ether_netdev_ops = {
+        .ndo_open               = w90p910_ether_open,
+        .ndo_stop               = w90p910_ether_close,
+        .ndo_start_xmit         = w90p910_ether_start_xmit,
+        .ndo_get_stats          = w90p910_ether_stats,
+        .ndo_set_multicast_list = w90p910_ether_set_multicast_list,
+        .ndo_set_mac_address    = set_mac_address,
+        .ndo_do_ioctl           = w90p910_ether_ioctl,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_change_mtu         = eth_change_mtu,
+};
+
+static void __init get_mac_address(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+        struct platform_device *pdev;
+        char addr[6];
+
+        pdev = ether->pdev;
+
+        addr[0] = 0x00;
+        addr[1] = 0x02;
+        addr[2] = 0xac;
+        addr[3] = 0x55;
+        addr[4] = 0x88;
+        addr[5] = 0xa8;
+
+        if (is_valid_ether_addr(addr))
+                memcpy(dev->dev_addr, &addr, 0x06);
+        else
+                dev_err(&pdev->dev, "invalid mac address\n");
+}
+
+static int w90p910_ether_setup(struct net_device *dev)
+{
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        ether_setup(dev);
+        dev->netdev_ops = &w90p910_ether_netdev_ops;
+        dev->ethtool_ops = &w90p910_ether_ethtool_ops;
+
+        dev->tx_queue_len = 16;
+        dev->dma = 0x0;
+        dev->watchdog_timeo = TX_TIMEOUT;
+
+        get_mac_address(dev);
+
+        spin_lock_init(&ether->lock);
+
+        ether->cur_tx = 0x0;
+        ether->cur_rx = 0x0;
+        ether->finish_tx = 0x0;
+        ether->linkflag = 0x0;
+        ether->mii.phy_id = 0x01;
+        ether->mii.phy_id_mask = 0x1f;
+        ether->mii.reg_num_mask = 0x1f;
+        ether->mii.dev = dev;
+        ether->mii.mdio_read = w90p910_mdio_read;
+        ether->mii.mdio_write = w90p910_mdio_write;
+
+        setup_timer(&ether->check_timer, w90p910_check_link,
+                                                (unsigned long)dev);
+
+        return 0;
+}
+
+static int __devinit w90p910_ether_probe(struct platform_device *pdev)
+{
+        struct w90p910_ether *ether;
+        struct net_device *dev;
+        struct resource *res;
+        int error;
+
+        dev = alloc_etherdev(sizeof(struct w90p910_ether));
+        if (!dev)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (res == NULL) {
+                dev_err(&pdev->dev, "failed to get I/O memory\n");
+                error = -ENXIO;
+                goto failed_free;
+        }
+
+        res = request_mem_region(res->start, resource_size(res), pdev->name);
+        if (res == NULL) {
+                dev_err(&pdev->dev, "failed to request I/O memory\n");
+                error = -EBUSY;
+                goto failed_free;
+        }
+
+        ether = netdev_priv(dev);
+
+        ether->reg = ioremap(res->start, resource_size(res));
+        if (ether->reg == NULL) {
+                dev_err(&pdev->dev, "failed to remap I/O memory\n");
+                error = -ENXIO;
+                goto failed_free_mem;
+        }
+
+        ether->txirq = platform_get_irq(pdev, 0);
+        if (ether->txirq < 0) {
+                dev_err(&pdev->dev, "failed to get ether tx irq\n");
+                error = -ENXIO;
+                goto failed_free_io;
+        }
+
+        ether->rxirq = platform_get_irq(pdev, 1);
+        if (ether->rxirq < 0) {
+                dev_err(&pdev->dev, "failed to get ether rx irq\n");
+                error = -ENXIO;
+                goto failed_free_txirq;
+        }
+
+        platform_set_drvdata(pdev, dev);
+
+        ether->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(ether->clk)) {
+                dev_err(&pdev->dev, "failed to get ether clock\n");
+                error = PTR_ERR(ether->clk);
+                goto failed_free_rxirq;
+        }
+
+        ether->rmiiclk = clk_get(&pdev->dev, "RMII");
+        if (IS_ERR(ether->rmiiclk)) {
+                dev_err(&pdev->dev, "failed to get ether clock\n");
+                error = PTR_ERR(ether->rmiiclk);
+                goto failed_put_clk;
+        }
+
+        ether->pdev = pdev;
+
+        w90p910_ether_setup(dev);
+
+        error = register_netdev(dev);
+        if (error != 0) {
+                dev_err(&pdev->dev, "Regiter EMC w90p910 FAILED\n");
+                error = -ENODEV;
+                goto failed_put_rmiiclk;
+        }
+
+        return 0;
+failed_put_rmiiclk:
+        clk_put(ether->rmiiclk);
+failed_put_clk:
+        clk_put(ether->clk);
+failed_free_rxirq:
+        free_irq(ether->rxirq, pdev);
+        platform_set_drvdata(pdev, NULL);
+failed_free_txirq:
+        free_irq(ether->txirq, pdev);
+failed_free_io:
+        iounmap(ether->reg);
+failed_free_mem:
+        release_mem_region(res->start, resource_size(res));
+failed_free:
+        free_netdev(dev);
+        return error;
+}
+
+static int __devexit w90p910_ether_remove(struct platform_device *pdev)
+{
+        struct net_device *dev = platform_get_drvdata(pdev);
+        struct w90p910_ether *ether = netdev_priv(dev);
+
+        unregister_netdev(dev);
+        clk_put(ether->rmiiclk);
+        clk_put(ether->clk);
+        del_timer_sync(&ether->check_timer);
+        platform_set_drvdata(pdev, NULL);
+        free_netdev(dev);
+        return 0;
+}
+
+static struct platform_driver w90p910_ether_driver = {
+        .probe          = w90p910_ether_probe,
+        .remove         = __devexit_p(w90p910_ether_remove),
+        .driver         = {
+                .name   = "w90p910-emc",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init w90p910_ether_init(void)
+{
+        return platform_driver_register(&w90p910_ether_driver);
+}
+
+static void __exit w90p910_ether_exit(void)
+{
+        platform_driver_unregister(&w90p910_ether_driver);
+}
+
+module_init(w90p910_ether_init);
+module_exit(w90p910_ether_exit);
+
+MODULE_AUTHOR("Wan ZongShun <mcuos.com@gmail.com>");
+MODULE_DESCRIPTION("w90p910 MAC driver!");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:w90p910-emc");
+
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index 18b566ad4fd1..cf30e278f182 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -318,7 +318,7 @@ static int __init at1700_probe1(struct net_device *dev, int ioaddr)
                                 pos3 = mca_read_stored_pos( slot, 3 );
                                 pos4 = mca_read_stored_pos( slot, 4 );
 
-                                for (l_i = 0; l_i < 0x09; l_i++)
+                                for (l_i = 0; l_i < 8; l_i++)
                                         if (( pos3 & 0x07) == at1700_ioaddr_pattern[l_i])
                                                 break;
                                 ioaddr = at1700_mca_probe_list[l_i];
diff --git a/drivers/net/atl1c/atl1c.h b/drivers/net/atl1c/atl1c.h
index e1658ef3fcdf..2a1120ad2e74 100644
--- a/drivers/net/atl1c/atl1c.h
+++ b/drivers/net/atl1c/atl1c.h
@@ -188,14 +188,14 @@ struct atl1c_tpd_ext_desc {
 #define RRS_HDS_TYPE_DATA       2
 
 #define RRS_IS_NO_HDS_TYPE(flag) \
-        (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == 0)
+        ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == 0)
 
 #define RRS_IS_HDS_HEAD(flag) \
-        (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == \
+        ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == \
                         RRS_HDS_TYPE_HEAD)
 
 #define RRS_IS_HDS_DATA(flag) \
-        (((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK == \
+        ((((flag) >> (RRS_HDS_TYPE_SHIFT)) & RRS_HDS_TYPE_MASK) == \
                         RRS_HDS_TYPE_DATA)
 
 /* rrs word 3 bit 0:31 */
@@ -245,7 +245,7 @@ struct atl1c_tpd_ext_desc {
 #define RRS_PACKET_TYPE_802_3   1
 #define RRS_PACKET_TYPE_ETH     0
 #define RRS_PACKET_IS_ETH(word) \
-        (((word) >> RRS_PACKET_TYPE_SHIFT) & RRS_PACKET_TYPE_MASK == \
+        ((((word) >> RRS_PACKET_TYPE_SHIFT) & RRS_PACKET_TYPE_MASK) == \
                         RRS_PACKET_TYPE_ETH)
 #define RRS_RXD_IS_VALID(word) \
         ((((word) >> RRS_RXD_UPDATED_SHIFT) & RRS_RXD_UPDATED_MASK) == 1)
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index cd547a205fb9..a383122679de 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -1689,7 +1689,7 @@ static void atl1c_clean_rx_irq(struct atl1c_adapter *adapter, u8 que,
                 if (likely(RRS_RXD_IS_VALID(rrs->word3))) {
                         rfd_num = (rrs->word0 >> RRS_RX_RFD_CNT_SHIFT) &
                                 RRS_RX_RFD_CNT_MASK;
-                        if (unlikely(rfd_num) != 1)
+                        if (unlikely(rfd_num != 1))
                                 /* TODO support mul rfd*/
                                 if (netif_msg_rx_err(adapter))
                                         dev_warn(&pdev->dev,
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index c43f6a119295..dea3155688bb 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -667,7 +667,7 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
         struct be_queue_info *rxq = &adapter->rx_obj.q;
         struct be_rx_page_info *page_info;
         u16 rxq_idx, i, num_rcvd, j;
-        u32 pktsize, hdr_len, curr_frag_len;
+        u32 pktsize, hdr_len, curr_frag_len, size;
         u8 *start;
 
         rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
@@ -708,12 +708,13 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
         }
 
         /* More frags present for this completion */
-        pktsize -= curr_frag_len; /* account for above copied frag */
+        size = pktsize;
         for (i = 1, j = 0; i < num_rcvd; i++) {
+                size -= curr_frag_len;
                 index_inc(&rxq_idx, rxq->len);
                 page_info = get_rx_page_info(adapter, rxq_idx);
 
-                curr_frag_len = min(pktsize, rx_frag_size);
+                curr_frag_len = min(size, rx_frag_size);
 
                 /* Coalesce all frags from the same physical page in one slot */
                 if (page_info->page_offset == 0) {
@@ -731,7 +732,6 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
                 skb_shinfo(skb)->frags[j].size += curr_frag_len;
                 skb->len += curr_frag_len;
                 skb->data_len += curr_frag_len;
-                pktsize -= curr_frag_len;
 
                 memset(page_info, 0, sizeof(*page_info));
         }
diff --git a/drivers/net/bnx2x_link.c b/drivers/net/bnx2x_link.c
index ed648acef7cf..2ee581a2cdec 100644
--- a/drivers/net/bnx2x_link.c
+++ b/drivers/net/bnx2x_link.c
@@ -4212,13 +4212,14 @@ static void bnx2x_turn_off_sf(struct bnx2x *bp, u8 port)
 u8 bnx2x_get_ext_phy_fw_version(struct link_params *params, u8 driver_loaded,
                               u8 *version, u16 len)
 {
-        struct bnx2x *bp = params->bp;
+        struct bnx2x *bp;
         u32 ext_phy_type = 0;
         u32 spirom_ver = 0;
         u8 status = 0 ;
 
         if (version == NULL || params == NULL)
                 return -EINVAL;
+        bp = params->bp;
 
         spirom_ver = REG_RD(bp, params->shmem_base +
                    offsetof(struct shmem_region,
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index d927f71af8a3..aa1be1feceed 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1459,8 +1459,16 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
          * ether type (eg ARPHRD_ETHER and ARPHRD_INFINIBAND) share the same bond
          */
         if (bond->slave_cnt == 0) {
-                if (slave_dev->type != ARPHRD_ETHER)
-                        bond_setup_by_slave(bond_dev, slave_dev);
+                if (bond_dev->type != slave_dev->type) {
+                        dev_close(bond_dev);
+                        pr_debug("%s: change device type from %d to %d\n",
+                                bond_dev->name, bond_dev->type, slave_dev->type);
+                        if (slave_dev->type != ARPHRD_ETHER)
+                                bond_setup_by_slave(bond_dev, slave_dev);
+                        else
+                                ether_setup(bond_dev);
+                        dev_open(bond_dev);
+                }
         } else if (bond_dev->type != slave_dev->type) {
                 pr_err(DRV_NAME ": %s ether type (%d) is different "
                         "from other slaves (%d), can not enslave it.\n",
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 574daddc21bf..9e4283aff828 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -346,7 +346,7 @@ void can_restart(unsigned long data)
         skb = dev_alloc_skb(sizeof(struct can_frame));
         if (skb == NULL) {
                 err = -ENOMEM;
-                goto out;
+                goto restart;
         }
         skb->dev = dev;
         skb->protocol = htons(ETH_P_CAN);
@@ -361,13 +361,13 @@ void can_restart(unsigned long data)
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
 
+restart:
         dev_dbg(dev->dev.parent, "restarted\n");
         priv->can_stats.restarts++;
 
         /* Now restart the device */
         err = priv->do_set_mode(dev, CAN_MODE_START);
 
-out:
         netif_carrier_on(dev);
         if (err)
                 dev_err(dev->dev.parent, "Error %d during restart", err);
@@ -473,6 +473,10 @@ int open_candev(struct net_device *dev)
                 return -EINVAL;
         }
 
+        /* Switch carrier on if device was stopped while in bus-off state */
+        if (!netif_carrier_ok(dev))
+                netif_carrier_on(dev);
+
         setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
 
         return 0;
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 571f133a8fec..08ebee79d8a6 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -63,7 +63,6 @@
 #include <linux/can.h>
 #include <linux/can/dev.h>
 #include <linux/can/error.h>
-#include <linux/can/dev.h>
 
 #include "sja1000.h"
 
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4d1515f45ba2..4869d77cbe91 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
         }
 
         rcu_read_lock();
-        ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
+        ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
         if (ulp_ops)
                 ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf, len);
         rcu_read_unlock();
@@ -319,6 +319,20 @@ static int cnic_abort_prep(struct cnic_sock *csk)
         return 0;
 }
 
+static void cnic_uio_stop(void)
+{
+        struct cnic_dev *dev;
+
+        read_lock(&cnic_dev_lock);
+        list_for_each_entry(dev, &cnic_dev_list, list) {
+                struct cnic_local *cp = dev->cnic_priv;
+
+                if (cp->cnic_uinfo)
+                        cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+        }
+        read_unlock(&cnic_dev_lock);
+}
+
 int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 {
         struct cnic_dev *dev;
@@ -390,6 +404,9 @@ int cnic_unregister_driver(int ulp_type)
         }
         read_unlock(&cnic_dev_lock);
 
+        if (ulp_type == CNIC_ULP_ISCSI)
+                cnic_uio_stop();
+
         rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);
 
         mutex_unlock(&cnic_lock);
@@ -632,7 +649,6 @@ static void cnic_free_resc(struct cnic_dev *dev)
         int i = 0;
 
         if (cp->cnic_uinfo) {
-                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
                 while (cp->uio_dev != -1 && i < 15) {
                         msleep(100);
                         i++;
@@ -1057,6 +1073,9 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
         struct cnic_local *cp = dev->cnic_priv;
         int if_type;
 
+        if (cp->cnic_uinfo)
+                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+
         rcu_read_lock();
         for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                 struct cnic_ulp_ops *ulp_ops;
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index efa680f4b8dd..41b648a67fec 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1897,6 +1897,9 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
 
                         if (ioread8(&nic->csr->scb.status) & rus_no_res)
                                 nic->ru_running = RU_SUSPENDED;
+                pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
+                                               sizeof(struct rfd),
+                                               PCI_DMA_BIDIRECTIONAL);
                 return -ENODATA;
         }
 
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index cc2ab6412c73..4f7003485348 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -1784,7 +1784,7 @@ int __init init_module(void)
                 printk(KERN_INFO "eepro_init_module: Auto-detecting boards (May God protect us...)\n");
         }
 
-        for (i = 0; io[i] != -1 && i < MAX_EEPRO; i++) {
+        for (i = 0; i < MAX_EEPRO && io[i] != -1; i++) {
                 dev = alloc_etherdev(sizeof(struct eepro_local));
                 if (!dev)
                         break;
diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index 48385c42ab57..160655d24581 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -584,7 +584,8 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
         if (np->flags == HAS_MII_XCVR) {
                 int phy, phy_idx = 0;
 
-                for (phy = 1; phy < 32 && phy_idx < 4; phy++) {
+                for (phy = 1; phy < 32 && phy_idx < ARRAY_SIZE(np->phys);
+                               phy++) {
                         int mii_status = mdio_read(dev, phy, 1);
 
                         if (mii_status != 0xffff && mii_status != 0x0000) {
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index b892c3ad9a74..2bc2d2b20644 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -754,17 +754,16 @@ static int fs_init_phy(struct net_device *dev)
         fep->oldlink = 0;
         fep->oldspeed = 0;
         fep->oldduplex = -1;
-        if(fep->fpi->phy_node)
-                phydev = of_phy_connect(dev, fep->fpi->phy_node,
-                                        &fs_adjust_link, 0,
-                                        PHY_INTERFACE_MODE_MII);
-        else {
-                printk("No phy bus ID specified in BSP code\n");
-                return -EINVAL;
+
+        phydev = of_phy_connect(dev, fep->fpi->phy_node, &fs_adjust_link, 0,
+                                PHY_INTERFACE_MODE_MII);
+        if (!phydev) {
+                phydev = of_phy_connect_fixed_link(dev, &fs_adjust_link,
+                                                   PHY_INTERFACE_MODE_MII);
         }
-        if (IS_ERR(phydev)) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return PTR_ERR(phydev);
+        if (!phydev) {
+                dev_err(&dev->dev, "Could not attach to PHY\n");
+                return -ENODEV;
         }
 
         fep->phydev = phydev;
@@ -1005,6 +1004,7 @@ static int __devinit fs_enet_probe(struct of_device *ofdev,
                 goto out_free_fpi;
         }
 
+        SET_NETDEV_DEV(ndev, &ofdev->dev);
         dev_set_drvdata(&ofdev->dev, ndev);
 
         fep = netdev_priv(ndev);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 43d813ed9f45..f8ffcbf0bc39 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -264,15 +264,6 @@ static int gfar_of_init(struct net_device *dev)
                 priv->device_flags |= FSL_GIANFAR_DEV_HAS_MAGIC_PACKET;
 
         priv->phy_node = of_parse_phandle(np, "phy-handle", 0);
-        if (!priv->phy_node) {
-                u32 *fixed_link;
-
-                fixed_link = (u32 *)of_get_property(np, "fixed-link", NULL);
-                if (!fixed_link) {
-                        err = -ENODEV;
-                        goto err_out;
-                }
-        }
 
         /* Find the TBI PHY.  If it's not there, we don't support SGMII */
         priv->tbi_node = of_parse_phandle(np, "tbi-handle", 0);
@@ -659,13 +650,14 @@ static int init_phy(struct net_device *dev)
 
         interface = gfar_get_interface(dev);
 
-        if (priv->phy_node) {
-                priv->phydev = of_phy_connect(dev, priv->phy_node, &adjust_link,
-                                              0, interface);
-                if (!priv->phydev) {
-                        dev_err(&dev->dev, "error: Could not attach to PHY\n");
-                        return -ENODEV;
-                }
+        priv->phydev = of_phy_connect(dev, priv->phy_node, &adjust_link, 0,
+                                      interface);
+        if (!priv->phydev)
+                priv->phydev = of_phy_connect_fixed_link(dev, &adjust_link,
+                                                         interface);
+        if (!priv->phydev) {
+                dev_err(&dev->dev, "could not attach to PHY\n");
+                return -ENODEV;
         }
 
         if (interface == PHY_INTERFACE_MODE_SGMII)
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 155160052c8b..981ab530e9ac 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -3,7 +3,7 @@
  *              devices like TTY. It interfaces between a raw TTY and the
  *              kernel's AX.25 protocol layers.
  *
- * Authors:     Andreas Könsgen <ajk@iehk.rwth-aachen.de>
+ * Authors:     Andreas Könsgen <ajk@comnets.uni-bremen.de>
  *              Ralf Baechle DL5RB <ralf@linux-mips.org>
  *
  * Quite a lot of stuff "stolen" by Joerg Reuter from slip.c, written by
diff --git a/drivers/net/ibm_newemac/rgmii.c b/drivers/net/ibm_newemac/rgmii.c
index 1d5379de6900..8d76cb89dbd6 100644
--- a/drivers/net/ibm_newemac/rgmii.c
+++ b/drivers/net/ibm_newemac/rgmii.c
@@ -188,11 +188,12 @@ void rgmii_put_mdio(struct of_device *ofdev, int input)
 void rgmii_detach(struct of_device *ofdev, int input)
 {
         struct rgmii_instance *dev = dev_get_drvdata(&ofdev->dev);
-        struct rgmii_regs __iomem *p = dev->base;
-
-        mutex_lock(&dev->lock);
+        struct rgmii_regs __iomem *p;
 
         BUG_ON(!dev || dev->users == 0);
+        p = dev->base;
+
+        mutex_lock(&dev->lock);
 
         RGMII_DBG(dev, "detach(%d)" NL, input);
 
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index cd22323cfd22..1b12c7ba275f 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -327,6 +327,7 @@ struct ixgbe_adapter {
 #define IXGBE_FLAG_IN_SFP_MOD_TASK              (u32)(1 << 25)
 #define IXGBE_FLAG_FDIR_HASH_CAPABLE            (u32)(1 << 26)
 #define IXGBE_FLAG_FDIR_PERFECT_CAPABLE         (u32)(1 << 27)
+#define IXGBE_FLAG_FCOE_CAPABLE                 (u32)(1 << 28)
 #define IXGBE_FLAG_FCOE_ENABLED                 (u32)(1 << 29)
 
         u32 flags2;
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index 7c5978ad929a..1c7265732900 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -106,8 +106,6 @@ static u8 ixgbe_dcbnl_get_state(struct net_device *netdev)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
 
-        DPRINTK(DRV, INFO, "Get DCB Admin Mode.\n");
-
         return !!(adapter->flags & IXGBE_FLAG_DCB_ENABLED);
 }
 
@@ -116,8 +114,6 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
         u8 err = 0;
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
 
-        DPRINTK(DRV, INFO, "Set DCB Admin Mode.\n");
-
         if (state > 0) {
                 /* Turn on DCB */
                 if (adapter->flags & IXGBE_FLAG_DCB_ENABLED)
@@ -143,6 +139,18 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         adapter->flags &= ~IXGBE_FLAG_FDIR_PERFECT_CAPABLE;
                 }
                 adapter->flags |= IXGBE_FLAG_DCB_ENABLED;
+#ifdef IXGBE_FCOE
+                /* Turn on FCoE offload */
+                if ((adapter->flags & IXGBE_FLAG_FCOE_CAPABLE) &&
+                    (!(adapter->flags & IXGBE_FLAG_FCOE_ENABLED))) {
+                        adapter->flags |= IXGBE_FLAG_FCOE_ENABLED;
+                        adapter->ring_feature[RING_F_FCOE].indices =
+                                IXGBE_FCRETA_SIZE;
+                        netdev->features |= NETIF_F_FCOE_CRC;
+                        netdev->features |= NETIF_F_FSO;
+                        netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
+                }
+#endif /* IXGBE_FCOE */
                 ixgbe_init_interrupt_scheme(adapter);
                 if (netif_running(netdev))
                         netdev->netdev_ops->ndo_open(netdev);
@@ -160,6 +168,18 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         adapter->flags |= IXGBE_FLAG_RSS_ENABLED;
                         if (adapter->hw.mac.type == ixgbe_mac_82599EB)
                                 adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
+
+#ifdef IXGBE_FCOE
+                        /* Turn off FCoE offload */
+                        if (adapter->flags & (IXGBE_FLAG_FCOE_CAPABLE |
+                             IXGBE_FLAG_FCOE_ENABLED)) {
+                                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
+                                adapter->ring_feature[RING_F_FCOE].indices = 0;
+                                netdev->features &= ~NETIF_F_FCOE_CRC;
+                                netdev->features &= ~NETIF_F_FSO;
+                                netdev->fcoe_ddp_xid = 0;
+                        }
+#endif /* IXGBE_FCOE */
                         ixgbe_init_interrupt_scheme(adapter);
                         if (netif_running(netdev))
                                 netdev->netdev_ops->ndo_open(netdev);
@@ -175,6 +195,8 @@ static void ixgbe_dcbnl_get_perm_hw_addr(struct net_device *netdev,
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
         int i, j;
 
+        memset(perm_addr, 0xff, MAX_ADDR_LEN);
+
         for (i = 0; i < netdev->addr_len; i++)
                 perm_addr[i] = adapter->hw.mac.perm_addr[i];
 
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e3442f47f932..200454f30f6a 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -34,6 +34,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
+#include <linux/pkt_sched.h>
 #include <linux/ipv6.h>
 #include <net/checksum.h>
 #include <net/ip6_checksum.h>
@@ -510,8 +511,11 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
  * @skb: skb currently being received and modified
  **/
 static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
-                                     u32 status_err, struct sk_buff *skb)
+                                     union ixgbe_adv_rx_desc *rx_desc,
+                                     struct sk_buff *skb)
 {
+        u32 status_err = le32_to_cpu(rx_desc->wb.upper.status_error);
+
         skb->ip_summed = CHECKSUM_NONE;
 
         /* Rx csum disabled */
@@ -529,6 +533,16 @@ static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
                 return;
 
         if (status_err & IXGBE_RXDADV_ERR_TCPE) {
+                u16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
+
+                /*
+                 * 82599 errata, UDP frames with a 0 checksum can be marked as
+                 * checksum errors.
+                 */
+                if ((pkt_info & IXGBE_RXDADV_PKTTYPE_UDP) &&
+                    (adapter->hw.mac.type == ixgbe_mac_82599EB))
+                        return;
+
                 adapter->hw_csum_rx_error++;
                 return;
         }
@@ -802,7 +816,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                         goto next_desc;
                 }
 
-                ixgbe_rx_checksum(adapter, staterr, skb);
+                ixgbe_rx_checksum(adapter, rx_desc, skb);
 
                 /* probably a little skewed due to removing CRC */
                 total_rx_bytes += skb->len;
@@ -3806,8 +3820,9 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                 adapter->atr_sample_rate = 20;
                 adapter->fdir_pballoc = 0;
 #ifdef IXGBE_FCOE
-                adapter->flags |= IXGBE_FLAG_FCOE_ENABLED;
-                adapter->ring_feature[RING_F_FCOE].indices = IXGBE_FCRETA_SIZE;
+                adapter->flags |= IXGBE_FLAG_FCOE_CAPABLE;
+                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
+                adapter->ring_feature[RING_F_FCOE].indices = 0;
 #endif /* IXGBE_FCOE */
         }
 
@@ -5125,9 +5140,6 @@ static int ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         int count = 0;
         unsigned int f;
 
-        r_idx = skb->queue_mapping;
-        tx_ring = &adapter->tx_ring[r_idx];
-
         if (adapter->vlgrp && vlan_tx_tag_present(skb)) {
                 tx_flags |= vlan_tx_tag_get(skb);
                 if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
@@ -5137,11 +5149,19 @@ static int ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
                 tx_flags |= IXGBE_TX_FLAGS_VLAN;
         } else if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
-                tx_flags |= (skb->queue_mapping << 13);
-                tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
-                tx_flags |= IXGBE_TX_FLAGS_VLAN;
+                if (skb->priority != TC_PRIO_CONTROL) {
+                        tx_flags |= (skb->queue_mapping << 13);
+                        tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
+                        tx_flags |= IXGBE_TX_FLAGS_VLAN;
+                } else {
+                        skb->queue_mapping =
+                                adapter->ring_feature[RING_F_DCB].indices-1;
+                }
         }
 
+        r_idx = skb->queue_mapping;
+        tx_ring = &adapter->tx_ring[r_idx];
+
         if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
             (skb->protocol == htons(ETH_P_FCOE)))
                 tx_flags |= IXGBE_TX_FLAGS_FCOE;
@@ -5580,16 +5600,11 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
 #endif
 
 #ifdef IXGBE_FCOE
-        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
+        if (adapter->flags & IXGBE_FLAG_FCOE_CAPABLE) {
                 if (hw->mac.ops.get_device_caps) {
                         hw->mac.ops.get_device_caps(hw, &device_caps);
-                        if (!(device_caps & IXGBE_DEVICE_CAPS_FCOE_OFFLOADS)) {
-                                netdev->features |= NETIF_F_FCOE_CRC;
-                                netdev->features |= NETIF_F_FSO;
-                                netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
-                        } else {
-                                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
-                        }
+                        if (device_caps & IXGBE_DEVICE_CAPS_FCOE_OFFLOADS)
+                                adapter->flags &= ~IXGBE_FLAG_FCOE_CAPABLE;
                 }
         }
 #endif /* IXGBE_FCOE */
@@ -5638,7 +5653,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 adapter->wol = 0;
                 break;
         }
-        device_init_wakeup(&adapter->pdev->dev, true);
         device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
         /* pick up the PCI bus settings for reporting later */
diff --git a/drivers/net/jazzsonic.c b/drivers/net/jazzsonic.c
index d12106b47bf2..2f286091394d 100644
--- a/drivers/net/jazzsonic.c
+++ b/drivers/net/jazzsonic.c
@@ -229,6 +229,7 @@ static int __init jazz_sonic_probe(struct platform_device *pdev)
         lp = netdev_priv(dev);
         lp->device = &pdev->dev;
         SET_NETDEV_DEV(dev, &pdev->dev);
+        platform_set_drvdata(pdev, dev);
 
         netdev_boot_setup_check(dev);
 
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
new file mode 100644
index 000000000000..9a1dea60c1c4
--- /dev/null
+++ b/drivers/net/ks8851.c
@@ -0,0 +1,1322 @@
+/* drivers/net/ks8651.c
+ *
+ * Copyright 2009 Simtec Electronics
+ *      http://www.simtec.co.uk/
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#define DEBUG
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/cache.h>
+#include <linux/crc32.h>
+#include <linux/mii.h>
+
+#include <linux/spi/spi.h>
+
+#include "ks8851.h"
+
+/**
+ * struct ks8851_rxctrl - KS8851 driver rx control
+ * @mchash: Multicast hash-table data.
+ * @rxcr1: KS_RXCR1 register setting
+ * @rxcr2: KS_RXCR2 register setting
+ *
+ * Representation of the settings needs to control the receive filtering
+ * such as the multicast hash-filter and the receive register settings. This
+ * is used to make the job of working out if the receive settings change and
+ * then issuing the new settings to the worker that will send the necessary
+ * commands.
+ */
+struct ks8851_rxctrl {
+        u16     mchash[4];
+        u16     rxcr1;
+        u16     rxcr2;
+};
+
+/**
+ * union ks8851_tx_hdr - tx header data
+ * @txb: The header as bytes
+ * @txw: The header as 16bit, little-endian words
+ *
+ * A dual representation of the tx header data to allow
+ * access to individual bytes, and to allow 16bit accesses
+ * with 16bit alignment.
+ */
+union ks8851_tx_hdr {
+        u8      txb[6];
+        __le16  txw[3];
+};
+
+/**
+ * struct ks8851_net - KS8851 driver private data
+ * @netdev: The network device we're bound to
+ * @spidev: The spi device we're bound to.
+ * @lock: Lock to ensure that the device is not accessed when busy.
+ * @statelock: Lock on this structure for tx list.
+ * @mii: The MII state information for the mii calls.
+ * @rxctrl: RX settings for @rxctrl_work.
+ * @tx_work: Work queue for tx packets
+ * @irq_work: Work queue for servicing interrupts
+ * @rxctrl_work: Work queue for updating RX mode and multicast lists
+ * @txq: Queue of packets for transmission.
+ * @spi_msg1: pre-setup SPI transfer with one message, @spi_xfer1.
+ * @spi_msg2: pre-setup SPI transfer with two messages, @spi_xfer2.
+ * @txh: Space for generating packet TX header in DMA-able data
+ * @rxd: Space for receiving SPI data, in DMA-able space.
+ * @txd: Space for transmitting SPI data, in DMA-able space.
+ * @msg_enable: The message flags controlling driver output (see ethtool).
+ * @fid: Incrementing frame id tag.
+ * @rc_ier: Cached copy of KS_IER.
+ * @rc_rxqcr: Cached copy of KS_RXQCR.
+ *
+ * The @lock ensures that the chip is protected when certain operations are
+ * in progress. When the read or write packet transfer is in progress, most
+ * of the chip registers are not ccessible until the transfer is finished and
+ * the DMA has been de-asserted.
+ *
+ * The @statelock is used to protect information in the structure which may
+ * need to be accessed via several sources, such as the network driver layer
+ * or one of the work queues.
+ *
+ * We align the buffers we may use for rx/tx to ensure that if the SPI driver
+ * wants to DMA map them, it will not have any problems with data the driver
+ * modifies.
+ */
+struct ks8851_net {
+        struct net_device       *netdev;
+        struct spi_device       *spidev;
+        struct mutex            lock;
+        spinlock_t              statelock;
+
+        union ks8851_tx_hdr     txh ____cacheline_aligned;
+        u8                      rxd[8];
+        u8                      txd[8];
+
+        u32                     msg_enable ____cacheline_aligned;
+        u16                     tx_space;
+        u8                      fid;
+
+        u16                     rc_ier;
+        u16                     rc_rxqcr;
+
+        struct mii_if_info      mii;
+        struct ks8851_rxctrl    rxctrl;
+
+        struct work_struct      tx_work;
+        struct work_struct      irq_work;
+        struct work_struct      rxctrl_work;
+
+        struct sk_buff_head     txq;
+
+        struct spi_message      spi_msg1;
+        struct spi_message      spi_msg2;
+        struct spi_transfer     spi_xfer1;
+        struct spi_transfer     spi_xfer2[2];
+};
+
+static int msg_enable;
+
+#define ks_info(_ks, _msg...) dev_info(&(_ks)->spidev->dev, _msg)
+#define ks_warn(_ks, _msg...) dev_warn(&(_ks)->spidev->dev, _msg)
+#define ks_dbg(_ks, _msg...) dev_dbg(&(_ks)->spidev->dev, _msg)
+#define ks_err(_ks, _msg...) dev_err(&(_ks)->spidev->dev, _msg)
+
+/* shift for byte-enable data */
+#define BYTE_EN(_x)     ((_x) << 2)
+
+/* turn register number and byte-enable mask into data for start of packet */
+#define MK_OP(_byteen, _reg) (BYTE_EN(_byteen) | (_reg)  << (8+2) | (_reg) >> 6)
+
+/* SPI register read/write calls.
+ *
+ * All these calls issue SPI transactions to access the chip's registers. They
+ * all require that the necessary lock is held to prevent accesses when the
+ * chip is busy transfering packet data (RX/TX FIFO accesses).
+ */
+
+/**
+ * ks8851_wrreg16 - write 16bit register value to chip
+ * @ks: The chip state
+ * @reg: The register address
+ * @val: The value to write
+ *
+ * Issue a write to put the value @val into the register specified in @reg.
+ */
+static void ks8851_wrreg16(struct ks8851_net *ks, unsigned reg, unsigned val)
+{
+        struct spi_transfer *xfer = &ks->spi_xfer1;
+        struct spi_message *msg = &ks->spi_msg1;
+        __le16 txb[2];
+        int ret;
+
+        txb[0] = cpu_to_le16(MK_OP(reg & 2 ? 0xC : 0x03, reg) | KS_SPIOP_WR);
+        txb[1] = cpu_to_le16(val);
+
+        xfer->tx_buf = txb;
+        xfer->rx_buf = NULL;
+        xfer->len = 4;
+
+        ret = spi_sync(ks->spidev, msg);
+        if (ret < 0)
+                ks_err(ks, "spi_sync() failed\n");
+}
+
+/**
+ * ks8851_rx_1msg - select whether to use one or two messages for spi read
+ * @ks: The device structure
+ *
+ * Return whether to generate a single message with a tx and rx buffer
+ * supplied to spi_sync(), or alternatively send the tx and rx buffers
+ * as separate messages.
+ *
+ * Depending on the hardware in use, a single message may be more efficient
+ * on interrupts or work done by the driver.
+ *
+ * This currently always returns true until we add some per-device data passed
+ * from the platform code to specify which mode is better.
+ */
+static inline bool ks8851_rx_1msg(struct ks8851_net *ks)
+{
+        return true;
+}
+
+/**
+ * ks8851_rdreg - issue read register command and return the data
+ * @ks: The device state
+ * @op: The register address and byte enables in message format.
+ * @rxb: The RX buffer to return the result into
+ * @rxl: The length of data expected.
+ *
+ * This is the low level read call that issues the necessary spi message(s)
+ * to read data from the register specified in @op.
+ */
+static void ks8851_rdreg(struct ks8851_net *ks, unsigned op,
+                         u8 *rxb, unsigned rxl)
+{
+        struct spi_transfer *xfer;
+        struct spi_message *msg;
+        __le16 *txb = (__le16 *)ks->txd;
+        u8 *trx = ks->rxd;
+        int ret;
+
+        txb[0] = cpu_to_le16(op | KS_SPIOP_RD);
+
+        if (ks8851_rx_1msg(ks)) {
+                msg = &ks->spi_msg1;
+                xfer = &ks->spi_xfer1;
+
+                xfer->tx_buf = txb;
+                xfer->rx_buf = trx;
+                xfer->len = rxl + 2;
+        } else {
+                msg = &ks->spi_msg2;
+                xfer = ks->spi_xfer2;
+
+                xfer->tx_buf = txb;
+                xfer->rx_buf = NULL;
+                xfer->len = 2;
+
+                xfer++;
+                xfer->tx_buf = NULL;
+                xfer->rx_buf = trx;
+                xfer->len = rxl;
+        }
+
+        ret = spi_sync(ks->spidev, msg);
+        if (ret < 0)
+                ks_err(ks, "read: spi_sync() failed\n");
+        else if (ks8851_rx_1msg(ks))
+                memcpy(rxb, trx + 2, rxl);
+        else
+                memcpy(rxb, trx, rxl);
+}
+
+/**
+ * ks8851_rdreg8 - read 8 bit register from device
+ * @ks: The chip information
+ * @reg: The register address
+ *
+ * Read a 8bit register from the chip, returning the result
+*/
+static unsigned ks8851_rdreg8(struct ks8851_net *ks, unsigned reg)
+{
+        u8 rxb[1];
+
+        ks8851_rdreg(ks, MK_OP(1 << (reg & 3), reg), rxb, 1);
+        return rxb[0];
+}
+
+/**
+ * ks8851_rdreg16 - read 16 bit register from device
+ * @ks: The chip information
+ * @reg: The register address
+ *
+ * Read a 16bit register from the chip, returning the result
+*/
+static unsigned ks8851_rdreg16(struct ks8851_net *ks, unsigned reg)
+{
+        __le16 rx = 0;
+
+        ks8851_rdreg(ks, MK_OP(reg & 2 ? 0xC : 0x3, reg), (u8 *)&rx, 2);
+        return le16_to_cpu(rx);
+}
+
+/**
+ * ks8851_rdreg32 - read 32 bit register from device
+ * @ks: The chip information
+ * @reg: The register address
+ *
+ * Read a 32bit register from the chip.
+ *
+ * Note, this read requires the address be aligned to 4 bytes.
+*/
+static unsigned ks8851_rdreg32(struct ks8851_net *ks, unsigned reg)
+{
+        __le32 rx = 0;
+
+        WARN_ON(reg & 3);
+
+        ks8851_rdreg(ks, MK_OP(0xf, reg), (u8 *)&rx, 4);
+        return le32_to_cpu(rx);
+}
+
+/**
+ * ks8851_soft_reset - issue one of the soft reset to the device
+ * @ks: The device state.
+ * @op: The bit(s) to set in the GRR
+ *
+ * Issue the relevant soft-reset command to the device's GRR register
+ * specified by @op.
+ *
+ * Note, the delays are in there as a caution to ensure that the reset
+ * has time to take effect and then complete. Since the datasheet does
+ * not currently specify the exact sequence, we have chosen something
+ * that seems to work with our device.
+ */
+static void ks8851_soft_reset(struct ks8851_net *ks, unsigned op)
+{
+        ks8851_wrreg16(ks, KS_GRR, op);
+        mdelay(1);      /* wait a short time to effect reset */
+        ks8851_wrreg16(ks, KS_GRR, 0);
+        mdelay(1);      /* wait for condition to clear */
+}
+
+/**
+ * ks8851_write_mac_addr - write mac address to device registers
+ * @dev: The network device
+ *
+ * Update the KS8851 MAC address registers from the address in @dev.
+ *
+ * This call assumes that the chip is not running, so there is no need to
+ * shutdown the RXQ process whilst setting this.
+*/
+static int ks8851_write_mac_addr(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        u16 *mcp = (u16 *)dev->dev_addr;
+
+        mutex_lock(&ks->lock);
+
+        ks8851_wrreg16(ks, KS_MARL, mcp[0]);
+        ks8851_wrreg16(ks, KS_MARM, mcp[1]);
+        ks8851_wrreg16(ks, KS_MARH, mcp[2]);
+
+        mutex_unlock(&ks->lock);
+
+        return 0;
+}
+
+/**
+ * ks8851_init_mac - initialise the mac address
+ * @ks: The device structure
+ *
+ * Get or create the initial mac address for the device and then set that
+ * into the station address register. Currently we assume that the device
+ * does not have a valid mac address in it, and so we use random_ether_addr()
+ * to create a new one.
+ *
+ * In future, the driver should check to see if the device has an EEPROM
+ * attached and whether that has a valid ethernet address in it.
+ */
+static void ks8851_init_mac(struct ks8851_net *ks)
+{
+        struct net_device *dev = ks->netdev;
+
+        random_ether_addr(dev->dev_addr);
+        ks8851_write_mac_addr(dev);
+}
+
+/**
+ * ks8851_irq - device interrupt handler
+ * @irq: Interrupt number passed from the IRQ hnalder.
+ * @pw: The private word passed to register_irq(), our struct ks8851_net.
+ *
+ * Disable the interrupt from happening again until we've processed the
+ * current status by scheduling ks8851_irq_work().
+ */
+static irqreturn_t ks8851_irq(int irq, void *pw)
+{
+        struct ks8851_net *ks = pw;
+
+        disable_irq_nosync(irq);
+        schedule_work(&ks->irq_work);
+        return IRQ_HANDLED;
+}
+
+/**
+ * ks8851_rdfifo - read data from the receive fifo
+ * @ks: The device state.
+ * @buff: The buffer address
+ * @len: The length of the data to read
+ *
+ * Issue an RXQ FIFO read command and read the @len ammount of data from
+ * the FIFO into the buffer specified by @buff.
+ */
+static void ks8851_rdfifo(struct ks8851_net *ks, u8 *buff, unsigned len)
+{
+        struct spi_transfer *xfer = ks->spi_xfer2;
+        struct spi_message *msg = &ks->spi_msg2;
+        u8 txb[1];
+        int ret;
+
+        if (netif_msg_rx_status(ks))
+                ks_dbg(ks, "%s: %d@%p\n", __func__, len, buff);
+
+        /* set the operation we're issuing */
+        txb[0] = KS_SPIOP_RXFIFO;
+
+        xfer->tx_buf = txb;
+        xfer->rx_buf = NULL;
+        xfer->len = 1;
+
+        xfer++;
+        xfer->rx_buf = buff;
+        xfer->tx_buf = NULL;
+        xfer->len = len;
+
+        ret = spi_sync(ks->spidev, msg);
+        if (ret < 0)
+                ks_err(ks, "%s: spi_sync() failed\n", __func__);
+}
+
+/**
+ * ks8851_dbg_dumpkkt - dump initial packet contents to debug
+ * @ks: The device state
+ * @rxpkt: The data for the received packet
+ *
+ * Dump the initial data from the packet to dev_dbg().
+*/
+static void ks8851_dbg_dumpkkt(struct ks8851_net *ks, u8 *rxpkt)
+{
+        ks_dbg(ks, "pkt %02x%02x%02x%02x %02x%02x%02x%02x %02x%02x%02x%02x\n",
+               rxpkt[4], rxpkt[5], rxpkt[6], rxpkt[7],
+               rxpkt[8], rxpkt[9], rxpkt[10], rxpkt[11],
+               rxpkt[12], rxpkt[13], rxpkt[14], rxpkt[15]);
+}
+
+/**
+ * ks8851_rx_pkts - receive packets from the host
+ * @ks: The device information.
+ *
+ * This is called from the IRQ work queue when the system detects that there
+ * are packets in the receive queue. Find out how many packets there are and
+ * read them from the FIFO.
+ */
+static void ks8851_rx_pkts(struct ks8851_net *ks)
+{
+        struct sk_buff *skb;
+        unsigned rxfc;
+        unsigned rxlen;
+        unsigned rxstat;
+        u32 rxh;
+        u8 *rxpkt;
+
+        rxfc = ks8851_rdreg8(ks, KS_RXFC);
+
+        if (netif_msg_rx_status(ks))
+                ks_dbg(ks, "%s: %d packets\n", __func__, rxfc);
+
+        /* Currently we're issuing a read per packet, but we could possibly
+         * improve the code by issuing a single read, getting the receive
+         * header, allocating the packet and then reading the packet data
+         * out in one go.
+         *
+         * This form of operation would require us to hold the SPI bus'
+         * chipselect low during the entie transaction to avoid any
+         * reset to the data stream comming from the chip.
+         */
+
+        for (; rxfc != 0; rxfc--) {
+                rxh = ks8851_rdreg32(ks, KS_RXFHSR);
+                rxstat = rxh & 0xffff;
+                rxlen = rxh >> 16;
+
+                if (netif_msg_rx_status(ks))
+                        ks_dbg(ks, "rx: stat 0x%04x, len 0x%04x\n",
+                                rxstat, rxlen);
+
+                /* the length of the packet includes the 32bit CRC */
+
+                /* set dma read address */
+                ks8851_wrreg16(ks, KS_RXFDPR, RXFDPR_RXFPAI | 0x00);
+
+                /* start the packet dma process, and set auto-dequeue rx */
+                ks8851_wrreg16(ks, KS_RXQCR,
+                               ks->rc_rxqcr | RXQCR_SDA | RXQCR_ADRFE);
+
+                if (rxlen > 0) {
+                        skb = netdev_alloc_skb(ks->netdev, rxlen + 2 + 8);
+                        if (!skb) {
+                                /* todo - dump frame and move on */
+                        }
+
+                        /* two bytes to ensure ip is aligned, and four bytes
+                         * for the status header and 4 bytes of garbage */
+                        skb_reserve(skb, 2 + 4 + 4);
+
+                        rxpkt = skb_put(skb, rxlen - 4) - 8;
+
+                        /* align the packet length to 4 bytes, and add 4 bytes
+                         * as we're getting the rx status header as well */
+                        ks8851_rdfifo(ks, rxpkt, ALIGN(rxlen, 4) + 8);
+
+                        if (netif_msg_pktdata(ks))
+                                ks8851_dbg_dumpkkt(ks, rxpkt);
+
+                        skb->protocol = eth_type_trans(skb, ks->netdev);
+                        netif_rx(skb);
+
+                        ks->netdev->stats.rx_packets++;
+                        ks->netdev->stats.rx_bytes += rxlen - 4;
+                }
+
+                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+        }
+}
+
+/**
+ * ks8851_irq_work - work queue handler for dealing with interrupt requests
+ * @work: The work structure that was scheduled by schedule_work()
+ *
+ * This is the handler invoked when the ks8851_irq() is called to find out
+ * what happened, as we cannot allow ourselves to sleep whilst waiting for
+ * anything other process has the chip's lock.
+ *
+ * Read the interrupt status, work out what needs to be done and then clear
+ * any of the interrupts that are not needed.
+ */
+static void ks8851_irq_work(struct work_struct *work)
+{
+        struct ks8851_net *ks = container_of(work, struct ks8851_net, irq_work);
+        unsigned status;
+        unsigned handled = 0;
+
+        mutex_lock(&ks->lock);
+
+        status = ks8851_rdreg16(ks, KS_ISR);
+
+        if (netif_msg_intr(ks))
+                dev_dbg(&ks->spidev->dev, "%s: status 0x%04x\n",
+                        __func__, status);
+
+        if (status & IRQ_LCI) {
+                /* should do something about checking link status */
+                handled |= IRQ_LCI;
+        }
+
+        if (status & IRQ_LDI) {
+                u16 pmecr = ks8851_rdreg16(ks, KS_PMECR);
+                pmecr &= ~PMECR_WKEVT_MASK;
+                ks8851_wrreg16(ks, KS_PMECR, pmecr | PMECR_WKEVT_LINK);
+
+                handled |= IRQ_LDI;
+        }
+
+        if (status & IRQ_RXPSI)
+                handled |= IRQ_RXPSI;
+
+        if (status & IRQ_TXI) {
+                handled |= IRQ_TXI;
+
+                /* no lock here, tx queue should have been stopped */
+
+                /* update our idea of how much tx space is available to the
+                 * system */
+                ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR);
+
+                if (netif_msg_intr(ks))
+                        ks_dbg(ks, "%s: txspace %d\n", __func__, ks->tx_space);
+        }
+
+        if (status & IRQ_RXI)
+                handled |= IRQ_RXI;
+
+        if (status & IRQ_SPIBEI) {
+                dev_err(&ks->spidev->dev, "%s: spi bus error\n", __func__);
+                handled |= IRQ_SPIBEI;
+        }
+
+        ks8851_wrreg16(ks, KS_ISR, handled);
+
+        if (status & IRQ_RXI) {
+                /* the datasheet says to disable the rx interrupt during
+                 * packet read-out, however we're masking the interrupt
+                 * from the device so do not bother masking just the RX
+                 * from the device. */
+
+                ks8851_rx_pkts(ks);
+        }
+
+        /* if something stopped the rx process, probably due to wanting
+         * to change the rx settings, then do something about restarting
+         * it. */
+        if (status & IRQ_RXPSI) {
+                struct ks8851_rxctrl *rxc = &ks->rxctrl;
+
+                /* update the multicast hash table */
+                ks8851_wrreg16(ks, KS_MAHTR0, rxc->mchash[0]);
+                ks8851_wrreg16(ks, KS_MAHTR1, rxc->mchash[1]);
+                ks8851_wrreg16(ks, KS_MAHTR2, rxc->mchash[2]);
+                ks8851_wrreg16(ks, KS_MAHTR3, rxc->mchash[3]);
+
+                ks8851_wrreg16(ks, KS_RXCR2, rxc->rxcr2);
+                ks8851_wrreg16(ks, KS_RXCR1, rxc->rxcr1);
+        }
+
+        mutex_unlock(&ks->lock);
+
+        if (status & IRQ_TXI)
+                netif_wake_queue(ks->netdev);
+
+        enable_irq(ks->netdev->irq);
+}
+
+/**
+ * calc_txlen - calculate size of message to send packet
+ * @len: Lenght of data
+ *
+ * Returns the size of the TXFIFO message needed to send
+ * this packet.
+ */
+static inline unsigned calc_txlen(unsigned len)
+{
+        return ALIGN(len + 4, 4);
+}
+
+/**
+ * ks8851_wrpkt - write packet to TX FIFO
+ * @ks: The device state.
+ * @txp: The sk_buff to transmit.
+ * @irq: IRQ on completion of the packet.
+ *
+ * Send the @txp to the chip. This means creating the relevant packet header
+ * specifying the length of the packet and the other information the chip
+ * needs, such as IRQ on completion. Send the header and the packet data to
+ * the device.
+ */
+static void ks8851_wrpkt(struct ks8851_net *ks, struct sk_buff *txp, bool irq)
+{
+        struct spi_transfer *xfer = ks->spi_xfer2;
+        struct spi_message *msg = &ks->spi_msg2;
+        unsigned fid = 0;
+        int ret;
+
+        if (netif_msg_tx_queued(ks))
+                dev_dbg(&ks->spidev->dev, "%s: skb %p, %d@%p, irq %d\n",
+                        __func__, txp, txp->len, txp->data, irq);
+
+        fid = ks->fid++;
+        fid &= TXFR_TXFID_MASK;
+
+        if (irq)
+                fid |= TXFR_TXIC;       /* irq on completion */
+
+        /* start header at txb[1] to align txw entries */
+        ks->txh.txb[1] = KS_SPIOP_TXFIFO;
+        ks->txh.txw[1] = cpu_to_le16(fid);
+        ks->txh.txw[2] = cpu_to_le16(txp->len);
+
+        xfer->tx_buf = &ks->txh.txb[1];
+        xfer->rx_buf = NULL;
+        xfer->len = 5;
+
+        xfer++;
+        xfer->tx_buf = txp->data;
+        xfer->rx_buf = NULL;
+        xfer->len = ALIGN(txp->len, 4);
+
+        ret = spi_sync(ks->spidev, msg);
+        if (ret < 0)
+                ks_err(ks, "%s: spi_sync() failed\n", __func__);
+}
+
+/**
+ * ks8851_done_tx - update and then free skbuff after transmitting
+ * @ks: The device state
+ * @txb: The buffer transmitted
+ */
+static void ks8851_done_tx(struct ks8851_net *ks, struct sk_buff *txb)
+{
+        struct net_device *dev = ks->netdev;
+
+        dev->stats.tx_bytes += txb->len;
+        dev->stats.tx_packets++;
+
+        dev_kfree_skb(txb);
+}
+
+/**
+ * ks8851_tx_work - process tx packet(s)
+ * @work: The work strucutre what was scheduled.
+ *
+ * This is called when a number of packets have been scheduled for
+ * transmission and need to be sent to the device.
+ */
+static void ks8851_tx_work(struct work_struct *work)
+{
+        struct ks8851_net *ks = container_of(work, struct ks8851_net, tx_work);
+        struct sk_buff *txb;
+        bool last = false;
+
+        mutex_lock(&ks->lock);
+
+        while (!last) {
+                txb = skb_dequeue(&ks->txq);
+                last = skb_queue_empty(&ks->txq);
+
+                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+                ks8851_wrpkt(ks, txb, last);
+                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+
+                ks8851_done_tx(ks, txb);
+        }
+
+        mutex_unlock(&ks->lock);
+}
+
+/**
+ * ks8851_set_powermode - set power mode of the device
+ * @ks: The device state
+ * @pwrmode: The power mode value to write to KS_PMECR.
+ *
+ * Change the power mode of the chip.
+ */
+static void ks8851_set_powermode(struct ks8851_net *ks, unsigned pwrmode)
+{
+        unsigned pmecr;
+
+        if (netif_msg_hw(ks))
+                ks_dbg(ks, "setting power mode %d\n", pwrmode);
+
+        pmecr = ks8851_rdreg16(ks, KS_PMECR);
+        pmecr &= ~PMECR_PM_MASK;
+        pmecr |= pwrmode;
+
+        ks8851_wrreg16(ks, KS_PMECR, pmecr);
+}
+
+/**
+ * ks8851_net_open - open network device
+ * @dev: The network device being opened.
+ *
+ * Called when the network device is marked active, such as a user executing
+ * 'ifconfig up' on the device.
+ */
+static int ks8851_net_open(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+
+        /* lock the card, even if we may not actually be doing anything
+         * else at the moment */
+        mutex_lock(&ks->lock);
+
+        if (netif_msg_ifup(ks))
+                ks_dbg(ks, "opening %s\n", dev->name);
+
+        /* bring chip out of any power saving mode it was in */
+        ks8851_set_powermode(ks, PMECR_PM_NORMAL);
+
+        /* issue a soft reset to the RX/TX QMU to put it into a known
+         * state. */
+        ks8851_soft_reset(ks, GRR_QMU);
+
+        /* setup transmission parameters */
+
+        ks8851_wrreg16(ks, KS_TXCR, (TXCR_TXE | /* enable transmit process */
+                                     TXCR_TXPE | /* pad to min length */
+                                     TXCR_TXCRC | /* add CRC */
+                                     TXCR_TXFCE)); /* enable flow control */
+
+        /* auto-increment tx data, reset tx pointer */
+        ks8851_wrreg16(ks, KS_TXFDPR, TXFDPR_TXFPAI);
+
+        /* setup receiver control */
+
+        ks8851_wrreg16(ks, KS_RXCR1, (RXCR1_RXPAFMA | /*  from mac filter */
+                                      RXCR1_RXFCE | /* enable flow control */
+                                      RXCR1_RXBE | /* broadcast enable */
+                                      RXCR1_RXUE | /* unicast enable */
+                                      RXCR1_RXE)); /* enable rx block */
+
+        /* transfer entire frames out in one go */
+        ks8851_wrreg16(ks, KS_RXCR2, RXCR2_SRDBL_FRAME);
+
+        /* set receive counter timeouts */
+        ks8851_wrreg16(ks, KS_RXDTTR, 1000); /* 1ms after first frame to IRQ */
+        ks8851_wrreg16(ks, KS_RXDBCTR, 4096); /* >4Kbytes in buffer to IRQ */
+        ks8851_wrreg16(ks, KS_RXFCTR, 10);  /* 10 frames to IRQ */
+
+        ks->rc_rxqcr = (RXQCR_RXFCTE |  /* IRQ on frame count exceeded */
+                        RXQCR_RXDBCTE | /* IRQ on byte count exceeded */
+                        RXQCR_RXDTTE);  /* IRQ on time exceeded */
+
+        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+
+        /* clear then enable interrupts */
+
+#define STD_IRQ (IRQ_LCI |      /* Link Change */       \
+                 IRQ_TXI |      /* TX done */           \
+                 IRQ_RXI |      /* RX done */           \
+                 IRQ_SPIBEI |   /* SPI bus error */     \
+                 IRQ_TXPSI |    /* TX process stop */   \
+                 IRQ_RXPSI)     /* RX process stop */
+
+        ks->rc_ier = STD_IRQ;
+        ks8851_wrreg16(ks, KS_ISR, STD_IRQ);
+        ks8851_wrreg16(ks, KS_IER, STD_IRQ);
+
+        netif_start_queue(ks->netdev);
+
+        if (netif_msg_ifup(ks))
+                ks_dbg(ks, "network device %s up\n", dev->name);
+
+        mutex_unlock(&ks->lock);
+        return 0;
+}
+
+/**
+ * ks8851_net_stop - close network device
+ * @dev: The device being closed.
+ *
+ * Called to close down a network device which has been active. Cancell any
+ * work, shutdown the RX and TX process and then place the chip into a low
+ * power state whilst it is not being used.
+ */
+static int ks8851_net_stop(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+
+        if (netif_msg_ifdown(ks))
+                ks_info(ks, "%s: shutting down\n", dev->name);
+
+        netif_stop_queue(dev);
+
+        mutex_lock(&ks->lock);
+
+        /* stop any outstanding work */
+        flush_work(&ks->irq_work);
+        flush_work(&ks->tx_work);
+        flush_work(&ks->rxctrl_work);
+
+        /* turn off the IRQs and ack any outstanding */
+        ks8851_wrreg16(ks, KS_IER, 0x0000);
+        ks8851_wrreg16(ks, KS_ISR, 0xffff);
+
+        /* shutdown RX process */
+        ks8851_wrreg16(ks, KS_RXCR1, 0x0000);
+
+        /* shutdown TX process */
+        ks8851_wrreg16(ks, KS_TXCR, 0x0000);
+
+        /* set powermode to soft power down to save power */
+        ks8851_set_powermode(ks, PMECR_PM_SOFTDOWN);
+
+        /* ensure any queued tx buffers are dumped */
+        while (!skb_queue_empty(&ks->txq)) {
+                struct sk_buff *txb = skb_dequeue(&ks->txq);
+
+                if (netif_msg_ifdown(ks))
+                        ks_dbg(ks, "%s: freeing txb %p\n", __func__, txb);
+
+                dev_kfree_skb(txb);
+        }
+
+        mutex_unlock(&ks->lock);
+        return 0;
+}
+
+/**
+ * ks8851_start_xmit - transmit packet
+ * @skb: The buffer to transmit
+ * @dev: The device used to transmit the packet.
+ *
+ * Called by the network layer to transmit the @skb. Queue the packet for
+ * the device and schedule the necessary work to transmit the packet when
+ * it is free.
+ *
+ * We do this to firstly avoid sleeping with the network device locked,
+ * and secondly so we can round up more than one packet to transmit which
+ * means we can try and avoid generating too many transmit done interrupts.
+ */
+static int ks8851_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        unsigned needed = calc_txlen(skb->len);
+        int ret = NETDEV_TX_OK;
+
+        if (netif_msg_tx_queued(ks))
+                ks_dbg(ks, "%s: skb %p, %d@%p\n", __func__,
+                       skb, skb->len, skb->data);
+
+        spin_lock(&ks->statelock);
+
+        if (needed > ks->tx_space) {
+                netif_stop_queue(dev);
+                ret = NETDEV_TX_BUSY;
+        } else {
+                ks->tx_space -= needed;
+                skb_queue_tail(&ks->txq, skb);
+        }
+
+        spin_unlock(&ks->statelock);
+        schedule_work(&ks->tx_work);
+
+        return ret;
+}
+
+/**
+ * ks8851_rxctrl_work - work handler to change rx mode
+ * @work: The work structure this belongs to.
+ *
+ * Lock the device and issue the necessary changes to the receive mode from
+ * the network device layer. This is done so that we can do this without
+ * having to sleep whilst holding the network device lock.
+ *
+ * Since the recommendation from Micrel is that the RXQ is shutdown whilst the
+ * receive parameters are programmed, we issue a write to disable the RXQ and
+ * then wait for the interrupt handler to be triggered once the RXQ shutdown is
+ * complete. The interrupt handler then writes the new values into the chip.
+ */
+static void ks8851_rxctrl_work(struct work_struct *work)
+{
+        struct ks8851_net *ks = container_of(work, struct ks8851_net, rxctrl_work);
+
+        mutex_lock(&ks->lock);
+
+        /* need to shutdown RXQ before modifying filter parameters */
+        ks8851_wrreg16(ks, KS_RXCR1, 0x00);
+
+        mutex_unlock(&ks->lock);
+}
+
+static void ks8851_set_rx_mode(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        struct ks8851_rxctrl rxctrl;
+
+        memset(&rxctrl, 0, sizeof(rxctrl));
+
+        if (dev->flags & IFF_PROMISC) {
+                /* interface to receive everything */
+
+                rxctrl.rxcr1 = RXCR1_RXAE | RXCR1_RXINVF;
+        } else if (dev->flags & IFF_ALLMULTI) {
+                /* accept all multicast packets */
+
+                rxctrl.rxcr1 = (RXCR1_RXME | RXCR1_RXAE |
+                                RXCR1_RXPAFMA | RXCR1_RXMAFMA);
+        } else if (dev->flags & IFF_MULTICAST && dev->mc_count > 0) {
+                struct dev_mc_list *mcptr = dev->mc_list;
+                u32 crc;
+                int i;
+
+                /* accept some multicast */
+
+                for (i = dev->mc_count; i > 0; i--) {
+                        crc = ether_crc(ETH_ALEN, mcptr->dmi_addr);
+                        crc >>= (32 - 6);  /* get top six bits */
+
+                        rxctrl.mchash[crc >> 4] |= (1 << (crc & 0xf));
+                        mcptr = mcptr->next;
+                }
+
+                rxctrl.rxcr1 = RXCR1_RXME | RXCR1_RXAE | RXCR1_RXPAFMA;
+        } else {
+                /* just accept broadcast / unicast */
+                rxctrl.rxcr1 = RXCR1_RXPAFMA;
+        }
+
+        rxctrl.rxcr1 |= (RXCR1_RXUE | /* unicast enable */
+                         RXCR1_RXBE | /* broadcast enable */
+                         RXCR1_RXE | /* RX process enable */
+                         RXCR1_RXFCE); /* enable flow control */
+
+        rxctrl.rxcr2 |= RXCR2_SRDBL_FRAME;
+
+        /* schedule work to do the actual set of the data if needed */
+
+        spin_lock(&ks->statelock);
+
+        if (memcmp(&rxctrl, &ks->rxctrl, sizeof(rxctrl)) != 0) {
+                memcpy(&ks->rxctrl, &rxctrl, sizeof(ks->rxctrl));
+                schedule_work(&ks->rxctrl_work);
+        }
+
+        spin_unlock(&ks->statelock);
+}
+
+static int ks8851_set_mac_address(struct net_device *dev, void *addr)
+{
+        struct sockaddr *sa = addr;
+
+        if (netif_running(dev))
+                return -EBUSY;
+
+        if (!is_valid_ether_addr(sa->sa_data))
+                return -EADDRNOTAVAIL;
+
+        memcpy(dev->dev_addr, sa->sa_data, ETH_ALEN);
+        return ks8851_write_mac_addr(dev);
+}
+
+static int ks8851_net_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+
+        if (!netif_running(dev))
+                return -EINVAL;
+
+        return generic_mii_ioctl(&ks->mii, if_mii(req), cmd, NULL);
+}
+
+static const struct net_device_ops ks8851_netdev_ops = {
+        .ndo_open               = ks8851_net_open,
+        .ndo_stop               = ks8851_net_stop,
+        .ndo_do_ioctl           = ks8851_net_ioctl,
+        .ndo_start_xmit         = ks8851_start_xmit,
+        .ndo_set_mac_address    = ks8851_set_mac_address,
+        .ndo_set_rx_mode        = ks8851_set_rx_mode,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+/* ethtool support */
+
+static void ks8851_get_drvinfo(struct net_device *dev,
+                               struct ethtool_drvinfo *di)
+{
+        strlcpy(di->driver, "KS8851", sizeof(di->driver));
+        strlcpy(di->version, "1.00", sizeof(di->version));
+        strlcpy(di->bus_info, dev_name(dev->dev.parent), sizeof(di->bus_info));
+}
+
+static u32 ks8851_get_msglevel(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return ks->msg_enable;
+}
+
+static void ks8851_set_msglevel(struct net_device *dev, u32 to)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        ks->msg_enable = to;
+}
+
+static int ks8851_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return mii_ethtool_gset(&ks->mii, cmd);
+}
+
+static int ks8851_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return mii_ethtool_sset(&ks->mii, cmd);
+}
+
+static u32 ks8851_get_link(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return mii_link_ok(&ks->mii);
+}
+
+static int ks8851_nway_reset(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return mii_nway_restart(&ks->mii);
+}
+
+static const struct ethtool_ops ks8851_ethtool_ops = {
+        .get_drvinfo    = ks8851_get_drvinfo,
+        .get_msglevel   = ks8851_get_msglevel,
+        .set_msglevel   = ks8851_set_msglevel,
+        .get_settings   = ks8851_get_settings,
+        .set_settings   = ks8851_set_settings,
+        .get_link       = ks8851_get_link,
+        .nway_reset     = ks8851_nway_reset,
+};
+
+/* MII interface controls */
+
+/**
+ * ks8851_phy_reg - convert MII register into a KS8851 register
+ * @reg: MII register number.
+ *
+ * Return the KS8851 register number for the corresponding MII PHY register
+ * if possible. Return zero if the MII register has no direct mapping to the
+ * KS8851 register set.
+ */
+static int ks8851_phy_reg(int reg)
+{
+        switch (reg) {
+        case MII_BMCR:
+                return KS_P1MBCR;
+        case MII_BMSR:
+                return KS_P1MBSR;
+        case MII_PHYSID1:
+                return KS_PHY1ILR;
+        case MII_PHYSID2:
+                return KS_PHY1IHR;
+        case MII_ADVERTISE:
+                return KS_P1ANAR;
+        case MII_LPA:
+                return KS_P1ANLPR;
+        }
+
+        return 0x0;
+}
+
+/**
+ * ks8851_phy_read - MII interface PHY register read.
+ * @dev: The network device the PHY is on.
+ * @phy_addr: Address of PHY (ignored as we only have one)
+ * @reg: The register to read.
+ *
+ * This call reads data from the PHY register specified in @reg. Since the
+ * device does not support all the MII registers, the non-existant values
+ * are always returned as zero.
+ *
+ * We return zero for unsupported registers as the MII code does not check
+ * the value returned for any error status, and simply returns it to the
+ * caller. The mii-tool that the driver was tested with takes any -ve error
+ * as real PHY capabilities, thus displaying incorrect data to the user.
+ */
+static int ks8851_phy_read(struct net_device *dev, int phy_addr, int reg)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        int ksreg;
+        int result;
+
+        ksreg = ks8851_phy_reg(reg);
+        if (!ksreg)
+                return 0x0;     /* no error return allowed, so use zero */
+
+        mutex_lock(&ks->lock);
+        result = ks8851_rdreg16(ks, ksreg);
+        mutex_unlock(&ks->lock);
+
+        return result;
+}
+
+static void ks8851_phy_write(struct net_device *dev,
+                             int phy, int reg, int value)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        int ksreg;
+
+        ksreg = ks8851_phy_reg(reg);
+        if (ksreg) {
+                mutex_lock(&ks->lock);
+                ks8851_wrreg16(ks, ksreg, value);
+                mutex_unlock(&ks->lock);
+        }
+}
+
+/**
+ * ks8851_read_selftest - read the selftest memory info.
+ * @ks: The device state
+ *
+ * Read and check the TX/RX memory selftest information.
+ */
+static int ks8851_read_selftest(struct ks8851_net *ks)
+{
+        unsigned both_done = MBIR_TXMBF | MBIR_RXMBF;
+        int ret = 0;
+        unsigned rd;
+
+        rd = ks8851_rdreg16(ks, KS_MBIR);
+
+        if ((rd & both_done) != both_done) {
+                ks_warn(ks, "Memory selftest not finished\n");
+                return 0;
+        }
+
+        if (rd & MBIR_TXMBFA) {
+                ks_err(ks, "TX memory selftest fail\n");
+                ret |= 1;
+        }
+
+        if (rd & MBIR_RXMBFA) {
+                ks_err(ks, "RX memory selftest fail\n");
+                ret |= 2;
+        }
+
+        return 0;
+}
+
+/* driver bus management functions */
+
+static int __devinit ks8851_probe(struct spi_device *spi)
+{
+        struct net_device *ndev;
+        struct ks8851_net *ks;
+        int ret;
+
+        ndev = alloc_etherdev(sizeof(struct ks8851_net));
+        if (!ndev) {
+                dev_err(&spi->dev, "failed to alloc ethernet device\n");
+                return -ENOMEM;
+        }
+
+        spi->bits_per_word = 8;
+
+        ks = netdev_priv(ndev);
+
+        ks->netdev = ndev;
+        ks->spidev = spi;
+        ks->tx_space = 6144;
+
+        mutex_init(&ks->lock);
+        spin_lock_init(&ks->statelock);
+
+        INIT_WORK(&ks->tx_work, ks8851_tx_work);
+        INIT_WORK(&ks->irq_work, ks8851_irq_work);
+        INIT_WORK(&ks->rxctrl_work, ks8851_rxctrl_work);
+
+        /* initialise pre-made spi transfer messages */
+
+        spi_message_init(&ks->spi_msg1);
+        spi_message_add_tail(&ks->spi_xfer1, &ks->spi_msg1);
+
+        spi_message_init(&ks->spi_msg2);
+        spi_message_add_tail(&ks->spi_xfer2[0], &ks->spi_msg2);
+        spi_message_add_tail(&ks->spi_xfer2[1], &ks->spi_msg2);
+
+        /* setup mii state */
+        ks->mii.dev             = ndev;
+        ks->mii.phy_id          = 1,
+        ks->mii.phy_id_mask     = 1;
+        ks->mii.reg_num_mask    = 0xf;
+        ks->mii.mdio_read       = ks8851_phy_read;
+        ks->mii.mdio_write      = ks8851_phy_write;
+
+        dev_info(&spi->dev, "message enable is %d\n", msg_enable);
+
+        /* set the default message enable */
+        ks->msg_enable = netif_msg_init(msg_enable, (NETIF_MSG_DRV |
+                                                     NETIF_MSG_PROBE |
+                                                     NETIF_MSG_LINK));
+
+        skb_queue_head_init(&ks->txq);
+
+        SET_ETHTOOL_OPS(ndev, &ks8851_ethtool_ops);
+        SET_NETDEV_DEV(ndev, &spi->dev);
+
+        dev_set_drvdata(&spi->dev, ks);
+
+        ndev->if_port = IF_PORT_100BASET;
+        ndev->netdev_ops = &ks8851_netdev_ops;
+        ndev->irq = spi->irq;
+
+        /* simple check for a valid chip being connected to the bus */
+
+        if ((ks8851_rdreg16(ks, KS_CIDER) & ~CIDER_REV_MASK) != CIDER_ID) {
+                dev_err(&spi->dev, "failed to read device ID\n");
+                ret = -ENODEV;
+                goto err_id;
+        }
+
+        ks8851_read_selftest(ks);
+        ks8851_init_mac(ks);
+
+        ret = request_irq(spi->irq, ks8851_irq, IRQF_TRIGGER_LOW,
+                          ndev->name, ks);
+        if (ret < 0) {
+                dev_err(&spi->dev, "failed to get irq\n");
+                goto err_irq;
+        }
+
+        ret = register_netdev(ndev);
+        if (ret) {
+                dev_err(&spi->dev, "failed to register network device\n");
+                goto err_netdev;
+        }
+
+        dev_info(&spi->dev, "revision %d, MAC %pM, IRQ %d\n",
+                 CIDER_REV_GET(ks8851_rdreg16(ks, KS_CIDER)),
+                 ndev->dev_addr, ndev->irq);
+
+        return 0;
+
+
+err_netdev:
+        free_irq(ndev->irq, ndev);
+
+err_id:
+err_irq:
+        free_netdev(ndev);
+        return ret;
+}
+
+static int __devexit ks8851_remove(struct spi_device *spi)
+{
+        struct ks8851_net *priv = dev_get_drvdata(&spi->dev);
+
+        if (netif_msg_drv(priv))
+                dev_info(&spi->dev, "remove");
+
+        unregister_netdev(priv->netdev);
+        free_irq(spi->irq, priv);
+        free_netdev(priv->netdev);
+
+        return 0;
+}
+
+static struct spi_driver ks8851_driver = {
+        .driver = {
+                .name = "ks8851",
+                .owner = THIS_MODULE,
+        },
+        .probe = ks8851_probe,
+        .remove = __devexit_p(ks8851_remove),
+};
+
+static int __init ks8851_init(void)
+{
+        return spi_register_driver(&ks8851_driver);
+}
+
+static void __exit ks8851_exit(void)
+{
+        spi_unregister_driver(&ks8851_driver);
+}
+
+module_init(ks8851_init);
+module_exit(ks8851_exit);
+
+MODULE_DESCRIPTION("KS8851 Network driver");
+MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
+MODULE_LICENSE("GPL");
+
+module_param_named(message, msg_enable, int, 0);
+MODULE_PARM_DESC(message, "Message verbosity level (0=none, 31=all)");
diff --git a/drivers/net/ks8851.h b/drivers/net/ks8851.h
new file mode 100644
index 000000000000..85abe147afbf
--- /dev/null
+++ b/drivers/net/ks8851.h
@@ -0,0 +1,296 @@
+/* drivers/net/ks8851.h
+ *
+ * Copyright 2009 Simtec Electronics
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * KS8851 register definitions
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+#define KS_CCR                                  0x08
+#define CCR_EEPROM                              (1 << 9)
+#define CCR_SPI                                 (1 << 8)
+#define CCR_32PIN                               (1 << 0)
+
+/* MAC address registers */
+#define KS_MARL                                 0x10
+#define KS_MARM                                 0x12
+#define KS_MARH                                 0x14
+
+#define KS_OBCR                                 0x20
+#define OBCR_ODS_16mA                           (1 << 6)
+
+#define KS_EEPCR                                0x22
+#define EEPCR_EESA                              (1 << 4)
+#define EEPCR_EESB                              (1 << 3)
+#define EEPCR_EEDO                              (1 << 2)
+#define EEPCR_EESCK                             (1 << 1)
+#define EEPCR_EECS                              (1 << 0)
+
+#define KS_MBIR                                 0x24
+#define MBIR_TXMBF                              (1 << 12)
+#define MBIR_TXMBFA                             (1 << 11)
+#define MBIR_RXMBF                              (1 << 4)
+#define MBIR_RXMBFA                             (1 << 3)
+
+#define KS_GRR                                  0x26
+#define GRR_QMU                                 (1 << 1)
+#define GRR_GSR                                 (1 << 0)
+
+#define KS_WFCR                                 0x2A
+#define WFCR_MPRXE                              (1 << 7)
+#define WFCR_WF3E                               (1 << 3)
+#define WFCR_WF2E                               (1 << 2)
+#define WFCR_WF1E                               (1 << 1)
+#define WFCR_WF0E                               (1 << 0)
+
+#define KS_WF0CRC0                              0x30
+#define KS_WF0CRC1                              0x32
+#define KS_WF0BM0                               0x34
+#define KS_WF0BM1                               0x36
+#define KS_WF0BM2                               0x38
+#define KS_WF0BM3                               0x3A
+
+#define KS_WF1CRC0                              0x40
+#define KS_WF1CRC1                              0x42
+#define KS_WF1BM0                               0x44
+#define KS_WF1BM1                               0x46
+#define KS_WF1BM2                               0x48
+#define KS_WF1BM3                               0x4A
+
+#define KS_WF2CRC0                              0x50
+#define KS_WF2CRC1                              0x52
+#define KS_WF2BM0                               0x54
+#define KS_WF2BM1                               0x56
+#define KS_WF2BM2                               0x58
+#define KS_WF2BM3                               0x5A
+
+#define KS_WF3CRC0                              0x60
+#define KS_WF3CRC1                              0x62
+#define KS_WF3BM0                               0x64
+#define KS_WF3BM1                               0x66
+#define KS_WF3BM2                               0x68
+#define KS_WF3BM3                               0x6A
+
+#define KS_TXCR                                 0x70
+#define TXCR_TCGICMP                            (1 << 8)
+#define TXCR_TCGUDP                             (1 << 7)
+#define TXCR_TCGTCP                             (1 << 6)
+#define TXCR_TCGIP                              (1 << 5)
+#define TXCR_FTXQ                               (1 << 4)
+#define TXCR_TXFCE                              (1 << 3)
+#define TXCR_TXPE                               (1 << 2)
+#define TXCR_TXCRC                              (1 << 1)
+#define TXCR_TXE                                (1 << 0)
+
+#define KS_TXSR                                 0x72
+#define TXSR_TXLC                               (1 << 13)
+#define TXSR_TXMC                               (1 << 12)
+#define TXSR_TXFID_MASK                         (0x3f << 0)
+#define TXSR_TXFID_SHIFT                        (0)
+#define TXSR_TXFID_GET(_v)                      (((_v) >> 0) & 0x3f)
+
+#define KS_RXCR1                                0x74
+#define RXCR1_FRXQ                              (1 << 15)
+#define RXCR1_RXUDPFCC                          (1 << 14)
+#define RXCR1_RXTCPFCC                          (1 << 13)
+#define RXCR1_RXIPFCC                           (1 << 12)
+#define RXCR1_RXPAFMA                           (1 << 11)
+#define RXCR1_RXFCE                             (1 << 10)
+#define RXCR1_RXEFE                             (1 << 9)
+#define RXCR1_RXMAFMA                           (1 << 8)
+#define RXCR1_RXBE                              (1 << 7)
+#define RXCR1_RXME                              (1 << 6)
+#define RXCR1_RXUE                              (1 << 5)
+#define RXCR1_RXAE                              (1 << 4)
+#define RXCR1_RXINVF                            (1 << 1)
+#define RXCR1_RXE                               (1 << 0)
+
+#define KS_RXCR2                                0x76
+#define RXCR2_SRDBL_MASK                        (0x7 << 5)
+#define RXCR2_SRDBL_SHIFT                       (5)
+#define RXCR2_SRDBL_4B                          (0x0 << 5)
+#define RXCR2_SRDBL_8B                          (0x1 << 5)
+#define RXCR2_SRDBL_16B                         (0x2 << 5)
+#define RXCR2_SRDBL_32B                         (0x3 << 5)
+#define RXCR2_SRDBL_FRAME                       (0x4 << 5)
+#define RXCR2_IUFFP                             (1 << 4)
+#define RXCR2_RXIUFCEZ                          (1 << 3)
+#define RXCR2_UDPLFE                            (1 << 2)
+#define RXCR2_RXICMPFCC                         (1 << 1)
+#define RXCR2_RXSAF                             (1 << 0)
+
+#define KS_TXMIR                                0x78
+
+#define KS_RXFHSR                               0x7C
+#define RXFSHR_RXFV                             (1 << 15)
+#define RXFSHR_RXICMPFCS                        (1 << 13)
+#define RXFSHR_RXIPFCS                          (1 << 12)
+#define RXFSHR_RXTCPFCS                         (1 << 11)
+#define RXFSHR_RXUDPFCS                         (1 << 10)
+#define RXFSHR_RXBF                             (1 << 7)
+#define RXFSHR_RXMF                             (1 << 6)
+#define RXFSHR_RXUF                             (1 << 5)
+#define RXFSHR_RXMR                             (1 << 4)
+#define RXFSHR_RXFT                             (1 << 3)
+#define RXFSHR_RXFTL                            (1 << 2)
+#define RXFSHR_RXRF                             (1 << 1)
+#define RXFSHR_RXCE                             (1 << 0)
+
+#define KS_RXFHBCR                              0x7E
+#define KS_TXQCR                                0x80
+#define TXQCR_AETFE                             (1 << 2)
+#define TXQCR_TXQMAM                            (1 << 1)
+#define TXQCR_METFE                             (1 << 0)
+
+#define KS_RXQCR                                0x82
+#define RXQCR_RXDTTS                            (1 << 12)
+#define RXQCR_RXDBCTS                           (1 << 11)
+#define RXQCR_RXFCTS                            (1 << 10)
+#define RXQCR_RXIPHTOE                          (1 << 9)
+#define RXQCR_RXDTTE                            (1 << 7)
+#define RXQCR_RXDBCTE                           (1 << 6)
+#define RXQCR_RXFCTE                            (1 << 5)
+#define RXQCR_ADRFE                             (1 << 4)
+#define RXQCR_SDA                               (1 << 3)
+#define RXQCR_RRXEF                             (1 << 0)
+
+#define KS_TXFDPR                               0x84
+#define TXFDPR_TXFPAI                           (1 << 14)
+#define TXFDPR_TXFP_MASK                        (0x7ff << 0)
+#define TXFDPR_TXFP_SHIFT                       (0)
+
+#define KS_RXFDPR                               0x86
+#define RXFDPR_RXFPAI                           (1 << 14)
+
+#define KS_RXDTTR                               0x8C
+#define KS_RXDBCTR                              0x8E
+
+#define KS_IER                                  0x90
+#define KS_ISR                                  0x92
+#define IRQ_LCI                                 (1 << 15)
+#define IRQ_TXI                                 (1 << 14)
+#define IRQ_RXI                                 (1 << 13)
+#define IRQ_RXOI                                (1 << 11)
+#define IRQ_TXPSI                               (1 << 9)
+#define IRQ_RXPSI                               (1 << 8)
+#define IRQ_TXSAI                               (1 << 6)
+#define IRQ_RXWFDI                              (1 << 5)
+#define IRQ_RXMPDI                              (1 << 4)
+#define IRQ_LDI                                 (1 << 3)
+#define IRQ_EDI                                 (1 << 2)
+#define IRQ_SPIBEI                              (1 << 1)
+#define IRQ_DEDI                                (1 << 0)
+
+#define KS_RXFCTR                               0x9C
+#define KS_RXFC                                 0x9D
+#define RXFCTR_RXFC_MASK                        (0xff << 8)
+#define RXFCTR_RXFC_SHIFT                       (8)
+#define RXFCTR_RXFC_GET(_v)                     (((_v) >> 8) & 0xff)
+#define RXFCTR_RXFCT_MASK                       (0xff << 0)
+#define RXFCTR_RXFCT_SHIFT                      (0)
+
+#define KS_TXNTFSR                              0x9E
+
+#define KS_MAHTR0                               0xA0
+#define KS_MAHTR1                               0xA2
+#define KS_MAHTR2                               0xA4
+#define KS_MAHTR3                               0xA6
+
+#define KS_FCLWR                                0xB0
+#define KS_FCHWR                                0xB2
+#define KS_FCOWR                                0xB4
+
+#define KS_CIDER                                0xC0
+#define CIDER_ID                                0x8870
+#define CIDER_REV_MASK                          (0x7 << 1)
+#define CIDER_REV_SHIFT                         (1)
+#define CIDER_REV_GET(_v)                       (((_v) >> 1) & 0x7)
+
+#define KS_CGCR                                 0xC6
+
+#define KS_IACR                                 0xC8
+#define IACR_RDEN                               (1 << 12)
+#define IACR_TSEL_MASK                          (0x3 << 10)
+#define IACR_TSEL_SHIFT                         (10)
+#define IACR_TSEL_MIB                           (0x3 << 10)
+#define IACR_ADDR_MASK                          (0x1f << 0)
+#define IACR_ADDR_SHIFT                         (0)
+
+#define KS_IADLR                                0xD0
+#define KS_IAHDR                                0xD2
+
+#define KS_PMECR                                0xD4
+#define PMECR_PME_DELAY                         (1 << 14)
+#define PMECR_PME_POL                           (1 << 12)
+#define PMECR_WOL_WAKEUP                        (1 << 11)
+#define PMECR_WOL_MAGICPKT                      (1 << 10)
+#define PMECR_WOL_LINKUP                        (1 << 9)
+#define PMECR_WOL_ENERGY                        (1 << 8)
+#define PMECR_AUTO_WAKE_EN                      (1 << 7)
+#define PMECR_WAKEUP_NORMAL                     (1 << 6)
+#define PMECR_WKEVT_MASK                        (0xf << 2)
+#define PMECR_WKEVT_SHIFT                       (2)
+#define PMECR_WKEVT_GET(_v)                     (((_v) >> 2) & 0xf)
+#define PMECR_WKEVT_ENERGY                      (0x1 << 2)
+#define PMECR_WKEVT_LINK                        (0x2 << 2)
+#define PMECR_WKEVT_MAGICPKT                    (0x4 << 2)
+#define PMECR_WKEVT_FRAME                       (0x8 << 2)
+#define PMECR_PM_MASK                           (0x3 << 0)
+#define PMECR_PM_SHIFT                          (0)
+#define PMECR_PM_NORMAL                         (0x0 << 0)
+#define PMECR_PM_ENERGY                         (0x1 << 0)
+#define PMECR_PM_SOFTDOWN                       (0x2 << 0)
+#define PMECR_PM_POWERSAVE                      (0x3 << 0)
+
+/* Standard MII PHY data */
+#define KS_P1MBCR                               0xE4
+#define KS_P1MBSR                               0xE6
+#define KS_PHY1ILR                              0xE8
+#define KS_PHY1IHR                              0xEA
+#define KS_P1ANAR                               0xEC
+#define KS_P1ANLPR                              0xEE
+
+#define KS_P1SCLMD                              0xF4
+#define P1SCLMD_LEDOFF                          (1 << 15)
+#define P1SCLMD_TXIDS                           (1 << 14)
+#define P1SCLMD_RESTARTAN                       (1 << 13)
+#define P1SCLMD_DISAUTOMDIX                     (1 << 10)
+#define P1SCLMD_FORCEMDIX                       (1 << 9)
+#define P1SCLMD_AUTONEGEN                       (1 << 7)
+#define P1SCLMD_FORCE100                        (1 << 6)
+#define P1SCLMD_FORCEFDX                        (1 << 5)
+#define P1SCLMD_ADV_FLOW                        (1 << 4)
+#define P1SCLMD_ADV_100BT_FDX                   (1 << 3)
+#define P1SCLMD_ADV_100BT_HDX                   (1 << 2)
+#define P1SCLMD_ADV_10BT_FDX                    (1 << 1)
+#define P1SCLMD_ADV_10BT_HDX                    (1 << 0)
+
+#define KS_P1CR                                 0xF6
+#define P1CR_HP_MDIX                            (1 << 15)
+#define P1CR_REV_POL                            (1 << 13)
+#define P1CR_OP_100M                            (1 << 10)
+#define P1CR_OP_FDX                             (1 << 9)
+#define P1CR_OP_MDI                             (1 << 7)
+#define P1CR_AN_DONE                            (1 << 6)
+#define P1CR_LINK_GOOD                          (1 << 5)
+#define P1CR_PNTR_FLOW                          (1 << 4)
+#define P1CR_PNTR_100BT_FDX                     (1 << 3)
+#define P1CR_PNTR_100BT_HDX                     (1 << 2)
+#define P1CR_PNTR_10BT_FDX                      (1 << 1)
+#define P1CR_PNTR_10BT_HDX                      (1 << 0)
+
+/* TX Frame control */
+
+#define TXFR_TXIC                               (1 << 15)
+#define TXFR_TXFID_MASK                         (0x3f << 0)
+#define TXFR_TXFID_SHIFT                        (0)
+
+/* SPI frame opcodes */
+#define KS_SPIOP_RD                             (0x00)
+#define KS_SPIOP_WR                             (0x40)
+#define KS_SPIOP_RXFIFO                         (0x80)
+#define KS_SPIOP_TXFIFO                         (0xC0)
diff --git a/drivers/net/macsonic.c b/drivers/net/macsonic.c
index acd143da161d..61eabcac734c 100644
--- a/drivers/net/macsonic.c
+++ b/drivers/net/macsonic.c
@@ -179,7 +179,7 @@ static const struct net_device_ops macsonic_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
 };
 
-static int __init macsonic_init(struct net_device *dev)
+static int __devinit macsonic_init(struct net_device *dev)
 {
         struct sonic_local* lp = netdev_priv(dev);
 
@@ -223,7 +223,7 @@ static int __init macsonic_init(struct net_device *dev)
         return 0;
 }
 
-static int __init mac_onboard_sonic_ethernet_addr(struct net_device *dev)
+static int __devinit mac_onboard_sonic_ethernet_addr(struct net_device *dev)
 {
         struct sonic_local *lp = netdev_priv(dev);
         const int prom_addr = ONBOARD_SONIC_PROM_BASE;
@@ -288,7 +288,7 @@ static int __init mac_onboard_sonic_ethernet_addr(struct net_device *dev)
         } else return 0;
 }
 
-static int __init mac_onboard_sonic_probe(struct net_device *dev)
+static int __devinit mac_onboard_sonic_probe(struct net_device *dev)
 {
         /* Bwahahaha */
         static int once_is_more_than_enough;
@@ -409,7 +409,7 @@ static int __init mac_onboard_sonic_probe(struct net_device *dev)
         return macsonic_init(dev);
 }
 
-static int __init mac_nubus_sonic_ethernet_addr(struct net_device *dev,
+static int __devinit mac_nubus_sonic_ethernet_addr(struct net_device *dev,
                                                 unsigned long prom_addr,
                                                 int id)
 {
@@ -424,7 +424,7 @@ static int __init mac_nubus_sonic_ethernet_addr(struct net_device *dev,
         return 0;
 }
 
-static int __init macsonic_ident(struct nubus_dev *ndev)
+static int __devinit macsonic_ident(struct nubus_dev *ndev)
 {
         if (ndev->dr_hw == NUBUS_DRHW_ASANTE_LC &&
             ndev->dr_sw == NUBUS_DRSW_SONIC_LC)
@@ -449,7 +449,7 @@ static int __init macsonic_ident(struct nubus_dev *ndev)
         return -1;
 }
 
-static int __init mac_nubus_sonic_probe(struct net_device *dev)
+static int __devinit mac_nubus_sonic_probe(struct net_device *dev)
 {
         static int slots;
         struct nubus_dev* ndev = NULL;
@@ -562,7 +562,7 @@ static int __init mac_nubus_sonic_probe(struct net_device *dev)
         return macsonic_init(dev);
 }
 
-static int __init mac_sonic_probe(struct platform_device *pdev)
+static int __devinit mac_sonic_probe(struct platform_device *pdev)
 {
         struct net_device *dev;
         struct sonic_local *lp;
@@ -575,6 +575,7 @@ static int __init mac_sonic_probe(struct platform_device *pdev)
         lp = netdev_priv(dev);
         lp->device = &pdev->dev;
         SET_NETDEV_DEV(dev, &pdev->dev);
+        platform_set_drvdata(pdev, dev);
 
         /* This will catch fatal stuff like -ENOMEM as well as success */
         err = mac_onboard_sonic_probe(dev);
diff --git a/drivers/net/mlx4/en_ethtool.c b/drivers/net/mlx4/en_ethtool.c
index 091f99052c91..86467b444ac6 100644
--- a/drivers/net/mlx4/en_ethtool.c
+++ b/drivers/net/mlx4/en_ethtool.c
@@ -220,7 +220,7 @@ static int mlx4_en_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         cmd->autoneg = AUTONEG_DISABLE;
         cmd->supported = SUPPORTED_10000baseT_Full;
-        cmd->advertising = SUPPORTED_10000baseT_Full;
+        cmd->advertising = ADVERTISED_1000baseT_Full;
         if (netif_carrier_ok(dev)) {
                 cmd->speed = SPEED_10000;
                 cmd->duplex = DUPLEX_FULL;
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index e1cdba752e09..f86e05047d19 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -210,6 +210,7 @@
 #define NETXEN_CTX_SIGNATURE    0xdee0
 #define NETXEN_CTX_SIGNATURE_V2 0x0002dee0
 #define NETXEN_CTX_RESET        0xbad0
+#define NETXEN_CTX_D3_RESET     0xacc0
 #define NETXEN_RCV_PRODUCER(ringid)     (ringid)
 
 #define PHAN_PEG_RCV_INITIALIZED        0xff01
@@ -773,6 +774,8 @@ struct nx_host_tx_ring {
         u32 crb_cmd_consumer;
         u32 num_desc;
 
+        struct netdev_queue *txq;
+
         struct netxen_cmd_buffer *cmd_buf_arr;
         struct cmd_desc_type0 *desc_head;
         dma_addr_t phys_addr;
diff --git a/drivers/net/netxen/netxen_nic_ctx.c b/drivers/net/netxen/netxen_nic_ctx.c
index 4754f5cffad0..9f8ae4719e2f 100644
--- a/drivers/net/netxen/netxen_nic_ctx.c
+++ b/drivers/net/netxen/netxen_nic_ctx.c
@@ -684,10 +684,8 @@ int netxen_alloc_hw_resources(struct netxen_adapter *adapter)
                         goto err_out_free;
         } else {
                 err = netxen_init_old_ctx(adapter);
-                if (err) {
-                        netxen_free_hw_resources(adapter);
-                        return err;
-                }
+                if (err)
+                        goto err_out_free;
         }
 
         return 0;
@@ -708,15 +706,18 @@ void netxen_free_hw_resources(struct netxen_adapter *adapter)
         int port = adapter->portnum;
 
         if (adapter->fw_major >= 4) {
-                nx_fw_cmd_destroy_tx_ctx(adapter);
                 nx_fw_cmd_destroy_rx_ctx(adapter);
+                nx_fw_cmd_destroy_tx_ctx(adapter);
         } else {
                 netxen_api_lock(adapter);
                 NXWR32(adapter, CRB_CTX_SIGNATURE_REG(port),
-                                NETXEN_CTX_RESET | port);
+                                NETXEN_CTX_D3_RESET | port);
                 netxen_api_unlock(adapter);
         }
 
+        /* Allow dma queues to drain after context reset */
+        msleep(20);
+
         recv_ctx = &adapter->recv_ctx;
 
         if (recv_ctx->hwctx != NULL) {
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index ce3b89d2cbb6..b9123d445c96 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -461,13 +461,14 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter,
         i = 0;
 
         tx_ring = adapter->tx_ring;
-        netif_tx_lock_bh(adapter->netdev);
+        __netif_tx_lock_bh(tx_ring->txq);
 
         producer = tx_ring->producer;
         consumer = tx_ring->sw_consumer;
 
-        if (nr_desc >= find_diff_among(producer, consumer, tx_ring->num_desc)) {
-                netif_tx_unlock_bh(adapter->netdev);
+        if (nr_desc >= netxen_tx_avail(tx_ring)) {
+                netif_tx_stop_queue(tx_ring->txq);
+                __netif_tx_unlock_bh(tx_ring->txq);
                 return -EBUSY;
         }
 
@@ -490,7 +491,7 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter,
 
         netxen_nic_update_cmd_producer(adapter, tx_ring);
 
-        netif_tx_unlock_bh(adapter->netdev);
+        __netif_tx_unlock_bh(tx_ring->txq);
 
         return 0;
 }
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index b899bd51fcd8..7acf204e38c9 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,6 +184,13 @@ void netxen_free_sw_resources(struct netxen_adapter *adapter)
         kfree(recv_ctx->rds_rings);
 
 skip_rds:
+        if (recv_ctx->sds_rings == NULL)
+                goto skip_sds;
+
+        for(ring = 0; ring < adapter->max_sds_rings; ring++)
+                recv_ctx->sds_rings[ring].consumer = 0;
+
+skip_sds:
         if (adapter->tx_ring == NULL)
                 return;
 
@@ -214,6 +221,7 @@ int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
         adapter->tx_ring = tx_ring;
 
         tx_ring->num_desc = adapter->num_txd;
+        tx_ring->txq = netdev_get_tx_queue(netdev, 0);
 
         cmd_buf_arr = vmalloc(TX_BUFF_RINGSIZE(tx_ring));
         if (cmd_buf_arr == NULL) {
@@ -1400,10 +1408,10 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter)
                 smp_mb();
 
                 if (netif_queue_stopped(netdev) && netif_carrier_ok(netdev)) {
-                        netif_tx_lock(netdev);
+                        __netif_tx_lock(tx_ring->txq, smp_processor_id());
                         if (netxen_tx_avail(tx_ring) > TX_STOP_THRESH)
                                 netif_wake_queue(netdev);
-                        netif_tx_unlock(netdev);
+                        __netif_tx_unlock(tx_ring->txq);
                 }
         }
         /*
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 27539ddf94c4..637ac8b89bac 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -215,9 +215,9 @@ netxen_napi_disable(struct netxen_adapter *adapter)
 
         for (ring = 0; ring < adapter->max_sds_rings; ring++) {
                 sds_ring = &recv_ctx->sds_rings[ring];
-                napi_disable(&sds_ring->napi);
                 netxen_nic_disable_int(sds_ring);
-                synchronize_irq(sds_ring->irq);
+                napi_synchronize(&sds_ring->napi);
+                napi_disable(&sds_ring->napi);
         }
 }
 
@@ -833,11 +833,11 @@ netxen_nic_up(struct netxen_adapter *adapter, struct net_device *netdev)
 
         adapter->ahw.linkup = 0;
 
-        netxen_napi_enable(adapter);
-
         if (adapter->max_sds_rings > 1)
                 netxen_config_rss(adapter, 1);
 
+        netxen_napi_enable(adapter);
+
         if (adapter->capabilities & NX_FW_CAPABILITY_LINK_NOTIFICATION)
                 netxen_linkevent_request(adapter, 1);
         else
@@ -851,8 +851,9 @@ netxen_nic_up(struct netxen_adapter *adapter, struct net_device *netdev)
 static void
 netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
 {
+        spin_lock(&adapter->tx_clean_lock);
         netif_carrier_off(netdev);
-        netif_stop_queue(netdev);
+        netif_tx_disable(netdev);
 
         if (adapter->stop_port)
                 adapter->stop_port(adapter);
@@ -863,9 +864,10 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
         netxen_napi_disable(adapter);
 
         netxen_release_tx_buffers(adapter);
+        spin_unlock(&adapter->tx_clean_lock);
 
-        FLUSH_SCHEDULED_WORK();
         del_timer_sync(&adapter->watchdog_timer);
+        FLUSH_SCHEDULED_WORK();
 }
 
 
@@ -943,8 +945,8 @@ err_out_free_sw:
 static void
 netxen_nic_detach(struct netxen_adapter *adapter)
 {
-        netxen_release_rx_buffers(adapter);
         netxen_free_hw_resources(adapter);
+        netxen_release_rx_buffers(adapter);
         netxen_nic_free_irq(adapter);
         netxen_free_sw_resources(adapter);
 
@@ -1533,10 +1535,12 @@ static int netxen_nic_check_temp(struct netxen_adapter *adapter)
                 printk(KERN_ALERT
                        "%s: Device temperature %d degrees C exceeds"
                        " maximum allowed. Hardware has been shut down.\n",
-                       netxen_nic_driver_name, temp_val);
+                       netdev->name, temp_val);
+
+                netif_device_detach(netdev);
+                netxen_nic_down(adapter, netdev);
+                netxen_nic_detach(adapter);
 
-                netif_carrier_off(netdev);
-                netif_stop_queue(netdev);
                 rv = 1;
         } else if (temp_state == NX_TEMP_WARN) {
                 if (adapter->temp == NX_TEMP_NORMAL) {
@@ -1544,13 +1548,13 @@ static int netxen_nic_check_temp(struct netxen_adapter *adapter)
                                "%s: Device temperature %d degrees C "
                                "exceeds operating range."
                                " Immediate action needed.\n",
-                               netxen_nic_driver_name, temp_val);
+                               netdev->name, temp_val);
                 }
         } else {
                 if (adapter->temp == NX_TEMP_WARN) {
                         printk(KERN_INFO
                                "%s: Device temperature is now %d degrees C"
-                               " in normal range.\n", netxen_nic_driver_name,
+                               " in normal range.\n", netdev->name,
                                temp_val);
                 }
         }
@@ -1623,7 +1627,7 @@ void netxen_watchdog_task(struct work_struct *work)
         struct netxen_adapter *adapter =
                 container_of(work, struct netxen_adapter, watchdog_task);
 
-        if ((adapter->portnum  == 0) && netxen_nic_check_temp(adapter))
+        if (netxen_nic_check_temp(adapter))
                 return;
 
         if (!adapter->has_link_events)
@@ -1645,6 +1649,9 @@ static void netxen_tx_timeout_task(struct work_struct *work)
         struct netxen_adapter *adapter =
                 container_of(work, struct netxen_adapter, tx_timeout_task);
 
+        if (!netif_running(adapter->netdev))
+                return;
+
         printk(KERN_ERR "%s %s: transmit timeout, resetting.\n",
                netxen_nic_driver_name, adapter->netdev->name);
 
@@ -1757,7 +1764,8 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
 
         if ((work_done < budget) && tx_complete) {
                 napi_complete(&sds_ring->napi);
-                netxen_nic_enable_int(sds_ring);
+                if (netif_running(adapter->netdev))
+                        netxen_nic_enable_int(sds_ring);
         }
 
         return work_done;
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index ec7cf5ac4f05..690b9c76d34e 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -156,6 +156,7 @@ static struct net_device_stats *el3_get_stats(struct net_device *dev);
 static int el3_rx(struct net_device *dev);
 static int el3_close(struct net_device *dev);
 static void el3_tx_timeout(struct net_device *dev);
+static void set_rx_mode(struct net_device *dev);
 static void set_multicast_list(struct net_device *dev);
 static const struct ethtool_ops netdev_ethtool_ops;
 
@@ -488,8 +489,7 @@ static void tc589_reset(struct net_device *dev)
     /* Switch to register set 1 for normal use. */
     EL3WINDOW(1);
 
-    /* Accept b-cast and phys addr only. */
-    outw(SetRxFilter | RxStation | RxBroadcast, ioaddr + EL3_CMD);
+    set_rx_mode(dev);
     outw(StatsEnable, ioaddr + EL3_CMD); /* Turn on statistics. */
     outw(RxEnable, ioaddr + EL3_CMD); /* Enable the receiver. */
     outw(TxEnable, ioaddr + EL3_CMD); /* Enable transmitter. */
@@ -700,7 +700,7 @@ static irqreturn_t el3_interrupt(int irq, void *dev_id)
                 if (fifo_diag & 0x2000) {
                     /* Rx underrun */
                     tc589_wait_for_completion(dev, RxReset);
-                    set_multicast_list(dev);
+                    set_rx_mode(dev);
                     outw(RxEnable, ioaddr + EL3_CMD);
                 }
                 outw(AckIntr | AdapterFailure, ioaddr + EL3_CMD);
@@ -905,14 +905,11 @@ static int el3_rx(struct net_device *dev)
     return 0;
 }
 
-static void set_multicast_list(struct net_device *dev)
+static void set_rx_mode(struct net_device *dev)
 {
-    struct el3_private *lp = netdev_priv(dev);
-    struct pcmcia_device *link = lp->p_dev;
     unsigned int ioaddr = dev->base_addr;
     u16 opts = SetRxFilter | RxStation | RxBroadcast;
 
-    if (!pcmcia_dev_present(link)) return;
     if (dev->flags & IFF_PROMISC)
         opts |= RxMulticast | RxProm;
     else if (dev->mc_count || (dev->flags & IFF_ALLMULTI))
@@ -920,6 +917,16 @@ static void set_multicast_list(struct net_device *dev)
     outw(opts, ioaddr + EL3_CMD);
 }
 
+static void set_multicast_list(struct net_device *dev)
+{
+        struct el3_private *priv = netdev_priv(dev);
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        set_rx_mode(dev);
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
 static int el3_close(struct net_device *dev)
 {
     struct el3_private *lp = netdev_priv(dev);
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 33984b737233..22cdd451fb82 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -30,6 +30,7 @@
 
 #ifdef CONFIG_OF_GPIO
 #include <linux/of_gpio.h>
+#include <linux/of_mdio.h>
 #include <linux/of_platform.h>
 #endif
 
@@ -81,13 +82,12 @@ static struct mdiobb_ops mdio_gpio_ops = {
         .get_mdio_data = mdio_get,
 };
 
-static int __devinit mdio_gpio_bus_init(struct device *dev,
+static struct mii_bus * __devinit mdio_gpio_bus_init(struct device *dev,
                                         struct mdio_gpio_platform_data *pdata,
                                         int bus_id)
 {
         struct mii_bus *new_bus;
         struct mdio_gpio_info *bitbang;
-        int ret = -ENOMEM;
         int i;
 
         bitbang = kzalloc(sizeof(*bitbang), GFP_KERNEL);
@@ -104,8 +104,6 @@ static int __devinit mdio_gpio_bus_init(struct device *dev,
 
         new_bus->name = "GPIO Bitbanged MDIO",
 
-        ret = -ENODEV;
-
         new_bus->phy_mask = pdata->phy_mask;
         new_bus->irq = pdata->irqs;
         new_bus->parent = dev;
@@ -129,15 +127,8 @@ static int __devinit mdio_gpio_bus_init(struct device *dev,
 
         dev_set_drvdata(dev, new_bus);
 
-        ret = mdiobus_register(new_bus);
-        if (ret)
-                goto out_free_all;
-
-        return 0;
+        return new_bus;
 
-out_free_all:
-        dev_set_drvdata(dev, NULL);
-        gpio_free(bitbang->mdio);
 out_free_mdc:
         gpio_free(bitbang->mdc);
 out_free_bus:
@@ -145,30 +136,47 @@ out_free_bus:
 out_free_bitbang:
         kfree(bitbang);
 out:
-        return ret;
+        return NULL;
 }
 
-static void __devexit mdio_gpio_bus_destroy(struct device *dev)
+static void __devinit mdio_gpio_bus_deinit(struct device *dev)
 {
         struct mii_bus *bus = dev_get_drvdata(dev);
         struct mdio_gpio_info *bitbang = bus->priv;
 
-        mdiobus_unregister(bus);
-        free_mdio_bitbang(bus);
         dev_set_drvdata(dev, NULL);
-        gpio_free(bitbang->mdc);
         gpio_free(bitbang->mdio);
+        gpio_free(bitbang->mdc);
+        free_mdio_bitbang(bus);
         kfree(bitbang);
 }
 
+static void __devexit mdio_gpio_bus_destroy(struct device *dev)
+{
+        struct mii_bus *bus = dev_get_drvdata(dev);
+
+        mdiobus_unregister(bus);
+        mdio_gpio_bus_deinit(dev);
+}
+
 static int __devinit mdio_gpio_probe(struct platform_device *pdev)
 {
         struct mdio_gpio_platform_data *pdata = pdev->dev.platform_data;
+        struct mii_bus *new_bus;
+        int ret;
 
         if (!pdata)
                 return -ENODEV;
 
-        return mdio_gpio_bus_init(&pdev->dev, pdata, pdev->id);
+        new_bus = mdio_gpio_bus_init(&pdev->dev, pdata, pdev->id);
+        if (!new_bus)
+                return -ENODEV;
+
+        ret = mdiobus_register(new_bus);
+        if (ret)
+                mdio_gpio_bus_deinit(&pdev->dev);
+
+        return ret;
 }
 
 static int __devexit mdio_gpio_remove(struct platform_device *pdev)
@@ -179,29 +187,12 @@ static int __devexit mdio_gpio_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_OF_GPIO
-static void __devinit add_phy(struct mdio_gpio_platform_data *pdata,
-                              struct device_node *np)
-{
-        const u32 *data;
-        int len, id, irq;
-
-        data = of_get_property(np, "reg", &len);
-        if (!data || len != 4)
-                return;
-
-        id = *data;
-        pdata->phy_mask &= ~(1 << id);
-
-        irq = of_irq_to_resource(np, 0, NULL);
-        if (irq)
-                pdata->irqs[id] = irq;
-}
 
 static int __devinit mdio_ofgpio_probe(struct of_device *ofdev,
                                         const struct of_device_id *match)
 {
-        struct device_node *np = NULL;
         struct mdio_gpio_platform_data *pdata;
+        struct mii_bus *new_bus;
         int ret;
 
         pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
@@ -215,14 +206,18 @@ static int __devinit mdio_ofgpio_probe(struct of_device *ofdev,
 
         ret = of_get_gpio(ofdev->node, 1);
         if (ret < 0)
-                goto out_free;
+                goto out_free;
         pdata->mdio = ret;
 
-        while ((np = of_get_next_child(ofdev->node, np)))
-                if (!strcmp(np->type, "ethernet-phy"))
-                        add_phy(pdata, np);
+        new_bus = mdio_gpio_bus_init(&ofdev->dev, pdata, pdata->mdc);
+        if (!new_bus)
+                return -ENODEV;
 
-        return mdio_gpio_bus_init(&ofdev->dev, pdata, pdata->mdc);
+        ret = of_mdiobus_register(new_bus, ofdev->node);
+        if (ret)
+                mdio_gpio_bus_deinit(&ofdev->dev);
+
+        return ret;
 
 out_free:
         kfree(pdata);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 4b53b58d75fc..b82780d805f5 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2060,8 +2060,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 }
         }
 
-        pci_set_master(pdev);
-
         /* ioremap MMIO region */
         ioaddr = ioremap(pci_resource_start(pdev, region), R8169_REGS_SIZE);
         if (!ioaddr) {
@@ -2089,6 +2087,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         RTL_W16(IntrStatus, 0xffff);
 
+        pci_set_master(pdev);
+
         /* Identify chip attached to board */
         rtl8169_get_mac_version(tp, ioaddr);
 
@@ -3874,6 +3874,15 @@ static void rtl_shutdown(struct pci_dev *pdev)
         spin_unlock_irq(&tp->lock);
 
         if (system_state == SYSTEM_POWER_OFF) {
+                /* WoL fails with some 8168 when the receiver is disabled. */
+                if (tp->features & RTL_FEATURE_WOL) {
+                        pci_clear_master(pdev);
+
+                        RTL_W8(ChipCmd, CmdRxEnb);
+                        /* PCI commit */
+                        RTL_R8(ChipCmd);
+                }
+
                 pci_wake_from_d3(pdev, true);
                 pci_set_power_state(pdev, PCI_D3hot);
         }
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index 18821f217e19..e3156c97bb58 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -1593,6 +1593,7 @@ out:
 static struct pci_device_id sc92031_pci_device_id_table[] __devinitdata = {
         { PCI_DEVICE(PCI_VENDOR_ID_SILAN, 0x2031) },
         { PCI_DEVICE(PCI_VENDOR_ID_SILAN, 0x8139) },
+        { PCI_DEVICE(0x1088, 0x2031) },
         { 0, }
 };
 MODULE_DEVICE_TABLE(pci, sc92031_pci_device_id_table);
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 60d502eef4fc..543af2044f40 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -3854,8 +3854,10 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
         skge->speed = -1;
         skge->advertising = skge_supported_modes(hw);
 
-        if (device_may_wakeup(&hw->pdev->dev))
+        if (device_can_wakeup(&hw->pdev->dev)) {
                 skge->wol = wol_supported(hw) & WAKE_MAGIC;
+                device_set_wakeup_enable(&hw->pdev->dev, skge->wol);
+        }
 
         hw->dev[port] = dev;
 
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index daf961ab68bc..3550c5dcd93c 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1151,14 +1151,7 @@ stopped:
 
         /* reset the Rx prefetch unit */
         sky2_write32(hw, Y2_QADDR(rxq, PREF_UNIT_CTRL), PREF_UNIT_RST_SET);
-
-        /* Reset the RAM Buffer receive queue */
-        sky2_write8(hw, RB_ADDR(rxq, RB_CTRL), RB_RST_SET);
-
-        /* Reset Rx MAC FIFO */
-        sky2_write8(hw, SK_REG(sky2->port, RX_GMF_CTRL_T), GMF_RST_SET);
-
-        sky2_read8(hw, B0_CTST);
+        mmiowb();
 }
 
 /* Clean out receive buffer area, assumes receiver hardware stopped */
@@ -1825,12 +1818,6 @@ static int sky2_down(struct net_device *dev)
         if (netif_msg_ifdown(sky2))
                 printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
 
-        /* Disable port IRQ */
-        imask = sky2_read32(hw, B0_IMSK);
-        imask &= ~portirq_msk[port];
-        sky2_write32(hw, B0_IMSK, imask);
-        sky2_read32(hw, B0_IMSK);
-
         /* Force flow control off */
         sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
 
@@ -1870,8 +1857,6 @@ static int sky2_down(struct net_device *dev)
 
         sky2_write32(hw, RB_ADDR(txqaddr[port], RB_CTRL), RB_RST_SET);
 
-        sky2_rx_stop(sky2);
-
         sky2_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_SET);
         sky2_write8(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_RST_SET);
 
@@ -1881,6 +1866,14 @@ static int sky2_down(struct net_device *dev)
         sky2_write32(hw, STAT_ISR_TIMER_CNT, 0);
         sky2_read8(hw, STAT_ISR_TIMER_CTRL);
 
+        sky2_rx_stop(sky2);
+
+        /* Disable port IRQ */
+        imask = sky2_read32(hw, B0_IMSK);
+        imask &= ~portirq_msk[port];
+        sky2_write32(hw, B0_IMSK, imask);
+        sky2_read32(hw, B0_IMSK);
+
         synchronize_irq(hw->pdev->irq);
         napi_synchronize(&hw->napi);
 
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index f1f773b17fe1..57a159fac99f 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -186,7 +186,8 @@ static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, (l))
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
-#elif   defined(CONFIG_MACH_LOGICPD_PXA270)
+#elif   defined(CONFIG_MACH_LOGICPD_PXA270) \
+        || defined(CONFIG_MACH_NOMADIK_8815NHK)
 
 #define SMC_CAN_USE_8BIT        0
 #define SMC_CAN_USE_16BIT       1
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 9d896116cf76..08a6c41c1599 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void)
 
         find_turbo_adapters(io);
 
-        for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) {
+        for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
                 struct net_device *dev;
                 irq[i] = 0;
                 mem[i] = 0;
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 40c6eba775ce..3b957e6412ee 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1590,13 +1590,13 @@ static int init_phy(struct net_device *dev)
         priv->oldspeed = 0;
         priv->oldduplex = -1;
 
-        if (!ug_info->phy_node)
-                return 0;
-
         phydev = of_phy_connect(dev, ug_info->phy_node, &adjust_link, 0,
                                 priv->phy_interface);
+        if (!phydev)
+                phydev = of_phy_connect_fixed_link(dev, &adjust_link,
+                                                   priv->phy_interface);
         if (!phydev) {
-                printk("%s: Could not attach to PHY\n", dev->name);
+                dev_err(&dev->dev, "Could not attach to PHY\n");
                 return -ENODEV;
         }
 
@@ -3608,9 +3608,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
         struct ucc_geth_private *ugeth = NULL;
         struct ucc_geth_info *ug_info;
         struct resource res;
-        struct device_node *phy;
         int err, ucc_num, max_speed = 0;
-        const u32 *fixed_link;
         const unsigned int *prop;
         const char *sprop;
         const void *mac_addr;
@@ -3708,15 +3706,8 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
 
         ug_info->uf_info.regs = res.start;
         ug_info->uf_info.irq = irq_of_parse_and_map(np, 0);
-        fixed_link = of_get_property(np, "fixed-link", NULL);
-        if (fixed_link) {
-                phy = NULL;
-        } else {
-                phy = of_parse_phandle(np, "phy-handle", 0);
-                if (phy == NULL)
-                        return -ENODEV;
-        }
-        ug_info->phy_node = phy;
+
+        ug_info->phy_node = of_parse_phandle(np, "phy-handle", 0);
 
         /* Find the TBI PHY node.  If it's not there, we don't support SGMII */
         ug_info->tbi_node = of_parse_phandle(np, "tbi-handle", 0);
@@ -3725,7 +3716,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
         prop = of_get_property(np, "phy-connection-type", NULL);
         if (!prop) {
                 /* handle interface property present in old trees */
-                prop = of_get_property(phy, "interface", NULL);
+                prop = of_get_property(ug_info->phy_node, "interface", NULL);
                 if (prop != NULL) {
                         phy_interface = enet_to_phy_interface[*prop];
                         max_speed = enet_to_speed[*prop];
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index a906d3998131..c47237c2d638 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -369,4 +369,12 @@ config USB_NET_INT51X1
           (Powerline Communications) solution with an Intellon
           INT51x1/INT5200 chip, like the "devolo dLan duo".
 
+config USB_CDC_PHONET
+        tristate "CDC Phonet support"
+        depends on PHONET
+        help
+          Choose this option to support the Phonet interface to a Nokia
+          cellular modem, as found on most Nokia handsets with the
+          "PC suite" USB profile.
+
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index b870b0b1cbe0..e17afb78f372 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -21,4 +21,5 @@ obj-$(CONFIG_USB_NET_ZAURUS)	+= zaurus.o
 obj-$(CONFIG_USB_NET_MCS7830)   += mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
+obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
 
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
new file mode 100644
index 000000000000..792af72da8ac
--- /dev/null
+++ b/drivers/net/usb/cdc-phonet.c
@@ -0,0 +1,461 @@
+/*
+ * phonet.c -- USB CDC Phonet host driver
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation. All rights reserved.
+ *
+ * Author: Rémi Denis-Courmont
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/if_phonet.h>
+
+#define PN_MEDIA_USB    0x1B
+
+static const unsigned rxq_size = 17;
+
+struct usbpn_dev {
+        struct net_device       *dev;
+
+        struct usb_interface    *intf, *data_intf;
+        struct usb_device       *usb;
+        unsigned int            tx_pipe, rx_pipe;
+        u8 active_setting;
+        u8 disconnected;
+
+        unsigned                tx_queue;
+        spinlock_t              tx_lock;
+
+        spinlock_t              rx_lock;
+        struct sk_buff          *rx_skb;
+        struct urb              *urbs[0];
+};
+
+static void tx_complete(struct urb *req);
+static void rx_complete(struct urb *req);
+
+/*
+ * Network device callbacks
+ */
+static int usbpn_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct usbpn_dev *pnd = netdev_priv(dev);
+        struct urb *req = NULL;
+        unsigned long flags;
+        int err;
+
+        if (skb->protocol != htons(ETH_P_PHONET))
+                goto drop;
+
+        req = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!req)
+                goto drop;
+        usb_fill_bulk_urb(req, pnd->usb, pnd->tx_pipe, skb->data, skb->len,
+                                tx_complete, skb);
+        req->transfer_flags = URB_ZERO_PACKET;
+        err = usb_submit_urb(req, GFP_ATOMIC);
+        if (err) {
+                usb_free_urb(req);
+                goto drop;
+        }
+
+        spin_lock_irqsave(&pnd->tx_lock, flags);
+        pnd->tx_queue++;
+        if (pnd->tx_queue >= dev->tx_queue_len)
+                netif_stop_queue(dev);
+        spin_unlock_irqrestore(&pnd->tx_lock, flags);
+        return 0;
+
+drop:
+        dev_kfree_skb(skb);
+        dev->stats.tx_dropped++;
+        return 0;
+}
+
+static void tx_complete(struct urb *req)
+{
+        struct sk_buff *skb = req->context;
+        struct net_device *dev = skb->dev;
+        struct usbpn_dev *pnd = netdev_priv(dev);
+
+        switch (req->status) {
+        case 0:
+                dev->stats.tx_bytes += skb->len;
+                break;
+
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                dev->stats.tx_aborted_errors++;
+        default:
+                dev->stats.tx_errors++;
+                dev_dbg(&dev->dev, "TX error (%d)\n", req->status);
+        }
+        dev->stats.tx_packets++;
+
+        spin_lock(&pnd->tx_lock);
+        pnd->tx_queue--;
+        netif_wake_queue(dev);
+        spin_unlock(&pnd->tx_lock);
+
+        dev_kfree_skb_any(skb);
+        usb_free_urb(req);
+}
+
+static int rx_submit(struct usbpn_dev *pnd, struct urb *req, gfp_t gfp_flags)
+{
+        struct net_device *dev = pnd->dev;
+        struct page *page;
+        int err;
+
+        page = __netdev_alloc_page(dev, gfp_flags);
+        if (!page)
+                return -ENOMEM;
+
+        usb_fill_bulk_urb(req, pnd->usb, pnd->rx_pipe, page_address(page),
+                                PAGE_SIZE, rx_complete, dev);
+        req->transfer_flags = 0;
+        err = usb_submit_urb(req, gfp_flags);
+        if (unlikely(err)) {
+                dev_dbg(&dev->dev, "RX submit error (%d)\n", err);
+                netdev_free_page(dev, page);
+        }
+        return err;
+}
+
+static void rx_complete(struct urb *req)
+{
+        struct net_device *dev = req->context;
+        struct usbpn_dev *pnd = netdev_priv(dev);
+        struct page *page = virt_to_page(req->transfer_buffer);
+        struct sk_buff *skb;
+        unsigned long flags;
+
+        switch (req->status) {
+        case 0:
+                spin_lock_irqsave(&pnd->rx_lock, flags);
+                skb = pnd->rx_skb;
+                if (!skb) {
+                        skb = pnd->rx_skb = netdev_alloc_skb(dev, 12);
+                        if (likely(skb)) {
+                                /* Can't use pskb_pull() on page in IRQ */
+                                memcpy(skb_put(skb, 1), page_address(page), 1);
+                                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+                                                page, 1, req->actual_length);
+                                page = NULL;
+                        }
+                } else {
+                        skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+                                        page, 0, req->actual_length);
+                        page = NULL;
+                }
+                if (req->actual_length < PAGE_SIZE)
+                        pnd->rx_skb = NULL; /* Last fragment */
+                else
+                        skb = NULL;
+                spin_unlock_irqrestore(&pnd->rx_lock, flags);
+                if (skb) {
+                        skb->protocol = htons(ETH_P_PHONET);
+                        skb_reset_mac_header(skb);
+                        __skb_pull(skb, 1);
+                        skb->dev = dev;
+                        dev->stats.rx_packets++;
+                        dev->stats.rx_bytes += skb->len;
+
+                        netif_rx(skb);
+                }
+                goto resubmit;
+
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                req = NULL;
+                break;
+
+        case -EOVERFLOW:
+                dev->stats.rx_over_errors++;
+                dev_dbg(&dev->dev, "RX overflow\n");
+                break;
+
+        case -EILSEQ:
+                dev->stats.rx_crc_errors++;
+                break;
+        }
+
+        dev->stats.rx_errors++;
+resubmit:
+        if (page)
+                netdev_free_page(dev, page);
+        if (req)
+                rx_submit(pnd, req, GFP_ATOMIC);
+}
+
+static int usbpn_close(struct net_device *dev);
+
+static int usbpn_open(struct net_device *dev)
+{
+        struct usbpn_dev *pnd = netdev_priv(dev);
+        int err;
+        unsigned i;
+        unsigned num = pnd->data_intf->cur_altsetting->desc.bInterfaceNumber;
+
+        err = usb_set_interface(pnd->usb, num, pnd->active_setting);
+        if (err)
+                return err;
+
+        for (i = 0; i < rxq_size; i++) {
+                struct urb *req = usb_alloc_urb(0, GFP_KERNEL);
+
+                if (!req || rx_submit(pnd, req, GFP_KERNEL)) {
+                        usbpn_close(dev);
+                        return -ENOMEM;
+                }
+                pnd->urbs[i] = req;
+        }
+
+        netif_wake_queue(dev);
+        return 0;
+}
+
+static int usbpn_close(struct net_device *dev)
+{
+        struct usbpn_dev *pnd = netdev_priv(dev);
+        unsigned i;
+        unsigned num = pnd->data_intf->cur_altsetting->desc.bInterfaceNumber;
+
+        netif_stop_queue(dev);
+
+        for (i = 0; i < rxq_size; i++) {
+                struct urb *req = pnd->urbs[i];
+
+                if (!req)
+                        continue;
+                usb_kill_urb(req);
+                usb_free_urb(req);
+                pnd->urbs[i] = NULL;
+        }
+
+        return usb_set_interface(pnd->usb, num, !pnd->active_setting);
+}
+
+static int usbpn_set_mtu(struct net_device *dev, int new_mtu)
+{
+        if ((new_mtu < PHONET_MIN_MTU) || (new_mtu > PHONET_MAX_MTU))
+                return -EINVAL;
+
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+static const struct net_device_ops usbpn_ops = {
+        .ndo_open       = usbpn_open,
+        .ndo_stop       = usbpn_close,
+        .ndo_start_xmit = usbpn_xmit,
+        .ndo_change_mtu = usbpn_set_mtu,
+};
+
+static void usbpn_setup(struct net_device *dev)
+{
+        dev->features           = 0;
+        dev->netdev_ops         = &usbpn_ops,
+        dev->header_ops         = &phonet_header_ops;
+        dev->type               = ARPHRD_PHONET;
+        dev->flags              = IFF_POINTOPOINT | IFF_NOARP;
+        dev->mtu                = PHONET_MAX_MTU;
+        dev->hard_header_len    = 1;
+        dev->dev_addr[0]        = PN_MEDIA_USB;
+        dev->addr_len           = 1;
+        dev->tx_queue_len       = 3;
+
+        dev->destructor         = free_netdev;
+}
+
+/*
+ * USB driver callbacks
+ */
+static struct usb_device_id usbpn_ids[] = {
+        {
+                .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+                        | USB_DEVICE_ID_MATCH_INT_CLASS
+                        | USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+                .idVendor = 0x0421, /* Nokia */
+                .bInterfaceClass = USB_CLASS_COMM,
+                .bInterfaceSubClass = 0xFE,
+        },
+        { },
+};
+
+MODULE_DEVICE_TABLE(usb, usbpn_ids);
+
+static struct usb_driver usbpn_driver;
+
+int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+        static const char ifname[] = "usbpn%d";
+        const struct usb_cdc_union_desc *union_header = NULL;
+        const struct usb_cdc_header_desc *phonet_header = NULL;
+        const struct usb_host_interface *data_desc;
+        struct usb_interface *data_intf;
+        struct usb_device *usbdev = interface_to_usbdev(intf);
+        struct net_device *dev;
+        struct usbpn_dev *pnd;
+        u8 *data;
+        int len, err;
+
+        data = intf->altsetting->extra;
+        len = intf->altsetting->extralen;
+        while (len >= 3) {
+                u8 dlen = data[0];
+                if (dlen < 3)
+                        return -EINVAL;
+
+                /* bDescriptorType */
+                if (data[1] == USB_DT_CS_INTERFACE) {
+                        /* bDescriptorSubType */
+                        switch (data[2]) {
+                        case USB_CDC_UNION_TYPE:
+                                if (union_header || dlen < 5)
+                                        break;
+                                union_header =
+                                        (struct usb_cdc_union_desc *)data;
+                                break;
+                        case 0xAB:
+                                if (phonet_header || dlen < 5)
+                                        break;
+                                phonet_header =
+                                        (struct usb_cdc_header_desc *)data;
+                                break;
+                        }
+                }
+                data += dlen;
+                len -= dlen;
+        }
+
+        if (!union_header || !phonet_header)
+                return -EINVAL;
+
+        data_intf = usb_ifnum_to_if(usbdev, union_header->bSlaveInterface0);
+        if (data_intf == NULL)
+                return -ENODEV;
+        /* Data interface has one inactive and one active setting */
+        if (data_intf->num_altsetting != 2)
+                return -EINVAL;
+        if (data_intf->altsetting[0].desc.bNumEndpoints == 0
+         && data_intf->altsetting[1].desc.bNumEndpoints == 2)
+                data_desc = data_intf->altsetting + 1;
+        else
+        if (data_intf->altsetting[0].desc.bNumEndpoints == 2
+         && data_intf->altsetting[1].desc.bNumEndpoints == 0)
+                data_desc = data_intf->altsetting;
+        else
+                return -EINVAL;
+
+        dev = alloc_netdev(sizeof(*pnd) + sizeof(pnd->urbs[0]) * rxq_size,
+                                ifname, usbpn_setup);
+        if (!dev)
+                return -ENOMEM;
+
+        pnd = netdev_priv(dev);
+        SET_NETDEV_DEV(dev, &intf->dev);
+        netif_stop_queue(dev);
+
+        pnd->dev = dev;
+        pnd->usb = usb_get_dev(usbdev);
+        pnd->intf = intf;
+        pnd->data_intf = data_intf;
+        spin_lock_init(&pnd->tx_lock);
+        spin_lock_init(&pnd->rx_lock);
+        /* Endpoints */
+        if (usb_pipein(data_desc->endpoint[0].desc.bEndpointAddress)) {
+                pnd->rx_pipe = usb_rcvbulkpipe(usbdev,
+                        data_desc->endpoint[0].desc.bEndpointAddress);
+                pnd->tx_pipe = usb_sndbulkpipe(usbdev,
+                        data_desc->endpoint[1].desc.bEndpointAddress);
+        } else {
+                pnd->rx_pipe = usb_rcvbulkpipe(usbdev,
+                        data_desc->endpoint[1].desc.bEndpointAddress);
+                pnd->tx_pipe = usb_sndbulkpipe(usbdev,
+                        data_desc->endpoint[0].desc.bEndpointAddress);
+        }
+        pnd->active_setting = data_desc - data_intf->altsetting;
+
+        err = usb_driver_claim_interface(&usbpn_driver, data_intf, pnd);
+        if (err)
+                goto out;
+
+        /* Force inactive mode until the network device is brought UP */
+        usb_set_interface(usbdev, union_header->bSlaveInterface0,
+                                !pnd->active_setting);
+        usb_set_intfdata(intf, pnd);
+
+        err = register_netdev(dev);
+        if (err) {
+                usb_driver_release_interface(&usbpn_driver, data_intf);
+                goto out;
+        }
+
+        dev_dbg(&dev->dev, "USB CDC Phonet device found\n");
+        return 0;
+
+out:
+        usb_set_intfdata(intf, NULL);
+        free_netdev(dev);
+        return err;
+}
+
+static void usbpn_disconnect(struct usb_interface *intf)
+{
+        struct usbpn_dev *pnd = usb_get_intfdata(intf);
+        struct usb_device *usb = pnd->usb;
+
+        if (pnd->disconnected)
+                return;
+
+        pnd->disconnected = 1;
+        usb_driver_release_interface(&usbpn_driver,
+                        (pnd->intf == intf) ? pnd->data_intf : pnd->intf);
+        unregister_netdev(pnd->dev);
+        usb_put_dev(usb);
+}
+
+static struct usb_driver usbpn_driver = {
+        .name =         "cdc_phonet",
+        .probe =        usbpn_probe,
+        .disconnect =   usbpn_disconnect,
+        .id_table =     usbpn_ids,
+};
+
+static int __init usbpn_init(void)
+{
+        return usb_register(&usbpn_driver);
+}
+
+static void __exit usbpn_exit(void)
+{
+        usb_deregister(&usbpn_driver);
+}
+
+module_init(usbpn_init);
+module_exit(usbpn_exit);
+
+MODULE_AUTHOR("Remi Denis-Courmont");
+MODULE_DESCRIPTION("USB CDC Phonet host interface");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
index cd35d50e46d4..45cebfb302cf 100644
--- a/drivers/net/usb/cdc_eem.c
+++ b/drivers/net/usb/cdc_eem.c
@@ -311,7 +311,7 @@ static int eem_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                          *      bmCRC = 0       : CRC = 0xDEADBEEF
                          */
                         if (header & BIT(14))
-                                crc2 = ~crc32_le(~0, skb2->data, len);
+                                crc2 = ~crc32_le(~0, skb2->data, skb2->len);
                         else
                                 crc2 = 0xdeadbeef;
 
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index ea045151f953..029c1bc7468f 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2970,6 +2970,9 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (modparam_nohwcrypt)
                 return -EOPNOTSUPP;
 
+        if (sc->opmode == NL80211_IFTYPE_AP)
+                return -EOPNOTSUPP;
+
         switch (key->alg) {
         case ALG_WEP:
         case ALG_TKIP:
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 1aeafb511ddd..aad259b4c197 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -478,6 +478,18 @@ void ath9k_ani_reset(struct ath_hw *ah)
                         "Reset ANI state opmode %u\n", ah->opmode);
                 ah->stats.ast_ani_reset++;
 
+                if (ah->opmode == NL80211_IFTYPE_AP) {
+                        /*
+                         * ath9k_hw_ani_control() will only process items set on
+                         * ah->ani_function
+                         */
+                        if (IS_CHAN_2GHZ(chan))
+                                ah->ani_function = (ATH9K_ANI_SPUR_IMMUNITY_LEVEL |
+                                                    ATH9K_ANI_FIRSTEP_LEVEL);
+                        else
+                                ah->ani_function = 0;
+                }
+
                 ath9k_hw_ani_control(ah, ATH9K_ANI_NOISE_IMMUNITY_LEVEL, 0);
                 ath9k_hw_ani_control(ah, ATH9K_ANI_SPUR_IMMUNITY_LEVEL, 0);
                 ath9k_hw_ani_control(ah, ATH9K_ANI_FIRSTEP_LEVEL, 0);
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index eef370bd1211..bf3d25ba7be1 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -474,6 +474,21 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
         return 0;
 }
 
+/*
+ * Some users have reported their EEPROM programmed with
+ * 0x8000 set, this is not a supported regulatory domain
+ * but since we have more than one user with it we need
+ * a solution for them. We default to 0x64, which is the
+ * default Atheros world regulatory domain.
+ */
+static void ath_regd_sanitize(struct ath_regulatory *reg)
+{
+        if (reg->current_rd != COUNTRY_ERD_FLAG)
+                return;
+        printk(KERN_DEBUG "ath: EEPROM regdomain sanitized\n");
+        reg->current_rd = 0x64;
+}
+
 int
 ath_regd_init(struct ath_regulatory *reg,
               struct wiphy *wiphy,
@@ -486,6 +501,8 @@ ath_regd_init(struct ath_regulatory *reg,
         if (!reg)
                 return -EINVAL;
 
+        ath_regd_sanitize(reg);
+
         printk(KERN_DEBUG "ath: EEPROM regdomain: 0x%0x\n", reg->current_rd);
 
         if (!ath_regd_is_eeprom_valid(reg)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 6d1519e1f011..355f50ea7fef 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2675,12 +2675,10 @@ static ssize_t show_power_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
-        int mode = priv->power_data.user_power_setting;
         int level = priv->power_data.power_mode;
         char *p = buf;
 
-        p += sprintf(p, "INDEX:%d\t", level);
-        p += sprintf(p, "USER:%d\n", mode);
+        p += sprintf(p, "%d\n", level);
         return p - buf + 1;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 85ae7a62109c..9bbeec9427f0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -872,7 +872,8 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
 
         /* Set up entry for this TFD in Tx byte-count array */
-        priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
+        if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
                                                      le16_to_cpu(tx_cmd->len));
 
         pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index cb9bd4c8f25e..956798f2c80c 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3643,12 +3643,10 @@ static ssize_t show_power_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
-        int mode = priv->power_data.user_power_setting;
         int level = priv->power_data.power_mode;
         char *p = buf;
 
-        p += sprintf(p, "INDEX:%d\t", level);
-        p += sprintf(p, "USER:%d\n", mode);
+        p += sprintf(p, "%d\n", level);
         return p - buf + 1;
 }
 
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index aaa20c6885c8..aea5ccf24ccf 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -151,8 +151,8 @@ void iwm_if_free(struct iwm_priv *iwm)
                 return;
 
         free_netdev(iwm_to_ndev(iwm));
-        iwm_wdev_free(iwm);
         iwm_priv_deinit(iwm);
+        iwm_wdev_free(iwm);
 }
 
 int iwm_if_add(struct iwm_priv *iwm)
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 01db705a38ec..685098148e10 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -135,8 +135,14 @@ int lbs_update_hw_spec(struct lbs_private *priv)
         /* Clamp region code to 8-bit since FW spec indicates that it should
          * only ever be 8-bit, even though the field size is 16-bit.  Some firmware
          * returns non-zero high 8 bits here.
+         *
+         * Firmware version 4.0.102 used in CF8381 has region code shifted.  We
+         * need to check for this problem and handle it properly.
          */
-        priv->regioncode = le16_to_cpu(cmd.regioncode) & 0xFF;
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V4)
+                priv->regioncode = (le16_to_cpu(cmd.regioncode) >> 8) & 0xFF;
+        else
+                priv->regioncode = le16_to_cpu(cmd.regioncode) & 0xFF;
 
         for (i = 0; i < MRVDRV_MAX_REGION_CODE; i++) {
                 /* use the region code to search for the index */
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index 48da157d6cda..72f3479a4d70 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -234,6 +234,8 @@ static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, in
 /** Mesh enable bit in FW capability */
 #define MESH_CAPINFO_ENABLE_MASK                        (1<<16)
 
+/** FW definition from Marvell v4 */
+#define MRVL_FW_V4                                      (0x04)
 /** FW definition from Marvell v5 */
 #define MRVL_FW_V5                                      (0x05)
 /** FW definition from Marvell v10 */
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index a111bda392e2..7916ca3f84c8 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -709,7 +709,7 @@ static const struct ieee80211_ops mac80211_hwsim_ops =
 static void mac80211_hwsim_free(void)
 {
         struct list_head tmplist, *i, *tmp;
-        struct mac80211_hwsim_data *data;
+        struct mac80211_hwsim_data *data, *tmpdata;
 
         INIT_LIST_HEAD(&tmplist);
 
@@ -718,7 +718,7 @@ static void mac80211_hwsim_free(void)
                 list_move(i, &tmplist);
         spin_unlock_bh(&hwsim_radio_lock);
 
-        list_for_each_entry(data, &tmplist, list) {
+        list_for_each_entry_safe(data, tmpdata, &tmplist, list) {
                 debugfs_remove(data->debugfs_group);
                 debugfs_remove(data->debugfs_ps);
                 debugfs_remove(data->debugfs);
@@ -1167,8 +1167,8 @@ static void __exit exit_mac80211_hwsim(void)
 {
         printk(KERN_DEBUG "mac80211_hwsim: unregister radios\n");
 
-        unregister_netdev(hwsim_mon);
         mac80211_hwsim_free();
+        unregister_netdev(hwsim_mon);
 }
 
 
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 83116baeb110..72c7dbd39d0a 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -635,7 +635,7 @@ static int __devinit p54spi_probe(struct spi_device *spi)
 
         hw = p54_init_common(sizeof(*priv));
         if (!hw) {
-                dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
+                dev_err(&spi->dev, "could not alloc ieee80211_hw");
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 66daf68ff0ee..ce75426764a1 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1550,7 +1550,9 @@ static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
         rt2500usb_register_read(rt2x00dev, MAC_CSR0, &reg);
         rt2x00_set_chip(rt2x00dev, RT2570, value, reg);
 
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0)) {
+        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0) ||
+            rt2x00_check_rev(&rt2x00dev->chip, 0x0000000f, 0)) {
+
                 ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                 return -ENODEV;
         }
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.c b/drivers/net/wireless/rtl818x/rtl8187_leds.c
index b44253592243..cf9f899fe0e6 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c
@@ -208,11 +208,12 @@ void rtl8187_leds_exit(struct ieee80211_hw *dev)
 {
         struct rtl8187_priv *priv = dev->priv;
 
-        rtl8187_unregister_led(&priv->led_tx);
         /* turn the LED off before exiting */
         queue_delayed_work(dev->workqueue, &priv->led_off, 0);
         cancel_delayed_work_sync(&priv->led_off);
+        cancel_delayed_work_sync(&priv->led_on);
         rtl8187_unregister_led(&priv->led_rx);
+        rtl8187_unregister_led(&priv->led_tx);
 }
 #endif /* def CONFIG_RTL8187_LED */
 
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index aee967d7f760..bacaa536fd51 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -9,6 +9,10 @@
  * out of the OpenFirmware device tree and using it to populate an mii_bus.
  */
 
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/netdevice.h>
+#include <linux/err.h>
 #include <linux/phy.h>
 #include <linux/of.h>
 #include <linux/of_mdio.h>
@@ -137,3 +141,41 @@ struct phy_device *of_phy_connect(struct net_device *dev,
         return phy_connect_direct(dev, phy, hndlr, flags, iface) ? NULL : phy;
 }
 EXPORT_SYMBOL(of_phy_connect);
+
+/**
+ * of_phy_connect_fixed_link - Parse fixed-link property and return a dummy phy
+ * @dev: pointer to net_device claiming the phy
+ * @hndlr: Link state callback for the network device
+ * @iface: PHY data interface type
+ *
+ * This function is a temporary stop-gap and will be removed soon.  It is
+ * only to support the fs_enet, ucc_geth and gianfar Ethernet drivers.  Do
+ * not call this function from new drivers.
+ */
+struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
+                                             void (*hndlr)(struct net_device *),
+                                             phy_interface_t iface)
+{
+        struct device_node *net_np;
+        char bus_id[MII_BUS_ID_SIZE + 3];
+        struct phy_device *phy;
+        const u32 *phy_id;
+        int sz;
+
+        if (!dev->dev.parent)
+                return NULL;
+
+        net_np = dev_archdata_get_node(&dev->dev.parent->archdata);
+        if (!net_np)
+                return NULL;
+
+        phy_id = of_get_property(net_np, "fixed-link", &sz);
+        if (!phy_id || sz < sizeof(*phy_id))
+                return NULL;
+
+        sprintf(bus_id, PHY_ID_FMT, "0", phy_id[0]);
+
+        phy = phy_connect(dev, bus_id, hndlr, 0, iface);
+        return IS_ERR(phy) ? NULL : phy;
+}
+EXPORT_SYMBOL(of_phy_connect_fixed_link);
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index be2fd6f91639..fb45f5ee8df1 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -973,7 +973,7 @@ static int acer_rfkill_set(void *data, bool blocked)
 {
         acpi_status status;
         u32 cap = (unsigned long)data;
-        status = set_u32(!!blocked, cap);
+        status = set_u32(!blocked, cap);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
         return 0;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 727a809636d8..ed3dcdea7fe1 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -1145,12 +1145,17 @@ ap_config_timeout(unsigned long ptr)
  */
 static inline void ap_schedule_poll_timer(void)
 {
+        ktime_t hr_time;
         if (ap_using_interrupts() || ap_suspend_flag)
                 return;
         if (hrtimer_is_queued(&ap_poll_timer))
                 return;
-        hrtimer_start(&ap_poll_timer, ktime_set(0, poll_timeout),
-                      HRTIMER_MODE_ABS);
+        if (ktime_to_ns(hrtimer_expires_remaining(&ap_poll_timer)) <= 0) {
+                hr_time = ktime_set(0, poll_timeout);
+                hrtimer_forward_now(&ap_poll_timer, hr_time);
+                hrtimer_restart(&ap_poll_timer);
+        }
+        return;
 }
 
 /**
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index bd7581b3a48a..99188c92068b 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -32,6 +32,7 @@
 #include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/uaccess.h>
+#include <linux/serial.h>
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
 #include "pl2303.h"
@@ -184,6 +185,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
         struct usb_serial_port *port;
         unsigned int portNumber;
         int retval = 0;
+        int first = 0;
 
         dbg("%s", __func__);
 
@@ -223,7 +225,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
 
         /* If the console is attached, the device is already open */
         if (port->port.count == 1 && !port->console) {
-
+                first = 1;
                 /* lock this module before we call it
                  * this may fail, which means we must bail out,
                  * safe because we are called with BKL held */
@@ -246,13 +248,21 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
                 if (retval)
                         goto bailout_interface_put;
                 mutex_unlock(&serial->disc_mutex);
+                set_bit(ASYNCB_INITIALIZED, &port->port.flags);
         }
         mutex_unlock(&port->mutex);
         /* Now do the correct tty layer semantics */
         retval = tty_port_block_til_ready(&port->port, tty, filp);
-        if (retval == 0)
+        if (retval == 0) {
+                if (!first)
+                        usb_serial_put(serial);
                 return 0;
-
+        }
+        mutex_lock(&port->mutex);
+        if (first == 0)
+                goto bailout_mutex_unlock;
+        /* Undo the initial port actions */
+        mutex_lock(&serial->disc_mutex);
 bailout_interface_put:
         usb_autopm_put_interface(serial->interface);
 bailout_module_put:
@@ -340,6 +350,22 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
 
         dbg("%s - port %d", __func__, port->number);
 
+        /* FIXME:
+           This leaves a very narrow race. Really we should do the
+           serial_do_free() on tty->shutdown(), but tty->shutdown can
+           be called from IRQ context and serial_do_free can sleep.
+
+           The right fix is probably to make the tty free (which is rare)
+           and thus tty->shutdown() occur via a work queue and simplify all
+           the drivers that use it.
+        */
+        if (tty_hung_up_p(filp)) {
+                /* serial_hangup already called serial_down at this point.
+                   Another user may have already reopened the port but
+                   serial_do_free is refcounted */
+                serial_do_free(port);
+                return;
+        }
 
         if (tty_port_close_start(&port->port, tty, filp) == 0)
                 return;
@@ -355,7 +381,8 @@ static void serial_hangup(struct tty_struct *tty)
         struct usb_serial_port *port = tty->driver_data;
         serial_do_down(port);
         tty_port_hangup(&port->port);
-        serial_do_free(port);
+        /* We must not free port yet - the USB serial layer depends on it's
+           continued existence */
 }
 
 static int serial_write(struct tty_struct *tty, const unsigned char *buf,
@@ -394,7 +421,6 @@ static int serial_chars_in_buffer(struct tty_struct *tty)
         struct usb_serial_port *port = tty->driver_data;
         dbg("%s = port %d", __func__, port->number);
 
-        WARN_ON(!port->port.count);
         /* if the device was unplugged then any remaining characters
            fell out of the connector ;) */
         if (port->serial->disconnected)
diff --git a/drivers/video/fbmon.c b/drivers/video/fbmon.c
index 5c1a2c01778f..9ae9cd32bd06 100644
--- a/drivers/video/fbmon.c
+++ b/drivers/video/fbmon.c
@@ -256,8 +256,8 @@ static void fix_edid(unsigned char *edid, int fix)
 
 static int edid_checksum(unsigned char *edid)
 {
-        unsigned char i, csum = 0, all_null = 0;
-        int err = 0, fix = check_edid(edid);
+        unsigned char csum = 0, all_null = 0;
+        int i, err = 0, fix = check_edid(edid);
 
         if (fix)
                 fix_edid(edid, fix);
diff --git a/fs/Kconfig b/fs/Kconfig
index a97263be6a91..0e7da7bb5d93 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -186,32 +186,7 @@ source "fs/romfs/Kconfig"
 source "fs/sysv/Kconfig"
 source "fs/ufs/Kconfig"
 source "fs/exofs/Kconfig"
-
-config NILFS2_FS
-        tristate "NILFS2 file system support (EXPERIMENTAL)"
-        depends on BLOCK && EXPERIMENTAL
-        select CRC32
-        help
-          NILFS2 is a log-structured file system (LFS) supporting continuous
-          snapshotting.  In addition to versioning capability of the entire
-          file system, users can even restore files mistakenly overwritten or
-          destroyed just a few seconds ago.  Since this file system can keep
-          consistency like conventional LFS, it achieves quick recovery after
-          system crashes.
-
-          NILFS2 creates a number of checkpoints every few seconds or per
-          synchronous write basis (unless there is no change).  Users can
-          select significant versions among continuously created checkpoints,
-          and can change them into snapshots which will be preserved for long
-          periods until they are changed back to checkpoints.  Each
-          snapshot is mountable as a read-only file system concurrently with
-          its writable mount, and this feature is convenient for online backup.
-
-          Some features including atime, extended attributes, and POSIX ACLs,
-          are not supported yet.
-
-          To compile this file system support as a module, choose M here: the
-          module will be called nilfs2.  If unsure, say N.
+source "fs/nilfs2/Kconfig"
 
 endif # MISC_FILESYSTEMS
 
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 6e4f6c50a120..019e8af449ab 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -424,11 +424,11 @@ int btrfs_requeue_work(struct btrfs_work *work)
          * list
          */
         if (worker->idle) {
-                spin_lock_irqsave(&worker->workers->lock, flags);
+                spin_lock(&worker->workers->lock);
                 worker->idle = 0;
                 list_move_tail(&worker->worker_list,
                                &worker->workers->worker_list);
-                spin_unlock_irqrestore(&worker->workers->lock, flags);
+                spin_unlock(&worker->workers->lock);
         }
         if (!worker->working) {
                 wake = 1;
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 60a45f3a4e91..3fdcc0512d3a 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -557,19 +557,7 @@ static int comp_keys(struct btrfs_disk_key *disk, struct btrfs_key *k2)
 
         btrfs_disk_key_to_cpu(&k1, disk);
 
-        if (k1.objectid > k2->objectid)
-                return 1;
-        if (k1.objectid < k2->objectid)
-                return -1;
-        if (k1.type > k2->type)
-                return 1;
-        if (k1.type < k2->type)
-                return -1;
-        if (k1.offset > k2->offset)
-                return 1;
-        if (k1.offset < k2->offset)
-                return -1;
-        return 0;
+        return btrfs_comp_cpu_keys(&k1, k2);
 }
 
 /*
@@ -1052,9 +1040,6 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
             BTRFS_NODEPTRS_PER_BLOCK(root) / 4)
                 return 0;
 
-        if (btrfs_header_nritems(mid) > 2)
-                return 0;
-
         if (btrfs_header_nritems(mid) < 2)
                 err_on_enospc = 1;
 
@@ -1701,6 +1686,7 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root
         struct extent_buffer *b;
         int slot;
         int ret;
+        int err;
         int level;
         int lowest_unlock = 1;
         u8 lowest_level = 0;
@@ -1737,8 +1723,6 @@ again:
                         p->locks[level] = 1;
 
                 if (cow) {
-                        int wret;
-
                         /*
                          * if we don't really need to cow this block
                          * then we don't want to set the path blocking,
@@ -1749,12 +1733,12 @@ again:
 
                         btrfs_set_path_blocking(p);
 
-                        wret = btrfs_cow_block(trans, root, b,
-                                               p->nodes[level + 1],
-                                               p->slots[level + 1], &b);
-                        if (wret) {
+                        err = btrfs_cow_block(trans, root, b,
+                                              p->nodes[level + 1],
+                                              p->slots[level + 1], &b);
+                        if (err) {
                                 free_extent_buffer(b);
-                                ret = wret;
+                                ret = err;
                                 goto done;
                         }
                 }
@@ -1793,41 +1777,45 @@ cow_done:
                 ret = bin_search(b, key, level, &slot);
 
                 if (level != 0) {
-                        if (ret && slot > 0)
+                        int dec = 0;
+                        if (ret && slot > 0) {
+                                dec = 1;
                                 slot -= 1;
+                        }
                         p->slots[level] = slot;
-                        ret = setup_nodes_for_search(trans, root, p, b, level,
+                        err = setup_nodes_for_search(trans, root, p, b, level,
                                                      ins_len);
-                        if (ret == -EAGAIN)
+                        if (err == -EAGAIN)
                                 goto again;
-                        else if (ret)
+                        if (err) {
+                                ret = err;
                                 goto done;
+                        }
                         b = p->nodes[level];
                         slot = p->slots[level];
 
                         unlock_up(p, level, lowest_unlock);
 
-                        /* this is only true while dropping a snapshot */
                         if (level == lowest_level) {
-                                ret = 0;
+                                if (dec)
+                                        p->slots[level]++;
                                 goto done;
                         }
 
-                        ret = read_block_for_search(trans, root, p,
+                        err = read_block_for_search(trans, root, p,
                                                     &b, level, slot, key);
-                        if (ret == -EAGAIN)
+                        if (err == -EAGAIN)
                                 goto again;
-
-                        if (ret == -EIO)
+                        if (err) {
+                                ret = err;
                                 goto done;
+                        }
 
                         if (!p->skip_locking) {
-                                int lret;
-
                                 btrfs_clear_path_blocking(p, NULL);
-                                lret = btrfs_try_spin_lock(b);
+                                err = btrfs_try_spin_lock(b);
 
-                                if (!lret) {
+                                if (!err) {
                                         btrfs_set_path_blocking(p);
                                         btrfs_tree_lock(b);
                                         btrfs_clear_path_blocking(p, b);
@@ -1837,16 +1825,14 @@ cow_done:
                         p->slots[level] = slot;
                         if (ins_len > 0 &&
                             btrfs_leaf_free_space(root, b) < ins_len) {
-                                int sret;
-
                                 btrfs_set_path_blocking(p);
-                                sret = split_leaf(trans, root, key,
-                                                      p, ins_len, ret == 0);
+                                err = split_leaf(trans, root, key,
+                                                 p, ins_len, ret == 0);
                                 btrfs_clear_path_blocking(p, NULL);
 
-                                BUG_ON(sret > 0);
-                                if (sret) {
-                                        ret = sret;
+                                BUG_ON(err > 0);
+                                if (err) {
+                                        ret = err;
                                         goto done;
                                 }
                         }
@@ -3807,7 +3793,7 @@ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                 }
 
                 /* delete the leaf if it is mostly empty */
-                if (used < BTRFS_LEAF_DATA_SIZE(root) / 2) {
+                if (used < BTRFS_LEAF_DATA_SIZE(root) / 3) {
                         /* push_leaf_left fixes the path.
                          * make sure the path still points to our leaf
                          * for possible call to del_ptr below
@@ -4042,10 +4028,9 @@ out:
  * calling this function.
  */
 int btrfs_find_next_key(struct btrfs_root *root, struct btrfs_path *path,
-                        struct btrfs_key *key, int lowest_level,
+                        struct btrfs_key *key, int level,
                         int cache_only, u64 min_trans)
 {
-        int level = lowest_level;
         int slot;
         struct extent_buffer *c;
 
@@ -4058,11 +4043,40 @@ int btrfs_find_next_key(struct btrfs_root *root, struct btrfs_path *path,
                 c = path->nodes[level];
 next:
                 if (slot >= btrfs_header_nritems(c)) {
-                        level++;
-                        if (level == BTRFS_MAX_LEVEL)
+                        int ret;
+                        int orig_lowest;
+                        struct btrfs_key cur_key;
+                        if (level + 1 >= BTRFS_MAX_LEVEL ||
+                            !path->nodes[level + 1])
                                 return 1;
-                        continue;
+
+                        if (path->locks[level + 1]) {
+                                level++;
+                                continue;
+                        }
+
+                        slot = btrfs_header_nritems(c) - 1;
+                        if (level == 0)
+                                btrfs_item_key_to_cpu(c, &cur_key, slot);
+                        else
+                                btrfs_node_key_to_cpu(c, &cur_key, slot);
+
+                        orig_lowest = path->lowest_level;
+                        btrfs_release_path(root, path);
+                        path->lowest_level = level;
+                        ret = btrfs_search_slot(NULL, root, &cur_key, path,
+                                                0, 0);
+                        path->lowest_level = orig_lowest;
+                        if (ret < 0)
+                                return ret;
+
+                        c = path->nodes[level];
+                        slot = path->slots[level];
+                        if (ret == 0)
+                                slot++;
+                        goto next;
                 }
+
                 if (level == 0)
                         btrfs_item_key_to_cpu(c, key, slot);
                 else {
@@ -4146,7 +4160,8 @@ again:
          * advance the path if there are now more items available.
          */
         if (nritems > 0 && path->slots[0] < nritems - 1) {
-                path->slots[0]++;
+                if (ret == 0)
+                        path->slots[0]++;
                 ret = 0;
                 goto done;
         }
@@ -4278,10 +4293,10 @@ int btrfs_previous_item(struct btrfs_root *root,
                         path->slots[0]--;
 
                 btrfs_item_key_to_cpu(leaf, &found_key, path->slots[0]);
-                if (found_key.type == type)
-                        return 0;
                 if (found_key.objectid < min_objectid)
                         break;
+                if (found_key.type == type)
+                        return 0;
                 if (found_key.objectid == min_objectid &&
                     found_key.type < type)
                         break;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 98a873838717..215ef8cae823 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -481,7 +481,7 @@ struct btrfs_shared_data_ref {
 
 struct btrfs_extent_inline_ref {
         u8 type;
-        u64 offset;
+        __le64 offset;
 } __attribute__ ((__packed__));
 
 /* old style backrefs item */
@@ -689,6 +689,7 @@ struct btrfs_space_info {
         struct list_head block_groups;
         spinlock_t lock;
         struct rw_semaphore groups_sem;
+        atomic_t caching_threads;
 };
 
 /*
@@ -707,6 +708,9 @@ struct btrfs_free_cluster {
         /* first extent starting offset */
         u64 window_start;
 
+        /* if this cluster simply points at a bitmap in the block group */
+        bool points_to_bitmap;
+
         struct btrfs_block_group_cache *block_group;
         /*
          * when a cluster is allocated from a block group, we put the
@@ -716,24 +720,37 @@ struct btrfs_free_cluster {
         struct list_head block_group_list;
 };
 
+enum btrfs_caching_type {
+        BTRFS_CACHE_NO          = 0,
+        BTRFS_CACHE_STARTED     = 1,
+        BTRFS_CACHE_FINISHED    = 2,
+};
+
 struct btrfs_block_group_cache {
         struct btrfs_key key;
         struct btrfs_block_group_item item;
+        struct btrfs_fs_info *fs_info;
         spinlock_t lock;
-        struct mutex cache_mutex;
         u64 pinned;
         u64 reserved;
         u64 flags;
-        int cached;
+        u64 sectorsize;
+        int extents_thresh;
+        int free_extents;
+        int total_bitmaps;
         int ro;
         int dirty;
 
+        /* cache tracking stuff */
+        wait_queue_head_t caching_q;
+        int cached;
+
         struct btrfs_space_info *space_info;
 
         /* free space cache stuff */
         spinlock_t tree_lock;
-        struct rb_root free_space_bytes;
         struct rb_root free_space_offset;
+        u64 free_space;
 
         /* block group cache stuff */
         struct rb_node cache_node;
@@ -942,6 +959,9 @@ struct btrfs_root {
         /* the node lock is held while changing the node pointer */
         spinlock_t node_lock;
 
+        /* taken when updating the commit root */
+        struct rw_semaphore commit_root_sem;
+
         struct extent_buffer *commit_root;
         struct btrfs_root *log_root;
         struct btrfs_root *reloc_root;
@@ -1988,6 +2008,7 @@ void btrfs_delalloc_reserve_space(struct btrfs_root *root, struct inode *inode,
                                  u64 bytes);
 void btrfs_delalloc_free_space(struct btrfs_root *root, struct inode *inode,
                               u64 bytes);
+void btrfs_free_pinned_extents(struct btrfs_fs_info *info);
 /* ctree.c */
 int btrfs_bin_search(struct extent_buffer *eb, struct btrfs_key *key,
                      int level, int *slot);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index d28d29c95f7c..7dcaa8138864 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -909,6 +909,7 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
         spin_lock_init(&root->inode_lock);
         mutex_init(&root->objectid_mutex);
         mutex_init(&root->log_mutex);
+        init_rwsem(&root->commit_root_sem);
         init_waitqueue_head(&root->log_writer_wait);
         init_waitqueue_head(&root->log_commit_wait[0]);
         init_waitqueue_head(&root->log_commit_wait[1]);
@@ -1799,6 +1800,11 @@ struct btrfs_root *open_ctree(struct super_block *sb,
                                            btrfs_super_chunk_root(disk_super),
                                            blocksize, generation);
         BUG_ON(!chunk_root->node);
+        if (!test_bit(EXTENT_BUFFER_UPTODATE, &chunk_root->node->bflags)) {
+                printk(KERN_WARNING "btrfs: failed to read chunk root on %s\n",
+                       sb->s_id);
+                goto fail_chunk_root;
+        }
         btrfs_set_root_node(&chunk_root->root_item, chunk_root->node);
         chunk_root->commit_root = btrfs_root_node(chunk_root);
 
@@ -1826,6 +1832,11 @@ struct btrfs_root *open_ctree(struct super_block *sb,
                                           blocksize, generation);
         if (!tree_root->node)
                 goto fail_chunk_root;
+        if (!test_bit(EXTENT_BUFFER_UPTODATE, &tree_root->node->bflags)) {
+                printk(KERN_WARNING "btrfs: failed to read tree root on %s\n",
+                       sb->s_id);
+                goto fail_tree_root;
+        }
         btrfs_set_root_node(&tree_root->root_item, tree_root->node);
         tree_root->commit_root = btrfs_root_node(tree_root);
 
@@ -2322,6 +2333,9 @@ int close_ctree(struct btrfs_root *root)
                         printk(KERN_ERR "btrfs: commit super ret %d\n", ret);
         }
 
+        fs_info->closing = 2;
+        smp_mb();
+
         if (fs_info->delalloc_bytes) {
                 printk(KERN_INFO "btrfs: at unmount delalloc count %llu\n",
                        (unsigned long long)fs_info->delalloc_bytes);
@@ -2343,6 +2357,7 @@ int close_ctree(struct btrfs_root *root)
         free_extent_buffer(root->fs_info->csum_root->commit_root);
 
         btrfs_free_block_groups(root->fs_info);
+        btrfs_free_pinned_extents(root->fs_info);
 
         del_fs_roots(fs_info);
 
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index a5aca3997d42..fadf69a2764b 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -21,6 +21,7 @@
 #include <linux/blkdev.h>
 #include <linux/sort.h>
 #include <linux/rcupdate.h>
+#include <linux/kthread.h>
 #include "compat.h"
 #include "hash.h"
 #include "ctree.h"
@@ -61,6 +62,13 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
                           struct btrfs_root *extent_root, u64 alloc_bytes,
                           u64 flags, int force);
 
+static noinline int
+block_group_cache_done(struct btrfs_block_group_cache *cache)
+{
+        smp_mb();
+        return cache->cached == BTRFS_CACHE_FINISHED;
+}
+
 static int block_group_bits(struct btrfs_block_group_cache *cache, u64 bits)
 {
         return (cache->flags & bits) == bits;
@@ -146,20 +154,70 @@ block_group_cache_tree_search(struct btrfs_fs_info *info, u64 bytenr,
 }
 
 /*
+ * We always set EXTENT_LOCKED for the super mirror extents so we don't
+ * overwrite them, so those bits need to be unset.  Also, if we are unmounting
+ * with pinned extents still sitting there because we had a block group caching,
+ * we need to clear those now, since we are done.
+ */
+void btrfs_free_pinned_extents(struct btrfs_fs_info *info)
+{
+        u64 start, end, last = 0;
+        int ret;
+
+        while (1) {
+                ret = find_first_extent_bit(&info->pinned_extents, last,
+                                            &start, &end,
+                                            EXTENT_LOCKED|EXTENT_DIRTY);
+                if (ret)
+                        break;
+
+                clear_extent_bits(&info->pinned_extents, start, end,
+                                  EXTENT_LOCKED|EXTENT_DIRTY, GFP_NOFS);
+                last = end+1;
+        }
+}
+
+static int remove_sb_from_cache(struct btrfs_root *root,
+                                struct btrfs_block_group_cache *cache)
+{
+        struct btrfs_fs_info *fs_info = root->fs_info;
+        u64 bytenr;
+        u64 *logical;
+        int stripe_len;
+        int i, nr, ret;
+
+        for (i = 0; i < BTRFS_SUPER_MIRROR_MAX; i++) {
+                bytenr = btrfs_sb_offset(i);
+                ret = btrfs_rmap_block(&root->fs_info->mapping_tree,
+                                       cache->key.objectid, bytenr,
+                                       0, &logical, &nr, &stripe_len);
+                BUG_ON(ret);
+                while (nr--) {
+                        try_lock_extent(&fs_info->pinned_extents,
+                                        logical[nr],
+                                        logical[nr] + stripe_len - 1, GFP_NOFS);
+                }
+                kfree(logical);
+        }
+
+        return 0;
+}
+
+/*
  * this is only called by cache_block_group, since we could have freed extents
  * we need to check the pinned_extents for any extents that can't be used yet
  * since their free space will be released as soon as the transaction commits.
  */
-static int add_new_free_space(struct btrfs_block_group_cache *block_group,
+static u64 add_new_free_space(struct btrfs_block_group_cache *block_group,
                               struct btrfs_fs_info *info, u64 start, u64 end)
 {
-        u64 extent_start, extent_end, size;
+        u64 extent_start, extent_end, size, total_added = 0;
         int ret;
 
         while (start < end) {
                 ret = find_first_extent_bit(&info->pinned_extents, start,
                                             &extent_start, &extent_end,
-                                            EXTENT_DIRTY);
+                                            EXTENT_DIRTY|EXTENT_LOCKED);
                 if (ret)
                         break;
 
@@ -167,6 +225,7 @@ static int add_new_free_space(struct btrfs_block_group_cache *block_group,
                         start = extent_end + 1;
                 } else if (extent_start > start && extent_start < end) {
                         size = extent_start - start;
+                        total_added += size;
                         ret = btrfs_add_free_space(block_group, start,
                                                    size);
                         BUG_ON(ret);
@@ -178,84 +237,79 @@ static int add_new_free_space(struct btrfs_block_group_cache *block_group,
 
         if (start < end) {
                 size = end - start;
+                total_added += size;
                 ret = btrfs_add_free_space(block_group, start, size);
                 BUG_ON(ret);
         }
 
-        return 0;
+        return total_added;
 }
 
-static int remove_sb_from_cache(struct btrfs_root *root,
-                                struct btrfs_block_group_cache *cache)
-{
-        u64 bytenr;
-        u64 *logical;
-        int stripe_len;
-        int i, nr, ret;
-
-        for (i = 0; i < BTRFS_SUPER_MIRROR_MAX; i++) {
-                bytenr = btrfs_sb_offset(i);
-                ret = btrfs_rmap_block(&root->fs_info->mapping_tree,
-                                       cache->key.objectid, bytenr, 0,
-                                       &logical, &nr, &stripe_len);
-                BUG_ON(ret);
-                while (nr--) {
-                        btrfs_remove_free_space(cache, logical[nr],
-                                                stripe_len);
-                }
-                kfree(logical);
-        }
-        return 0;
-}
-
-static int cache_block_group(struct btrfs_root *root,
-                             struct btrfs_block_group_cache *block_group)
+static int caching_kthread(void *data)
 {
+        struct btrfs_block_group_cache *block_group = data;
+        struct btrfs_fs_info *fs_info = block_group->fs_info;
+        u64 last = 0;
         struct btrfs_path *path;
         int ret = 0;
         struct btrfs_key key;
         struct extent_buffer *leaf;
         int slot;
-        u64 last;
-
-        if (!block_group)
-                return 0;
+        u64 total_found = 0;
 
-        root = root->fs_info->extent_root;
-
-        if (block_group->cached)
-                return 0;
+        BUG_ON(!fs_info);
 
         path = btrfs_alloc_path();
         if (!path)
                 return -ENOMEM;
 
-        path->reada = 2;
+        atomic_inc(&block_group->space_info->caching_threads);
+        last = max_t(u64, block_group->key.objectid, BTRFS_SUPER_INFO_OFFSET);
+again:
+        /* need to make sure the commit_root doesn't disappear */
+        down_read(&fs_info->extent_root->commit_root_sem);
+
         /*
-         * we get into deadlocks with paths held by callers of this function.
-         * since the alloc_mutex is protecting things right now, just
-         * skip the locking here
+         * We don't want to deadlock with somebody trying to allocate a new
+         * extent for the extent root while also trying to search the extent
+         * root to add free space.  So we skip locking and search the commit
+         * root, since its read-only
          */
         path->skip_locking = 1;
-        last = max_t(u64, block_group->key.objectid, BTRFS_SUPER_INFO_OFFSET);
+        path->search_commit_root = 1;
+        path->reada = 2;
+
         key.objectid = last;
         key.offset = 0;
         btrfs_set_key_type(&key, BTRFS_EXTENT_ITEM_KEY);
-        ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+        ret = btrfs_search_slot(NULL, fs_info->extent_root, &key, path, 0, 0);
         if (ret < 0)
                 goto err;
 
         while (1) {
+                smp_mb();
+                if (block_group->fs_info->closing > 1) {
+                        last = (u64)-1;
+                        break;
+                }
+
                 leaf = path->nodes[0];
                 slot = path->slots[0];
                 if (slot >= btrfs_header_nritems(leaf)) {
-                        ret = btrfs_next_leaf(root, path);
+                        ret = btrfs_next_leaf(fs_info->extent_root, path);
                         if (ret < 0)
                                 goto err;
-                        if (ret == 0)
-                                continue;
-                        else
+                        else if (ret)
                                 break;
+
+                        if (need_resched()) {
+                                btrfs_release_path(fs_info->extent_root, path);
+                                up_read(&fs_info->extent_root->commit_root_sem);
+                                cond_resched();
+                                goto again;
+                        }
+
+                        continue;
                 }
                 btrfs_item_key_to_cpu(leaf, &key, slot);
                 if (key.objectid < block_group->key.objectid)
@@ -266,24 +320,59 @@ static int cache_block_group(struct btrfs_root *root,
                         break;
 
                 if (btrfs_key_type(&key) == BTRFS_EXTENT_ITEM_KEY) {
-                        add_new_free_space(block_group, root->fs_info, last,
-                                           key.objectid);
-
+                        total_found += add_new_free_space(block_group,
+                                                          fs_info, last,
+                                                          key.objectid);
                         last = key.objectid + key.offset;
                 }
+
+                if (total_found > (1024 * 1024 * 2)) {
+                        total_found = 0;
+                        wake_up(&block_group->caching_q);
+                }
 next:
                 path->slots[0]++;
         }
+        ret = 0;
 
-        add_new_free_space(block_group, root->fs_info, last,
-                           block_group->key.objectid +
-                           block_group->key.offset);
+        total_found += add_new_free_space(block_group, fs_info, last,
+                                          block_group->key.objectid +
+                                          block_group->key.offset);
+
+        spin_lock(&block_group->lock);
+        block_group->cached = BTRFS_CACHE_FINISHED;
+        spin_unlock(&block_group->lock);
 
-        block_group->cached = 1;
-        remove_sb_from_cache(root, block_group);
-        ret = 0;
 err:
         btrfs_free_path(path);
+        up_read(&fs_info->extent_root->commit_root_sem);
+        atomic_dec(&block_group->space_info->caching_threads);
+        wake_up(&block_group->caching_q);
+
+        return 0;
+}
+
+static int cache_block_group(struct btrfs_block_group_cache *cache)
+{
+        struct task_struct *tsk;
+        int ret = 0;
+
+        spin_lock(&cache->lock);
+        if (cache->cached != BTRFS_CACHE_NO) {
+                spin_unlock(&cache->lock);
+                return ret;
+        }
+        cache->cached = BTRFS_CACHE_STARTED;
+        spin_unlock(&cache->lock);
+
+        tsk = kthread_run(caching_kthread, cache, "btrfs-cache-%llu\n",
+                          cache->key.objectid);
+        if (IS_ERR(tsk)) {
+                ret = PTR_ERR(tsk);
+                printk(KERN_ERR "error running thread %d\n", ret);
+                BUG();
+        }
+
         return ret;
 }
 
@@ -2387,13 +2476,29 @@ fail:
 
 }
 
+static struct btrfs_block_group_cache *
+next_block_group(struct btrfs_root *root,
+                 struct btrfs_block_group_cache *cache)
+{
+        struct rb_node *node;
+        spin_lock(&root->fs_info->block_group_cache_lock);
+        node = rb_next(&cache->cache_node);
+        btrfs_put_block_group(cache);
+        if (node) {
+                cache = rb_entry(node, struct btrfs_block_group_cache,
+                                 cache_node);
+                atomic_inc(&cache->count);
+        } else
+                cache = NULL;
+        spin_unlock(&root->fs_info->block_group_cache_lock);
+        return cache;
+}
+
 int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root)
 {
-        struct btrfs_block_group_cache *cache, *entry;
-        struct rb_node *n;
+        struct btrfs_block_group_cache *cache;
         int err = 0;
-        int werr = 0;
         struct btrfs_path *path;
         u64 last = 0;
 
@@ -2402,39 +2507,35 @@ int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans,
                 return -ENOMEM;
 
         while (1) {
-                cache = NULL;
-                spin_lock(&root->fs_info->block_group_cache_lock);
-                for (n = rb_first(&root->fs_info->block_group_cache_tree);
-                     n; n = rb_next(n)) {
-                        entry = rb_entry(n, struct btrfs_block_group_cache,
-                                         cache_node);
-                        if (entry->dirty) {
-                                cache = entry;
-                                break;
-                        }
+                if (last == 0) {
+                        err = btrfs_run_delayed_refs(trans, root,
+                                                     (unsigned long)-1);
+                        BUG_ON(err);
                 }
-                spin_unlock(&root->fs_info->block_group_cache_lock);
 
-                if (!cache)
-                        break;
+                cache = btrfs_lookup_first_block_group(root->fs_info, last);
+                while (cache) {
+                        if (cache->dirty)
+                                break;
+                        cache = next_block_group(root, cache);
+                }
+                if (!cache) {
+                        if (last == 0)
+                                break;
+                        last = 0;
+                        continue;
+                }
 
                 cache->dirty = 0;
-                last += cache->key.offset;
+                last = cache->key.objectid + cache->key.offset;
 
-                err = write_one_cache_group(trans, root,
-                                            path, cache);
-                /*
-                 * if we fail to write the cache group, we want
-                 * to keep it marked dirty in hopes that a later
-                 * write will work
-                 */
-                if (err) {
-                        werr = err;
-                        continue;
-                }
+                err = write_one_cache_group(trans, root, path, cache);
+                BUG_ON(err);
+                btrfs_put_block_group(cache);
         }
+
         btrfs_free_path(path);
-        return werr;
+        return 0;
 }
 
 int btrfs_extent_readonly(struct btrfs_root *root, u64 bytenr)
@@ -2484,6 +2585,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
         found->force_alloc = 0;
         *space_info = found;
         list_add_rcu(&found->list, &info->space_info);
+        atomic_set(&found->caching_threads, 0);
         return 0;
 }
 
@@ -2947,13 +3049,9 @@ int btrfs_update_pinned_extents(struct btrfs_root *root,
         struct btrfs_block_group_cache *cache;
         struct btrfs_fs_info *fs_info = root->fs_info;
 
-        if (pin) {
+        if (pin)
                 set_extent_dirty(&fs_info->pinned_extents,
                                 bytenr, bytenr + num - 1, GFP_NOFS);
-        } else {
-                clear_extent_dirty(&fs_info->pinned_extents,
-                                bytenr, bytenr + num - 1, GFP_NOFS);
-        }
 
         while (num > 0) {
                 cache = btrfs_lookup_block_group(fs_info, bytenr);
@@ -2969,14 +3067,34 @@ int btrfs_update_pinned_extents(struct btrfs_root *root,
                         spin_unlock(&cache->space_info->lock);
                         fs_info->total_pinned += len;
                 } else {
+                        int unpin = 0;
+
+                        /*
+                         * in order to not race with the block group caching, we
+                         * only want to unpin the extent if we are cached.  If
+                         * we aren't cached, we want to start async caching this
+                         * block group so we can free the extent the next time
+                         * around.
+                         */
                         spin_lock(&cache->space_info->lock);
                         spin_lock(&cache->lock);
-                        cache->pinned -= len;
-                        cache->space_info->bytes_pinned -= len;
+                        unpin = (cache->cached == BTRFS_CACHE_FINISHED);
+                        if (likely(unpin)) {
+                                cache->pinned -= len;
+                                cache->space_info->bytes_pinned -= len;
+                                fs_info->total_pinned -= len;
+                        }
                         spin_unlock(&cache->lock);
                         spin_unlock(&cache->space_info->lock);
-                        fs_info->total_pinned -= len;
-                        if (cache->cached)
+
+                        if (likely(unpin))
+                                clear_extent_dirty(&fs_info->pinned_extents,
+                                                   bytenr, bytenr + len -1,
+                                                   GFP_NOFS);
+                        else
+                                cache_block_group(cache);
+
+                        if (unpin)
                                 btrfs_add_free_space(cache, bytenr, len);
                 }
                 btrfs_put_block_group(cache);
@@ -3030,6 +3148,7 @@ int btrfs_copy_pinned(struct btrfs_root *root, struct extent_io_tree *copy)
                                             &start, &end, EXTENT_DIRTY);
                 if (ret)
                         break;
+
                 set_extent_dirty(copy, start, end, GFP_NOFS);
                 last = end + 1;
         }
@@ -3058,6 +3177,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans,
 
                 cond_resched();
         }
+
         return ret;
 }
 
@@ -3436,6 +3556,45 @@ static u64 stripe_align(struct btrfs_root *root, u64 val)
 }
 
 /*
+ * when we wait for progress in the block group caching, its because
+ * our allocation attempt failed at least once.  So, we must sleep
+ * and let some progress happen before we try again.
+ *
+ * This function will sleep at least once waiting for new free space to
+ * show up, and then it will check the block group free space numbers
+ * for our min num_bytes.  Another option is to have it go ahead
+ * and look in the rbtree for a free extent of a given size, but this
+ * is a good start.
+ */
+static noinline int
+wait_block_group_cache_progress(struct btrfs_block_group_cache *cache,
+                                u64 num_bytes)
+{
+        DEFINE_WAIT(wait);
+
+        prepare_to_wait(&cache->caching_q, &wait, TASK_UNINTERRUPTIBLE);
+
+        if (block_group_cache_done(cache)) {
+                finish_wait(&cache->caching_q, &wait);
+                return 0;
+        }
+        schedule();
+        finish_wait(&cache->caching_q, &wait);
+
+        wait_event(cache->caching_q, block_group_cache_done(cache) ||
+                   (cache->free_space >= num_bytes));
+        return 0;
+}
+
+enum btrfs_loop_type {
+        LOOP_CACHED_ONLY = 0,
+        LOOP_CACHING_NOWAIT = 1,
+        LOOP_CACHING_WAIT = 2,
+        LOOP_ALLOC_CHUNK = 3,
+        LOOP_NO_EMPTY_SIZE = 4,
+};
+
+/*
  * walks the btree of allocated extents and find a hole of a given size.
  * The key ins is changed to record the hole:
  * ins->objectid == block start
@@ -3460,6 +3619,7 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         struct btrfs_space_info *space_info;
         int last_ptr_loop = 0;
         int loop = 0;
+        bool found_uncached_bg = false;
 
         WARN_ON(num_bytes < root->sectorsize);
         btrfs_set_key_type(ins, BTRFS_EXTENT_ITEM_KEY);
@@ -3491,15 +3651,18 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         search_start = max(search_start, first_logical_byte(root, 0));
         search_start = max(search_start, hint_byte);
 
-        if (!last_ptr) {
+        if (!last_ptr)
                 empty_cluster = 0;
-                loop = 1;
-        }
 
         if (search_start == hint_byte) {
                 block_group = btrfs_lookup_block_group(root->fs_info,
                                                        search_start);
-                if (block_group && block_group_bits(block_group, data)) {
+                /*
+                 * we don't want to use the block group if it doesn't match our
+                 * allocation bits, or if its not cached.
+                 */
+                if (block_group && block_group_bits(block_group, data) &&
+                    block_group_cache_done(block_group)) {
                         down_read(&space_info->groups_sem);
                         if (list_empty(&block_group->list) ||
                             block_group->ro) {
@@ -3522,21 +3685,35 @@ search:
         down_read(&space_info->groups_sem);
         list_for_each_entry(block_group, &space_info->block_groups, list) {
                 u64 offset;
+                int cached;
 
                 atomic_inc(&block_group->count);
                 search_start = block_group->key.objectid;
 
 have_block_group:
-                if (unlikely(!block_group->cached)) {
-                        mutex_lock(&block_group->cache_mutex);
-                        ret = cache_block_group(root, block_group);
-                        mutex_unlock(&block_group->cache_mutex);
-                        if (ret) {
-                                btrfs_put_block_group(block_group);
-                                break;
+                if (unlikely(block_group->cached == BTRFS_CACHE_NO)) {
+                        /*
+                         * we want to start caching kthreads, but not too many
+                         * right off the bat so we don't overwhelm the system,
+                         * so only start them if there are less than 2 and we're
+                         * in the initial allocation phase.
+                         */
+                        if (loop > LOOP_CACHING_NOWAIT ||
+                            atomic_read(&space_info->caching_threads) < 2) {
+                                ret = cache_block_group(block_group);
+                                BUG_ON(ret);
                         }
                 }
 
+                cached = block_group_cache_done(block_group);
+                if (unlikely(!cached)) {
+                        found_uncached_bg = true;
+
+                        /* if we only want cached bgs, loop */
+                        if (loop == LOOP_CACHED_ONLY)
+                                goto loop;
+                }
+
                 if (unlikely(block_group->ro))
                         goto loop;
 
@@ -3615,14 +3792,21 @@ refill_cluster:
                                         spin_unlock(&last_ptr->refill_lock);
                                         goto checks;
                                 }
+                        } else if (!cached && loop > LOOP_CACHING_NOWAIT) {
+                                spin_unlock(&last_ptr->refill_lock);
+
+                                wait_block_group_cache_progress(block_group,
+                                       num_bytes + empty_cluster + empty_size);
+                                goto have_block_group;
                         }
+
                         /*
                          * at this point we either didn't find a cluster
                          * or we weren't able to allocate a block from our
                          * cluster.  Free the cluster we've been trying
                          * to use, and go to the next block group
                          */
-                        if (loop < 2) {
+                        if (loop < LOOP_NO_EMPTY_SIZE) {
                                 btrfs_return_cluster_to_free_space(NULL,
                                                                    last_ptr);
                                 spin_unlock(&last_ptr->refill_lock);
@@ -3633,11 +3817,17 @@ refill_cluster:
 
                 offset = btrfs_find_space_for_alloc(block_group, search_start,
                                                     num_bytes, empty_size);
-                if (!offset)
+                if (!offset && (cached || (!cached &&
+                                           loop == LOOP_CACHING_NOWAIT))) {
                         goto loop;
+                } else if (!offset && (!cached &&
+                                       loop > LOOP_CACHING_NOWAIT)) {
+                        wait_block_group_cache_progress(block_group,
+                                        num_bytes + empty_size);
+                        goto have_block_group;
+                }
 checks:
                 search_start = stripe_align(root, offset);
-
                 /* move on to the next group */
                 if (search_start + num_bytes >= search_end) {
                         btrfs_add_free_space(block_group, offset, num_bytes);
@@ -3683,13 +3873,26 @@ loop:
         }
         up_read(&space_info->groups_sem);
 
-        /* loop == 0, try to find a clustered alloc in every block group
-         * loop == 1, try again after forcing a chunk allocation
-         * loop == 2, set empty_size and empty_cluster to 0 and try again
+        /* LOOP_CACHED_ONLY, only search fully cached block groups
+         * LOOP_CACHING_NOWAIT, search partially cached block groups, but
+         *                      dont wait foR them to finish caching
+         * LOOP_CACHING_WAIT, search everything, and wait if our bg is caching
+         * LOOP_ALLOC_CHUNK, force a chunk allocation and try again
+         * LOOP_NO_EMPTY_SIZE, set empty_size and empty_cluster to 0 and try
+         *                      again
          */
-        if (!ins->objectid && loop < 3 &&
-            (empty_size || empty_cluster || allowed_chunk_alloc)) {
-                if (loop >= 2) {
+        if (!ins->objectid && loop < LOOP_NO_EMPTY_SIZE &&
+            (found_uncached_bg || empty_size || empty_cluster ||
+             allowed_chunk_alloc)) {
+                if (found_uncached_bg) {
+                        found_uncached_bg = false;
+                        if (loop < LOOP_CACHING_WAIT) {
+                                loop++;
+                                goto search;
+                        }
+                }
+
+                if (loop == LOOP_ALLOC_CHUNK) {
                         empty_size = 0;
                         empty_cluster = 0;
                 }
@@ -3702,7 +3905,7 @@ loop:
                         space_info->force_alloc = 1;
                 }
 
-                if (loop < 3) {
+                if (loop < LOOP_NO_EMPTY_SIZE) {
                         loop++;
                         goto search;
                 }
@@ -3798,7 +4001,7 @@ again:
                                num_bytes, data, 1);
                 goto again;
         }
-        if (ret) {
+        if (ret == -ENOSPC) {
                 struct btrfs_space_info *sinfo;
 
                 sinfo = __find_space_info(root->fs_info, data);
@@ -3806,7 +4009,6 @@ again:
                        "wanted %llu\n", (unsigned long long)data,
                        (unsigned long long)num_bytes);
                 dump_space_info(sinfo, num_bytes);
-                BUG();
         }
 
         return ret;
@@ -3844,7 +4046,9 @@ int btrfs_reserve_extent(struct btrfs_trans_handle *trans,
         ret = __btrfs_reserve_extent(trans, root, num_bytes, min_alloc_size,
                                      empty_size, hint_byte, search_end, ins,
                                      data);
-        update_reserved_extents(root, ins->objectid, ins->offset, 1);
+        if (!ret)
+                update_reserved_extents(root, ins->objectid, ins->offset, 1);
+
         return ret;
 }
 
@@ -4006,9 +4210,9 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
         struct btrfs_block_group_cache *block_group;
 
         block_group = btrfs_lookup_block_group(root->fs_info, ins->objectid);
-        mutex_lock(&block_group->cache_mutex);
-        cache_block_group(root, block_group);
-        mutex_unlock(&block_group->cache_mutex);
+        cache_block_group(block_group);
+        wait_event(block_group->caching_q,
+                   block_group_cache_done(block_group));
 
         ret = btrfs_remove_free_space(block_group, ins->objectid,
                                       ins->offset);
@@ -4039,7 +4243,8 @@ static int alloc_tree_block(struct btrfs_trans_handle *trans,
         ret = __btrfs_reserve_extent(trans, root, num_bytes, num_bytes,
                                      empty_size, hint_byte, search_end,
                                      ins, 0);
-        BUG_ON(ret);
+        if (ret)
+                return ret;
 
         if (root_objectid == BTRFS_TREE_RELOC_OBJECTID) {
                 if (parent == 0)
@@ -6955,11 +7160,16 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
                          &info->block_group_cache_tree);
                 spin_unlock(&info->block_group_cache_lock);
 
-                btrfs_remove_free_space_cache(block_group);
                 down_write(&block_group->space_info->groups_sem);
                 list_del(&block_group->list);
                 up_write(&block_group->space_info->groups_sem);
 
+                if (block_group->cached == BTRFS_CACHE_STARTED)
+                        wait_event(block_group->caching_q,
+                                   block_group_cache_done(block_group));
+
+                btrfs_remove_free_space_cache(block_group);
+
                 WARN_ON(atomic_read(&block_group->count) != 1);
                 kfree(block_group);
 
@@ -7025,9 +7235,19 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                 atomic_set(&cache->count, 1);
                 spin_lock_init(&cache->lock);
                 spin_lock_init(&cache->tree_lock);
-                mutex_init(&cache->cache_mutex);
+                cache->fs_info = info;
+                init_waitqueue_head(&cache->caching_q);
                 INIT_LIST_HEAD(&cache->list);
                 INIT_LIST_HEAD(&cache->cluster_list);
+
+                /*
+                 * we only want to have 32k of ram per block group for keeping
+                 * track of free space, and if we pass 1/2 of that we want to
+                 * start converting things over to using bitmaps
+                 */
+                cache->extents_thresh = ((1024 * 32) / 2) /
+                        sizeof(struct btrfs_free_space);
+
                 read_extent_buffer(leaf, &cache->item,
                                    btrfs_item_ptr_offset(leaf, path->slots[0]),
                                    sizeof(cache->item));
@@ -7036,6 +7256,26 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                 key.objectid = found_key.objectid + found_key.offset;
                 btrfs_release_path(root, path);
                 cache->flags = btrfs_block_group_flags(&cache->item);
+                cache->sectorsize = root->sectorsize;
+
+                remove_sb_from_cache(root, cache);
+
+                /*
+                 * check for two cases, either we are full, and therefore
+                 * don't need to bother with the caching work since we won't
+                 * find any space, or we are empty, and we can just add all
+                 * the space in and be done with it.  This saves us _alot_ of
+                 * time, particularly in the full case.
+                 */
+                if (found_key.offset == btrfs_block_group_used(&cache->item)) {
+                        cache->cached = BTRFS_CACHE_FINISHED;
+                } else if (btrfs_block_group_used(&cache->item) == 0) {
+                        cache->cached = BTRFS_CACHE_FINISHED;
+                        add_new_free_space(cache, root->fs_info,
+                                           found_key.objectid,
+                                           found_key.objectid +
+                                           found_key.offset);
+                }
 
                 ret = update_space_info(info, cache->flags, found_key.offset,
                                         btrfs_block_group_used(&cache->item),
@@ -7079,10 +7319,19 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
         cache->key.objectid = chunk_offset;
         cache->key.offset = size;
         cache->key.type = BTRFS_BLOCK_GROUP_ITEM_KEY;
+        cache->sectorsize = root->sectorsize;
+
+        /*
+         * we only want to have 32k of ram per block group for keeping track
+         * of free space, and if we pass 1/2 of that we want to start
+         * converting things over to using bitmaps
+         */
+        cache->extents_thresh = ((1024 * 32) / 2) /
+                sizeof(struct btrfs_free_space);
         atomic_set(&cache->count, 1);
         spin_lock_init(&cache->lock);
         spin_lock_init(&cache->tree_lock);
-        mutex_init(&cache->cache_mutex);
+        init_waitqueue_head(&cache->caching_q);
         INIT_LIST_HEAD(&cache->list);
         INIT_LIST_HEAD(&cache->cluster_list);
 
@@ -7091,6 +7340,12 @@ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
         cache->flags = type;
         btrfs_set_block_group_flags(&cache->item, type);
 
+        cache->cached = BTRFS_CACHE_FINISHED;
+        remove_sb_from_cache(root, cache);
+
+        add_new_free_space(cache, root->fs_info, chunk_offset,
+                           chunk_offset + size);
+
         ret = update_space_info(root->fs_info, cache->flags, size, bytes_used,
                                 &cache->space_info);
         BUG_ON(ret);
@@ -7149,7 +7404,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         rb_erase(&block_group->cache_node,
                  &root->fs_info->block_group_cache_tree);
         spin_unlock(&root->fs_info->block_group_cache_lock);
-        btrfs_remove_free_space_cache(block_group);
+
         down_write(&block_group->space_info->groups_sem);
         /*
          * we must use list_del_init so people can check to see if they
@@ -7158,11 +7413,18 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         list_del_init(&block_group->list);
         up_write(&block_group->space_info->groups_sem);
 
+        if (block_group->cached == BTRFS_CACHE_STARTED)
+                wait_event(block_group->caching_q,
+                           block_group_cache_done(block_group));
+
+        btrfs_remove_free_space_cache(block_group);
+
         spin_lock(&block_group->space_info->lock);
         block_group->space_info->total_bytes -= block_group->key.offset;
         block_group->space_info->bytes_readonly -= block_group->key.offset;
         spin_unlock(&block_group->space_info->lock);
-        block_group->space_info->full = 0;
+
+        btrfs_clear_space_info_full(root->fs_info);
 
         btrfs_put_block_group(block_group);
         btrfs_put_block_group(block_group);
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 4538e48581a5..af99b78b288e 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -16,45 +16,46 @@
  * Boston, MA 021110-1307, USA.
  */
 
+#include <linux/pagemap.h>
 #include <linux/sched.h>
+#include <linux/math64.h>
 #include "ctree.h"
 #include "free-space-cache.h"
 #include "transaction.h"
 
-struct btrfs_free_space {
-        struct rb_node bytes_index;
-        struct rb_node offset_index;
-        u64 offset;
-        u64 bytes;
-};
+#define BITS_PER_BITMAP         (PAGE_CACHE_SIZE * 8)
+#define MAX_CACHE_BYTES_PER_GIG (32 * 1024)
 
-static int tree_insert_offset(struct rb_root *root, u64 offset,
-                              struct rb_node *node)
+static inline unsigned long offset_to_bit(u64 bitmap_start, u64 sectorsize,
+                                          u64 offset)
 {
-        struct rb_node **p = &root->rb_node;
-        struct rb_node *parent = NULL;
-        struct btrfs_free_space *info;
+        BUG_ON(offset < bitmap_start);
+        offset -= bitmap_start;
+        return (unsigned long)(div64_u64(offset, sectorsize));
+}
 
-        while (*p) {
-                parent = *p;
-                info = rb_entry(parent, struct btrfs_free_space, offset_index);
+static inline unsigned long bytes_to_bits(u64 bytes, u64 sectorsize)
+{
+        return (unsigned long)(div64_u64(bytes, sectorsize));
+}
 
-                if (offset < info->offset)
-                        p = &(*p)->rb_left;
-                else if (offset > info->offset)
-                        p = &(*p)->rb_right;
-                else
-                        return -EEXIST;
-        }
+static inline u64 offset_to_bitmap(struct btrfs_block_group_cache *block_group,
+                                   u64 offset)
+{
+        u64 bitmap_start;
+        u64 bytes_per_bitmap;
 
-        rb_link_node(node, parent, p);
-        rb_insert_color(node, root);
+        bytes_per_bitmap = BITS_PER_BITMAP * block_group->sectorsize;
+        bitmap_start = offset - block_group->key.objectid;
+        bitmap_start = div64_u64(bitmap_start, bytes_per_bitmap);
+        bitmap_start *= bytes_per_bitmap;
+        bitmap_start += block_group->key.objectid;
 
-        return 0;
+        return bitmap_start;
 }
 
-static int tree_insert_bytes(struct rb_root *root, u64 bytes,
-                             struct rb_node *node)
+static int tree_insert_offset(struct rb_root *root, u64 offset,
+                              struct rb_node *node, int bitmap)
 {
         struct rb_node **p = &root->rb_node;
         struct rb_node *parent = NULL;
@@ -62,12 +63,34 @@ static int tree_insert_bytes(struct rb_root *root, u64 bytes,
 
         while (*p) {
                 parent = *p;
-                info = rb_entry(parent, struct btrfs_free_space, bytes_index);
+                info = rb_entry(parent, struct btrfs_free_space, offset_index);
 
-                if (bytes < info->bytes)
+                if (offset < info->offset) {
                         p = &(*p)->rb_left;
-                else
+                } else if (offset > info->offset) {
                         p = &(*p)->rb_right;
+                } else {
+                        /*
+                         * we could have a bitmap entry and an extent entry
+                         * share the same offset.  If this is the case, we want
+                         * the extent entry to always be found first if we do a
+                         * linear search through the tree, since we want to have
+                         * the quickest allocation time, and allocating from an
+                         * extent is faster than allocating from a bitmap.  So
+                         * if we're inserting a bitmap and we find an entry at
+                         * this offset, we want to go right, or after this entry
+                         * logically.  If we are inserting an extent and we've
+                         * found a bitmap, we want to go left, or before
+                         * logically.
+                         */
+                        if (bitmap) {
+                                WARN_ON(info->bitmap);
+                                p = &(*p)->rb_right;
+                        } else {
+                                WARN_ON(!info->bitmap);
+                                p = &(*p)->rb_left;
+                        }
+                }
         }
 
         rb_link_node(node, parent, p);
@@ -79,110 +102,143 @@ static int tree_insert_bytes(struct rb_root *root, u64 bytes,
 /*
  * searches the tree for the given offset.
  *
- * fuzzy == 1: this is used for allocations where we are given a hint of where
- * to look for free space.  Because the hint may not be completely on an offset
- * mark, or the hint may no longer point to free space we need to fudge our
- * results a bit.  So we look for free space starting at or after offset with at
- * least bytes size.  We prefer to find as close to the given offset as we can.
- * Also if the offset is within a free space range, then we will return the free
- * space that contains the given offset, which means we can return a free space
- * chunk with an offset before the provided offset.
- *
- * fuzzy == 0: this is just a normal tree search.  Give us the free space that
- * starts at the given offset which is at least bytes size, and if its not there
- * return NULL.
+ * fuzzy - If this is set, then we are trying to make an allocation, and we just
+ * want a section that has at least bytes size and comes at or after the given
+ * offset.
  */
-static struct btrfs_free_space *tree_search_offset(struct rb_root *root,
-                                                   u64 offset, u64 bytes,
-                                                   int fuzzy)
+static struct btrfs_free_space *
+tree_search_offset(struct btrfs_block_group_cache *block_group,
+                   u64 offset, int bitmap_only, int fuzzy)
 {
-        struct rb_node *n = root->rb_node;
-        struct btrfs_free_space *entry, *ret = NULL;
+        struct rb_node *n = block_group->free_space_offset.rb_node;
+        struct btrfs_free_space *entry, *prev = NULL;
+
+        /* find entry that is closest to the 'offset' */
+        while (1) {
+                if (!n) {
+                        entry = NULL;
+                        break;
+                }
 
-        while (n) {
                 entry = rb_entry(n, struct btrfs_free_space, offset_index);
+                prev = entry;
 
-                if (offset < entry->offset) {
-                        if (fuzzy &&
-                            (!ret || entry->offset < ret->offset) &&
-                            (bytes <= entry->bytes))
-                                ret = entry;
+                if (offset < entry->offset)
                         n = n->rb_left;
-                } else if (offset > entry->offset) {
-                        if (fuzzy &&
-                            (entry->offset + entry->bytes - 1) >= offset &&
-                            bytes <= entry->bytes) {
-                                ret = entry;
-                                break;
-                        }
+                else if (offset > entry->offset)
                         n = n->rb_right;
-                } else {
-                        if (bytes > entry->bytes) {
-                                n = n->rb_right;
-                                continue;
-                        }
-                        ret = entry;
+                else
                         break;
-                }
         }
 
-        return ret;
-}
-
-/*
- * return a chunk at least bytes size, as close to offset that we can get.
- */
-static struct btrfs_free_space *tree_search_bytes(struct rb_root *root,
-                                                  u64 offset, u64 bytes)
-{
-        struct rb_node *n = root->rb_node;
-        struct btrfs_free_space *entry, *ret = NULL;
+        if (bitmap_only) {
+                if (!entry)
+                        return NULL;
+                if (entry->bitmap)
+                        return entry;
 
-        while (n) {
-                entry = rb_entry(n, struct btrfs_free_space, bytes_index);
+                /*
+                 * bitmap entry and extent entry may share same offset,
+                 * in that case, bitmap entry comes after extent entry.
+                 */
+                n = rb_next(n);
+                if (!n)
+                        return NULL;
+                entry = rb_entry(n, struct btrfs_free_space, offset_index);
+                if (entry->offset != offset)
+                        return NULL;
 
-                if (bytes < entry->bytes) {
+                WARN_ON(!entry->bitmap);
+                return entry;
+        } else if (entry) {
+                if (entry->bitmap) {
                         /*
-                         * We prefer to get a hole size as close to the size we
-                         * are asking for so we don't take small slivers out of
-                         * huge holes, but we also want to get as close to the
-                         * offset as possible so we don't have a whole lot of
-                         * fragmentation.
+                         * if previous extent entry covers the offset,
+                         * we should return it instead of the bitmap entry
                          */
-                        if (offset <= entry->offset) {
-                                if (!ret)
-                                        ret = entry;
-                                else if (entry->bytes < ret->bytes)
-                                        ret = entry;
-                                else if (entry->offset < ret->offset)
-                                        ret = entry;
+                        n = &entry->offset_index;
+                        while (1) {
+                                n = rb_prev(n);
+                                if (!n)
+                                        break;
+                                prev = rb_entry(n, struct btrfs_free_space,
+                                                offset_index);
+                                if (!prev->bitmap) {
+                                        if (prev->offset + prev->bytes > offset)
+                                                entry = prev;
+                                        break;
+                                }
                         }
-                        n = n->rb_left;
-                } else if (bytes > entry->bytes) {
-                        n = n->rb_right;
+                }
+                return entry;
+        }
+
+        if (!prev)
+                return NULL;
+
+        /* find last entry before the 'offset' */
+        entry = prev;
+        if (entry->offset > offset) {
+                n = rb_prev(&entry->offset_index);
+                if (n) {
+                        entry = rb_entry(n, struct btrfs_free_space,
+                                        offset_index);
+                        BUG_ON(entry->offset > offset);
                 } else {
-                        /*
-                         * Ok we may have multiple chunks of the wanted size,
-                         * so we don't want to take the first one we find, we
-                         * want to take the one closest to our given offset, so
-                         * keep searching just in case theres a better match.
-                         */
-                        n = n->rb_right;
-                        if (offset > entry->offset)
-                                continue;
-                        else if (!ret || entry->offset < ret->offset)
-                                ret = entry;
+                        if (fuzzy)
+                                return entry;
+                        else
+                                return NULL;
                 }
         }
 
-        return ret;
+        if (entry->bitmap) {
+                n = &entry->offset_index;
+                while (1) {
+                        n = rb_prev(n);
+                        if (!n)
+                                break;
+                        prev = rb_entry(n, struct btrfs_free_space,
+                                        offset_index);
+                        if (!prev->bitmap) {
+                                if (prev->offset + prev->bytes > offset)
+                                        return prev;
+                                break;
+                        }
+                }
+                if (entry->offset + BITS_PER_BITMAP *
+                    block_group->sectorsize > offset)
+                        return entry;
+        } else if (entry->offset + entry->bytes > offset)
+                return entry;
+
+        if (!fuzzy)
+                return NULL;
+
+        while (1) {
+                if (entry->bitmap) {
+                        if (entry->offset + BITS_PER_BITMAP *
+                            block_group->sectorsize > offset)
+                                break;
+                } else {
+                        if (entry->offset + entry->bytes > offset)
+                                break;
+                }
+
+                n = rb_next(&entry->offset_index);
+                if (!n)
+                        return NULL;
+                entry = rb_entry(n, struct btrfs_free_space, offset_index);
+        }
+        return entry;
 }
 
 static void unlink_free_space(struct btrfs_block_group_cache *block_group,
                               struct btrfs_free_space *info)
 {
         rb_erase(&info->offset_index, &block_group->free_space_offset);
-        rb_erase(&info->bytes_index, &block_group->free_space_bytes);
+        block_group->free_extents--;
+        block_group->free_space -= info->bytes;
 }
 
 static int link_free_space(struct btrfs_block_group_cache *block_group,
@@ -190,17 +246,314 @@ static int link_free_space(struct btrfs_block_group_cache *block_group,
 {
         int ret = 0;
 
-
-        BUG_ON(!info->bytes);
+        BUG_ON(!info->bitmap && !info->bytes);
         ret = tree_insert_offset(&block_group->free_space_offset, info->offset,
-                                 &info->offset_index);
+                                 &info->offset_index, (info->bitmap != NULL));
         if (ret)
                 return ret;
 
-        ret = tree_insert_bytes(&block_group->free_space_bytes, info->bytes,
-                                &info->bytes_index);
-        if (ret)
-                return ret;
+        block_group->free_space += info->bytes;
+        block_group->free_extents++;
+        return ret;
+}
+
+static void recalculate_thresholds(struct btrfs_block_group_cache *block_group)
+{
+        u64 max_bytes, possible_bytes;
+
+        /*
+         * The goal is to keep the total amount of memory used per 1gb of space
+         * at or below 32k, so we need to adjust how much memory we allow to be
+         * used by extent based free space tracking
+         */
+        max_bytes = MAX_CACHE_BYTES_PER_GIG *
+                (div64_u64(block_group->key.offset, 1024 * 1024 * 1024));
+
+        possible_bytes = (block_group->total_bitmaps * PAGE_CACHE_SIZE) +
+                (sizeof(struct btrfs_free_space) *
+                 block_group->extents_thresh);
+
+        if (possible_bytes > max_bytes) {
+                int extent_bytes = max_bytes -
+                        (block_group->total_bitmaps * PAGE_CACHE_SIZE);
+
+                if (extent_bytes <= 0) {
+                        block_group->extents_thresh = 0;
+                        return;
+                }
+
+                block_group->extents_thresh = extent_bytes /
+                        (sizeof(struct btrfs_free_space));
+        }
+}
+
+static void bitmap_clear_bits(struct btrfs_block_group_cache *block_group,
+                              struct btrfs_free_space *info, u64 offset,
+                              u64 bytes)
+{
+        unsigned long start, end;
+        unsigned long i;
+
+        start = offset_to_bit(info->offset, block_group->sectorsize, offset);
+        end = start + bytes_to_bits(bytes, block_group->sectorsize);
+        BUG_ON(end > BITS_PER_BITMAP);
+
+        for (i = start; i < end; i++)
+                clear_bit(i, info->bitmap);
+
+        info->bytes -= bytes;
+        block_group->free_space -= bytes;
+}
+
+static void bitmap_set_bits(struct btrfs_block_group_cache *block_group,
+                            struct btrfs_free_space *info, u64 offset,
+                            u64 bytes)
+{
+        unsigned long start, end;
+        unsigned long i;
+
+        start = offset_to_bit(info->offset, block_group->sectorsize, offset);
+        end = start + bytes_to_bits(bytes, block_group->sectorsize);
+        BUG_ON(end > BITS_PER_BITMAP);
+
+        for (i = start; i < end; i++)
+                set_bit(i, info->bitmap);
+
+        info->bytes += bytes;
+        block_group->free_space += bytes;
+}
+
+static int search_bitmap(struct btrfs_block_group_cache *block_group,
+                         struct btrfs_free_space *bitmap_info, u64 *offset,
+                         u64 *bytes)
+{
+        unsigned long found_bits = 0;
+        unsigned long bits, i;
+        unsigned long next_zero;
+
+        i = offset_to_bit(bitmap_info->offset, block_group->sectorsize,
+                          max_t(u64, *offset, bitmap_info->offset));
+        bits = bytes_to_bits(*bytes, block_group->sectorsize);
+
+        for (i = find_next_bit(bitmap_info->bitmap, BITS_PER_BITMAP, i);
+             i < BITS_PER_BITMAP;
+             i = find_next_bit(bitmap_info->bitmap, BITS_PER_BITMAP, i + 1)) {
+                next_zero = find_next_zero_bit(bitmap_info->bitmap,
+                                               BITS_PER_BITMAP, i);
+                if ((next_zero - i) >= bits) {
+                        found_bits = next_zero - i;
+                        break;
+                }
+                i = next_zero;
+        }
+
+        if (found_bits) {
+                *offset = (u64)(i * block_group->sectorsize) +
+                        bitmap_info->offset;
+                *bytes = (u64)(found_bits) * block_group->sectorsize;
+                return 0;
+        }
+
+        return -1;
+}
+
+static struct btrfs_free_space *find_free_space(struct btrfs_block_group_cache
+                                                *block_group, u64 *offset,
+                                                u64 *bytes, int debug)
+{
+        struct btrfs_free_space *entry;
+        struct rb_node *node;
+        int ret;
+
+        if (!block_group->free_space_offset.rb_node)
+                return NULL;
+
+        entry = tree_search_offset(block_group,
+                                   offset_to_bitmap(block_group, *offset),
+                                   0, 1);
+        if (!entry)
+                return NULL;
+
+        for (node = &entry->offset_index; node; node = rb_next(node)) {
+                entry = rb_entry(node, struct btrfs_free_space, offset_index);
+                if (entry->bytes < *bytes)
+                        continue;
+
+                if (entry->bitmap) {
+                        ret = search_bitmap(block_group, entry, offset, bytes);
+                        if (!ret)
+                                return entry;
+                        continue;
+                }
+
+                *offset = entry->offset;
+                *bytes = entry->bytes;
+                return entry;
+        }
+
+        return NULL;
+}
+
+static void add_new_bitmap(struct btrfs_block_group_cache *block_group,
+                           struct btrfs_free_space *info, u64 offset)
+{
+        u64 bytes_per_bg = BITS_PER_BITMAP * block_group->sectorsize;
+        int max_bitmaps = (int)div64_u64(block_group->key.offset +
+                                         bytes_per_bg - 1, bytes_per_bg);
+        BUG_ON(block_group->total_bitmaps >= max_bitmaps);
+
+        info->offset = offset_to_bitmap(block_group, offset);
+        link_free_space(block_group, info);
+        block_group->total_bitmaps++;
+
+        recalculate_thresholds(block_group);
+}
+
+static noinline int remove_from_bitmap(struct btrfs_block_group_cache *block_group,
+                              struct btrfs_free_space *bitmap_info,
+                              u64 *offset, u64 *bytes)
+{
+        u64 end;
+
+again:
+        end = bitmap_info->offset +
+                (u64)(BITS_PER_BITMAP * block_group->sectorsize) - 1;
+
+        if (*offset > bitmap_info->offset && *offset + *bytes > end) {
+                bitmap_clear_bits(block_group, bitmap_info, *offset,
+                                  end - *offset + 1);
+                *bytes -= end - *offset + 1;
+                *offset = end + 1;
+        } else if (*offset >= bitmap_info->offset && *offset + *bytes <= end) {
+                bitmap_clear_bits(block_group, bitmap_info, *offset, *bytes);
+                *bytes = 0;
+        }
+
+        if (*bytes) {
+                if (!bitmap_info->bytes) {
+                        unlink_free_space(block_group, bitmap_info);
+                        kfree(bitmap_info->bitmap);
+                        kfree(bitmap_info);
+                        block_group->total_bitmaps--;
+                        recalculate_thresholds(block_group);
+                }
+
+                bitmap_info = tree_search_offset(block_group,
+                                                 offset_to_bitmap(block_group,
+                                                                  *offset),
+                                                 1, 0);
+                if (!bitmap_info)
+                        return -EINVAL;
+
+                if (!bitmap_info->bitmap)
+                        return -EAGAIN;
+
+                goto again;
+        } else if (!bitmap_info->bytes) {
+                unlink_free_space(block_group, bitmap_info);
+                kfree(bitmap_info->bitmap);
+                kfree(bitmap_info);
+                block_group->total_bitmaps--;
+                recalculate_thresholds(block_group);
+        }
+
+        return 0;
+}
+
+static int insert_into_bitmap(struct btrfs_block_group_cache *block_group,
+                              struct btrfs_free_space *info)
+{
+        struct btrfs_free_space *bitmap_info;
+        int added = 0;
+        u64 bytes, offset, end;
+        int ret;
+
+        /*
+         * If we are below the extents threshold then we can add this as an
+         * extent, and don't have to deal with the bitmap
+         */
+        if (block_group->free_extents < block_group->extents_thresh &&
+            info->bytes > block_group->sectorsize * 4)
+                return 0;
+
+        /*
+         * some block groups are so tiny they can't be enveloped by a bitmap, so
+         * don't even bother to create a bitmap for this
+         */
+        if (BITS_PER_BITMAP * block_group->sectorsize >
+            block_group->key.offset)
+                return 0;
+
+        bytes = info->bytes;
+        offset = info->offset;
+
+again:
+        bitmap_info = tree_search_offset(block_group,
+                                         offset_to_bitmap(block_group, offset),
+                                         1, 0);
+        if (!bitmap_info) {
+                BUG_ON(added);
+                goto new_bitmap;
+        }
+
+        end = bitmap_info->offset +
+                (u64)(BITS_PER_BITMAP * block_group->sectorsize);
+
+        if (offset >= bitmap_info->offset && offset + bytes > end) {
+                bitmap_set_bits(block_group, bitmap_info, offset,
+                                end - offset);
+                bytes -= end - offset;
+                offset = end;
+                added = 0;
+        } else if (offset >= bitmap_info->offset && offset + bytes <= end) {
+                bitmap_set_bits(block_group, bitmap_info, offset, bytes);
+                bytes = 0;
+        } else {
+                BUG();
+        }
+
+        if (!bytes) {
+                ret = 1;
+                goto out;
+        } else
+                goto again;
+
+new_bitmap:
+        if (info && info->bitmap) {
+                add_new_bitmap(block_group, info, offset);
+                added = 1;
+                info = NULL;
+                goto again;
+        } else {
+                spin_unlock(&block_group->tree_lock);
+
+                /* no pre-allocated info, allocate a new one */
+                if (!info) {
+                        info = kzalloc(sizeof(struct btrfs_free_space),
+                                       GFP_NOFS);
+                        if (!info) {
+                                spin_lock(&block_group->tree_lock);
+                                ret = -ENOMEM;
+                                goto out;
+                        }
+                }
+
+                /* allocate the bitmap */
+                info->bitmap = kzalloc(PAGE_CACHE_SIZE, GFP_NOFS);
+                spin_lock(&block_group->tree_lock);
+                if (!info->bitmap) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+                goto again;
+        }
+
+out:
+        if (info) {
+                if (info->bitmap)
+                        kfree(info->bitmap);
+                kfree(info);
+        }
 
         return ret;
 }
@@ -208,8 +561,8 @@ static int link_free_space(struct btrfs_block_group_cache *block_group,
 int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
                          u64 offset, u64 bytes)
 {
-        struct btrfs_free_space *right_info;
-        struct btrfs_free_space *left_info;
+        struct btrfs_free_space *right_info = NULL;
+        struct btrfs_free_space *left_info = NULL;
         struct btrfs_free_space *info = NULL;
         int ret = 0;
 
@@ -227,18 +580,38 @@ int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
          * are adding, if there is remove that struct and add a new one to
          * cover the entire range
          */
-        right_info = tree_search_offset(&block_group->free_space_offset,
-                                        offset+bytes, 0, 0);
-        left_info = tree_search_offset(&block_group->free_space_offset,
-                                       offset-1, 0, 1);
+        right_info = tree_search_offset(block_group, offset + bytes, 0, 0);
+        if (right_info && rb_prev(&right_info->offset_index))
+                left_info = rb_entry(rb_prev(&right_info->offset_index),
+                                     struct btrfs_free_space, offset_index);
+        else
+                left_info = tree_search_offset(block_group, offset - 1, 0, 0);
 
-        if (right_info) {
+        /*
+         * If there was no extent directly to the left or right of this new
+         * extent then we know we're going to have to allocate a new extent, so
+         * before we do that see if we need to drop this into a bitmap
+         */
+        if ((!left_info || left_info->bitmap) &&
+            (!right_info || right_info->bitmap)) {
+                ret = insert_into_bitmap(block_group, info);
+
+                if (ret < 0) {
+                        goto out;
+                } else if (ret) {
+                        ret = 0;
+                        goto out;
+                }
+        }
+
+        if (right_info && !right_info->bitmap) {
                 unlink_free_space(block_group, right_info);
                 info->bytes += right_info->bytes;
                 kfree(right_info);
         }
 
-        if (left_info && left_info->offset + left_info->bytes == offset) {
+        if (left_info && !left_info->bitmap &&
+            left_info->offset + left_info->bytes == offset) {
                 unlink_free_space(block_group, left_info);
                 info->offset = left_info->offset;
                 info->bytes += left_info->bytes;
@@ -248,11 +621,11 @@ int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
         ret = link_free_space(block_group, info);
         if (ret)
                 kfree(info);
-
+out:
         spin_unlock(&block_group->tree_lock);
 
         if (ret) {
-                printk(KERN_ERR "btrfs: unable to add free space :%d\n", ret);
+                printk(KERN_CRIT "btrfs: unable to add free space :%d\n", ret);
                 BUG_ON(ret == -EEXIST);
         }
 
@@ -263,40 +636,65 @@ int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
                             u64 offset, u64 bytes)
 {
         struct btrfs_free_space *info;
+        struct btrfs_free_space *next_info = NULL;
         int ret = 0;
 
         spin_lock(&block_group->tree_lock);
 
-        info = tree_search_offset(&block_group->free_space_offset, offset, 0,
-                                  1);
-        if (info && info->offset == offset) {
-                if (info->bytes < bytes) {
-                        printk(KERN_ERR "Found free space at %llu, size %llu,"
-                               "trying to use %llu\n",
-                               (unsigned long long)info->offset,
-                               (unsigned long long)info->bytes,
-                               (unsigned long long)bytes);
+again:
+        info = tree_search_offset(block_group, offset, 0, 0);
+        if (!info) {
+                WARN_ON(1);
+                goto out_lock;
+        }
+
+        if (info->bytes < bytes && rb_next(&info->offset_index)) {
+                u64 end;
+                next_info = rb_entry(rb_next(&info->offset_index),
+                                             struct btrfs_free_space,
+                                             offset_index);
+
+                if (next_info->bitmap)
+                        end = next_info->offset + BITS_PER_BITMAP *
+                                block_group->sectorsize - 1;
+                else
+                        end = next_info->offset + next_info->bytes;
+
+                if (next_info->bytes < bytes ||
+                    next_info->offset > offset || offset > end) {
+                        printk(KERN_CRIT "Found free space at %llu, size %llu,"
+                              " trying to use %llu\n",
+                              (unsigned long long)info->offset,
+                              (unsigned long long)info->bytes,
+                              (unsigned long long)bytes);
                         WARN_ON(1);
                         ret = -EINVAL;
-                        spin_unlock(&block_group->tree_lock);
-                        goto out;
+                        goto out_lock;
                 }
-                unlink_free_space(block_group, info);
 
-                if (info->bytes == bytes) {
-                        kfree(info);
-                        spin_unlock(&block_group->tree_lock);
-                        goto out;
+                info = next_info;
+        }
+
+        if (info->bytes == bytes) {
+                unlink_free_space(block_group, info);
+                if (info->bitmap) {
+                        kfree(info->bitmap);
+                        block_group->total_bitmaps--;
                 }
+                kfree(info);
+                goto out_lock;
+        }
 
+        if (!info->bitmap && info->offset == offset) {
+                unlink_free_space(block_group, info);
                 info->offset += bytes;
                 info->bytes -= bytes;
+                link_free_space(block_group, info);
+                goto out_lock;
+        }
 
-                ret = link_free_space(block_group, info);
-                spin_unlock(&block_group->tree_lock);
-                BUG_ON(ret);
-        } else if (info && info->offset < offset &&
-                   info->offset + info->bytes >= offset + bytes) {
+        if (!info->bitmap && info->offset <= offset &&
+            info->offset + info->bytes >= offset + bytes) {
                 u64 old_start = info->offset;
                 /*
                  * we're freeing space in the middle of the info,
@@ -312,7 +710,9 @@ int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
                         info->offset = offset + bytes;
                         info->bytes = old_end - info->offset;
                         ret = link_free_space(block_group, info);
-                        BUG_ON(ret);
+                        WARN_ON(ret);
+                        if (ret)
+                                goto out_lock;
                 } else {
                         /* the hole we're creating ends at the end
                          * of the info struct, just free the info
@@ -320,32 +720,22 @@ int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
                         kfree(info);
                 }
                 spin_unlock(&block_group->tree_lock);
-                /* step two, insert a new info struct to cover anything
-                 * before the hole
+
+                /* step two, insert a new info struct to cover
+                 * anything before the hole
                  */
                 ret = btrfs_add_free_space(block_group, old_start,
                                            offset - old_start);
-                BUG_ON(ret);
-        } else {
-                spin_unlock(&block_group->tree_lock);
-                if (!info) {
-                        printk(KERN_ERR "couldn't find space %llu to free\n",
-                               (unsigned long long)offset);
-                        printk(KERN_ERR "cached is %d, offset %llu bytes %llu\n",
-                               block_group->cached,
-                               (unsigned long long)block_group->key.objectid,
-                               (unsigned long long)block_group->key.offset);
-                        btrfs_dump_free_space(block_group, bytes);
-                } else if (info) {
-                        printk(KERN_ERR "hmm, found offset=%llu bytes=%llu, "
-                               "but wanted offset=%llu bytes=%llu\n",
-                               (unsigned long long)info->offset,
-                               (unsigned long long)info->bytes,
-                               (unsigned long long)offset,
-                               (unsigned long long)bytes);
-                }
-                WARN_ON(1);
+                WARN_ON(ret);
+                goto out;
         }
+
+        ret = remove_from_bitmap(block_group, info, &offset, &bytes);
+        if (ret == -EAGAIN)
+                goto again;
+        BUG_ON(ret);
+out_lock:
+        spin_unlock(&block_group->tree_lock);
 out:
         return ret;
 }
@@ -361,10 +751,13 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
                 info = rb_entry(n, struct btrfs_free_space, offset_index);
                 if (info->bytes >= bytes)
                         count++;
-                printk(KERN_ERR "entry offset %llu, bytes %llu\n",
+                printk(KERN_CRIT "entry offset %llu, bytes %llu, bitmap %s\n",
                        (unsigned long long)info->offset,
-                       (unsigned long long)info->bytes);
+                       (unsigned long long)info->bytes,
+                       (info->bitmap) ? "yes" : "no");
         }
+        printk(KERN_INFO "block group has cluster?: %s\n",
+               list_empty(&block_group->cluster_list) ? "no" : "yes");
         printk(KERN_INFO "%d blocks of free space at or bigger than bytes is"
                "\n", count);
 }
@@ -397,26 +790,35 @@ __btrfs_return_cluster_to_free_space(
 {
         struct btrfs_free_space *entry;
         struct rb_node *node;
+        bool bitmap;
 
         spin_lock(&cluster->lock);
         if (cluster->block_group != block_group)
                 goto out;
 
+        bitmap = cluster->points_to_bitmap;
+        cluster->block_group = NULL;
         cluster->window_start = 0;
+        list_del_init(&cluster->block_group_list);
+        cluster->points_to_bitmap = false;
+
+        if (bitmap)
+                goto out;
+
         node = rb_first(&cluster->root);
-        while(node) {
+        while (node) {
                 entry = rb_entry(node, struct btrfs_free_space, offset_index);
                 node = rb_next(&entry->offset_index);
                 rb_erase(&entry->offset_index, &cluster->root);
-                link_free_space(block_group, entry);
+                BUG_ON(entry->bitmap);
+                tree_insert_offset(&block_group->free_space_offset,
+                                   entry->offset, &entry->offset_index, 0);
         }
-        list_del_init(&cluster->block_group_list);
-
-        btrfs_put_block_group(cluster->block_group);
-        cluster->block_group = NULL;
         cluster->root.rb_node = NULL;
+
 out:
         spin_unlock(&cluster->lock);
+        btrfs_put_block_group(block_group);
         return 0;
 }
 
@@ -425,20 +827,28 @@ void btrfs_remove_free_space_cache(struct btrfs_block_group_cache *block_group)
         struct btrfs_free_space *info;
         struct rb_node *node;
         struct btrfs_free_cluster *cluster;
-        struct btrfs_free_cluster *safe;
+        struct list_head *head;
 
         spin_lock(&block_group->tree_lock);
-
-        list_for_each_entry_safe(cluster, safe, &block_group->cluster_list,
-                                 block_group_list) {
+        while ((head = block_group->cluster_list.next) !=
+               &block_group->cluster_list) {
+                cluster = list_entry(head, struct btrfs_free_cluster,
+                                     block_group_list);
 
                 WARN_ON(cluster->block_group != block_group);
                 __btrfs_return_cluster_to_free_space(block_group, cluster);
+                if (need_resched()) {
+                        spin_unlock(&block_group->tree_lock);
+                        cond_resched();
+                        spin_lock(&block_group->tree_lock);
+                }
         }
 
-        while ((node = rb_last(&block_group->free_space_bytes)) != NULL) {
-                info = rb_entry(node, struct btrfs_free_space, bytes_index);
+        while ((node = rb_last(&block_group->free_space_offset)) != NULL) {
+                info = rb_entry(node, struct btrfs_free_space, offset_index);
                 unlink_free_space(block_group, info);
+                if (info->bitmap)
+                        kfree(info->bitmap);
                 kfree(info);
                 if (need_resched()) {
                         spin_unlock(&block_group->tree_lock);
@@ -446,6 +856,7 @@ void btrfs_remove_free_space_cache(struct btrfs_block_group_cache *block_group)
                         spin_lock(&block_group->tree_lock);
                 }
         }
+
         spin_unlock(&block_group->tree_lock);
 }
 
@@ -453,25 +864,35 @@ u64 btrfs_find_space_for_alloc(struct btrfs_block_group_cache *block_group,
                                u64 offset, u64 bytes, u64 empty_size)
 {
         struct btrfs_free_space *entry = NULL;
+        u64 bytes_search = bytes + empty_size;
         u64 ret = 0;
 
         spin_lock(&block_group->tree_lock);
-        entry = tree_search_offset(&block_group->free_space_offset, offset,
-                                   bytes + empty_size, 1);
+        entry = find_free_space(block_group, &offset, &bytes_search, 0);
         if (!entry)
-                entry = tree_search_bytes(&block_group->free_space_bytes,
-                                          offset, bytes + empty_size);
-        if (entry) {
+                goto out;
+
+        ret = offset;
+        if (entry->bitmap) {
+                bitmap_clear_bits(block_group, entry, offset, bytes);
+                if (!entry->bytes) {
+                        unlink_free_space(block_group, entry);
+                        kfree(entry->bitmap);
+                        kfree(entry);
+                        block_group->total_bitmaps--;
+                        recalculate_thresholds(block_group);
+                }
+        } else {
                 unlink_free_space(block_group, entry);
-                ret = entry->offset;
                 entry->offset += bytes;
                 entry->bytes -= bytes;
-
                 if (!entry->bytes)
                         kfree(entry);
                 else
                         link_free_space(block_group, entry);
         }
+
+out:
         spin_unlock(&block_group->tree_lock);
 
         return ret;
@@ -517,6 +938,47 @@ int btrfs_return_cluster_to_free_space(
         return ret;
 }
 
+static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
+                                   struct btrfs_free_cluster *cluster,
+                                   u64 bytes, u64 min_start)
+{
+        struct btrfs_free_space *entry;
+        int err;
+        u64 search_start = cluster->window_start;
+        u64 search_bytes = bytes;
+        u64 ret = 0;
+
+        spin_lock(&block_group->tree_lock);
+        spin_lock(&cluster->lock);
+
+        if (!cluster->points_to_bitmap)
+                goto out;
+
+        if (cluster->block_group != block_group)
+                goto out;
+
+        entry = tree_search_offset(block_group, search_start, 0, 0);
+
+        if (!entry || !entry->bitmap)
+                goto out;
+
+        search_start = min_start;
+        search_bytes = bytes;
+
+        err = search_bitmap(block_group, entry, &search_start,
+                            &search_bytes);
+        if (err)
+                goto out;
+
+        ret = search_start;
+        bitmap_clear_bits(block_group, entry, ret, bytes);
+out:
+        spin_unlock(&cluster->lock);
+        spin_unlock(&block_group->tree_lock);
+
+        return ret;
+}
+
 /*
  * given a cluster, try to allocate 'bytes' from it, returns 0
  * if it couldn't find anything suitably large, or a logical disk offset
@@ -530,6 +992,10 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
         struct rb_node *node;
         u64 ret = 0;
 
+        if (cluster->points_to_bitmap)
+                return btrfs_alloc_from_bitmap(block_group, cluster, bytes,
+                                               min_start);
+
         spin_lock(&cluster->lock);
         if (bytes > cluster->max_size)
                 goto out;
@@ -567,9 +1033,73 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
         }
 out:
         spin_unlock(&cluster->lock);
+
         return ret;
 }
 
+static int btrfs_bitmap_cluster(struct btrfs_block_group_cache *block_group,
+                                struct btrfs_free_space *entry,
+                                struct btrfs_free_cluster *cluster,
+                                u64 offset, u64 bytes, u64 min_bytes)
+{
+        unsigned long next_zero;
+        unsigned long i;
+        unsigned long search_bits;
+        unsigned long total_bits;
+        unsigned long found_bits;
+        unsigned long start = 0;
+        unsigned long total_found = 0;
+        bool found = false;
+
+        i = offset_to_bit(entry->offset, block_group->sectorsize,
+                          max_t(u64, offset, entry->offset));
+        search_bits = bytes_to_bits(min_bytes, block_group->sectorsize);
+        total_bits = bytes_to_bits(bytes, block_group->sectorsize);
+
+again:
+        found_bits = 0;
+        for (i = find_next_bit(entry->bitmap, BITS_PER_BITMAP, i);
+             i < BITS_PER_BITMAP;
+             i = find_next_bit(entry->bitmap, BITS_PER_BITMAP, i + 1)) {
+                next_zero = find_next_zero_bit(entry->bitmap,
+                                               BITS_PER_BITMAP, i);
+                if (next_zero - i >= search_bits) {
+                        found_bits = next_zero - i;
+                        break;
+                }
+                i = next_zero;
+        }
+
+        if (!found_bits)
+                return -1;
+
+        if (!found) {
+                start = i;
+                found = true;
+        }
+
+        total_found += found_bits;
+
+        if (cluster->max_size < found_bits * block_group->sectorsize)
+                cluster->max_size = found_bits * block_group->sectorsize;
+
+        if (total_found < total_bits) {
+                i = find_next_bit(entry->bitmap, BITS_PER_BITMAP, next_zero);
+                if (i - start > total_bits * 2) {
+                        total_found = 0;
+                        cluster->max_size = 0;
+                        found = false;
+                }
+                goto again;
+        }
+
+        cluster->window_start = start * block_group->sectorsize +
+                entry->offset;
+        cluster->points_to_bitmap = true;
+
+        return 0;
+}
+
 /*
  * here we try to find a cluster of blocks in a block group.  The goal
  * is to find at least bytes free and up to empty_size + bytes free.
@@ -587,12 +1117,12 @@ int btrfs_find_space_cluster(struct btrfs_trans_handle *trans,
         struct btrfs_free_space *entry = NULL;
         struct rb_node *node;
         struct btrfs_free_space *next;
-        struct btrfs_free_space *last;
+        struct btrfs_free_space *last = NULL;
         u64 min_bytes;
         u64 window_start;
         u64 window_free;
         u64 max_extent = 0;
-        int total_retries = 0;
+        bool found_bitmap = false;
         int ret;
 
         /* for metadata, allow allocates with more holes */
@@ -620,31 +1150,80 @@ int btrfs_find_space_cluster(struct btrfs_trans_handle *trans,
                 goto out;
         }
 again:
-        min_bytes = min(min_bytes, bytes + empty_size);
-        entry = tree_search_bytes(&block_group->free_space_bytes,
-                                  offset, min_bytes);
+        entry = tree_search_offset(block_group, offset, found_bitmap, 1);
         if (!entry) {
                 ret = -ENOSPC;
                 goto out;
         }
+
+        /*
+         * If found_bitmap is true, we exhausted our search for extent entries,
+         * and we just want to search all of the bitmaps that we can find, and
+         * ignore any extent entries we find.
+         */
+        while (entry->bitmap || found_bitmap ||
+               (!entry->bitmap && entry->bytes < min_bytes)) {
+                struct rb_node *node = rb_next(&entry->offset_index);
+
+                if (entry->bitmap && entry->bytes > bytes + empty_size) {
+                        ret = btrfs_bitmap_cluster(block_group, entry, cluster,
+                                                   offset, bytes + empty_size,
+                                                   min_bytes);
+                        if (!ret)
+                                goto got_it;
+                }
+
+                if (!node) {
+                        ret = -ENOSPC;
+                        goto out;
+                }
+                entry = rb_entry(node, struct btrfs_free_space, offset_index);
+        }
+
+        /*
+         * We already searched all the extent entries from the passed in offset
+         * to the end and didn't find enough space for the cluster, and we also
+         * didn't find any bitmaps that met our criteria, just go ahead and exit
+         */
+        if (found_bitmap) {
+                ret = -ENOSPC;
+                goto out;
+        }
+
+        cluster->points_to_bitmap = false;
         window_start = entry->offset;
         window_free = entry->bytes;
         last = entry;
         max_extent = entry->bytes;
 
-        while(1) {
+        while (1) {
                 /* out window is just right, lets fill it */
                 if (window_free >= bytes + empty_size)
                         break;
 
                 node = rb_next(&last->offset_index);
                 if (!node) {
+                        if (found_bitmap)
+                                goto again;
                         ret = -ENOSPC;
                         goto out;
                 }
                 next = rb_entry(node, struct btrfs_free_space, offset_index);
 
                 /*
+                 * we found a bitmap, so if this search doesn't result in a
+                 * cluster, we know to go and search again for the bitmaps and
+                 * start looking for space there
+                 */
+                if (next->bitmap) {
+                        if (!found_bitmap)
+                                offset = next->offset;
+                        found_bitmap = true;
+                        last = next;
+                        continue;
+                }
+
+                /*
                  * we haven't filled the empty size and the window is
                  * very large.  reset and try again
                  */
@@ -655,19 +1234,6 @@ again:
                         window_free = entry->bytes;
                         last = entry;
                         max_extent = 0;
-                        total_retries++;
-                        if (total_retries % 64 == 0) {
-                                if (min_bytes >= (bytes + empty_size)) {
-                                        ret = -ENOSPC;
-                                        goto out;
-                                }
-                                /*
-                                 * grow our allocation a bit, we're not having
-                                 * much luck
-                                 */
-                                min_bytes *= 2;
-                                goto again;
-                        }
                 } else {
                         last = next;
                         window_free += next->bytes;
@@ -685,11 +1251,19 @@ again:
          * The cluster includes an rbtree, but only uses the offset index
          * of each free space cache entry.
          */
-        while(1) {
+        while (1) {
                 node = rb_next(&entry->offset_index);
-                unlink_free_space(block_group, entry);
+                if (entry->bitmap && node) {
+                        entry = rb_entry(node, struct btrfs_free_space,
+                                         offset_index);
+                        continue;
+                } else if (entry->bitmap && !node) {
+                        break;
+                }
+
+                rb_erase(&entry->offset_index, &block_group->free_space_offset);
                 ret = tree_insert_offset(&cluster->root, entry->offset,
-                                         &entry->offset_index);
+                                         &entry->offset_index, 0);
                 BUG_ON(ret);
 
                 if (!node || entry == last)
@@ -697,8 +1271,10 @@ again:
 
                 entry = rb_entry(node, struct btrfs_free_space, offset_index);
         }
-        ret = 0;
+
         cluster->max_size = max_extent;
+got_it:
+        ret = 0;
         atomic_inc(&block_group->count);
         list_add_tail(&cluster->block_group_list, &block_group->cluster_list);
         cluster->block_group = block_group;
@@ -718,6 +1294,7 @@ void btrfs_init_free_cluster(struct btrfs_free_cluster *cluster)
         spin_lock_init(&cluster->refill_lock);
         cluster->root.rb_node = NULL;
         cluster->max_size = 0;
+        cluster->points_to_bitmap = false;
         INIT_LIST_HEAD(&cluster->block_group_list);
         cluster->block_group = NULL;
 }
diff --git a/fs/btrfs/free-space-cache.h b/fs/btrfs/free-space-cache.h
index 266fb8764054..890a8e79011b 100644
--- a/fs/btrfs/free-space-cache.h
+++ b/fs/btrfs/free-space-cache.h
@@ -19,6 +19,14 @@
 #ifndef __BTRFS_FREE_SPACE_CACHE
 #define __BTRFS_FREE_SPACE_CACHE
 
+struct btrfs_free_space {
+        struct rb_node offset_index;
+        u64 offset;
+        u64 bytes;
+        unsigned long *bitmap;
+        struct list_head list;
+};
+
 int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
                          u64 bytenr, u64 size);
 int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 791eab19e330..56fe83fa60c4 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2603,8 +2603,8 @@ noinline int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
         if (root->ref_cows)
                 btrfs_drop_extent_cache(inode, new_size & (~mask), (u64)-1, 0);
         path = btrfs_alloc_path();
-        path->reada = -1;
         BUG_ON(!path);
+        path->reada = -1;
 
         /* FIXME, add redo link to tree so we don't leak on crash */
         key.objectid = inode->i_ino;
diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
index 6d6523da0a30..0d126be22b63 100644
--- a/fs/btrfs/print-tree.c
+++ b/fs/btrfs/print-tree.c
@@ -309,7 +309,7 @@ void btrfs_print_tree(struct btrfs_root *root, struct extent_buffer *c)
         }
         printk(KERN_INFO "node %llu level %d total ptrs %d free spc %u\n",
                (unsigned long long)btrfs_header_bytenr(c),
-               btrfs_header_level(c), nr,
+              level, nr,
                (u32)BTRFS_NODEPTRS_PER_BLOCK(root) - nr);
         for (i = 0; i < nr; i++) {
                 btrfs_node_key_to_cpu(c, &key, i);
@@ -326,10 +326,10 @@ void btrfs_print_tree(struct btrfs_root *root, struct extent_buffer *c)
                                         btrfs_level_size(root, level - 1),
                                         btrfs_node_ptr_generation(c, i));
                 if (btrfs_is_leaf(next) &&
-                    btrfs_header_level(c) != 1)
+                   level != 1)
                         BUG();
                 if (btrfs_header_level(next) !=
-                        btrfs_header_level(c) - 1)
+                       level - 1)
                         BUG();
                 btrfs_print_tree(root, next);
                 free_extent_buffer(next);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 008397934778..e71264d1c2c9 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -670,6 +670,8 @@ again:
                         err = ret;
                         goto out;
                 }
+                if (ret > 0 && path2->slots[level] > 0)
+                        path2->slots[level]--;
 
                 eb = path2->nodes[level];
                 WARN_ON(btrfs_node_blockptr(eb, path2->slots[level]) !=
@@ -1609,6 +1611,7 @@ static noinline_for_stack int merge_reloc_root(struct reloc_control *rc,
                 BUG_ON(level == 0);
                 path->lowest_level = level;
                 ret = btrfs_search_slot(NULL, reloc_root, &key, path, 0, 0);
+                path->lowest_level = 0;
                 if (ret < 0) {
                         btrfs_free_path(path);
                         return ret;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 2dbf1c1f56ee..e51d2bc532f8 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -40,6 +40,14 @@ static noinline void put_transaction(struct btrfs_transaction *transaction)
         }
 }
 
+static noinline void switch_commit_root(struct btrfs_root *root)
+{
+        down_write(&root->commit_root_sem);
+        free_extent_buffer(root->commit_root);
+        root->commit_root = btrfs_root_node(root);
+        up_write(&root->commit_root_sem);
+}
+
 /*
  * either allocate a new transaction or hop into the existing one
  */
@@ -444,9 +452,6 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
 
         btrfs_write_dirty_block_groups(trans, root);
 
-        ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
-        BUG_ON(ret);
-
         while (1) {
                 old_root_bytenr = btrfs_root_bytenr(&root->root_item);
                 if (old_root_bytenr == root->node->start)
@@ -457,13 +462,11 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
                                         &root->root_key,
                                         &root->root_item);
                 BUG_ON(ret);
-                btrfs_write_dirty_block_groups(trans, root);
 
-                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
+                ret = btrfs_write_dirty_block_groups(trans, root);
                 BUG_ON(ret);
         }
-        free_extent_buffer(root->commit_root);
-        root->commit_root = btrfs_root_node(root);
+        switch_commit_root(root);
         return 0;
 }
 
@@ -495,9 +498,6 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans,
                 root = list_entry(next, struct btrfs_root, dirty_list);
 
                 update_cowonly_root(trans, root);
-
-                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
-                BUG_ON(ret);
         }
         return 0;
 }
@@ -544,8 +544,7 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans,
                         btrfs_update_reloc_root(trans, root);
 
                         if (root->commit_root != root->node) {
-                                free_extent_buffer(root->commit_root);
-                                root->commit_root = btrfs_root_node(root);
+                                switch_commit_root(root);
                                 btrfs_set_root_node(&root->root_item,
                                                     root->node);
                         }
@@ -943,9 +942,11 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
                 mutex_unlock(&root->fs_info->trans_mutex);
 
-                if (flush_on_commit || snap_pending) {
-                        if (flush_on_commit)
-                                btrfs_start_delalloc_inodes(root);
+                if (flush_on_commit) {
+                        btrfs_start_delalloc_inodes(root);
+                        ret = btrfs_wait_ordered_extents(root, 0);
+                        BUG_ON(ret);
+                } else if (snap_pending) {
                         ret = btrfs_wait_ordered_extents(root, 1);
                         BUG_ON(ret);
                 }
@@ -1009,15 +1010,11 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         btrfs_set_root_node(&root->fs_info->tree_root->root_item,
                             root->fs_info->tree_root->node);
-        free_extent_buffer(root->fs_info->tree_root->commit_root);
-        root->fs_info->tree_root->commit_root =
-                                btrfs_root_node(root->fs_info->tree_root);
+        switch_commit_root(root->fs_info->tree_root);
 
         btrfs_set_root_node(&root->fs_info->chunk_root->root_item,
                             root->fs_info->chunk_root->node);
-        free_extent_buffer(root->fs_info->chunk_root->commit_root);
-        root->fs_info->chunk_root->commit_root =
-                                btrfs_root_node(root->fs_info->chunk_root);
+        switch_commit_root(root->fs_info->chunk_root);
 
         update_super_roots(root);
 
@@ -1057,6 +1054,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         cur_trans->commit_done = 1;
 
         root->fs_info->last_trans_committed = cur_trans->transid;
+
         wake_up(&cur_trans->commit_wait);
 
         put_transaction(cur_trans);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index c13922206d1b..d91b0de7c502 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -797,7 +797,7 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
                 return -ENOENT;
 
         inode = read_one_inode(root, key->objectid);
-        BUG_ON(!dir);
+        BUG_ON(!inode);
 
         ref_ptr = btrfs_item_ptr_offset(eb, slot);
         ref_end = ref_ptr + btrfs_item_size_nr(eb, slot);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 3ab80e9cd767..5dbefd11b4af 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -721,7 +721,8 @@ error:
  */
 static noinline int find_free_dev_extent(struct btrfs_trans_handle *trans,
                                          struct btrfs_device *device,
-                                         u64 num_bytes, u64 *start)
+                                         u64 num_bytes, u64 *start,
+                                         u64 *max_avail)
 {
         struct btrfs_key key;
         struct btrfs_root *root = device->dev_root;
@@ -758,9 +759,13 @@ static noinline int find_free_dev_extent(struct btrfs_trans_handle *trans,
         ret = btrfs_search_slot(trans, root, &key, path, 0, 0);
         if (ret < 0)
                 goto error;
-        ret = btrfs_previous_item(root, path, 0, key.type);
-        if (ret < 0)
-                goto error;
+        if (ret > 0) {
+                ret = btrfs_previous_item(root, path, key.objectid, key.type);
+                if (ret < 0)
+                        goto error;
+                if (ret > 0)
+                        start_found = 1;
+        }
         l = path->nodes[0];
         btrfs_item_key_to_cpu(l, &key, path->slots[0]);
         while (1) {
@@ -803,6 +808,10 @@ no_more_items:
                         if (last_byte < search_start)
                                 last_byte = search_start;
                         hole_size = key.offset - last_byte;
+
+                        if (hole_size > *max_avail)
+                                *max_avail = hole_size;
+
                         if (key.offset > last_byte &&
                             hole_size >= num_bytes) {
                                 *start = last_byte;
@@ -1621,6 +1630,7 @@ static int __btrfs_grow_device(struct btrfs_trans_handle *trans,
         device->fs_devices->total_rw_bytes += diff;
 
         device->total_bytes = new_size;
+        device->disk_total_bytes = new_size;
         btrfs_clear_space_info_full(device->dev_root->fs_info);
 
         return btrfs_update_device(trans, device);
@@ -2007,7 +2017,7 @@ int btrfs_shrink_device(struct btrfs_device *device, u64 new_size)
                         goto done;
                 if (ret) {
                         ret = 0;
-                        goto done;
+                        break;
                 }
 
                 l = path->nodes[0];
@@ -2015,7 +2025,7 @@ int btrfs_shrink_device(struct btrfs_device *device, u64 new_size)
                 btrfs_item_key_to_cpu(l, &key, path->slots[0]);
 
                 if (key.objectid != device->devid)
-                        goto done;
+                        break;
 
                 dev_extent = btrfs_item_ptr(l, slot, struct btrfs_dev_extent);
                 length = btrfs_dev_extent_length(l, dev_extent);
@@ -2171,6 +2181,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                              max_chunk_size);
 
 again:
+        max_avail = 0;
         if (!map || map->num_stripes != num_stripes) {
                 kfree(map);
                 map = kmalloc(map_lookup_size(num_stripes), GFP_NOFS);
@@ -2219,7 +2230,8 @@ again:
 
                 if (device->in_fs_metadata && avail >= min_free) {
                         ret = find_free_dev_extent(trans, device,
-                                                   min_free, &dev_offset);
+                                                   min_free, &dev_offset,
+                                                   &max_avail);
                         if (ret == 0) {
                                 list_move_tail(&device->dev_alloc_list,
                                                &private_devs);
@@ -2795,26 +2807,6 @@ int btrfs_rmap_block(struct btrfs_mapping_tree *map_tree,
                 }
         }
 
-        for (i = 0; i > nr; i++) {
-                struct btrfs_multi_bio *multi;
-                struct btrfs_bio_stripe *stripe;
-                int ret;
-
-                length = 1;
-                ret = btrfs_map_block(map_tree, WRITE, buf[i],
-                                      &length, &multi, 0);
-                BUG_ON(ret);
-
-                stripe = multi->stripes;
-                for (j = 0; j < multi->num_stripes; j++) {
-                        if (stripe->physical >= physical &&
-                            physical < stripe->physical + length)
-                                break;
-                }
-                BUG_ON(j >= multi->num_stripes);
-                kfree(multi);
-        }
-
         *logical = buf;
         *naddrs = nr;
         *stripe_len = map->stripe_len;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 9bb5c8750736..fc44d316d0bb 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2452,10 +2452,10 @@ try_mount_again:
                 tcon->local_lease = volume_info->local_lease;
         }
         if (pSesInfo) {
-                if (pSesInfo->capabilities & CAP_LARGE_FILES) {
-                        sb->s_maxbytes = (u64) 1 << 63;
-                } else
-                        sb->s_maxbytes = (u64) 1 << 31; /* 2 GB */
+                if (pSesInfo->capabilities & CAP_LARGE_FILES)
+                        sb->s_maxbytes = MAX_LFS_FILESIZE;
+                else
+                        sb->s_maxbytes = MAX_NON_LFS;
         }
 
         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 18afe57b2461..82d83839655e 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -212,7 +212,7 @@ cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info,
  * junction to the new submount (ie to setup the fake directory
  * which represents a DFS referral).
  */
-void
+static void
 cifs_create_dfs_fattr(struct cifs_fattr *fattr, struct super_block *sb)
 {
         struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
@@ -388,7 +388,7 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
 }
 
 /* Fill a cifs_fattr struct with info from FILE_ALL_INFO */
-void
+static void
 cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                        struct cifs_sb_info *cifs_sb, bool adjust_tz)
 {
@@ -513,9 +513,12 @@ int cifs_get_inode_info(struct inode **pinode,
                                         cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
                         if (rc1) {
-                                /* BB EOPNOSUPP disable SERVER_INUM? */
                                 cFYI(1, ("GetSrvInodeNum rc %d", rc1));
                                 fattr.cf_uniqueid = iunique(sb, ROOT_I);
+                                /* disable serverino if call not supported */
+                                if (rc1 == -EINVAL)
+                                        cifs_sb->mnt_cifs_flags &=
+                                                        ~CIFS_MOUNT_SERVER_INUM;
                         }
                 } else {
                         fattr.cf_uniqueid = iunique(sb, ROOT_I);
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index af737bb56cb7..259525c9abb8 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1303,6 +1303,13 @@ parse_tag_3_packet(struct ecryptfs_crypt_stat *crypt_stat,
         }
         (*new_auth_tok)->session_key.encrypted_key_size =
                 (body_size - (ECRYPTFS_SALT_SIZE + 5));
+        if ((*new_auth_tok)->session_key.encrypted_key_size
+            > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) {
+                printk(KERN_WARNING "Tag 3 packet contains key larger "
+                       "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n");
+                rc = -EINVAL;
+                goto out_free;
+        }
         if (unlikely(data[(*packet_size)++] != 0x04)) {
                 printk(KERN_WARNING "Unknown version number [%d]\n",
                        data[(*packet_size) - 1]);
@@ -1449,6 +1456,12 @@ parse_tag_11_packet(unsigned char *data, unsigned char *contents,
                 rc = -EINVAL;
                 goto out;
         }
+        if (unlikely((*tag_11_contents_size) > max_contents_bytes)) {
+                printk(KERN_ERR "Literal data section in tag 11 packet exceeds "
+                       "expected size\n");
+                rc = -EINVAL;
+                goto out;
+        }
         if (data[(*packet_size)++] != 0x62) {
                 printk(KERN_WARNING "Unrecognizable packet\n");
                 rc = -EINVAL;
diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
index 3d724a95882f..373fa90c796a 100644
--- a/fs/ext3/dir.c
+++ b/fs/ext3/dir.c
@@ -130,8 +130,7 @@ static int ext3_readdir(struct file * filp,
                 struct buffer_head *bh = NULL;
 
                 map_bh.b_state = 0;
-                err = ext3_get_blocks_handle(NULL, inode, blk, 1,
-                                                &map_bh, 0, 0);
+                err = ext3_get_blocks_handle(NULL, inode, blk, 1, &map_bh, 0);
                 if (err > 0) {
                         pgoff_t index = map_bh.b_blocknr >>
                                         (PAGE_CACHE_SHIFT - inode->i_blkbits);
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 5f51fed5c750..b49908a167ae 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -788,7 +788,7 @@ err_out:
 int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
                 sector_t iblock, unsigned long maxblocks,
                 struct buffer_head *bh_result,
-                int create, int extend_disksize)
+                int create)
 {
         int err = -EIO;
         int offsets[4];
@@ -911,13 +911,6 @@ int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
         if (!err)
                 err = ext3_splice_branch(handle, inode, iblock,
                                         partial, indirect_blks, count);
-        /*
-         * i_disksize growing is protected by truncate_mutex.  Don't forget to
-         * protect it if you're about to implement concurrent
-         * ext3_get_block() -bzzz
-        */
-        if (!err && extend_disksize && inode->i_size > ei->i_disksize)
-                ei->i_disksize = inode->i_size;
         mutex_unlock(&ei->truncate_mutex);
         if (err)
                 goto cleanup;
@@ -972,7 +965,7 @@ static int ext3_get_block(struct inode *inode, sector_t iblock,
         }
 
         ret = ext3_get_blocks_handle(handle, inode, iblock,
-                                        max_blocks, bh_result, create, 0);
+                                        max_blocks, bh_result, create);
         if (ret > 0) {
                 bh_result->b_size = (ret << inode->i_blkbits);
                 ret = 0;
@@ -1005,7 +998,7 @@ struct buffer_head *ext3_getblk(handle_t *handle, struct inode *inode,
         dummy.b_blocknr = -1000;
         buffer_trace_init(&dummy.b_history);
         err = ext3_get_blocks_handle(handle, inode, block, 1,
-                                        &dummy, create, 1);
+                                        &dummy, create);
         /*
          * ext3_get_blocks_handle() returns number of blocks
          * mapped. 0 in case of a HOLE.
@@ -1193,15 +1186,16 @@ write_begin_failed:
                  * i_size_read because we hold i_mutex.
                  *
                  * Add inode to orphan list in case we crash before truncate
-                 * finishes.
+                 * finishes. Do this only if ext3_can_truncate() agrees so
+                 * that orphan processing code is happy.
                  */
-                if (pos + len > inode->i_size)
+                if (pos + len > inode->i_size && ext3_can_truncate(inode))
                         ext3_orphan_add(handle, inode);
                 ext3_journal_stop(handle);
                 unlock_page(page);
                 page_cache_release(page);
                 if (pos + len > inode->i_size)
-                        vmtruncate(inode, inode->i_size);
+                        ext3_truncate(inode);
         }
         if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
                 goto retry;
@@ -1287,7 +1281,7 @@ static int ext3_ordered_write_end(struct file *file,
          * There may be allocated blocks outside of i_size because
          * we failed to copy some data. Prepare for truncate.
          */
-        if (pos + len > inode->i_size)
+        if (pos + len > inode->i_size && ext3_can_truncate(inode))
                 ext3_orphan_add(handle, inode);
         ret2 = ext3_journal_stop(handle);
         if (!ret)
@@ -1296,7 +1290,7 @@ static int ext3_ordered_write_end(struct file *file,
         page_cache_release(page);
 
         if (pos + len > inode->i_size)
-                vmtruncate(inode, inode->i_size);
+                ext3_truncate(inode);
         return ret ? ret : copied;
 }
 
@@ -1315,14 +1309,14 @@ static int ext3_writeback_write_end(struct file *file,
          * There may be allocated blocks outside of i_size because
          * we failed to copy some data. Prepare for truncate.
          */
-        if (pos + len > inode->i_size)
+        if (pos + len > inode->i_size && ext3_can_truncate(inode))
                 ext3_orphan_add(handle, inode);
         ret = ext3_journal_stop(handle);
         unlock_page(page);
         page_cache_release(page);
 
         if (pos + len > inode->i_size)
-                vmtruncate(inode, inode->i_size);
+                ext3_truncate(inode);
         return ret ? ret : copied;
 }
 
@@ -1358,7 +1352,7 @@ static int ext3_journalled_write_end(struct file *file,
          * There may be allocated blocks outside of i_size because
          * we failed to copy some data. Prepare for truncate.
          */
-        if (pos + len > inode->i_size)
+        if (pos + len > inode->i_size && ext3_can_truncate(inode))
                 ext3_orphan_add(handle, inode);
         EXT3_I(inode)->i_state |= EXT3_STATE_JDATA;
         if (inode->i_size > EXT3_I(inode)->i_disksize) {
@@ -1375,7 +1369,7 @@ static int ext3_journalled_write_end(struct file *file,
         page_cache_release(page);
 
         if (pos + len > inode->i_size)
-                vmtruncate(inode, inode->i_size);
+                ext3_truncate(inode);
         return ret ? ret : copied;
 }
 
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 737f7246a4b5..f96f85092d1c 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -287,6 +287,7 @@ int journal_write_metadata_buffer(transaction_t *transaction,
         struct page *new_page;
         unsigned int new_offset;
         struct buffer_head *bh_in = jh2bh(jh_in);
+        journal_t *journal = transaction->t_journal;
 
         /*
          * The buffer really shouldn't be locked: only the current committing
@@ -300,6 +301,11 @@ int journal_write_metadata_buffer(transaction_t *transaction,
         J_ASSERT_BH(bh_in, buffer_jbddirty(bh_in));
 
         new_bh = alloc_buffer_head(GFP_NOFS|__GFP_NOFAIL);
+        /* keep subsequent assertions sane */
+        new_bh->b_state = 0;
+        init_buffer(new_bh, NULL, NULL);
+        atomic_set(&new_bh->b_count, 1);
+        new_jh = journal_add_journal_head(new_bh);      /* This sleeps */
 
         /*
          * If a new transaction has already done a buffer copy-out, then
@@ -361,14 +367,6 @@ repeat:
                 kunmap_atomic(mapped_data, KM_USER0);
         }
 
-        /* keep subsequent assertions sane */
-        new_bh->b_state = 0;
-        init_buffer(new_bh, NULL, NULL);
-        atomic_set(&new_bh->b_count, 1);
-        jbd_unlock_bh_state(bh_in);
-
-        new_jh = journal_add_journal_head(new_bh);      /* This sleeps */
-
         set_bh_page(new_bh, new_page, new_offset);
         new_jh->b_transaction = NULL;
         new_bh->b_size = jh2bh(jh_in)->b_size;
@@ -385,7 +383,11 @@ repeat:
          * copying is moved to the transaction's shadow queue.
          */
         JBUFFER_TRACE(jh_in, "file as BJ_Shadow");
-        journal_file_buffer(jh_in, transaction, BJ_Shadow);
+        spin_lock(&journal->j_list_lock);
+        __journal_file_buffer(jh_in, transaction, BJ_Shadow);
+        spin_unlock(&journal->j_list_lock);
+        jbd_unlock_bh_state(bh_in);
+
         JBUFFER_TRACE(new_jh, "file as BJ_IO");
         journal_file_buffer(new_jh, transaction, BJ_IO);
 
@@ -848,6 +850,12 @@ static int journal_reset(journal_t *journal)
 
         first = be32_to_cpu(sb->s_first);
         last = be32_to_cpu(sb->s_maxlen);
+        if (first + JFS_MIN_JOURNAL_BLOCKS > last + 1) {
+                printk(KERN_ERR "JBD: Journal too short (blocks %lu-%lu).\n",
+                       first, last);
+                journal_fail_superblock(journal);
+                return -EINVAL;
+        }
 
         journal->j_first = first;
         journal->j_last = last;
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index 73242ba7c7b1..c03ac11f74be 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -489,34 +489,15 @@ void journal_unlock_updates (journal_t *journal)
         wake_up(&journal->j_wait_transaction_locked);
 }
 
-/*
- * Report any unexpected dirty buffers which turn up.  Normally those
- * indicate an error, but they can occur if the user is running (say)
- * tune2fs to modify the live filesystem, so we need the option of
- * continuing as gracefully as possible.  #
- *
- * The caller should already hold the journal lock and
- * j_list_lock spinlock: most callers will need those anyway
- * in order to probe the buffer's journaling state safely.
- */
-static void jbd_unexpected_dirty_buffer(struct journal_head *jh)
+static void warn_dirty_buffer(struct buffer_head *bh)
 {
-        int jlist;
-
-        /* If this buffer is one which might reasonably be dirty
-         * --- ie. data, or not part of this journal --- then
-         * we're OK to leave it alone, but otherwise we need to
-         * move the dirty bit to the journal's own internal
-         * JBDDirty bit. */
-        jlist = jh->b_jlist;
+        char b[BDEVNAME_SIZE];
 
-        if (jlist == BJ_Metadata || jlist == BJ_Reserved ||
-            jlist == BJ_Shadow || jlist == BJ_Forget) {
-                struct buffer_head *bh = jh2bh(jh);
-
-                if (test_clear_buffer_dirty(bh))
-                        set_buffer_jbddirty(bh);
-        }
+        printk(KERN_WARNING
+               "JBD: Spotted dirty metadata buffer (dev = %s, blocknr = %llu). "
+               "There's a risk of filesystem corruption in case of system "
+               "crash.\n",
+               bdevname(bh->b_bdev, b), (unsigned long long)bh->b_blocknr);
 }
 
 /*
@@ -583,14 +564,16 @@ repeat:
                         if (jh->b_next_transaction)
                                 J_ASSERT_JH(jh, jh->b_next_transaction ==
                                                         transaction);
+                        warn_dirty_buffer(bh);
                 }
                 /*
                  * In any case we need to clean the dirty flag and we must
                  * do it under the buffer lock to be sure we don't race
                  * with running write-out.
                  */
-                JBUFFER_TRACE(jh, "Unexpected dirty buffer");
-                jbd_unexpected_dirty_buffer(jh);
+                JBUFFER_TRACE(jh, "Journalling dirty buffer");
+                clear_buffer_dirty(bh);
+                set_buffer_jbddirty(bh);
         }
 
         unlock_buffer(bh);
@@ -826,6 +809,15 @@ int journal_get_create_access(handle_t *handle, struct buffer_head *bh)
         J_ASSERT_JH(jh, buffer_locked(jh2bh(jh)));
 
         if (jh->b_transaction == NULL) {
+                /*
+                 * Previous journal_forget() could have left the buffer
+                 * with jbddirty bit set because it was being committed. When
+                 * the commit finished, we've filed the buffer for
+                 * checkpointing and marked it dirty. Now we are reallocating
+                 * the buffer so the transaction freeing it must have
+                 * committed and so it's safe to clear the dirty bit.
+                 */
+                clear_buffer_dirty(jh2bh(jh));
                 jh->b_transaction = transaction;
 
                 /* first access by this transaction */
@@ -1782,8 +1774,13 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
 
         if (jh->b_cp_transaction) {
                 JBUFFER_TRACE(jh, "on running+cp transaction");
+                /*
+                 * We don't want to write the buffer anymore, clear the
+                 * bit so that we don't confuse checks in
+                 * __journal_file_buffer
+                 */
+                clear_buffer_dirty(bh);
                 __journal_file_buffer(jh, transaction, BJ_Forget);
-                clear_buffer_jbddirty(bh);
                 may_free = 0;
         } else {
                 JBUFFER_TRACE(jh, "on running transaction");
@@ -2041,12 +2038,17 @@ void __journal_file_buffer(struct journal_head *jh,
         if (jh->b_transaction && jh->b_jlist == jlist)
                 return;
 
-        /* The following list of buffer states needs to be consistent
-         * with __jbd_unexpected_dirty_buffer()'s handling of dirty
-         * state. */
-
         if (jlist == BJ_Metadata || jlist == BJ_Reserved ||
             jlist == BJ_Shadow || jlist == BJ_Forget) {
+                /*
+                 * For metadata buffers, we track dirty bit in buffer_jbddirty
+                 * instead of buffer_dirty. We should not see a dirty bit set
+                 * here because we clear it in do_get_write_access but e.g.
+                 * tune2fs can modify the sb and set the dirty bit at any time
+                 * so we try to gracefully handle that.
+                 */
+                if (buffer_dirty(bh))
+                        warn_dirty_buffer(bh);
                 if (test_clear_buffer_dirty(bh) ||
                     test_clear_buffer_jbddirty(bh))
                         was_dirty = 1;
diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c
index 91fa3ad6e8c2..a29c7c3e3fb8 100644
--- a/fs/jfs/acl.c
+++ b/fs/jfs/acl.c
@@ -67,10 +67,8 @@ static struct posix_acl *jfs_get_acl(struct inode *inode, int type)
                 acl = posix_acl_from_xattr(value, size);
         }
         kfree(value);
-        if (!IS_ERR(acl)) {
+        if (!IS_ERR(acl))
                 set_cached_acl(inode, type, acl);
-                posix_acl_release(acl);
-        }
         return acl;
 }
 
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index c2d061675d80..8d25ccb2d51d 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1242,20 +1242,6 @@ error:
         return error;
 }
 
-/*
- * Initialize a session.
- * Note: save the mount rsize and wsize for create_server negotiation.
- */
-static void nfs4_init_session(struct nfs_client *clp,
-                              unsigned int wsize, unsigned int rsize)
-{
-#if defined(CONFIG_NFS_V4_1)
-        if (nfs4_has_session(clp)) {
-                clp->cl_session->fc_attrs.max_rqst_sz = wsize;
-                clp->cl_session->fc_attrs.max_resp_sz = rsize;
-        }
-#endif /* CONFIG_NFS_V4_1 */
-}
 
 /*
  * Session has been established, and the client marked ready.
@@ -1350,7 +1336,9 @@ struct nfs_server *nfs4_create_server(const struct nfs_parsed_mount_data *data,
         BUG_ON(!server->nfs_client->rpc_ops);
         BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
 
-        nfs4_init_session(server->nfs_client, server->wsize, server->rsize);
+        error = nfs4_init_session(server);
+        if (error < 0)
+                goto error;
 
         /* Probe the root fh to retrieve its FSID */
         error = nfs4_path_walk(server, mntfh, data->nfs_server.export_path);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 38d42c29fb92..32062c33c859 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1025,12 +1025,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
                                 res = NULL;
                                 goto out;
                         /* This turned out not to be a regular file */
-                        case -EISDIR:
                         case -ENOTDIR:
                                 goto no_open;
                         case -ELOOP:
                                 if (!(nd->intent.open.flags & O_NOFOLLOW))
                                         goto no_open;
+                        /* case -EISDIR: */
                         /* case -EINVAL: */
                         default:
                                 goto out;
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 61bc3a32e1e2..6ea07a3c75d4 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -220,6 +220,7 @@ extern void nfs4_destroy_session(struct nfs4_session *session);
 extern struct nfs4_session *nfs4_alloc_session(struct nfs_client *clp);
 extern int nfs4_proc_create_session(struct nfs_client *, int reset);
 extern int nfs4_proc_destroy_session(struct nfs4_session *);
+extern int nfs4_init_session(struct nfs_server *server);
 #else /* CONFIG_NFS_v4_1 */
 static inline int nfs4_setup_sequence(struct nfs_client *clp,
                 struct nfs4_sequence_args *args, struct nfs4_sequence_res *res,
@@ -227,6 +228,11 @@ static inline int nfs4_setup_sequence(struct nfs_client *clp,
 {
         return 0;
 }
+
+static inline int nfs4_init_session(struct nfs_server *server)
+{
+        return 0;
+}
 #endif /* CONFIG_NFS_V4_1 */
 
 extern struct nfs4_state_maintenance_ops *nfs4_state_renewal_ops[];
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ff0c080db59b..6917311f201c 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2040,15 +2040,9 @@ static int _nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
                 .rpc_argp = &args,
                 .rpc_resp = &res,
         };
-        int status;
 
         nfs_fattr_init(info->fattr);
-        status = nfs4_recover_expired_lease(server);
-        if (!status)
-                status = nfs4_check_client_ready(server->nfs_client);
-        if (!status)
-                status = nfs4_call_sync(server, &msg, &args, &res, 0);
-        return status;
+        return nfs4_call_sync(server, &msg, &args, &res, 0);
 }
 
 static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
@@ -4099,15 +4093,23 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
         if (request->fl_start < 0 || request->fl_end < 0)
                 return -EINVAL;
 
-        if (IS_GETLK(cmd))
-                return nfs4_proc_getlk(state, F_GETLK, request);
+        if (IS_GETLK(cmd)) {
+                if (state != NULL)
+                        return nfs4_proc_getlk(state, F_GETLK, request);
+                return 0;
+        }
 
         if (!(IS_SETLK(cmd) || IS_SETLKW(cmd)))
                 return -EINVAL;
 
-        if (request->fl_type == F_UNLCK)
-                return nfs4_proc_unlck(state, cmd, request);
+        if (request->fl_type == F_UNLCK) {
+                if (state != NULL)
+                        return nfs4_proc_unlck(state, cmd, request);
+                return 0;
+        }
 
+        if (state == NULL)
+                return -ENOLCK;
         do {
                 status = nfs4_proc_setlk(state, cmd, request);
                 if ((status != -EAGAIN) || IS_SETLK(cmd))
@@ -4793,6 +4795,22 @@ int nfs4_proc_destroy_session(struct nfs4_session *session)
         return status;
 }
 
+int nfs4_init_session(struct nfs_server *server)
+{
+        struct nfs_client *clp = server->nfs_client;
+        int ret;
+
+        if (!nfs4_has_session(clp))
+                return 0;
+
+        clp->cl_session->fc_attrs.max_rqst_sz = server->wsize;
+        clp->cl_session->fc_attrs.max_resp_sz = server->rsize;
+        ret = nfs4_recover_expired_lease(server);
+        if (!ret)
+                ret = nfs4_check_client_ready(clp);
+        return ret;
+}
+
 /*
  * Renew the cl_session lease.
  */
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index b73c5a728655..65ca8c18476f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -553,6 +553,7 @@ static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, f
         INIT_LIST_HEAD(&lsp->ls_sequence.list);
         lsp->ls_seqid.sequence = &lsp->ls_sequence;
         atomic_set(&lsp->ls_count, 1);
+        lsp->ls_state = state;
         lsp->ls_owner = fl_owner;
         spin_lock(&clp->cl_lock);
         nfs_alloc_unique_id(&clp->cl_lockowner_id, &lsp->ls_id, 1, 64);
@@ -587,7 +588,6 @@ static struct nfs4_lock_state *nfs4_get_lock_state(struct nfs4_state *state, fl_
                 if (lsp != NULL)
                         break;
                 if (new != NULL) {
-                        new->ls_state = state;
                         list_add(&new->ls_locks, &state->lock_states);
                         set_bit(LK_STATE_IN_USE, &state->flags);
                         lsp = new;
diff --git a/fs/nilfs2/Kconfig b/fs/nilfs2/Kconfig
new file mode 100644
index 000000000000..72da095d4009
--- /dev/null
+++ b/fs/nilfs2/Kconfig
@@ -0,0 +1,25 @@
+config NILFS2_FS
+        tristate "NILFS2 file system support (EXPERIMENTAL)"
+        depends on BLOCK && EXPERIMENTAL
+        select CRC32
+        help
+          NILFS2 is a log-structured file system (LFS) supporting continuous
+          snapshotting.  In addition to versioning capability of the entire
+          file system, users can even restore files mistakenly overwritten or
+          destroyed just a few seconds ago.  Since this file system can keep
+          consistency like conventional LFS, it achieves quick recovery after
+          system crashes.
+
+          NILFS2 creates a number of checkpoints every few seconds or per
+          synchronous write basis (unless there is no change).  Users can
+          select significant versions among continuously created checkpoints,
+          and can change them into snapshots which will be preserved for long
+          periods until they are changed back to checkpoints.  Each
+          snapshot is mountable as a read-only file system concurrently with
+          its writable mount, and this feature is convenient for online backup.
+
+          Some features including atime, extended attributes, and POSIX ACLs,
+          are not supported yet.
+
+          To compile this file system support as a module, choose M here: the
+          module will be called nilfs2.  If unsure, say N.
diff --git a/fs/notify/Kconfig b/fs/notify/Kconfig
index 31dac7e3b0f1..dffbb0911d02 100644
--- a/fs/notify/Kconfig
+++ b/fs/notify/Kconfig
@@ -1,15 +1,5 @@
 config FSNOTIFY
-        bool "Filesystem notification backend"
-        default y
-        ---help---
-           fsnotify is a backend for filesystem notification.  fsnotify does
-           not provide any userspace interface but does provide the basis
-           needed for other notification schemes such as dnotify, inotify,
-           and fanotify.
-
-           Say Y here to enable fsnotify suport.
-
-           If unsure, say Y.
+        def_bool n
 
 source "fs/notify/dnotify/Kconfig"
 source "fs/notify/inotify/Kconfig"
diff --git a/fs/notify/dnotify/Kconfig b/fs/notify/dnotify/Kconfig
index 904ff8d5405a..f9c1ca139d8f 100644
--- a/fs/notify/dnotify/Kconfig
+++ b/fs/notify/dnotify/Kconfig
@@ -1,6 +1,6 @@
 config DNOTIFY
         bool "Dnotify support"
-        depends on FSNOTIFY
+        select FSNOTIFY
         default y
         help
           Dnotify is a directory-based per-fd file change notification system
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index ec2f7bd76818..037e878e03fc 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -159,7 +159,9 @@ void fsnotify(struct inode *to_tell, __u32 mask, void *data, int data_is, const
                         if (!group->ops->should_send_event(group, to_tell, mask))
                                 continue;
                         if (!event) {
-                                event = fsnotify_create_event(to_tell, mask, data, data_is, file_name, cookie);
+                                event = fsnotify_create_event(to_tell, mask, data,
+                                                              data_is, file_name, cookie,
+                                                              GFP_KERNEL);
                                 /* shit, we OOM'd and now we can't tell, maybe
                                  * someday someone else will want to do something
                                  * here */
diff --git a/fs/notify/inotify/Kconfig b/fs/notify/inotify/Kconfig
index 5356884289a1..3e56dbffe729 100644
--- a/fs/notify/inotify/Kconfig
+++ b/fs/notify/inotify/Kconfig
@@ -15,7 +15,7 @@ config INOTIFY
 
 config INOTIFY_USER
         bool "Inotify support for userspace"
-        depends on FSNOTIFY
+        select FSNOTIFY
         default y
         ---help---
           Say Y here to enable inotify support for userspace, including the
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index ff27a2965844..f30d9bbc2e1b 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -57,7 +57,6 @@ int inotify_max_user_watches __read_mostly;
 
 static struct kmem_cache *inotify_inode_mark_cachep __read_mostly;
 struct kmem_cache *event_priv_cachep __read_mostly;
-static struct fsnotify_event *inotify_ignored_event;
 
 /*
  * When inotify registers a new group it increments this and uses that
@@ -365,6 +364,17 @@ static int inotify_find_inode(const char __user *dirname, struct path *path, uns
         return error;
 }
 
+static void inotify_remove_from_idr(struct fsnotify_group *group,
+                                    struct inotify_inode_mark_entry *ientry)
+{
+        struct idr *idr;
+
+        spin_lock(&group->inotify_data.idr_lock);
+        idr = &group->inotify_data.idr;
+        idr_remove(idr, ientry->wd);
+        spin_unlock(&group->inotify_data.idr_lock);
+        ientry->wd = -1;
+}
 /*
  * Send IN_IGNORED for this wd, remove this wd from the idr, and drop the
  * internal reference help on the mark because it is in the idr.
@@ -373,13 +383,19 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
                                     struct fsnotify_group *group)
 {
         struct inotify_inode_mark_entry *ientry;
+        struct fsnotify_event *ignored_event;
         struct inotify_event_private_data *event_priv;
         struct fsnotify_event_private_data *fsn_event_priv;
-        struct idr *idr;
+
+        ignored_event = fsnotify_create_event(NULL, FS_IN_IGNORED, NULL,
+                                              FSNOTIFY_EVENT_NONE, NULL, 0,
+                                              GFP_NOFS);
+        if (!ignored_event)
+                return;
 
         ientry = container_of(entry, struct inotify_inode_mark_entry, fsn_entry);
 
-        event_priv = kmem_cache_alloc(event_priv_cachep, GFP_KERNEL);
+        event_priv = kmem_cache_alloc(event_priv_cachep, GFP_NOFS);
         if (unlikely(!event_priv))
                 goto skip_send_ignore;
 
@@ -388,7 +404,7 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
         fsn_event_priv->group = group;
         event_priv->wd = ientry->wd;
 
-        fsnotify_add_notify_event(group, inotify_ignored_event, fsn_event_priv);
+        fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);
 
         /* did the private data get added? */
         if (list_empty(&fsn_event_priv->event_list))
@@ -396,14 +412,16 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
 
 skip_send_ignore:
 
+        /* matches the reference taken when the event was created */
+        fsnotify_put_event(ignored_event);
+
         /* remove this entry from the idr */
-        spin_lock(&group->inotify_data.idr_lock);
-        idr = &group->inotify_data.idr;
-        idr_remove(idr, ientry->wd);
-        spin_unlock(&group->inotify_data.idr_lock);
+        inotify_remove_from_idr(group, ientry);
 
         /* removed from idr, drop that reference */
         fsnotify_put_mark(entry);
+
+        atomic_dec(&group->inotify_data.user->inotify_watches);
 }
 
 /* ding dong the mark is dead */
@@ -418,6 +436,7 @@ static int inotify_update_watch(struct fsnotify_group *group, struct inode *inod
 {
         struct fsnotify_mark_entry *entry = NULL;
         struct inotify_inode_mark_entry *ientry;
+        struct inotify_inode_mark_entry *tmp_ientry;
         int ret = 0;
         int add = (arg & IN_MASK_ADD);
         __u32 mask;
@@ -428,54 +447,66 @@ static int inotify_update_watch(struct fsnotify_group *group, struct inode *inod
         if (unlikely(!mask))
                 return -EINVAL;
 
-        ientry = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL);
-        if (unlikely(!ientry))
+        tmp_ientry = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL);
+        if (unlikely(!tmp_ientry))
                 return -ENOMEM;
         /* we set the mask at the end after attaching it */
-        fsnotify_init_mark(&ientry->fsn_entry, inotify_free_mark);
-        ientry->wd = 0;
+        fsnotify_init_mark(&tmp_ientry->fsn_entry, inotify_free_mark);
+        tmp_ientry->wd = -1;
 
 find_entry:
         spin_lock(&inode->i_lock);
         entry = fsnotify_find_mark_entry(group, inode);
         spin_unlock(&inode->i_lock);
         if (entry) {
-                kmem_cache_free(inotify_inode_mark_cachep, ientry);
                 ientry = container_of(entry, struct inotify_inode_mark_entry, fsn_entry);
         } else {
-                if (atomic_read(&group->inotify_data.user->inotify_watches) >= inotify_max_user_watches) {
-                        ret = -ENOSPC;
-                        goto out_err;
-                }
-
-                ret = fsnotify_add_mark(&ientry->fsn_entry, group, inode);
-                if (ret == -EEXIST)
-                        goto find_entry;
-                else if (ret)
+                ret = -ENOSPC;
+                if (atomic_read(&group->inotify_data.user->inotify_watches) >= inotify_max_user_watches)
                         goto out_err;
-
-                entry = &ientry->fsn_entry;
 retry:
                 ret = -ENOMEM;
                 if (unlikely(!idr_pre_get(&group->inotify_data.idr, GFP_KERNEL)))
                         goto out_err;
 
                 spin_lock(&group->inotify_data.idr_lock);
-                /* if entry is added to the idr we keep the reference obtained
-                 * through fsnotify_mark_add.  remember to drop this reference
-                 * when entry is removed from idr */
-                ret = idr_get_new_above(&group->inotify_data.idr, entry,
-                                        ++group->inotify_data.last_wd,
-                                        &ientry->wd);
+                ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
+                                        group->inotify_data.last_wd,
+                                        &tmp_ientry->wd);
                 spin_unlock(&group->inotify_data.idr_lock);
                 if (ret) {
                         if (ret == -EAGAIN)
                                 goto retry;
                         goto out_err;
                 }
+
+                ret = fsnotify_add_mark(&tmp_ientry->fsn_entry, group, inode);
+                if (ret) {
+                        inotify_remove_from_idr(group, tmp_ientry);
+                        if (ret == -EEXIST)
+                                goto find_entry;
+                        goto out_err;
+                }
+
+                /* tmp_ientry has been added to the inode, so we are all set up.
+                 * now we just need to make sure tmp_ientry doesn't get freed and
+                 * we need to set up entry and ientry so the generic code can
+                 * do its thing. */
+                ientry = tmp_ientry;
+                entry = &ientry->fsn_entry;
+                tmp_ientry = NULL;
+
                 atomic_inc(&group->inotify_data.user->inotify_watches);
+
+                /* update the idr hint */
+                group->inotify_data.last_wd = ientry->wd;
+
+                /* we put the mark on the idr, take a reference */
+                fsnotify_get_mark(entry);
         }
 
+        ret = ientry->wd;
+
         spin_lock(&entry->lock);
 
         old_mask = entry->mask;
@@ -506,14 +537,19 @@ retry:
                         fsnotify_recalc_group_mask(group);
         }
 
-        return ientry->wd;
+        /* this either matches fsnotify_find_mark_entry, or init_mark_entry
+         * depending on which path we took... */
+        fsnotify_put_mark(entry);
 
 out_err:
-        /* see this isn't supposed to happen, just kill the watch */
-        if (entry) {
-                fsnotify_destroy_mark_by_entry(entry);
-                fsnotify_put_mark(entry);
+        /* could be an error, could be that we found an existing mark */
+        if (tmp_ientry) {
+                /* on the idr but didn't make it on the inode */
+                if (tmp_ientry->wd != -1)
+                        inotify_remove_from_idr(group, tmp_ientry);
+                kmem_cache_free(inotify_inode_mark_cachep, tmp_ientry);
         }
+
         return ret;
 }
 
@@ -721,9 +757,6 @@ static int __init inotify_user_setup(void)
 
         inotify_inode_mark_cachep = KMEM_CACHE(inotify_inode_mark_entry, SLAB_PANIC);
         event_priv_cachep = KMEM_CACHE(inotify_event_private_data, SLAB_PANIC);
-        inotify_ignored_event = fsnotify_create_event(NULL, FS_IN_IGNORED, NULL, FSNOTIFY_EVENT_NONE, NULL, 0);
-        if (!inotify_ignored_event)
-                panic("unable to allocate the inotify ignored event\n");
 
         inotify_max_queued_events = 16384;
         inotify_max_user_instances = 128;
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index 959b73e756fd..521368574e97 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -136,18 +136,24 @@ static bool event_compare(struct fsnotify_event *old, struct fsnotify_event *new
 {
         if ((old->mask == new->mask) &&
             (old->to_tell == new->to_tell) &&
-            (old->data_type == new->data_type)) {
+            (old->data_type == new->data_type) &&
+            (old->name_len == new->name_len)) {
                 switch (old->data_type) {
                 case (FSNOTIFY_EVENT_INODE):
-                        if (old->inode == new->inode)
+                        /* remember, after old was put on the wait_q we aren't
+                         * allowed to look at the inode any more, only thing
+                         * left to check was if the file_name is the same */
+                        if (old->name_len &&
+                            !strcmp(old->file_name, new->file_name))
                                 return true;
                         break;
                 case (FSNOTIFY_EVENT_PATH):
                         if ((old->path.mnt == new->path.mnt) &&
                             (old->path.dentry == new->path.dentry))
                                 return true;
+                        break;
                 case (FSNOTIFY_EVENT_NONE):
-                        return true;
+                        return false;
                 };
         }
         return false;
@@ -339,18 +345,19 @@ static void initialize_event(struct fsnotify_event *event)
  * @name the filename, if available
  */
 struct fsnotify_event *fsnotify_create_event(struct inode *to_tell, __u32 mask, void *data,
-                                             int data_type, const char *name, u32 cookie)
+                                             int data_type, const char *name, u32 cookie,
+                                             gfp_t gfp)
 {
         struct fsnotify_event *event;
 
-        event = kmem_cache_alloc(fsnotify_event_cachep, GFP_KERNEL);
+        event = kmem_cache_alloc(fsnotify_event_cachep, gfp);
         if (!event)
                 return NULL;
 
         initialize_event(event);
 
         if (name) {
-                event->file_name = kstrdup(name, GFP_KERNEL);
+                event->file_name = kstrdup(name, gfp);
                 if (!event->file_name) {
                         kmem_cache_free(fsnotify_event_cachep, event);
                         return NULL;
diff --git a/fs/pipe.c b/fs/pipe.c
index f7dd21ad85a6..52c415114838 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -68,8 +68,8 @@ void pipe_double_lock(struct pipe_inode_info *pipe1,
                 pipe_lock_nested(pipe1, I_MUTEX_PARENT);
                 pipe_lock_nested(pipe2, I_MUTEX_CHILD);
         } else {
-                pipe_lock_nested(pipe2, I_MUTEX_CHILD);
-                pipe_lock_nested(pipe1, I_MUTEX_PARENT);
+                pipe_lock_nested(pipe2, I_MUTEX_PARENT);
+                pipe_lock_nested(pipe1, I_MUTEX_CHILD);
         }
 }
 
diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
index 9d40e879f99e..77ff547730af 100644
--- a/include/asm-generic/4level-fixup.h
+++ b/include/asm-generic/4level-fixup.h
@@ -27,9 +27,9 @@
 #define pud_page_vaddr(pud)             pgd_page_vaddr(pud)
 
 #undef pud_free_tlb
-#define pud_free_tlb(tlb, x)            do { } while (0)
+#define pud_free_tlb(tlb, x, addr)      do { } while (0)
 #define pud_free(mm, x)                 do { } while (0)
-#define __pud_free_tlb(tlb, x)          do { } while (0)
+#define __pud_free_tlb(tlb, x, addr)    do { } while (0)
 
 #undef  pud_addr_end
 #define pud_addr_end(addr, end)         (end)
diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
index a7cdc48e8b78..725612b793ce 100644
--- a/include/asm-generic/pgtable-nopmd.h
+++ b/include/asm-generic/pgtable-nopmd.h
@@ -59,7 +59,7 @@ static inline pmd_t * pmd_offset(pud_t * pud, unsigned long address)
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 {
 }
-#define __pmd_free_tlb(tlb, x)                  do { } while (0)
+#define __pmd_free_tlb(tlb, x, a)               do { } while (0)
 
 #undef  pmd_addr_end
 #define pmd_addr_end(addr, end)                 (end)
diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
index 87cf449a6df3..810431d8351b 100644
--- a/include/asm-generic/pgtable-nopud.h
+++ b/include/asm-generic/pgtable-nopud.h
@@ -52,7 +52,7 @@ static inline pud_t * pud_offset(pgd_t * pgd, unsigned long address)
  */
 #define pud_alloc_one(mm, address)              NULL
 #define pud_free(mm, x)                         do { } while (0)
-#define __pud_free_tlb(tlb, x)                  do { } while (0)
+#define __pud_free_tlb(tlb, x, a)               do { } while (0)
 
 #undef  pud_addr_end
 #define pud_addr_end(addr, end)                 (end)
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index f490e43a90b9..e43f9766259f 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -123,24 +123,24 @@ static inline void tlb_remove_page(struct mmu_gather *tlb, struct page *page)
                 __tlb_remove_tlb_entry(tlb, ptep, address);     \
         } while (0)
 
-#define pte_free_tlb(tlb, ptep)                                 \
+#define pte_free_tlb(tlb, ptep, address)                        \
         do {                                                    \
                 tlb->need_flush = 1;                            \
-                __pte_free_tlb(tlb, ptep);                      \
+                __pte_free_tlb(tlb, ptep, address);             \
         } while (0)
 
 #ifndef __ARCH_HAS_4LEVEL_HACK
-#define pud_free_tlb(tlb, pudp)                                 \
+#define pud_free_tlb(tlb, pudp, address)                        \
         do {                                                    \
                 tlb->need_flush = 1;                            \
-                __pud_free_tlb(tlb, pudp);                      \
+                __pud_free_tlb(tlb, pudp, address);             \
         } while (0)
 #endif
 
-#define pmd_free_tlb(tlb, pmdp)                                 \
+#define pmd_free_tlb(tlb, pmdp, address)                        \
         do {                                                    \
                 tlb->need_flush = 1;                            \
-                __pmd_free_tlb(tlb, pmdp);                      \
+                __pmd_free_tlb(tlb, pmdp, address);             \
         } while (0)
 
 #define tlb_migrate_finish(mm) do {} while (0)
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 0d6310657f32..655e7721580a 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -84,7 +84,7 @@ typedef int (*dm_merge_fn) (struct dm_target *ti, struct bvec_merge_data *bvm,
 
 typedef int (*iterate_devices_callout_fn) (struct dm_target *ti,
                                            struct dm_dev *dev,
-                                           sector_t physical_start,
+                                           sector_t start, sector_t len,
                                            void *data);
 
 typedef int (*dm_iterate_devices_fn) (struct dm_target *ti,
@@ -104,7 +104,7 @@ void dm_error(const char *message);
  * Combine device limits.
  */
 int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
-                         sector_t start, void *data);
+                         sector_t start, sector_t len, void *data);
 
 struct dm_dev {
         struct block_device *bdev;
diff --git a/include/linux/ext3_fs.h b/include/linux/ext3_fs.h
index 634a5e5aba3e..7499b3667798 100644
--- a/include/linux/ext3_fs.h
+++ b/include/linux/ext3_fs.h
@@ -874,7 +874,7 @@ struct buffer_head * ext3_getblk (handle_t *, struct inode *, long, int, int *);
 struct buffer_head * ext3_bread (handle_t *, struct inode *, int, int, int *);
 int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
         sector_t iblock, unsigned long maxblocks, struct buffer_head *bh_result,
-        int create, int extend_disksize);
+        int create);
 
 extern struct inode *ext3_iget(struct super_block *, unsigned long);
 extern int  ext3_write_inode (struct inode *, int);
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 6c3de999fb34..4d6f47b51189 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -352,7 +352,7 @@ extern void fsnotify_unmount_inodes(struct list_head *list);
 /* put here because inotify does some weird stuff when destroying watches */
 extern struct fsnotify_event *fsnotify_create_event(struct inode *to_tell, __u32 mask,
                                                     void *data, int data_is, const char *name,
-                                                    u32 cookie);
+                                                    u32 cookie, gfp_t gfp);
 
 #else
 
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 2721f07e9354..35e7df1e9f30 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -14,6 +14,7 @@
 #include <linux/irqflags.h>
 #include <linux/smp.h>
 #include <linux/percpu.h>
+#include <linux/hrtimer.h>
 
 #include <asm/atomic.h>
 #include <asm/ptrace.h>
@@ -64,11 +65,13 @@
  * IRQTF_RUNTHREAD - signals that the interrupt handler thread should run
  * IRQTF_DIED      - handler thread died
  * IRQTF_WARNED    - warning "IRQ_WAKE_THREAD w/o thread_fn" has been printed
+ * IRQTF_AFFINITY  - irq thread is requested to adjust affinity
  */
 enum {
         IRQTF_RUNTHREAD,
         IRQTF_DIED,
         IRQTF_WARNED,
+        IRQTF_AFFINITY,
 };
 
 typedef irqreturn_t (*irq_handler_t)(int, void *);
@@ -517,6 +520,31 @@ extern void tasklet_kill_immediate(struct tasklet_struct *t, unsigned int cpu);
 extern void tasklet_init(struct tasklet_struct *t,
                          void (*func)(unsigned long), unsigned long data);
 
+struct tasklet_hrtimer {
+        struct hrtimer          timer;
+        struct tasklet_struct   tasklet;
+        enum hrtimer_restart    (*function)(struct hrtimer *);
+};
+
+extern void
+tasklet_hrtimer_init(struct tasklet_hrtimer *ttimer,
+                     enum hrtimer_restart (*function)(struct hrtimer *),
+                     clockid_t which_clock, enum hrtimer_mode mode);
+
+static inline
+int tasklet_hrtimer_start(struct tasklet_hrtimer *ttimer, ktime_t time,
+                          const enum hrtimer_mode mode)
+{
+        return hrtimer_start(&ttimer->timer, time, mode);
+}
+
+static inline
+void tasklet_hrtimer_cancel(struct tasklet_hrtimer *ttimer)
+{
+        hrtimer_cancel(&ttimer->timer);
+        tasklet_kill(&ttimer->tasklet);
+}
+
 /*
  * Autoprobing for irqs:
  *
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
index c9663c690303..53b94e025c7c 100644
--- a/include/linux/of_mdio.h
+++ b/include/linux/of_mdio.h
@@ -18,5 +18,8 @@ extern struct phy_device *of_phy_connect(struct net_device *dev,
                                          struct device_node *phy_np,
                                          void (*hndlr)(struct net_device *),
                                          u32 flags, phy_interface_t iface);
+extern struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
+                                         void (*hndlr)(struct net_device *),
+                                         phy_interface_t iface);
 
 #endif /* __LINUX_OF_MDIO_H */
diff --git a/include/linux/perf_counter.h b/include/linux/perf_counter.h
index 5e970c7d3fd5..bd15d7a5f5ce 100644
--- a/include/linux/perf_counter.h
+++ b/include/linux/perf_counter.h
@@ -120,8 +120,9 @@ enum perf_counter_sample_format {
         PERF_SAMPLE_ID                          = 1U << 6,
         PERF_SAMPLE_CPU                         = 1U << 7,
         PERF_SAMPLE_PERIOD                      = 1U << 8,
+        PERF_SAMPLE_STREAM_ID                   = 1U << 9,
 
-        PERF_SAMPLE_MAX = 1U << 9,              /* non-ABI */
+        PERF_SAMPLE_MAX = 1U << 10,             /* non-ABI */
 };
 
 /*
@@ -312,16 +313,7 @@ enum perf_event_type {
          *      struct perf_event_header        header;
          *      u64                             time;
          *      u64                             id;
-         *      u64                             sample_period;
-         * };
-         */
-        PERF_EVENT_PERIOD               = 4,
-
-        /*
-         * struct {
-         *      struct perf_event_header        header;
-         *      u64                             time;
-         *      u64                             id;
+         *      u64                             stream_id;
          * };
          */
         PERF_EVENT_THROTTLE             = 5,
@@ -356,6 +348,7 @@ enum perf_event_type {
          *      { u64                   time;     } && PERF_SAMPLE_TIME
          *      { u64                   addr;     } && PERF_SAMPLE_ADDR
          *      { u64                   id;       } && PERF_SAMPLE_ID
+         *      { u64                   stream_id;} && PERF_SAMPLE_STREAM_ID
          *      { u32                   cpu, res; } && PERF_SAMPLE_CPU
          *      { u64                   period;   } && PERF_SAMPLE_PERIOD
          *
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index 2ce29831feb6..278777fa8a3a 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -224,7 +224,7 @@ void rfkill_destroy(struct rfkill *rfkill);
  * should be blocked) so that drivers need not keep track of the soft
  * block state -- which they might not be able to.
  */
-bool __must_check rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
+bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
 
 /**
  * rfkill_set_sw_state - Set the internal rfkill software block state
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 16a982e389fb..3ab08e4bb6b8 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -209,7 +209,7 @@ extern unsigned long long time_sync_thresh;
                         ((task->state & (__TASK_STOPPED | __TASK_TRACED)) != 0)
 #define task_contributes_to_load(task)  \
                                 ((task->state & TASK_UNINTERRUPTIBLE) != 0 && \
-                                 (task->flags & PF_FROZEN) == 0)
+                                 (task->flags & PF_FREEZING) == 0)
 
 #define __set_task_state(tsk, state_value)              \
         do { (tsk)->state = (state_value); } while (0)
@@ -1680,6 +1680,7 @@ extern cputime_t task_gtime(struct task_struct *p);
 #define PF_MEMALLOC     0x00000800      /* Allocating memory */
 #define PF_FLUSHER      0x00001000      /* responsible for disk writeback */
 #define PF_USED_MATH    0x00002000      /* if unset the fpu must be initialized before use */
+#define PF_FREEZING     0x00004000      /* freeze in progress. do not account to load */
 #define PF_NOFREEZE     0x00008000      /* this thread should not be frozen */
 #define PF_FROZEN       0x00010000      /* frozen for system suspend */
 #define PF_FSTRANS      0x00020000      /* inside a filesystem transaction */
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index 95846d988011..74f16876f38d 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -338,6 +338,7 @@ struct v4l2_pix_format {
 /*  Vendor-specific formats   */
 #define V4L2_PIX_FMT_WNVA     v4l2_fourcc('W', 'N', 'V', 'A') /* Winnov hw compress */
 #define V4L2_PIX_FMT_SN9C10X  v4l2_fourcc('S', '9', '1', '0') /* SN9C10x compression */
+#define V4L2_PIX_FMT_SN9C20X_I420 v4l2_fourcc('S', '9', '2', '0') /* SN9C20x YUV 4:2:0 */
 #define V4L2_PIX_FMT_PWC1     v4l2_fourcc('P', 'W', 'C', '1') /* pwc older webcam */
 #define V4L2_PIX_FMT_PWC2     v4l2_fourcc('P', 'W', 'C', '2') /* pwc newer webcam */
 #define V4L2_PIX_FMT_ET61X251 v4l2_fourcc('E', '6', '2', '5') /* ET61X251 compression */
diff --git a/include/media/v4l2-chip-ident.h b/include/media/v4l2-chip-ident.h
index 11a4a2d3e364..94e908c0d7a0 100644
--- a/include/media/v4l2-chip-ident.h
+++ b/include/media/v4l2-chip-ident.h
@@ -60,6 +60,10 @@ enum {
         V4L2_IDENT_OV7670 = 250,
         V4L2_IDENT_OV7720 = 251,
         V4L2_IDENT_OV7725 = 252,
+        V4L2_IDENT_OV7660 = 253,
+        V4L2_IDENT_OV9650 = 254,
+        V4L2_IDENT_OV9655 = 255,
+        V4L2_IDENT_SOI968 = 256,
 
         /* module saa7146: reserved range 300-309 */
         V4L2_IDENT_SAA7146 = 300,
@@ -161,6 +165,9 @@ enum {
         /* module tw9910: just ident 9910 */
         V4L2_IDENT_TW9910 = 9910,
 
+        /* module sn9c20x: just ident 10000 */
+        V4L2_IDENT_SN9C20X = 10000,
+
         /* module msp3400: reserved range 34000-34999 and 44000-44999 */
         V4L2_IDENT_MSPX4XX  = 34000, /* generic MSPX4XX identifier, only
                                         use internally (tveeprom.c). */
@@ -237,6 +244,11 @@ enum {
         V4L2_IDENT_MT9V022IX7ATC        = 45010, /* No way to detect "normal" I77ATx */
         V4L2_IDENT_MT9V022IX7ATM        = 45015, /* and "lead free" IA7ATx chips */
         V4L2_IDENT_MT9T031              = 45020,
+        V4L2_IDENT_MT9V111              = 45031,
+        V4L2_IDENT_MT9V112              = 45032,
+
+        /* HV7131R CMOS sensor: just ident 46000 */
+        V4L2_IDENT_HV7131R              = 46000,
 
         /* module cs53132a: just ident 53132 */
         V4L2_IDENT_CS53l32A = 53132,
diff --git a/include/net/rose.h b/include/net/rose.h
index cbd5364b2c8a..5ba9f02731eb 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -156,7 +156,7 @@ extern int  sysctl_rose_maximum_vcs;
 extern int  sysctl_rose_window_size;
 extern int  rosecmp(rose_address *, rose_address *);
 extern int  rosecmpm(rose_address *, rose_address *, unsigned short);
-extern const char *rose2asc(const rose_address *);
+extern char *rose2asc(char *buf, const rose_address *);
 extern struct sock *rose_find_socket(unsigned int, struct rose_neigh *);
 extern void rose_kill_by_neigh(struct rose_neigh *);
 extern unsigned int rose_new_lci(struct rose_neigh *);
diff --git a/include/net/sock.h b/include/net/sock.h
index 2c0da9239b95..950409dcec3d 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -104,15 +104,15 @@ struct net;
 
 /**
  *      struct sock_common - minimal network layer representation of sockets
+ *      @skc_node: main hash linkage for various protocol lookup tables
+ *      @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol
+ *      @skc_refcnt: reference count
+ *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_family: network address family
  *      @skc_state: Connection state
  *      @skc_reuse: %SO_REUSEADDR setting
  *      @skc_bound_dev_if: bound device index if != 0
- *      @skc_node: main hash linkage for various protocol lookup tables
- *      @skc_nulls_node: main hash linkage for UDP/UDP-Lite protocol
  *      @skc_bind_node: bind hash linkage for various protocol lookup tables
- *      @skc_refcnt: reference count
- *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_prot: protocol handlers inside a network family
  *      @skc_net: reference to the network namespace of this socket
  *
@@ -120,17 +120,21 @@ struct net;
  *      for struct sock and struct inet_timewait_sock.
  */
 struct sock_common {
-        unsigned short          skc_family;
-        volatile unsigned char  skc_state;
-        unsigned char           skc_reuse;
-        int                     skc_bound_dev_if;
+        /*
+         * first fields are not copied in sock_copy()
+         */
         union {
                 struct hlist_node       skc_node;
                 struct hlist_nulls_node skc_nulls_node;
         };
-        struct hlist_node       skc_bind_node;
         atomic_t                skc_refcnt;
+
         unsigned int            skc_hash;
+        unsigned short          skc_family;
+        volatile unsigned char  skc_state;
+        unsigned char           skc_reuse;
+        int                     skc_bound_dev_if;
+        struct hlist_node       skc_bind_node;
         struct proto            *skc_prot;
 #ifdef CONFIG_NET_NS
         struct net              *skc_net;
@@ -208,15 +212,17 @@ struct sock {
          * don't add nothing before this first member (__sk_common) --acme
          */
         struct sock_common      __sk_common;
+#define sk_node                 __sk_common.skc_node
+#define sk_nulls_node           __sk_common.skc_nulls_node
+#define sk_refcnt               __sk_common.skc_refcnt
+
+#define sk_copy_start           __sk_common.skc_hash
+#define sk_hash                 __sk_common.skc_hash
 #define sk_family               __sk_common.skc_family
 #define sk_state                __sk_common.skc_state
 #define sk_reuse                __sk_common.skc_reuse
 #define sk_bound_dev_if         __sk_common.skc_bound_dev_if
-#define sk_node                 __sk_common.skc_node
-#define sk_nulls_node           __sk_common.skc_nulls_node
 #define sk_bind_node            __sk_common.skc_bind_node
-#define sk_refcnt               __sk_common.skc_refcnt
-#define sk_hash                 __sk_common.skc_hash
 #define sk_prot                 __sk_common.skc_prot
 #define sk_net                  __sk_common.skc_net
         kmemcheck_bitfield_begin(flags);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 19f4150f4d4d..88af84306471 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1425,6 +1425,11 @@ struct tcp_request_sock_ops {
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_md5sig_key   *(*md5_lookup) (struct sock *sk,
                                                 struct request_sock *req);
+        int                     (*calc_md5_hash) (char *location,
+                                                  struct tcp_md5sig_key *md5,
+                                                  struct sock *sk,
+                                                  struct request_sock *req,
+                                                  struct sk_buff *skb);
 #endif
 };
 
diff --git a/init/Kconfig b/init/Kconfig
index 1ce05a4cb5f6..cb2c09270226 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -962,7 +962,7 @@ config PERF_COUNTERS
 
 config EVENT_PROFILE
         bool "Tracepoint profile sources"
-        depends on PERF_COUNTERS && EVENT_TRACER
+        depends on PERF_COUNTERS && EVENT_TRACING
         default y
 
 endmenu
diff --git a/kernel/fork.c b/kernel/fork.c
index bd2959228871..9b42695f0d14 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1407,14 +1407,11 @@ long do_fork(unsigned long clone_flags,
                 if (clone_flags & CLONE_VFORK) {
                         p->vfork_done = &vfork;
                         init_completion(&vfork);
-                } else if (!(clone_flags & CLONE_VM)) {
-                        /*
-                         * vfork will do an exec which will call
-                         * set_task_comm()
-                         */
-                        perf_counter_fork(p);
                 }
 
+                if (!(clone_flags & CLONE_THREAD))
+                        perf_counter_fork(p);
+
                 audit_finish_fork(p);
                 tracehook_report_clone(regs, clone_flags, nr, p);
 
diff --git a/kernel/freezer.c b/kernel/freezer.c
index 2f4936cf7083..bd1d42b17cb2 100644
--- a/kernel/freezer.c
+++ b/kernel/freezer.c
@@ -44,12 +44,19 @@ void refrigerator(void)
         recalc_sigpending(); /* We sent fake signal, clean it up */
         spin_unlock_irq(&current->sighand->siglock);
 
+        /* prevent accounting of that task to load */
+        current->flags |= PF_FREEZING;
+
         for (;;) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
                 if (!frozen(current))
                         break;
                 schedule();
         }
+
+        /* Remove the accounting blocker */
+        current->flags &= ~PF_FREEZING;
+
         pr_debug("%s left refrigerator\n", current->comm);
         __set_current_state(save);
 }
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 73468253143b..e70ed5592eb9 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -42,8 +42,7 @@ static inline void unregister_handler_proc(unsigned int irq,
 
 extern int irq_select_affinity_usr(unsigned int irq);
 
-extern void
-irq_set_thread_affinity(struct irq_desc *desc, const struct cpumask *cpumask);
+extern void irq_set_thread_affinity(struct irq_desc *desc);
 
 /*
  * Debugging printout:
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 50da67672901..61c679db4687 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -80,14 +80,22 @@ int irq_can_set_affinity(unsigned int irq)
         return 1;
 }
 
-void
-irq_set_thread_affinity(struct irq_desc *desc, const struct cpumask *cpumask)
+/**
+ *      irq_set_thread_affinity - Notify irq threads to adjust affinity
+ *      @desc:          irq descriptor which has affitnity changed
+ *
+ *      We just set IRQTF_AFFINITY and delegate the affinity setting
+ *      to the interrupt thread itself. We can not call
+ *      set_cpus_allowed_ptr() here as we hold desc->lock and this
+ *      code can be called from hard interrupt context.
+ */
+void irq_set_thread_affinity(struct irq_desc *desc)
 {
         struct irqaction *action = desc->action;
 
         while (action) {
                 if (action->thread)
-                        set_cpus_allowed_ptr(action->thread, cpumask);
+                        set_bit(IRQTF_AFFINITY, &action->thread_flags);
                 action = action->next;
         }
 }
@@ -112,7 +120,7 @@ int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
         if (desc->status & IRQ_MOVE_PCNTXT) {
                 if (!desc->chip->set_affinity(irq, cpumask)) {
                         cpumask_copy(desc->affinity, cpumask);
-                        irq_set_thread_affinity(desc, cpumask);
+                        irq_set_thread_affinity(desc);
                 }
         }
         else {
@@ -122,7 +130,7 @@ int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
 #else
         if (!desc->chip->set_affinity(irq, cpumask)) {
                 cpumask_copy(desc->affinity, cpumask);
-                irq_set_thread_affinity(desc, cpumask);
+                irq_set_thread_affinity(desc);
         }
 #endif
         desc->status |= IRQ_AFFINITY_SET;
@@ -176,7 +184,7 @@ int irq_select_affinity_usr(unsigned int irq)
         spin_lock_irqsave(&desc->lock, flags);
         ret = setup_affinity(irq, desc);
         if (!ret)
-                irq_set_thread_affinity(desc, desc->affinity);
+                irq_set_thread_affinity(desc);
         spin_unlock_irqrestore(&desc->lock, flags);
 
         return ret;
@@ -443,6 +451,39 @@ static int irq_wait_for_interrupt(struct irqaction *action)
         return -1;
 }
 
+#ifdef CONFIG_SMP
+/*
+ * Check whether we need to change the affinity of the interrupt thread.
+ */
+static void
+irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action)
+{
+        cpumask_var_t mask;
+
+        if (!test_and_clear_bit(IRQTF_AFFINITY, &action->thread_flags))
+                return;
+
+        /*
+         * In case we are out of memory we set IRQTF_AFFINITY again and
+         * try again next time
+         */
+        if (!alloc_cpumask_var(&mask, GFP_KERNEL)) {
+                set_bit(IRQTF_AFFINITY, &action->thread_flags);
+                return;
+        }
+
+        spin_lock_irq(&desc->lock);
+        cpumask_copy(mask, desc->affinity);
+        spin_unlock_irq(&desc->lock);
+
+        set_cpus_allowed_ptr(current, mask);
+        free_cpumask_var(mask);
+}
+#else
+static inline void
+irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action) { }
+#endif
+
 /*
  * Interrupt handler thread
  */
@@ -458,6 +499,8 @@ static int irq_thread(void *data)
 
         while (!irq_wait_for_interrupt(action)) {
 
+                irq_thread_check_affinity(desc, action);
+
                 atomic_inc(&desc->threads_active);
 
                 spin_lock_irq(&desc->lock);
diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
index cfe767ca1545..fcb6c96f2627 100644
--- a/kernel/irq/migration.c
+++ b/kernel/irq/migration.c
@@ -45,7 +45,7 @@ void move_masked_irq(int irq)
                    < nr_cpu_ids))
                 if (!desc->chip->set_affinity(irq, desc->pending_mask)) {
                         cpumask_copy(desc->affinity, desc->pending_mask);
-                        irq_set_thread_affinity(desc, desc->pending_mask);
+                        irq_set_thread_affinity(desc);
                 }
 
         cpumask_clear(desc->pending_mask);
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 9b1a7de26979..eb8751aa0418 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -180,10 +180,12 @@ EXPORT_SYMBOL(kthread_bind);
  * @k: thread created by kthread_create().
  *
  * Sets kthread_should_stop() for @k to return true, wakes it, and
- * waits for it to exit.  Your threadfn() must not call do_exit()
- * itself if you use this function!  This can also be called after
- * kthread_create() instead of calling wake_up_process(): the thread
- * will exit without calling threadfn().
+ * waits for it to exit. This can also be called after kthread_create()
+ * instead of calling wake_up_process(): the thread will exit without
+ * calling threadfn().
+ *
+ * If threadfn() may call do_exit() itself, the caller must ensure
+ * task_struct can't go away.
  *
  * Returns the result of threadfn(), or %-EINTR if wake_up_process()
  * was never called.
diff --git a/kernel/module.c b/kernel/module.c
index 0a049837008e..fd1411403558 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1068,7 +1068,8 @@ static inline int check_modstruct_version(Elf_Shdr *sechdrs,
 {
         const unsigned long *crc;
 
-        if (!find_symbol("module_layout", NULL, &crc, true, false))
+        if (!find_symbol(MODULE_SYMBOL_PREFIX "module_layout", NULL,
+                         &crc, true, false))
                 BUG();
         return check_version(sechdrs, versindex, "module_layout", mod, crc);
 }
diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c
index a641eb753b8c..950931041954 100644
--- a/kernel/perf_counter.c
+++ b/kernel/perf_counter.c
@@ -146,6 +146,28 @@ static void put_ctx(struct perf_counter_context *ctx)
         }
 }
 
+static void unclone_ctx(struct perf_counter_context *ctx)
+{
+        if (ctx->parent_ctx) {
+                put_ctx(ctx->parent_ctx);
+                ctx->parent_ctx = NULL;
+        }
+}
+
+/*
+ * If we inherit counters we want to return the parent counter id
+ * to userspace.
+ */
+static u64 primary_counter_id(struct perf_counter *counter)
+{
+        u64 id = counter->id;
+
+        if (counter->parent)
+                id = counter->parent->id;
+
+        return id;
+}
+
 /*
  * Get the perf_counter_context for a task and lock it.
  * This has to cope with with the fact that until it is locked,
@@ -1288,7 +1310,6 @@ static void perf_counter_cpu_sched_in(struct perf_cpu_context *cpuctx, int cpu)
 #define MAX_INTERRUPTS (~0ULL)
 
 static void perf_log_throttle(struct perf_counter *counter, int enable);
-static void perf_log_period(struct perf_counter *counter, u64 period);
 
 static void perf_adjust_period(struct perf_counter *counter, u64 events)
 {
@@ -1307,8 +1328,6 @@ static void perf_adjust_period(struct perf_counter *counter, u64 events)
         if (!sample_period)
                 sample_period = 1;
 
-        perf_log_period(counter, sample_period);
-
         hwc->sample_period = sample_period;
 }
 
@@ -1463,10 +1482,8 @@ static void perf_counter_enable_on_exec(struct task_struct *task)
         /*
          * Unclone this context if we enabled any counter.
          */
-        if (enabled && ctx->parent_ctx) {
-                put_ctx(ctx->parent_ctx);
-                ctx->parent_ctx = NULL;
-        }
+        if (enabled)
+                unclone_ctx(ctx);
 
         spin_unlock(&ctx->lock);
 
@@ -1526,7 +1543,6 @@ __perf_counter_init_context(struct perf_counter_context *ctx,
 
 static struct perf_counter_context *find_get_context(pid_t pid, int cpu)
 {
-        struct perf_counter_context *parent_ctx;
         struct perf_counter_context *ctx;
         struct perf_cpu_context *cpuctx;
         struct task_struct *task;
@@ -1586,11 +1602,7 @@ static struct perf_counter_context *find_get_context(pid_t pid, int cpu)
  retry:
         ctx = perf_lock_task_context(task, &flags);
         if (ctx) {
-                parent_ctx = ctx->parent_ctx;
-                if (parent_ctx) {
-                        put_ctx(parent_ctx);
-                        ctx->parent_ctx = NULL;         /* no longer a clone */
-                }
+                unclone_ctx(ctx);
                 spin_unlock_irqrestore(&ctx->lock, flags);
         }
 
@@ -1704,7 +1716,7 @@ perf_read_hw(struct perf_counter *counter, char __user *buf, size_t count)
                 values[n++] = counter->total_time_running +
                         atomic64_read(&counter->child_total_time_running);
         if (counter->attr.read_format & PERF_FORMAT_ID)
-                values[n++] = counter->id;
+                values[n++] = primary_counter_id(counter);
         mutex_unlock(&counter->child_mutex);
 
         if (count < n * sizeof(u64))
@@ -1811,8 +1823,6 @@ static int perf_counter_period(struct perf_counter *counter, u64 __user *arg)
 
                 counter->attr.sample_freq = value;
         } else {
-                perf_log_period(counter, value);
-
                 counter->attr.sample_period = value;
                 counter->hw.sample_period = value;
         }
@@ -2661,10 +2671,14 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
         if (sample_type & PERF_SAMPLE_ID)
                 header.size += sizeof(u64);
 
+        if (sample_type & PERF_SAMPLE_STREAM_ID)
+                header.size += sizeof(u64);
+
         if (sample_type & PERF_SAMPLE_CPU) {
                 header.size += sizeof(cpu_entry);
 
                 cpu_entry.cpu = raw_smp_processor_id();
+                cpu_entry.reserved = 0;
         }
 
         if (sample_type & PERF_SAMPLE_PERIOD)
@@ -2703,7 +2717,13 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
         if (sample_type & PERF_SAMPLE_ADDR)
                 perf_output_put(&handle, data->addr);
 
-        if (sample_type & PERF_SAMPLE_ID)
+        if (sample_type & PERF_SAMPLE_ID) {
+                u64 id = primary_counter_id(counter);
+
+                perf_output_put(&handle, id);
+        }
+
+        if (sample_type & PERF_SAMPLE_STREAM_ID)
                 perf_output_put(&handle, counter->id);
 
         if (sample_type & PERF_SAMPLE_CPU)
@@ -2726,7 +2746,7 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
                         if (sub != counter)
                                 sub->pmu->read(sub);
 
-                        group_entry.id = sub->id;
+                        group_entry.id = primary_counter_id(sub);
                         group_entry.counter = atomic64_read(&sub->count);
 
                         perf_output_put(&handle, group_entry);
@@ -2786,15 +2806,8 @@ perf_counter_read_event(struct perf_counter *counter,
         }
 
         if (counter->attr.read_format & PERF_FORMAT_ID) {
-                u64 id;
-
                 event.header.size += sizeof(u64);
-                if (counter->parent)
-                        id = counter->parent->id;
-                else
-                        id = counter->id;
-
-                event.format[i++] = id;
+                event.format[i++] = primary_counter_id(counter);
         }
 
         ret = perf_output_begin(&handle, counter, event.header.size, 0, 0);
@@ -2895,8 +2908,11 @@ void perf_counter_fork(struct task_struct *task)
                 .event  = {
                         .header = {
                                 .type = PERF_EVENT_FORK,
+                                .misc = 0,
                                 .size = sizeof(fork_event.event),
                         },
+                        /* .pid  */
+                        /* .ppid */
                 },
         };
 
@@ -2968,8 +2984,10 @@ static void perf_counter_comm_event(struct perf_comm_event *comm_event)
         struct perf_cpu_context *cpuctx;
         struct perf_counter_context *ctx;
         unsigned int size;
-        char *comm = comm_event->task->comm;
+        char comm[TASK_COMM_LEN];
 
+        memset(comm, 0, sizeof(comm));
+        strncpy(comm, comm_event->task->comm, sizeof(comm));
         size = ALIGN(strlen(comm)+1, sizeof(u64));
 
         comm_event->comm = comm;
@@ -3004,8 +3022,16 @@ void perf_counter_comm(struct task_struct *task)
 
         comm_event = (struct perf_comm_event){
                 .task   = task,
+                /* .comm      */
+                /* .comm_size */
                 .event  = {
-                        .header = { .type = PERF_EVENT_COMM, },
+                        .header = {
+                                .type = PERF_EVENT_COMM,
+                                .misc = 0,
+                                /* .size */
+                        },
+                        /* .pid */
+                        /* .tid */
                 },
         };
 
@@ -3088,8 +3114,15 @@ static void perf_counter_mmap_event(struct perf_mmap_event *mmap_event)
         char *buf = NULL;
         const char *name;
 
+        memset(tmp, 0, sizeof(tmp));
+
         if (file) {
-                buf = kzalloc(PATH_MAX, GFP_KERNEL);
+                /*
+                 * d_path works from the end of the buffer backwards, so we
+                 * need to add enough zero bytes after the string to handle
+                 * the 64bit alignment we do later.
+                 */
+                buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
                 if (!buf) {
                         name = strncpy(tmp, "//enomem", sizeof(tmp));
                         goto got_name;
@@ -3100,9 +3133,11 @@ static void perf_counter_mmap_event(struct perf_mmap_event *mmap_event)
                         goto got_name;
                 }
         } else {
-                name = arch_vma_name(mmap_event->vma);
-                if (name)
+                if (arch_vma_name(mmap_event->vma)) {
+                        name = strncpy(tmp, arch_vma_name(mmap_event->vma),
+                                       sizeof(tmp));
                         goto got_name;
+                }
 
                 if (!vma->vm_mm) {
                         name = strncpy(tmp, "[vdso]", sizeof(tmp));
@@ -3147,8 +3182,16 @@ void __perf_counter_mmap(struct vm_area_struct *vma)
 
         mmap_event = (struct perf_mmap_event){
                 .vma    = vma,
+                /* .file_name */
+                /* .file_size */
                 .event  = {
-                        .header = { .type = PERF_EVENT_MMAP, },
+                        .header = {
+                                .type = PERF_EVENT_MMAP,
+                                .misc = 0,
+                                /* .size */
+                        },
+                        /* .pid */
+                        /* .tid */
                         .start  = vma->vm_start,
                         .len    = vma->vm_end - vma->vm_start,
                         .pgoff  = vma->vm_pgoff,
@@ -3159,49 +3202,6 @@ void __perf_counter_mmap(struct vm_area_struct *vma)
 }
 
 /*
- * Log sample_period changes so that analyzing tools can re-normalize the
- * event flow.
- */
-
-struct freq_event {
-        struct perf_event_header        header;
-        u64                             time;
-        u64                             id;
-        u64                             period;
-};
-
-static void perf_log_period(struct perf_counter *counter, u64 period)
-{
-        struct perf_output_handle handle;
-        struct freq_event event;
-        int ret;
-
-        if (counter->hw.sample_period == period)
-                return;
-
-        if (counter->attr.sample_type & PERF_SAMPLE_PERIOD)
-                return;
-
-        event = (struct freq_event) {
-                .header = {
-                        .type = PERF_EVENT_PERIOD,
-                        .misc = 0,
-                        .size = sizeof(event),
-                },
-                .time = sched_clock(),
-                .id = counter->id,
-                .period = period,
-        };
-
-        ret = perf_output_begin(&handle, counter, sizeof(event), 1, 0);
-        if (ret)
-                return;
-
-        perf_output_put(&handle, event);
-        perf_output_end(&handle);
-}
-
-/*
  * IRQ throttle logging
  */
 
@@ -3214,16 +3214,21 @@ static void perf_log_throttle(struct perf_counter *counter, int enable)
                 struct perf_event_header        header;
                 u64                             time;
                 u64                             id;
+                u64                             stream_id;
         } throttle_event = {
                 .header = {
-                        .type = PERF_EVENT_THROTTLE + 1,
+                        .type = PERF_EVENT_THROTTLE,
                         .misc = 0,
                         .size = sizeof(throttle_event),
                 },
-                .time   = sched_clock(),
-                .id     = counter->id,
+                .time           = sched_clock(),
+                .id             = primary_counter_id(counter),
+                .stream_id      = counter->id,
         };
 
+        if (enable)
+                throttle_event.header.type = PERF_EVENT_UNTHROTTLE;
+
         ret = perf_output_begin(&handle, counter, sizeof(throttle_event), 1, 0);
         if (ret)
                 return;
@@ -3671,7 +3676,7 @@ static const struct pmu perf_ops_task_clock = {
 void perf_tpcounter_event(int event_id)
 {
         struct perf_sample_data data = {
-                .regs = get_irq_regs();
+                .regs = get_irq_regs(),
                 .addr = 0,
         };
 
@@ -3687,16 +3692,12 @@ extern void ftrace_profile_disable(int);
 
 static void tp_perf_counter_destroy(struct perf_counter *counter)
 {
-        ftrace_profile_disable(perf_event_id(&counter->attr));
+        ftrace_profile_disable(counter->attr.config);
 }
 
 static const struct pmu *tp_perf_counter_init(struct perf_counter *counter)
 {
-        int event_id = perf_event_id(&counter->attr);
-        int ret;
-
-        ret = ftrace_profile_enable(event_id);
-        if (ret)
+        if (ftrace_profile_enable(counter->attr.config))
                 return NULL;
 
         counter->destroy = tp_perf_counter_destroy;
@@ -4255,15 +4256,12 @@ void perf_counter_exit_task(struct task_struct *child)
          */
         spin_lock(&child_ctx->lock);
         child->perf_counter_ctxp = NULL;
-        if (child_ctx->parent_ctx) {
-                /*
-                 * This context is a clone; unclone it so it can't get
-                 * swapped to another process while we're removing all
-                 * the counters from it.
-                 */
-                put_ctx(child_ctx->parent_ctx);
-                child_ctx->parent_ctx = NULL;
-        }
+        /*
+         * If this context is a clone; unclone it so it can't get
+         * swapped to another process while we're removing all
+         * the counters from it.
+         */
+        unclone_ctx(child_ctx);
         spin_unlock(&child_ctx->lock);
         local_irq_restore(flags);
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 98972d366fdc..1b59e265273b 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -7289,6 +7289,7 @@ static void migrate_dead_tasks(unsigned int dead_cpu)
 static void calc_global_load_remove(struct rq *rq)
 {
         atomic_long_sub(rq->calc_load_active, &calc_load_tasks);
+        rq->calc_load_active = 0;
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
@@ -7515,6 +7516,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 task_rq_unlock(rq, &flags);
                 get_task_struct(p);
                 cpu_rq(cpu)->migration_thread = p;
+                rq->calc_load_update = calc_load_update;
                 break;
 
         case CPU_ONLINE:
@@ -7525,8 +7527,6 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 /* Update our root-domain */
                 rq = cpu_rq(cpu);
                 spin_lock_irqsave(&rq->lock, flags);
-                rq->calc_load_update = calc_load_update;
-                rq->calc_load_active = 0;
                 if (rq->rd) {
                         BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span));
 
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 7c248dc30f41..9ffb2b2ceba4 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -266,6 +266,12 @@ static inline u64 min_vruntime(u64 min_vruntime, u64 vruntime)
         return min_vruntime;
 }
 
+static inline int entity_before(struct sched_entity *a,
+                                struct sched_entity *b)
+{
+        return (s64)(a->vruntime - b->vruntime) < 0;
+}
+
 static inline s64 entity_key(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
         return se->vruntime - cfs_rq->min_vruntime;
@@ -1017,7 +1023,7 @@ static void yield_task_fair(struct rq *rq)
         /*
          * Already in the rightmost position?
          */
-        if (unlikely(!rightmost || rightmost->vruntime < se->vruntime))
+        if (unlikely(!rightmost || entity_before(rightmost, se)))
                 return;
 
         /*
@@ -1713,7 +1719,7 @@ static void task_new_fair(struct rq *rq, struct task_struct *p)
 
         /* 'curr' will be NULL if the child belongs to a different group */
         if (sysctl_sched_child_runs_first && this_cpu == task_cpu(p) &&
-                        curr && curr->vruntime < se->vruntime) {
+                        curr && entity_before(curr, se)) {
                 /*
                  * Upon rescheduling, sched_class::put_prev_task() will place
                  * 'current' within the tree based on its new key value.
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 3a94905fa5d2..eb5e131a0485 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -345,7 +345,9 @@ void open_softirq(int nr, void (*action)(struct softirq_action *))
         softirq_vec[nr].action = action;
 }
 
-/* Tasklets */
+/*
+ * Tasklets
+ */
 struct tasklet_head
 {
         struct tasklet_struct *head;
@@ -493,6 +495,66 @@ void tasklet_kill(struct tasklet_struct *t)
 
 EXPORT_SYMBOL(tasklet_kill);
 
+/*
+ * tasklet_hrtimer
+ */
+
+/*
+ * The trampoline is called when the hrtimer expires. If this is
+ * called from the hrtimer interrupt then we schedule the tasklet as
+ * the timer callback function expects to run in softirq context. If
+ * it's called in softirq context anyway (i.e. high resolution timers
+ * disabled) then the hrtimer callback is called right away.
+ */
+static enum hrtimer_restart __hrtimer_tasklet_trampoline(struct hrtimer *timer)
+{
+        struct tasklet_hrtimer *ttimer =
+                container_of(timer, struct tasklet_hrtimer, timer);
+
+        if (hrtimer_is_hres_active(timer)) {
+                tasklet_hi_schedule(&ttimer->tasklet);
+                return HRTIMER_NORESTART;
+        }
+        return ttimer->function(timer);
+}
+
+/*
+ * Helper function which calls the hrtimer callback from
+ * tasklet/softirq context
+ */
+static void __tasklet_hrtimer_trampoline(unsigned long data)
+{
+        struct tasklet_hrtimer *ttimer = (void *)data;
+        enum hrtimer_restart restart;
+
+        restart = ttimer->function(&ttimer->timer);
+        if (restart != HRTIMER_NORESTART)
+                hrtimer_restart(&ttimer->timer);
+}
+
+/**
+ * tasklet_hrtimer_init - Init a tasklet/hrtimer combo for softirq callbacks
+ * @ttimer:      tasklet_hrtimer which is initialized
+ * @function:    hrtimer callback funtion which gets called from softirq context
+ * @which_clock: clock id (CLOCK_MONOTONIC/CLOCK_REALTIME)
+ * @mode:        hrtimer mode (HRTIMER_MODE_ABS/HRTIMER_MODE_REL)
+ */
+void tasklet_hrtimer_init(struct tasklet_hrtimer *ttimer,
+                          enum hrtimer_restart (*function)(struct hrtimer *),
+                          clockid_t which_clock, enum hrtimer_mode mode)
+{
+        hrtimer_init(&ttimer->timer, which_clock, mode);
+        ttimer->timer.function = __hrtimer_tasklet_trampoline;
+        tasklet_init(&ttimer->tasklet, __tasklet_hrtimer_trampoline,
+                     (unsigned long)ttimer);
+        ttimer->function = function;
+}
+EXPORT_SYMBOL_GPL(tasklet_hrtimer_init);
+
+/*
+ * Remote softirq bits
+ */
+
 DEFINE_PER_CPU(struct list_head [NR_SOFTIRQS], softirq_work_list);
 EXPORT_PER_CPU_SYMBOL(softirq_work_list);
 
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 592bf584d1d2..7466cb811251 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -513,7 +513,7 @@ static ssize_t sysfs_override_clocksource(struct sys_device *dev,
          * Check to make sure we don't switch to a non-highres capable
          * clocksource if the tick code is in oneshot mode (highres or nohz)
          */
-        if (tick_oneshot_mode_active() &&
+        if (tick_oneshot_mode_active() && ovr &&
             !(ovr->flags & CLOCK_SOURCE_VALID_FOR_HRES)) {
                 printk(KERN_WARNING "%s clocksource is not HRT compatible. "
                         "Cannot switch while in HRT/NOHZ mode\n", ovr->name);
diff --git a/kernel/timer.c b/kernel/timer.c
index 0b36b9e5cc8b..a7f07d5a6241 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -714,7 +714,7 @@ int mod_timer(struct timer_list *timer, unsigned long expires)
          * networking code - if the timer is re-modified
          * to be the same thing then just return:
          */
-        if (timer->expires == expires && timer_pending(timer))
+        if (timer_pending(timer) && timer->expires == expires)
                 return 1;
 
         return __mod_timer(timer, expires, false, TIMER_NOT_PINNED);
diff --git a/mm/memory.c b/mm/memory.c
index 65216194eb8d..aede2ce3aba4 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -135,11 +135,12 @@ void pmd_clear_bad(pmd_t *pmd)
  * Note: this doesn't free the actual pages themselves. That
  * has been handled earlier when unmapping all the memory regions.
  */
-static void free_pte_range(struct mmu_gather *tlb, pmd_t *pmd)
+static void free_pte_range(struct mmu_gather *tlb, pmd_t *pmd,
+                           unsigned long addr)
 {
         pgtable_t token = pmd_pgtable(*pmd);
         pmd_clear(pmd);
-        pte_free_tlb(tlb, token);
+        pte_free_tlb(tlb, token, addr);
         tlb->mm->nr_ptes--;
 }
 
@@ -157,7 +158,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
                 next = pmd_addr_end(addr, end);
                 if (pmd_none_or_clear_bad(pmd))
                         continue;
-                free_pte_range(tlb, pmd);
+                free_pte_range(tlb, pmd, addr);
         } while (pmd++, addr = next, addr != end);
 
         start &= PUD_MASK;
@@ -173,7 +174,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
 
         pmd = pmd_offset(pud, start);
         pud_clear(pud);
-        pmd_free_tlb(tlb, pmd);
+        pmd_free_tlb(tlb, pmd, start);
 }
 
 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
@@ -206,7 +207,7 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
 
         pud = pud_offset(pgd, start);
         pgd_clear(pgd);
-        pud_free_tlb(tlb, pud);
+        pud_free_tlb(tlb, pud, start);
 }
 
 /*
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 8a96672e2c5c..eb404dc3ed6e 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -424,7 +424,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 err2:
         br_fdb_delete_by_port(br, p, 1);
 err1:
-        kobject_del(&p->kobj);
+        kobject_put(&p->kobj);
 err0:
         dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 95d7f32643ae..72720c710351 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -75,6 +75,7 @@ static __initdata const char banner[] = KERN_INFO
 MODULE_DESCRIPTION("PF_CAN broadcast manager protocol");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
+MODULE_ALIAS("can-proto-2");
 
 /* easy access to can_frame payload */
 static inline u64 GET_U64(const struct can_frame *cp)
@@ -1469,6 +1470,9 @@ static int bcm_release(struct socket *sock)
                 bo->ifindex = 0;
         }
 
+        sock_orphan(sk);
+        sock->sk = NULL;
+
         release_sock(sk);
         sock_put(sk);
 
diff --git a/net/can/raw.c b/net/can/raw.c
index 6aa154e806ae..f4cc44548bda 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -62,6 +62,7 @@ static __initdata const char banner[] =
 MODULE_DESCRIPTION("PF_CAN raw protocol");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Urs Thuermann <urs.thuermann@volkswagen.de>");
+MODULE_ALIAS("can-proto-1");
 
 #define MASK_ALL 0
 
@@ -306,6 +307,9 @@ static int raw_release(struct socket *sock)
         ro->bound   = 0;
         ro->count   = 0;
 
+        sock_orphan(sk);
+        sock->sk = NULL;
+
         release_sock(sk);
         sock_put(sk);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index ba5d2116aea1..bbb25be7ddfe 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -631,7 +631,7 @@ set_rcvbuf:
 
         case SO_TIMESTAMPING:
                 if (val & ~SOF_TIMESTAMPING_MASK) {
-                        ret = EINVAL;
+                        ret = -EINVAL;
                         break;
                 }
                 sock_valbool_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE,
@@ -919,13 +919,19 @@ static inline void sock_lock_init(struct sock *sk)
                         af_family_keys + sk->sk_family);
 }
 
+/*
+ * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
+ * even temporarly, because of RCU lookups. sk_node should also be left as is.
+ */
 static void sock_copy(struct sock *nsk, const struct sock *osk)
 {
 #ifdef CONFIG_SECURITY_NETWORK
         void *sptr = nsk->sk_security;
 #endif
-
-        memcpy(nsk, osk, osk->sk_prot->obj_size);
+        BUILD_BUG_ON(offsetof(struct sock, sk_copy_start) !=
+                     sizeof(osk->sk_node) + sizeof(osk->sk_refcnt));
+        memcpy(&nsk->sk_copy_start, &osk->sk_copy_start,
+               osk->sk_prot->obj_size - offsetof(struct sock, sk_copy_start));
 #ifdef CONFIG_SECURITY_NETWORK
         nsk->sk_security = sptr;
         security_sk_clone(osk, nsk);
@@ -1140,6 +1146,11 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
 
                 newsk->sk_err      = 0;
                 newsk->sk_priority = 0;
+                /*
+                 * Before updating sk_refcnt, we must commit prior changes to memory
+                 * (Documentation/RCU/rculist_nulls.txt for details)
+                 */
+                smp_wmb();
                 atomic_set(&newsk->sk_refcnt, 2);
 
                 /*
@@ -1855,6 +1866,11 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         sk->sk_stamp = ktime_set(-1L, 0);
 
+        /*
+         * Before updating sk_refcnt, we must commit prior changes to memory
+         * (Documentation/RCU/rculist_nulls.txt for details)
+         */
+        smp_wmb();
         atomic_set(&sk->sk_refcnt, 1);
         atomic_set(&sk->sk_wmem_alloc, 1);
         atomic_set(&sk->sk_drops, 0);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a1ca2698c88..6d88219c5e22 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1160,6 +1160,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
         .md5_lookup     =       tcp_v4_reqsk_md5_lookup,
+        .calc_md5_hash  =       tcp_v4_md5_hash_skb,
 };
 #endif
 
@@ -1373,7 +1374,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v4_md5_do_add(newsk, inet_sk(sk)->daddr,
+                        tcp_v4_md5_do_add(newsk, newinet->daddr,
                                           newkey, key->keylen);
                 newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5bdf08d312d9..bd62712848fa 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2261,7 +2261,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 #ifdef CONFIG_TCP_MD5SIG
         /* Okay, we have all we need - do the md5 hash if needed */
         if (md5) {
-                tp->af_specific->calc_md5_hash(md5_hash_location,
+                tcp_rsk(req)->af_specific->calc_md5_hash(md5_hash_location,
                                                md5, NULL, req, skb);
         }
 #endif
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 58810c65b635..d849dd53b788 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -896,6 +896,7 @@ struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
+        .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 };
 #endif
 
@@ -1441,7 +1442,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
+                        tcp_v6_md5_do_add(newsk, &newnp->daddr,
                                           newkey, key->keylen);
         }
 #endif
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index ecf4eb2717cb..9cb79f95bf63 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1453,6 +1453,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
         }
         /* Dup */
         memcpy(new, orig, sizeof(struct tsap_cb));
+        spin_lock_init(&new->lock);
 
         /* We don't need the old instance any more */
         spin_unlock_irqrestore(&irttp->tsaps->hb_spinlock, flags);
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index ba2643a43c73..7836ee928983 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -83,6 +83,7 @@ endmenu
 config MAC80211_MESH
         bool "Enable mac80211 mesh networking (pre-802.11s) support"
         depends on MAC80211 && EXPERIMENTAL
+        depends on BROKEN
         ---help---
          This options enables support of Draft 802.11s mesh networking.
          The implementation is based on Draft 1.08 of the Mesh Networking
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 3c72557df45a..479597e88583 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -175,6 +175,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
+        might_sleep();
+
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -265,6 +267,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
+        might_sleep();
 
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
@@ -491,8 +494,10 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
  * @skb: frame to discard
  * @sdata: network subif the frame was to be sent through
  *
- * If the frame was beign forwarded from another MP, a PERR frame will be sent
- * to the precursor.
+ * If the frame was being forwarded from another MP, a PERR frame will be sent
+ * to the precursor.  The precursor's address (i.e. the previous hop) was saved
+ * in addr1 of the frame-to-be-forwarded, and would only be overwritten once
+ * the destination is successfully resolved.
  *
  * Locking: the function must me called within a rcu_read_lock region
  */
@@ -507,7 +512,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                 u8 *ra, *da;
 
                 da = hdr->addr3;
-                ra = hdr->addr2;
+                ra = hdr->addr1;
                 mpath = mesh_path_lookup(da, sdata);
                 if (mpath)
                         dsn = ++mpath->dsn;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d238a8939a09..3a8922cd1038 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1455,7 +1455,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 monitor_iface = UNKNOWN_ADDRESS;
 
                 len_rthdr = ieee80211_get_radiotap_len(skb->data);
-                hdr = (struct ieee80211_hdr *)skb->data + len_rthdr;
+                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
                 /* check the header is complete in the frame */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7508f11c5b39..b5869b9574b0 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -561,23 +561,38 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
                 }
         }
 
-        ct = kmem_cache_zalloc(nf_conntrack_cachep, gfp);
+        /*
+         * Do not use kmem_cache_zalloc(), as this cache uses
+         * SLAB_DESTROY_BY_RCU.
+         */
+        ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
         if (ct == NULL) {
                 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
                 atomic_dec(&net->ct.count);
                 return ERR_PTR(-ENOMEM);
         }
-
+        /*
+         * Let ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.next
+         * and ct->tuplehash[IP_CT_DIR_REPLY].hnnode.next unchanged.
+         */
+        memset(&ct->tuplehash[IP_CT_DIR_MAX], 0,
+               sizeof(*ct) - offsetof(struct nf_conn, tuplehash[IP_CT_DIR_MAX]));
         spin_lock_init(&ct->lock);
-        atomic_set(&ct->ct_general.use, 1);
         ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
+        ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.pprev = NULL;
         ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
+        ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev = NULL;
         /* Don't set timer yet: wait for confirmation */
         setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
 #ifdef CONFIG_NET_NS
         ct->ct_net = net;
 #endif
 
+        /*
+         * changes to lookup keys must be done before setting refcnt to 1
+         */
+        smp_wmb();
+        atomic_set(&ct->ct_general.use, 1);
         return ct;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 863e40977a4d..0f482e2440b4 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -330,7 +330,8 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
                         fcount++;
 
                         if (info->flags & XT_OSF_LOG)
-                                nf_log_packet(p->hooknum, 0, skb, p->in, p->out, NULL,
+                                nf_log_packet(p->family, p->hooknum, skb,
+                                        p->in, p->out, NULL,
                                         "%s [%s:%s] : %pi4:%d -> %pi4:%d hops=%d\n",
                                         f->genre, f->version, f->subtype,
                                         &ip->saddr, ntohs(tcp->source),
@@ -345,7 +346,7 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
         rcu_read_unlock();
 
         if (!fcount && (info->flags & XT_OSF_LOG))
-                nf_log_packet(p->hooknum, 0, skb, p->in, p->out, NULL,
+                nf_log_packet(p->family, p->hooknum, skb, p->in, p->out, NULL,
                         "Remote OS is not known: %pi4:%u -> %pi4:%u\n",
                                 &ip->saddr, ntohs(tcp->source),
                                 &ip->daddr, ntohs(tcp->dest));
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 79693fe2001e..2fc4a1724eb8 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -549,6 +549,10 @@ void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
         swprev = !!(rfkill->state & RFKILL_BLOCK_SW);
         hwprev = !!(rfkill->state & RFKILL_BLOCK_HW);
         __rfkill_set_sw_state(rfkill, sw);
+        if (hw)
+                rfkill->state |= RFKILL_BLOCK_HW;
+        else
+                rfkill->state &= ~RFKILL_BLOCK_HW;
 
         spin_unlock_irqrestore(&rfkill->lock, flags);
 
@@ -648,15 +652,26 @@ static ssize_t rfkill_state_store(struct device *dev,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        /*
-         * The intention was that userspace can only take control over
-         * a given device when/if rfkill-input doesn't control it due
-         * to user_claim. Since user_claim is currently unsupported,
-         * we never support changing the state from userspace -- this
-         * can be implemented again later.
-         */
+        struct rfkill *rfkill = to_rfkill(dev);
+        unsigned long state;
+        int err;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        err = strict_strtoul(buf, 0, &state);
+        if (err)
+                return err;
+
+        if (state != RFKILL_USER_STATE_SOFT_BLOCKED &&
+            state != RFKILL_USER_STATE_UNBLOCKED)
+                return -EINVAL;
+
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_set_block(rfkill, state == RFKILL_USER_STATE_SOFT_BLOCKED);
+        mutex_unlock(&rfkill_global_mutex);
 
-        return -EPERM;
+        return err ?: count;
 }
 
 static ssize_t rfkill_claim_show(struct device *dev,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 6bd8e93869ed..f0a76f6bca71 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -92,23 +92,21 @@ static void rose_set_lockdep_key(struct net_device *dev)
 /*
  *      Convert a ROSE address into text.
  */
-const char *rose2asc(const rose_address *addr)
+char *rose2asc(char *buf, const rose_address *addr)
 {
-        static char buffer[11];
-
         if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
             addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
             addr->rose_addr[4] == 0x00) {
-                strcpy(buffer, "*");
+                strcpy(buf, "*");
         } else {
-                sprintf(buffer, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
+                sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
                                                 addr->rose_addr[1] & 0xFF,
                                                 addr->rose_addr[2] & 0xFF,
                                                 addr->rose_addr[3] & 0xFF,
                                                 addr->rose_addr[4] & 0xFF);
         }
 
-        return buffer;
+        return buf;
 }
 
 /*
@@ -1437,7 +1435,7 @@ static void rose_info_stop(struct seq_file *seq, void *v)
 
 static int rose_info_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -1455,8 +1453,8 @@ static int rose_info_show(struct seq_file *seq, void *v)
                         devname = dev->name;
 
                 seq_printf(seq, "%-10s %-9s ",
-                        rose2asc(&rose->dest_addr),
-                        ax2asc(buf, &rose->dest_call));
+                           rose2asc(rsbuf, &rose->dest_addr),
+                           ax2asc(buf, &rose->dest_call));
 
                 if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
                         callsign = "??????-?";
@@ -1465,7 +1463,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
 
                 seq_printf(seq,
                            "%-10s %-9s %-5s %3.3X %05d  %d  %d  %d  %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
-                        rose2asc(&rose->source_addr),
+                        rose2asc(rsbuf, &rose->source_addr),
                         callsign,
                         devname,
                         rose->lci & 0x0FFF,
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index a81066a1010a..9478d9b3d977 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -1104,6 +1104,7 @@ static void rose_node_stop(struct seq_file *seq, void *v)
 
 static int rose_node_show(struct seq_file *seq, void *v)
 {
+        char rsbuf[11];
         int i;
 
         if (v == SEQ_START_TOKEN)
@@ -1112,13 +1113,13 @@ static int rose_node_show(struct seq_file *seq, void *v)
                 const struct rose_node *rose_node = v;
                 /* if (rose_node->loopback) {
                         seq_printf(seq, "%-10s %04d 1 loopback\n",
-                                rose2asc(&rose_node->address),
-                                rose_node->mask);
+                                   rose2asc(rsbuf, &rose_node->address),
+                                   rose_node->mask);
                 } else { */
                         seq_printf(seq, "%-10s %04d %d",
-                                rose2asc(&rose_node->address),
-                                rose_node->mask,
-                                rose_node->count);
+                                   rose2asc(rsbuf, &rose_node->address),
+                                   rose_node->mask,
+                                   rose_node->count);
 
                         for (i = 0; i < rose_node->count; i++)
                                 seq_printf(seq, " %05d",
@@ -1267,7 +1268,7 @@ static void rose_route_stop(struct seq_file *seq, void *v)
 
 static int rose_route_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -1279,7 +1280,7 @@ static int rose_route_show(struct seq_file *seq, void *v)
                         seq_printf(seq,
                                    "%3.3X  %-10s  %-9s  %05d      ",
                                    rose_route->lci1,
-                                   rose2asc(&rose_route->src_addr),
+                                   rose2asc(rsbuf, &rose_route->src_addr),
                                    ax2asc(buf, &rose_route->src_call),
                                    rose_route->neigh1->number);
                 else
@@ -1289,10 +1290,10 @@ static int rose_route_show(struct seq_file *seq, void *v)
                 if (rose_route->neigh2)
                         seq_printf(seq,
                                    "%3.3X  %-10s  %-9s  %05d\n",
-                                rose_route->lci2,
-                                rose2asc(&rose_route->dest_addr),
-                                ax2asc(buf, &rose_route->dest_call),
-                                rose_route->neigh2->number);
+                                   rose_route->lci2,
+                                   rose2asc(rsbuf, &rose_route->dest_addr),
+                                   ax2asc(buf, &rose_route->dest_call),
+                                   rose_route->neigh2->number);
                  else
                          seq_puts(seq,
                                   "000  *           *          00000\n");
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 43bdb1372cae..634496b3ed77 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -997,7 +997,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
         if (IS_ERR(hdr)) {
                 err = PTR_ERR(hdr);
-                goto out;
+                goto free_msg;
         }
 
         cookie.msg = msg;
@@ -1011,7 +1011,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
                                 &cookie, get_key_callback);
 
         if (err)
-                goto out;
+                goto free_msg;
 
         if (cookie.error)
                 goto nla_put_failure;
@@ -1022,6 +1022,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
  nla_put_failure:
         err = -ENOBUFS;
+ free_msg:
         nlmsg_free(msg);
  out:
         cfg80211_put_dev(drv);
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index f8e71b300001..9271118e1fc4 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -35,8 +35,6 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         else
                 nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
 
-        wiphy_to_dev(request->wiphy)->scan_req = NULL;
-
 #ifdef CONFIG_WIRELESS_EXT
         if (!aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
@@ -48,6 +46,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         dev_put(dev);
 
  out:
+        wiphy_to_dev(request->wiphy)->scan_req = NULL;
         kfree(request);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 333e4dd29450..72cfd47af6b8 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -233,6 +233,18 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                 xrun(substream);
                 return -EPIPE;
         }
+        if (xrun_debug(substream, 8)) {
+                char name[16];
+                pcm_debug_name(substream, name, sizeof(name));
+                snd_printd("period_update: %s: pos=0x%x/0x%x/0x%x, "
+                           "hwptr=0x%lx, hw_base=0x%lx, hw_intr=0x%lx\n",
+                           name, (unsigned int)pos,
+                           (unsigned int)runtime->period_size,
+                           (unsigned int)runtime->buffer_size,
+                           (unsigned long)old_hw_ptr,
+                           (unsigned long)runtime->hw_ptr_base,
+                           (unsigned long)runtime->hw_ptr_interrupt);
+        }
         hw_base = runtime->hw_ptr_base;
         new_hw_ptr = hw_base + pos;
         hw_ptr_interrupt = runtime->hw_ptr_interrupt + runtime->period_size;
@@ -244,18 +256,27 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                         delta = new_hw_ptr - hw_ptr_interrupt;
         }
         if (delta < 0) {
-                delta += runtime->buffer_size;
+                if (runtime->periods == 1 || new_hw_ptr < old_hw_ptr)
+                        delta += runtime->buffer_size;
                 if (delta < 0) {
                         hw_ptr_error(substream, 
                                      "Unexpected hw_pointer value "
                                      "(stream=%i, pos=%ld, intr_ptr=%ld)\n",
                                      substream->stream, (long)pos,
                                      (long)hw_ptr_interrupt);
+#if 1
+                        /* simply skipping the hwptr update seems more
+                         * robust in some cases, e.g. on VMware with
+                         * inaccurate timer source
+                         */
+                        return 0; /* skip this update */
+#else
                         /* rebase to interrupt position */
                         hw_base = new_hw_ptr = hw_ptr_interrupt;
                         /* align hw_base to buffer_size */
                         hw_base -= hw_base % runtime->buffer_size;
                         delta = 0;
+#endif
                 } else {
                         hw_base += runtime->buffer_size;
                         if (hw_base >= runtime->boundary)
@@ -344,6 +365,19 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
                 xrun(substream);
                 return -EPIPE;
         }
+        if (xrun_debug(substream, 16)) {
+                char name[16];
+                pcm_debug_name(substream, name, sizeof(name));
+                snd_printd("hw_update: %s: pos=0x%x/0x%x/0x%x, "
+                           "hwptr=0x%lx, hw_base=0x%lx, hw_intr=0x%lx\n",
+                           name, (unsigned int)pos,
+                           (unsigned int)runtime->period_size,
+                           (unsigned int)runtime->buffer_size,
+                           (unsigned long)old_hw_ptr,
+                           (unsigned long)runtime->hw_ptr_base,
+                           (unsigned long)runtime->hw_ptr_interrupt);
+        }
+
         hw_base = runtime->hw_ptr_base;
         new_hw_ptr = hw_base + pos;
 
diff --git a/sound/core/seq/Makefile b/sound/core/seq/Makefile
index 1bcb360330e5..941f64a853eb 100644
--- a/sound/core/seq/Makefile
+++ b/sound/core/seq/Makefile
@@ -3,10 +3,6 @@
 # Copyright (c) 1999 by Jaroslav Kysela <perex@perex.cz>
 #
 
-ifeq ($(CONFIG_SND_SEQUENCER_OSS),y)
-  obj-$(CONFIG_SND_SEQUENCER) += oss/
-endif
-
 snd-seq-device-objs := seq_device.o
 snd-seq-objs := seq.o seq_lock.o seq_clientmgr.o seq_memory.o seq_queue.o \
                 seq_fifo.o seq_prioq.o seq_timer.o \
@@ -19,7 +15,8 @@ snd-seq-virmidi-objs := seq_virmidi.o
 
 obj-$(CONFIG_SND_SEQUENCER) += snd-seq.o snd-seq-device.o
 ifeq ($(CONFIG_SND_SEQUENCER_OSS),y)
-obj-$(CONFIG_SND_SEQUENCER) += snd-seq-midi-event.o
+  obj-$(CONFIG_SND_SEQUENCER) += snd-seq-midi-event.o
+  obj-$(CONFIG_SND_SEQUENCER) += oss/
 endif
 obj-$(CONFIG_SND_SEQ_DUMMY) += snd-seq-dummy.o
 
diff --git a/sound/isa/gus/gus_pcm.c b/sound/isa/gus/gus_pcm.c
index edb11eefdfe3..2dcf45bf7293 100644
--- a/sound/isa/gus/gus_pcm.c
+++ b/sound/isa/gus/gus_pcm.c
@@ -795,13 +795,13 @@ static int snd_gf1_pcm_volume_put(struct snd_kcontrol *kcontrol, struct snd_ctl_
                 if (!(pcmp->flags & SNDRV_GF1_PCM_PFLG_ACTIVE))
                         continue;
                 /* load real volume - better precision */
-                spin_lock_irqsave(&gus->reg_lock, flags);
+                spin_lock(&gus->reg_lock);
                 snd_gf1_select_voice(gus, pvoice->number);
                 snd_gf1_ctrl_stop(gus, SNDRV_GF1_VB_VOLUME_CONTROL);
                 vol = pvoice == pcmp->pvoices[0] ? gus->gf1.pcm_volume_level_left : gus->gf1.pcm_volume_level_right;
                 snd_gf1_write16(gus, SNDRV_GF1_VW_VOLUME, vol);
                 pcmp->final_volume = 1;
-                spin_unlock_irqrestore(&gus->reg_lock, flags);
+                spin_unlock(&gus->reg_lock);
         }
         spin_unlock_irqrestore(&gus->voice_alloc, flags);
         return change;
diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c
index f24bf1ecb36d..15e4138bce17 100644
--- a/sound/pci/ca0106/ca0106_main.c
+++ b/sound/pci/ca0106/ca0106_main.c
@@ -325,9 +325,9 @@ static struct snd_pcm_hardware snd_ca0106_capture_hw = {
         .rate_max =             192000,
         .channels_min =         2,
         .channels_max =         2,
-        .buffer_bytes_max =     ((65536 - 64) * 8),
+        .buffer_bytes_max =     65536 - 128,
         .period_bytes_min =     64,
-        .period_bytes_max =     (65536 - 64),
+        .period_bytes_max =     32768 - 64,
         .periods_min =          2,
         .periods_max =          2,
         .fifo_size =            0,
diff --git a/sound/pci/ctxfi/ctamixer.c b/sound/pci/ctxfi/ctamixer.c
index a1db51b3ead8..a7f4a671f7b7 100644
--- a/sound/pci/ctxfi/ctamixer.c
+++ b/sound/pci/ctxfi/ctamixer.c
@@ -242,13 +242,12 @@ static int get_amixer_rsc(struct amixer_mgr *mgr,
 
         /* Allocate mem for amixer resource */
         amixer = kzalloc(sizeof(*amixer), GFP_KERNEL);
-        if (NULL == amixer) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (!amixer)
+                return -ENOMEM;
 
         /* Check whether there are sufficient
          * amixer resources to meet request. */
+        err = 0;
         spin_lock_irqsave(&mgr->mgr_lock, flags);
         for (i = 0; i < desc->msr; i++) {
                 err = mgr_get_resource(&mgr->mgr, 1, &idx);
@@ -397,12 +396,11 @@ static int get_sum_rsc(struct sum_mgr *mgr,
 
         /* Allocate mem for sum resource */
         sum = kzalloc(sizeof(*sum), GFP_KERNEL);
-        if (NULL == sum) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (!sum)
+                return -ENOMEM;
 
         /* Check whether there are sufficient sum resources to meet request. */
+        err = 0;
         spin_lock_irqsave(&mgr->mgr_lock, flags);
         for (i = 0; i < desc->msr; i++) {
                 err = mgr_get_resource(&mgr->mgr, 1, &idx);
diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c
index 082e35c08c02..deb6cfa73600 100644
--- a/sound/pci/ctxfi/ctdaio.c
+++ b/sound/pci/ctxfi/ctdaio.c
@@ -57,9 +57,9 @@ struct daio_rsc_idx idx_20k1[NUM_DAIOTYP] = {
 
 struct daio_rsc_idx idx_20k2[NUM_DAIOTYP] = {
         [LINEO1] = {.left = 0x40, .right = 0x41},
-        [LINEO2] = {.left = 0x70, .right = 0x71},
+        [LINEO2] = {.left = 0x60, .right = 0x61},
         [LINEO3] = {.left = 0x50, .right = 0x51},
-        [LINEO4] = {.left = 0x60, .right = 0x61},
+        [LINEO4] = {.left = 0x70, .right = 0x71},
         [LINEIM] = {.left = 0x45, .right = 0xc5},
         [SPDIFOO] = {.left = 0x00, .right = 0x01},
         [SPDIFIO] = {.left = 0x05, .right = 0x85},
diff --git a/sound/pci/ctxfi/ctsrc.c b/sound/pci/ctxfi/ctsrc.c
index e1c145d8b702..df43a5cd3938 100644
--- a/sound/pci/ctxfi/ctsrc.c
+++ b/sound/pci/ctxfi/ctsrc.c
@@ -724,12 +724,11 @@ static int get_srcimp_rsc(struct srcimp_mgr *mgr,
 
         /* Allocate mem for SRCIMP resource */
         srcimp = kzalloc(sizeof(*srcimp), GFP_KERNEL);
-        if (NULL == srcimp) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (!srcimp)
+                return -ENOMEM;
 
         /* Check whether there are sufficient SRCIMP resources. */
+        err = 0;
         spin_lock_irqsave(&mgr->mgr_lock, flags);
         for (i = 0; i < desc->msr; i++) {
                 err = mgr_get_resource(&mgr->mgr, 1, &idx);
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 26d255de6beb..88480c0c58a0 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -332,6 +332,12 @@ int snd_hda_get_connections(struct hda_codec *codec, hda_nid_t nid,
                                                   AC_VERB_GET_CONNECT_LIST, i);
                 range_val = !!(parm & (1 << (shift-1))); /* ranges */
                 val = parm & mask;
+                if (val == 0) {
+                        snd_printk(KERN_WARNING "hda_codec: "
+                                   "invalid CONNECT_LIST verb %x[%i]:%x\n",
+                                    nid, i, parm);
+                        return 0;
+                }
                 parm >>= shift;
                 if (range_val) {
                         /* ranges between the previous and this one */
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index be7d25fa7f35..3da85caf8af1 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3754,7 +3754,7 @@ static int ad1884a_mobile_master_sw_put(struct snd_kcontrol *kcontrol,
         int mute = (!ucontrol->value.integer.value[0] &&
                     !ucontrol->value.integer.value[1]);
         /* toggle GPIO1 according to the mute state */
-        snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
+        snd_hda_codec_write_cache(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
                             mute ? 0x02 : 0x0);
         return ret;
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7e99763ca527..8c8b273116fb 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10631,6 +10631,18 @@ static void alc262_lenovo_3000_unsol_event(struct hda_codec *codec,
         alc262_lenovo_3000_automute(codec, 1);
 }
 
+static int amp_stereo_mute_update(struct hda_codec *codec, hda_nid_t nid,
+                                  int dir, int idx, long *valp)
+{
+        int i, change = 0;
+
+        for (i = 0; i < 2; i++, valp++)
+                change |= snd_hda_codec_amp_update(codec, nid, i, dir, idx,
+                                                   HDA_AMP_MUTE,
+                                                   *valp ? 0 : HDA_AMP_MUTE);
+        return change;
+}
+
 /* bind hp and internal speaker mute (with plug check) */
 static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol,
                                          struct snd_ctl_elem_value *ucontrol)
@@ -10639,13 +10651,8 @@ static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol,
         long *valp = ucontrol->value.integer.value;
         int change;
 
-        change = snd_hda_codec_amp_stereo(codec, 0x14, HDA_OUTPUT, 0,
-                                                 HDA_AMP_MUTE,
-                                                 valp ? 0 : HDA_AMP_MUTE);
-        change |= snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
-                                                 HDA_AMP_MUTE,
-                                                 valp ? 0 : HDA_AMP_MUTE);
-
+        change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
+        change |= amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
         if (change)
                 alc262_fujitsu_automute(codec, 0);
         return change;
@@ -10680,10 +10687,7 @@ static int alc262_lenovo_3000_master_sw_put(struct snd_kcontrol *kcontrol,
         long *valp = ucontrol->value.integer.value;
         int change;
 
-        change = snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
-                                                 HDA_AMP_MUTE,
-                                                 valp ? 0 : HDA_AMP_MUTE);
-
+        change = amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
         if (change)
                 alc262_lenovo_3000_automute(codec, 0);
         return change;
@@ -11854,12 +11858,7 @@ static int alc268_acer_master_sw_put(struct snd_kcontrol *kcontrol,
         long *valp = ucontrol->value.integer.value;
         int change;
 
-        change = snd_hda_codec_amp_update(codec, 0x14, 0, HDA_OUTPUT, 0,
-                                          HDA_AMP_MUTE,
-                                          valp[0] ? 0 : HDA_AMP_MUTE);
-        change |= snd_hda_codec_amp_update(codec, 0x14, 1, HDA_OUTPUT, 0,
-                                           HDA_AMP_MUTE,
-                                           valp[1] ? 0 : HDA_AMP_MUTE);
+        change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
         if (change)
                 alc268_acer_automute(codec, 0);
         return change;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 41b5b3a18c1e..512f3b9b9a45 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -2378,6 +2378,7 @@ static struct snd_pci_quirk stac9205_cfg_tbl[] = {
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0228,
                       "Dell Vostro 1500", STAC_9205_DELL_M42),
         /* Gateway */
+        SND_PCI_QUIRK(0x107b, 0x0560, "Gateway T6834c", STAC_9205_EAPD),
         SND_PCI_QUIRK(0x107b, 0x0565, "Gateway T1616", STAC_9205_EAPD),
         {} /* terminator */
 };
@@ -4065,7 +4066,7 @@ static int stac92xx_add_jack(struct hda_codec *codec,
         jack->nid = nid;
         jack->type = type;
 
-        sprintf(name, "%s at %s %s Jack",
+        snprintf(name, sizeof(name), "%s at %s %s Jack",
                 snd_hda_get_jack_type(def_conf),
                 snd_hda_get_jack_connectivity(def_conf),
                 snd_hda_get_jack_location(def_conf));
@@ -5854,6 +5855,8 @@ static unsigned int *stac9872_brd_tbl[STAC_9872_MODELS] = {
 };
 
 static struct snd_pci_quirk stac9872_cfg_tbl[] = {
+        SND_PCI_QUIRK_MASK(0x104d, 0xfff0, 0x81e0,
+                           "Sony VAIO F/S", STAC_9872_VAIO),
         {} /* terminator */
 };
 
@@ -5866,6 +5869,8 @@ static int patch_stac9872(struct hda_codec *codec)
         if (spec == NULL)
                 return -ENOMEM;
         codec->spec = spec;
+        spec->num_pins = ARRAY_SIZE(stac9872_pin_nids);
+        spec->pin_nids = stac9872_pin_nids;
 
         spec->board_config = snd_hda_check_board_config(codec, STAC_9872_MODELS,
                                                         stac9872_models,
@@ -5877,8 +5882,6 @@ static int patch_stac9872(struct hda_codec *codec)
                 stac92xx_set_config_regs(codec,
                                          stac9872_brd_tbl[spec->board_config]);
 
-        spec->num_pins = ARRAY_SIZE(stac9872_pin_nids);
-        spec->pin_nids = stac9872_pin_nids;
         spec->multiout.dac_nids = spec->dac_nids;
         spec->num_adcs = ARRAY_SIZE(stac9872_adc_nids);
         spec->adc_nids = stac9872_adc_nids;
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index ab099f482487..cb0d1bf34b57 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -767,6 +767,7 @@ static int aic3x_hw_params(struct snd_pcm_substream *substream,
         int codec_clk = 0, bypass_pll = 0, fsref, last_clk = 0;
         u8 data, r, p, pll_q, pll_p = 1, pll_r = 1, pll_j = 1;
         u16 pll_d = 1;
+        u8 reg;
 
         /* select data word length */
         data =
@@ -801,8 +802,16 @@ static int aic3x_hw_params(struct snd_pcm_substream *substream,
                 pll_q &= 0xf;
                 aic3x_write(codec, AIC3X_PLL_PROGA_REG, pll_q << PLLQ_SHIFT);
                 aic3x_write(codec, AIC3X_GPIOB_REG, CODEC_CLKIN_CLKDIV);
-        } else
+                /* disable PLL if it is bypassed */
+                reg = aic3x_read_reg_cache(codec, AIC3X_PLL_PROGA_REG);
+                aic3x_write(codec, AIC3X_PLL_PROGA_REG, reg & ~PLL_ENABLE);
+
+        } else {
                 aic3x_write(codec, AIC3X_GPIOB_REG, CODEC_CLKIN_PLLDIV);
+                /* enable PLL when it is used */
+                reg = aic3x_read_reg_cache(codec, AIC3X_PLL_PROGA_REG);
+                aic3x_write(codec, AIC3X_PLL_PROGA_REG, reg | PLL_ENABLE);
+        }
 
         /* Route Left DAC to left channel input and
          * right DAC to right channel input */
diff --git a/sound/usb/Kconfig b/sound/usb/Kconfig
index 523aec188ccf..73525c048e7f 100644
--- a/sound/usb/Kconfig
+++ b/sound/usb/Kconfig
@@ -48,6 +48,7 @@ config SND_USB_CAIAQ
             * Native Instruments Kore Controller
             * Native Instruments Kore Controller 2
             * Native Instruments Audio Kontrol 1
+            * Native Instruments Audio 2 DJ
             * Native Instruments Audio 4 DJ
             * Native Instruments Audio 8 DJ
             * Native Instruments Guitar Rig Session I/O
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index 8f9b60c5d74c..121af0644fd9 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -646,6 +646,7 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *dev)
         case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_GUITARRIGMOBILE):
                 dev->samplerates |= SNDRV_PCM_RATE_192000;
                 /* fall thru */
+        case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_AUDIO2DJ):
         case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_AUDIO4DJ):
         case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_AUDIO8DJ):
                 dev->samplerates |= SNDRV_PCM_RATE_88200;
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index de38108f0b28..83e6c1312d47 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -35,13 +35,14 @@
 #include "input.h"
 
 MODULE_AUTHOR("Daniel Mack <daniel@caiaq.de>");
-MODULE_DESCRIPTION("caiaq USB audio, version 1.3.18");
+MODULE_DESCRIPTION("caiaq USB audio, version 1.3.19");
 MODULE_LICENSE("GPL");
 MODULE_SUPPORTED_DEVICE("{{Native Instruments, RigKontrol2},"
                          "{Native Instruments, RigKontrol3},"
                          "{Native Instruments, Kore Controller},"
                          "{Native Instruments, Kore Controller 2},"
                          "{Native Instruments, Audio Kontrol 1},"
+                         "{Native Instruments, Audio 2 DJ},"
                          "{Native Instruments, Audio 4 DJ},"
                          "{Native Instruments, Audio 8 DJ},"
                          "{Native Instruments, Session I/O},"
@@ -121,6 +122,11 @@ static struct usb_device_id snd_usb_id_table[] = {
                 .idVendor =     USB_VID_NATIVEINSTRUMENTS,
                 .idProduct =    USB_PID_AUDIO4DJ
         },
+        {
+                .match_flags =  USB_DEVICE_ID_MATCH_DEVICE,
+                .idVendor =     USB_VID_NATIVEINSTRUMENTS,
+                .idProduct =    USB_PID_AUDIO2DJ
+        },
         { /* terminator */ }
 };
 
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index ece73514854e..44e3edf88bef 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -10,6 +10,7 @@
 #define USB_PID_KORECONTROLLER  0x4711
 #define USB_PID_KORECONTROLLER2 0x4712
 #define USB_PID_AK1             0x0815
+#define USB_PID_AUDIO2DJ        0x041c
 #define USB_PID_AUDIO4DJ        0x0839
 #define USB_PID_AUDIO8DJ        0x1978
 #define USB_PID_SESSIONIO       0x1915
diff --git a/sound/usb/usbmixer.c b/sound/usb/usbmixer.c
index 4bd3a7a0edc1..ec9cdf986928 100644
--- a/sound/usb/usbmixer.c
+++ b/sound/usb/usbmixer.c
@@ -990,20 +990,35 @@ static void build_feature_ctl(struct mixer_build *state, unsigned char *desc,
                 break;
         }
 
-        /* quirk for UDA1321/N101 */
-        /* note that detection between firmware 2.1.1.7 (N101) and later 2.1.1.21 */
-        /* is not very clear from datasheets */
-        /* I hope that the min value is -15360 for newer firmware --jk */
+        /* volume control quirks */
         switch (state->chip->usb_id) {
         case USB_ID(0x0471, 0x0101):
         case USB_ID(0x0471, 0x0104):
         case USB_ID(0x0471, 0x0105):
         case USB_ID(0x0672, 0x1041):
+        /* quirk for UDA1321/N101.
+         * note that detection between firmware 2.1.1.7 (N101)
+         * and later 2.1.1.21 is not very clear from datasheets.
+         * I hope that the min value is -15360 for newer firmware --jk
+         */
                 if (!strcmp(kctl->id.name, "PCM Playback Volume") &&
                     cval->min == -15616) {
-                        snd_printk(KERN_INFO "using volume control quirk for the UDA1321/N101 chip\n");
+                        snd_printk(KERN_INFO
+                                 "set volume quirk for UDA1321/N101 chip\n");
                         cval->max = -256;
                 }
+                break;
+
+        case USB_ID(0x046d, 0x09a4):
+                if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+                        snd_printk(KERN_INFO
+                                "set volume quirk for QuickCam E3500\n");
+                        cval->min = 6080;
+                        cval->max = 8768;
+                        cval->res = 192;
+                }
+                break;
+
         }
 
         snd_printdd(KERN_INFO "[%d] FU [%s] ch = %d, val = %d/%d/%d\n",
diff --git a/tools/perf/Documentation/perf-report.txt b/tools/perf/Documentation/perf-report.txt
index 8aa3f8c88707..e72e93110782 100644
--- a/tools/perf/Documentation/perf-report.txt
+++ b/tools/perf/Documentation/perf-report.txt
@@ -24,6 +24,9 @@ OPTIONS
 --dsos=::
         Only consider symbols in these dsos. CSV that understands
         file://filename entries.
+-n
+--show-nr-samples
+        Show the number of samples for each symbol
 -C::
 --comms=::
         Only consider symbols in these comms. CSV that understands
@@ -33,6 +36,18 @@ OPTIONS
         Only consider these symbols. CSV that understands
         file://filename entries.
 
+-w::
+--field-width=::
+        Force each column width to the provided list, for large terminal
+        readability.
+
+-t::
+--field-separator=::
+
+        Use a special separator character and don't pad with spaces, replacing
+        all occurances of this separator in symbol names (and other output)
+        with a '.' character, that thus it's the only non valid separator.
+
 SEE ALSO
 --------
 linkperf:perf-stat[1]
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 7822b3d6baca..a5e9b876ca09 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -345,7 +345,7 @@ BUILTIN_OBJS += builtin-stat.o
 BUILTIN_OBJS += builtin-top.o
 
 PERFLIBS = $(LIB_FILE)
-EXTLIBS =
+EXTLIBS = -lbfd
 
 #
 # Platform specific tweaks
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 5f9eefecc574..1dba568e1941 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -74,20 +74,12 @@ struct fork_event {
         u32 pid, ppid;
 };
 
-struct period_event {
-        struct perf_event_header header;
-        u64 time;
-        u64 id;
-        u64 sample_period;
-};
-
 typedef union event_union {
         struct perf_event_header        header;
         struct ip_event                 ip;
         struct mmap_event               mmap;
         struct comm_event               comm;
         struct fork_event               fork;
-        struct period_event             period;
 } event_t;
 
 
@@ -998,19 +990,6 @@ process_fork_event(event_t *event, unsigned long offset, unsigned long head)
 }
 
 static int
-process_period_event(event_t *event, unsigned long offset, unsigned long head)
-{
-        dprintf("%p [%p]: PERF_EVENT_PERIOD: time:%Ld, id:%Ld: period:%Ld\n",
-                (void *)(offset + head),
-                (void *)(long)(event->header.size),
-                event->period.time,
-                event->period.id,
-                event->period.sample_period);
-
-        return 0;
-}
-
-static int
 process_event(event_t *event, unsigned long offset, unsigned long head)
 {
         switch (event->header.type) {
@@ -1025,9 +1004,6 @@ process_event(event_t *event, unsigned long offset, unsigned long head)
 
         case PERF_EVENT_FORK:
                 return process_fork_event(event, offset, head);
-
-        case PERF_EVENT_PERIOD:
-                return process_period_event(event, offset, head);
         /*
          * We dont process them right now but they are fine:
          */
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 4ef78a5e6f32..6da09928130f 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -43,6 +43,7 @@ static int			call_graph			= 0;
 static int                      verbose                         = 0;
 static int                      inherit_stat                    = 0;
 static int                      no_samples                      = 0;
+static int                      sample_address                  = 0;
 
 static long                     samples;
 static struct timeval           last_read;
@@ -313,6 +314,10 @@ static void pid_synthesize_mmap_samples(pid_t pid)
                 if (*pbf == 'x') { /* vm_exec */
                         char *execname = strchr(bf, '/');
 
+                        /* Catch VDSO */
+                        if (execname == NULL)
+                                execname = strstr(bf, "[vdso]");
+
                         if (execname == NULL)
                                 continue;
 
@@ -401,6 +406,9 @@ static void create_counter(int counter, int cpu, pid_t pid)
         if (inherit_stat)
                 attr->inherit_stat = 1;
 
+        if (sample_address)
+                attr->sample_type       |= PERF_SAMPLE_ADDR;
+
         if (call_graph)
                 attr->sample_type       |= PERF_SAMPLE_CALLCHAIN;
 
@@ -645,6 +653,8 @@ static const struct option options[] = {
                     "be more verbose (show counter open errors, etc)"),
         OPT_BOOLEAN('s', "stat", &inherit_stat,
                     "per thread counts"),
+        OPT_BOOLEAN('d', "data", &sample_address,
+                    "Sample addresses"),
         OPT_BOOLEAN('n', "no-samples", &no_samples,
                     "don't sample"),
         OPT_END()
@@ -654,7 +664,8 @@ int cmd_record(int argc, const char **argv, const char *prefix __used)
 {
         int counter;
 
-        argc = parse_options(argc, argv, options, record_usage, 0);
+        argc = parse_options(argc, argv, options, record_usage,
+                PARSE_OPT_STOP_AT_NON_OPTION);
         if (!argc && target_pid == -1 && !system_wide)
                 usage_with_options(record_usage, options);
 
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 4e5cc266311e..b20a4b6e31b7 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -33,8 +33,10 @@ static char		*vmlinux = NULL;
 
 static char             default_sort_order[] = "comm,dso";
 static char             *sort_order = default_sort_order;
-static char             *dso_list_str, *comm_list_str, *sym_list_str;
+static char             *dso_list_str, *comm_list_str, *sym_list_str,
+                        *col_width_list_str;
 static struct strlist   *dso_list, *comm_list, *sym_list;
+static char             *field_sep;
 
 static int              input;
 static int              show_mask = SHOW_KERNEL | SHOW_USER | SHOW_HV;
@@ -49,6 +51,7 @@ static int		verbose;
 static int              modules;
 
 static int              full_paths;
+static int              show_nr_samples;
 
 static unsigned long    page_size;
 static unsigned long    mmap_window = 32;
@@ -98,13 +101,6 @@ struct fork_event {
         u32 pid, ppid;
 };
 
-struct period_event {
-        struct perf_event_header header;
-        u64 time;
-        u64 id;
-        u64 sample_period;
-};
-
 struct lost_event {
         struct perf_event_header header;
         u64 id;
@@ -124,11 +120,37 @@ typedef union event_union {
         struct mmap_event               mmap;
         struct comm_event               comm;
         struct fork_event               fork;
-        struct period_event             period;
         struct lost_event               lost;
         struct read_event               read;
 } event_t;
 
+static int repsep_fprintf(FILE *fp, const char *fmt, ...)
+{
+        int n;
+        va_list ap;
+
+        va_start(ap, fmt);
+        if (!field_sep)
+                n = vfprintf(fp, fmt, ap);
+        else {
+                char *bf = NULL;
+                n = vasprintf(&bf, fmt, ap);
+                if (n > 0) {
+                        char *sep = bf;
+                        while (1) {
+                                sep = strchr(sep, *field_sep);
+                                if (sep == NULL)
+                                        break;
+                                *sep = '.';
+                        }
+                }
+                fputs(bf, fp);
+                free(bf);
+        }
+        va_end(ap);
+        return n;
+}
+
 static LIST_HEAD(dsos);
 static struct dso *kernel_dso;
 static struct dso *vdso;
@@ -360,12 +382,28 @@ static struct thread *thread__new(pid_t pid)
         return self;
 }
 
+static unsigned int dsos__col_width,
+                    comms__col_width,
+                    threads__col_width;
+
 static int thread__set_comm(struct thread *self, const char *comm)
 {
         if (self->comm)
                 free(self->comm);
         self->comm = strdup(comm);
-        return self->comm ? 0 : -ENOMEM;
+        if (!self->comm)
+                return -ENOMEM;
+
+        if (!col_width_list_str && !field_sep &&
+            (!comm_list || strlist__has_entry(comm_list, comm))) {
+                unsigned int slen = strlen(comm);
+                if (slen > comms__col_width) {
+                        comms__col_width = slen;
+                        threads__col_width = slen + 6;
+                }
+        }
+
+        return 0;
 }
 
 static size_t thread__fprintf(struct thread *self, FILE *fp)
@@ -536,7 +574,9 @@ struct sort_entry {
 
         int64_t (*cmp)(struct hist_entry *, struct hist_entry *);
         int64_t (*collapse)(struct hist_entry *, struct hist_entry *);
-        size_t  (*print)(FILE *fp, struct hist_entry *);
+        size_t  (*print)(FILE *fp, struct hist_entry *, unsigned int width);
+        unsigned int *width;
+        bool    elide;
 };
 
 static int64_t cmp_null(void *l, void *r)
@@ -558,15 +598,17 @@ sort__thread_cmp(struct hist_entry *left, struct hist_entry *right)
 }
 
 static size_t
-sort__thread_print(FILE *fp, struct hist_entry *self)
+sort__thread_print(FILE *fp, struct hist_entry *self, unsigned int width)
 {
-        return fprintf(fp, "%16s:%5d", self->thread->comm ?: "", self->thread->pid);
+        return repsep_fprintf(fp, "%*s:%5d", width - 6,
+                              self->thread->comm ?: "", self->thread->pid);
 }
 
 static struct sort_entry sort_thread = {
-        .header = "         Command:  Pid",
+        .header = "Command:  Pid",
         .cmp    = sort__thread_cmp,
         .print  = sort__thread_print,
+        .width  = &threads__col_width,
 };
 
 /* --sort comm */
@@ -590,16 +632,17 @@ sort__comm_collapse(struct hist_entry *left, struct hist_entry *right)
 }
 
 static size_t
-sort__comm_print(FILE *fp, struct hist_entry *self)
+sort__comm_print(FILE *fp, struct hist_entry *self, unsigned int width)
 {
-        return fprintf(fp, "%16s", self->thread->comm);
+        return repsep_fprintf(fp, "%*s", width, self->thread->comm);
 }
 
 static struct sort_entry sort_comm = {
-        .header         = "         Command",
+        .header         = "Command",
         .cmp            = sort__comm_cmp,
         .collapse       = sort__comm_collapse,
         .print          = sort__comm_print,
+        .width          = &comms__col_width,
 };
 
 /* --sort dso */
@@ -617,18 +660,19 @@ sort__dso_cmp(struct hist_entry *left, struct hist_entry *right)
 }
 
 static size_t
-sort__dso_print(FILE *fp, struct hist_entry *self)
+sort__dso_print(FILE *fp, struct hist_entry *self, unsigned int width)
 {
         if (self->dso)
-                return fprintf(fp, "%-25s", self->dso->name);
+                return repsep_fprintf(fp, "%-*s", width, self->dso->name);
 
-        return fprintf(fp, "%016llx         ", (u64)self->ip);
+        return repsep_fprintf(fp, "%*llx", width, (u64)self->ip);
 }
 
 static struct sort_entry sort_dso = {
-        .header = "Shared Object            ",
+        .header = "Shared Object",
         .cmp    = sort__dso_cmp,
         .print  = sort__dso_print,
+        .width  = &dsos__col_width,
 };
 
 /* --sort symbol */
@@ -648,22 +692,22 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)
 }
 
 static size_t
-sort__sym_print(FILE *fp, struct hist_entry *self)
+sort__sym_print(FILE *fp, struct hist_entry *self, unsigned int width __used)
 {
         size_t ret = 0;
 
         if (verbose)
-                ret += fprintf(fp, "%#018llx  ", (u64)self->ip);
+                ret += repsep_fprintf(fp, "%#018llx  ", (u64)self->ip);
 
+        ret += repsep_fprintf(fp, "[%c] ", self->level);
         if (self->sym) {
-                ret += fprintf(fp, "[%c] %s",
-                        self->dso == kernel_dso ? 'k' :
-                        self->dso == hypervisor_dso ? 'h' : '.', self->sym->name);
+                ret += repsep_fprintf(fp, "%s", self->sym->name);
 
                 if (self->sym->module)
-                        ret += fprintf(fp, "\t[%s]", self->sym->module->name);
+                        ret += repsep_fprintf(fp, "\t[%s]",
+                                             self->sym->module->name);
         } else {
-                ret += fprintf(fp, "%#016llx", (u64)self->ip);
+                ret += repsep_fprintf(fp, "%#016llx", (u64)self->ip);
         }
 
         return ret;
@@ -690,19 +734,19 @@ sort__parent_cmp(struct hist_entry *left, struct hist_entry *right)
 }
 
 static size_t
-sort__parent_print(FILE *fp, struct hist_entry *self)
+sort__parent_print(FILE *fp, struct hist_entry *self, unsigned int width)
 {
-        size_t ret = 0;
-
-        ret += fprintf(fp, "%-20s", self->parent ? self->parent->name : "[other]");
-
-        return ret;
+        return repsep_fprintf(fp, "%-*s", width,
+                              self->parent ? self->parent->name : "[other]");
 }
 
+static unsigned int parent_symbol__col_width;
+
 static struct sort_entry sort_parent = {
-        .header = "Parent symbol       ",
+        .header = "Parent symbol",
         .cmp    = sort__parent_cmp,
         .print  = sort__parent_print,
+        .width  = &parent_symbol__col_width,
 };
 
 static int sort__need_collapse = 0;
@@ -967,17 +1011,25 @@ hist_entry__fprintf(FILE *fp, struct hist_entry *self, u64 total_samples)
                 return 0;
 
         if (total_samples)
-                ret = percent_color_fprintf(fp, "   %6.2f%%",
-                                (self->count * 100.0) / total_samples);
+                ret = percent_color_fprintf(fp,
+                                            field_sep ? "%.2f" : "   %6.2f%%",
+                                        (self->count * 100.0) / total_samples);
         else
-                ret = fprintf(fp, "%12Ld ", self->count);
+                ret = fprintf(fp, field_sep ? "%lld" : "%12lld ", self->count);
+
+        if (show_nr_samples) {
+                if (field_sep)
+                        fprintf(fp, "%c%lld", *field_sep, self->count);
+                else
+                        fprintf(fp, "%11lld", self->count);
+        }
 
         list_for_each_entry(se, &hist_entry__sort_list, list) {
-                if (exclude_other && (se == &sort_parent))
+                if (se->elide)
                         continue;
 
-                fprintf(fp, "  ");
-                ret += se->print(fp, self);
+                fprintf(fp, "%s", field_sep ?: "  ");
+                ret += se->print(fp, self, se->width ? *se->width : 0);
         }
 
         ret += fprintf(fp, "\n");
@@ -992,6 +1044,18 @@ hist_entry__fprintf(FILE *fp, struct hist_entry *self, u64 total_samples)
  *
  */
 
+static void dso__calc_col_width(struct dso *self)
+{
+        if (!col_width_list_str && !field_sep &&
+            (!dso_list || strlist__has_entry(dso_list, self->name))) {
+                unsigned int slen = strlen(self->name);
+                if (slen > dsos__col_width)
+                        dsos__col_width = slen;
+        }
+
+        self->slen_calculated = 1;
+}
+
 static struct symbol *
 resolve_symbol(struct thread *thread, struct map **mapp,
                struct dso **dsop, u64 *ipp)
@@ -1011,6 +1075,14 @@ resolve_symbol(struct thread *thread, struct map **mapp,
 
         map = thread__find_map(thread, ip);
         if (map != NULL) {
+                /*
+                 * We have to do this here as we may have a dso
+                 * with no symbol hit that has a name longer than
+                 * the ones with symbols sampled.
+                 */
+                if (!sort_dso.elide && !map->dso->slen_calculated)
+                        dso__calc_col_width(map->dso);
+
                 if (mapp)
                         *mapp = map;
 got_map:
@@ -1282,35 +1354,67 @@ static size_t output__fprintf(FILE *fp, u64 total_samples)
         struct sort_entry *se;
         struct rb_node *nd;
         size_t ret = 0;
+        unsigned int width;
+        char *col_width = col_width_list_str;
 
-        fprintf(fp, "\n");
-        fprintf(fp, "#\n");
-        fprintf(fp, "# (%Ld samples)\n", (u64)total_samples);
+        fprintf(fp, "# Samples: %Ld\n", (u64)total_samples);
         fprintf(fp, "#\n");
 
         fprintf(fp, "# Overhead");
+        if (show_nr_samples) {
+                if (field_sep)
+                        fprintf(fp, "%cSamples", *field_sep);
+                else
+                        fputs("  Samples  ", fp);
+        }
         list_for_each_entry(se, &hist_entry__sort_list, list) {
-                if (exclude_other && (se == &sort_parent))
+                if (se->elide)
                         continue;
-                fprintf(fp, "  %s", se->header);
+                if (field_sep) {
+                        fprintf(fp, "%c%s", *field_sep, se->header);
+                        continue;
+                }
+                width = strlen(se->header);
+                if (se->width) {
+                        if (col_width_list_str) {
+                                if (col_width) {
+                                        *se->width = atoi(col_width);
+                                        col_width = strchr(col_width, ',');
+                                        if (col_width)
+                                                ++col_width;
+                                }
+                        }
+                        width = *se->width = max(*se->width, width);
+                }
+                fprintf(fp, "  %*s", width, se->header);
         }
         fprintf(fp, "\n");
 
+        if (field_sep)
+                goto print_entries;
+
         fprintf(fp, "# ........");
+        if (show_nr_samples)
+                fprintf(fp, " ..........");
         list_for_each_entry(se, &hist_entry__sort_list, list) {
                 unsigned int i;
 
-                if (exclude_other && (se == &sort_parent))
+                if (se->elide)
                         continue;
 
                 fprintf(fp, "  ");
-                for (i = 0; i < strlen(se->header); i++)
+                if (se->width)
+                        width = *se->width;
+                else
+                        width = strlen(se->header);
+                for (i = 0; i < width; i++)
                         fprintf(fp, ".");
         }
         fprintf(fp, "\n");
 
         fprintf(fp, "#\n");
 
+print_entries:
         for (nd = rb_first(&output_hists); nd; nd = rb_next(nd)) {
                 pos = rb_entry(nd, struct hist_entry, rb_node);
                 ret += hist_entry__fprintf(fp, pos, total_samples);
@@ -1524,19 +1628,6 @@ process_fork_event(event_t *event, unsigned long offset, unsigned long head)
 }
 
 static int
-process_period_event(event_t *event, unsigned long offset, unsigned long head)
-{
-        dprintf("%p [%p]: PERF_EVENT_PERIOD: time:%Ld, id:%Ld: period:%Ld\n",
-                (void *)(offset + head),
-                (void *)(long)(event->header.size),
-                event->period.time,
-                event->period.id,
-                event->period.sample_period);
-
-        return 0;
-}
-
-static int
 process_lost_event(event_t *event, unsigned long offset, unsigned long head)
 {
         dprintf("%p [%p]: PERF_EVENT_LOST: id:%Ld: lost:%Ld\n",
@@ -1617,9 +1708,6 @@ process_event(event_t *event, unsigned long offset, unsigned long head)
         case PERF_EVENT_FORK:
                 return process_fork_event(event, offset, head);
 
-        case PERF_EVENT_PERIOD:
-                return process_period_event(event, offset, head);
-
         case PERF_EVENT_LOST:
                 return process_lost_event(event, offset, head);
 
@@ -1883,6 +1971,8 @@ static const struct option options[] = {
         OPT_STRING('k', "vmlinux", &vmlinux, "file", "vmlinux pathname"),
         OPT_BOOLEAN('m', "modules", &modules,
                     "load module symbols - WARNING: use only with -k and LIVE kernel"),
+        OPT_BOOLEAN('n', "show-nr-samples", &show_nr_samples,
+                    "Show a column with the number of samples"),
         OPT_STRING('s', "sort", &sort_order, "key[,key2...]",
                    "sort by key(s): pid, comm, dso, symbol, parent"),
         OPT_BOOLEAN('P', "full-paths", &full_paths,
@@ -1891,15 +1981,21 @@ static const struct option options[] = {
                    "regex filter to identify parent, see: '--sort parent'"),
         OPT_BOOLEAN('x', "exclude-other", &exclude_other,
                     "Only display entries with parent-match"),
-        OPT_CALLBACK_DEFAULT('c', "callchain", NULL, "output_type,min_percent",
+        OPT_CALLBACK_DEFAULT('g', "call-graph", NULL, "output_type,min_percent",
                      "Display callchains using output_type and min percent threshold. "
-                     "Default: flat,0", &parse_callchain_opt, callchain_default_opt),
+                     "Default: fractal,0.5", &parse_callchain_opt, callchain_default_opt),
         OPT_STRING('d', "dsos", &dso_list_str, "dso[,dso...]",
                    "only consider symbols in these dsos"),
         OPT_STRING('C', "comms", &comm_list_str, "comm[,comm...]",
                    "only consider symbols in these comms"),
         OPT_STRING('S', "symbols", &sym_list_str, "symbol[,symbol...]",
                    "only consider these symbols"),
+        OPT_STRING('w', "column-widths", &col_width_list_str,
+                   "width[,width...]",
+                   "don't try to adjust column width, use these fixed values"),
+        OPT_STRING('t', "field-separator", &field_sep, "separator",
+                   "separator for columns, no spaces will be added between "
+                   "columns '.' is reserved."),
         OPT_END()
 };
 
@@ -1919,7 +2015,8 @@ static void setup_sorting(void)
 }
 
 static void setup_list(struct strlist **list, const char *list_str,
-                       const char *list_name)
+                       struct sort_entry *se, const char *list_name,
+                       FILE *fp)
 {
         if (list_str) {
                 *list = strlist__new(true, list_str);
@@ -1928,6 +2025,11 @@ static void setup_list(struct strlist **list, const char *list_str,
                                 list_name);
                         exit(129);
                 }
+                if (strlist__nr_entries(*list) == 1) {
+                        fprintf(fp, "# %s: %s\n", list_name,
+                                strlist__entry(*list, 0)->s);
+                        se->elide = true;
+                }
         }
 }
 
@@ -1941,9 +2043,10 @@ int cmd_report(int argc, const char **argv, const char *prefix __used)
 
         setup_sorting();
 
-        if (parent_pattern != default_parent_pattern)
+        if (parent_pattern != default_parent_pattern) {
                 sort_dimension__add("parent");
-        else
+                sort_parent.elide = 1;
+        } else
                 exclude_other = 0;
 
         /*
@@ -1952,11 +2055,17 @@ int cmd_report(int argc, const char **argv, const char *prefix __used)
         if (argc)
                 usage_with_options(report_usage, options);
 
-        setup_list(&dso_list, dso_list_str, "dso");
-        setup_list(&comm_list, comm_list_str, "comm");
-        setup_list(&sym_list, sym_list_str, "symbol");
-
         setup_pager();
 
+        setup_list(&dso_list, dso_list_str, &sort_dso, "dso", stdout);
+        setup_list(&comm_list, comm_list_str, &sort_comm, "comm", stdout);
+        setup_list(&sym_list, sym_list_str, &sort_sym, "symbol", stdout);
+
+        if (field_sep && *field_sep == '.') {
+                fputs("'.' is the only non valid --field-separator argument\n",
+                      stderr);
+                exit(129);
+        }
+
         return __cmd_report();
 }
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 27921a8ce1a9..f9510eeeb6c7 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -511,7 +511,8 @@ int cmd_stat(int argc, const char **argv, const char *prefix __used)
 {
         int status;
 
-        argc = parse_options(argc, argv, options, stat_usage, 0);
+        argc = parse_options(argc, argv, options, stat_usage,
+                PARSE_OPT_STOP_AT_NON_OPTION);
         if (!argc)
                 usage_with_options(stat_usage, options);
         if (run_count <= 0 || run_count > MAX_RUN)
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 95d5c0ae375a..c0a423004e15 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -58,6 +58,7 @@ static u64			count_filter			=  5;
 static int                      print_entries                   = 15;
 
 static int                      target_pid                      = -1;
+static int                      inherit                         =  0;
 static int                      profile_cpu                     = -1;
 static int                      nr_cpus                         =  0;
 static unsigned int             realtime_prio                   =  0;
@@ -549,7 +550,7 @@ int group_fd;
 static void start_counter(int i, int counter)
 {
         struct perf_counter_attr *attr;
-        unsigned int cpu;
+        int cpu;
 
         cpu = profile_cpu;
         if (target_pid == -1 && profile_cpu == -1)
@@ -559,6 +560,7 @@ static void start_counter(int i, int counter)
 
         attr->sample_type       = PERF_SAMPLE_IP | PERF_SAMPLE_TID;
         attr->freq              = freq;
+        attr->inherit           = (cpu < 0) && inherit;
 
 try_again:
         fd[i][counter] = sys_perf_counter_open(attr, target_pid, cpu, group_fd, 0);
@@ -685,6 +687,8 @@ static const struct option options[] = {
                     "only display functions with more events than this"),
         OPT_BOOLEAN('g', "group", &group,
                             "put the counters into a counter group"),
+        OPT_BOOLEAN('i', "inherit", &inherit,
+                    "child tasks inherit counters"),
         OPT_STRING('s', "sym-filter", &sym_filter, "pattern",
                     "only display symbols matchig this pattern"),
         OPT_BOOLEAN('z', "zero", &zero,
diff --git a/tools/perf/perf.c b/tools/perf/perf.c
index c5656784c61d..31982ad064b4 100644
--- a/tools/perf/perf.c
+++ b/tools/perf/perf.c
@@ -12,6 +12,8 @@
 #include "util/cache.h"
 #include "util/quote.h"
 #include "util/run-command.h"
+#include "util/parse-events.h"
+#include "util/string.h"
 
 const char perf_usage_string[] =
         "perf [--version] [--help] COMMAND [ARGS]";
@@ -25,6 +27,8 @@ struct pager_config {
         int val;
 };
 
+static char debugfs_mntpt[MAXPATHLEN];
+
 static int pager_command_config(const char *var, const char *value, void *data)
 {
         struct pager_config *c = data;
@@ -56,6 +60,15 @@ static void commit_pager_choice(void) {
         }
 }
 
+static void set_debugfs_path(void)
+{
+        char *path;
+
+        path = getenv(PERF_DEBUGFS_ENVIRONMENT);
+        snprintf(debugfs_path, MAXPATHLEN, "%s/%s", path ?: debugfs_mntpt,
+                 "tracing/events");
+}
+
 static int handle_options(const char*** argv, int* argc, int* envchanged)
 {
         int handled = 0;
@@ -122,6 +135,22 @@ static int handle_options(const char*** argv, int* argc, int* envchanged)
                         setenv(PERF_WORK_TREE_ENVIRONMENT, cmd + 12, 1);
                         if (envchanged)
                                 *envchanged = 1;
+                } else if (!strcmp(cmd, "--debugfs-dir")) {
+                        if (*argc < 2) {
+                                fprintf(stderr, "No directory given for --debugfs-dir.\n");
+                                usage(perf_usage_string);
+                        }
+                        strncpy(debugfs_mntpt, (*argv)[1], MAXPATHLEN);
+                        debugfs_mntpt[MAXPATHLEN - 1] = '\0';
+                        if (envchanged)
+                                *envchanged = 1;
+                        (*argv)++;
+                        (*argc)--;
+                } else if (!prefixcmp(cmd, "--debugfs-dir=")) {
+                        strncpy(debugfs_mntpt, cmd + 14, MAXPATHLEN);
+                        debugfs_mntpt[MAXPATHLEN - 1] = '\0';
+                        if (envchanged)
+                                *envchanged = 1;
                 } else {
                         fprintf(stderr, "Unknown option: %s\n", cmd);
                         usage(perf_usage_string);
@@ -228,6 +257,7 @@ static int run_builtin(struct cmd_struct *p, int argc, const char **argv)
         if (use_pager == -1 && p->option & USE_PAGER)
                 use_pager = 1;
         commit_pager_choice();
+        set_debugfs_path();
 
         status = p->fn(argc, argv, prefix);
         if (status)
@@ -346,6 +376,49 @@ static int run_argv(int *argcp, const char ***argv)
         return done_alias;
 }
 
+/* mini /proc/mounts parser: searching for "^blah /mount/point debugfs" */
+static void get_debugfs_mntpt(void)
+{
+        FILE *file;
+        char fs_type[100];
+        char debugfs[MAXPATHLEN];
+
+        /*
+         * try the standard location
+         */
+        if (valid_debugfs_mount("/sys/kernel/debug/") == 0) {
+                strcpy(debugfs_mntpt, "/sys/kernel/debug/");
+                return;
+        }
+
+        /*
+         * try the sane location
+         */
+        if (valid_debugfs_mount("/debug/") == 0) {
+                strcpy(debugfs_mntpt, "/debug/");
+                return;
+        }
+
+        /*
+         * give up and parse /proc/mounts
+         */
+        file = fopen("/proc/mounts", "r");
+        if (file == NULL)
+                return;
+
+        while (fscanf(file, "%*s %"
+                      STR(MAXPATHLEN)
+                      "s %99s %*s %*d %*d\n",
+                      debugfs, fs_type) == 2) {
+                if (strcmp(fs_type, "debugfs") == 0)
+                        break;
+        }
+        fclose(file);
+        if (strcmp(fs_type, "debugfs") == 0) {
+                strncpy(debugfs_mntpt, debugfs, MAXPATHLEN);
+                debugfs_mntpt[MAXPATHLEN - 1] = '\0';
+        }
+}
 
 int main(int argc, const char **argv)
 {
@@ -354,7 +427,8 @@ int main(int argc, const char **argv)
         cmd = perf_extract_argv0_path(argv[0]);
         if (!cmd)
                 cmd = "perf-help";
-
+        /* get debugfs mount point from /proc/mounts */
+        get_debugfs_mntpt();
         /*
          * "perf-xxxx" is the same as "perf xxxx", but we obviously:
          *
@@ -377,6 +451,7 @@ int main(int argc, const char **argv)
         argc--;
         handle_options(&argv, &argc, NULL);
         commit_pager_choice();
+        set_debugfs_path();
         if (argc > 0) {
                 if (!prefixcmp(argv[0], "--"))
                         argv[0] += 2;
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index 63e67cc5487b..e5148e2b6134 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -1,7 +1,13 @@
 #ifndef _PERF_PERF_H
 #define _PERF_PERF_H
 
-#if defined(__x86_64__) || defined(__i386__)
+#if defined(__i386__)
+#include "../../arch/x86/include/asm/unistd.h"
+#define rmb()           asm volatile("lock; addl $0,0(%%esp)" ::: "memory")
+#define cpu_relax()     asm volatile("rep; nop" ::: "memory");
+#endif
+
+#if defined(__x86_64__)
 #include "../../arch/x86/include/asm/unistd.h"
 #define rmb()           asm volatile("lfence" ::: "memory")
 #define cpu_relax()     asm volatile("rep; nop" ::: "memory");
diff --git a/tools/perf/util/cache.h b/tools/perf/util/cache.h
index 161d5f413e28..4b50c412b9c5 100644
--- a/tools/perf/util/cache.h
+++ b/tools/perf/util/cache.h
@@ -18,6 +18,7 @@
 #define PERFATTRIBUTES_FILE ".perfattributes"
 #define INFOATTRIBUTES_FILE "info/attributes"
 #define ATTRIBUTE_MACRO_PREFIX "[attr]"
+#define PERF_DEBUGFS_ENVIRONMENT "PERF_DEBUGFS_DIR"
 
 typedef int (*config_fn_t)(const char *, const char *, void *);
 extern int perf_default_config(const char *, const char *, void *);
diff --git a/tools/perf/util/header.h b/tools/perf/util/header.h
index b5ef53ad4c7a..bf280449fcfd 100644
--- a/tools/perf/util/header.h
+++ b/tools/perf/util/header.h
@@ -16,7 +16,7 @@ struct perf_header {
         int frozen;
         int attrs, size;
         struct perf_header_attr **attr;
-        off_t attr_offset;
+        s64 attr_offset;
         u64 data_offset;
         u64 data_size;
 };
diff --git a/tools/perf/util/include/linux/kernel.h b/tools/perf/util/include/linux/kernel.h
index 99c1b3d1edd9..a6b87390cb52 100644
--- a/tools/perf/util/include/linux/kernel.h
+++ b/tools/perf/util/include/linux/kernel.h
@@ -18,4 +18,12 @@
         (type *)((char *)__mptr - offsetof(type, member)); })
 #endif
 
+#ifndef max
+#define max(x, y) ({                            \
+        typeof(x) _max1 = (x);                  \
+        typeof(y) _max2 = (y);                  \
+        (void) (&_max1 == &_max2);              \
+        _max1 > _max2 ? _max1 : _max2; })
+#endif
+
 #endif
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 5184959e0615..7bdad8df22a6 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -5,6 +5,7 @@
 #include "parse-events.h"
 #include "exec_cmd.h"
 #include "string.h"
+#include "cache.h"
 
 extern char *strcasestr(const char *haystack, const char *needle);
 
@@ -19,6 +20,8 @@ struct event_symbol {
         char    *alias;
 };
 
+char debugfs_path[MAXPATHLEN];
+
 #define CHW(x) .type = PERF_TYPE_HARDWARE, .config = PERF_COUNT_HW_##x
 #define CSW(x) .type = PERF_TYPE_SOFTWARE, .config = PERF_COUNT_SW_##x
 
@@ -71,8 +74,8 @@ static char *sw_event_names[] = {
 #define MAX_ALIASES 8
 
 static char *hw_cache[][MAX_ALIASES] = {
- { "L1-d$",     "l1-d",         "l1d",          "L1-data",              },
- { "L1-i$",     "l1-i",         "l1i",          "L1-instruction",       },
+ { "L1-dcache", "l1-d",         "l1d",          "L1-data",              },
+ { "L1-icache", "l1-i",         "l1i",          "L1-instruction",       },
  { "LLC",       "L2"                                                    },
  { "dTLB",      "d-tlb",        "Data-TLB",                             },
  { "iTLB",      "i-tlb",        "Instruction-TLB",                      },
@@ -110,6 +113,88 @@ static unsigned long hw_cache_stat[C(MAX)] = {
  [C(BPU)]       = (CACHE_READ),
 };
 
+#define for_each_subsystem(sys_dir, sys_dirent, sys_next, file, st)            \
+        while (!readdir_r(sys_dir, &sys_dirent, &sys_next) && sys_next)        \
+        if (snprintf(file, MAXPATHLEN, "%s/%s", debugfs_path,                  \
+                        sys_dirent.d_name) &&                                  \
+           (!stat(file, &st)) && (S_ISDIR(st.st_mode)) &&                      \
+           (strcmp(sys_dirent.d_name, ".")) &&                                 \
+           (strcmp(sys_dirent.d_name, "..")))
+
+#define for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next, file, st)    \
+        while (!readdir_r(evt_dir, &evt_dirent, &evt_next) && evt_next)        \
+        if (snprintf(file, MAXPATHLEN, "%s/%s/%s", debugfs_path,               \
+                     sys_dirent.d_name, evt_dirent.d_name) &&                  \
+           (!stat(file, &st)) && (S_ISDIR(st.st_mode)) &&                      \
+           (strcmp(evt_dirent.d_name, ".")) &&                                 \
+           (strcmp(evt_dirent.d_name, "..")))
+
+#define MAX_EVENT_LENGTH 30
+
+int valid_debugfs_mount(const char *debugfs)
+{
+        struct statfs st_fs;
+
+        if (statfs(debugfs, &st_fs) < 0)
+                return -ENOENT;
+        else if (st_fs.f_type != (long) DEBUGFS_MAGIC)
+                return -ENOENT;
+        return 0;
+}
+
+static char *tracepoint_id_to_name(u64 config)
+{
+        static char tracepoint_name[2 * MAX_EVENT_LENGTH];
+        DIR *sys_dir, *evt_dir;
+        struct dirent *sys_next, *evt_next, sys_dirent, evt_dirent;
+        struct stat st;
+        char id_buf[4];
+        int fd;
+        u64 id;
+        char evt_path[MAXPATHLEN];
+
+        if (valid_debugfs_mount(debugfs_path))
+                return "unkown";
+
+        sys_dir = opendir(debugfs_path);
+        if (!sys_dir)
+                goto cleanup;
+
+        for_each_subsystem(sys_dir, sys_dirent, sys_next, evt_path, st) {
+                evt_dir = opendir(evt_path);
+                if (!evt_dir)
+                        goto cleanup;
+                for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next,
+                                                                evt_path, st) {
+                        snprintf(evt_path, MAXPATHLEN, "%s/%s/%s/id",
+                                 debugfs_path, sys_dirent.d_name,
+                                 evt_dirent.d_name);
+                        fd = open(evt_path, O_RDONLY);
+                        if (fd < 0)
+                                continue;
+                        if (read(fd, id_buf, sizeof(id_buf)) < 0) {
+                                close(fd);
+                                continue;
+                        }
+                        close(fd);
+                        id = atoll(id_buf);
+                        if (id == config) {
+                                closedir(evt_dir);
+                                closedir(sys_dir);
+                                snprintf(tracepoint_name, 2 * MAX_EVENT_LENGTH,
+                                        "%s:%s", sys_dirent.d_name,
+                                        evt_dirent.d_name);
+                                return tracepoint_name;
+                        }
+                }
+                closedir(evt_dir);
+        }
+
+cleanup:
+        closedir(sys_dir);
+        return "unkown";
+}
+
 static int is_cache_op_valid(u8 cache_type, u8 cache_op)
 {
         if (hw_cache_stat[cache_type] & COP(cache_op))
@@ -177,6 +262,9 @@ char *event_name(int counter)
                         return sw_event_names[config];
                 return "unknown-software";
 
+        case PERF_TYPE_TRACEPOINT:
+                return tracepoint_id_to_name(config);
+
         default:
                 break;
         }
@@ -265,6 +353,53 @@ parse_generic_hw_event(const char **str, struct perf_counter_attr *attr)
         return 1;
 }
 
+static int parse_tracepoint_event(const char **strp,
+                                    struct perf_counter_attr *attr)
+{
+        const char *evt_name;
+        char sys_name[MAX_EVENT_LENGTH];
+        char id_buf[4];
+        int fd;
+        unsigned int sys_length, evt_length;
+        u64 id;
+        char evt_path[MAXPATHLEN];
+
+        if (valid_debugfs_mount(debugfs_path))
+                return 0;
+
+        evt_name = strchr(*strp, ':');
+        if (!evt_name)
+                return 0;
+
+        sys_length = evt_name - *strp;
+        if (sys_length >= MAX_EVENT_LENGTH)
+                return 0;
+
+        strncpy(sys_name, *strp, sys_length);
+        sys_name[sys_length] = '\0';
+        evt_name = evt_name + 1;
+        evt_length = strlen(evt_name);
+        if (evt_length >= MAX_EVENT_LENGTH)
+                return 0;
+
+        snprintf(evt_path, MAXPATHLEN, "%s/%s/%s/id", debugfs_path,
+                 sys_name, evt_name);
+        fd = open(evt_path, O_RDONLY);
+        if (fd < 0)
+                return 0;
+
+        if (read(fd, id_buf, sizeof(id_buf)) < 0) {
+                close(fd);
+                return 0;
+        }
+        close(fd);
+        id = atoll(id_buf);
+        attr->config = id;
+        attr->type = PERF_TYPE_TRACEPOINT;
+        *strp = evt_name + evt_length;
+        return 1;
+}
+
 static int check_events(const char *str, unsigned int i)
 {
         int n;
@@ -374,7 +509,8 @@ parse_event_modifier(const char **strp, struct perf_counter_attr *attr)
  */
 static int parse_event_symbols(const char **str, struct perf_counter_attr *attr)
 {
-        if (!(parse_raw_event(str, attr) ||
+        if (!(parse_tracepoint_event(str, attr) ||
+              parse_raw_event(str, attr) ||
               parse_numeric_event(str, attr) ||
               parse_symbolic_event(str, attr) ||
               parse_generic_hw_event(str, attr)))
@@ -423,6 +559,42 @@ static const char * const event_type_descriptors[] = {
 };
 
 /*
+ * Print the events from <debugfs_mount_point>/tracing/events
+ */
+
+static void print_tracepoint_events(void)
+{
+        DIR *sys_dir, *evt_dir;
+        struct dirent *sys_next, *evt_next, sys_dirent, evt_dirent;
+        struct stat st;
+        char evt_path[MAXPATHLEN];
+
+        if (valid_debugfs_mount(debugfs_path))
+                return;
+
+        sys_dir = opendir(debugfs_path);
+        if (!sys_dir)
+                goto cleanup;
+
+        for_each_subsystem(sys_dir, sys_dirent, sys_next, evt_path, st) {
+                evt_dir = opendir(evt_path);
+                if (!evt_dir)
+                        goto cleanup;
+                for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next,
+                                                                evt_path, st) {
+                        snprintf(evt_path, MAXPATHLEN, "%s:%s",
+                                 sys_dirent.d_name, evt_dirent.d_name);
+                        fprintf(stderr, "  %-40s [%s]\n", evt_path,
+                                event_type_descriptors[PERF_TYPE_TRACEPOINT+1]);
+                }
+                closedir(evt_dir);
+        }
+
+cleanup:
+        closedir(sys_dir);
+}
+
+/*
  * Print the help text for the event symbols:
  */
 void print_events(void)
@@ -436,7 +608,7 @@ void print_events(void)
 
         for (i = 0; i < ARRAY_SIZE(event_symbols); i++, syms++) {
                 type = syms->type + 1;
-                if (type > ARRAY_SIZE(event_type_descriptors))
+                if (type >= ARRAY_SIZE(event_type_descriptors))
                         type = 0;
 
                 if (type != prev_type)
@@ -472,5 +644,7 @@ void print_events(void)
                 "rNNN");
         fprintf(stderr, "\n");
 
+        print_tracepoint_events();
+
         exit(129);
 }
diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
index e3d552908e60..1ea5d09b6eb1 100644
--- a/tools/perf/util/parse-events.h
+++ b/tools/perf/util/parse-events.h
@@ -3,6 +3,8 @@
  * Parse symbolic events/counts passed in as options:
  */
 
+struct option;
+
 extern int                      nr_counters;
 
 extern struct perf_counter_attr attrs[MAX_COUNTERS];
@@ -15,3 +17,6 @@ extern int parse_events(const struct option *opt, const char *str, int unset);
 
 extern void print_events(void);
 
+extern char debugfs_path[];
+extern int valid_debugfs_mount(const char *debugfs);
+
diff --git a/tools/perf/util/string.h b/tools/perf/util/string.h
index 3dca2f654cd0..bf39dfadfd24 100644
--- a/tools/perf/util/string.h
+++ b/tools/perf/util/string.h
@@ -5,4 +5,7 @@
 
 int hex2u64(const char *ptr, u64 *val);
 
+#define _STR(x) #x
+#define STR(x) _STR(x)
+
 #endif
diff --git a/tools/perf/util/strlist.c b/tools/perf/util/strlist.c
index 025a78edfffe..7ad38171dc2b 100644
--- a/tools/perf/util/strlist.c
+++ b/tools/perf/util/strlist.c
@@ -64,6 +64,7 @@ int strlist__add(struct strlist *self, const char *new_entry)
 
         rb_link_node(&sn->rb_node, parent, p);
         rb_insert_color(&sn->rb_node, &self->entries);
+        ++self->nr_entries;
 
         return 0;
 }
@@ -155,8 +156,9 @@ struct strlist *strlist__new(bool dupstr, const char *slist)
         struct strlist *self = malloc(sizeof(*self));
 
         if (self != NULL) {
-                self->entries = RB_ROOT;
-                self->dupstr = dupstr;
+                self->entries    = RB_ROOT;
+                self->dupstr     = dupstr;
+                self->nr_entries = 0;
                 if (slist && strlist__parse_list(self, slist) != 0)
                         goto out_error;
         }
@@ -182,3 +184,17 @@ void strlist__delete(struct strlist *self)
                 free(self);
         }
 }
+
+struct str_node *strlist__entry(const struct strlist *self, unsigned int idx)
+{
+        struct rb_node *nd;
+
+        for (nd = rb_first(&self->entries); nd; nd = rb_next(nd)) {
+                struct str_node *pos = rb_entry(nd, struct str_node, rb_node);
+
+                if (!idx--)
+                        return pos;
+        }
+
+        return NULL;
+}
diff --git a/tools/perf/util/strlist.h b/tools/perf/util/strlist.h
index 2fdcfee87586..921818e44a54 100644
--- a/tools/perf/util/strlist.h
+++ b/tools/perf/util/strlist.h
@@ -11,7 +11,8 @@ struct str_node {
 
 struct strlist {
         struct rb_root entries;
-        bool dupstr;
+        unsigned int   nr_entries;
+        bool           dupstr;
 };
 
 struct strlist *strlist__new(bool dupstr, const char *slist);
@@ -21,11 +22,17 @@ void strlist__remove(struct strlist *self, struct str_node *sn);
 int strlist__load(struct strlist *self, const char *filename);
 int strlist__add(struct strlist *self, const char *str);
 
+struct str_node *strlist__entry(const struct strlist *self, unsigned int idx);
 bool strlist__has_entry(struct strlist *self, const char *entry);
 
 static inline bool strlist__empty(const struct strlist *self)
 {
-        return rb_first(&self->entries) == NULL;
+        return self->nr_entries == 0;
+}
+
+static inline unsigned int strlist__nr_entries(const struct strlist *self)
+{
+        return self->nr_entries;
 }
 
 int strlist__parse_list(struct strlist *self, const char *s);
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 4683b67b5ee4..28106059bf12 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -6,9 +6,15 @@
 #include <libelf.h>
 #include <gelf.h>
 #include <elf.h>
+#include <bfd.h>
 
 const char *sym_hist_filter;
 
+#ifndef DMGL_PARAMS
+#define DMGL_PARAMS      (1 << 0)       /* Include function args */
+#define DMGL_ANSI        (1 << 1)       /* Include const, volatile, etc */
+#endif
+
 static struct symbol *symbol__new(u64 start, u64 len,
                                   const char *name, unsigned int priv_size,
                                   u64 obj_start, int verbose)
@@ -65,6 +71,7 @@ struct dso *dso__new(const char *name, unsigned int sym_priv_size)
                 self->syms = RB_ROOT;
                 self->sym_priv_size = sym_priv_size;
                 self->find_symbol = dso__find_symbol;
+                self->slen_calculated = 0;
         }
 
         return self;
@@ -373,36 +380,61 @@ static Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
              idx < nr_entries; \
              ++idx, pos = gelf_getrela(reldata, idx, &pos_mem))
 
-static int dso__synthesize_plt_symbols(struct  dso *self, Elf *elf,
-                                       GElf_Ehdr *ehdr, Elf_Scn *scn_dynsym,
-                                       GElf_Shdr *shdr_dynsym,
-                                       size_t dynsym_idx, int verbose)
+/*
+ * We need to check if we have a .dynsym, so that we can handle the
+ * .plt, synthesizing its symbols, that aren't on the symtabs (be it
+ * .dynsym or .symtab).
+ * And always look at the original dso, not at debuginfo packages, that
+ * have the PLT data stripped out (shdr_rel_plt.sh_type == SHT_NOBITS).
+ */
+static int dso__synthesize_plt_symbols(struct  dso *self, int verbose)
 {
         uint32_t nr_rel_entries, idx;
         GElf_Sym sym;
         u64 plt_offset;
         GElf_Shdr shdr_plt;
         struct symbol *f;
-        GElf_Shdr shdr_rel_plt;
+        GElf_Shdr shdr_rel_plt, shdr_dynsym;
         Elf_Data *reldata, *syms, *symstrs;
-        Elf_Scn *scn_plt_rel, *scn_symstrs;
+        Elf_Scn *scn_plt_rel, *scn_symstrs, *scn_dynsym;
+        size_t dynsym_idx;
+        GElf_Ehdr ehdr;
         char sympltname[1024];
-        int nr = 0, symidx;
+        Elf *elf;
+        int nr = 0, symidx, fd, err = 0;
+
+        fd = open(self->name, O_RDONLY);
+        if (fd < 0)
+                goto out;
+
+        elf = elf_begin(fd, ELF_C_READ_MMAP, NULL);
+        if (elf == NULL)
+                goto out_close;
+
+        if (gelf_getehdr(elf, &ehdr) == NULL)
+                goto out_elf_end;
+
+        scn_dynsym = elf_section_by_name(elf, &ehdr, &shdr_dynsym,
+                                         ".dynsym", &dynsym_idx);
+        if (scn_dynsym == NULL)
+                goto out_elf_end;
 
-        scn_plt_rel = elf_section_by_name(elf, ehdr, &shdr_rel_plt,
+        scn_plt_rel = elf_section_by_name(elf, &ehdr, &shdr_rel_plt,
                                           ".rela.plt", NULL);
         if (scn_plt_rel == NULL) {
-                scn_plt_rel = elf_section_by_name(elf, ehdr, &shdr_rel_plt,
+                scn_plt_rel = elf_section_by_name(elf, &ehdr, &shdr_rel_plt,
                                                   ".rel.plt", NULL);
                 if (scn_plt_rel == NULL)
-                        return 0;
+                        goto out_elf_end;
         }
 
+        err = -1;
+
         if (shdr_rel_plt.sh_link != dynsym_idx)
-                return 0;
+                goto out_elf_end;
 
-        if (elf_section_by_name(elf, ehdr, &shdr_plt, ".plt", NULL) == NULL)
-                return 0;
+        if (elf_section_by_name(elf, &ehdr, &shdr_plt, ".plt", NULL) == NULL)
+                goto out_elf_end;
 
         /*
          * Fetch the relocation section to find the indexes to the GOT
@@ -410,19 +442,19 @@ static int dso__synthesize_plt_symbols(struct  dso *self, Elf *elf,
          */
         reldata = elf_getdata(scn_plt_rel, NULL);
         if (reldata == NULL)
-                return -1;
+                goto out_elf_end;
 
         syms = elf_getdata(scn_dynsym, NULL);
         if (syms == NULL)
-                return -1;
+                goto out_elf_end;
 
-        scn_symstrs = elf_getscn(elf, shdr_dynsym->sh_link);
+        scn_symstrs = elf_getscn(elf, shdr_dynsym.sh_link);
         if (scn_symstrs == NULL)
-                return -1;
+                goto out_elf_end;
 
         symstrs = elf_getdata(scn_symstrs, NULL);
         if (symstrs == NULL)
-                return -1;
+                goto out_elf_end;
 
         nr_rel_entries = shdr_rel_plt.sh_size / shdr_rel_plt.sh_entsize;
         plt_offset = shdr_plt.sh_offset;
@@ -441,7 +473,7 @@ static int dso__synthesize_plt_symbols(struct  dso *self, Elf *elf,
                         f = symbol__new(plt_offset, shdr_plt.sh_entsize,
                                         sympltname, self->sym_priv_size, 0, verbose);
                         if (!f)
-                                return -1;
+                                goto out_elf_end;
 
                         dso__insert_symbol(self, f);
                         ++nr;
@@ -459,19 +491,25 @@ static int dso__synthesize_plt_symbols(struct  dso *self, Elf *elf,
                         f = symbol__new(plt_offset, shdr_plt.sh_entsize,
                                         sympltname, self->sym_priv_size, 0, verbose);
                         if (!f)
-                                return -1;
+                                goto out_elf_end;
 
                         dso__insert_symbol(self, f);
                         ++nr;
                 }
-        } else {
-                /*
-                 * TODO: There are still one more shdr_rel_plt.sh_type
-                 * I have to investigate, but probably should be ignored.
-                 */
         }
 
-        return nr;
+        err = 0;
+out_elf_end:
+        elf_end(elf);
+out_close:
+        close(fd);
+
+        if (err == 0)
+                return nr;
+out:
+        fprintf(stderr, "%s: problems reading %s PLT info.\n",
+                __func__, self->name);
+        return 0;
 }
 
 static int dso__load_sym(struct dso *self, int fd, const char *name,
@@ -485,10 +523,9 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
         GElf_Shdr shdr;
         Elf_Data *syms;
         GElf_Sym sym;
-        Elf_Scn *sec, *sec_dynsym, *sec_strndx;
+        Elf_Scn *sec, *sec_strndx;
         Elf *elf;
-        size_t dynsym_idx;
-        int nr = 0;
+        int nr = 0, kernel = !strcmp("[kernel]", self->name);
 
         elf = elf_begin(fd, ELF_C_READ_MMAP, NULL);
         if (elf == NULL) {
@@ -504,32 +541,11 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
                 goto out_elf_end;
         }
 
-        /*
-         * We need to check if we have a .dynsym, so that we can handle the
-         * .plt, synthesizing its symbols, that aren't on the symtabs (be it
-         * .dynsym or .symtab)
-         */
-        sec_dynsym = elf_section_by_name(elf, &ehdr, &shdr,
-                                         ".dynsym", &dynsym_idx);
-        if (sec_dynsym != NULL) {
-                nr = dso__synthesize_plt_symbols(self, elf, &ehdr,
-                                                 sec_dynsym, &shdr,
-                                                 dynsym_idx, verbose);
-                if (nr < 0)
-                        goto out_elf_end;
-        }
-
-        /*
-         * But if we have a full .symtab (that is a superset of .dynsym) we
-         * should add the symbols not in the .dynsyn
-         */
         sec = elf_section_by_name(elf, &ehdr, &shdr, ".symtab", NULL);
         if (sec == NULL) {
-                if (sec_dynsym == NULL)
+                sec = elf_section_by_name(elf, &ehdr, &shdr, ".dynsym", NULL);
+                if (sec == NULL)
                         goto out_elf_end;
-
-                sec = sec_dynsym;
-                gelf_getshdr(sec, &shdr);
         }
 
         syms = elf_getdata(sec, NULL);
@@ -555,12 +571,17 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
         nr_syms = shdr.sh_size / shdr.sh_entsize;
 
         memset(&sym, 0, sizeof(sym));
-        self->adjust_symbols = (ehdr.e_type == ET_EXEC ||
+        if (!kernel) {
+                self->adjust_symbols = (ehdr.e_type == ET_EXEC ||
                                 elf_section_by_name(elf, &ehdr, &shdr,
                                                      ".gnu.prelink_undo",
                                                      NULL) != NULL);
+        } else self->adjust_symbols = 0;
+
         elf_symtab__for_each_symbol(syms, nr_syms, index, sym) {
                 struct symbol *f;
+                const char *name;
+                char *demangled;
                 u64 obj_start;
                 struct section *section = NULL;
                 int is_label = elf_sym__is_label(&sym);
@@ -599,10 +620,19 @@ static int dso__load_sym(struct dso *self, int fd, const char *name,
                                 goto out_elf_end;
                         }
                 }
+                /*
+                 * We need to figure out if the object was created from C++ sources
+                 * DWARF DW_compile_unit has this, but we don't always have access
+                 * to it...
+                 */
+                name = elf_sym__name(&sym, symstrs);
+                demangled = bfd_demangle(NULL, name, DMGL_PARAMS | DMGL_ANSI);
+                if (demangled != NULL)
+                        name = demangled;
 
-                f = symbol__new(sym.st_value, sym.st_size,
-                                elf_sym__name(&sym, symstrs),
+                f = symbol__new(sym.st_value, sym.st_size, name,
                                 self->sym_priv_size, obj_start, verbose);
+                free(demangled);
                 if (!f)
                         goto out_elf_end;
 
@@ -668,6 +698,11 @@ more:
         if (!ret)
                 goto more;
 
+        if (ret > 0) {
+                int nr_plt = dso__synthesize_plt_symbols(self, verbose);
+                if (nr_plt > 0)
+                        ret += nr_plt;
+        }
 out:
         free(name);
         return ret;
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 7918cffb23cd..2f92b21c712d 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -25,6 +25,7 @@ struct dso {
         struct symbol    *(*find_symbol)(struct dso *, u64 ip);
         unsigned int     sym_priv_size;
         unsigned char    adjust_symbols;
+        unsigned char    slen_calculated;
         char             name[0];
 };
 
diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h
index b4be6071c105..68fe157d72fb 100644
--- a/tools/perf/util/util.h
+++ b/tools/perf/util/util.h
@@ -50,6 +50,7 @@
 #include <unistd.h>
 #include <stdio.h>
 #include <sys/stat.h>
+#include <sys/statfs.h>
 #include <fcntl.h>
 #include <stddef.h>
 #include <stdlib.h>
@@ -80,6 +81,7 @@
 #include <netdb.h>
 #include <pwd.h>
 #include <inttypes.h>
+#include "../../../include/linux/magic.h"
 
 #ifndef NO_ICONV
 #include <iconv.h>