713 files changed, 6461 insertions, 4151 deletions
diff --git a/Documentation/ABI/testing/sysfs-class-scsi_host b/Documentation/ABI/testing/sysfs-class-scsi_host
new file mode 100644
index 000000000000..29a4f892e433
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-class-scsi_host
@@ -0,0 +1,13 @@
+What:           /sys/class/scsi_host/hostX/isci_id
+Date:           June 2011
+Contact:        Dave Jiang <dave.jiang@intel.com>
+Description:
+                This file contains the enumerated host ID for the Intel
+                SCU controller. The Intel(R) C600 Series Chipset SATA/SAS
+                Storage Control Unit embeds up to two 4-port controllers in
+                a single PCI device.  The controllers are enumerated in order
+                which usually means the lowest number scsi_host corresponds
+                with the first controller, but this association is not
+                guaranteed.  The 'isci_id' attribute unambiguously identifies
+                the controller index: '0' for the first controller,
+                '1' for the second.
diff --git a/Documentation/DocBook/media/v4l/controls.xml b/Documentation/DocBook/media/v4l/controls.xml
index 85164016ed26..23fdf79f8cf3 100644
--- a/Documentation/DocBook/media/v4l/controls.xml
+++ b/Documentation/DocBook/media/v4l/controls.xml
@@ -1455,7 +1455,7 @@ Applicable to the H264 encoder.</entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-video-h264-vui-sar-idc">
                <entry spanname="id"><constant>V4L2_CID_MPEG_VIDEO_H264_VUI_SAR_IDC</constant>&nbsp;</entry>
                <entry>enum&nbsp;v4l2_mpeg_video_h264_vui_sar_idc</entry>
              </row>
@@ -1561,7 +1561,7 @@ Applicable to the H264 encoder.</entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-video-h264-level">
                <entry spanname="id"><constant>V4L2_CID_MPEG_VIDEO_H264_LEVEL</constant>&nbsp;</entry>
                <entry>enum&nbsp;v4l2_mpeg_video_h264_level</entry>
              </row>
@@ -1641,7 +1641,7 @@ Possible values are:</entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-video-mpeg4-level">
                <entry spanname="id"><constant>V4L2_CID_MPEG_VIDEO_MPEG4_LEVEL</constant>&nbsp;</entry>
                <entry>enum&nbsp;v4l2_mpeg_video_mpeg4_level</entry>
              </row>
@@ -1689,9 +1689,9 @@ Possible values are:</entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-video-h264-profile">
                <entry spanname="id"><constant>V4L2_CID_MPEG_VIDEO_H264_PROFILE</constant>&nbsp;</entry>
-                <entry>enum&nbsp;v4l2_mpeg_h264_profile</entry>
+                <entry>enum&nbsp;v4l2_mpeg_video_h264_profile</entry>
              </row>
              <row><entry spanname="descr">The profile information for H264.
 Applicable to the H264 encoder.
@@ -1774,9 +1774,9 @@ Possible values are:</entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-video-mpeg4-profile">
                <entry spanname="id"><constant>V4L2_CID_MPEG_VIDEO_MPEG4_PROFILE</constant>&nbsp;</entry>
-                <entry>enum&nbsp;v4l2_mpeg_mpeg4_profile</entry>
+                <entry>enum&nbsp;v4l2_mpeg_video_mpeg4_profile</entry>
              </row>
              <row><entry spanname="descr">The profile information for MPEG4.
 Applicable to the MPEG4 encoder.
@@ -1820,9 +1820,9 @@ Applicable to the encoder.
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-video-multi-slice-mode">
                <entry spanname="id"><constant>V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE</constant>&nbsp;</entry>
-                <entry>enum&nbsp;v4l2_mpeg_multi_slice_mode</entry>
+                <entry>enum&nbsp;v4l2_mpeg_video_multi_slice_mode</entry>
              </row>
              <row><entry spanname="descr">Determines how the encoder should handle division of frame into slices.
 Applicable to the encoder.
@@ -1868,9 +1868,9 @@ Applicable to the encoder.</entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-video-h264-loop-filter-mode">
                <entry spanname="id"><constant>V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE</constant>&nbsp;</entry>
-                <entry>enum&nbsp;v4l2_mpeg_h264_loop_filter_mode</entry>
+                <entry>enum&nbsp;v4l2_mpeg_video_h264_loop_filter_mode</entry>
              </row>
              <row><entry spanname="descr">Loop filter mode for H264 encoder.
 Possible values are:</entry>
@@ -1913,9 +1913,9 @@ Applicable to the H264 encoder.</entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-video-h264-entropy-mode">
                <entry spanname="id"><constant>V4L2_CID_MPEG_VIDEO_H264_ENTROPY_MODE</constant>&nbsp;</entry>
-                <entry>enum&nbsp;v4l2_mpeg_h264_symbol_mode</entry>
+                <entry>enum&nbsp;v4l2_mpeg_video_h264_entropy_mode</entry>
              </row>
              <row><entry spanname="descr">Entropy coding mode for H264 - CABAC/CAVALC.
 Applicable to the H264 encoder.
@@ -2140,9 +2140,9 @@ previous frames. Applicable to the H264 encoder.</entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-video-header-mode">
                <entry spanname="id"><constant>V4L2_CID_MPEG_VIDEO_HEADER_MODE</constant>&nbsp;</entry>
-                <entry>enum&nbsp;v4l2_mpeg_header_mode</entry>
+                <entry>enum&nbsp;v4l2_mpeg_video_header_mode</entry>
              </row>
              <row><entry spanname="descr">Determines whether the header is returned as the first buffer or is
 it returned together with the first frame. Applicable to encoders.
@@ -2320,9 +2320,9 @@ Valid only when H.264 and macroblock level RC is enabled (<constant>V4L2_CID_MPE
 Applicable to the H264 encoder.</entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-mfc51-video-frame-skip-mode">
                <entry spanname="id"><constant>V4L2_CID_MPEG_MFC51_VIDEO_FRAME_SKIP_MODE</constant>&nbsp;</entry>
-                <entry>enum&nbsp;v4l2_mpeg_mfc51_frame_skip_mode</entry>
+                <entry>enum&nbsp;v4l2_mpeg_mfc51_video_frame_skip_mode</entry>
              </row>
              <row><entry spanname="descr">
 Indicates in what conditions the encoder should skip frames. If encoding a frame would cause the encoded stream to be larger then
@@ -2361,9 +2361,9 @@ the stream will meet tight bandwidth contraints. Applicable to encoders.
 </entry>
              </row>
              <row><entry></entry></row>
-              <row>
+              <row id="v4l2-mpeg-mfc51-video-force-frame-type">
                <entry spanname="id"><constant>V4L2_CID_MPEG_MFC51_VIDEO_FORCE_FRAME_TYPE</constant>&nbsp;</entry>
-                <entry>enum&nbsp;v4l2_mpeg_mfc51_force_frame_type</entry>
+                <entry>enum&nbsp;v4l2_mpeg_mfc51_video_force_frame_type</entry>
              </row>
              <row><entry spanname="descr">Force a frame type for the next queued buffer. Applicable to encoders.
 Possible values are:</entry>
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index 6f3c598971fc..06eb6d957c83 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -380,7 +380,7 @@ will be charged as a new owner of it.
 5.2 stat file
-5.2.1 memory.stat file includes following statistics
+memory.stat file includes following statistics
 # per-memory cgroup local status
 cache           - # of bytes of page cache memory.
@@ -438,89 +438,6 @@ Note:
         file_mapped is accounted only when the memory cgroup is owner of page
         cache.)
-5.2.2 memory.vmscan_stat
-memory.vmscan_stat includes statistics information for memory scanning and
-freeing, reclaiming. The statistics shows memory scanning information since
-memory cgroup creation and can be reset to 0 by writing 0 as
- #echo 0 > ../memory.vmscan_stat
-This file contains following statistics.
-[param]_[file_or_anon]_pages_by_[reason]_[under_heararchy]
-[param]_elapsed_ns_by_[reason]_[under_hierarchy]
-For example,
-  scanned_file_pages_by_limit indicates the number of scanned
-  file pages at vmscan.
-Now, 3 parameters are supported
-  scanned - the number of pages scanned by vmscan
-  rotated - the number of pages activated at vmscan
-  freed   - the number of pages freed by vmscan
-If "rotated" is high against scanned/freed, the memcg seems busy.
-Now, 2 reason are supported
-  limit - the memory cgroup's limit
-  system - global memory pressure + softlimit
-           (global memory pressure not under softlimit is not handled now)
-When under_hierarchy is added in the tail, the number indicates the
-total memcg scan of its children and itself.
-elapsed_ns is a elapsed time in nanosecond. This may include sleep time
-and not indicates CPU usage. So, please take this as just showing
-latency.
-Here is an example.
-# cat /cgroup/memory/A/memory.vmscan_stat
-scanned_pages_by_limit 9471864
-scanned_anon_pages_by_limit 6640629
-scanned_file_pages_by_limit 2831235
-rotated_pages_by_limit 4243974
-rotated_anon_pages_by_limit 3971968
-rotated_file_pages_by_limit 272006
-freed_pages_by_limit 2318492
-freed_anon_pages_by_limit 962052
-freed_file_pages_by_limit 1356440
-elapsed_ns_by_limit 351386416101
-scanned_pages_by_system 0
-scanned_anon_pages_by_system 0
-scanned_file_pages_by_system 0
-rotated_pages_by_system 0
-rotated_anon_pages_by_system 0
-rotated_file_pages_by_system 0
-freed_pages_by_system 0
-freed_anon_pages_by_system 0
-freed_file_pages_by_system 0
-elapsed_ns_by_system 0
-scanned_pages_by_limit_under_hierarchy 9471864
-scanned_anon_pages_by_limit_under_hierarchy 6640629
-scanned_file_pages_by_limit_under_hierarchy 2831235
-rotated_pages_by_limit_under_hierarchy 4243974
-rotated_anon_pages_by_limit_under_hierarchy 3971968
-rotated_file_pages_by_limit_under_hierarchy 272006
-freed_pages_by_limit_under_hierarchy 2318492
-freed_anon_pages_by_limit_under_hierarchy 962052
-freed_file_pages_by_limit_under_hierarchy 1356440
-elapsed_ns_by_limit_under_hierarchy 351386416101
-scanned_pages_by_system_under_hierarchy 0
-scanned_anon_pages_by_system_under_hierarchy 0
-scanned_file_pages_by_system_under_hierarchy 0
-rotated_pages_by_system_under_hierarchy 0
-rotated_anon_pages_by_system_under_hierarchy 0
-rotated_file_pages_by_system_under_hierarchy 0
-freed_pages_by_system_under_hierarchy 0
-freed_anon_pages_by_system_under_hierarchy 0
-freed_file_pages_by_system_under_hierarchy 0
-elapsed_ns_by_system_under_hierarchy 0
 5.3 swappiness
 Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only.
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index c4a6e148732a..4dc465477665 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -592,3 +592,11 @@ Why:    In 3.0, we can now autodetect internal 3G device and already have
        interface that was used by acer-wmi driver. It will replaced by
        information log when acer-wmi initial.
 Who:    Lee, Chun-Yi <jlee@novell.com>
+----------------------------
+What:   The XFS nodelaylog mount option
+When:   3.3
+Why:    The delaylog mode that has been the default since 2.6.39 has proven
+        stable, and the old code is in the way of additional improvements in
+        the log code.
+Who:    Christoph Hellwig <hch@lst.de>
diff --git a/Documentation/hwmon/max16065 b/Documentation/hwmon/max16065
index 44b4f61e04f9..c11f64a1f2ad 100644
--- a/Documentation/hwmon/max16065
+++ b/Documentation/hwmon/max16065
@@ -62,6 +62,13 @@ can be safely used to identify the chip. You will have to instantiate
 the devices explicitly. Please see Documentation/i2c/instantiating-devices for
 details.
+WARNING: Do not access chip registers using the i2cdump command, and do not use
+any of the i2ctools commands on a command register (0xa5 to 0xac). The chips
+supported by this driver interpret any access to a command register (including
+read commands) as request to execute the command in question. This may result in
+power loss, board resets, and/or Flash corruption. Worst case, your board may
+turn into a brick.
 Sysfs entries
 -------------
diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
index 845a191004b1..54078ed96b37 100644
--- a/Documentation/ioctl/ioctl-number.txt
+++ b/Documentation/ioctl/ioctl-number.txt
@@ -319,4 +319,6 @@ Code  Seq#(hex)	Include File		Comments
                                        <mailto:thomas@winischhofer.net>
 0xF4    00-1F   video/mbxfb.h           mbxfb
                                        <mailto:raph@8d.com>
+0xF6    all     LTTng                   Linux Trace Toolkit Next Generation
+                                        <mailto:mathieu.desnoyers@efficios.com>
 0xFD    all     linux/dm-ioctl.h
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 614d0382e2cb..854ed5ca7e3f 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2086,9 +2086,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        Override pmtimer IOPort with a hex value.
                        e.g. pmtmr=0x508
-        pnp.debug       [PNP]
+        pnp.debug=1     [PNP]
-                        Enable PNP debug messages.  This depends on the
+                        Enable PNP debug messages (depends on the
-                        CONFIG_PNP_DEBUG_MESSAGES option.
+                        CONFIG_PNP_DEBUG_MESSAGES option).  Change at run-time
+                        via /sys/module/pnp/parameters/debug.  We always show
+                        current resource usage; turning this on also shows
+                        possible settings and some assignment information.
        pnpacpi=        [ACPI]
                        { off }
diff --git a/Documentation/networking/dmfe.txt b/Documentation/networking/dmfe.txt
index 8006c227fda2..25320bf19c86 100644
--- a/Documentation/networking/dmfe.txt
+++ b/Documentation/networking/dmfe.txt
@@ -1,3 +1,5 @@
+Note: This driver doesn't have a maintainer.
 Davicom DM9102(A)/DM9132/DM9801 fast ethernet driver for Linux.
 This program is free software; you can redistribute it and/or
@@ -55,7 +57,6 @@ Test and make sure PCI latency is now correct for all cases.
 Authors:
 Sten Wang <sten_wang@davicom.com.tw >   : Original Author
-Tobias Ringstrom <tori@unhappy.mine.nu> : Current Maintainer
 Contributors:
diff --git a/Documentation/vm/transhuge.txt b/Documentation/vm/transhuge.txt
index 0924aaca3302..29bdf62aac09 100644
--- a/Documentation/vm/transhuge.txt
+++ b/Documentation/vm/transhuge.txt
@@ -123,10 +123,11 @@ be automatically shutdown if it's set to "never".
 khugepaged runs usually at low frequency so while one may not want to
 invoke defrag algorithms synchronously during the page faults, it
 should be worth invoking defrag at least in khugepaged. However it's
-also possible to disable defrag in khugepaged:
+also possible to disable defrag in khugepaged by writing 0 or enable
+defrag in khugepaged by writing 1:
-echo yes >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
+echo 0 >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
-echo no >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
+echo 1 >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
 You can also control how many pages khugepaged should scan at each
 pass:
diff --git a/MAINTAINERS b/MAINTAINERS
index 069ee3b5c651..ae8820e173a2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1278,7 +1278,6 @@ F:	drivers/input/misc/ati_remote2.c
 ATLX ETHERNET DRIVERS
 M:      Jay Cliburn <jcliburn@gmail.com>
 M:      Chris Snook <chris.snook@gmail.com>
-M:      Jie Yang <jie.yang@atheros.com>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/atl1
 W:      http://atl1.sourceforge.net
@@ -1574,7 +1573,6 @@ F:	drivers/scsi/bfa/
 BROCADE BNA 10 GIGABIT ETHERNET DRIVER
 M:      Rasesh Mody <rmody@brocade.com>
-M:      Debashis Dutt <ddutt@brocade.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/bna/
@@ -1758,7 +1756,6 @@ F:	Documentation/zh_CN/
 CISCO VIC ETHERNET NIC DRIVER
 M:      Christian Benvenuti <benve@cisco.com>
-M:      Vasanthy Kolluri <vkolluri@cisco.com>
 M:      Roopa Prabhu <roprabhu@cisco.com>
 M:      David Wang <dwang2@cisco.com>
 S:      Supported
@@ -1883,7 +1880,7 @@ S:	Maintained
 F:      drivers/connector/
 CONTROL GROUPS (CGROUPS)
-M:      Paul Menage <menage@google.com>
+M:      Paul Menage <paul@paulmenage.org>
 M:      Li Zefan <lizf@cn.fujitsu.com>
 L:      containers@lists.linux-foundation.org
 S:      Maintained
@@ -1932,7 +1929,7 @@ S:	Maintained
 F:      tools/power/cpupower
 CPUSETS
-M:      Paul Menage <menage@google.com>
+M:      Paul Menage <paul@paulmenage.org>
 W:      http://www.bullopensource.org/cpuset/
 W:      http://oss.sgi.com/projects/cpusets/
 S:      Supported
@@ -2649,11 +2646,11 @@ F:	drivers/net/wan/dlci.c
 F:      drivers/net/wan/sdla.c
 FRAMEBUFFER LAYER
-M:      Paul Mundt <lethal@linux-sh.org>
+M:      Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
 L:      linux-fbdev@vger.kernel.org
 W:      http://linux-fbdev.sourceforge.net/
 Q:      http://patchwork.kernel.org/project/linux-fbdev/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6.git
+T:      git git://github.com/schandinat/linux-2.6.git fbdev-next
 S:      Maintained
 F:      Documentation/fb/
 F:      Documentation/devicetree/bindings/fb/
@@ -3262,6 +3259,17 @@ F:	Documentation/input/multi-touch-protocol.txt
 F:      drivers/input/input-mt.c
 K:      \b(ABS|SYN)_MT_
+INTEL C600 SERIES SAS CONTROLLER DRIVER
+M:      Intel SCU Linux support <intel-linux-scu@intel.com>
+M:      Dan Williams <dan.j.williams@intel.com>
+M:      Dave Jiang <dave.jiang@intel.com>
+M:      Ed Nadolski <edmund.nadolski@intel.com>
+L:      linux-scsi@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/djbw/isci.git
+S:      Maintained
+F:      drivers/scsi/isci/
+F:      firmware/isci/
 INTEL IDLE DRIVER
 M:      Len Brown <lenb@kernel.org>
 L:      linux-pm@lists.linux-foundation.org
@@ -4404,7 +4412,8 @@ L:	netfilter@vger.kernel.org
 L:      coreteam@netfilter.org
 W:      http://www.netfilter.org/
 W:      http://www.iptables.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next-2.6.git
 S:      Supported
 F:      include/linux/netfilter*
 F:      include/linux/netfilter/
@@ -4450,8 +4459,8 @@ M:	"David S. Miller" <davem@davemloft.net>
 L:      netdev@vger.kernel.org
 W:      http://www.linuxfoundation.org/en/Net
 W:      http://patchwork.ozlabs.org/project/netdev/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
 S:      Maintained
 F:      net/
 F:      include/net/
@@ -4774,7 +4783,7 @@ F:	drivers/net/wireless/orinoco/
 OSD LIBRARY and FILESYSTEM
 M:      Boaz Harrosh <bharrosh@panasas.com>
-M:      Benny Halevy <bhalevy@panasas.com>
+M:      Benny Halevy <bhalevy@tonian.com>
 L:      osd-dev@open-osd.org
 W:      http://open-osd.org
 T:      git git://git.open-osd.org/open-osd.git
@@ -5532,6 +5541,7 @@ F:	include/media/*7146*
 SAMSUNG AUDIO (ASoC) DRIVERS
 M:      Jassi Brar <jassisinghbrar@gmail.com>
+M:      Sangbeom Kim <sbkim73@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Supported
 F:      sound/soc/samsung
@@ -7087,7 +7097,7 @@ S:	Supported
 F:      drivers/mmc/host/vub300.c
 W1 DALLAS'S 1-WIRE BUS
-M:      Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+M:      Evgeniy Polyakov <zbr@ioremap.net>
 S:      Maintained
 F:      Documentation/w1/
 F:      drivers/w1/
@@ -7199,6 +7209,9 @@ W:	http://opensource.wolfsonmicro.com/content/linux-drivers-wolfson-devices
 S:      Supported
 F:      Documentation/hwmon/wm83??
 F:      drivers/leds/leds-wm83*.c
+F:      drivers/input/misc/wm831x-on.c
+F:      drivers/input/touchscreen/wm831x-ts.c
+F:      drivers/input/touchscreen/wm97*.c
 F:      drivers/mfd/wm8*.c
 F:      drivers/power/wm83*.c
 F:      drivers/rtc/rtc-wm83*.c
@@ -7208,6 +7221,7 @@ F:	drivers/watchdog/wm83*_wdt.c
 F:      include/linux/mfd/wm831x/
 F:      include/linux/mfd/wm8350/
 F:      include/linux/mfd/wm8400*
+F:      include/linux/wm97xx.h
 F:      include/sound/wm????.h
 F:      sound/soc/codecs/wm*
diff --git a/Makefile b/Makefile
index 788511f86a62..733dcba61f34 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc7
 NAME = "Divemaster Edition"
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 60cde53d266c..8bb936226dee 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -51,7 +51,7 @@ config GENERIC_CMOS_UPDATE
        def_bool y
 config GENERIC_GPIO
-        def_bool y
+        bool
 config ZONE_DMA
        bool
diff --git a/arch/alpha/include/asm/sysinfo.h b/arch/alpha/include/asm/sysinfo.h
index 086aba284df2..e77d77cd07b8 100644
--- a/arch/alpha/include/asm/sysinfo.h
+++ b/arch/alpha/include/asm/sysinfo.h
@@ -27,13 +27,4 @@
 #define UAC_NOFIX                       2
 #define UAC_SIGBUS                      4
-#ifdef __KERNEL__
-/* This is the shift that is applied to the UAC bits as stored in the
-   per-thread flags.  See thread_info.h.  */
-#define UAC_SHIFT                       6
-#endif
 #endif /* __ASM_ALPHA_SYSINFO_H */
diff --git a/arch/alpha/include/asm/thread_info.h b/arch/alpha/include/asm/thread_info.h
index 6f32f9c84a2d..ff73db022342 100644
--- a/arch/alpha/include/asm/thread_info.h
+++ b/arch/alpha/include/asm/thread_info.h
@@ -74,9 +74,9 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 #define TIF_POLLING_NRFLAG      8       /* poll_idle is polling NEED_RESCHED */
 #define TIF_DIE_IF_KERNEL       9       /* dik recursion lock */
-#define TIF_UAC_NOPRINT         10      /* see sysinfo.h */
+#define TIF_UAC_NOPRINT         10      /* ! Preserve sequence of following */
-#define TIF_UAC_NOFIX           11
+#define TIF_UAC_NOFIX           11      /* ! flags as they match            */
-#define TIF_UAC_SIGBUS          12
+#define TIF_UAC_SIGBUS          12      /* ! userspace part of 'osf_sysinfo' */
 #define TIF_MEMDIE              13      /* is terminating due to OOM killer */
 #define TIF_RESTORE_SIGMASK     14      /* restore signal mask in do_signal */
 #define TIF_FREEZE              16      /* is freezing for suspend */
@@ -97,7 +97,7 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define _TIF_ALLWORK_MASK       (_TIF_WORK_MASK         \
                                 | _TIF_SYSCALL_TRACE)
-#define ALPHA_UAC_SHIFT         10
+#define ALPHA_UAC_SHIFT         TIF_UAC_NOPRINT
 #define ALPHA_UAC_MASK          (1 << TIF_UAC_NOPRINT | 1 << TIF_UAC_NOFIX | \
                                 1 << TIF_UAC_SIGBUS)
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 326f0a2d56e5..01e8715e26d9 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -42,6 +42,7 @@
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <asm/sysinfo.h>
+#include <asm/thread_info.h>
 #include <asm/hwrpb.h>
 #include <asm/processor.h>
@@ -633,9 +634,10 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
        case GSI_UACPROC:
                if (nbytes < sizeof(unsigned int))
                        return -EINVAL;
-                w = (current_thread_info()->flags >> UAC_SHIFT) & UAC_BITMASK;
+                w = (current_thread_info()->flags >> ALPHA_UAC_SHIFT) &
-                if (put_user(w, (unsigned int __user *)buffer))
+                        UAC_BITMASK;
-                        return -EFAULT;
+                if (put_user(w, (unsigned int __user *)buffer))
+                        return -EFAULT;
                return 1;
        case GSI_PROC_TYPE:
@@ -756,8 +758,8 @@ SYSCALL_DEFINE5(osf_setsysinfo, unsigned long, op, void __user *, buffer,
                        case SSIN_UACPROC:
                        again:
                                old = current_thread_info()->flags;
-                                new = old & ~(UAC_BITMASK << UAC_SHIFT);
+                                new = old & ~(UAC_BITMASK << ALPHA_UAC_SHIFT);
-                                new = new | (w & UAC_BITMASK) << UAC_SHIFT;
+                                new = new | (w & UAC_BITMASK) << ALPHA_UAC_SHIFT;
                                if (cmpxchg(&current_thread_info()->flags,
                                            old, new) != old)
                                        goto again;
diff --git a/arch/alpha/kernel/systbls.S b/arch/alpha/kernel/systbls.S
index b9c28f3f1956..6acea1f96de3 100644
--- a/arch/alpha/kernel/systbls.S
+++ b/arch/alpha/kernel/systbls.S
@@ -360,7 +360,7 @@ sys_call_table:
        .quad sys_newuname
        .quad sys_nanosleep                     /* 340 */
        .quad sys_mremap
-        .quad sys_nfsservctl
+        .quad sys_ni_syscall                    /* old nfsservctl */
        .quad sys_setresuid
        .quad sys_getresuid
        .quad sys_pciconfig_read                /* 345 */
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 5ebc5d922ea1..3269576dbfa8 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1271,6 +1271,18 @@ config ARM_ERRATA_754327
          This workaround defines cpu_relax() as smp_mb(), preventing correctly
          written polling loops from denying visibility of updates to memory.
+config ARM_ERRATA_364296
+        bool "ARM errata: Possible cache data corruption with hit-under-miss enabled"
+        depends on CPU_V6 && !SMP
+        help
+          This options enables the workaround for the 364296 ARM1136
+          r0p2 erratum (possible cache data corruption with
+          hit-under-miss enabled). It sets the undocumented bit 31 in
+          the auxiliary control register and the FI bit in the control
+          register, thus disabling hit-under-miss without putting the
+          processor into full low interrupt latency mode. ARM11MPCore
+          is not affected.
 endmenu
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/boot/compressed/mmcif-sh7372.c b/arch/arm/boot/compressed/mmcif-sh7372.c
index b6f61d9a5a1b..672ae95db5c3 100644
--- a/arch/arm/boot/compressed/mmcif-sh7372.c
+++ b/arch/arm/boot/compressed/mmcif-sh7372.c
@@ -82,7 +82,7 @@ asmlinkage void mmc_loader(unsigned char *buf, unsigned long len)
        /* Disable clock to MMC hardware block */
-        __raw_writel(__raw_readl(SMSTPCR3) & (1 << 12), SMSTPCR3);
+        __raw_writel(__raw_readl(SMSTPCR3) | (1 << 12), SMSTPCR3);
        mmc_update_progress(MMC_PROGRESS_DONE);
 }
diff --git a/arch/arm/boot/compressed/sdhi-sh7372.c b/arch/arm/boot/compressed/sdhi-sh7372.c
index d403a8b24d7f..d279294f2381 100644
--- a/arch/arm/boot/compressed/sdhi-sh7372.c
+++ b/arch/arm/boot/compressed/sdhi-sh7372.c
@@ -85,7 +85,7 @@ asmlinkage void mmc_loader(unsigned short *buf, unsigned long len)
                goto err;
        /* Disable clock to SDHI1 hardware block */
-        __raw_writel(__raw_readl(SMSTPCR3) & (1 << 13), SMSTPCR3);
+        __raw_writel(__raw_readl(SMSTPCR3) | (1 << 13), SMSTPCR3);
        mmc_update_progress(MMC_PROGRESS_DONE);
diff --git a/arch/arm/boot/dts/tegra-harmony.dts b/arch/arm/boot/dts/tegra-harmony.dts
index 4c053340ce33..e5818668d091 100644
--- a/arch/arm/boot/dts/tegra-harmony.dts
+++ b/arch/arm/boot/dts/tegra-harmony.dts
@@ -57,14 +57,14 @@
        };
        sdhci@c8000200 {
-                gpios = <&gpio 69 0>, /* cd, gpio PI5 */
+                cd-gpios = <&gpio 69 0>; /* gpio PI5 */
-                        <&gpio 57 0>, /* wp, gpio PH1 */
+                wp-gpios = <&gpio 57 0>; /* gpio PH1 */
-                        <&gpio 155 0>; /* power, gpio PT3 */
+                power-gpios = <&gpio 155 0>; /* gpio PT3 */
        };
        sdhci@c8000600 {
-                gpios = <&gpio 58 0>, /* cd, gpio PH2 */
+                cd-gpios = <&gpio 58 0>; /* gpio PH2 */
-                        <&gpio 59 0>, /* wp, gpio PH3 */
+                wp-gpios = <&gpio 59 0>; /* gpio PH3 */
-                        <&gpio 70 0>; /* power, gpio PI6 */
+                power-gpios = <&gpio 70 0>; /* gpio PI6 */
        };
 };
diff --git a/arch/arm/boot/dts/tegra-seaboard.dts b/arch/arm/boot/dts/tegra-seaboard.dts
index 1940cae00748..64cedca6fc79 100644
--- a/arch/arm/boot/dts/tegra-seaboard.dts
+++ b/arch/arm/boot/dts/tegra-seaboard.dts
@@ -21,8 +21,8 @@
        };
        sdhci@c8000400 {
-                gpios = <&gpio 69 0>, /* cd, gpio PI5 */
+                cd-gpios = <&gpio 69 0>; /* gpio PI5 */
-                        <&gpio 57 0>, /* wp, gpio PH1 */
+                wp-gpios = <&gpio 57 0>; /* gpio PH1 */
-                        <&gpio 70 0>; /* power, gpio PI6 */
+                power-gpios = <&gpio 70 0>; /* gpio PI6 */
        };
 };
diff --git a/arch/arm/include/asm/hardware/cache-l2x0.h b/arch/arm/include/asm/hardware/cache-l2x0.h
index 16bd48031583..99a6ed7e1bfd 100644
--- a/arch/arm/include/asm/hardware/cache-l2x0.h
+++ b/arch/arm/include/asm/hardware/cache-l2x0.h
@@ -45,8 +45,13 @@
 #define L2X0_CLEAN_INV_LINE_PA          0x7F0
 #define L2X0_CLEAN_INV_LINE_IDX         0x7F8
 #define L2X0_CLEAN_INV_WAY              0x7FC
-#define L2X0_LOCKDOWN_WAY_D             0x900
+/*
-#define L2X0_LOCKDOWN_WAY_I             0x904
+ * The lockdown registers repeat 8 times for L310, the L210 has only one
+ * D and one I lockdown register at 0x0900 and 0x0904.
+ */
+#define L2X0_LOCKDOWN_WAY_D_BASE        0x900
+#define L2X0_LOCKDOWN_WAY_I_BASE        0x904
+#define L2X0_LOCKDOWN_STRIDE            0x08
 #define L2X0_TEST_OPERATION             0xF00
 #define L2X0_LINE_DATA                  0xF10
 #define L2X0_LINE_TAG                   0xF30
@@ -64,7 +69,7 @@
 #define L2X0_AUX_CTRL_MASK                      0xc0000fff
 #define L2X0_AUX_CTRL_ASSOCIATIVITY_SHIFT       16
 #define L2X0_AUX_CTRL_WAY_SIZE_SHIFT            17
-#define L2X0_AUX_CTRL_WAY_SIZE_MASK             (0x3 << 17)
+#define L2X0_AUX_CTRL_WAY_SIZE_MASK             (0x7 << 17)
 #define L2X0_AUX_CTRL_SHARE_OVERRIDE_SHIFT      22
 #define L2X0_AUX_CTRL_NS_LOCKDOWN_SHIFT         26
 #define L2X0_AUX_CTRL_NS_INT_CTRL_SHIFT         27
diff --git a/arch/arm/include/asm/pmu.h b/arch/arm/include/asm/pmu.h
index 67c70a31a1be..b7e82c4aced6 100644
--- a/arch/arm/include/asm/pmu.h
+++ b/arch/arm/include/asm/pmu.h
@@ -41,7 +41,7 @@ struct arm_pmu_platdata {
 * encoded error on failure.
 */
 extern struct platform_device *
-reserve_pmu(enum arm_pmu_type device);
+reserve_pmu(enum arm_pmu_type type);
 /**
 * release_pmu() - Relinquish control of the performance counters
@@ -62,26 +62,26 @@ release_pmu(enum arm_pmu_type type);
 * the actual hardware initialisation.
 */
 extern int
-init_pmu(enum arm_pmu_type device);
+init_pmu(enum arm_pmu_type type);
 #else /* CONFIG_CPU_HAS_PMU */
 #include <linux/err.h>
 static inline struct platform_device *
-reserve_pmu(enum arm_pmu_type device)
+reserve_pmu(enum arm_pmu_type type)
 {
        return ERR_PTR(-ENODEV);
 }
 static inline int
-release_pmu(struct platform_device *pdev)
+release_pmu(enum arm_pmu_type type)
 {
        return -ENODEV;
 }
 static inline int
-init_pmu(enum arm_pmu_type device)
+init_pmu(enum arm_pmu_type type)
 {
        return -ENODEV;
 }
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 80f7896cc016..9943e9e74a1b 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -178,7 +178,7 @@
                CALL(sys_ni_syscall)            /* vm86 */
                CALL(sys_ni_syscall)            /* was sys_query_module */
                CALL(sys_poll)
-                CALL(sys_nfsservctl)
+                CALL(sys_ni_syscall)            /* was nfsservctl */
 /* 170 */       CALL(sys_setresgid16)
                CALL(sys_getresgid16)
                CALL(sys_prctl)
diff --git a/arch/arm/kernel/pmu.c b/arch/arm/kernel/pmu.c
index 2b70709376c3..c53474fe84df 100644
--- a/arch/arm/kernel/pmu.c
+++ b/arch/arm/kernel/pmu.c
@@ -31,7 +31,7 @@ static int __devinit pmu_register(struct platform_device *pdev,
 {
        if (type < 0 || type >= ARM_NUM_PMU_DEVICES) {
                pr_warning("received registration request for unknown "
-                                "device %d\n", type);
+                                "PMU device type %d\n", type);
                return -EINVAL;
        }
@@ -112,17 +112,17 @@ static int __init register_pmu_driver(void)
 device_initcall(register_pmu_driver);
 struct platform_device *
-reserve_pmu(enum arm_pmu_type device)
+reserve_pmu(enum arm_pmu_type type)
 {
        struct platform_device *pdev;
-        if (test_and_set_bit_lock(device, &pmu_lock)) {
+        if (test_and_set_bit_lock(type, &pmu_lock)) {
                pdev = ERR_PTR(-EBUSY);
-        } else if (pmu_devices[device] == NULL) {
+        } else if (pmu_devices[type] == NULL) {
-                clear_bit_unlock(device, &pmu_lock);
+                clear_bit_unlock(type, &pmu_lock);
                pdev = ERR_PTR(-ENODEV);
        } else {
-                pdev = pmu_devices[device];
+                pdev = pmu_devices[type];
        }
        return pdev;
@@ -130,11 +130,11 @@ reserve_pmu(enum arm_pmu_type device)
 EXPORT_SYMBOL_GPL(reserve_pmu);
 int
-release_pmu(enum arm_pmu_type device)
+release_pmu(enum arm_pmu_type type)
 {
-        if (WARN_ON(!pmu_devices[device]))
+        if (WARN_ON(!pmu_devices[type]))
                return -EINVAL;
-        clear_bit_unlock(device, &pmu_lock);
+        clear_bit_unlock(type, &pmu_lock);
        return 0;
 }
 EXPORT_SYMBOL_GPL(release_pmu);
@@ -182,17 +182,17 @@ init_cpu_pmu(void)
 }
 int
-init_pmu(enum arm_pmu_type device)
+init_pmu(enum arm_pmu_type type)
 {
        int err = 0;
-        switch (device) {
+        switch (type) {
        case ARM_PMU_DEVICE_CPU:
                err = init_cpu_pmu();
                break;
        default:
-                pr_warning("attempt to initialise unknown device %d\n",
+                pr_warning("attempt to initialise PMU of unknown "
-                                device);
+                           "type %d\n", type);
                err = -EINVAL;
        }
diff --git a/arch/arm/kernel/relocate_kernel.S b/arch/arm/kernel/relocate_kernel.S
index 9cf4cbf8f95b..d0cdedf4864d 100644
--- a/arch/arm/kernel/relocate_kernel.S
+++ b/arch/arm/kernel/relocate_kernel.S
@@ -57,7 +57,8 @@ relocate_new_kernel:
        mov r0,#0
        ldr r1,kexec_mach_type
        ldr r2,kexec_boot_atags
-        mov pc,lr
+ ARM(   mov pc, lr      )
+ THUMB( bx lr           )
        .align
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 70bca649e925..e514c76043b4 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -280,18 +280,19 @@ static void __init cacheid_init(void)
        if (arch >= CPU_ARCH_ARMv6) {
                if ((cachetype & (7 << 29)) == 4 << 29) {
                        /* ARMv7 register format */
+                        arch = CPU_ARCH_ARMv7;
                        cacheid = CACHEID_VIPT_NONALIASING;
                        if ((cachetype & (3 << 14)) == 1 << 14)
                                cacheid |= CACHEID_ASID_TAGGED;
-                        else if (cpu_has_aliasing_icache(CPU_ARCH_ARMv7))
-                                cacheid |= CACHEID_VIPT_I_ALIASING;
-                } else if (cachetype & (1 << 23)) {
-                        cacheid = CACHEID_VIPT_ALIASING;
                } else {
-                        cacheid = CACHEID_VIPT_NONALIASING;
+                        arch = CPU_ARCH_ARMv6;
-                        if (cpu_has_aliasing_icache(CPU_ARCH_ARMv6))
+                        if (cachetype & (1 << 23))
-                                cacheid |= CACHEID_VIPT_I_ALIASING;
+                                cacheid = CACHEID_VIPT_ALIASING;
+                        else
+                                cacheid = CACHEID_VIPT_NONALIASING;
                }
+                if (cpu_has_aliasing_icache(arch))
+                        cacheid |= CACHEID_VIPT_I_ALIASING;
        } else {
                cacheid = CACHEID_VIVT;
        }
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index 2c277d40cee6..01c186222f3b 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -137,8 +137,8 @@ void __cpuinit twd_timer_setup(struct clock_event_device *clk)
        clk->max_delta_ns = clockevent_delta2ns(0xffffffff, clk);
        clk->min_delta_ns = clockevent_delta2ns(0xf, clk);
+        clockevents_register_device(clk);
        /* Make sure our local interrupt controller has this enabled */
        gic_enable_ppi(clk->irq);
-        clockevents_register_device(clk);
 }
diff --git a/arch/arm/mach-at91/at91sam9261.c b/arch/arm/mach-at91/at91sam9261.c
index d522b47e30b5..6c8e3b5f669f 100644
--- a/arch/arm/mach-at91/at91sam9261.c
+++ b/arch/arm/mach-at91/at91sam9261.c
@@ -157,7 +157,7 @@ static struct clk_lookup periph_clocks_lookups[] = {
        CLKDEV_CON_DEV_ID("spi_clk", "atmel_spi.1", &spi1_clk),
        CLKDEV_CON_DEV_ID("t0_clk", "atmel_tcb.0", &tc0_clk),
        CLKDEV_CON_DEV_ID("t1_clk", "atmel_tcb.0", &tc1_clk),
-        CLKDEV_CON_DEV_ID("t2_clk", "atmel_tcb.0", &tc1_clk),
+        CLKDEV_CON_DEV_ID("t2_clk", "atmel_tcb.0", &tc2_clk),
        CLKDEV_CON_DEV_ID("pclk", "ssc.0", &ssc0_clk),
        CLKDEV_CON_DEV_ID("pclk", "ssc.1", &ssc1_clk),
        CLKDEV_CON_DEV_ID("pclk", "ssc.2", &ssc2_clk),
diff --git a/arch/arm/mach-cns3xxx/include/mach/entry-macro.S b/arch/arm/mach-cns3xxx/include/mach/entry-macro.S
index 6bd83ed90afe..d87bfc397d39 100644
--- a/arch/arm/mach-cns3xxx/include/mach/entry-macro.S
+++ b/arch/arm/mach-cns3xxx/include/mach/entry-macro.S
@@ -8,7 +8,6 @@
 * published by the Free Software Foundation.
 */
-#include <mach/hardware.h>
 #include <asm/hardware/entry-macro-gic.S>
                .macro  disable_fiq
diff --git a/arch/arm/mach-cns3xxx/include/mach/system.h b/arch/arm/mach-cns3xxx/include/mach/system.h
index 58bb03ae3cf4..4f16c9b79f78 100644
--- a/arch/arm/mach-cns3xxx/include/mach/system.h
+++ b/arch/arm/mach-cns3xxx/include/mach/system.h
@@ -13,7 +13,6 @@
 #include <linux/io.h>
 #include <asm/proc-fns.h>
-#include <mach/hardware.h>
 static inline void arch_idle(void)
 {
diff --git a/arch/arm/mach-cns3xxx/include/mach/uncompress.h b/arch/arm/mach-cns3xxx/include/mach/uncompress.h
index de8ead9b91f7..a91b6058ab4f 100644
--- a/arch/arm/mach-cns3xxx/include/mach/uncompress.h
+++ b/arch/arm/mach-cns3xxx/include/mach/uncompress.h
@@ -8,7 +8,6 @@
 */
 #include <asm/mach-types.h>
-#include <mach/hardware.h>
 #include <mach/cns3xxx.h>
 #define AMBA_UART_DR(base)      (*(volatile unsigned char *)((base) + 0x00))
diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
index 06fd25d70aec..0f8fca48a5ed 100644
--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -49,7 +49,7 @@ static struct cns3xxx_pcie *sysdata_to_cnspci(void *sysdata)
        return &cns3xxx_pcie[root->domain];
 }
-static struct cns3xxx_pcie *pdev_to_cnspci(struct pci_dev *dev)
+static struct cns3xxx_pcie *pdev_to_cnspci(const struct pci_dev *dev)
 {
        return sysdata_to_cnspci(dev->sysdata);
 }
diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
index bd5394537c88..008d51407cd7 100644
--- a/arch/arm/mach-davinci/board-da850-evm.c
+++ b/arch/arm/mach-davinci/board-da850-evm.c
@@ -115,6 +115,32 @@ static struct spi_board_info da850evm_spi_info[] = {
        },
 };
+#ifdef CONFIG_MTD
+static void da850_evm_m25p80_notify_add(struct mtd_info *mtd)
+{
+        char *mac_addr = davinci_soc_info.emac_pdata->mac_addr;
+        size_t retlen;
+        if (!strcmp(mtd->name, "MAC-Address")) {
+                mtd->read(mtd, 0, ETH_ALEN, &retlen, mac_addr);
+                if (retlen == ETH_ALEN)
+                        pr_info("Read MAC addr from SPI Flash: %pM\n",
+                                mac_addr);
+        }
+}
+static struct mtd_notifier da850evm_spi_notifier = {
+        .add    = da850_evm_m25p80_notify_add,
+};
+static void da850_evm_setup_mac_addr(void)
+{
+        register_mtd_user(&da850evm_spi_notifier);
+}
+#else
+static void da850_evm_setup_mac_addr(void) { }
+#endif
 static struct mtd_partition da850_evm_norflash_partition[] = {
        {
                .name           = "bootloaders + env",
@@ -1244,6 +1270,8 @@ static __init void da850_evm_init(void)
        if (ret)
                pr_warning("da850_evm_init: sata registration failed: %d\n",
                                ret);
+        da850_evm_setup_mac_addr();
 }
 #ifdef CONFIG_SERIAL_8250_CONSOLE
diff --git a/arch/arm/mach-davinci/include/mach/psc.h b/arch/arm/mach-davinci/include/mach/psc.h
index 47fd0bc3d3e7..fa59c097223d 100644
--- a/arch/arm/mach-davinci/include/mach/psc.h
+++ b/arch/arm/mach-davinci/include/mach/psc.h
@@ -243,7 +243,7 @@
 #define PSC_STATE_DISABLE       2
 #define PSC_STATE_ENABLE        3
-#define MDSTAT_STATE_MASK       0x1f
+#define MDSTAT_STATE_MASK       0x3f
 #define MDCTL_FORCE             BIT(31)
 #ifndef __ASSEMBLER__
diff --git a/arch/arm/mach-davinci/sleep.S b/arch/arm/mach-davinci/sleep.S
index fb5e72b532b0..5f1e045a3ad1 100644
--- a/arch/arm/mach-davinci/sleep.S
+++ b/arch/arm/mach-davinci/sleep.S
@@ -217,7 +217,11 @@ ddr2clk_stop_done:
 ENDPROC(davinci_ddr_psc_config)
 CACHE_FLUSH:
-        .word   arm926_flush_kern_cache_all
+#ifdef CONFIG_CPU_V6
+        .word   v6_flush_kern_cache_all
+#else
+        .word   arm926_flush_kern_cache_all
+#endif
 ENTRY(davinci_cpu_suspend_sz)
        .word   . - davinci_cpu_suspend
diff --git a/arch/arm/mach-dove/common.c b/arch/arm/mach-dove/common.c
index 83dce859886d..a9e0dae86a26 100644
--- a/arch/arm/mach-dove/common.c
+++ b/arch/arm/mach-dove/common.c
@@ -158,7 +158,7 @@ void __init dove_spi0_init(void)
 void __init dove_spi1_init(void)
 {
-        orion_spi_init(DOVE_SPI1_PHYS_BASE, get_tclk());
+        orion_spi_1_init(DOVE_SPI1_PHYS_BASE, get_tclk());
 }
 /*****************************************************************************
diff --git a/arch/arm/mach-ep93xx/include/mach/ts72xx.h b/arch/arm/mach-ep93xx/include/mach/ts72xx.h
index 0eabec62cd9d..f1397a13e76b 100644
--- a/arch/arm/mach-ep93xx/include/mach/ts72xx.h
+++ b/arch/arm/mach-ep93xx/include/mach/ts72xx.h
@@ -6,7 +6,7 @@
 * TS72xx memory map:
 *
 * virt         phys            size
- * febff000     22000000        4K      model number register
+ * febff000     22000000        4K      model number register (bits 0-2)
 * febfe000     22400000        4K      options register
 * febfd000     22800000        4K      options register #2
 * febf9000     10800000        4K      TS-5620 RTC index register
@@ -20,6 +20,9 @@
 #define TS72XX_MODEL_TS7200             0x00
 #define TS72XX_MODEL_TS7250             0x01
 #define TS72XX_MODEL_TS7260             0x02
+#define TS72XX_MODEL_TS7300             0x03
+#define TS72XX_MODEL_TS7400             0x04
+#define TS72XX_MODEL_MASK               0x07
 #define TS72XX_OPTIONS_PHYS_BASE        0x22400000
@@ -51,19 +54,34 @@
 #ifndef __ASSEMBLY__
+static inline int ts72xx_model(void)
+{
+        return __raw_readb(TS72XX_MODEL_VIRT_BASE) & TS72XX_MODEL_MASK;
+}
 static inline int board_is_ts7200(void)
 {
-        return __raw_readb(TS72XX_MODEL_VIRT_BASE) == TS72XX_MODEL_TS7200;
+        return ts72xx_model() == TS72XX_MODEL_TS7200;
 }
 static inline int board_is_ts7250(void)
 {
-        return __raw_readb(TS72XX_MODEL_VIRT_BASE) == TS72XX_MODEL_TS7250;
+        return ts72xx_model() == TS72XX_MODEL_TS7250;
 }
 static inline int board_is_ts7260(void)
 {
-        return __raw_readb(TS72XX_MODEL_VIRT_BASE) == TS72XX_MODEL_TS7260;
+        return ts72xx_model() == TS72XX_MODEL_TS7260;
+}
+static inline int board_is_ts7300(void)
+{
+        return ts72xx_model()  == TS72XX_MODEL_TS7300;
+}
+static inline int board_is_ts7400(void)
+{
+        return ts72xx_model() == TS72XX_MODEL_TS7400;
 }
 static inline int is_max197_installed(void)
diff --git a/arch/arm/mach-exynos4/clock.c b/arch/arm/mach-exynos4/clock.c
index 851dea018578..79d6cd0c8e7b 100644
--- a/arch/arm/mach-exynos4/clock.c
+++ b/arch/arm/mach-exynos4/clock.c
@@ -520,7 +520,7 @@ static struct clk init_clocks_off[] = {
                .ctrlbit        = (1 << 21),
        }, {
                .name           = "ac97",
-                .id             = -1,
+                .devname        = "samsung-ac97",
                .enable         = exynos4_clk_ip_peril_ctrl,
                .ctrlbit        = (1 << 27),
        }, {
@@ -1160,7 +1160,7 @@ void __init_or_cpufreq exynos4_setup_clocks(void)
        vpllsrc = clk_get_rate(&clk_vpllsrc.clk);
        vpll = s5p_get_pll46xx(vpllsrc, __raw_readl(S5P_VPLL_CON0),
-                                __raw_readl(S5P_VPLL_CON1), pll_4650);
+                                __raw_readl(S5P_VPLL_CON1), pll_4650c);
        clk_fout_apll.ops = &exynos4_fout_apll_ops;
        clk_fout_mpll.rate = mpll;
diff --git a/arch/arm/mach-exynos4/cpu.c b/arch/arm/mach-exynos4/cpu.c
index 2d8a40c9e6e5..746d6fc6d397 100644
--- a/arch/arm/mach-exynos4/cpu.c
+++ b/arch/arm/mach-exynos4/cpu.c
@@ -24,12 +24,13 @@
 #include <plat/exynos4.h>
 #include <plat/adc-core.h>
 #include <plat/sdhci.h>
-#include <plat/devs.h>
 #include <plat/fb-core.h>
 #include <plat/fimc-core.h>
 #include <plat/iic-core.h>
+#include <plat/reset.h>
 #include <mach/regs-irq.h>
+#include <mach/regs-pmu.h>
 extern int combiner_init(unsigned int combiner_nr, void __iomem *base,
                         unsigned int irq_start);
@@ -128,6 +129,11 @@ static void exynos4_idle(void)
        local_irq_enable();
 }
+static void exynos4_sw_reset(void)
+{
+        __raw_writel(0x1, S5P_SWRESET);
+}
 /*
 * exynos4_map_io
 *
@@ -241,5 +247,8 @@ int __init exynos4_init(void)
        /* set idle function */
        pm_idle = exynos4_idle;
+        /* set sw_reset function */
+        s5p_reset_hook = exynos4_sw_reset;
        return sysdev_register(&exynos4_sysdev);
 }
diff --git a/arch/arm/mach-exynos4/include/mach/irqs.h b/arch/arm/mach-exynos4/include/mach/irqs.h
index 934d2a493982..f8952f8f3757 100644
--- a/arch/arm/mach-exynos4/include/mach/irqs.h
+++ b/arch/arm/mach-exynos4/include/mach/irqs.h
@@ -80,9 +80,8 @@
 #define IRQ_HSMMC3              IRQ_SPI(76)
 #define IRQ_DWMCI               IRQ_SPI(77)
-#define IRQ_MIPICSI0            IRQ_SPI(78)
+#define IRQ_MIPI_CSIS0          IRQ_SPI(78)
+#define IRQ_MIPI_CSIS1          IRQ_SPI(80)
-#define IRQ_MIPICSI1            IRQ_SPI(80)
 #define IRQ_ONENAND_AUDI        IRQ_SPI(82)
 #define IRQ_ROTATOR             IRQ_SPI(83)
diff --git a/arch/arm/mach-exynos4/include/mach/regs-pmu.h b/arch/arm/mach-exynos4/include/mach/regs-pmu.h
index fa49bbb8e7b0..cdf9b47c303c 100644
--- a/arch/arm/mach-exynos4/include/mach/regs-pmu.h
+++ b/arch/arm/mach-exynos4/include/mach/regs-pmu.h
@@ -29,6 +29,8 @@
 #define S5P_USE_STANDBY_WFE1                    (1 << 25)
 #define S5P_USE_MASK                            ((0x3 << 16) | (0x3 << 24))
+#define S5P_SWRESET                             S5P_PMUREG(0x0400)
 #define S5P_WAKEUP_STAT                         S5P_PMUREG(0x0600)
 #define S5P_EINT_WAKEUP_MASK                    S5P_PMUREG(0x0604)
 #define S5P_WAKEUP_MASK                         S5P_PMUREG(0x0608)
diff --git a/arch/arm/mach-exynos4/irq-eint.c b/arch/arm/mach-exynos4/irq-eint.c
index 9d87d2ac7f68..badb8c66fc9b 100644
--- a/arch/arm/mach-exynos4/irq-eint.c
+++ b/arch/arm/mach-exynos4/irq-eint.c
@@ -23,6 +23,8 @@
 #include <mach/regs-gpio.h>
+#include <asm/mach/irq.h>
 static DEFINE_SPINLOCK(eint_lock);
 static unsigned int eint0_15_data[16];
@@ -184,8 +186,11 @@ static inline void exynos4_irq_demux_eint(unsigned int start)
 static void exynos4_irq_demux_eint16_31(unsigned int irq, struct irq_desc *desc)
 {
+        struct irq_chip *chip = irq_get_chip(irq);
+        chained_irq_enter(chip, desc);
        exynos4_irq_demux_eint(IRQ_EINT(16));
        exynos4_irq_demux_eint(IRQ_EINT(24));
+        chained_irq_exit(chip, desc);
 }
 static void exynos4_irq_eint0_15(unsigned int irq, struct irq_desc *desc)
@@ -193,6 +198,7 @@ static void exynos4_irq_eint0_15(unsigned int irq, struct irq_desc *desc)
        u32 *irq_data = irq_get_handler_data(irq);
        struct irq_chip *chip = irq_get_chip(irq);
+        chained_irq_enter(chip, desc);
        chip->irq_mask(&desc->irq_data);
        if (chip->irq_ack)
@@ -201,6 +207,7 @@ static void exynos4_irq_eint0_15(unsigned int irq, struct irq_desc *desc)
        generic_handle_irq(*irq_data);
        chip->irq_unmask(&desc->irq_data);
+        chained_irq_exit(chip, desc);
 }
 int __init exynos4_init_irq_eint(void)
diff --git a/arch/arm/mach-exynos4/mach-universal_c210.c b/arch/arm/mach-exynos4/mach-universal_c210.c
index 0e280d12301e..b3b5d8911004 100644
--- a/arch/arm/mach-exynos4/mach-universal_c210.c
+++ b/arch/arm/mach-exynos4/mach-universal_c210.c
@@ -79,7 +79,7 @@ static struct s3c2410_uartcfg universal_uartcfgs[] __initdata = {
 };
 static struct regulator_consumer_supply max8952_consumer =
-        REGULATOR_SUPPLY("vddarm", NULL);
+        REGULATOR_SUPPLY("vdd_arm", NULL);
 static struct max8952_platform_data universal_max8952_pdata __initdata = {
        .gpio_vid0      = EXYNOS4_GPX0(3),
@@ -105,7 +105,7 @@ static struct max8952_platform_data universal_max8952_pdata __initdata = {
 };
 static struct regulator_consumer_supply lp3974_buck1_consumer =
-        REGULATOR_SUPPLY("vddint", NULL);
+        REGULATOR_SUPPLY("vdd_int", NULL);
 static struct regulator_consumer_supply lp3974_buck2_consumer =
        REGULATOR_SUPPLY("vddg3d", NULL);
diff --git a/arch/arm/mach-exynos4/mct.c b/arch/arm/mach-exynos4/mct.c
index 1ae059b7ad7b..ddd86864fb83 100644
--- a/arch/arm/mach-exynos4/mct.c
+++ b/arch/arm/mach-exynos4/mct.c
@@ -132,12 +132,18 @@ static cycle_t exynos4_frc_read(struct clocksource *cs)
        return ((cycle_t)hi << 32) | lo;
 }
+static void exynos4_frc_resume(struct clocksource *cs)
+{
+        exynos4_mct_frc_start(0, 0);
+}
 struct clocksource mct_frc = {
        .name           = "mct-frc",
        .rating         = 400,
        .read           = exynos4_frc_read,
        .mask           = CLOCKSOURCE_MASK(64),
        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
+        .resume         = exynos4_frc_resume,
 };
 static void __init exynos4_clocksource_init(void)
@@ -389,9 +395,11 @@ static void exynos4_mct_tick_init(struct clock_event_device *evt)
 }
 /* Setup the local clock events for a CPU */
-void __cpuinit local_timer_setup(struct clock_event_device *evt)
+int __cpuinit local_timer_setup(struct clock_event_device *evt)
 {
        exynos4_mct_tick_init(evt);
+        return 0;
 }
 int local_timer_ack(void)
diff --git a/arch/arm/mach-exynos4/platsmp.c b/arch/arm/mach-exynos4/platsmp.c
index 7c2282c6ba81..df6ef1b2f98b 100644
--- a/arch/arm/mach-exynos4/platsmp.c
+++ b/arch/arm/mach-exynos4/platsmp.c
@@ -106,6 +106,8 @@ void __cpuinit platform_secondary_init(unsigned int cpu)
         */
        spin_lock(&boot_lock);
        spin_unlock(&boot_lock);
+        set_cpu_online(cpu, true);
 }
 int __cpuinit boot_secondary(unsigned int cpu, struct task_struct *idle)
diff --git a/arch/arm/mach-exynos4/setup-keypad.c b/arch/arm/mach-exynos4/setup-keypad.c
index 1ee0ebff111f..7862bfb5933d 100644
--- a/arch/arm/mach-exynos4/setup-keypad.c
+++ b/arch/arm/mach-exynos4/setup-keypad.c
@@ -19,15 +19,16 @@ void samsung_keypad_cfg_gpio(unsigned int rows, unsigned int cols)
        if (rows > 8) {
                /* Set all the necessary GPX2 pins: KP_ROW[0~7] */
-                s3c_gpio_cfgrange_nopull(EXYNOS4_GPX2(0), 8, S3C_GPIO_SFN(3));
+                s3c_gpio_cfgall_range(EXYNOS4_GPX2(0), 8, S3C_GPIO_SFN(3),
+                                        S3C_GPIO_PULL_UP);
                /* Set all the necessary GPX3 pins: KP_ROW[8~] */
-                s3c_gpio_cfgrange_nopull(EXYNOS4_GPX3(0), (rows - 8),
+                s3c_gpio_cfgall_range(EXYNOS4_GPX3(0), (rows - 8),
-                                         S3C_GPIO_SFN(3));
+                                         S3C_GPIO_SFN(3), S3C_GPIO_PULL_UP);
        } else {
                /* Set all the necessary GPX2 pins: KP_ROW[x] */
-                s3c_gpio_cfgrange_nopull(EXYNOS4_GPX2(0), rows,
+                s3c_gpio_cfgall_range(EXYNOS4_GPX2(0), rows, S3C_GPIO_SFN(3),
-                                         S3C_GPIO_SFN(3));
+                                        S3C_GPIO_PULL_UP);
        }
        /* Set all the necessary GPX1 pins to special-function 3: KP_COL[x] */
diff --git a/arch/arm/mach-exynos4/setup-usb-phy.c b/arch/arm/mach-exynos4/setup-usb-phy.c
index 0883c1b824b9..39aca045f660 100644
--- a/arch/arm/mach-exynos4/setup-usb-phy.c
+++ b/arch/arm/mach-exynos4/setup-usb-phy.c
@@ -82,7 +82,7 @@ static int exynos4_usb_phy1_init(struct platform_device *pdev)
        rstcon &= ~(HOST_LINK_PORT_SWRST_MASK | PHY1_SWRST_MASK);
        writel(rstcon, EXYNOS4_RSTCON);
-        udelay(50);
+        udelay(80);
        clk_disable(otg_clk);
        clk_put(otg_clk);
diff --git a/arch/arm/mach-footbridge/Kconfig b/arch/arm/mach-footbridge/Kconfig
index dc26fff22cf0..c8e7afcf14ec 100644
--- a/arch/arm/mach-footbridge/Kconfig
+++ b/arch/arm/mach-footbridge/Kconfig
@@ -62,6 +62,7 @@ config ARCH_EBSA285_HOST
 config ARCH_NETWINDER
        bool "NetWinder"
        select CLKSRC_I8253
+        select CLKEVT_I8253
        select FOOTBRIDGE_HOST
        select ISA
        select ISA_DMA
diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
index 1331fff51ae2..18c32a5541d9 100644
--- a/arch/arm/mach-footbridge/dc21285.c
+++ b/arch/arm/mach-footbridge/dc21285.c
@@ -18,6 +18,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/spinlock.h>
+#include <video/vga.h>
 #include <asm/irq.h>
 #include <asm/system.h>
diff --git a/arch/arm/mach-imx/mach-cpuimx27.c b/arch/arm/mach-imx/mach-cpuimx27.c
index 87887ac5806b..f851fe903687 100644
--- a/arch/arm/mach-imx/mach-cpuimx27.c
+++ b/arch/arm/mach-imx/mach-cpuimx27.c
@@ -310,7 +310,7 @@ static struct sys_timer eukrea_cpuimx27_timer = {
        .init = eukrea_cpuimx27_timer_init,
 };
-MACHINE_START(CPUIMX27, "EUKREA CPUIMX27")
+MACHINE_START(EUKREA_CPUIMX27, "EUKREA CPUIMX27")
        .boot_params = MX27_PHYS_OFFSET + 0x100,
        .map_io = mx27_map_io,
        .init_early = imx27_init_early,
diff --git a/arch/arm/mach-imx/mach-cpuimx35.c b/arch/arm/mach-imx/mach-cpuimx35.c
index f39a478ba1a6..4bd083ba9af2 100644
--- a/arch/arm/mach-imx/mach-cpuimx35.c
+++ b/arch/arm/mach-imx/mach-cpuimx35.c
@@ -192,7 +192,7 @@ struct sys_timer eukrea_cpuimx35_timer = {
        .init   = eukrea_cpuimx35_timer_init,
 };
-MACHINE_START(EUKREA_CPUIMX35, "Eukrea CPUIMX35")
+MACHINE_START(EUKREA_CPUIMX35SD, "Eukrea CPUIMX35")
        /* Maintainer: Eukrea Electromatique */
        .boot_params = MX3x_PHYS_OFFSET + 0x100,
        .map_io = mx35_map_io,
diff --git a/arch/arm/mach-imx/mach-eukrea_cpuimx25.c b/arch/arm/mach-imx/mach-eukrea_cpuimx25.c
index da36da52969d..2442d5da883d 100644
--- a/arch/arm/mach-imx/mach-eukrea_cpuimx25.c
+++ b/arch/arm/mach-imx/mach-eukrea_cpuimx25.c
@@ -161,7 +161,7 @@ static struct sys_timer eukrea_cpuimx25_timer = {
        .init   = eukrea_cpuimx25_timer_init,
 };
-MACHINE_START(EUKREA_CPUIMX25, "Eukrea CPUIMX25")
+MACHINE_START(EUKREA_CPUIMX25SD, "Eukrea CPUIMX25")
        /* Maintainer: Eukrea Electromatique */
        .boot_params = MX25_PHYS_OFFSET + 0x100,
        .map_io = mx25_map_io,
diff --git a/arch/arm/mach-integrator/integrator_ap.c b/arch/arm/mach-integrator/integrator_ap.c
index 2fbbdd5eac35..8cdc730dcb3a 100644
--- a/arch/arm/mach-integrator/integrator_ap.c
+++ b/arch/arm/mach-integrator/integrator_ap.c
@@ -32,6 +32,7 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/mtd/physmap.h>
+#include <video/vga.h>
 #include <mach/hardware.h>
 #include <mach/platform.h>
@@ -154,6 +155,7 @@ static struct map_desc ap_io_desc[] __initdata = {
 static void __init ap_map_io(void)
 {
        iotable_init(ap_io_desc, ARRAY_SIZE(ap_io_desc));
+        vga_base = PCI_MEMORY_VADDR;
 }
 #define INTEGRATOR_SC_VALID_INT 0x003fffff
@@ -337,15 +339,15 @@ static unsigned long timer_reload;
 static void integrator_clocksource_init(u32 khz)
 {
        void __iomem *base = (void __iomem *)TIMER2_VA_BASE;
-        u32 ctrl = TIMER_CTRL_ENABLE;
+        u32 ctrl = TIMER_CTRL_ENABLE | TIMER_CTRL_PERIODIC;
        if (khz >= 1500) {
                khz /= 16;
-                ctrl = TIMER_CTRL_DIV16;
+                ctrl |= TIMER_CTRL_DIV16;
        }
-        writel(ctrl, base + TIMER_CTRL);
        writel(0xffff, base + TIMER_LOAD);
+        writel(ctrl, base + TIMER_CTRL);
        clocksource_mmio_init(base + TIMER_VALUE, "timer2",
                khz * 1000, 200, 16, clocksource_mmio_readl_down);
diff --git a/arch/arm/mach-integrator/pci_v3.c b/arch/arm/mach-integrator/pci_v3.c
index dd56bfb351e3..11b86e5b71c2 100644
--- a/arch/arm/mach-integrator/pci_v3.c
+++ b/arch/arm/mach-integrator/pci_v3.c
@@ -27,7 +27,6 @@
 #include <linux/spinlock.h>
 #include <linux/init.h>
 #include <linux/io.h>
-#include <video/vga.h>
 #include <mach/hardware.h>
 #include <mach/platform.h>
@@ -505,7 +504,6 @@ void __init pci_v3_preinit(void)
        pcibios_min_io = 0x6000;
        pcibios_min_mem = 0x00100000;
-        vga_base = PCI_MEMORY_VADDR;
        /*
         * Hook in our fault handler for PCI errors
diff --git a/arch/arm/mach-omap2/clock3xxx_data.c b/arch/arm/mach-omap2/clock3xxx_data.c
index ffd55b1c4396..b9b844683147 100644
--- a/arch/arm/mach-omap2/clock3xxx_data.c
+++ b/arch/arm/mach-omap2/clock3xxx_data.c
@@ -3078,6 +3078,7 @@ static struct clk gpt12_fck = {
        .name           = "gpt12_fck",
        .ops            = &clkops_null,
        .parent         = &secure_32k_fck,
+        .clkdm_name     = "wkup_clkdm",
        .recalc         = &followparent_recalc,
 };
@@ -3085,6 +3086,7 @@ static struct clk wdt1_fck = {
        .name           = "wdt1_fck",
        .ops            = &clkops_null,
        .parent         = &secure_32k_fck,
+        .clkdm_name     = "wkup_clkdm",
        .recalc         = &followparent_recalc,
 };
diff --git a/arch/arm/mach-omap2/clock44xx_data.c b/arch/arm/mach-omap2/clock44xx_data.c
index 2af0e3f00ce1..c0b6fbda3408 100644
--- a/arch/arm/mach-omap2/clock44xx_data.c
+++ b/arch/arm/mach-omap2/clock44xx_data.c
@@ -3376,10 +3376,18 @@ int __init omap4xxx_clk_init(void)
        } else if (cpu_is_omap446x()) {
                cpu_mask = RATE_IN_4460;
                cpu_clkflg = CK_446X;
+        } else {
+                return 0;
        }
        clk_init(&omap2_clk_functions);
-        omap2_clk_disable_clkdm_control();
+        /*
+         * Must stay commented until all OMAP SoC drivers are
+         * converted to runtime PM, or drivers may start crashing
+         *
+         * omap2_clk_disable_clkdm_control();
+         */
        for (c = omap44xx_clks; c < omap44xx_clks + ARRAY_SIZE(omap44xx_clks);
                                                                          c++)
diff --git a/arch/arm/mach-omap2/clockdomain.c b/arch/arm/mach-omap2/clockdomain.c
index ab7db083f97f..8f0890685d7b 100644
--- a/arch/arm/mach-omap2/clockdomain.c
+++ b/arch/arm/mach-omap2/clockdomain.c
@@ -747,6 +747,7 @@ int clkdm_wakeup(struct clockdomain *clkdm)
        spin_lock_irqsave(&clkdm->lock, flags);
        clkdm->_flags &= ~_CLKDM_FLAG_HWSUP_ENABLED;
        ret = arch_clkdm->clkdm_wakeup(clkdm);
+        ret |= pwrdm_state_switch(clkdm->pwrdm.ptr);
        spin_unlock_irqrestore(&clkdm->lock, flags);
        return ret;
 }
@@ -818,6 +819,7 @@ void clkdm_deny_idle(struct clockdomain *clkdm)
        spin_lock_irqsave(&clkdm->lock, flags);
        clkdm->_flags &= ~_CLKDM_FLAG_HWSUP_ENABLED;
        arch_clkdm->clkdm_deny_idle(clkdm);
+        pwrdm_state_switch(clkdm->pwrdm.ptr);
        spin_unlock_irqrestore(&clkdm->lock, flags);
 }
diff --git a/arch/arm/mach-omap2/omap_hwmod_2430_data.c b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
index 16743c7d6e8e..408193d8e044 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2430_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
@@ -192,6 +192,7 @@ static struct omap_hwmod_addr_space omap2430_usbhsotg_addrs[] = {
                .pa_end         = OMAP243X_HS_BASE + SZ_4K - 1,
                .flags          = ADDR_TYPE_RT
        },
+        { }
 };
 /*  l4_core ->usbhsotg  interface */
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index 3feb35911a32..472bf22d5e84 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -130,7 +130,6 @@ int omap_set_pwrdm_state(struct powerdomain *pwrdm, u32 state)
                } else {
                        hwsup = clkdm_in_hwsup(pwrdm->pwrdm_clkdms[0]);
                        clkdm_wakeup(pwrdm->pwrdm_clkdms[0]);
-                        pwrdm_wait_transition(pwrdm);
                        sleep_switch = FORCEWAKEUP_SWITCH;
                }
        }
@@ -156,7 +155,6 @@ int omap_set_pwrdm_state(struct powerdomain *pwrdm, u32 state)
                return ret;
        }
-        pwrdm_wait_transition(pwrdm);
        pwrdm_state_switch(pwrdm);
 err:
        return ret;
diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c
index 9af08473bf10..ef71fdd40fc4 100644
--- a/arch/arm/mach-omap2/powerdomain.c
+++ b/arch/arm/mach-omap2/powerdomain.c
@@ -195,28 +195,35 @@ static int _pwrdm_post_transition_cb(struct powerdomain *pwrdm, void *unused)
 /**
 * pwrdm_init - set up the powerdomain layer
- * @pwrdm_list: array of struct powerdomain pointers to register
+ * @pwrdms: array of struct powerdomain pointers to register
 * @custom_funcs: func pointers for arch specific implementations
 *
- * Loop through the array of powerdomains @pwrdm_list, registering all
+ * Loop through the array of powerdomains @pwrdms, registering all
- * that are available on the current CPU. If pwrdm_list is supplied
+ * that are available on the current CPU.  Also, program all
- * and not null, all of the referenced powerdomains will be
+ * powerdomain target state as ON; this is to prevent domains from
- * registered.  No return value.  XXX pwrdm_list is not really a
+ * hitting low power states (if bootloader has target states set to
- * "list"; it is an array.  Rename appropriately.
+ * something other than ON) and potentially even losing context while
+ * PM is not fully initialized.  The PM late init code can then program
+ * the desired target state for all the power domains.  No return
+ * value.
 */
-void pwrdm_init(struct powerdomain **pwrdm_list, struct pwrdm_ops *custom_funcs)
+void pwrdm_init(struct powerdomain **pwrdms, struct pwrdm_ops *custom_funcs)
 {
        struct powerdomain **p = NULL;
+        struct powerdomain *temp_p;
        if (!custom_funcs)
                WARN(1, "powerdomain: No custom pwrdm functions registered\n");
        else
                arch_pwrdm = custom_funcs;
-        if (pwrdm_list) {
+        if (pwrdms) {
-                for (p = pwrdm_list; *p; p++)
+                for (p = pwrdms; *p; p++)
                        _pwrdm_register(*p);
        }
+        list_for_each_entry(temp_p, &pwrdm_list, node)
+                pwrdm_set_next_pwrst(temp_p, PWRDM_POWER_ON);
 }
 /**
diff --git a/arch/arm/mach-orion5x/dns323-setup.c b/arch/arm/mach-orion5x/dns323-setup.c
index a6eddae82a0b..c105556a0ee1 100644
--- a/arch/arm/mach-orion5x/dns323-setup.c
+++ b/arch/arm/mach-orion5x/dns323-setup.c
@@ -77,7 +77,7 @@ static int __init dns323_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
        /*
         * Check for devices with hard-wired IRQs.
         */
-        irq = orion5x_pci_map_irq(const dev, slot, pin);
+        irq = orion5x_pci_map_irq(dev, slot, pin);
        if (irq != -1)
                return irq;
diff --git a/arch/arm/mach-orion5x/pci.c b/arch/arm/mach-orion5x/pci.c
index 28b8760ab9fa..bc4a920e26ee 100644
--- a/arch/arm/mach-orion5x/pci.c
+++ b/arch/arm/mach-orion5x/pci.c
@@ -14,6 +14,7 @@
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/mbus.h>
+#include <video/vga.h>
 #include <asm/irq.h>
 #include <asm/mach/pci.h>
 #include <plat/pcie.h>
diff --git a/arch/arm/mach-prima2/clock.c b/arch/arm/mach-prima2/clock.c
index f9a2aaf63f71..615a4e75ceab 100644
--- a/arch/arm/mach-prima2/clock.c
+++ b/arch/arm/mach-prima2/clock.c
@@ -481,6 +481,7 @@ static void __init sirfsoc_clk_init(void)
 static struct of_device_id clkc_ids[] = {
        { .compatible = "sirf,prima2-clkc" },
+        {},
 };
 void __init sirfsoc_of_clk_init(void)
diff --git a/arch/arm/mach-prima2/irq.c b/arch/arm/mach-prima2/irq.c
index c3404cbb6ff7..7af254d046ba 100644
--- a/arch/arm/mach-prima2/irq.c
+++ b/arch/arm/mach-prima2/irq.c
@@ -51,6 +51,7 @@ static __init void sirfsoc_irq_init(void)
 static struct of_device_id intc_ids[]  = {
        { .compatible = "sirf,prima2-intc" },
+        {},
 };
 void __init sirfsoc_of_irq_init(void)
diff --git a/arch/arm/mach-prima2/rstc.c b/arch/arm/mach-prima2/rstc.c
index d074786e83d4..492cfa8d2610 100644
--- a/arch/arm/mach-prima2/rstc.c
+++ b/arch/arm/mach-prima2/rstc.c
@@ -19,6 +19,7 @@ static DEFINE_MUTEX(rstc_lock);
 static struct of_device_id rstc_ids[]  = {
        { .compatible = "sirf,prima2-rstc" },
+        {},
 };
 static int __init sirfsoc_of_rstc_init(void)
diff --git a/arch/arm/mach-prima2/timer.c b/arch/arm/mach-prima2/timer.c
index 44027f34a88a..ed7ec48d11da 100644
--- a/arch/arm/mach-prima2/timer.c
+++ b/arch/arm/mach-prima2/timer.c
@@ -190,6 +190,7 @@ static void __init sirfsoc_timer_init(void)
 static struct of_device_id timer_ids[] = {
        { .compatible = "sirf,prima2-tick" },
+        {},
 };
 static void __init sirfsoc_of_timer_map(void)
diff --git a/arch/arm/mach-realview/include/mach/system.h b/arch/arm/mach-realview/include/mach/system.h
index a30f2e3ec178..6657ff231161 100644
--- a/arch/arm/mach-realview/include/mach/system.h
+++ b/arch/arm/mach-realview/include/mach/system.h
@@ -44,6 +44,7 @@ static inline void arch_reset(char mode, const char *cmd)
         */
        if (realview_reset)
                realview_reset(mode);
+        dsb();
 }
 #endif
diff --git a/arch/arm/mach-s3c64xx/mach-smdk6410.c b/arch/arm/mach-s3c64xx/mach-smdk6410.c
index ecbea92bf83b..a9f3183e0290 100644
--- a/arch/arm/mach-s3c64xx/mach-smdk6410.c
+++ b/arch/arm/mach-s3c64xx/mach-smdk6410.c
@@ -262,45 +262,6 @@ static struct samsung_keypad_platdata smdk6410_keypad_data __initdata = {
        .cols           = 8,
 };
-static int smdk6410_backlight_init(struct device *dev)
-{
-        int ret;
-        ret = gpio_request(S3C64XX_GPF(15), "Backlight");
-        if (ret) {
-                printk(KERN_ERR "failed to request GPF for PWM-OUT1\n");
-                return ret;
-        }
-        /* Configure GPIO pin with S3C64XX_GPF15_PWM_TOUT1 */
-        s3c_gpio_cfgpin(S3C64XX_GPF(15), S3C_GPIO_SFN(2));
-        return 0;
-}
-static void smdk6410_backlight_exit(struct device *dev)
-{
-        s3c_gpio_cfgpin(S3C64XX_GPF(15), S3C_GPIO_OUTPUT);
-        gpio_free(S3C64XX_GPF(15));
-}
-static struct platform_pwm_backlight_data smdk6410_backlight_data = {
-        .pwm_id         = 1,
-        .max_brightness = 255,
-        .dft_brightness = 255,
-        .pwm_period_ns  = 78770,
-        .init           = smdk6410_backlight_init,
-        .exit           = smdk6410_backlight_exit,
-};
-static struct platform_device smdk6410_backlight_device = {
-        .name           = "pwm-backlight",
-        .dev            = {
-                .parent         = &s3c_device_timer[1].dev,
-                .platform_data  = &smdk6410_backlight_data,
-        },
-};
 static struct map_desc smdk6410_iodesc[] = {};
 static struct platform_device *smdk6410_devices[] __initdata = {
diff --git a/arch/arm/mach-s3c64xx/pm.c b/arch/arm/mach-s3c64xx/pm.c
index 8bad64370689..055e2858b0dd 100644
--- a/arch/arm/mach-s3c64xx/pm.c
+++ b/arch/arm/mach-s3c64xx/pm.c
@@ -16,6 +16,7 @@
 #include <linux/suspend.h>
 #include <linux/serial_core.h>
 #include <linux/io.h>
+#include <linux/gpio.h>
 #include <mach/map.h>
 #include <mach/irqs.h>
diff --git a/arch/arm/mach-s5p64x0/irq-eint.c b/arch/arm/mach-s5p64x0/irq-eint.c
index 69ed4545112b..fe7380f5c3cd 100644
--- a/arch/arm/mach-s5p64x0/irq-eint.c
+++ b/arch/arm/mach-s5p64x0/irq-eint.c
@@ -129,7 +129,7 @@ static int s5p64x0_alloc_gc(void)
        }
        ct = gc->chip_types;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_set_bit;
        ct->chip.irq_mask = irq_gc_mask_set_bit;
        ct->chip.irq_unmask = irq_gc_mask_clr_bit;
        ct->chip.irq_set_type = s5p64x0_irq_eint_set_type;
diff --git a/arch/arm/mach-s5pv210/pm.c b/arch/arm/mach-s5pv210/pm.c
index 309e388a8a83..f149d278377b 100644
--- a/arch/arm/mach-s5pv210/pm.c
+++ b/arch/arm/mach-s5pv210/pm.c
@@ -88,7 +88,7 @@ static struct sleep_save s5pv210_core_save[] = {
        SAVE_ITEM(S3C2410_TCNTO(0)),
 };
-void s5pv210_cpu_suspend(unsigned long arg)
+static int s5pv210_cpu_suspend(unsigned long arg)
 {
        unsigned long tmp;
diff --git a/arch/arm/mach-shmobile/board-ag5evm.c b/arch/arm/mach-shmobile/board-ag5evm.c
index ce5c2513c6ce..cdfdd624d21d 100644
--- a/arch/arm/mach-shmobile/board-ag5evm.c
+++ b/arch/arm/mach-shmobile/board-ag5evm.c
@@ -341,6 +341,7 @@ static struct platform_device mipidsi0_device = {
 static struct sh_mobile_sdhi_info sdhi0_info = {
        .dma_slave_tx   = SHDMA_SLAVE_SDHI0_TX,
        .dma_slave_rx   = SHDMA_SLAVE_SDHI0_RX,
+        .tmio_flags     = TMIO_MMC_HAS_IDLE_WAIT,
        .tmio_caps      = MMC_CAP_SD_HIGHSPEED,
        .tmio_ocr_mask  = MMC_VDD_27_28 | MMC_VDD_28_29,
 };
@@ -382,7 +383,7 @@ void ag5evm_sdhi1_set_pwr(struct platform_device *pdev, int state)
 }
 static struct sh_mobile_sdhi_info sh_sdhi1_info = {
-        .tmio_flags     = TMIO_MMC_WRPROTECT_DISABLE,
+        .tmio_flags     = TMIO_MMC_WRPROTECT_DISABLE | TMIO_MMC_HAS_IDLE_WAIT,
        .tmio_caps      = MMC_CAP_NONREMOVABLE | MMC_CAP_SDIO_IRQ,
        .tmio_ocr_mask  = MMC_VDD_32_33 | MMC_VDD_33_34,
        .set_pwr        = ag5evm_sdhi1_set_pwr,
diff --git a/arch/arm/mach-shmobile/board-ap4evb.c b/arch/arm/mach-shmobile/board-ap4evb.c
index 074884c646db..d6c8ae813175 100644
--- a/arch/arm/mach-shmobile/board-ap4evb.c
+++ b/arch/arm/mach-shmobile/board-ap4evb.c
@@ -1413,7 +1413,7 @@ static void __init ap4evb_init(void)
        fsi_init_pm_clock();
        sh7372_pm_init();
        pm_clk_add(&fsi_device.dev, "spu2");
-        pm_clk_add(&hdmi_lcdc_device.dev, "hdmi");
+        pm_clk_add(&lcdc1_device.dev, "hdmi");
 }
 static void __init ap4evb_timer_init(void)
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index 4978e8186127..19f5d4922e2c 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -641,6 +641,8 @@ static struct usbhs_private usbhs0_private = {
                },
                .driver_param = {
                        .buswait_bwait  = 4,
+                        .d0_tx_id       = SHDMA_SLAVE_USB0_TX,
+                        .d1_rx_id       = SHDMA_SLAVE_USB0_RX,
                },
        },
 };
@@ -810,6 +812,8 @@ static struct usbhs_private usbhs1_private = {
                        .buswait_bwait  = 4,
                        .pipe_type      = usbhs1_pipe_cfg,
                        .pipe_size      = ARRAY_SIZE(usbhs1_pipe_cfg),
+                        .d0_tx_id       = SHDMA_SLAVE_USB1_TX,
+                        .d1_rx_id       = SHDMA_SLAVE_USB1_RX,
                },
        },
 };
diff --git a/arch/arm/mach-shmobile/clock-sh7372.c b/arch/arm/mach-shmobile/clock-sh7372.c
index e6e11e4e2d43..66975921e646 100644
--- a/arch/arm/mach-shmobile/clock-sh7372.c
+++ b/arch/arm/mach-shmobile/clock-sh7372.c
@@ -503,16 +503,17 @@ static struct clk *late_main_clks[] = {
        &sh7372_fsidivb_clk,
 };
-enum { MSTP001,
+enum { MSTP001, MSTP000,
       MSTP131, MSTP130,
       MSTP129, MSTP128, MSTP127, MSTP126, MSTP125,
       MSTP118, MSTP117, MSTP116, MSTP113,
       MSTP106, MSTP101, MSTP100,
       MSTP223,
-       MSTP218, MSTP217, MSTP216,
+       MSTP218, MSTP217, MSTP216, MSTP214, MSTP208, MSTP207,
-       MSTP207, MSTP206, MSTP204, MSTP203, MSTP202, MSTP201, MSTP200,
+       MSTP206, MSTP205, MSTP204, MSTP203, MSTP202, MSTP201, MSTP200,
-       MSTP329, MSTP328, MSTP323, MSTP322, MSTP314, MSTP313, MSTP312,
+       MSTP328, MSTP323, MSTP322, MSTP314, MSTP313, MSTP312,
-       MSTP423, MSTP415, MSTP413, MSTP411, MSTP410, MSTP406, MSTP403,
+       MSTP423, MSTP415, MSTP413, MSTP411, MSTP410, MSTP407, MSTP406,
+       MSTP405, MSTP404, MSTP403, MSTP400,
       MSTP_NR };
 #define MSTP(_parent, _reg, _bit, _flags) \
@@ -520,6 +521,7 @@ enum { MSTP001,
 static struct clk mstp_clks[MSTP_NR] = {
        [MSTP001] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR0, 1, 0), /* IIC2 */
+        [MSTP000] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR0, 0, 0), /* MSIOF0 */
        [MSTP131] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 31, 0), /* VEU3 */
        [MSTP130] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 30, 0), /* VEU2 */
        [MSTP129] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 29, 0), /* VEU1 */
@@ -538,14 +540,16 @@ static struct clk mstp_clks[MSTP_NR] = {
        [MSTP218] = MSTP(&div4_clks[DIV4_HP], SMSTPCR2, 18, 0), /* DMAC1 */
        [MSTP217] = MSTP(&div4_clks[DIV4_HP], SMSTPCR2, 17, 0), /* DMAC2 */
        [MSTP216] = MSTP(&div4_clks[DIV4_HP], SMSTPCR2, 16, 0), /* DMAC3 */
+        [MSTP214] = MSTP(&div4_clks[DIV4_HP], SMSTPCR2, 14, 0), /* USBDMAC */
+        [MSTP208] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 8, 0), /* MSIOF1 */
        [MSTP207] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 7, 0), /* SCIFA5 */
        [MSTP206] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 6, 0), /* SCIFB */
+        [MSTP205] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 5, 0), /* MSIOF2 */
        [MSTP204] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 4, 0), /* SCIFA0 */
        [MSTP203] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 3, 0), /* SCIFA1 */
        [MSTP202] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 2, 0), /* SCIFA2 */
        [MSTP201] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 1, 0), /* SCIFA3 */
        [MSTP200] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 0, 0), /* SCIFA4 */
-        [MSTP329] = MSTP(&r_clk, SMSTPCR3, 29, 0), /* CMT10 */
        [MSTP328] = MSTP(&div6_clks[DIV6_SPU], SMSTPCR3, 28, 0), /* FSI2 */
        [MSTP323] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR3, 23, 0), /* IIC1 */
        [MSTP322] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR3, 22, 0), /* USB0 */
@@ -557,8 +561,12 @@ static struct clk mstp_clks[MSTP_NR] = {
        [MSTP413] = MSTP(&pllc1_div2_clk, SMSTPCR4, 13, 0), /* HDMI */
        [MSTP411] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR4, 11, 0), /* IIC3 */
        [MSTP410] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR4, 10, 0), /* IIC4 */
+        [MSTP407] = MSTP(&div4_clks[DIV4_HP], SMSTPCR4, 7, 0), /* USB-DMAC1 */
        [MSTP406] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR4, 6, 0), /* USB1 */
+        [MSTP405] = MSTP(&r_clk, SMSTPCR4, 5, 0), /* CMT4 */
+        [MSTP404] = MSTP(&r_clk, SMSTPCR4, 4, 0), /* CMT3 */
        [MSTP403] = MSTP(&r_clk, SMSTPCR4, 3, 0), /* KEYSC */
+        [MSTP400] = MSTP(&r_clk, SMSTPCR4, 0, 0), /* CMT2 */
 };
 static struct clk_lookup lookups[] = {
@@ -609,6 +617,7 @@ static struct clk_lookup lookups[] = {
        /* MSTP32 clocks */
        CLKDEV_DEV_ID("i2c-sh_mobile.2", &mstp_clks[MSTP001]), /* IIC2 */
+        CLKDEV_DEV_ID("spi_sh_msiof.0", &mstp_clks[MSTP000]), /* MSIOF0 */
        CLKDEV_DEV_ID("uio_pdrv_genirq.4", &mstp_clks[MSTP131]), /* VEU3 */
        CLKDEV_DEV_ID("uio_pdrv_genirq.3", &mstp_clks[MSTP130]), /* VEU2 */
        CLKDEV_DEV_ID("uio_pdrv_genirq.2", &mstp_clks[MSTP129]), /* VEU1 */
@@ -629,14 +638,16 @@ static struct clk_lookup lookups[] = {
        CLKDEV_DEV_ID("sh-dma-engine.0", &mstp_clks[MSTP218]), /* DMAC1 */
        CLKDEV_DEV_ID("sh-dma-engine.1", &mstp_clks[MSTP217]), /* DMAC2 */
        CLKDEV_DEV_ID("sh-dma-engine.2", &mstp_clks[MSTP216]), /* DMAC3 */
+        CLKDEV_DEV_ID("sh-dma-engine.3", &mstp_clks[MSTP214]), /* USB-DMAC0 */
+        CLKDEV_DEV_ID("spi_sh_msiof.1", &mstp_clks[MSTP208]), /* MSIOF1 */
        CLKDEV_DEV_ID("sh-sci.5", &mstp_clks[MSTP207]), /* SCIFA5 */
        CLKDEV_DEV_ID("sh-sci.6", &mstp_clks[MSTP206]), /* SCIFB */
+        CLKDEV_DEV_ID("spi_sh_msiof.2", &mstp_clks[MSTP205]), /* MSIOF2 */
        CLKDEV_DEV_ID("sh-sci.0", &mstp_clks[MSTP204]), /* SCIFA0 */
        CLKDEV_DEV_ID("sh-sci.1", &mstp_clks[MSTP203]), /* SCIFA1 */
        CLKDEV_DEV_ID("sh-sci.2", &mstp_clks[MSTP202]), /* SCIFA2 */
        CLKDEV_DEV_ID("sh-sci.3", &mstp_clks[MSTP201]), /* SCIFA3 */
        CLKDEV_DEV_ID("sh-sci.4", &mstp_clks[MSTP200]), /* SCIFA4 */
-        CLKDEV_DEV_ID("sh_cmt.10", &mstp_clks[MSTP329]), /* CMT10 */
        CLKDEV_DEV_ID("sh_fsi2", &mstp_clks[MSTP328]), /* FSI2 */
        CLKDEV_DEV_ID("i2c-sh_mobile.1", &mstp_clks[MSTP323]), /* IIC1 */
        CLKDEV_DEV_ID("r8a66597_hcd.0", &mstp_clks[MSTP322]), /* USB0 */
@@ -650,10 +661,14 @@ static struct clk_lookup lookups[] = {
        CLKDEV_DEV_ID("sh-mobile-hdmi", &mstp_clks[MSTP413]), /* HDMI */
        CLKDEV_DEV_ID("i2c-sh_mobile.3", &mstp_clks[MSTP411]), /* IIC3 */
        CLKDEV_DEV_ID("i2c-sh_mobile.4", &mstp_clks[MSTP410]), /* IIC4 */
+        CLKDEV_DEV_ID("sh-dma-engine.4", &mstp_clks[MSTP407]), /* USB-DMAC1 */
        CLKDEV_DEV_ID("r8a66597_hcd.1", &mstp_clks[MSTP406]), /* USB1 */
        CLKDEV_DEV_ID("r8a66597_udc.1", &mstp_clks[MSTP406]), /* USB1 */
        CLKDEV_DEV_ID("renesas_usbhs.1", &mstp_clks[MSTP406]), /* USB1 */
+        CLKDEV_DEV_ID("sh_cmt.4", &mstp_clks[MSTP405]), /* CMT4 */
+        CLKDEV_DEV_ID("sh_cmt.3", &mstp_clks[MSTP404]), /* CMT3 */
        CLKDEV_DEV_ID("sh_keysc.0", &mstp_clks[MSTP403]), /* KEYSC */
+        CLKDEV_DEV_ID("sh_cmt.2", &mstp_clks[MSTP400]), /* CMT2 */
        CLKDEV_ICK_ID("hdmi", "sh_mobile_lcdc_fb.1",
                      &div6_reparent_clks[DIV6_HDMI]),
diff --git a/arch/arm/mach-shmobile/clock-sh73a0.c b/arch/arm/mach-shmobile/clock-sh73a0.c
index 6db2ccabc2bf..61a846bb30f2 100644
--- a/arch/arm/mach-shmobile/clock-sh73a0.c
+++ b/arch/arm/mach-shmobile/clock-sh73a0.c
@@ -365,7 +365,7 @@ void __init sh73a0_clock_init(void)
        __raw_writel(0x108, SD2CKCR);
        /* detect main clock parent */
-        switch ((__raw_readl(CKSCR) >> 24) & 0x03) {
+        switch ((__raw_readl(CKSCR) >> 28) & 0x03) {
        case 0:
                main_clk.parent = &sh73a0_extal1_clk;
                break;
diff --git a/arch/arm/mach-shmobile/include/mach/sh7372.h b/arch/arm/mach-shmobile/include/mach/sh7372.h
index 713cd2111e85..efc984c4cef3 100644
--- a/arch/arm/mach-shmobile/include/mach/sh7372.h
+++ b/arch/arm/mach-shmobile/include/mach/sh7372.h
@@ -459,6 +459,10 @@ enum {
        SHDMA_SLAVE_SDHI2_TX,
        SHDMA_SLAVE_MMCIF_RX,
        SHDMA_SLAVE_MMCIF_TX,
+        SHDMA_SLAVE_USB0_TX,
+        SHDMA_SLAVE_USB0_RX,
+        SHDMA_SLAVE_USB1_TX,
+        SHDMA_SLAVE_USB1_RX,
 };
 extern struct clk sh7372_extal1_clk;
diff --git a/arch/arm/mach-shmobile/intc-sh7372.c b/arch/arm/mach-shmobile/intc-sh7372.c
index 3b28743c77eb..739315e30eb9 100644
--- a/arch/arm/mach-shmobile/intc-sh7372.c
+++ b/arch/arm/mach-shmobile/intc-sh7372.c
@@ -379,7 +379,7 @@ enum {
        /* BBIF2 */
        VPU,
        TSIF1,
-        _3DG_SGX530,
+        /* 3DG */
        _2DDMAC,
        IIC2_ALI2, IIC2_TACKI2, IIC2_WAITI2, IIC2_DTEI2,
        IPMMU_IPMMUR, IPMMU_IPMMUR2,
@@ -436,7 +436,7 @@ static struct intc_vect intcs_vectors[] = {
        /* BBIF2 */
        INTCS_VECT(VPU, 0x980),
        INTCS_VECT(TSIF1, 0x9a0),
-        INTCS_VECT(_3DG_SGX530, 0x9e0),
+        /* 3DG */
        INTCS_VECT(_2DDMAC, 0xa00),
        INTCS_VECT(IIC2_ALI2, 0xa80), INTCS_VECT(IIC2_TACKI2, 0xaa0),
        INTCS_VECT(IIC2_WAITI2, 0xac0), INTCS_VECT(IIC2_DTEI2, 0xae0),
@@ -521,7 +521,7 @@ static struct intc_mask_reg intcs_mask_registers[] = {
            RTDMAC_1_DEI3, RTDMAC_1_DEI2, RTDMAC_1_DEI1, RTDMAC_1_DEI0 } },
        { 0xffd20198, 0xffd201d8, 8, /* IMR6SA / IMCR6SA */
          { 0, 0, MSIOF, 0,
-            _3DG_SGX530, 0, 0, 0 } },
+            0, 0, 0, 0 } },
        { 0xffd2019c, 0xffd201dc, 8, /* IMR7SA / IMCR7SA */
          { 0, TMU_TUNI2, TMU_TUNI1, TMU_TUNI0,
            0, 0, 0, 0 } },
@@ -561,7 +561,6 @@ static struct intc_prio_reg intcs_prio_registers[] = {
                                              TMU_TUNI2, TSIF1 } },
        { 0xffd2001c, 0, 16, 4, /* IPRHS */ { 0, 0, VEU, BEU } },
        { 0xffd20020, 0, 16, 4, /* IPRIS */ { 0, MSIOF, TSIF0, IIC0 } },
-        { 0xffd20024, 0, 16, 4, /* IPRJS */ { 0, _3DG_SGX530, 0, 0 } },
        { 0xffd20028, 0, 16, 4, /* IPRKS */ { 0, 0, LMB, 0 } },
        { 0xffd2002c, 0, 16, 4, /* IPRLS */ { IPMMU, 0, 0, 0 } },
        { 0xffd20030, 0, 16, 4, /* IPRMS */ { IIC2, 0, 0, 0 } },
diff --git a/arch/arm/mach-shmobile/setup-sh7372.c b/arch/arm/mach-shmobile/setup-sh7372.c
index a12ee41f5c03..d317c224ed63 100644
--- a/arch/arm/mach-shmobile/setup-sh7372.c
+++ b/arch/arm/mach-shmobile/setup-sh7372.c
@@ -170,35 +170,35 @@ static struct platform_device scif6_device = {
 };
 /* CMT */
-static struct sh_timer_config cmt10_platform_data = {
+static struct sh_timer_config cmt2_platform_data = {
-        .name = "CMT10",
+        .name = "CMT2",
-        .channel_offset = 0x10,
+        .channel_offset = 0x40,
-        .timer_bit = 0,
+        .timer_bit = 5,
        .clockevent_rating = 125,
        .clocksource_rating = 125,
 };
-static struct resource cmt10_resources[] = {
+static struct resource cmt2_resources[] = {
        [0] = {
-                .name   = "CMT10",
+                .name   = "CMT2",
-                .start  = 0xe6138010,
+                .start  = 0xe6130040,
-                .end    = 0xe613801b,
+                .end    = 0xe613004b,
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
-                .start  = evt2irq(0x0b00), /* CMT1_CMT10 */
+                .start  = evt2irq(0x0b80), /* CMT2 */
                .flags  = IORESOURCE_IRQ,
        },
 };
-static struct platform_device cmt10_device = {
+static struct platform_device cmt2_device = {
        .name           = "sh_cmt",
-        .id             = 10,
+        .id             = 2,
        .dev = {
-                .platform_data  = &cmt10_platform_data,
+                .platform_data  = &cmt2_platform_data,
        },
-        .resource       = cmt10_resources,
+        .resource       = cmt2_resources,
-        .num_resources  = ARRAY_SIZE(cmt10_resources),
+        .num_resources  = ARRAY_SIZE(cmt2_resources),
 };
 /* TMU */
@@ -603,6 +603,150 @@ static struct platform_device dma2_device = {
        },
 };
+/*
+ * USB-DMAC
+ */
+unsigned int usbts_shift[] = {3, 4, 5};
+enum {
+        XMIT_SZ_8BYTE           = 0,
+        XMIT_SZ_16BYTE          = 1,
+        XMIT_SZ_32BYTE          = 2,
+};
+#define USBTS_INDEX2VAL(i) (((i) & 3) << 6)
+static const struct sh_dmae_channel sh7372_usb_dmae_channels[] = {
+        {
+                .offset = 0,
+        }, {
+                .offset = 0x20,
+        },
+};
+/* USB DMAC0 */
+static const struct sh_dmae_slave_config sh7372_usb_dmae0_slaves[] = {
+        {
+                .slave_id       = SHDMA_SLAVE_USB0_TX,
+                .chcr           = USBTS_INDEX2VAL(XMIT_SZ_8BYTE),
+        }, {
+                .slave_id       = SHDMA_SLAVE_USB0_RX,
+                .chcr           = USBTS_INDEX2VAL(XMIT_SZ_8BYTE),
+        },
+};
+static struct sh_dmae_pdata usb_dma0_platform_data = {
+        .slave          = sh7372_usb_dmae0_slaves,
+        .slave_num      = ARRAY_SIZE(sh7372_usb_dmae0_slaves),
+        .channel        = sh7372_usb_dmae_channels,
+        .channel_num    = ARRAY_SIZE(sh7372_usb_dmae_channels),
+        .ts_low_shift   = 6,
+        .ts_low_mask    = 0xc0,
+        .ts_high_shift  = 0,
+        .ts_high_mask   = 0,
+        .ts_shift       = usbts_shift,
+        .ts_shift_num   = ARRAY_SIZE(usbts_shift),
+        .dmaor_init     = DMAOR_DME,
+        .chcr_offset    = 0x14,
+        .chcr_ie_bit    = 1 << 5,
+        .dmaor_is_32bit = 1,
+        .needs_tend_set = 1,
+        .no_dmars       = 1,
+};
+static struct resource sh7372_usb_dmae0_resources[] = {
+        {
+                /* Channel registers and DMAOR */
+                .start  = 0xe68a0020,
+                .end    = 0xe68a0064 - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        {
+                /* VCR/SWR/DMICR */
+                .start  = 0xe68a0000,
+                .end    = 0xe68a0014 - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        {
+                /* IRQ for channels */
+                .start  = evt2irq(0x0a00),
+                .end    = evt2irq(0x0a00),
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device usb_dma0_device = {
+        .name           = "sh-dma-engine",
+        .id             = 3,
+        .resource       = sh7372_usb_dmae0_resources,
+        .num_resources  = ARRAY_SIZE(sh7372_usb_dmae0_resources),
+        .dev            = {
+                .platform_data  = &usb_dma0_platform_data,
+        },
+};
+/* USB DMAC1 */
+static const struct sh_dmae_slave_config sh7372_usb_dmae1_slaves[] = {
+        {
+                .slave_id       = SHDMA_SLAVE_USB1_TX,
+                .chcr           = USBTS_INDEX2VAL(XMIT_SZ_8BYTE),
+        }, {
+                .slave_id       = SHDMA_SLAVE_USB1_RX,
+                .chcr           = USBTS_INDEX2VAL(XMIT_SZ_8BYTE),
+        },
+};
+static struct sh_dmae_pdata usb_dma1_platform_data = {
+        .slave          = sh7372_usb_dmae1_slaves,
+        .slave_num      = ARRAY_SIZE(sh7372_usb_dmae1_slaves),
+        .channel        = sh7372_usb_dmae_channels,
+        .channel_num    = ARRAY_SIZE(sh7372_usb_dmae_channels),
+        .ts_low_shift   = 6,
+        .ts_low_mask    = 0xc0,
+        .ts_high_shift  = 0,
+        .ts_high_mask   = 0,
+        .ts_shift       = usbts_shift,
+        .ts_shift_num   = ARRAY_SIZE(usbts_shift),
+        .dmaor_init     = DMAOR_DME,
+        .chcr_offset    = 0x14,
+        .chcr_ie_bit    = 1 << 5,
+        .dmaor_is_32bit = 1,
+        .needs_tend_set = 1,
+        .no_dmars       = 1,
+};
+static struct resource sh7372_usb_dmae1_resources[] = {
+        {
+                /* Channel registers and DMAOR */
+                .start  = 0xe68c0020,
+                .end    = 0xe68c0064 - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        {
+                /* VCR/SWR/DMICR */
+                .start  = 0xe68c0000,
+                .end    = 0xe68c0014 - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        {
+                /* IRQ for channels */
+                .start  = evt2irq(0x1d00),
+                .end    = evt2irq(0x1d00),
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device usb_dma1_device = {
+        .name           = "sh-dma-engine",
+        .id             = 4,
+        .resource       = sh7372_usb_dmae1_resources,
+        .num_resources  = ARRAY_SIZE(sh7372_usb_dmae1_resources),
+        .dev            = {
+                .platform_data  = &usb_dma1_platform_data,
+        },
+};
 /* VPU */
 static struct uio_info vpu_platform_data = {
        .name = "VPU5HG",
@@ -819,7 +963,7 @@ static struct platform_device *sh7372_early_devices[] __initdata = {
        &scif4_device,
        &scif5_device,
        &scif6_device,
-        &cmt10_device,
+        &cmt2_device,
        &tmu00_device,
        &tmu01_device,
 };
@@ -830,6 +974,8 @@ static struct platform_device *sh7372_late_devices[] __initdata = {
        &dma0_device,
        &dma1_device,
        &dma2_device,
+        &usb_dma0_device,
+        &usb_dma1_device,
        &vpu_device,
        &veu0_device,
        &veu1_device,
diff --git a/arch/arm/mach-vexpress/v2m.c b/arch/arm/mach-vexpress/v2m.c
index 9e6b93b1a043..d0d267a8d3f9 100644
--- a/arch/arm/mach-vexpress/v2m.c
+++ b/arch/arm/mach-vexpress/v2m.c
@@ -318,6 +318,10 @@ static struct clk v2m_sp804_clk = {
        .rate   = 1000000,
 };
+static struct clk v2m_ref_clk = {
+        .rate   = 32768,
+};
 static struct clk dummy_apb_pclk;
 static struct clk_lookup v2m_lookups[] = {
@@ -348,6 +352,9 @@ static struct clk_lookup v2m_lookups[] = {
        }, {    /* CLCD */
                .dev_id         = "mb:clcd",
                .clk            = &osc1_clk,
+        }, {    /* SP805 WDT */
+                .dev_id         = "mb:wdt",
+                .clk            = &v2m_ref_clk,
        }, {    /* SP804 timers */
                .dev_id         = "sp804",
                .con_id         = "v2m-timer0",
diff --git a/arch/arm/mm/abort-macro.S b/arch/arm/mm/abort-macro.S
index 52162d59407a..2cbf68ef0e83 100644
--- a/arch/arm/mm/abort-macro.S
+++ b/arch/arm/mm/abort-macro.S
@@ -17,7 +17,7 @@
        cmp     \tmp, # 0x5600                  @ Is it ldrsb?
        orreq   \tmp, \tmp, #1 << 11            @ Set L-bit if yes
        tst     \tmp, #1 << 11                  @ L = 0 -> write
-        orreq   \psr, \psr, #1 << 11            @ yes.
+        orreq   \fsr, \fsr, #1 << 11            @ yes.
        b       do_DataAbort
 not_thumb:
        .endm
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index 44c086710d2b..9ecfdb511951 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -277,6 +277,25 @@ static void l2x0_disable(void)
        spin_unlock_irqrestore(&l2x0_lock, flags);
 }
+static void __init l2x0_unlock(__u32 cache_id)
+{
+        int lockregs;
+        int i;
+        if (cache_id == L2X0_CACHE_ID_PART_L310)
+                lockregs = 8;
+        else
+                /* L210 and unknown types */
+                lockregs = 1;
+        for (i = 0; i < lockregs; i++) {
+                writel_relaxed(0x0, l2x0_base + L2X0_LOCKDOWN_WAY_D_BASE +
+                               i * L2X0_LOCKDOWN_STRIDE);
+                writel_relaxed(0x0, l2x0_base + L2X0_LOCKDOWN_WAY_I_BASE +
+                               i * L2X0_LOCKDOWN_STRIDE);
+        }
+}
 void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask)
 {
        __u32 aux;
@@ -328,6 +347,8 @@ void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask)
         * accessing the below registers will fault.
         */
        if (!(readl_relaxed(l2x0_base + L2X0_CTRL) & 1)) {
+                /* Make sure that I&D is not locked down when starting */
+                l2x0_unlock(cache_id);
                /* l2x0 controller is disabled */
                writel_relaxed(aux, l2x0_base + L2X0_AUX_CTRL);
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 91bca355cd31..cc7e2d8be9aa 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -298,7 +298,7 @@ static void __init arm_bootmem_free(unsigned long min, unsigned long max_low,
 #ifdef CONFIG_HAVE_ARCH_PFN_VALID
 int pfn_valid(unsigned long pfn)
 {
-        return memblock_is_memory(pfn << PAGE_SHIFT);
+        return memblock_is_memory(__pfn_to_phys(pfn));
 }
 EXPORT_SYMBOL(pfn_valid);
 #endif
diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
index 92bd102e3982..2e6849b41f66 100644
--- a/arch/arm/mm/proc-arm920.S
+++ b/arch/arm/mm/proc-arm920.S
@@ -379,7 +379,7 @@ ENTRY(cpu_arm920_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm920_suspend_size
-.equ    cpu_arm920_suspend_size, 4 * 3
+.equ    cpu_arm920_suspend_size, 4 * 4
 #ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_arm920_do_suspend)
        stmfd   sp!, {r4 - r7, lr}
diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
index 2bbcf053dffd..cd8f79c3a282 100644
--- a/arch/arm/mm/proc-arm926.S
+++ b/arch/arm/mm/proc-arm926.S
@@ -394,7 +394,7 @@ ENTRY(cpu_arm926_set_pte_ext)
 /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
 .globl  cpu_arm926_suspend_size
-.equ    cpu_arm926_suspend_size, 4 * 3
+.equ    cpu_arm926_suspend_size, 4 * 4
 #ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_arm926_do_suspend)
        stmfd   sp!, {r4 - r7, lr}
diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
index 07219c2ae114..69e7f2ef7384 100644
--- a/arch/arm/mm/proc-sa1100.S
+++ b/arch/arm/mm/proc-sa1100.S
@@ -182,11 +182,11 @@ ENDPROC(cpu_sa1100_do_suspend)
 ENTRY(cpu_sa1100_do_resume)
        ldmia   r0, {r4 - r7}                   @ load cp regs
-        mov     r1, #0
+        mov     ip, #0
-        mcr     p15, 0, r1, c8, c7, 0           @ flush I+D TLBs
+        mcr     p15, 0, ip, c8, c7, 0           @ flush I+D TLBs
-        mcr     p15, 0, r1, c7, c7, 0           @ flush I&D cache
+        mcr     p15, 0, ip, c7, c7, 0           @ flush I&D cache
-        mcr     p15, 0, r1, c9, c0, 0           @ invalidate RB
+        mcr     p15, 0, ip, c9, c0, 0           @ invalidate RB
-        mcr     p15, 0, r1, c9, c0, 5           @ allow user space to use RB
+        mcr     p15, 0, ip, c9, c0, 5           @ allow user space to use RB
        mcr     p15, 0, r4, c3, c0, 0           @ domain ID
        mcr     p15, 0, r5, c2, c0, 0           @ translation table base addr
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index 219138d2f158..a923aa0fd00d 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -223,6 +223,22 @@ __v6_setup:
        mrc     p15, 0, r0, c1, c0, 0           @ read control register
        bic     r0, r0, r5                      @ clear bits them
        orr     r0, r0, r6                      @ set them
+#ifdef CONFIG_ARM_ERRATA_364296
+        /*
+         * Workaround for the 364296 ARM1136 r0p2 erratum (possible cache data
+         * corruption with hit-under-miss enabled). The conditional code below
+         * (setting the undocumented bit 31 in the auxiliary control register
+         * and the FI bit in the control register) disables hit-under-miss
+         * without putting the processor into full low interrupt latency mode.
+         */
+        ldr     r6, =0x4107b362                 @ id for ARM1136 r0p2
+        mrc     p15, 0, r5, c0, c0, 0           @ get processor id
+        teq     r5, r6                          @ check for the faulty core
+        mrceq   p15, 0, r5, c1, c0, 1           @ load aux control reg
+        orreq   r5, r5, #(1 << 31)              @ set the undocumented bit 31
+        mcreq   p15, 0, r5, c1, c0, 1           @ write aux control reg
+        orreq   r0, r0, #(1 << 21)              @ low interrupt latency configuration
+#endif
        mov     pc, lr                          @ return to head.S:__ret
        /*
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index a30e78542ccf..9049c0764db2 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -66,6 +66,7 @@ ENDPROC(cpu_v7_proc_fin)
 ENTRY(cpu_v7_reset)
        mrc     p15, 0, r1, c1, c0, 0           @ ctrl register
        bic     r1, r1, #0x1                    @ ...............m
+ THUMB( bic     r1, r1, #1 << 30 )              @ SCTLR.TE (Thumb exceptions)
        mcr     p15, 0, r1, c1, c0, 0           @ disable MMU
        isb
        mov     pc, r0
@@ -247,13 +248,16 @@ ENTRY(cpu_v7_do_resume)
        mcr     p15, 0, r7, c2, c0, 0   @ TTB 0
        mcr     p15, 0, r8, c2, c0, 1   @ TTB 1
        mcr     p15, 0, ip, c2, c0, 2   @ TTB control register
-        mcr     p15, 0, r10, c1, c0, 1  @ Auxiliary control register
+        mrc     p15, 0, r4, c1, c0, 1   @ Read Auxiliary control register
+        teq     r4, r10                 @ Is it already set?
+        mcrne   p15, 0, r10, c1, c0, 1  @ No, so write it
        mcr     p15, 0, r11, c1, c0, 2  @ Co-processor access control
        ldr     r4, =PRRR               @ PRRR
        ldr     r5, =NMRR               @ NMRR
        mcr     p15, 0, r4, c10, c2, 0  @ write PRRR
        mcr     p15, 0, r5, c10, c2, 1  @ write NMRR
        isb
+        dsb
        mov     r0, r9                  @ control register
        mov     r2, r7, lsr #14         @ get TTB0 base
        mov     r2, r2, lsl #14
diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
index 28c72a2006a1..755e1bf22681 100644
--- a/arch/arm/mm/proc-xsc3.S
+++ b/arch/arm/mm/proc-xsc3.S
@@ -406,7 +406,7 @@ ENTRY(cpu_xsc3_set_pte_ext)
        .align
 .globl  cpu_xsc3_suspend_size
-.equ    cpu_xsc3_suspend_size, 4 * 8
+.equ    cpu_xsc3_suspend_size, 4 * 7
 #ifdef CONFIG_PM_SLEEP
 ENTRY(cpu_xsc3_do_suspend)
        stmfd   sp!, {r4 - r10, lr}
@@ -418,12 +418,12 @@ ENTRY(cpu_xsc3_do_suspend)
        mrc     p15, 0, r9, c1, c0, 1   @ auxiliary control reg
        mrc     p15, 0, r10, c1, c0, 0  @ control reg
        bic     r4, r4, #2              @ clear frequency change bit
-        stmia   r0, {r1, r4 - r10}      @ store v:p offset + cp regs
+        stmia   r0, {r4 - r10}          @ store cp regs
        ldmia   sp!, {r4 - r10, pc}
 ENDPROC(cpu_xsc3_do_suspend)
 ENTRY(cpu_xsc3_do_resume)
-        ldmia   r0, {r1, r4 - r10}      @ load v:p offset + cp regs
+        ldmia   r0, {r4 - r10}          @ load cp regs
        mov     ip, #0
        mcr     p15, 0, ip, c7, c7, 0   @ invalidate I & D caches, BTB
        mcr     p15, 0, ip, c7, c10, 4  @ drain write (&fill) buffer
diff --git a/arch/arm/plat-omap/omap_device.c b/arch/arm/plat-omap/omap_device.c
index 9a6a53854911..02609eee0562 100644
--- a/arch/arm/plat-omap/omap_device.c
+++ b/arch/arm/plat-omap/omap_device.c
@@ -615,6 +615,9 @@ static int _od_resume_noirq(struct device *dev)
        return pm_generic_resume_noirq(dev);
 }
+#else
+#define _od_suspend_noirq NULL
+#define _od_resume_noirq NULL
 #endif
 static struct dev_pm_domain omap_device_pm_domain = {
diff --git a/arch/arm/plat-s5p/clock.c b/arch/arm/plat-s5p/clock.c
index 02af235298e2..5f84a3f13ef9 100644
--- a/arch/arm/plat-s5p/clock.c
+++ b/arch/arm/plat-s5p/clock.c
@@ -192,7 +192,7 @@ unsigned long s5p_spdif_get_rate(struct clk *clk)
        if (IS_ERR(pclk))
                return -EINVAL;
-        rate = pclk->ops->get_rate(clk);
+        rate = pclk->ops->get_rate(pclk);
        clk_put(pclk);
        return rate;
diff --git a/arch/arm/plat-s5p/irq-gpioint.c b/arch/arm/plat-s5p/irq-gpioint.c
index 327ab9f662e8..f71078ef6bb5 100644
--- a/arch/arm/plat-s5p/irq-gpioint.c
+++ b/arch/arm/plat-s5p/irq-gpioint.c
@@ -23,6 +23,8 @@
 #include <plat/gpio-core.h>
 #include <plat/gpio-cfg.h>
+#include <asm/mach/irq.h>
 #define GPIO_BASE(chip)         (((unsigned long)(chip)->base) & 0xFFFFF000u)
 #define CON_OFFSET              0x700
@@ -81,6 +83,9 @@ static void s5p_gpioint_handler(unsigned int irq, struct irq_desc *desc)
        int group, pend_offset, mask_offset;
        unsigned int pend, mask;
+        struct irq_chip *chip = irq_get_chip(irq);
+        chained_irq_enter(chip, desc);
        for (group = 0; group < bank->nr_groups; group++) {
                struct s3c_gpio_chip *chip = bank->chips[group];
                if (!chip)
@@ -102,6 +107,7 @@ static void s5p_gpioint_handler(unsigned int irq, struct irq_desc *desc)
                        pend &= ~BIT(offset);
                }
        }
+        chained_irq_exit(chip, desc);
 }
 static __init int s5p_gpioint_add(struct s3c_gpio_chip *chip)
diff --git a/arch/arm/plat-samsung/clock.c b/arch/arm/plat-samsung/clock.c
index 302c42670bd1..3b4451979d1b 100644
--- a/arch/arm/plat-samsung/clock.c
+++ b/arch/arm/plat-samsung/clock.c
@@ -64,6 +64,17 @@ static LIST_HEAD(clocks);
 */
 DEFINE_SPINLOCK(clocks_lock);
+/* Global watchdog clock used by arch_wtd_reset() callback */
+struct clk *s3c2410_wdtclk;
+static int __init s3c_wdt_reset_init(void)
+{
+        s3c2410_wdtclk = clk_get(NULL, "watchdog");
+        if (IS_ERR(s3c2410_wdtclk))
+                printk(KERN_WARNING "%s: warning: cannot get watchdog clock\n", __func__);
+        return 0;
+}
+arch_initcall(s3c_wdt_reset_init);
 /* enable and disable calls for use with the clk struct */
 static int clk_null_enable(struct clk *clk, int enable)
diff --git a/arch/arm/plat-samsung/include/plat/backlight.h b/arch/arm/plat-samsung/include/plat/backlight.h
index 51d8da846a62..ad530c78fe8c 100644
--- a/arch/arm/plat-samsung/include/plat/backlight.h
+++ b/arch/arm/plat-samsung/include/plat/backlight.h
@@ -20,7 +20,7 @@ struct samsung_bl_gpio_info {
        int func;
 };
-extern void samsung_bl_set(struct samsung_bl_gpio_info *gpio_info,
+extern void __init samsung_bl_set(struct samsung_bl_gpio_info *gpio_info,
        struct platform_pwm_backlight_data *bl_data);
 #endif /* __ASM_PLAT_BACKLIGHT_H */
diff --git a/arch/arm/plat-samsung/include/plat/clock.h b/arch/arm/plat-samsung/include/plat/clock.h
index 87d5b38a86fb..73c66d4d10fa 100644
--- a/arch/arm/plat-samsung/include/plat/clock.h
+++ b/arch/arm/plat-samsung/include/plat/clock.h
@@ -9,6 +9,9 @@
 * published by the Free Software Foundation.
 */
+#ifndef __ASM_PLAT_CLOCK_H
+#define __ASM_PLAT_CLOCK_H __FILE__
 #include <linux/spinlock.h>
 #include <linux/clkdev.h>
@@ -121,3 +124,8 @@ extern int s3c64xx_sclk_ctrl(struct clk *clk, int enable);
 extern void s3c_pwmclk_init(void);
+/* Global watchdog clock used by arch_wtd_reset() callback */
+extern struct clk *s3c2410_wdtclk;
+#endif /* __ASM_PLAT_CLOCK_H */
diff --git a/arch/arm/plat-samsung/include/plat/watchdog-reset.h b/arch/arm/plat-samsung/include/plat/watchdog-reset.h
index 54b762acb5a0..40dbb2b0ae22 100644
--- a/arch/arm/plat-samsung/include/plat/watchdog-reset.h
+++ b/arch/arm/plat-samsung/include/plat/watchdog-reset.h
@@ -10,6 +10,7 @@
 * published by the Free Software Foundation.
 */
+#include <plat/clock.h>
 #include <plat/regs-watchdog.h>
 #include <mach/map.h>
@@ -19,17 +20,12 @@
 static inline void arch_wdt_reset(void)
 {
-        struct clk *wdtclk;
        printk("arch_reset: attempting watchdog reset\n");
        __raw_writel(0, S3C2410_WTCON);   /* disable watchdog, to be safe  */
-        wdtclk = clk_get(NULL, "watchdog");
+        if (s3c2410_wdtclk)
-        if (!IS_ERR(wdtclk)) {
+                clk_enable(s3c2410_wdtclk);
-                clk_enable(wdtclk);
-        } else
-                printk(KERN_WARNING "%s: warning: cannot get watchdog clock\n", __func__);
        /* put initial values into count and data */
        __raw_writel(0x80, S3C2410_WTCNT);
diff --git a/arch/arm/plat-samsung/irq-vic-timer.c b/arch/arm/plat-samsung/irq-vic-timer.c
index f714d060370d..51583cd30164 100644
--- a/arch/arm/plat-samsung/irq-vic-timer.c
+++ b/arch/arm/plat-samsung/irq-vic-timer.c
@@ -22,9 +22,14 @@
 #include <plat/irq-vic-timer.h>
 #include <plat/regs-timer.h>
+#include <asm/mach/irq.h>
 static void s3c_irq_demux_vic_timer(unsigned int irq, struct irq_desc *desc)
 {
+        struct irq_chip *chip = irq_get_chip(irq);
+        chained_irq_enter(chip, desc);
        generic_handle_irq((int)desc->irq_data.handler_data);
+        chained_irq_exit(chip, desc);
 }
 /* We assume the IRQ_TIMER0..IRQ_TIMER4 range is continuous. */
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index fff68d0d521b..62cc8f981171 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -351,7 +351,7 @@ centro			MACH_CENTRO		CENTRO			1944
 nokia_rx51              MACH_NOKIA_RX51         NOKIA_RX51              1955
 omap_zoom2              MACH_OMAP_ZOOM2         OMAP_ZOOM2              1967
 cpuat9260               MACH_CPUAT9260          CPUAT9260               1973
-eukrea_cpuimx27         MACH_CPUIMX27           CPUIMX27                1975
+eukrea_cpuimx27         MACH_EUKREA_CPUIMX27    EUKREA_CPUIMX27         1975
 acs5k                   MACH_ACS5K              ACS5K                   1982
 snapper_9260            MACH_SNAPPER_9260       SNAPPER_9260            1987
 dsm320                  MACH_DSM320             DSM320                  1988
@@ -476,8 +476,8 @@ cns3420vb		MACH_CNS3420VB		CNS3420VB		2776
 omap4_panda             MACH_OMAP4_PANDA        OMAP4_PANDA             2791
 ti8168evm               MACH_TI8168EVM          TI8168EVM               2800
 teton_bga               MACH_TETON_BGA          TETON_BGA               2816
-eukrea_cpuimx25sd       MACH_EUKREA_CPUIMX25    EUKREA_CPUIMX25         2820
+eukrea_cpuimx25sd       MACH_EUKREA_CPUIMX25SD  EUKREA_CPUIMX25SD       2820
-eukrea_cpuimx35sd       MACH_EUKREA_CPUIMX35    EUKREA_CPUIMX35         2821
+eukrea_cpuimx35sd       MACH_EUKREA_CPUIMX35SD  EUKREA_CPUIMX35SD       2821
 eukrea_cpuimx51sd       MACH_EUKREA_CPUIMX51SD  EUKREA_CPUIMX51SD       2822
 eukrea_cpuimx51         MACH_EUKREA_CPUIMX51    EUKREA_CPUIMX51         2823
 smdkc210                MACH_SMDKC210           SMDKC210                2838
diff --git a/arch/avr32/kernel/syscall_table.S b/arch/avr32/kernel/syscall_table.S
index c7fd394d28a4..6eba53530d1c 100644
--- a/arch/avr32/kernel/syscall_table.S
+++ b/arch/avr32/kernel/syscall_table.S
@@ -158,7 +158,7 @@ sys_call_table:
        .long   sys_sched_rr_get_interval
        .long   sys_nanosleep
        .long   sys_poll
-        .long   sys_nfsservctl          /* 145 */
+        .long   sys_ni_syscall          /* 145 was nfsservctl */
        .long   sys_setresgid
        .long   sys_getresgid
        .long   sys_prctl
diff --git a/arch/blackfin/mach-common/entry.S b/arch/blackfin/mach-common/entry.S
index 225d311c9701..e4137297b790 100644
--- a/arch/blackfin/mach-common/entry.S
+++ b/arch/blackfin/mach-common/entry.S
@@ -1543,7 +1543,7 @@ ENTRY(_sys_call_table)
        .long _sys_ni_syscall   /* for vm86 */
        .long _sys_ni_syscall   /* old "query_module" */
        .long _sys_ni_syscall   /* sys_poll */
-        .long _sys_nfsservctl
+        .long _sys_ni_syscall   /* old nfsservctl */
        .long _sys_setresgid    /* setresgid16 */       /* 170 */
        .long _sys_getresgid    /* getresgid16 */
        .long _sys_prctl
diff --git a/arch/cris/arch-v10/kernel/entry.S b/arch/cris/arch-v10/kernel/entry.S
index 1161883eb582..592fbe9dfb62 100644
--- a/arch/cris/arch-v10/kernel/entry.S
+++ b/arch/cris/arch-v10/kernel/entry.S
@@ -771,7 +771,7 @@ sys_call_table:
        .long sys_ni_syscall    /* sys_vm86 */
        .long sys_ni_syscall    /* Old sys_query_module */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall    /* old nfsservctl */
        .long sys_setresgid16   /* 170 */
        .long sys_getresgid16
        .long sys_prctl
diff --git a/arch/cris/arch-v32/kernel/entry.S b/arch/cris/arch-v32/kernel/entry.S
index 84fed7e91ada..c3ea4694fbaf 100644
--- a/arch/cris/arch-v32/kernel/entry.S
+++ b/arch/cris/arch-v32/kernel/entry.S
@@ -714,7 +714,7 @@ sys_call_table:
        .long sys_ni_syscall    /* sys_vm86 */
        .long sys_ni_syscall    /* Old sys_query_module */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall    /* Old nfsservctl */
        .long sys_setresgid16   /* 170 */
        .long sys_getresgid16
        .long sys_prctl
diff --git a/arch/cris/include/asm/serial.h b/arch/cris/include/asm/serial.h
new file mode 100644
index 000000000000..af7535a955fb
--- /dev/null
+++ b/arch/cris/include/asm/serial.h
@@ -0,0 +1,9 @@
+#ifndef _ASM_SERIAL_H
+#define _ASM_SERIAL_H
+/*
+ * This assumes you have a 1.8432 MHz clock for your UART.
+ */
+#define BASE_BAUD (1843200 / 16)
+#endif /* _ASM_SERIAL_H */
diff --git a/arch/frv/kernel/entry.S b/arch/frv/kernel/entry.S
index 017d6d7b784f..5ba23f715ea5 100644
--- a/arch/frv/kernel/entry.S
+++ b/arch/frv/kernel/entry.S
@@ -1358,7 +1358,7 @@ sys_call_table:
        .long sys_ni_syscall    /* for vm86 */
        .long sys_ni_syscall    /* Old sys_query_module */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall    /* Old nfsservctl */
        .long sys_setresgid16   /* 170 */
        .long sys_getresgid16
        .long sys_prctl
diff --git a/arch/h8300/kernel/syscalls.S b/arch/h8300/kernel/syscalls.S
index f4b2e67bcc34..4be2ea2fbe26 100644
--- a/arch/h8300/kernel/syscalls.S
+++ b/arch/h8300/kernel/syscalls.S
@@ -183,7 +183,7 @@ SYMBOL_NAME_LABEL(sys_call_table)
        .long SYMBOL_NAME(sys_ni_syscall)       /* for vm86 */
        .long SYMBOL_NAME(sys_ni_syscall)       /* sys_query_module */
        .long SYMBOL_NAME(sys_poll)
-        .long SYMBOL_NAME(sys_nfsservctl)
+        .long SYMBOL_NAME(sys_ni_syscall)       /* old nfsservctl */
        .long SYMBOL_NAME(sys_setresgid16)      /* 170 */
        .long SYMBOL_NAME(sys_getresgid16)
        .long SYMBOL_NAME(sys_prctl)
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 97dd2abdeb1a..198c753d1006 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1614,7 +1614,7 @@ sys_call_table:
        data8 sys_sched_get_priority_min
        data8 sys_sched_rr_get_interval
        data8 sys_nanosleep
-        data8 sys_nfsservctl
+        data8 sys_ni_syscall                    // old nfsservctl
        data8 sys_prctl                         // 1170
        data8 sys_getpagesize
        data8 sys_mmap2
diff --git a/arch/m32r/kernel/syscall_table.S b/arch/m32r/kernel/syscall_table.S
index 528f2e6ad064..f365c19795ef 100644
--- a/arch/m32r/kernel/syscall_table.S
+++ b/arch/m32r/kernel/syscall_table.S
@@ -168,7 +168,7 @@ ENTRY(sys_call_table)
        .long sys_tas                   /* vm86 syscall holder */
        .long sys_ni_syscall            /* query_module syscall holder */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall            /* was nfsservctl */
        .long sys_setresgid             /* 170 */
        .long sys_getresgid
        .long sys_prctl
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 00d1452f9571..c468f2edaa85 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -189,7 +189,7 @@ ENTRY(sys_call_table)
        .long sys_getpagesize
        .long sys_ni_syscall            /* old "query_module" */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall            /* old nfsservctl */
        .long sys_setresgid16           /* 170 */
        .long sys_getresgid16
        .long sys_prctl
diff --git a/arch/microblaze/kernel/syscall_table.S b/arch/microblaze/kernel/syscall_table.S
index d915a122c865..8789daa2a346 100644
--- a/arch/microblaze/kernel/syscall_table.S
+++ b/arch/microblaze/kernel/syscall_table.S
@@ -173,7 +173,7 @@ ENTRY(sys_call_table)
        .long sys_ni_syscall            /* sys_vm86 */
        .long sys_ni_syscall            /* Old sys_query_module */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall            /* old nfsservctl */
        .long sys_setresgid             /* 170 */
        .long sys_getresgid
        .long sys_prctl
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index e521420a45a5..865bc7a6f5a1 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -424,7 +424,7 @@ einval:	li	v0, -ENOSYS
        sys     sys_getresuid           3
        sys     sys_ni_syscall          0       /* was sys_query_module */
        sys     sys_poll                3
-        sys     sys_nfsservctl          3
+        sys     sys_ni_syscall          0       /* was nfsservctl */
        sys     sys_setresgid           3       /* 4190 */
        sys     sys_getresgid           3
        sys     sys_prctl               5
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 85874d6a8a70..fb7334bea731 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -299,7 +299,7 @@ sys_call_table:
        PTR     sys_ni_syscall                  /* 5170, was get_kernel_syms */
        PTR     sys_ni_syscall                  /* was query_module */
        PTR     sys_quotactl
-        PTR     sys_nfsservctl
+        PTR     sys_ni_syscall                  /* was nfsservctl */
        PTR     sys_ni_syscall                  /* res. for getpmsg */
        PTR     sys_ni_syscall                  /* 5175  for putpmsg */
        PTR     sys_ni_syscall                  /* res. for afs_syscall */
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index b85842fc87ae..f9296e894e46 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -294,7 +294,7 @@ EXPORT(sysn32_call_table)
        PTR     sys_ni_syscall                  /* 6170, was get_kernel_syms */
        PTR     sys_ni_syscall                  /* was query_module */
        PTR     sys_quotactl
-        PTR     compat_sys_nfsservctl
+        PTR     sys_ni_syscall                  /* was nfsservctl */
        PTR     sys_ni_syscall                  /* res. for getpmsg */
        PTR     sys_ni_syscall                  /* 6175  for putpmsg */
        PTR     sys_ni_syscall                  /* res. for afs_syscall */
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 46c4763edf21..4d7c9827706f 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -392,7 +392,7 @@ sys_call_table:
        PTR     sys_getresuid
        PTR     sys_ni_syscall                  /* was query_module */
        PTR     sys_poll
-        PTR     compat_sys_nfsservctl
+        PTR     sys_ni_syscall                  /* was nfsservctl */
        PTR     sys_setresgid                   /* 4190 */
        PTR     sys_getresgid
        PTR     sys_prctl
diff --git a/arch/mn10300/kernel/entry.S b/arch/mn10300/kernel/entry.S
index ae435e1d5669..3e3620d9fc45 100644
--- a/arch/mn10300/kernel/entry.S
+++ b/arch/mn10300/kernel/entry.S
@@ -589,7 +589,7 @@ ENTRY(sys_call_table)
        .long sys_ni_syscall    /* vm86 */
        .long sys_ni_syscall    /* Old sys_query_module */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall    /* was nfsservctl */
        .long sys_setresgid16   /* 170 */
        .long sys_getresgid16
        .long sys_prctl
diff --git a/arch/openrisc/include/asm/dma-mapping.h b/arch/openrisc/include/asm/dma-mapping.h
index 052f877b52a5..60b472233900 100644
--- a/arch/openrisc/include/asm/dma-mapping.h
+++ b/arch/openrisc/include/asm/dma-mapping.h
@@ -31,7 +31,6 @@
 #define DMA_ERROR_CODE          (~(dma_addr_t)0x0)
-int dma_mapping_error(struct device *dev, dma_addr_t dma_addr);
 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
@@ -47,6 +46,12 @@ dma_addr_t or1k_map_page(struct device *dev, struct page *page,
 void or1k_unmap_page(struct device *dev, dma_addr_t dma_handle,
                     size_t size, enum dma_data_direction dir,
                     struct dma_attrs *attrs);
+int or1k_map_sg(struct device *dev, struct scatterlist *sg,
+                int nents, enum dma_data_direction dir,
+                struct dma_attrs *attrs);
+void or1k_unmap_sg(struct device *dev, struct scatterlist *sg,
+                   int nents, enum dma_data_direction dir,
+                   struct dma_attrs *attrs);
 void or1k_sync_single_for_cpu(struct device *dev,
                              dma_addr_t dma_handle, size_t size,
                              enum dma_data_direction dir);
@@ -98,6 +103,51 @@ static inline void dma_unmap_single(struct device *dev, dma_addr_t addr,
        debug_dma_unmap_page(dev, addr, size, dir, true);
 }
+static inline int dma_map_sg(struct device *dev, struct scatterlist *sg,
+                                   int nents, enum dma_data_direction dir)
+{
+        int i, ents;
+        struct scatterlist *s;
+        for_each_sg(sg, s, nents, i)
+                kmemcheck_mark_initialized(sg_virt(s), s->length);
+        BUG_ON(!valid_dma_direction(dir));
+        ents = or1k_map_sg(dev, sg, nents, dir, NULL);
+        debug_dma_map_sg(dev, sg, nents, ents, dir);
+        return ents;
+}
+static inline void dma_unmap_sg(struct device *dev, struct scatterlist *sg,
+                                      int nents, enum dma_data_direction dir)
+{
+        BUG_ON(!valid_dma_direction(dir));
+        debug_dma_unmap_sg(dev, sg, nents, dir);
+        or1k_unmap_sg(dev, sg, nents, dir, NULL);
+}
+static inline dma_addr_t dma_map_page(struct device *dev, struct page *page,
+                                      size_t offset, size_t size,
+                                      enum dma_data_direction dir)
+{
+        dma_addr_t addr;
+        kmemcheck_mark_initialized(page_address(page) + offset, size);
+        BUG_ON(!valid_dma_direction(dir));
+        addr = or1k_map_page(dev, page, offset, size, dir, NULL);
+        debug_dma_map_page(dev, page, offset, size, dir, addr, false);
+        return addr;
+}
+static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
+                                  size_t size, enum dma_data_direction dir)
+{
+        BUG_ON(!valid_dma_direction(dir));
+        or1k_unmap_page(dev, addr, size, dir, NULL);
+        debug_dma_unmap_page(dev, addr, size, dir, true);
+}
 static inline void dma_sync_single_for_cpu(struct device *dev, dma_addr_t addr,
                                           size_t size,
                                           enum dma_data_direction dir)
@@ -119,7 +169,12 @@ static inline void dma_sync_single_for_device(struct device *dev,
 static inline int dma_supported(struct device *dev, u64 dma_mask)
 {
        /* Support 32 bit DMA mask exclusively */
-        return dma_mask == 0xffffffffULL;
+        return dma_mask == DMA_BIT_MASK(32);
+}
+static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
+{
+        return 0;
 }
 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
diff --git a/arch/openrisc/include/asm/sigcontext.h b/arch/openrisc/include/asm/sigcontext.h
index 54a5c50132e3..b79c2b19afbe 100644
--- a/arch/openrisc/include/asm/sigcontext.h
+++ b/arch/openrisc/include/asm/sigcontext.h
@@ -23,16 +23,11 @@
 /* This struct is saved by setup_frame in signal.c, to keep the current
   context while a signal handler is executed. It's restored by sys_sigreturn.
-   To keep things simple, we use pt_regs here even though normally you just
-   specify the list of regs to save. Then we can use copy_from_user on the
-   entire regs instead of a bunch of get_user's as well...
 */
 struct sigcontext {
-        struct pt_regs regs;  /* needs to be first */
+        struct user_regs_struct regs;  /* needs to be first */
        unsigned long oldmask;
-        unsigned long usp;    /* usp before stacking this gunk on it */
 };
 #endif /* __ASM_OPENRISC_SIGCONTEXT_H */
diff --git a/arch/openrisc/kernel/dma.c b/arch/openrisc/kernel/dma.c
index 968d3ee477e3..f1c8ee2895d0 100644
--- a/arch/openrisc/kernel/dma.c
+++ b/arch/openrisc/kernel/dma.c
@@ -154,6 +154,33 @@ void or1k_unmap_page(struct device *dev, dma_addr_t dma_handle,
        /* Nothing special to do here... */
 }
+int or1k_map_sg(struct device *dev, struct scatterlist *sg,
+                int nents, enum dma_data_direction dir,
+                struct dma_attrs *attrs)
+{
+        struct scatterlist *s;
+        int i;
+        for_each_sg(sg, s, nents, i) {
+                s->dma_address = or1k_map_page(dev, sg_page(s), s->offset,
+                                               s->length, dir, NULL);
+        }
+        return nents;
+}
+void or1k_unmap_sg(struct device *dev, struct scatterlist *sg,
+                   int nents, enum dma_data_direction dir,
+                   struct dma_attrs *attrs)
+{
+        struct scatterlist *s;
+        int i;
+        for_each_sg(sg, s, nents, i) {
+                or1k_unmap_page(dev, sg_dma_address(s), sg_dma_len(s), dir, NULL);
+        }
+}
 void or1k_sync_single_for_cpu(struct device *dev,
                              dma_addr_t dma_handle, size_t size,
                              enum dma_data_direction dir)
@@ -187,5 +214,4 @@ static int __init dma_init(void)
        return 0;
 }
 fs_initcall(dma_init);
diff --git a/arch/openrisc/kernel/signal.c b/arch/openrisc/kernel/signal.c
index 5f759c76834e..95207ab0c99e 100644
--- a/arch/openrisc/kernel/signal.c
+++ b/arch/openrisc/kernel/signal.c
@@ -52,31 +52,25 @@ struct rt_sigframe {
 static int restore_sigcontext(struct pt_regs *regs, struct sigcontext *sc)
 {
        unsigned int err = 0;
-        unsigned long old_usp;
        /* Alwys make any pending restarted system call return -EINTR */
        current_thread_info()->restart_block.fn = do_no_restart_syscall;
-        /* restore the regs from &sc->regs (same as sc, since regs is first)
+        /*
+         * Restore the regs from &sc->regs.
         * (sc is already checked for VERIFY_READ since the sigframe was
         *  checked in sys_sigreturn previously)
         */
+        if (__copy_from_user(regs, sc->regs.gpr, 32 * sizeof(unsigned long)))
-        if (__copy_from_user(regs, sc, sizeof(struct pt_regs)))
+                goto badframe;
+        if (__copy_from_user(&regs->pc, &sc->regs.pc, sizeof(unsigned long)))
+                goto badframe;
+        if (__copy_from_user(&regs->sr, &sc->regs.sr, sizeof(unsigned long)))
                goto badframe;
        /* make sure the SM-bit is cleared so user-mode cannot fool us */
        regs->sr &= ~SPR_SR_SM;
-        /* restore the old USP as it was before we stacked the sc etc.
-         * (we cannot just pop the sigcontext since we aligned the sp and
-         *  stuff after pushing it)
-         */
-        err |= __get_user(old_usp, &sc->usp);
-        regs->sp = old_usp;
        /* TODO: the other ports use regs->orig_XX to disable syscall checks
         * after this completes, but we don't use that mechanism. maybe we can
         * use it now ?
@@ -137,18 +131,17 @@ static int setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs,
                            unsigned long mask)
 {
        int err = 0;
-        unsigned long usp = regs->sp;
-        /* copy the regs. they are first in sc so we can use sc directly */
+        /* copy the regs */
-        err |= __copy_to_user(sc, regs, sizeof(struct pt_regs));
+        err |= __copy_to_user(sc->regs.gpr, regs, 32 * sizeof(unsigned long));
+        err |= __copy_to_user(&sc->regs.pc, &regs->pc, sizeof(unsigned long));
+        err |= __copy_to_user(&sc->regs.sr, &regs->sr, sizeof(unsigned long));
        /* then some other stuff */
        err |= __put_user(mask, &sc->oldmask);
-        err |= __put_user(usp, &sc->usp);
        return err;
 }
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index e66366fd2abc..3735abd7f8f6 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -259,7 +259,7 @@
        ENTRY_SAME(ni_syscall)          /* query_module */
        ENTRY_SAME(poll)
        /* structs contain pointers and an in_addr... */
-        ENTRY_COMP(nfsservctl)
+        ENTRY_SAME(ni_syscall)          /* was nfsservctl */
        ENTRY_SAME(setresgid)           /* 170 */
        ENTRY_SAME(getresgid)
        ENTRY_SAME(prctl)
diff --git a/arch/powerpc/boot/dts/p1023rds.dts b/arch/powerpc/boot/dts/p1023rds.dts
index bfa96aa8f2ca..d9b776740a67 100644
--- a/arch/powerpc/boot/dts/p1023rds.dts
+++ b/arch/powerpc/boot/dts/p1023rds.dts
@@ -387,7 +387,7 @@
                        #size-cells = <1>;
                        compatible = "cfi-flash";
                        reg = <0x0 0x0 0x02000000>;
-                        bank-width = <1>;
+                        bank-width = <2>;
                        device-width = <1>;
                        partition@0 {
                                label = "ramdisk";
diff --git a/arch/powerpc/configs/85xx/p1023rds_defconfig b/arch/powerpc/configs/85xx/p1023rds_defconfig
index 980ff8f61fd4..3ff5a81c709f 100644
--- a/arch/powerpc/configs/85xx/p1023rds_defconfig
+++ b/arch/powerpc/configs/85xx/p1023rds_defconfig
@@ -171,3 +171,4 @@ CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
 CONFIG_CRYPTO_AES=y
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
+CONFIG_CRYPTO_DEV_FSL_CAAM=y
diff --git a/arch/powerpc/configs/corenet32_smp_defconfig b/arch/powerpc/configs/corenet32_smp_defconfig
index 10562a5c65b9..4311d02a3bfd 100644
--- a/arch/powerpc/configs/corenet32_smp_defconfig
+++ b/arch/powerpc/configs/corenet32_smp_defconfig
@@ -185,3 +185,4 @@ CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
 CONFIG_CRYPTO_AES=y
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
+CONFIG_CRYPTO_DEV_FSL_CAAM=y
diff --git a/arch/powerpc/configs/corenet64_smp_defconfig b/arch/powerpc/configs/corenet64_smp_defconfig
index d32283555b53..c92c204a204b 100644
--- a/arch/powerpc/configs/corenet64_smp_defconfig
+++ b/arch/powerpc/configs/corenet64_smp_defconfig
@@ -100,5 +100,8 @@ CONFIG_DEBUG_INFO=y
 CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_VIRQ_DEBUG=y
 CONFIG_CRYPTO_PCBC=m
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_AES=y
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
-CONFIG_CRYPTO_DEV_TALITOS=y
+CONFIG_CRYPTO_DEV_FSL_CAAM=y
diff --git a/arch/powerpc/configs/mpc85xx_defconfig b/arch/powerpc/configs/mpc85xx_defconfig
index fcd85d2c72dc..a3467bfb7671 100644
--- a/arch/powerpc/configs/mpc85xx_defconfig
+++ b/arch/powerpc/configs/mpc85xx_defconfig
@@ -139,6 +139,7 @@ CONFIG_SND=y
 CONFIG_SND_INTEL8X0=y
 # CONFIG_SND_PPC is not set
 # CONFIG_SND_USB is not set
+CONFIG_SND_SOC=y
 CONFIG_HID_A4TECH=y
 CONFIG_HID_APPLE=y
 CONFIG_HID_BELKIN=y
diff --git a/arch/powerpc/configs/mpc85xx_smp_defconfig b/arch/powerpc/configs/mpc85xx_smp_defconfig
index 908c941fc24c..9693f6ed3da0 100644
--- a/arch/powerpc/configs/mpc85xx_smp_defconfig
+++ b/arch/powerpc/configs/mpc85xx_smp_defconfig
@@ -140,6 +140,7 @@ CONFIG_SND=y
 CONFIG_SND_INTEL8X0=y
 # CONFIG_SND_PPC is not set
 # CONFIG_SND_USB is not set
+CONFIG_SND_SOC=y
 CONFIG_HID_A4TECH=y
 CONFIG_HID_APPLE=y
 CONFIG_HID_BELKIN=y
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index f6736b7da463..fa0d27a400de 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -171,7 +171,7 @@ SYSCALL_SPU(setresuid)
 SYSCALL_SPU(getresuid)
 SYSCALL(ni_syscall)
 SYSCALL_SPU(poll)
-COMPAT_SYS(nfsservctl)
+SYSCALL(ni_syscall)
 SYSCALL_SPU(setresgid)
 SYSCALL_SPU(getresgid)
 COMPAT_SYS_SPU(prctl)
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 2de8551df40f..c65f75aa7ff7 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -54,6 +54,7 @@
 #define ODSR_CLEAR              0x1c00
 #define LTLEECSR_ENABLE_ALL     0xFFC000FC
 #define ESCSR_CLEAR             0x07120204
+#define IECSR_CLEAR             0x80000000
 #define RIO_PORT1_EDCSR         0x0640
 #define RIO_PORT2_EDCSR         0x0680
@@ -1089,11 +1090,11 @@ static void port_error_handler(struct rio_mport *port, int offset)
        if (offset == 0) {
                out_be32((u32 *)(rio_regs_win + RIO_PORT1_EDCSR), 0);
-                out_be32((u32 *)(rio_regs_win + RIO_PORT1_IECSR), 0);
+                out_be32((u32 *)(rio_regs_win + RIO_PORT1_IECSR), IECSR_CLEAR);
                out_be32((u32 *)(rio_regs_win + RIO_ESCSR), ESCSR_CLEAR);
        } else {
                out_be32((u32 *)(rio_regs_win + RIO_PORT2_EDCSR), 0);
-                out_be32((u32 *)(rio_regs_win + RIO_PORT2_IECSR), 0);
+                out_be32((u32 *)(rio_regs_win + RIO_PORT2_IECSR), IECSR_CLEAR);
                out_be32((u32 *)(rio_regs_win + RIO_PORT2_ESCSR), ESCSR_CLEAR);
        }
 }
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 519eb5f187ef..c0cb794bb365 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -658,12 +658,14 @@ static inline void pgste_set_pte(pte_t *ptep, pgste_t pgste)
 * struct gmap_struct - guest address space
 * @mm: pointer to the parent mm_struct
 * @table: pointer to the page directory
+ * @asce: address space control element for gmap page table
 * @crst_list: list of all crst tables used in the guest address space
 */
 struct gmap {
        struct list_head list;
        struct mm_struct *mm;
        unsigned long *table;
+        unsigned long asce;
        struct list_head crst_list;
 };
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 532fd4322156..2b45591e1582 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -10,6 +10,7 @@
 #include <linux/sched.h>
 #include <asm/vdso.h>
 #include <asm/sigp.h>
+#include <asm/pgtable.h>
 /*
 * Make sure that the compiler is new enough. We want a compiler that
@@ -126,6 +127,7 @@ int main(void)
        DEFINE(__LC_KERNEL_STACK, offsetof(struct _lowcore, kernel_stack));
        DEFINE(__LC_ASYNC_STACK, offsetof(struct _lowcore, async_stack));
        DEFINE(__LC_PANIC_STACK, offsetof(struct _lowcore, panic_stack));
+        DEFINE(__LC_USER_ASCE, offsetof(struct _lowcore, user_asce));
        DEFINE(__LC_INT_CLOCK, offsetof(struct _lowcore, int_clock));
        DEFINE(__LC_MCCK_CLOCK, offsetof(struct _lowcore, mcck_clock));
        DEFINE(__LC_MACHINE_FLAGS, offsetof(struct _lowcore, machine_flags));
@@ -151,6 +153,7 @@ int main(void)
        DEFINE(__LC_VDSO_PER_CPU, offsetof(struct _lowcore, vdso_per_cpu_data));
        DEFINE(__LC_GMAP, offsetof(struct _lowcore, gmap));
        DEFINE(__LC_CMF_HPP, offsetof(struct _lowcore, cmf_hpp));
+        DEFINE(__GMAP_ASCE, offsetof(struct gmap, asce));
 #endif /* CONFIG_32BIT */
        return 0;
 }
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 08ab9aa6a0d5..7526db6bf501 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -665,12 +665,6 @@ ENTRY(sys32_poll_wrapper)
        lgfr    %r4,%r4                 # long
        jg      sys_poll                # branch to system call
-ENTRY(compat_sys_nfsservctl_wrapper)
-        lgfr    %r2,%r2                 # int
-        llgtr   %r3,%r3                 # struct compat_nfsctl_arg*
-        llgtr   %r4,%r4                 # union compat_nfsctl_res*
-        jg      compat_sys_nfsservctl   # branch to system call
 ENTRY(sys32_setresgid16_wrapper)
        llgfr   %r2,%r2                 # __kernel_old_gid_emu31_t
        llgfr   %r3,%r3                 # __kernel_old_gid_emu31_t
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index 068f8465c4ee..f297456dba7a 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -396,17 +396,19 @@ static __init void detect_machine_facilities(void)
 static __init void rescue_initrd(void)
 {
 #ifdef CONFIG_BLK_DEV_INITRD
+        unsigned long min_initrd_addr = (unsigned long) _end + (4UL << 20);
        /*
-         * Move the initrd right behind the bss section in case it starts
+         * Just like in case of IPL from VM reader we make sure there is a
-         * within the bss section. So we don't overwrite it when the bss
+         * gap of 4MB between end of kernel and start of initrd.
-         * section gets cleared.
+         * That way we can also be sure that saving an NSS will succeed,
+         * which however only requires different segments.
         */
        if (!INITRD_START || !INITRD_SIZE)
                return;
-        if (INITRD_START >= (unsigned long) __bss_stop)
+        if (INITRD_START >= min_initrd_addr)
                return;
-        memmove(__bss_stop, (void *) INITRD_START, INITRD_SIZE);
+        memmove((void *) min_initrd_addr, (void *) INITRD_START, INITRD_SIZE);
-        INITRD_START = (unsigned long) __bss_stop;
+        INITRD_START = min_initrd_addr;
 #endif
 }
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 5f729d627cef..713da0760538 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -1076,6 +1076,11 @@ sie_loop:
        lg      %r14,__LC_THREAD_INFO           # pointer thread_info struct
        tm      __TI_flags+7(%r14),_TIF_EXIT_SIE
        jnz     sie_exit
+        lg      %r14,__LC_GMAP                  # get gmap pointer
+        ltgr    %r14,%r14
+        jz      sie_gmap
+        lctlg   %c1,%c1,__GMAP_ASCE(%r14)       # load primary asce
+sie_gmap:
        lg      %r14,__SF_EMPTY(%r15)           # get control block pointer
        SPP     __SF_EMPTY(%r15)                # set guest id
        sie     0(%r14)
@@ -1083,6 +1088,7 @@ sie_done:
        SPP     __LC_CMF_HPP                    # set host id
        lg      %r14,__LC_THREAD_INFO           # pointer thread_info struct
 sie_exit:
+        lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
        ni      __TI_flags+6(%r14),255-(_TIF_SIE>>8)
        lg      %r14,__SF_EMPTY+8(%r15)         # load guest register save area
        stmg    %r0,%r13,0(%r14)                # save guest gprs 0-13
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index 04361d5a4279..48c710206366 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -1220,7 +1220,7 @@ static int __init reipl_fcp_init(void)
        /* sysfs: create fcp kset for mixing attr group and bin attrs */
        reipl_fcp_kset = kset_create_and_add(IPL_FCP_STR, NULL,
                                             &reipl_kset->kobj);
-        if (!reipl_kset) {
+        if (!reipl_fcp_kset) {
                free_page((unsigned long) reipl_block_fcp);
                return -ENOMEM;
        }
@@ -1618,7 +1618,8 @@ static struct shutdown_action vmcmd_action = {SHUTDOWN_ACTION_VMCMD_STR,
 static void stop_run(struct shutdown_trigger *trigger)
 {
-        if (strcmp(trigger->name, ON_PANIC_STR) == 0)
+        if (strcmp(trigger->name, ON_PANIC_STR) == 0 ||
+            strcmp(trigger->name, ON_RESTART_STR) == 0)
                disabled_wait((unsigned long) __builtin_return_address(0));
        while (sigp(smp_processor_id(), sigp_stop) == sigp_busy)
                cpu_relax();
@@ -1717,7 +1718,7 @@ static void do_panic(void)
 /* on restart */
 static struct shutdown_trigger on_restart_trigger = {ON_RESTART_STR,
-        &reipl_action};
+        &stop_action};
 static ssize_t on_restart_show(struct kobject *kobj,
                               struct kobj_attribute *attr, char *page)
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 6ee39ef8fe4a..73eb08c874fb 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -177,7 +177,7 @@ SYSCALL(sys_getresuid16,sys_ni_syscall,sys32_getresuid16_wrapper)	/* 165 old get
 NI_SYSCALL                                                      /* for vm86 */
 NI_SYSCALL                                                      /* old sys_query_module */
 SYSCALL(sys_poll,sys_poll,sys32_poll_wrapper)
-SYSCALL(sys_nfsservctl,sys_nfsservctl,compat_sys_nfsservctl_wrapper)
+NI_SYSCALL                                                      /* old nfsservctl */
 SYSCALL(sys_setresgid16,sys_ni_syscall,sys32_setresgid16_wrapper)       /* 170 old setresgid16 syscall */
 SYSCALL(sys_getresgid16,sys_ni_syscall,sys32_getresgid16_wrapper)       /* old getresgid16 syscall */
 SYSCALL(sys_prctl,sys_prctl,sys32_prctl_wrapper)
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f17296e4fc89..dc2b580e27bc 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -123,6 +123,7 @@ int kvm_dev_ioctl_check_extension(long ext)
        switch (ext) {
        case KVM_CAP_S390_PSW:
+        case KVM_CAP_S390_GMAP:
                r = 1;
                break;
        default:
@@ -263,10 +264,12 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
        vcpu->arch.guest_fpregs.fpc &= FPC_VALID_MASK;
        restore_fp_regs(&vcpu->arch.guest_fpregs);
        restore_access_regs(vcpu->arch.guest_acrs);
+        gmap_enable(vcpu->arch.gmap);
 }
 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
 {
+        gmap_disable(vcpu->arch.gmap);
        save_fp_regs(&vcpu->arch.guest_fpregs);
        save_access_regs(vcpu->arch.guest_acrs);
        restore_fp_regs(&vcpu->arch.host_fpregs);
@@ -461,7 +464,6 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
        local_irq_disable();
        kvm_guest_enter();
        local_irq_enable();
-        gmap_enable(vcpu->arch.gmap);
        VCPU_EVENT(vcpu, 6, "entering sie flags %x",
                   atomic_read(&vcpu->arch.sie_block->cpuflags));
        if (sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs)) {
@@ -470,7 +472,6 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
        }
        VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
                   vcpu->arch.sie_block->icptcode);
-        gmap_disable(vcpu->arch.gmap);
        local_irq_disable();
        kvm_guest_exit();
        local_irq_enable();
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 4d1f2bce87b3..f69ff3c13496 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -160,6 +160,8 @@ struct gmap *gmap_alloc(struct mm_struct *mm)
        table = (unsigned long *) page_to_phys(page);
        crst_table_init(table, _REGION1_ENTRY_EMPTY);
        gmap->table = table;
+        gmap->asce = _ASCE_TYPE_REGION1 | _ASCE_TABLE_LENGTH |
+                     _ASCE_USER_BITS | __pa(table);
        list_add(&gmap->list, &mm->context.gmap_list);
        return gmap;
@@ -240,10 +242,6 @@ EXPORT_SYMBOL_GPL(gmap_free);
 */
 void gmap_enable(struct gmap *gmap)
 {
-        /* Load primary space page table origin. */
-        S390_lowcore.user_asce = _ASCE_TYPE_REGION1 | _ASCE_TABLE_LENGTH |
-                                 _ASCE_USER_BITS | __pa(gmap->table);
-        asm volatile("lctlg 1,1,%0\n" : : "m" (S390_lowcore.user_asce) );
        S390_lowcore.gmap = (unsigned long) gmap;
 }
 EXPORT_SYMBOL_GPL(gmap_enable);
@@ -254,10 +252,6 @@ EXPORT_SYMBOL_GPL(gmap_enable);
 */
 void gmap_disable(struct gmap *gmap)
 {
-        /* Load primary space page table origin. */
-        S390_lowcore.user_asce =
-                gmap->mm->context.asce_bits | __pa(gmap->mm->pgd);
-        asm volatile("lctlg 1,1,%0\n" : : "m" (S390_lowcore.user_asce) );
        S390_lowcore.gmap = 0UL;
 }
 EXPORT_SYMBOL_GPL(gmap_disable);
diff --git a/arch/sh/include/asm/ptrace.h b/arch/sh/include/asm/ptrace.h
index b97baf81a87b..2d3679b2447f 100644
--- a/arch/sh/include/asm/ptrace.h
+++ b/arch/sh/include/asm/ptrace.h
@@ -123,7 +123,7 @@ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs,
 struct perf_event;
 struct perf_sample_data;
-extern void ptrace_triggered(struct perf_event *bp, int nmi,
+extern void ptrace_triggered(struct perf_event *bp,
                      struct perf_sample_data *data, struct pt_regs *regs);
 #define task_pt_regs(task) \
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
index e915deafac89..05559295d2ca 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
@@ -15,6 +15,7 @@
 #include <linux/serial_sci.h>
 #include <linux/io.h>
 #include <linux/mm.h>
+#include <linux/dma-mapping.h>
 #include <linux/sh_timer.h>
 #include <linux/sh_dma.h>
diff --git a/arch/sh/kernel/idle.c b/arch/sh/kernel/idle.c
index 32114e0941ae..db4ecd731a00 100644
--- a/arch/sh/kernel/idle.c
+++ b/arch/sh/kernel/idle.c
@@ -22,7 +22,7 @@
 #include <linux/atomic.h>
 #include <asm/smp.h>
-static void (*pm_idle)(void);
+void (*pm_idle)(void);
 static int hlt_counter;
diff --git a/arch/sh/kernel/syscalls_32.S b/arch/sh/kernel/syscalls_32.S
index 39b051de4c7c..293e39c59c00 100644
--- a/arch/sh/kernel/syscalls_32.S
+++ b/arch/sh/kernel/syscalls_32.S
@@ -185,7 +185,7 @@ ENTRY(sys_call_table)
        .long sys_ni_syscall    /* vm86 */
        .long sys_ni_syscall    /* old "query_module" */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall    /* was nfsservctl */
        .long sys_setresgid16   /* 170 */
        .long sys_getresgid16
        .long sys_prctl
diff --git a/arch/sh/kernel/syscalls_64.S b/arch/sh/kernel/syscalls_64.S
index 089c4d825d08..ceb34b94afa9 100644
--- a/arch/sh/kernel/syscalls_64.S
+++ b/arch/sh/kernel/syscalls_64.S
@@ -189,7 +189,7 @@ sys_call_table:
        .long sys_ni_syscall    /* vm86 */
        .long sys_ni_syscall    /* old "query_module" */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall    /* was nfsservctl */
        .long sys_setresgid16           /* 170 */
        .long sys_getresgid16
        .long sys_prctl
diff --git a/arch/sh/kernel/traps_32.c b/arch/sh/kernel/traps_32.c
index d9006f8ffc14..7bbef95c9d1b 100644
--- a/arch/sh/kernel/traps_32.c
+++ b/arch/sh/kernel/traps_32.c
@@ -316,6 +316,35 @@ static int handle_unaligned_ins(insn_size_t instruction, struct pt_regs *regs,
                        break;
                }
                break;
+        case 9: /* mov.w @(disp,PC),Rn */
+                srcu = (unsigned char __user *)regs->pc;
+                srcu += 4;
+                srcu += (instruction & 0x00FF) << 1;
+                dst = (unsigned char *)rn;
+                *(unsigned long *)dst = 0;
+#if !defined(__LITTLE_ENDIAN__)
+                dst += 2;
+#endif
+                if (ma->from(dst, srcu, 2))
+                        goto fetch_fault;
+                sign_extend(2, dst);
+                ret = 0;
+                break;
+        case 0xd: /* mov.l @(disp,PC),Rn */
+                srcu = (unsigned char __user *)(regs->pc & ~0x3);
+                srcu += 4;
+                srcu += (instruction & 0x00FF) << 2;
+                dst = (unsigned char *)rn;
+                *(unsigned long *)dst = 0;
+                if (ma->from(dst, srcu, 4))
+                        goto fetch_fault;
+                ret = 0;
+                break;
        }
        return ret;
@@ -466,6 +495,7 @@ int handle_unaligned_access(insn_size_t instruction, struct pt_regs *regs,
                case 0x0500: /* mov.w @(disp,Rm),R0 */
                        goto simple;
                case 0x0B00: /* bf   lab - no delayslot*/
+                        ret = 0;
                        break;
                case 0x0F00: /* bf/s lab */
                        ret = handle_delayslot(regs, instruction, ma);
@@ -479,6 +509,7 @@ int handle_unaligned_access(insn_size_t instruction, struct pt_regs *regs,
                        }
                        break;
                case 0x0900: /* bt   lab - no delayslot */
+                        ret = 0;
                        break;
                case 0x0D00: /* bt/s lab */
                        ret = handle_delayslot(regs, instruction, ma);
@@ -494,6 +525,9 @@ int handle_unaligned_access(insn_size_t instruction, struct pt_regs *regs,
                }
                break;
+        case 0x9000: /* mov.w @(disp,Rm),Rn */
+                goto simple;
        case 0xA000: /* bra label */
                ret = handle_delayslot(regs, instruction, ma);
                if (ret==0)
@@ -507,6 +541,9 @@ int handle_unaligned_access(insn_size_t instruction, struct pt_regs *regs,
                        regs->pc += SH_PC_12BIT_OFFSET(instruction);
                }
                break;
+        case 0xD000: /* mov.l @(disp,Rm),Rn */
+                goto simple;
        }
        return ret;
diff --git a/arch/sparc/kernel/irq.h b/arch/sparc/kernel/irq.h
index 100b9c204e78..42851122bbd9 100644
--- a/arch/sparc/kernel/irq.h
+++ b/arch/sparc/kernel/irq.h
@@ -88,7 +88,7 @@ BTFIXUPDEF_CALL(void, set_irq_udt, int)
 #define set_irq_udt(cpu) BTFIXUP_CALL(set_irq_udt)(cpu)
 /* All SUN4D IPIs are sent on this IRQ, may be shared with hard IRQs */
-#define SUN4D_IPI_IRQ 14
+#define SUN4D_IPI_IRQ 13
 extern void sun4d_ipi_interrupt(void);
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 3e9daea1653d..3c5bb784214f 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -440,8 +440,14 @@ static void __init init_sparc64_elf_hwcap(void)
                        cap |= AV_SPARC_VIS;
                if (tlb_type == cheetah || tlb_type == cheetah_plus)
                        cap |= AV_SPARC_VIS | AV_SPARC_VIS2;
-                if (tlb_type == cheetah_plus)
+                if (tlb_type == cheetah_plus) {
-                        cap |= AV_SPARC_POPC;
+                        unsigned long impl, ver;
+                        __asm__ __volatile__("rdpr %%ver, %0" : "=r" (ver));
+                        impl = ((ver >> 32) & 0xffff);
+                        if (impl == PANTHER_IMPL)
+                                cap |= AV_SPARC_POPC;
+                }
                if (tlb_type == hypervisor) {
                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA1)
                                cap |= AV_SPARC_ASI_BLK_INIT;
diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S
index 44e5faf1ad5f..d97f3eb72e06 100644
--- a/arch/sparc/kernel/sys32.S
+++ b/arch/sparc/kernel/sys32.S
@@ -81,7 +81,6 @@ SIGN2(sys32_fadvise64, compat_sys_fadvise64, %o0, %o4)
 SIGN2(sys32_fadvise64_64, compat_sys_fadvise64_64, %o0, %o5)
 SIGN2(sys32_bdflush, sys_bdflush, %o0, %o1)
 SIGN1(sys32_mlockall, sys_mlockall, %o0)
-SIGN1(sys32_nfsservctl, compat_sys_nfsservctl, %o0)
 SIGN1(sys32_clock_nanosleep, compat_sys_clock_nanosleep, %o1)
 SIGN1(sys32_timer_settime, compat_sys_timer_settime, %o1)
 SIGN1(sys32_io_submit, compat_sys_io_submit, %o1)
diff --git a/arch/sparc/kernel/systbls_32.S b/arch/sparc/kernel/systbls_32.S
index 6e492d59f6b1..09d8ec454450 100644
--- a/arch/sparc/kernel/systbls_32.S
+++ b/arch/sparc/kernel/systbls_32.S
@@ -67,7 +67,7 @@ sys_call_table:
 /*235*/ .long sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys_mlockall
 /*240*/ .long sys_munlockall, sys_sched_setparam, sys_sched_getparam, sys_sched_setscheduler, sys_sched_getscheduler
 /*245*/ .long sys_sched_yield, sys_sched_get_priority_max, sys_sched_get_priority_min, sys_sched_rr_get_interval, sys_nanosleep
-/*250*/ .long sys_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
+/*250*/ .long sys_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_ni_syscall
 /*255*/ .long sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
 /*260*/ .long sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
 /*265*/ .long sys_timer_delete, sys_timer_create, sys_nis_syscall, sys_io_setup, sys_io_destroy
diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
index f566518483b5..edbec45d4688 100644
--- a/arch/sparc/kernel/systbls_64.S
+++ b/arch/sparc/kernel/systbls_64.S
@@ -68,7 +68,7 @@ sys_call_table32:
        .word compat_sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys32_mlockall
 /*240*/ .word sys_munlockall, sys32_sched_setparam, sys32_sched_getparam, sys32_sched_setscheduler, sys32_sched_getscheduler
        .word sys_sched_yield, sys32_sched_get_priority_max, sys32_sched_get_priority_min, sys32_sched_rr_get_interval, compat_sys_nanosleep
-/*250*/ .word sys_mremap, compat_sys_sysctl, sys32_getsid, sys_fdatasync, sys32_nfsservctl
+/*250*/ .word sys_mremap, compat_sys_sysctl, sys32_getsid, sys_fdatasync, sys_nis_syscall
        .word sys32_sync_file_range, compat_sys_clock_settime, compat_sys_clock_gettime, compat_sys_clock_getres, sys32_clock_nanosleep
 /*260*/ .word compat_sys_sched_getaffinity, compat_sys_sched_setaffinity, sys32_timer_settime, compat_sys_timer_gettime, sys_timer_getoverrun
        .word sys_timer_delete, compat_sys_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
@@ -145,7 +145,7 @@ sys_call_table:
        .word sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys_mlockall
 /*240*/ .word sys_munlockall, sys_sched_setparam, sys_sched_getparam, sys_sched_setscheduler, sys_sched_getscheduler
        .word sys_sched_yield, sys_sched_get_priority_max, sys_sched_get_priority_min, sys_sched_rr_get_interval, sys_nanosleep
-/*250*/ .word sys_64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
+/*250*/ .word sys_64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nis_syscall
        .word sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
 /*260*/ .word sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
        .word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_io_setup, sys_io_destroy
diff --git a/arch/um/Kconfig.x86 b/arch/um/Kconfig.x86
index d31ecf346b4e..21bebe63df66 100644
--- a/arch/um/Kconfig.x86
+++ b/arch/um/Kconfig.x86
@@ -10,6 +10,10 @@ config CMPXCHG_LOCAL
        bool
        default n
+config CMPXCHG_DOUBLE
+        bool
+        default n
 source "arch/x86/Kconfig.cpu"
 endmenu
diff --git a/arch/um/Makefile b/arch/um/Makefile
index fab8121d2b32..c0f712cc7c5f 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -41,7 +41,7 @@ KBUILD_CPPFLAGS += -I$(srctree)/$(ARCH_DIR)/sys-$(SUBARCH)
 KBUILD_CFLAGS += $(CFLAGS) $(CFLAGS-y) -D__arch_um__ -DSUBARCH=\"$(SUBARCH)\" \
        $(ARCH_INCLUDE) $(MODE_INCLUDE) -Dvmap=kernel_vmap      \
        -Din6addr_loopback=kernel_in6addr_loopback \
-        -Din6addr_any=kernel_in6addr_any
+        -Din6addr_any=kernel_in6addr_any -Dstrrchr=kernel_strrchr
 KBUILD_AFLAGS += $(ARCH_INCLUDE)
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index d51c404239a8..364c8a15c4c3 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -399,8 +399,8 @@ int line_setup_irq(int fd, int input, int output, struct line *line, void *data)
 * is done under a spinlock.  Checking whether the device is in use is
 * line->tty->count > 1, also under the spinlock.
 *
- * tty->count serves to decide whether the device should be enabled or
+ * line->count serves to decide whether the device should be enabled or
- * disabled on the host.  If it's equal to 1, then we are doing the
+ * disabled on the host.  If it's equal to 0, then we are doing the
 * first open or last close.  Otherwise, open and close just return.
 */
@@ -414,16 +414,16 @@ int line_open(struct line *lines, struct tty_struct *tty)
                goto out_unlock;
        err = 0;
-        if (tty->count > 1)
+        if (line->count++)
                goto out_unlock;
-        spin_unlock(&line->count_lock);
+        BUG_ON(tty->driver_data);
        tty->driver_data = line;
        line->tty = tty;
+        spin_unlock(&line->count_lock);
        err = enable_chan(line);
-        if (err)
+        if (err) /* line_close() will be called by our caller */
                return err;
        INIT_DELAYED_WORK(&line->task, line_timer_cb);
@@ -436,7 +436,7 @@ int line_open(struct line *lines, struct tty_struct *tty)
        chan_window_size(&line->chan_list, &tty->winsize.ws_row,
                         &tty->winsize.ws_col);
-        return err;
+        return 0;
 out_unlock:
        spin_unlock(&line->count_lock);
@@ -460,17 +460,16 @@ void line_close(struct tty_struct *tty, struct file * filp)
        flush_buffer(line);
        spin_lock(&line->count_lock);
-        if (!line->valid)
+        BUG_ON(!line->valid);
-                goto out_unlock;
-        if (tty->count > 1)
+        if (--line->count)
                goto out_unlock;
-        spin_unlock(&line->count_lock);
        line->tty = NULL;
        tty->driver_data = NULL;
+        spin_unlock(&line->count_lock);
        if (line->sigio) {
                unregister_winch(tty);
                line->sigio = 0;
@@ -498,7 +497,7 @@ static int setup_one_line(struct line *lines, int n, char *init, int init_prio,
        spin_lock(&line->count_lock);
-        if (line->tty != NULL) {
+        if (line->count) {
                *error_out = "Device is already open";
                goto out;
        }
@@ -722,41 +721,53 @@ struct winch {
        int pid;
        struct tty_struct *tty;
        unsigned long stack;
+        struct work_struct work;
 };
-static void free_winch(struct winch *winch, int free_irq_ok)
+static void __free_winch(struct work_struct *work)
 {
-        if (free_irq_ok)
+        struct winch *winch = container_of(work, struct winch, work);
-                free_irq(WINCH_IRQ, winch);
+        free_irq(WINCH_IRQ, winch);
-        list_del(&winch->list);
        if (winch->pid != -1)
                os_kill_process(winch->pid, 1);
-        if (winch->fd != -1)
-                os_close_file(winch->fd);
        if (winch->stack != 0)
                free_stack(winch->stack, 0);
        kfree(winch);
 }
+static void free_winch(struct winch *winch)
+{
+        int fd = winch->fd;
+        winch->fd = -1;
+        if (fd != -1)
+                os_close_file(fd);
+        list_del(&winch->list);
+        __free_winch(&winch->work);
+}
 static irqreturn_t winch_interrupt(int irq, void *data)
 {
        struct winch *winch = data;
        struct tty_struct *tty;
        struct line *line;
+        int fd = winch->fd;
        int err;
        char c;
-        if (winch->fd != -1) {
+        if (fd != -1) {
-                err = generic_read(winch->fd, &c, NULL);
+                err = generic_read(fd, &c, NULL);
                if (err < 0) {
                        if (err != -EAGAIN) {
+                                winch->fd = -1;
+                                list_del(&winch->list);
+                                os_close_file(fd);
                                printk(KERN_ERR "winch_interrupt : "
                                       "read failed, errno = %d\n", -err);
                                printk(KERN_ERR "fd %d is losing SIGWINCH "
                                       "support\n", winch->tty_fd);
-                                free_winch(winch, 0);
+                                INIT_WORK(&winch->work, __free_winch);
+                                schedule_work(&winch->work);
                                return IRQ_HANDLED;
                        }
                        goto out;
@@ -828,7 +839,7 @@ static void unregister_winch(struct tty_struct *tty)
        list_for_each_safe(ele, next, &winch_handlers) {
                winch = list_entry(ele, struct winch, list);
                if (winch->tty == tty) {
-                        free_winch(winch, 1);
+                        free_winch(winch);
                        break;
                }
        }
@@ -844,7 +855,7 @@ static void winch_cleanup(void)
        list_for_each_safe(ele, next, &winch_handlers) {
                winch = list_entry(ele, struct winch, list);
-                free_winch(winch, 1);
+                free_winch(winch);
        }
        spin_unlock(&winch_handler_lock);
diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index 8ac7146c237f..2e1de5728604 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -123,6 +123,7 @@ static int xterm_open(int input, int output, int primary, void *d,
                err = -errno;
                printk(UM_KERN_ERR "xterm_open : unlink failed, errno = %d\n",
                       errno);
+                close(fd);
                return err;
        }
        close(fd);
diff --git a/arch/um/include/asm/ptrace-generic.h b/arch/um/include/asm/ptrace-generic.h
index ae084ad1a3a0..1a7d2757fe05 100644
--- a/arch/um/include/asm/ptrace-generic.h
+++ b/arch/um/include/asm/ptrace-generic.h
@@ -42,10 +42,6 @@ extern long subarch_ptrace(struct task_struct *child, long request,
        unsigned long addr, unsigned long data);
 extern unsigned long getreg(struct task_struct *child, int regno);
 extern int putreg(struct task_struct *child, int regno, unsigned long value);
-extern int get_fpregs(struct user_i387_struct __user *buf,
-                      struct task_struct *child);
-extern int set_fpregs(struct user_i387_struct __user *buf,
-                      struct task_struct *child);
 extern int arch_copy_tls(struct task_struct *new);
 extern void clear_flushed_tls(struct task_struct *task);
diff --git a/arch/um/include/shared/line.h b/arch/um/include/shared/line.h
index 72f4f25af247..63df3ca02ac2 100644
--- a/arch/um/include/shared/line.h
+++ b/arch/um/include/shared/line.h
@@ -33,6 +33,7 @@ struct line_driver {
 struct line {
        struct tty_struct *tty;
        spinlock_t count_lock;
+        unsigned long count;
        int valid;
        char *init_str;
diff --git a/arch/um/include/shared/registers.h b/arch/um/include/shared/registers.h
index b0b4589e0ebc..f1e0aa56c52a 100644
--- a/arch/um/include/shared/registers.h
+++ b/arch/um/include/shared/registers.h
@@ -16,7 +16,7 @@ extern int restore_fpx_registers(int pid, unsigned long *fp_regs);
 extern int save_registers(int pid, struct uml_pt_regs *regs);
 extern int restore_registers(int pid, struct uml_pt_regs *regs);
 extern int init_registers(int pid);
-extern void get_safe_registers(unsigned long *regs);
+extern void get_safe_registers(unsigned long *regs, unsigned long *fp_regs);
 extern unsigned long get_thread_reg(int reg, jmp_buf *buf);
 extern int get_fp_registers(int pid, unsigned long *regs);
 extern int put_fp_registers(int pid, unsigned long *regs);
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index fab4371184f6..21c1ae7c3d75 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -202,7 +202,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
                arch_copy_thread(&current->thread.arch, &p->thread.arch);
        }
        else {
-                get_safe_registers(p->thread.regs.regs.gp);
+                get_safe_registers(p->thread.regs.regs.gp, p->thread.regs.regs.fp);
                p->thread.request.u.thread = current->thread.request.u.thread;
                handler = new_thread_handler;
        }
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 701b672c1122..c9da32b0c707 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -50,23 +50,11 @@ long arch_ptrace(struct task_struct *child, long request,
        void __user *vp = p;
        switch (request) {
-        /* read word at location addr. */
-        case PTRACE_PEEKTEXT:
-        case PTRACE_PEEKDATA:
-                ret = generic_ptrace_peekdata(child, addr, data);
-                break;
        /* read the word at location addr in the USER area. */
        case PTRACE_PEEKUSR:
                ret = peek_user(child, addr, data);
                break;
-        /* write the word at location addr. */
-        case PTRACE_POKETEXT:
-        case PTRACE_POKEDATA:
-                ret = generic_ptrace_pokedata(child, addr, data);
-                break;
        /* write the word at location addr in the USER area */
        case PTRACE_POKEUSR:
                ret = poke_user(child, addr, data);
@@ -107,16 +95,6 @@ long arch_ptrace(struct task_struct *child, long request,
                break;
        }
 #endif
-#ifdef PTRACE_GETFPREGS
-        case PTRACE_GETFPREGS: /* Get the child FPU state. */
-                ret = get_fpregs(vp, child);
-                break;
-#endif
-#ifdef PTRACE_SETFPREGS
-        case PTRACE_SETFPREGS: /* Set the child FPU state. */
-                ret = set_fpregs(vp, child);
-                break;
-#endif
        case PTRACE_GET_THREAD_AREA:
                ret = ptrace_get_thread_area(child, addr, vp);
                break;
@@ -154,12 +132,6 @@ long arch_ptrace(struct task_struct *child, long request,
                break;
        }
 #endif
-#ifdef PTRACE_ARCH_PRCTL
-        case PTRACE_ARCH_PRCTL:
-                /* XXX Calls ptrace on the host - needs some SMP thinking */
-                ret = arch_prctl(child, data, (void __user *) addr);
-                break;
-#endif
        default:
                ret = ptrace_request(child, request, addr, data);
                if (ret == -EIO)
diff --git a/arch/um/os-Linux/registers.c b/arch/um/os-Linux/registers.c
index 830fe6a1518a..b866b9e3bef9 100644
--- a/arch/um/os-Linux/registers.c
+++ b/arch/um/os-Linux/registers.c
@@ -8,6 +8,8 @@
 #include <string.h>
 #include <sys/ptrace.h>
 #include "sysdep/ptrace.h"
+#include "sysdep/ptrace_user.h"
+#include "registers.h"
 int save_registers(int pid, struct uml_pt_regs *regs)
 {
@@ -32,6 +34,7 @@ int restore_registers(int pid, struct uml_pt_regs *regs)
 /* This is set once at boot time and not changed thereafter */
 static unsigned long exec_regs[MAX_REG_NR];
+static unsigned long exec_fp_regs[FP_SIZE];
 int init_registers(int pid)
 {
@@ -42,10 +45,14 @@ int init_registers(int pid)
                return -errno;
        arch_init_registers(pid);
+        get_fp_registers(pid, exec_fp_regs);
        return 0;
 }
-void get_safe_registers(unsigned long *regs)
+void get_safe_registers(unsigned long *regs, unsigned long *fp_regs)
 {
        memcpy(regs, exec_regs, sizeof(exec_regs));
+        if (fp_regs)
+                memcpy(fp_regs, exec_fp_regs, sizeof(exec_fp_regs));
 }
diff --git a/arch/um/os-Linux/skas/mem.c b/arch/um/os-Linux/skas/mem.c
index d261f170d120..e771398be5f3 100644
--- a/arch/um/os-Linux/skas/mem.c
+++ b/arch/um/os-Linux/skas/mem.c
@@ -39,7 +39,7 @@ static unsigned long syscall_regs[MAX_REG_NR];
 static int __init init_syscall_regs(void)
 {
-        get_safe_registers(syscall_regs);
+        get_safe_registers(syscall_regs, NULL);
        syscall_regs[REGS_IP_INDEX] = STUB_CODE +
                ((unsigned long) &batch_syscall_stub -
                 (unsigned long) &__syscall_stub_start);
diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index d6e0a2234b86..dee0e8cf8ad0 100644
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -373,6 +373,9 @@ void userspace(struct uml_pt_regs *regs)
                if (ptrace(PTRACE_SETREGS, pid, 0, regs->gp))
                        fatal_sigsegv();
+                if (put_fp_registers(pid, regs->fp))
+                        fatal_sigsegv();
                /* Now we set local_using_sysemu to be used for one loop */
                local_using_sysemu = get_using_sysemu();
@@ -399,6 +402,12 @@ void userspace(struct uml_pt_regs *regs)
                        fatal_sigsegv();
                }
+                if (get_fp_registers(pid, regs->fp)) {
+                        printk(UM_KERN_ERR "userspace -  get_fp_registers failed, "
+                               "errno = %d\n", errno);
+                        fatal_sigsegv();
+                }
                UPT_SYSCALL_NR(regs) = -1; /* Assume: It's not a syscall */
                if (WIFSTOPPED(status)) {
@@ -457,10 +466,11 @@ void userspace(struct uml_pt_regs *regs)
 }
 static unsigned long thread_regs[MAX_REG_NR];
+static unsigned long thread_fp_regs[FP_SIZE];
 static int __init init_thread_regs(void)
 {
-        get_safe_registers(thread_regs);
+        get_safe_registers(thread_regs, thread_fp_regs);
        /* Set parent's instruction pointer to start of clone-stub */
        thread_regs[REGS_IP_INDEX] = STUB_CODE +
                                (unsigned long) stub_clone_handler -
@@ -503,6 +513,13 @@ int copy_context_skas0(unsigned long new_stack, int pid)
                return err;
        }
+        err = put_fp_registers(pid, thread_fp_regs);
+        if (err < 0) {
+                printk(UM_KERN_ERR "copy_context_skas0 : put_fp_registers "
+                       "failed, pid = %d, err = %d\n", pid, err);
+                return err;
+        }
        /* set a well known return code for detection of child write failure */
        child_data->err = 12345678;
diff --git a/arch/um/sys-i386/asm/ptrace.h b/arch/um/sys-i386/asm/ptrace.h
index 0273e4d09af7..5d2a59112537 100644
--- a/arch/um/sys-i386/asm/ptrace.h
+++ b/arch/um/sys-i386/asm/ptrace.h
@@ -42,11 +42,6 @@
 */
 struct user_desc;
-extern int get_fpxregs(struct user_fxsr_struct __user *buf,
-                       struct task_struct *child);
-extern int set_fpxregs(struct user_fxsr_struct __user *buf,
-                       struct task_struct *tsk);
 extern int ptrace_get_thread_area(struct task_struct *child, int idx,
                                  struct user_desc __user *user_desc);
diff --git a/arch/um/sys-i386/ptrace.c b/arch/um/sys-i386/ptrace.c
index d23b2d3ea384..3375c2717851 100644
--- a/arch/um/sys-i386/ptrace.c
+++ b/arch/um/sys-i386/ptrace.c
@@ -145,7 +145,7 @@ int peek_user(struct task_struct *child, long addr, long data)
        return put_user(tmp, (unsigned long __user *) data);
 }
-int get_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
+static int get_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
 {
        int err, n, cpu = ((struct thread_info *) child->stack)->cpu;
        struct user_i387_struct fpregs;
@@ -161,7 +161,7 @@ int get_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
        return n;
 }
-int set_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
+static int set_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
 {
        int n, cpu = ((struct thread_info *) child->stack)->cpu;
        struct user_i387_struct fpregs;
@@ -174,7 +174,7 @@ int set_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
                                    (unsigned long *) &fpregs);
 }
-int get_fpxregs(struct user_fxsr_struct __user *buf, struct task_struct *child)
+static int get_fpxregs(struct user_fxsr_struct __user *buf, struct task_struct *child)
 {
        int err, n, cpu = ((struct thread_info *) child->stack)->cpu;
        struct user_fxsr_struct fpregs;
@@ -190,7 +190,7 @@ int get_fpxregs(struct user_fxsr_struct __user *buf, struct task_struct *child)
        return n;
 }
-int set_fpxregs(struct user_fxsr_struct __user *buf, struct task_struct *child)
+static int set_fpxregs(struct user_fxsr_struct __user *buf, struct task_struct *child)
 {
        int n, cpu = ((struct thread_info *) child->stack)->cpu;
        struct user_fxsr_struct fpregs;
@@ -206,5 +206,23 @@ int set_fpxregs(struct user_fxsr_struct __user *buf, struct task_struct *child)
 long subarch_ptrace(struct task_struct *child, long request,
                    unsigned long addr, unsigned long data)
 {
-        return -EIO;
+        int ret = -EIO;
+        void __user *datap = (void __user *) data;
+        switch (request) {
+        case PTRACE_GETFPREGS: /* Get the child FPU state. */
+                ret = get_fpregs(datap, child);
+                break;
+        case PTRACE_SETFPREGS: /* Set the child FPU state. */
+                ret = set_fpregs(datap, child);
+                break;
+        case PTRACE_GETFPXREGS: /* Get the child FPU state. */
+                ret = get_fpxregs(datap, child);
+                break;
+        case PTRACE_SETFPXREGS: /* Set the child FPU state. */
+                ret = set_fpxregs(datap, child);
+                break;
+        default:
+                ret = -EIO;
+        }
+        return ret;
 }
diff --git a/arch/um/sys-i386/shared/sysdep/ptrace.h b/arch/um/sys-i386/shared/sysdep/ptrace.h
index d50e62e07070..c398a5076111 100644
--- a/arch/um/sys-i386/shared/sysdep/ptrace.h
+++ b/arch/um/sys-i386/shared/sysdep/ptrace.h
@@ -53,6 +53,7 @@ extern int sysemu_supported;
 struct uml_pt_regs {
        unsigned long gp[MAX_REG_NR];
+        unsigned long fp[HOST_FPX_SIZE];
        struct faultinfo faultinfo;
        long syscall;
        int is_user;
diff --git a/arch/um/sys-x86_64/ptrace.c b/arch/um/sys-x86_64/ptrace.c
index f43613643cdb..4005506834fd 100644
--- a/arch/um/sys-x86_64/ptrace.c
+++ b/arch/um/sys-x86_64/ptrace.c
@@ -145,7 +145,7 @@ int is_syscall(unsigned long addr)
        return instr == 0x050f;
 }
-int get_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
+static int get_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
 {
        int err, n, cpu = ((struct thread_info *) child->stack)->cpu;
        long fpregs[HOST_FP_SIZE];
@@ -162,7 +162,7 @@ int get_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
        return n;
 }
-int set_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
+static int set_fpregs(struct user_i387_struct __user *buf, struct task_struct *child)
 {
        int n, cpu = ((struct thread_info *) child->stack)->cpu;
        long fpregs[HOST_FP_SIZE];
@@ -182,12 +182,16 @@ long subarch_ptrace(struct task_struct *child, long request,
        void __user *datap = (void __user *) data;
        switch (request) {
-        case PTRACE_GETFPXREGS: /* Get the child FPU state. */
+        case PTRACE_GETFPREGS: /* Get the child FPU state. */
                ret = get_fpregs(datap, child);
                break;
-        case PTRACE_SETFPXREGS: /* Set the child FPU state. */
+        case PTRACE_SETFPREGS: /* Set the child FPU state. */
                ret = set_fpregs(datap, child);
                break;
+        case PTRACE_ARCH_PRCTL:
+                /* XXX Calls ptrace on the host - needs some SMP thinking */
+                ret = arch_prctl(child, data, (void __user *) addr);
+                break;
        }
        return ret;
diff --git a/arch/um/sys-x86_64/shared/sysdep/ptrace.h b/arch/um/sys-x86_64/shared/sysdep/ptrace.h
index fdba5457947a..8ee8f8e12af1 100644
--- a/arch/um/sys-x86_64/shared/sysdep/ptrace.h
+++ b/arch/um/sys-x86_64/shared/sysdep/ptrace.h
@@ -85,6 +85,7 @@
 struct uml_pt_regs {
        unsigned long gp[MAX_REG_NR];
+        unsigned long fp[HOST_FP_SIZE];
        struct faultinfo faultinfo;
        long syscall;
        int is_user;
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index a0e866d233ee..54edb207ff3a 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -672,7 +672,7 @@ ia32_sys_call_table:
        .quad sys32_vm86_warning        /* vm86 */ 
        .quad quiet_ni_syscall  /* query_module */
        .quad sys_poll
-        .quad compat_sys_nfsservctl
+        .quad quiet_ni_syscall /* old nfsservctl */
        .quad sys_setresgid16   /* 170 */
        .quad sys_getresgid16
        .quad sys_prctl
diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
index 4554cc6fb96a..091508b533b4 100644
--- a/arch/x86/include/asm/alternative-asm.h
+++ b/arch/x86/include/asm/alternative-asm.h
@@ -16,7 +16,6 @@
 #endif
 .macro altinstruction_entry orig alt feature orig_len alt_len
-        .align 8
        .long \orig - .
        .long \alt - .
        .word \feature
diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
index 23fb6d79f209..37ad100a2210 100644
--- a/arch/x86/include/asm/alternative.h
+++ b/arch/x86/include/asm/alternative.h
@@ -48,9 +48,6 @@ struct alt_instr {
        u16 cpuid;              /* cpuid bit set for replacement */
        u8  instrlen;           /* length of original instruction */
        u8  replacementlen;     /* length of new instruction, <= instrlen */
-#ifdef CONFIG_X86_64
-        u32 pad2;
-#endif
 };
 extern void alternative_instructions(void);
@@ -83,7 +80,6 @@ static inline int alternatives_text_reserved(void *start, void *end)
                                                                        \
      "661:\n\t" oldinstr "\n662:\n"                                    \
      ".section .altinstructions,\"a\"\n"                               \
-      _ASM_ALIGN "\n"                                                   \
      "  .long 661b - .\n"                      /* label           */   \
      "  .long 663f - .\n"                      /* new instruction */   \
      "  .word " __stringify(feature) "\n"      /* feature bit     */   \
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 4258aac99a6e..88b23a43f340 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -332,7 +332,6 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
                asm goto("1: jmp %l[t_no]\n"
                         "2:\n"
                         ".section .altinstructions,\"a\"\n"
-                         _ASM_ALIGN "\n"
                         " .long 1b - .\n"
                         " .long 0\n"           /* no replacement */
                         " .word %P0\n"         /* feature bit */
@@ -350,7 +349,6 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
                asm volatile("1: movb $0,%0\n"
                             "2:\n"
                             ".section .altinstructions,\"a\"\n"
-                             _ASM_ALIGN "\n"
                             " .long 1b - .\n"
                             " .long 3f - .\n"
                             " .word %P1\n"             /* feature bit */
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index a518c0a45044..c59cc97fe6c1 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -44,7 +44,7 @@ static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
                : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
 #elif defined(__x86_64__)
        __asm__ (
-                "mul %[mul_frac] ; shrd $32, %[hi], %[lo]"
+                "mulq %[mul_frac] ; shrd $32, %[hi], %[lo]"
                : [lo]"=a"(product),
                  [hi]"=d"(tmp)
                : "0"(delta),
diff --git a/arch/x86/include/asm/unistd_64.h b/arch/x86/include/asm/unistd_64.h
index d92641cc7acc..201040573444 100644
--- a/arch/x86/include/asm/unistd_64.h
+++ b/arch/x86/include/asm/unistd_64.h
@@ -414,7 +414,7 @@ __SYSCALL(__NR_query_module, sys_ni_syscall)
 __SYSCALL(__NR_quotactl, sys_quotactl)
 #define __NR_nfsservctl                         180
-__SYSCALL(__NR_nfsservctl, sys_nfsservctl)
+__SYSCALL(__NR_nfsservctl, sys_ni_syscall)
 /* reserved for LiS/STREAMS */
 #define __NR_getpmsg                            181
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index 08119a37e53c..6b96110bb0c3 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -149,7 +149,6 @@ struct set_mtrr_data {
 */
 static int mtrr_rendezvous_handler(void *info)
 {
-#ifdef CONFIG_SMP
        struct set_mtrr_data *data = info;
        /*
@@ -171,7 +170,6 @@ static int mtrr_rendezvous_handler(void *info)
        } else if (mtrr_aps_delayed_init || !cpu_online(smp_processor_id())) {
                mtrr_if->set_all();
        }
-#endif
        return 0;
 }
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 4ee3abf20ed6..cfa62ec090ec 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1900,6 +1900,9 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
        perf_callchain_store(entry, regs->ip);
+        if (!current->mm)
+                return;
        if (perf_callchain_user32(regs, entry))
                return;
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 5c1a91974918..f3f6f5344001 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -54,6 +54,7 @@
 #include <asm/ftrace.h>
 #include <asm/irq_vectors.h>
 #include <asm/cpufeature.h>
+#include <asm/alternative-asm.h>
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
 #include <linux/elf-em.h>
@@ -873,12 +874,7 @@ ENTRY(simd_coprocessor_error)
 661:    pushl_cfi $do_general_protection
 662:
 .section .altinstructions,"a"
-        .balign 4
+        altinstruction_entry 661b, 663f, X86_FEATURE_XMM, 662b-661b, 664f-663f
-        .long 661b
-        .long 663f
-        .word X86_FEATURE_XMM
-        .byte 662b-661b
-        .byte 664f-663f
 .previous
 .section .altinstr_replacement,"ax"
 663:    pushl $do_simd_coprocessor_error
diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
index fbb0a045a1a2..bc19be332bc9 100644
--- a/arch/x86/kernel/syscall_table_32.S
+++ b/arch/x86/kernel/syscall_table_32.S
@@ -168,7 +168,7 @@ ENTRY(sys_call_table)
        .long ptregs_vm86
        .long sys_ni_syscall    /* Old sys_query_module */
        .long sys_poll
-        .long sys_nfsservctl
+        .long sys_ni_syscall    /* Old nfsservctl */
        .long sys_setresgid16   /* 170 */
        .long sys_getresgid16
        .long sys_prctl
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index c95330267f08..039d91315bc5 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -365,8 +365,13 @@ struct pci_bus * __devinit pci_acpi_scan_root(struct acpi_pci_root *root)
         */
        if (bus) {
                struct pci_bus *child;
-                list_for_each_entry(child, &bus->children, node)
+                list_for_each_entry(child, &bus->children, node) {
-                        pcie_bus_configure_settings(child, child->self->pcie_mpss);
+                        struct pci_dev *self = child->self;
+                        if (!self)
+                                continue;
+                        pcie_bus_configure_settings(child, self->pcie_mpss);
+                }
        }
        if (!bus)
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index 7000e74b3087..58425adc22c6 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -689,7 +689,9 @@ static int __init sfi_parse_devs(struct sfi_table_header *table)
                        irq_attr.trigger = 1;
                        irq_attr.polarity = 1;
                        io_apic_set_pci_routing(NULL, pentry->irq, &irq_attr);
-                }
+                } else
+                        pentry->irq = 0; /* No irq */
                switch (pentry->type) {
                case SFI_DEV_TYPE_IPC:
                        /* ID as IRQ is a hack that will go away */
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 20a614275064..3dd53f997b11 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1721,10 +1721,8 @@ void __init xen_setup_machphys_mapping(void)
                machine_to_phys_nr = MACH2PHYS_NR_ENTRIES;
        }
 #ifdef CONFIG_X86_32
-        if ((machine_to_phys_mapping + machine_to_phys_nr)
+        WARN_ON((machine_to_phys_mapping + (machine_to_phys_nr - 1))
-            < machine_to_phys_mapping)
+                < machine_to_phys_mapping);
-                machine_to_phys_nr = (unsigned long *)NULL
-                                     - machine_to_phys_mapping;
 #endif
 }
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index df118a825f39..46d6d21dbdbe 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -184,6 +184,19 @@ static unsigned long __init xen_set_identity(const struct e820entry *list,
                                        PFN_UP(start_pci), PFN_DOWN(last));
        return identity;
 }
+static unsigned long __init xen_get_max_pages(void)
+{
+        unsigned long max_pages = MAX_DOMAIN_PAGES;
+        domid_t domid = DOMID_SELF;
+        int ret;
+        ret = HYPERVISOR_memory_op(XENMEM_maximum_reservation, &domid);
+        if (ret > 0)
+                max_pages = ret;
+        return min(max_pages, MAX_DOMAIN_PAGES);
+}
 /**
 * machine_specific_memory_setup - Hook for machine specific memory setup.
 **/
@@ -292,6 +305,14 @@ char * __init xen_memory_setup(void)
        sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
+        extra_limit = xen_get_max_pages();
+        if (max_pfn + extra_pages > extra_limit) {
+                if (extra_limit > max_pfn)
+                        extra_pages = extra_limit - max_pfn;
+                else
+                        extra_pages = 0;
+        }
        extra_pages += xen_return_unused_memory(xen_start_info->nr_pages, &e820);
        /*
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index e79dbb95482b..041d4fe9dfe4 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -32,6 +32,7 @@
 #include <xen/page.h>
 #include <xen/events.h>
+#include <xen/hvc-console.h>
 #include "xen-ops.h"
 #include "mmu.h"
@@ -207,6 +208,15 @@ static void __init xen_smp_prepare_cpus(unsigned int max_cpus)
        unsigned cpu;
        unsigned int i;
+        if (skip_ioapic_setup) {
+                char *m = (max_cpus == 0) ?
+                        "The nosmp parameter is incompatible with Xen; " \
+                        "use Xen dom0_max_vcpus=1 parameter" :
+                        "The noapic parameter is incompatible with Xen";
+                xen_raw_printk(m);
+                panic(m);
+        }
        xen_init_lock_cpu(0);
        smp_store_cpu_info(0);
@@ -522,7 +532,6 @@ static void __init xen_hvm_smp_prepare_cpus(unsigned int max_cpus)
        WARN_ON(xen_smp_intr_init(0));
        xen_init_lock_cpu(0);
-        xen_init_spinlocks();
 }
 static int __cpuinit xen_hvm_cpu_up(unsigned int cpu)
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 5158c505bef9..163b4679556e 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -168,9 +168,10 @@ cycle_t xen_clocksource_read(void)
        struct pvclock_vcpu_time_info *src;
        cycle_t ret;
-        src = &get_cpu_var(xen_vcpu)->time;
+        preempt_disable_notrace();
+        src = &__get_cpu_var(xen_vcpu)->time;
        ret = pvclock_clocksource_read(src);
-        put_cpu_var(xen_vcpu);
+        preempt_enable_notrace();
        return ret;
 }
diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
index 22a2093b5862..b040b0e518ca 100644
--- a/arch/x86/xen/xen-asm_32.S
+++ b/arch/x86/xen/xen-asm_32.S
@@ -113,11 +113,13 @@ xen_iret_start_crit:
        /*
         * If there's something pending, mask events again so we can
-         * jump back into xen_hypervisor_callback
+         * jump back into xen_hypervisor_callback. Otherwise do not
+         * touch XEN_vcpu_info_mask.
         */
-        sete XEN_vcpu_info_mask(%eax)
+        jne 1f
+        movb $1, XEN_vcpu_info_mask(%eax)
-        popl %eax
+1:      popl %eax
        /*
         * From this point on the registers are restored and the stack
diff --git a/arch/xtensa/include/asm/unistd.h b/arch/xtensa/include/asm/unistd.h
index a6f934f37f1a..798ee6d285a1 100644
--- a/arch/xtensa/include/asm/unistd.h
+++ b/arch/xtensa/include/asm/unistd.h
@@ -455,7 +455,7 @@ __SYSCALL(203, sys_reboot, 3)
 #define __NR_quotactl                           204
 __SYSCALL(204, sys_quotactl, 4)
 #define __NR_nfsservctl                         205
-__SYSCALL(205, sys_nfsservctl, 3)
+__SYSCALL(205, sys_ni_syscall, 0)
 #define __NR__sysctl                            206
 __SYSCALL(206, sys_sysctl, 1)
 #define __NR_bdflush                            207
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index bcaf16ee6ad1..b596e54ddd71 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -785,10 +785,10 @@ static int blkio_policy_parse_and_set(char *buf,
 {
        char *s[4], *p, *major_s = NULL, *minor_s = NULL;
        int ret;
-        unsigned long major, minor, temp;
+        unsigned long major, minor;
        int i = 0;
        dev_t dev;
-        u64 bps, iops;
+        u64 temp;
        memset(s, 0, sizeof(s));
@@ -826,20 +826,23 @@ static int blkio_policy_parse_and_set(char *buf,
        dev = MKDEV(major, minor);
-        ret = blkio_check_dev_num(dev);
+        ret = strict_strtoull(s[1], 10, &temp);
        if (ret)
-                return ret;
+                return -EINVAL;
-        newpn->dev = dev;
+        /* For rule removal, do not check for device presence. */
+        if (temp) {
+                ret = blkio_check_dev_num(dev);
+                if (ret)
+                        return ret;
+        }
-        if (s[1] == NULL)
+        newpn->dev = dev;
-                return -EINVAL;
        switch (plid) {
        case BLKIO_POLICY_PROP:
-                ret = strict_strtoul(s[1], 10, &temp);
+                if ((temp < BLKIO_WEIGHT_MIN && temp > 0) ||
-                if (ret || (temp < BLKIO_WEIGHT_MIN && temp > 0) ||
+                     temp > BLKIO_WEIGHT_MAX)
-                        temp > BLKIO_WEIGHT_MAX)
                        return -EINVAL;
                newpn->plid = plid;
@@ -850,26 +853,18 @@ static int blkio_policy_parse_and_set(char *buf,
                switch(fileid) {
                case BLKIO_THROTL_read_bps_device:
                case BLKIO_THROTL_write_bps_device:
-                        ret = strict_strtoull(s[1], 10, &bps);
-                        if (ret)
-                                return -EINVAL;
                        newpn->plid = plid;
                        newpn->fileid = fileid;
-                        newpn->val.bps = bps;
+                        newpn->val.bps = temp;
                        break;
                case BLKIO_THROTL_read_iops_device:
                case BLKIO_THROTL_write_iops_device:
-                        ret = strict_strtoull(s[1], 10, &iops);
+                        if (temp > THROTL_IOPS_MAX)
-                        if (ret)
-                                return -EINVAL;
-                        if (iops > THROTL_IOPS_MAX)
                                return -EINVAL;
                        newpn->plid = plid;
                        newpn->fileid = fileid;
-                        newpn->val.iops = (unsigned int)iops;
+                        newpn->val.iops = (unsigned int)temp;
                        break;
                }
                break;
diff --git a/block/blk-core.c b/block/blk-core.c
index 90e1ffdeb415..b2ed78afd9f0 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1167,7 +1167,7 @@ static bool bio_attempt_front_merge(struct request_queue *q,
 * true if merge was successful, otherwise false.
 */
 static bool attempt_plug_merge(struct task_struct *tsk, struct request_queue *q,
-                               struct bio *bio)
+                               struct bio *bio, unsigned int *request_count)
 {
        struct blk_plug *plug;
        struct request *rq;
@@ -1176,10 +1176,13 @@ static bool attempt_plug_merge(struct task_struct *tsk, struct request_queue *q,
        plug = tsk->plug;
        if (!plug)
                goto out;
+        *request_count = 0;
        list_for_each_entry_reverse(rq, &plug->list, queuelist) {
                int el_ret;
+                (*request_count)++;
                if (rq->q != q)
                        continue;
@@ -1219,6 +1222,7 @@ static int __make_request(struct request_queue *q, struct bio *bio)
        struct blk_plug *plug;
        int el_ret, rw_flags, where = ELEVATOR_INSERT_SORT;
        struct request *req;
+        unsigned int request_count = 0;
        /*
         * low level driver can indicate that it wants pages above a
@@ -1237,7 +1241,7 @@ static int __make_request(struct request_queue *q, struct bio *bio)
         * Check if we can merge with the plugged list before grabbing
         * any locks.
         */
-        if (attempt_plug_merge(current, q, bio))
+        if (attempt_plug_merge(current, q, bio, &request_count))
                goto out;
        spin_lock_irq(q->queue_lock);
@@ -1302,11 +1306,10 @@ get_rq:
                        if (__rq->q != q)
                                plug->should_sort = 1;
                }
+                if (request_count >= BLK_MAX_REQUEST_COUNT)
+                        blk_flush_plug_list(plug, false);
                list_add_tail(&req->queuelist, &plug->list);
-                plug->count++;
                drive_stat_acct(req, 1);
-                if (plug->count >= BLK_MAX_REQUEST_COUNT)
-                        blk_flush_plug_list(plug, false);
        } else {
                spin_lock_irq(q->queue_lock);
                add_acct_request(q, req, where);
@@ -2634,7 +2637,6 @@ void blk_start_plug(struct blk_plug *plug)
        INIT_LIST_HEAD(&plug->list);
        INIT_LIST_HEAD(&plug->cb_list);
        plug->should_sort = 0;
-        plug->count = 0;
        /*
         * If this is a nested plug, don't actually assign it. It will be
@@ -2718,7 +2720,6 @@ void blk_flush_plug_list(struct blk_plug *plug, bool from_schedule)
                return;
        list_splice_init(&plug->list, &list);
-        plug->count = 0;
        if (plug->should_sort) {
                list_sort(NULL, &list, plug_rq_cmp);
diff --git a/block/blk-softirq.c b/block/blk-softirq.c
index 58340d0cb23a..1366a89d8e66 100644
--- a/block/blk-softirq.c
+++ b/block/blk-softirq.c
@@ -115,7 +115,7 @@ void __blk_complete_request(struct request *req)
        /*
         * Select completion CPU
         */
-        if (test_bit(QUEUE_FLAG_SAME_COMP, &q->queue_flags) && req->cpu != -1) {
+        if (req->cpu != -1) {
                ccpu = req->cpu;
                if (!test_bit(QUEUE_FLAG_SAME_FORCE, &q->queue_flags)) {
                        ccpu = blk_cpu_to_group(ccpu);
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 0ee17b5e7fb6..e681805cdb47 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -258,11 +258,13 @@ queue_rq_affinity_store(struct request_queue *q, const char *page, size_t count)
        ret = queue_var_store(&val, page, count);
        spin_lock_irq(q->queue_lock);
-        if (val) {
+        if (val == 2) {
                queue_flag_set(QUEUE_FLAG_SAME_COMP, q);
-                if (val == 2)
+                queue_flag_set(QUEUE_FLAG_SAME_FORCE, q);
-                        queue_flag_set(QUEUE_FLAG_SAME_FORCE, q);
+        } else if (val == 1) {
-        } else {
+                queue_flag_set(QUEUE_FLAG_SAME_COMP, q);
+                queue_flag_clear(QUEUE_FLAG_SAME_FORCE, q);
+        } else if (val == 0) {
                queue_flag_clear(QUEUE_FLAG_SAME_COMP, q);
                queue_flag_clear(QUEUE_FLAG_SAME_FORCE, q);
        }
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index a33bd4377c61..16ace89613bc 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -130,8 +130,8 @@ struct cfq_queue {
        unsigned long slice_end;
        long slice_resid;
-        /* pending metadata requests */
+        /* pending priority requests */
-        int meta_pending;
+        int prio_pending;
        /* number of requests that are on the dispatch list or inside driver */
        int dispatched;
@@ -684,8 +684,8 @@ cfq_choose_req(struct cfq_data *cfqd, struct request *rq1, struct request *rq2,
        if (rq_is_sync(rq1) != rq_is_sync(rq2))
                return rq_is_sync(rq1) ? rq1 : rq2;
-        if ((rq1->cmd_flags ^ rq2->cmd_flags) & REQ_META)
+        if ((rq1->cmd_flags ^ rq2->cmd_flags) & REQ_PRIO)
-                return rq1->cmd_flags & REQ_META ? rq1 : rq2;
+                return rq1->cmd_flags & REQ_PRIO ? rq1 : rq2;
        s1 = blk_rq_pos(rq1);
        s2 = blk_rq_pos(rq2);
@@ -1612,9 +1612,9 @@ static void cfq_remove_request(struct request *rq)
        cfqq->cfqd->rq_queued--;
        cfq_blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg,
                                        rq_data_dir(rq), rq_is_sync(rq));
-        if (rq->cmd_flags & REQ_META) {
+        if (rq->cmd_flags & REQ_PRIO) {
-                WARN_ON(!cfqq->meta_pending);
+                WARN_ON(!cfqq->prio_pending);
-                cfqq->meta_pending--;
+                cfqq->prio_pending--;
        }
 }
@@ -3372,7 +3372,7 @@ cfq_should_preempt(struct cfq_data *cfqd, struct cfq_queue *new_cfqq,
         * So both queues are sync. Let the new request get disk time if
         * it's a metadata request and the current queue is doing regular IO.
         */
-        if ((rq->cmd_flags & REQ_META) && !cfqq->meta_pending)
+        if ((rq->cmd_flags & REQ_PRIO) && !cfqq->prio_pending)
                return true;
        /*
@@ -3439,8 +3439,8 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
        struct cfq_io_context *cic = RQ_CIC(rq);
        cfqd->rq_queued++;
-        if (rq->cmd_flags & REQ_META)
+        if (rq->cmd_flags & REQ_PRIO)
-                cfqq->meta_pending++;
+                cfqq->prio_pending++;
        cfq_update_io_thinktime(cfqd, cfqq, cic);
        cfq_update_io_seektime(cfqd, cfqq, rq);
diff --git a/drivers/acpi/acpica/acconfig.h b/drivers/acpi/acpica/acconfig.h
index bc533dde16c4..f895a244ca7e 100644
--- a/drivers/acpi/acpica/acconfig.h
+++ b/drivers/acpi/acpica/acconfig.h
@@ -121,7 +121,7 @@
 /* Maximum sleep allowed via Sleep() operator */
-#define ACPI_MAX_SLEEP                  20000   /* Two seconds */
+#define ACPI_MAX_SLEEP                  2000    /* Two seconds */
 /******************************************************************************
 *
diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig
index c34aa51af4ee..e3f47872ec22 100644
--- a/drivers/acpi/apei/Kconfig
+++ b/drivers/acpi/apei/Kconfig
@@ -13,6 +13,7 @@ config ACPI_APEI_GHES
        bool "APEI Generic Hardware Error Source"
        depends on ACPI_APEI && X86
        select ACPI_HED
+        select IRQ_WORK
        select LLIST
        select GENERIC_ALLOCATOR
        help
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index 8041248fce9b..61540360d5ce 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -618,7 +618,7 @@ int apei_osc_setup(void)
        };
        capbuf[OSC_QUERY_TYPE] = OSC_QUERY_ENABLE;
-        capbuf[OSC_SUPPORT_TYPE] = 0;
+        capbuf[OSC_SUPPORT_TYPE] = 1;
        capbuf[OSC_CONTROL_TYPE] = 0;
        if (ACPI_FAILURE(acpi_get_handle(NULL, "\\_SB", &handle))
diff --git a/drivers/base/devres.c b/drivers/base/devres.c
index cf7a0c788052..65cd74832450 100644
--- a/drivers/base/devres.c
+++ b/drivers/base/devres.c
@@ -397,6 +397,7 @@ static int remove_nodes(struct device *dev,
 static int release_nodes(struct device *dev, struct list_head *first,
                         struct list_head *end, unsigned long flags)
+        __releases(&dev->devres_lock)
 {
        LIST_HEAD(todo);
        int cnt;
diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
index 33e1bed68fdd..a4760e095ff5 100644
--- a/drivers/base/devtmpfs.c
+++ b/drivers/base/devtmpfs.c
@@ -376,7 +376,7 @@ int devtmpfs_mount(const char *mntdir)
        return err;
 }
-static __initdata DECLARE_COMPLETION(setup_done);
+static DECLARE_COMPLETION(setup_done);
 static int handle(const char *name, mode_t mode, struct device *dev)
 {
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index bbb03e6f7255..06ed6b4e7df5 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -521,11 +521,6 @@ static int _request_firmware(const struct firmware **firmware_p,
        if (!firmware_p)
                return -EINVAL;
-        if (WARN_ON(usermodehelper_is_disabled())) {
-                dev_err(device, "firmware: %s will not be loaded\n", name);
-                return -EBUSY;
-        }
        *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
        if (!firmware) {
                dev_err(device, "%s: kmalloc(struct firmware) failed\n",
@@ -539,6 +534,12 @@ static int _request_firmware(const struct firmware **firmware_p,
                return 0;
        }
+        if (WARN_ON(usermodehelper_is_disabled())) {
+                dev_err(device, "firmware: %s will not be loaded\n", name);
+                retval = -EBUSY;
+                goto out;
+        }
        if (uevent)
                dev_dbg(device, "firmware: requesting %s\n", name);
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 0cad9c7f6bb5..99a5272d7c2f 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -33,7 +33,7 @@ EXPORT_SYMBOL_GPL(platform_bus);
 /**
 * arch_setup_pdev_archdata - Allow manipulation of archdata before its used
- * @dev: platform device
+ * @pdev: platform device
 *
 * This is called before platform_device_add() such that any pdev_archdata may
 * be setup before the platform_notifier is called.  So if a user needs to
diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c
index cb44b58d6813..b876e60a53ef 100644
--- a/drivers/base/power/clock_ops.c
+++ b/drivers/base/power/clock_ops.c
@@ -32,6 +32,22 @@ struct pm_clock_entry {
 };
 /**
+ * pm_clk_acquire - Acquire a device clock.
+ * @dev: Device whose clock is to be acquired.
+ * @ce: PM clock entry corresponding to the clock.
+ */
+static void pm_clk_acquire(struct device *dev, struct pm_clock_entry *ce)
+{
+        ce->clk = clk_get(dev, ce->con_id);
+        if (IS_ERR(ce->clk)) {
+                ce->status = PCE_STATUS_ERROR;
+        } else {
+                ce->status = PCE_STATUS_ACQUIRED;
+                dev_dbg(dev, "Clock %s managed by runtime PM.\n", ce->con_id);
+        }
+}
+/**
 * pm_clk_add - Start using a device clock for power management.
 * @dev: Device whose clock is going to be used for power management.
 * @con_id: Connection ID of the clock.
@@ -63,6 +79,8 @@ int pm_clk_add(struct device *dev, const char *con_id)
                }
        }
+        pm_clk_acquire(dev, ce);
        spin_lock_irq(&psd->lock);
        list_add_tail(&ce->node, &psd->clock_list);
        spin_unlock_irq(&psd->lock);
@@ -72,17 +90,12 @@ int pm_clk_add(struct device *dev, const char *con_id)
 /**
 * __pm_clk_remove - Destroy PM clock entry.
 * @ce: PM clock entry to destroy.
- *
- * This routine must be called under the spinlock protecting the PM list of
- * clocks corresponding the the @ce's device.
 */
 static void __pm_clk_remove(struct pm_clock_entry *ce)
 {
        if (!ce)
                return;
-        list_del(&ce->node);
        if (ce->status < PCE_STATUS_ERROR) {
                if (ce->status == PCE_STATUS_ENABLED)
                        clk_disable(ce->clk);
@@ -116,18 +129,22 @@ void pm_clk_remove(struct device *dev, const char *con_id)
        spin_lock_irq(&psd->lock);
        list_for_each_entry(ce, &psd->clock_list, node) {
-                if (!con_id && !ce->con_id) {
+                if (!con_id && !ce->con_id)
-                        __pm_clk_remove(ce);
+                        goto remove;
-                        break;
+                else if (!con_id || !ce->con_id)
-                } else if (!con_id || !ce->con_id) {
                        continue;
-                } else if (!strcmp(con_id, ce->con_id)) {
+                else if (!strcmp(con_id, ce->con_id))
-                        __pm_clk_remove(ce);
+                        goto remove;
-                        break;
-                }
        }
        spin_unlock_irq(&psd->lock);
+        return;
+ remove:
+        list_del(&ce->node);
+        spin_unlock_irq(&psd->lock);
+        __pm_clk_remove(ce);
 }
 /**
@@ -169,18 +186,26 @@ void pm_clk_destroy(struct device *dev)
 {
        struct pm_subsys_data *psd = dev_to_psd(dev);
        struct pm_clock_entry *ce, *c;
+        struct list_head list;
        if (!psd)
                return;
+        INIT_LIST_HEAD(&list);
        spin_lock_irq(&psd->lock);
        list_for_each_entry_safe_reverse(ce, c, &psd->clock_list, node)
-                __pm_clk_remove(ce);
+                list_move(&ce->node, &list);
        spin_unlock_irq(&psd->lock);
        dev_pm_put_subsys_data(dev);
+        list_for_each_entry_safe_reverse(ce, c, &list, node) {
+                list_del(&ce->node);
+                __pm_clk_remove(ce);
+        }
 }
 #endif /* CONFIG_PM */
@@ -188,23 +213,6 @@ void pm_clk_destroy(struct device *dev)
 #ifdef CONFIG_PM_RUNTIME
 /**
- * pm_clk_acquire - Acquire a device clock.
- * @dev: Device whose clock is to be acquired.
- * @con_id: Connection ID of the clock.
- */
-static void pm_clk_acquire(struct device *dev,
-                                    struct pm_clock_entry *ce)
-{
-        ce->clk = clk_get(dev, ce->con_id);
-        if (IS_ERR(ce->clk)) {
-                ce->status = PCE_STATUS_ERROR;
-        } else {
-                ce->status = PCE_STATUS_ACQUIRED;
-                dev_dbg(dev, "Clock %s managed by runtime PM.\n", ce->con_id);
-        }
-}
-/**
 * pm_clk_suspend - Disable clocks in a device's PM clock list.
 * @dev: Device to disable the clocks for.
 */
@@ -222,9 +230,6 @@ int pm_clk_suspend(struct device *dev)
        spin_lock_irqsave(&psd->lock, flags);
        list_for_each_entry_reverse(ce, &psd->clock_list, node) {
-                if (ce->status == PCE_STATUS_NONE)
-                        pm_clk_acquire(dev, ce);
                if (ce->status < PCE_STATUS_ERROR) {
                        clk_disable(ce->clk);
                        ce->status = PCE_STATUS_ACQUIRED;
@@ -254,9 +259,6 @@ int pm_clk_resume(struct device *dev)
        spin_lock_irqsave(&psd->lock, flags);
        list_for_each_entry(ce, &psd->clock_list, node) {
-                if (ce->status == PCE_STATUS_NONE)
-                        pm_clk_acquire(dev, ce);
                if (ce->status < PCE_STATUS_ERROR) {
                        clk_enable(ce->clk);
                        ce->status = PCE_STATUS_ENABLED;
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 0eef4da1ac61..20663f8dae45 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -168,13 +168,11 @@ struct regmap *regmap_init(struct device *dev,
        map->work_buf = kmalloc(map->format.buf_size, GFP_KERNEL);
        if (map->work_buf == NULL) {
                ret = -ENOMEM;
-                goto err_bus;
+                goto err_map;
        }
        return map;
-err_bus:
-        module_put(map->bus->owner);
 err_map:
        kfree(map);
 err:
@@ -188,7 +186,6 @@ EXPORT_SYMBOL_GPL(regmap_init);
 void regmap_exit(struct regmap *map)
 {
        kfree(map->work_buf);
-        module_put(map->bus->owner);
        kfree(map);
 }
 EXPORT_SYMBOL_GPL(regmap_exit);
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 873e2e4ac55f..73b7b1a18fab 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -15,6 +15,7 @@ MODULE_LICENSE("GPL");
 static int bcma_bus_match(struct device *dev, struct device_driver *drv);
 static int bcma_device_probe(struct device *dev);
 static int bcma_device_remove(struct device *dev);
+static int bcma_device_uevent(struct device *dev, struct kobj_uevent_env *env);
 static ssize_t manuf_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
@@ -49,6 +50,7 @@ static struct bus_type bcma_bus_type = {
        .match          = bcma_bus_match,
        .probe          = bcma_device_probe,
        .remove         = bcma_device_remove,
+        .uevent         = bcma_device_uevent,
        .dev_attrs      = bcma_device_attrs,
 };
@@ -227,6 +229,16 @@ static int bcma_device_remove(struct device *dev)
        return 0;
 }
+static int bcma_device_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        struct bcma_device *core = container_of(dev, struct bcma_device, dev);
+        return add_uevent_var(env,
+                              "MODALIAS=bcma:m%04Xid%04Xrev%02Xcl%02X",
+                              core->id.manuf, core->id.id,
+                              core->id.rev, core->id.class);
+}
 static int __init bcma_modinit(void)
 {
        int err;
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 98de8f418676..9955a53733b2 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4250,7 +4250,7 @@ static int __init floppy_init(void)
        use_virtual_dma = can_use_virtual_dma & 1;
        fdc_state[0].address = FDC1;
        if (fdc_state[0].address == -1) {
-                del_timer(&fd_timeout);
+                del_timer_sync(&fd_timeout);
                err = -ENODEV;
                goto out_unreg_region;
        }
@@ -4261,7 +4261,7 @@ static int __init floppy_init(void)
        fdc = 0;                /* reset fdc in case of unexpected interrupt */
        err = floppy_grab_irq_and_dma();
        if (err) {
-                del_timer(&fd_timeout);
+                del_timer_sync(&fd_timeout);
                err = -EBUSY;
                goto out_unreg_region;
        }
@@ -4318,7 +4318,7 @@ static int __init floppy_init(void)
                user_reset_fdc(-1, FD_RESET_ALWAYS, false);
        }
        fdc = 0;
-        del_timer(&fd_timeout);
+        del_timer_sync(&fd_timeout);
        current_drive = 0;
        initialized = true;
        if (have_no_fdc) {
@@ -4368,7 +4368,7 @@ out_unreg_blkdev:
        unregister_blkdev(FLOPPY_MAJOR, "fd");
 out_put_disk:
        while (dr--) {
-                del_timer(&motor_off_timer[dr]);
+                del_timer_sync(&motor_off_timer[dr]);
                if (disks[dr]->queue)
                        blk_cleanup_queue(disks[dr]->queue);
                put_disk(disks[dr]);
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 9e40b283a468..00c57c90e2d6 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -46,7 +46,7 @@
 #define DRV_PFX "xen-blkback:"
 #define DPRINTK(fmt, args...)                           \
-        pr_debug(DRV_PFX "(%s:%d) " fmt ".\n",  \
+        pr_debug(DRV_PFX "(%s:%d) " fmt ".\n",          \
                 __func__, __LINE__, ##args)
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 3f129b45451a..5fd2010f7d2b 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -590,7 +590,7 @@ static void frontend_changed(struct xenbus_device *dev,
                /*
                 * Enforce precondition before potential leak point.
-                 * blkif_disconnect() is idempotent.
+                 * xen_blkif_disconnect() is idempotent.
                 */
                xen_blkif_disconnect(be->blkif);
@@ -601,17 +601,17 @@ static void frontend_changed(struct xenbus_device *dev,
                break;
        case XenbusStateClosing:
-                xen_blkif_disconnect(be->blkif);
                xenbus_switch_state(dev, XenbusStateClosing);
                break;
        case XenbusStateClosed:
+                xen_blkif_disconnect(be->blkif);
                xenbus_switch_state(dev, XenbusStateClosed);
                if (xenbus_dev_is_online(dev))
                        break;
                /* fall through if not online */
        case XenbusStateUnknown:
-                /* implies blkif_disconnect() via blkback_remove() */
+                /* implies xen_blkif_disconnect() via xen_blkbk_remove() */
                device_unregister(&dev->dev);
                break;
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index a5854735bb2e..db7cb8111fbe 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -63,6 +63,7 @@ static struct usb_device_id ath3k_table[] = {
        /* Atheros AR3011 with sflash firmware*/
        { USB_DEVICE(0x0CF3, 0x3002) },
        { USB_DEVICE(0x13d3, 0x3304) },
+        { USB_DEVICE(0x0930, 0x0215) },
        /* Atheros AR9285 Malbec with sflash firmware */
        { USB_DEVICE(0x03F0, 0x311D) },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 91d13a9e8c65..9cbac6b445e1 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -72,9 +72,15 @@ static struct usb_device_id btusb_table[] = {
        /* Apple MacBookAir3,1, MacBookAir3,2 */
        { USB_DEVICE(0x05ac, 0x821b) },
+        /* Apple MacBookAir4,1 */
+        { USB_DEVICE(0x05ac, 0x821f) },
        /* Apple MacBookPro8,2 */
        { USB_DEVICE(0x05ac, 0x821a) },
+        /* Apple MacMini5,1 */
+        { USB_DEVICE(0x05ac, 0x8281) },
        /* AVM BlueFRITZ! USB v2.0 */
        { USB_DEVICE(0x057c, 0x3800) },
@@ -106,6 +112,7 @@ static struct usb_device_id blacklist_table[] = {
        /* Atheros 3011 with sflash firmware */
        { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
        { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
+        { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
        /* Atheros AR9285 Malbec with sflash firmware */
        { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
@@ -256,7 +263,9 @@ static void btusb_intr_complete(struct urb *urb)
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err < 0) {
-                if (err != -EPERM)
+                /* -EPERM: urb is being killed;
+                 * -ENODEV: device got disconnected */
+                if (err != -EPERM && err != -ENODEV)
                        BT_ERR("%s urb %p failed to resubmit (%d)",
                                                hdev->name, urb, -err);
                usb_unanchor_urb(urb);
@@ -341,7 +350,9 @@ static void btusb_bulk_complete(struct urb *urb)
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err < 0) {
-                if (err != -EPERM)
+                /* -EPERM: urb is being killed;
+                 * -ENODEV: device got disconnected */
+                if (err != -EPERM && err != -ENODEV)
                        BT_ERR("%s urb %p failed to resubmit (%d)",
                                                hdev->name, urb, -err);
                usb_unanchor_urb(urb);
@@ -431,7 +442,9 @@ static void btusb_isoc_complete(struct urb *urb)
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (err < 0) {
-                if (err != -EPERM)
+                /* -EPERM: urb is being killed;
+                 * -ENODEV: device got disconnected */
+                if (err != -EPERM && err != -ENODEV)
                        BT_ERR("%s urb %p failed to resubmit (%d)",
                                                hdev->name, urb, -err);
                usb_unanchor_urb(urb);
diff --git a/drivers/bluetooth/btwilink.c b/drivers/bluetooth/btwilink.c
index 65d27aff553a..04d353f58d71 100644
--- a/drivers/bluetooth/btwilink.c
+++ b/drivers/bluetooth/btwilink.c
@@ -125,6 +125,13 @@ static long st_receive(void *priv_data, struct sk_buff *skb)
 /* protocol structure registered with shared transport */
 static struct st_proto_s ti_st_proto[MAX_BT_CHNL_IDS] = {
        {
+                .chnl_id = HCI_EVENT_PKT, /* HCI Events */
+                .hdr_len = sizeof(struct hci_event_hdr),
+                .offset_len_in_hdr = offsetof(struct hci_event_hdr, plen),
+                .len_size = 1, /* sizeof(plen) in struct hci_event_hdr */
+                .reserve = 8,
+        },
+        {
                .chnl_id = HCI_ACLDATA_PKT, /* ACL */
                .hdr_len = sizeof(struct hci_acl_hdr),
                .offset_len_in_hdr = offsetof(struct hci_acl_hdr, dlen),
@@ -138,13 +145,6 @@ static struct st_proto_s ti_st_proto[MAX_BT_CHNL_IDS] = {
                .len_size = 1, /* sizeof(dlen) in struct hci_sco_hdr */
                .reserve = 8,
        },
-        {
-                .chnl_id = HCI_EVENT_PKT, /* HCI Events */
-                .hdr_len = sizeof(struct hci_event_hdr),
-                .offset_len_in_hdr = offsetof(struct hci_event_hdr, plen),
-                .len_size = 1, /* sizeof(plen) in struct hci_event_hdr */
-                .reserve = 8,
-        },
 };
 /* Called from HCI core to initialize the device */
@@ -240,7 +240,7 @@ static int ti_st_close(struct hci_dev *hdev)
        if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
                return 0;
-        for (i = 0; i < MAX_BT_CHNL_IDS; i++) {
+        for (i = MAX_BT_CHNL_IDS-1; i >= 0; i--) {
                err = st_unregister(&ti_st_proto[i]);
                if (err)
                        BT_ERR("st_unregister(%d) failed with error %d",
diff --git a/drivers/char/msm_smd_pkt.c b/drivers/char/msm_smd_pkt.c
index b6f8a65c9960..8eca55deb3a3 100644
--- a/drivers/char/msm_smd_pkt.c
+++ b/drivers/char/msm_smd_pkt.c
@@ -379,9 +379,8 @@ static int __init smd_pkt_init(void)
        for (i = 0; i < NUM_SMD_PKT_PORTS; ++i) {
                smd_pkt_devp[i] = kzalloc(sizeof(struct smd_pkt_dev),
                                          GFP_KERNEL);
-                if (IS_ERR(smd_pkt_devp[i])) {
+                if (!smd_pkt_devp[i]) {
-                        r = PTR_ERR(smd_pkt_devp[i]);
+                        pr_err("kmalloc() failed\n");
-                        pr_err("kmalloc() failed %d\n", r);
                        goto clean_cdevs;
                }
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index f6595aba4f0f..fa567f1158c2 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -43,6 +43,7 @@ config TCG_NSC
 config TCG_ATMEL
        tristate "Atmel TPM Interface"
+        depends on PPC64 || HAS_IOPORT
        ---help---
          If you have a TPM security chip from Atmel say Yes and it 
          will be accessible from within Linux.  To compile this driver 
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index caf8012ef47c..9ca5c021d0b6 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -383,6 +383,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
        u32 count, ordinal;
        unsigned long stop;
+        if (bufsiz > TPM_BUFSIZE)
+                bufsiz = TPM_BUFSIZE;
        count = be32_to_cpu(*((__be32 *) (buf + 2)));
        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
        if (count == 0)
@@ -1102,6 +1105,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
 {
        struct tpm_chip *chip = file->private_data;
        ssize_t ret_size;
+        int rc;
        del_singleshot_timer_sync(&chip->user_read_timer);
        flush_work_sync(&chip->work);
@@ -1112,8 +1116,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
                        ret_size = size;
                mutex_lock(&chip->buffer_mutex);
-                if (copy_to_user(buf, chip->data_buffer, ret_size))
+                rc = copy_to_user(buf, chip->data_buffer, ret_size);
+                memset(chip->data_buffer, 0, ret_size);
+                if (rc)
                        ret_size = -EFAULT;
                mutex_unlock(&chip->buffer_mutex);
        }
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 82facc9104c7..4d2464871ada 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void)
        if (pdev) {
                tpm_nsc_remove(&pdev->dev);
                platform_device_unregister(pdev);
-                kfree(pdev);
-                pdev = NULL;
        }
        platform_driver_unregister(&nsc_drv);
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index dc7c033ef587..32a77becc098 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -26,6 +26,7 @@
 #include <linux/clk.h>
 #include <linux/irq.h>
 #include <linux/err.h>
+#include <linux/delay.h>
 #include <linux/clocksource.h>
 #include <linux/clockchips.h>
 #include <linux/sh_timer.h>
@@ -150,13 +151,13 @@ static void sh_cmt_start_stop_ch(struct sh_cmt_priv *p, int start)
 static int sh_cmt_enable(struct sh_cmt_priv *p, unsigned long *rate)
 {
-        int ret;
+        int k, ret;
        /* enable clock */
        ret = clk_enable(p->clk);
        if (ret) {
                dev_err(&p->pdev->dev, "cannot enable clock\n");
-                return ret;
+                goto err0;
        }
        /* make sure channel is disabled */
@@ -174,9 +175,38 @@ static int sh_cmt_enable(struct sh_cmt_priv *p, unsigned long *rate)
        sh_cmt_write(p, CMCOR, 0xffffffff);
        sh_cmt_write(p, CMCNT, 0);
+        /*
+         * According to the sh73a0 user's manual, as CMCNT can be operated
+         * only by the RCLK (Pseudo 32 KHz), there's one restriction on
+         * modifying CMCNT register; two RCLK cycles are necessary before
+         * this register is either read or any modification of the value
+         * it holds is reflected in the LSI's actual operation.
+         *
+         * While at it, we're supposed to clear out the CMCNT as of this
+         * moment, so make sure it's processed properly here.  This will
+         * take RCLKx2 at maximum.
+         */
+        for (k = 0; k < 100; k++) {
+                if (!sh_cmt_read(p, CMCNT))
+                        break;
+                udelay(1);
+        }
+        if (sh_cmt_read(p, CMCNT)) {
+                dev_err(&p->pdev->dev, "cannot clear CMCNT\n");
+                ret = -ETIMEDOUT;
+                goto err1;
+        }
        /* enable channel */
        sh_cmt_start_stop_ch(p, 1);
        return 0;
+ err1:
+        /* stop clock */
+        clk_disable(p->clk);
+ err0:
+        return ret;
 }
 static void sh_cmt_disable(struct sh_cmt_priv *p)
diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
index 7b0603eb0129..cdc02ac8f41a 100644
--- a/drivers/cpufreq/pcc-cpufreq.c
+++ b/drivers/cpufreq/pcc-cpufreq.c
@@ -261,6 +261,9 @@ static int pcc_get_offset(int cpu)
        pr = per_cpu(processors, cpu);
        pcc_cpu_data = per_cpu_ptr(pcc_cpu_info, cpu);
+        if (!pr)
+                return -ENODEV;
        status = acpi_evaluate_object(pr->handle, "PCCP", NULL, &buffer);
        if (ACPI_FAILURE(status))
                return -ENODEV;
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index cd3a7c726bf8..467e4dcb20a0 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -174,8 +174,10 @@ struct d40_base;
 * @tasklet: Tasklet that gets scheduled from interrupt context to complete a
 * transfer and call client callback.
 * @client: Cliented owned descriptor list.
+ * @pending_queue: Submitted jobs, to be issued by issue_pending()
 * @active: Active descriptor.
 * @queue: Queued jobs.
+ * @prepare_queue: Prepared jobs.
 * @dma_cfg: The client configuration of this dma channel.
 * @configured: whether the dma_cfg configuration is valid
 * @base: Pointer to the device instance struct.
@@ -203,6 +205,7 @@ struct d40_chan {
        struct list_head                 pending_queue;
        struct list_head                 active;
        struct list_head                 queue;
+        struct list_head                 prepare_queue;
        struct stedma40_chan_cfg         dma_cfg;
        bool                             configured;
        struct d40_base                 *base;
@@ -477,7 +480,6 @@ static struct d40_desc *d40_desc_get(struct d40_chan *d40c)
                list_for_each_entry_safe(d, _d, &d40c->client, node)
                        if (async_tx_test_ack(&d->txd)) {
-                                d40_pool_lli_free(d40c, d);
                                d40_desc_remove(d);
                                desc = d;
                                memset(desc, 0, sizeof(*desc));
@@ -644,8 +646,11 @@ static struct d40_desc *d40_first_active_get(struct d40_chan *d40c)
        return d;
 }
+/* remove desc from current queue and add it to the pending_queue */
 static void d40_desc_queue(struct d40_chan *d40c, struct d40_desc *desc)
 {
+        d40_desc_remove(desc);
+        desc->is_in_client_list = false;
        list_add_tail(&desc->node, &d40c->pending_queue);
 }
@@ -803,6 +808,7 @@ done:
 static void d40_term_all(struct d40_chan *d40c)
 {
        struct d40_desc *d40d;
+        struct d40_desc *_d;
        /* Release active descriptors */
        while ((d40d = d40_first_active_get(d40c))) {
@@ -822,6 +828,21 @@ static void d40_term_all(struct d40_chan *d40c)
                d40_desc_free(d40c, d40d);
        }
+        /* Release client owned descriptors */
+        if (!list_empty(&d40c->client))
+                list_for_each_entry_safe(d40d, _d, &d40c->client, node) {
+                        d40_desc_remove(d40d);
+                        d40_desc_free(d40c, d40d);
+                }
+        /* Release descriptors in prepare queue */
+        if (!list_empty(&d40c->prepare_queue))
+                list_for_each_entry_safe(d40d, _d,
+                                         &d40c->prepare_queue, node) {
+                        d40_desc_remove(d40d);
+                        d40_desc_free(d40c, d40d);
+                }
        d40c->pending_tx = 0;
        d40c->busy = false;
 }
@@ -1208,7 +1229,6 @@ static void dma_tasklet(unsigned long data)
        if (!d40d->cyclic) {
                if (async_tx_test_ack(&d40d->txd)) {
-                        d40_pool_lli_free(d40c, d40d);
                        d40_desc_remove(d40d);
                        d40_desc_free(d40c, d40d);
                } else {
@@ -1595,21 +1615,10 @@ static int d40_free_dma(struct d40_chan *d40c)
        u32 event;
        struct d40_phy_res *phy = d40c->phy_chan;
        bool is_src;
-        struct d40_desc *d;
-        struct d40_desc *_d;
        /* Terminate all queued and active transfers */
        d40_term_all(d40c);
-        /* Release client owned descriptors */
-        if (!list_empty(&d40c->client))
-                list_for_each_entry_safe(d, _d, &d40c->client, node) {
-                        d40_pool_lli_free(d40c, d);
-                        d40_desc_remove(d);
-                        d40_desc_free(d40c, d);
-                }
        if (phy == NULL) {
                chan_err(d40c, "phy == null\n");
                return -EINVAL;
@@ -1911,6 +1920,12 @@ d40_prep_sg(struct dma_chan *dchan, struct scatterlist *sg_src,
                goto err;
        }
+        /*
+         * add descriptor to the prepare queue in order to be able
+         * to free them later in terminate_all
+         */
+        list_add_tail(&desc->node, &chan->prepare_queue);
        spin_unlock_irqrestore(&chan->lock, flags);
        return &desc->txd;
@@ -2400,6 +2415,7 @@ static void __init d40_chan_init(struct d40_base *base, struct dma_device *dma,
                INIT_LIST_HEAD(&d40c->queue);
                INIT_LIST_HEAD(&d40c->pending_queue);
                INIT_LIST_HEAD(&d40c->client);
+                INIT_LIST_HEAD(&d40c->prepare_queue);
                tasklet_init(&d40c->tasklet, dma_tasklet,
                             (unsigned long) d40c);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 57cd3a406edf..fd7170a9ad2c 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -290,6 +290,9 @@ static const struct {
        {PCI_VENDOR_ID_NEC, PCI_ANY_ID, PCI_ANY_ID,
                QUIRK_CYCLE_TIMER},
+        {PCI_VENDOR_ID_O2, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_NO_MSI},
        {PCI_VENDOR_ID_RICOH, PCI_ANY_ID, PCI_ANY_ID,
                QUIRK_CYCLE_TIMER},
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 41841a3e3f99..17cef864506a 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1198,6 +1198,10 @@ static int sbp2_remove(struct device *dev)
 {
        struct fw_unit *unit = fw_unit(dev);
        struct sbp2_target *tgt = dev_get_drvdata(&unit->device);
+        struct sbp2_logical_unit *lu;
+        list_for_each_entry(lu, &tgt->lu_list, link)
+                cancel_delayed_work_sync(&lu->work);
        sbp2_target_put(tgt);
        return 0;
diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
index 68810fd1a59d..aa83de9db1b9 100644
--- a/drivers/firmware/google/gsmi.c
+++ b/drivers/firmware/google/gsmi.c
@@ -420,7 +420,7 @@ static efi_status_t gsmi_get_next_variable(unsigned long *name_size,
 static efi_status_t gsmi_set_variable(efi_char16_t *name,
                                      efi_guid_t *vendor,
-                                      unsigned long attr,
+                                      u32 attr,
                                      unsigned long data_size,
                                      void *data)
 {
diff --git a/drivers/gpio/gpio-generic.c b/drivers/gpio/gpio-generic.c
index 231714def4d2..4e24436b0f82 100644
--- a/drivers/gpio/gpio-generic.c
+++ b/drivers/gpio/gpio-generic.c
@@ -351,7 +351,7 @@ static int bgpio_setup_direction(struct bgpio_chip *bgc,
        return 0;
 }
-int __devexit bgpio_remove(struct bgpio_chip *bgc)
+int bgpio_remove(struct bgpio_chip *bgc)
 {
        int err = gpiochip_remove(&bgc->gc);
@@ -361,15 +361,10 @@ int __devexit bgpio_remove(struct bgpio_chip *bgc)
 }
 EXPORT_SYMBOL_GPL(bgpio_remove);
-int __devinit bgpio_init(struct bgpio_chip *bgc,
+int bgpio_init(struct bgpio_chip *bgc, struct device *dev,
-                         struct device *dev,
+               unsigned long sz, void __iomem *dat, void __iomem *set,
-                         unsigned long sz,
+               void __iomem *clr, void __iomem *dirout, void __iomem *dirin,
-                         void __iomem *dat,
+               bool big_endian)
-                         void __iomem *set,
-                         void __iomem *clr,
-                         void __iomem *dirout,
-                         void __iomem *dirin,
-                         bool big_endian)
 {
        int ret;
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 82db18506662..fe738f05309b 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -499,6 +499,7 @@ void drm_connector_cleanup(struct drm_connector *connector)
        mutex_lock(&dev->mode_config.mutex);
        drm_mode_object_put(dev, &connector->base);
        list_del(&connector->head);
+        dev->mode_config.num_connector--;
        mutex_unlock(&dev->mode_config.mutex);
 }
 EXPORT_SYMBOL(drm_connector_cleanup);
@@ -529,6 +530,7 @@ void drm_encoder_cleanup(struct drm_encoder *encoder)
        mutex_lock(&dev->mode_config.mutex);
        drm_mode_object_put(dev, &encoder->base);
        list_del(&encoder->head);
+        dev->mode_config.num_encoder--;
        mutex_unlock(&dev->mode_config.mutex);
 }
 EXPORT_SYMBOL(drm_encoder_cleanup);
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 802b61ac3139..f7c6854eb4dd 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -256,7 +256,6 @@ int drm_fb_helper_panic(struct notifier_block *n, unsigned long ununsed,
 {
        printk(KERN_ERR "panic occurred, switching back to text console\n");
        return drm_fb_helper_force_kernel_mode();
-        return 0;
 }
 EXPORT_SYMBOL(drm_fb_helper_panic);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index ee1d701317f7..56a8554d9039 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -878,7 +878,7 @@ static void assert_panel_unlocked(struct drm_i915_private *dev_priv,
        int pp_reg, lvds_reg;
        u32 val;
        enum pipe panel_pipe = PIPE_A;
-        bool locked = locked;
+        bool locked = true;
        if (HAS_PCH_SPLIT(dev_priv->dev)) {
                pp_reg = PCH_PP_CONTROL;
@@ -7238,8 +7238,6 @@ static void intel_setup_outputs(struct drm_device *dev)
                        intel_encoder_clones(dev, encoder->clone_mask);
        }
-        intel_panel_setup_backlight(dev);
        /* disable all the possible outputs/crtcs before entering KMS mode */
        drm_helper_disable_unused_functions(dev);
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 8d02d875376d..c919cfc8f2fd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -530,7 +530,8 @@ nouveau_fence_channel_init(struct nouveau_channel *chan)
                nouveau_gpuobj_ref(NULL, &obj);
                if (ret)
                        return ret;
-        } else {
+        } else
+        if (USE_SEMA(dev)) {
                /* map fence bo into channel's vm */
                ret = nouveau_bo_vma_add(dev_priv->fence.bo, chan->vm,
                                         &chan->fence.vma);
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
index c444cadbf849..2706cb3d871a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -37,8 +37,11 @@ nouveau_sgdma_populate(struct ttm_backend *be, unsigned long num_pages,
                return -ENOMEM;
        nvbe->ttm_alloced = kmalloc(sizeof(bool) * num_pages, GFP_KERNEL);
-        if (!nvbe->ttm_alloced)
+        if (!nvbe->ttm_alloced) {
+                kfree(nvbe->pages);
+                nvbe->pages = NULL;
                return -ENOMEM;
+        }
        nvbe->nr_pages = 0;
        while (num_pages--) {
@@ -126,7 +129,7 @@ nv04_sgdma_bind(struct ttm_backend *be, struct ttm_mem_reg *mem)
                for (j = 0; j < PAGE_SIZE / NV_CTXDMA_PAGE_SIZE; j++, pte++) {
                        nv_wo32(gpuobj, (pte * 4) + 0, offset_l | 3);
-                        dma_offset += NV_CTXDMA_PAGE_SIZE;
+                        offset_l += NV_CTXDMA_PAGE_SIZE;
                }
        }
diff --git a/drivers/gpu/drm/nouveau/nv04_crtc.c b/drivers/gpu/drm/nouveau/nv04_crtc.c
index 118261d4927a..5e45398a9e2d 100644
--- a/drivers/gpu/drm/nouveau/nv04_crtc.c
+++ b/drivers/gpu/drm/nouveau/nv04_crtc.c
@@ -781,11 +781,20 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
        struct drm_device *dev = crtc->dev;
        struct drm_nouveau_private *dev_priv = dev->dev_private;
        struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
-        struct drm_framebuffer *drm_fb = nv_crtc->base.fb;
+        struct drm_framebuffer *drm_fb;
-        struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);
+        struct nouveau_framebuffer *fb;
        int arb_burst, arb_lwm;
        int ret;
+        NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
+        /* no fb bound */
+        if (!atomic && !crtc->fb) {
+                NV_DEBUG_KMS(dev, "No FB bound\n");
+                return 0;
+        }
        /* If atomic, we want to switch to the fb we were passed, so
         * now we update pointers to do that.  (We don't pin; just
         * assume we're already pinned and update the base address.)
@@ -794,6 +803,8 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
                drm_fb = passed_fb;
                fb = nouveau_framebuffer(passed_fb);
        } else {
+                drm_fb = crtc->fb;
+                fb = nouveau_framebuffer(crtc->fb);
                /* If not atomic, we can go ahead and pin, and unpin the
                 * old fb we were passed.
                 */
diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
index 46ad59ea2185..5d989073ba6e 100644
--- a/drivers/gpu/drm/nouveau/nv50_crtc.c
+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
@@ -519,12 +519,18 @@ nv50_crtc_do_mode_set_base(struct drm_crtc *crtc,
        struct drm_device *dev = nv_crtc->base.dev;
        struct drm_nouveau_private *dev_priv = dev->dev_private;
        struct nouveau_channel *evo = nv50_display(dev)->master;
-        struct drm_framebuffer *drm_fb = nv_crtc->base.fb;
+        struct drm_framebuffer *drm_fb;
-        struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);
+        struct nouveau_framebuffer *fb;
        int ret;
        NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
+        /* no fb bound */
+        if (!atomic && !crtc->fb) {
+                NV_DEBUG_KMS(dev, "No FB bound\n");
+                return 0;
+        }
        /* If atomic, we want to switch to the fb we were passed, so
         * now we update pointers to do that.  (We don't pin; just
         * assume we're already pinned and update the base address.)
@@ -533,6 +539,8 @@ nv50_crtc_do_mode_set_base(struct drm_crtc *crtc,
                drm_fb = passed_fb;
                fb = nouveau_framebuffer(passed_fb);
        } else {
+                drm_fb = crtc->fb;
+                fb = nouveau_framebuffer(crtc->fb);
                /* If not atomic, we can go ahead and pin, and unpin the
                 * old fb we were passed.
                 */
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index fb5fa0898868..e8a746712b5b 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -41,6 +41,31 @@ static void evergreen_gpu_init(struct radeon_device *rdev);
 void evergreen_fini(struct radeon_device *rdev);
 static void evergreen_pcie_gen2_enable(struct radeon_device *rdev);
+void evergreen_fix_pci_max_read_req_size(struct radeon_device *rdev)
+{
+        u16 ctl, v;
+        int cap, err;
+        cap = pci_pcie_cap(rdev->pdev);
+        if (!cap)
+                return;
+        err = pci_read_config_word(rdev->pdev, cap + PCI_EXP_DEVCTL, &ctl);
+        if (err)
+                return;
+        v = (ctl & PCI_EXP_DEVCTL_READRQ) >> 12;
+        /* if bios or OS sets MAX_READ_REQUEST_SIZE to an invalid value, fix it
+         * to avoid hangs or perfomance issues
+         */
+        if ((v == 0) || (v == 6) || (v == 7)) {
+                ctl &= ~PCI_EXP_DEVCTL_READRQ;
+                ctl |= (2 << 12);
+                pci_write_config_word(rdev->pdev, cap + PCI_EXP_DEVCTL, ctl);
+        }
+}
 void evergreen_pre_page_flip(struct radeon_device *rdev, int crtc)
 {
        /* enable the pflip int */
@@ -1357,6 +1382,7 @@ int evergreen_cp_resume(struct radeon_device *rdev)
                                 SOFT_RESET_PA |
                                 SOFT_RESET_SH |
                                 SOFT_RESET_VGT |
+                                 SOFT_RESET_SPI |
                                 SOFT_RESET_SX));
        RREG32(GRBM_SOFT_RESET);
        mdelay(15);
@@ -1378,7 +1404,8 @@ int evergreen_cp_resume(struct radeon_device *rdev)
        /* Initialize the ring buffer's read and write pointers */
        WREG32(CP_RB_CNTL, tmp | RB_RPTR_WR_ENA);
        WREG32(CP_RB_RPTR_WR, 0);
-        WREG32(CP_RB_WPTR, 0);
+        rdev->cp.wptr = 0;
+        WREG32(CP_RB_WPTR, rdev->cp.wptr);
        /* set the wb address wether it's enabled or not */
        WREG32(CP_RB_RPTR_ADDR,
@@ -1400,7 +1427,6 @@ int evergreen_cp_resume(struct radeon_device *rdev)
        WREG32(CP_DEBUG, (1 << 27) | (1 << 28));
        rdev->cp.rptr = RREG32(CP_RB_RPTR);
-        rdev->cp.wptr = RREG32(CP_RB_WPTR);
        evergreen_cp_start(rdev);
        rdev->cp.ready = true;
@@ -1862,6 +1888,8 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
        WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        evergreen_fix_pci_max_read_req_size(rdev);
        cc_gc_shader_pipe_config = RREG32(CC_GC_SHADER_PIPE_CONFIG) & ~2;
        cc_gc_shader_pipe_config |=
@@ -3143,21 +3171,23 @@ int evergreen_suspend(struct radeon_device *rdev)
 }
 int evergreen_copy_blit(struct radeon_device *rdev,
-                        uint64_t src_offset, uint64_t dst_offset,
+                        uint64_t src_offset,
-                        unsigned num_pages, struct radeon_fence *fence)
+                        uint64_t dst_offset,
+                        unsigned num_gpu_pages,
+                        struct radeon_fence *fence)
 {
        int r;
        mutex_lock(&rdev->r600_blit.mutex);
        rdev->r600_blit.vb_ib = NULL;
-        r = evergreen_blit_prepare_copy(rdev, num_pages * RADEON_GPU_PAGE_SIZE);
+        r = evergreen_blit_prepare_copy(rdev, num_gpu_pages * RADEON_GPU_PAGE_SIZE);
        if (r) {
                if (rdev->r600_blit.vb_ib)
                        radeon_ib_free(rdev, &rdev->r600_blit.vb_ib);
                mutex_unlock(&rdev->r600_blit.mutex);
                return r;
        }
-        evergreen_kms_blit_copy(rdev, src_offset, dst_offset, num_pages * RADEON_GPU_PAGE_SIZE);
+        evergreen_kms_blit_copy(rdev, src_offset, dst_offset, num_gpu_pages * RADEON_GPU_PAGE_SIZE);
        evergreen_blit_done_copy(rdev, fence);
        mutex_unlock(&rdev->r600_blit.mutex);
        return 0;
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 44c4750f4518..99fbd793c08c 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -39,6 +39,7 @@ extern int evergreen_mc_wait_for_idle(struct radeon_device *rdev);
 extern void evergreen_mc_program(struct radeon_device *rdev);
 extern void evergreen_irq_suspend(struct radeon_device *rdev);
 extern int evergreen_mc_init(struct radeon_device *rdev);
+extern void evergreen_fix_pci_max_read_req_size(struct radeon_device *rdev);
 #define EVERGREEN_PFP_UCODE_SIZE 1120
 #define EVERGREEN_PM4_UCODE_SIZE 1376
@@ -669,6 +670,8 @@ static void cayman_gpu_init(struct radeon_device *rdev)
        WREG32(GRBM_CNTL, GRBM_READ_TIMEOUT(0xff));
+        evergreen_fix_pci_max_read_req_size(rdev);
        mc_shared_chmap = RREG32(MC_SHARED_CHMAP);
        mc_arb_ramcfg = RREG32(MC_ARB_RAMCFG);
@@ -1159,6 +1162,7 @@ int cayman_cp_resume(struct radeon_device *rdev)
                                 SOFT_RESET_PA |
                                 SOFT_RESET_SH |
                                 SOFT_RESET_VGT |
+                                 SOFT_RESET_SPI |
                                 SOFT_RESET_SX));
        RREG32(GRBM_SOFT_RESET);
        mdelay(15);
@@ -1183,7 +1187,8 @@ int cayman_cp_resume(struct radeon_device *rdev)
        /* Initialize the ring buffer's read and write pointers */
        WREG32(CP_RB0_CNTL, tmp | RB_RPTR_WR_ENA);
-        WREG32(CP_RB0_WPTR, 0);
+        rdev->cp.wptr = 0;
+        WREG32(CP_RB0_WPTR, rdev->cp.wptr);
        /* set the wb address wether it's enabled or not */
        WREG32(CP_RB0_RPTR_ADDR, (rdev->wb.gpu_addr + RADEON_WB_CP_RPTR_OFFSET) & 0xFFFFFFFC);
@@ -1203,7 +1208,6 @@ int cayman_cp_resume(struct radeon_device *rdev)
        WREG32(CP_RB0_BASE, rdev->cp.gpu_addr >> 8);
        rdev->cp.rptr = RREG32(CP_RB0_RPTR);
-        rdev->cp.wptr = RREG32(CP_RB0_WPTR);
        /* ring1  - compute only */
        /* Set ring buffer size */
@@ -1216,7 +1220,8 @@ int cayman_cp_resume(struct radeon_device *rdev)
        /* Initialize the ring buffer's read and write pointers */
        WREG32(CP_RB1_CNTL, tmp | RB_RPTR_WR_ENA);
-        WREG32(CP_RB1_WPTR, 0);
+        rdev->cp1.wptr = 0;
+        WREG32(CP_RB1_WPTR, rdev->cp1.wptr);
        /* set the wb address wether it's enabled or not */
        WREG32(CP_RB1_RPTR_ADDR, (rdev->wb.gpu_addr + RADEON_WB_CP1_RPTR_OFFSET) & 0xFFFFFFFC);
@@ -1228,7 +1233,6 @@ int cayman_cp_resume(struct radeon_device *rdev)
        WREG32(CP_RB1_BASE, rdev->cp1.gpu_addr >> 8);
        rdev->cp1.rptr = RREG32(CP_RB1_RPTR);
-        rdev->cp1.wptr = RREG32(CP_RB1_WPTR);
        /* ring2 - compute only */
        /* Set ring buffer size */
@@ -1241,7 +1245,8 @@ int cayman_cp_resume(struct radeon_device *rdev)
        /* Initialize the ring buffer's read and write pointers */
        WREG32(CP_RB2_CNTL, tmp | RB_RPTR_WR_ENA);
-        WREG32(CP_RB2_WPTR, 0);
+        rdev->cp2.wptr = 0;
+        WREG32(CP_RB2_WPTR, rdev->cp2.wptr);
        /* set the wb address wether it's enabled or not */
        WREG32(CP_RB2_RPTR_ADDR, (rdev->wb.gpu_addr + RADEON_WB_CP2_RPTR_OFFSET) & 0xFFFFFFFC);
@@ -1253,7 +1258,6 @@ int cayman_cp_resume(struct radeon_device *rdev)
        WREG32(CP_RB2_BASE, rdev->cp2.gpu_addr >> 8);
        rdev->cp2.rptr = RREG32(CP_RB2_RPTR);
-        rdev->cp2.wptr = RREG32(CP_RB2_WPTR);
        /* start the rings */
        cayman_cp_start(rdev);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index f2204cb1ccdf..7fcdbbbf2979 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -721,11 +721,11 @@ void r100_fence_ring_emit(struct radeon_device *rdev,
 int r100_copy_blit(struct radeon_device *rdev,
                   uint64_t src_offset,
                   uint64_t dst_offset,
-                   unsigned num_pages,
+                   unsigned num_gpu_pages,
                   struct radeon_fence *fence)
 {
        uint32_t cur_pages;
-        uint32_t stride_bytes = PAGE_SIZE;
+        uint32_t stride_bytes = RADEON_GPU_PAGE_SIZE;
        uint32_t pitch;
        uint32_t stride_pixels;
        unsigned ndw;
@@ -737,7 +737,7 @@ int r100_copy_blit(struct radeon_device *rdev,
        /* radeon pitch is /64 */
        pitch = stride_bytes / 64;
        stride_pixels = stride_bytes / 4;
-        num_loops = DIV_ROUND_UP(num_pages, 8191);
+        num_loops = DIV_ROUND_UP(num_gpu_pages, 8191);
        /* Ask for enough room for blit + flush + fence */
        ndw = 64 + (10 * num_loops);
@@ -746,12 +746,12 @@ int r100_copy_blit(struct radeon_device *rdev,
                DRM_ERROR("radeon: moving bo (%d) asking for %u dw.\n", r, ndw);
                return -EINVAL;
        }
-        while (num_pages > 0) {
+        while (num_gpu_pages > 0) {
-                cur_pages = num_pages;
+                cur_pages = num_gpu_pages;
                if (cur_pages > 8191) {
                        cur_pages = 8191;
                }
-                num_pages -= cur_pages;
+                num_gpu_pages -= cur_pages;
                /* pages are in Y direction - height
                   page width in X direction - width */
@@ -773,8 +773,8 @@ int r100_copy_blit(struct radeon_device *rdev,
                radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
                radeon_ring_write(rdev, 0);
                radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
-                radeon_ring_write(rdev, num_pages);
+                radeon_ring_write(rdev, num_gpu_pages);
-                radeon_ring_write(rdev, num_pages);
+                radeon_ring_write(rdev, num_gpu_pages);
                radeon_ring_write(rdev, cur_pages | (stride_pixels << 16));
        }
        radeon_ring_write(rdev, PACKET0(RADEON_DSTCACHE_CTLSTAT, 0));
@@ -990,7 +990,8 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
        /* Force read & write ptr to 0 */
        WREG32(RADEON_CP_RB_CNTL, tmp | RADEON_RB_RPTR_WR_ENA | RADEON_RB_NO_UPDATE);
        WREG32(RADEON_CP_RB_RPTR_WR, 0);
-        WREG32(RADEON_CP_RB_WPTR, 0);
+        rdev->cp.wptr = 0;
+        WREG32(RADEON_CP_RB_WPTR, rdev->cp.wptr);
        /* set the wb address whether it's enabled or not */
        WREG32(R_00070C_CP_RB_RPTR_ADDR,
@@ -1007,9 +1008,6 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
        WREG32(RADEON_CP_RB_CNTL, tmp);
        udelay(10);
        rdev->cp.rptr = RREG32(RADEON_CP_RB_RPTR);
-        rdev->cp.wptr = RREG32(RADEON_CP_RB_WPTR);
-        /* protect against crazy HW on resume */
-        rdev->cp.wptr &= rdev->cp.ptr_mask;
        /* Set cp mode to bus mastering & enable cp*/
        WREG32(RADEON_CP_CSQ_MODE,
               REG_SET(RADEON_INDIRECT2_START, indirect2_start) |
diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
index f24058300413..a1f3ba063c2d 100644
--- a/drivers/gpu/drm/radeon/r200.c
+++ b/drivers/gpu/drm/radeon/r200.c
@@ -84,7 +84,7 @@ static int r200_get_vtx_size_0(uint32_t vtx_fmt_0)
 int r200_copy_dma(struct radeon_device *rdev,
                  uint64_t src_offset,
                  uint64_t dst_offset,
-                  unsigned num_pages,
+                  unsigned num_gpu_pages,
                  struct radeon_fence *fence)
 {
        uint32_t size;
@@ -93,7 +93,7 @@ int r200_copy_dma(struct radeon_device *rdev,
        int r = 0;
        /* radeon pitch is /64 */
-        size = num_pages << PAGE_SHIFT;
+        size = num_gpu_pages << RADEON_GPU_PAGE_SHIFT;
        num_loops = DIV_ROUND_UP(size, 0x1FFFFF);
        r = radeon_ring_lock(rdev, num_loops * 4 + 64);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index aa5571b73aa0..720dd99163f8 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2209,7 +2209,8 @@ int r600_cp_resume(struct radeon_device *rdev)
        /* Initialize the ring buffer's read and write pointers */
        WREG32(CP_RB_CNTL, tmp | RB_RPTR_WR_ENA);
        WREG32(CP_RB_RPTR_WR, 0);
-        WREG32(CP_RB_WPTR, 0);
+        rdev->cp.wptr = 0;
+        WREG32(CP_RB_WPTR, rdev->cp.wptr);
        /* set the wb address whether it's enabled or not */
        WREG32(CP_RB_RPTR_ADDR,
@@ -2231,7 +2232,6 @@ int r600_cp_resume(struct radeon_device *rdev)
        WREG32(CP_DEBUG, (1 << 27) | (1 << 28));
        rdev->cp.rptr = RREG32(CP_RB_RPTR);
-        rdev->cp.wptr = RREG32(CP_RB_WPTR);
        r600_cp_start(rdev);
        rdev->cp.ready = true;
@@ -2353,21 +2353,23 @@ void r600_fence_ring_emit(struct radeon_device *rdev,
 }
 int r600_copy_blit(struct radeon_device *rdev,
-                   uint64_t src_offset, uint64_t dst_offset,
+                   uint64_t src_offset,
-                   unsigned num_pages, struct radeon_fence *fence)
+                   uint64_t dst_offset,
+                   unsigned num_gpu_pages,
+                   struct radeon_fence *fence)
 {
        int r;
        mutex_lock(&rdev->r600_blit.mutex);
        rdev->r600_blit.vb_ib = NULL;
-        r = r600_blit_prepare_copy(rdev, num_pages * RADEON_GPU_PAGE_SIZE);
+        r = r600_blit_prepare_copy(rdev, num_gpu_pages * RADEON_GPU_PAGE_SIZE);
        if (r) {
                if (rdev->r600_blit.vb_ib)
                        radeon_ib_free(rdev, &rdev->r600_blit.vb_ib);
                mutex_unlock(&rdev->r600_blit.mutex);
                return r;
        }
-        r600_kms_blit_copy(rdev, src_offset, dst_offset, num_pages * RADEON_GPU_PAGE_SIZE);
+        r600_kms_blit_copy(rdev, src_offset, dst_offset, num_gpu_pages * RADEON_GPU_PAGE_SIZE);
        r600_blit_done_copy(rdev, fence);
        mutex_unlock(&rdev->r600_blit.mutex);
        return 0;
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 32807baf55e2..c1e056b35b29 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -322,6 +322,7 @@ union radeon_gart_table {
 #define RADEON_GPU_PAGE_SIZE 4096
 #define RADEON_GPU_PAGE_MASK (RADEON_GPU_PAGE_SIZE - 1)
+#define RADEON_GPU_PAGE_SHIFT 12
 struct radeon_gart {
        dma_addr_t                      table_addr;
@@ -914,17 +915,17 @@ struct radeon_asic {
        int (*copy_blit)(struct radeon_device *rdev,
                         uint64_t src_offset,
                         uint64_t dst_offset,
-                         unsigned num_pages,
+                         unsigned num_gpu_pages,
                         struct radeon_fence *fence);
        int (*copy_dma)(struct radeon_device *rdev,
                        uint64_t src_offset,
                        uint64_t dst_offset,
-                        unsigned num_pages,
+                        unsigned num_gpu_pages,
                        struct radeon_fence *fence);
        int (*copy)(struct radeon_device *rdev,
                    uint64_t src_offset,
                    uint64_t dst_offset,
-                    unsigned num_pages,
+                    unsigned num_gpu_pages,
                    struct radeon_fence *fence);
        uint32_t (*get_engine_clock)(struct radeon_device *rdev);
        void (*set_engine_clock)(struct radeon_device *rdev, uint32_t eng_clock);
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 3d7a0d7c6a9a..3dedaa07aac1 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -75,7 +75,7 @@ uint32_t r100_pll_rreg(struct radeon_device *rdev, uint32_t reg);
 int r100_copy_blit(struct radeon_device *rdev,
                   uint64_t src_offset,
                   uint64_t dst_offset,
-                   unsigned num_pages,
+                   unsigned num_gpu_pages,
                   struct radeon_fence *fence);
 int r100_set_surface_reg(struct radeon_device *rdev, int reg,
                         uint32_t tiling_flags, uint32_t pitch,
@@ -143,7 +143,7 @@ extern void r100_post_page_flip(struct radeon_device *rdev, int crtc);
 extern int r200_copy_dma(struct radeon_device *rdev,
                         uint64_t src_offset,
                         uint64_t dst_offset,
-                         unsigned num_pages,
+                         unsigned num_gpu_pages,
                         struct radeon_fence *fence);
 void r200_set_safe_registers(struct radeon_device *rdev);
@@ -311,7 +311,7 @@ void r600_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);
 int r600_ring_test(struct radeon_device *rdev);
 int r600_copy_blit(struct radeon_device *rdev,
                   uint64_t src_offset, uint64_t dst_offset,
-                   unsigned num_pages, struct radeon_fence *fence);
+                   unsigned num_gpu_pages, struct radeon_fence *fence);
 void r600_hpd_init(struct radeon_device *rdev);
 void r600_hpd_fini(struct radeon_device *rdev);
 bool r600_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd);
@@ -403,7 +403,7 @@ void evergreen_bandwidth_update(struct radeon_device *rdev);
 void evergreen_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);
 int evergreen_copy_blit(struct radeon_device *rdev,
                        uint64_t src_offset, uint64_t dst_offset,
-                        unsigned num_pages, struct radeon_fence *fence);
+                        unsigned num_gpu_pages, struct radeon_fence *fence);
 void evergreen_hpd_init(struct radeon_device *rdev);
 void evergreen_hpd_fini(struct radeon_device *rdev);
 bool evergreen_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd);
diff --git a/drivers/gpu/drm/radeon/radeon_clocks.c b/drivers/gpu/drm/radeon/radeon_clocks.c
index dcd0863e31ae..b6e18c8db9f5 100644
--- a/drivers/gpu/drm/radeon/radeon_clocks.c
+++ b/drivers/gpu/drm/radeon/radeon_clocks.c
@@ -219,6 +219,9 @@ void radeon_get_clock_info(struct drm_device *dev)
                } else {
                        DRM_INFO("Using generic clock info\n");
+                        /* may need to be per card */
+                        rdev->clock.max_pixel_clock = 35000;
                        if (rdev->flags & RADEON_IS_IGP) {
                                p1pll->reference_freq = 1432;
                                p2pll->reference_freq = 1432;
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index e0138b674aca..63675241c7ff 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -3298,6 +3298,14 @@ void radeon_combios_asic_init(struct drm_device *dev)
            rdev->pdev->subsystem_device == 0x30a4)
                return;
+        /* quirk for rs4xx Compaq Presario V5245EU laptop to make it resume
+         * - it hangs on resume inside the dynclk 1 table.
+         */
+        if (rdev->family == CHIP_RS480 &&
+            rdev->pdev->subsystem_vendor == 0x103c &&
+            rdev->pdev->subsystem_device == 0x30ae)
+                return;
        /* DYN CLK 1 */
        table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
        if (table)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 4f0c1ecac72e..c4b8741dbf58 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1297,12 +1297,33 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
                if (!radeon_dig_connector->edp_on)
                        atombios_set_edp_panel_power(connector,
                                                     ATOM_TRANSMITTER_ACTION_POWER_OFF);
-        } else {
+        } else if (radeon_connector_encoder_is_dp_bridge(connector)) {
-                /* need to setup ddc on the bridge */
+                /* DP bridges are always DP */
-                if (radeon_connector_encoder_is_dp_bridge(connector)) {
+                radeon_dig_connector->dp_sink_type = CONNECTOR_OBJECT_ID_DISPLAYPORT;
+                /* get the DPCD from the bridge */
+                radeon_dp_getdpcd(radeon_connector);
+                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd))
+                        ret = connector_status_connected;
+                else {
+                        /* need to setup ddc on the bridge */
                        if (encoder)
                                radeon_atom_ext_encoder_setup_ddc(encoder);
+                        if (radeon_ddc_probe(radeon_connector,
+                                             radeon_connector->requires_extended_probe))
+                                ret = connector_status_connected;
+                }
+                if ((ret == connector_status_disconnected) &&
+                    radeon_connector->dac_load_detect) {
+                        struct drm_encoder *encoder = radeon_best_single_encoder(connector);
+                        struct drm_encoder_helper_funcs *encoder_funcs;
+                        if (encoder) {
+                                encoder_funcs = encoder->helper_private;
+                                ret = encoder_funcs->detect(encoder, connector);
+                        }
                }
+        } else {
                radeon_dig_connector->dp_sink_type = radeon_dp_getsinktype(radeon_connector);
                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
                        ret = connector_status_connected;
@@ -1318,16 +1339,6 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
                                        ret = connector_status_connected;
                        }
                }
-                if ((ret == connector_status_disconnected) &&
-                    radeon_connector->dac_load_detect) {
-                        struct drm_encoder *encoder = radeon_best_single_encoder(connector);
-                        struct drm_encoder_helper_funcs *encoder_funcs;
-                        if (encoder) {
-                                encoder_funcs = encoder->helper_private;
-                                ret = encoder_funcs->detect(encoder, connector);
-                        }
-                }
        }
        radeon_connector_update_scratch_regs(connector, ret);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 1a858944e4f3..6adb3e58affd 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -473,8 +473,8 @@ pflip_cleanup:
        spin_lock_irqsave(&dev->event_lock, flags);
        radeon_crtc->unpin_work = NULL;
 unlock_free:
-        drm_gem_object_unreference_unlocked(old_radeon_fb->obj);
        spin_unlock_irqrestore(&dev->event_lock, flags);
+        drm_gem_object_unreference_unlocked(old_radeon_fb->obj);
        radeon_fence_unref(&work->fence);
        kfree(work);
@@ -707,16 +707,21 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
                radeon_router_select_ddc_port(radeon_connector);
        if ((radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_DisplayPort) ||
-            (radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_eDP)) {
+            (radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_eDP) ||
+            radeon_connector_encoder_is_dp_bridge(&radeon_connector->base)) {
                struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
                if ((dig->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT ||
                     dig->dp_sink_type == CONNECTOR_OBJECT_ID_eDP) && dig->dp_i2c_bus)
-                        radeon_connector->edid = drm_get_edid(&radeon_connector->base, &dig->dp_i2c_bus->adapter);
+                        radeon_connector->edid = drm_get_edid(&radeon_connector->base,
-        }
+                                                              &dig->dp_i2c_bus->adapter);
-        if (!radeon_connector->ddc_bus)
+                else if (radeon_connector->ddc_bus && !radeon_connector->edid)
-                return -1;
+                        radeon_connector->edid = drm_get_edid(&radeon_connector->base,
-        if (!radeon_connector->edid) {
+                                                              &radeon_connector->ddc_bus->adapter);
-                radeon_connector->edid = drm_get_edid(&radeon_connector->base, &radeon_connector->ddc_bus->adapter);
+        } else {
+                if (radeon_connector->ddc_bus && !radeon_connector->edid)
+                        radeon_connector->edid = drm_get_edid(&radeon_connector->base,
+                                                              &radeon_connector->ddc_bus->adapter);
        }
        if (!radeon_connector->edid) {
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 319d85d7e759..13690f3eb4a4 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1507,7 +1507,14 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
                switch (mode) {
                case DRM_MODE_DPMS_ON:
                        args.ucAction = ATOM_ENABLE;
-                        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                        /* workaround for DVOOutputControl on some RS690 systems */
+                        if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_DDI) {
+                                u32 reg = RREG32(RADEON_BIOS_3_SCRATCH);
+                                WREG32(RADEON_BIOS_3_SCRATCH, reg & ~ATOM_S3_DFP2I_ACTIVE);
+                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                                WREG32(RADEON_BIOS_3_SCRATCH, reg);
+                        } else
+                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
                        if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
                                args.ucAction = ATOM_LCD_BLON;
                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 9b86fb0e4122..0b5468bfaf54 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -277,7 +277,12 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
                DRM_ERROR("Trying to move memory with CP turned off.\n");
                return -EINVAL;
        }
-        r = radeon_copy(rdev, old_start, new_start, new_mem->num_pages, fence);
+        BUILD_BUG_ON((PAGE_SIZE % RADEON_GPU_PAGE_SIZE) != 0);
+        r = radeon_copy(rdev, old_start, new_start,
+                        new_mem->num_pages * (PAGE_SIZE / RADEON_GPU_PAGE_SIZE), /* GPU pages */
+                        fence);
        /* FIXME: handle copy error */
        r = ttm_bo_move_accel_cleanup(bo, (void *)fence, NULL,
                                      evict, no_wait_reserve, no_wait_gpu, new_mem);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index a4d38d85909a..ef06194c5aa6 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -394,7 +394,8 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
        if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED)) {
                if (bo->ttm == NULL) {
-                        ret = ttm_bo_add_ttm(bo, false);
+                        bool zero = !(old_man->flags & TTM_MEMTYPE_FLAG_FIXED);
+                        ret = ttm_bo_add_ttm(bo, zero);
                        if (ret)
                                goto out_err;
                }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 7d27d2b0445a..7484e1b67249 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -277,6 +277,7 @@
 #define USB_DEVICE_ID_PENPOWER          0x00f4
 #define USB_VENDOR_ID_GREENASIA         0x0e8f
+#define USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD 0x3013
 #define USB_VENDOR_ID_GRETAGMACBETH     0x0971
 #define USB_DEVICE_ID_GRETAGMACBETH_HUEY        0x2005
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 0ec91c18a421..f0fbd7bd239e 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -81,6 +81,28 @@ MODULE_PARM_DESC(report_undeciphered, "Report undeciphered multi-touch state fie
 #define NO_TOUCHES -1
 #define SINGLE_TOUCH_UP -2
+/* Touch surface information. Dimension is in hundredths of a mm, min and max
+ * are in units. */
+#define MOUSE_DIMENSION_X (float)9056
+#define MOUSE_MIN_X -1100
+#define MOUSE_MAX_X 1258
+#define MOUSE_RES_X ((MOUSE_MAX_X - MOUSE_MIN_X) / (MOUSE_DIMENSION_X / 100))
+#define MOUSE_DIMENSION_Y (float)5152
+#define MOUSE_MIN_Y -1589
+#define MOUSE_MAX_Y 2047
+#define MOUSE_RES_Y ((MOUSE_MAX_Y - MOUSE_MIN_Y) / (MOUSE_DIMENSION_Y / 100))
+#define TRACKPAD_DIMENSION_X (float)13000
+#define TRACKPAD_MIN_X -2909
+#define TRACKPAD_MAX_X 3167
+#define TRACKPAD_RES_X \
+        ((TRACKPAD_MAX_X - TRACKPAD_MIN_X) / (TRACKPAD_DIMENSION_X / 100))
+#define TRACKPAD_DIMENSION_Y (float)11000
+#define TRACKPAD_MIN_Y -2456
+#define TRACKPAD_MAX_Y 2565
+#define TRACKPAD_RES_Y \
+        ((TRACKPAD_MAX_Y - TRACKPAD_MIN_Y) / (TRACKPAD_DIMENSION_Y / 100))
 /**
 * struct magicmouse_sc - Tracks Magic Mouse-specific data.
 * @input: Input device through which we report events.
@@ -406,17 +428,31 @@ static void magicmouse_setup_input(struct input_dev *input, struct hid_device *h
                 * inverse of the reported Y.
                 */
                if (input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE) {
-                        input_set_abs_params(input, ABS_MT_POSITION_X, -1100,
+                        input_set_abs_params(input, ABS_MT_POSITION_X,
-                                1358, 4, 0);
+                                MOUSE_MIN_X, MOUSE_MAX_X, 4, 0);
-                        input_set_abs_params(input, ABS_MT_POSITION_Y, -1589,
+                        input_set_abs_params(input, ABS_MT_POSITION_Y,
-                                2047, 4, 0);
+                                MOUSE_MIN_Y, MOUSE_MAX_Y, 4, 0);
+                        input_abs_set_res(input, ABS_MT_POSITION_X,
+                                MOUSE_RES_X);
+                        input_abs_set_res(input, ABS_MT_POSITION_Y,
+                                MOUSE_RES_Y);
                } else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
-                        input_set_abs_params(input, ABS_X, -2909, 3167, 4, 0);
+                        input_set_abs_params(input, ABS_X, TRACKPAD_MIN_X,
-                        input_set_abs_params(input, ABS_Y, -2456, 2565, 4, 0);
+                                TRACKPAD_MAX_X, 4, 0);
-                        input_set_abs_params(input, ABS_MT_POSITION_X, -2909,
+                        input_set_abs_params(input, ABS_Y, TRACKPAD_MIN_Y,
-                                3167, 4, 0);
+                                TRACKPAD_MAX_Y, 4, 0);
-                        input_set_abs_params(input, ABS_MT_POSITION_Y, -2456,
+                        input_set_abs_params(input, ABS_MT_POSITION_X,
-                                2565, 4, 0);
+                                TRACKPAD_MIN_X, TRACKPAD_MAX_X, 4, 0);
+                        input_set_abs_params(input, ABS_MT_POSITION_Y,
+                                TRACKPAD_MIN_Y, TRACKPAD_MAX_Y, 4, 0);
+                        input_abs_set_res(input, ABS_X, TRACKPAD_RES_X);
+                        input_abs_set_res(input, ABS_Y, TRACKPAD_RES_Y);
+                        input_abs_set_res(input, ABS_MT_POSITION_X,
+                                TRACKPAD_RES_X);
+                        input_abs_set_res(input, ABS_MT_POSITION_Y,
+                                TRACKPAD_RES_Y);
                }
                input_set_events_per_packet(input, 60);
@@ -501,9 +537,17 @@ static int magicmouse_probe(struct hid_device *hdev,
        }
        report->size = 6;
+        /*
+         * Some devices repond with 'invalid report id' when feature
+         * report switching it into multitouch mode is sent to it.
+         *
+         * This results in -EIO from the _raw low-level transport callback,
+         * but there seems to be no other way of switching the mode.
+         * Thus the super-ugly hacky success check below.
+         */
        ret = hdev->hid_output_raw_report(hdev, feature, sizeof(feature),
                        HID_FEATURE_REPORT);
-        if (ret != sizeof(feature)) {
+        if (ret != -EIO && ret != sizeof(feature)) {
                hid_err(hdev, "unable to request touch data (%d)\n", ret);
                goto err_stop_hw;
        }
diff --git a/drivers/hid/hid-wacom.c b/drivers/hid/hid-wacom.c
index 06888323828c..72ca689b6474 100644
--- a/drivers/hid/hid-wacom.c
+++ b/drivers/hid/hid-wacom.c
@@ -353,11 +353,7 @@ static int wacom_probe(struct hid_device *hdev,
        if (ret) {
                hid_warn(hdev, "can't create sysfs battery attribute, err: %d\n",
                         ret);
-                /*
+                goto err_battery;
-                 * battery attribute is not critical for the tablet, but if it
-                 * failed then there is no need to create ac attribute
-                 */
-                goto move_on;
        }
        wdata->ac.properties = wacom_ac_props;
@@ -371,18 +367,14 @@ static int wacom_probe(struct hid_device *hdev,
        if (ret) {
                hid_warn(hdev,
                         "can't create ac battery attribute, err: %d\n", ret);
-                /*
+                goto err_ac;
-                 * ac attribute is not critical for the tablet, but if it
-                 * failed then we don't want to battery attribute to exist
-                 */
-                power_supply_unregister(&wdata->battery);
        }
-move_on:
 #endif
        hidinput = list_entry(hdev->inputs.next, struct hid_input, list);
        input = hidinput->input;
+        __set_bit(INPUT_PROP_POINTER, input->propbit);
        /* Basics */
        input->evbit[0] |= BIT(EV_KEY) | BIT(EV_ABS) | BIT(EV_REL);
@@ -416,6 +408,13 @@ move_on:
        return 0;
+#ifdef CONFIG_HID_WACOM_POWER_SUPPLY
+err_ac:
+        power_supply_unregister(&wdata->battery);
+err_battery:
+        device_remove_file(&hdev->dev, &dev_attr_speed);
+        hid_hw_stop(hdev);
+#endif
 err_free:
        kfree(wdata);
        return ret;
@@ -426,6 +425,7 @@ static void wacom_remove(struct hid_device *hdev)
 #ifdef CONFIG_HID_WACOM_POWER_SUPPLY
        struct wacom_data *wdata = hid_get_drvdata(hdev);
 #endif
+        device_remove_file(&hdev->dev, &dev_attr_speed);
        hid_hw_stop(hdev);
 #ifdef CONFIG_HID_WACOM_POWER_SUPPLY
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 4bdb5d46c52c..3146fdcda272 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -47,6 +47,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_AFATECH, USB_DEVICE_ID_AFATECH_AF9016, HID_QUIRK_FULLSPEED_INTERVAL },
        { USB_VENDOR_ID_ETURBOTOUCH, USB_DEVICE_ID_ETURBOTOUCH, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_PANTHERLORD, USB_DEVICE_ID_PANTHERLORD_TWIN_USB_JOYSTICK, HID_QUIRK_MULTI_INPUT | HID_QUIRK_SKIP_OUTPUT_REPORTS },
        { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 59d83e83da7f..411257676133 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -601,7 +601,12 @@ static int create_core_data(struct platform_data *pdata,
        err = rdmsr_safe_on_cpu(cpu, tdata->intrpt_reg, &eax, &edx);
        if (!err) {
                tdata->attr_size += MAX_THRESH_ATTRS;
-                tdata->ttarget = tdata->tjmax - ((eax >> 16) & 0x7f) * 1000;
+                tdata->tmin = tdata->tjmax -
+                              ((eax & THERM_MASK_THRESHOLD0) >>
+                               THERM_SHIFT_THRESHOLD0) * 1000;
+                tdata->ttarget = tdata->tjmax -
+                                 ((eax & THERM_MASK_THRESHOLD1) >>
+                                  THERM_SHIFT_THRESHOLD1) * 1000;
        }
        pdata->core_data[attr_no] = tdata;
diff --git a/drivers/hwmon/i5k_amb.c b/drivers/hwmon/i5k_amb.c
index c4c40be0edbf..d22f241b6a67 100644
--- a/drivers/hwmon/i5k_amb.c
+++ b/drivers/hwmon/i5k_amb.c
@@ -114,7 +114,6 @@ struct i5k_amb_data {
        void __iomem *amb_mmio;
        struct i5k_device_attribute *attrs;
        unsigned int num_attrs;
-        unsigned long chipset_id;
 };
 static ssize_t show_name(struct device *dev, struct device_attribute *devattr,
@@ -444,8 +443,6 @@ static int __devinit i5k_find_amb_registers(struct i5k_amb_data *data,
                goto out;
        }
-        data->chipset_id = devid;
        res = 0;
 out:
        pci_dev_put(pcidev);
@@ -478,23 +475,13 @@ out:
        return res;
 }
-static unsigned long i5k_channel_pci_id(struct i5k_amb_data *data,
+static struct {
-                                        unsigned long channel)
+        unsigned long err;
-{
+        unsigned long fbd0;
-        switch (data->chipset_id) {
+} chipset_ids[] __devinitdata  = {
-        case PCI_DEVICE_ID_INTEL_5000_ERR:
+        { PCI_DEVICE_ID_INTEL_5000_ERR, PCI_DEVICE_ID_INTEL_5000_FBD0 },
-                return PCI_DEVICE_ID_INTEL_5000_FBD0 + channel;
+        { PCI_DEVICE_ID_INTEL_5400_ERR, PCI_DEVICE_ID_INTEL_5400_FBD0 },
-        case PCI_DEVICE_ID_INTEL_5400_ERR:
+        { 0, 0 }
-                return PCI_DEVICE_ID_INTEL_5400_FBD0 + channel;
-        default:
-                BUG();
-        }
-}
-static unsigned long chipset_ids[] = {
-        PCI_DEVICE_ID_INTEL_5000_ERR,
-        PCI_DEVICE_ID_INTEL_5400_ERR,
-        0
 };
 #ifdef MODULE
@@ -510,8 +497,7 @@ static int __devinit i5k_amb_probe(struct platform_device *pdev)
 {
        struct i5k_amb_data *data;
        struct resource *reso;
-        int i;
+        int i, res;
-        int res = -ENODEV;
        data = kzalloc(sizeof(*data), GFP_KERNEL);
        if (!data)
@@ -520,22 +506,22 @@ static int __devinit i5k_amb_probe(struct platform_device *pdev)
        /* Figure out where the AMB registers live */
        i = 0;
        do {
-                res = i5k_find_amb_registers(data, chipset_ids[i]);
+                res = i5k_find_amb_registers(data, chipset_ids[i].err);
+                if (res == 0)
+                        break;
                i++;
-        } while (res && chipset_ids[i]);
+        } while (chipset_ids[i].err);
        if (res)
                goto err;
        /* Copy the DIMM presence map for the first two channels */
-        res = i5k_channel_probe(&data->amb_present[0],
+        res = i5k_channel_probe(&data->amb_present[0], chipset_ids[i].fbd0);
-                                i5k_channel_pci_id(data, 0));
        if (res)
                goto err;
        /* Copy the DIMM presence map for the optional second two channels */
-        i5k_channel_probe(&data->amb_present[2],
+        i5k_channel_probe(&data->amb_present[2], chipset_ids[i].fbd0 + 1);
-                          i5k_channel_pci_id(data, 1));
        /* Set up resource regions */
        reso = request_mem_region(data->amb_base, data->amb_len, DRVNAME);
diff --git a/drivers/hwmon/max16065.c b/drivers/hwmon/max16065.c
index d94a24fdf4ba..dd2d7b9620c2 100644
--- a/drivers/hwmon/max16065.c
+++ b/drivers/hwmon/max16065.c
@@ -124,7 +124,7 @@ static inline int MV_TO_LIMIT(int mv, int range)
 static inline int ADC_TO_CURR(int adc, int gain)
 {
-        return adc * 1400000 / gain * 255;
+        return adc * 1400000 / (gain * 255);
 }
 /*
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index d7926f4336b5..eab11615dced 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -211,8 +211,7 @@ static int lookup_comp(struct ntc_data *data,
        if (data->comp[mid].ohm <= ohm) {
                *i_low = mid;
                *i_high = mid - 1;
-        }
+        } else {
-        if (data->comp[mid].ohm > ohm) {
                *i_low = mid + 1;
                *i_high = mid;
        }
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index a561c3a0e916..397fc59b5682 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -978,6 +978,8 @@ static void pmbus_find_max_attr(struct i2c_client *client,
 struct pmbus_limit_attr {
        u16 reg;                /* Limit register */
        bool update;            /* True if register needs updates */
+        bool low;               /* True if low limit; for limits with compare
+                                   functions only */
        const char *attr;       /* Attribute name */
        const char *alarm;      /* Alarm attribute name */
        u32 sbit;               /* Alarm attribute status bit */
@@ -1029,7 +1031,8 @@ static bool pmbus_add_limit_attrs(struct i2c_client *client,
                                if (attr->compare) {
                                        pmbus_add_boolean_cmp(data, name,
                                                l->alarm, index,
-                                                cbase, cindex,
+                                                l->low ? cindex : cbase,
+                                                l->low ? cbase : cindex,
                                                attr->sbase + page, l->sbit);
                                } else {
                                        pmbus_add_boolean_reg(data, name,
@@ -1366,11 +1369,13 @@ static const struct pmbus_sensor_attr power_attributes[] = {
 static const struct pmbus_limit_attr temp_limit_attrs[] = {
        {
                .reg = PMBUS_UT_WARN_LIMIT,
+                .low = true,
                .attr = "min",
                .alarm = "min_alarm",
                .sbit = PB_TEMP_UT_WARNING,
        }, {
                .reg = PMBUS_UT_FAULT_LIMIT,
+                .low = true,
                .attr = "lcrit",
                .alarm = "lcrit_alarm",
                .sbit = PB_TEMP_UT_FAULT,
@@ -1399,11 +1404,13 @@ static const struct pmbus_limit_attr temp_limit_attrs[] = {
 static const struct pmbus_limit_attr temp_limit_attrs23[] = {
        {
                .reg = PMBUS_UT_WARN_LIMIT,
+                .low = true,
                .attr = "min",
                .alarm = "min_alarm",
                .sbit = PB_TEMP_UT_WARNING,
        }, {
                .reg = PMBUS_UT_FAULT_LIMIT,
+                .low = true,
                .attr = "lcrit",
                .alarm = "lcrit_alarm",
                .sbit = PB_TEMP_UT_FAULT,
diff --git a/drivers/hwmon/pmbus/ucd9000.c b/drivers/hwmon/pmbus/ucd9000.c
index ace1c7319734..d0ddb60155c9 100644
--- a/drivers/hwmon/pmbus/ucd9000.c
+++ b/drivers/hwmon/pmbus/ucd9000.c
@@ -141,13 +141,11 @@ static int ucd9000_probe(struct i2c_client *client,
        block_buffer[ret] = '\0';
        dev_info(&client->dev, "Device ID %s\n", block_buffer);
-        mid = NULL;
+        for (mid = ucd9000_id; mid->name[0]; mid++) {
-        for (i = 0; i < ARRAY_SIZE(ucd9000_id); i++) {
-                mid = &ucd9000_id[i];
                if (!strncasecmp(mid->name, block_buffer, strlen(mid->name)))
                        break;
        }
-        if (!mid || !strlen(mid->name)) {
+        if (!mid->name[0]) {
                dev_err(&client->dev, "Unsupported device\n");
                return -ENODEV;
        }
diff --git a/drivers/hwmon/pmbus/ucd9200.c b/drivers/hwmon/pmbus/ucd9200.c
index ffcc1cf3609d..c65e9da707cc 100644
--- a/drivers/hwmon/pmbus/ucd9200.c
+++ b/drivers/hwmon/pmbus/ucd9200.c
@@ -68,13 +68,11 @@ static int ucd9200_probe(struct i2c_client *client,
        block_buffer[ret] = '\0';
        dev_info(&client->dev, "Device ID %s\n", block_buffer);
-        mid = NULL;
+        for (mid = ucd9200_id; mid->name[0]; mid++) {
-        for (i = 0; i < ARRAY_SIZE(ucd9200_id); i++) {
-                mid = &ucd9200_id[i];
                if (!strncasecmp(mid->name, block_buffer, strlen(mid->name)))
                        break;
        }
-        if (!mid || !strlen(mid->name)) {
+        if (!mid->name[0]) {
                dev_err(&client->dev, "Unsupported device\n");
                return -ENODEV;
        }
diff --git a/drivers/i2c/busses/i2c-nomadik.c b/drivers/i2c/busses/i2c-nomadik.c
index 0c731ca69f15..b228e09c5d05 100644
--- a/drivers/i2c/busses/i2c-nomadik.c
+++ b/drivers/i2c/busses/i2c-nomadik.c
@@ -146,6 +146,7 @@ struct i2c_nmk_client {
 * @stop: stop condition
 * @xfer_complete: acknowledge completion for a I2C message
 * @result: controller propogated result
+ * @regulator: pointer to i2c regulator
 * @busy: Busy doing transfer
 */
 struct nmk_i2c_dev {
@@ -417,12 +418,12 @@ static int read_i2c(struct nmk_i2c_dev *dev)
        writel(readl(dev->virtbase + I2C_IMSCR) | irq_mask,
                        dev->virtbase + I2C_IMSCR);
-        timeout = wait_for_completion_interruptible_timeout(
+        timeout = wait_for_completion_timeout(
                &dev->xfer_complete, dev->adap.timeout);
        if (timeout < 0) {
                dev_err(&dev->pdev->dev,
-                        "wait_for_completion_interruptible_timeout"
+                        "wait_for_completion_timeout"
                        "returned %d waiting for event\n", timeout);
                status = timeout;
        }
@@ -504,12 +505,12 @@ static int write_i2c(struct nmk_i2c_dev *dev)
        writel(readl(dev->virtbase + I2C_IMSCR) | irq_mask,
                        dev->virtbase + I2C_IMSCR);
-        timeout = wait_for_completion_interruptible_timeout(
+        timeout = wait_for_completion_timeout(
                &dev->xfer_complete, dev->adap.timeout);
        if (timeout < 0) {
                dev_err(&dev->pdev->dev,
-                        "wait_for_completion_interruptible_timeout"
+                        "wait_for_completion_timeout "
                        "returned %d waiting for event\n", timeout);
                status = timeout;
        }
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 1a766cf74f6b..2dfb63176856 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -1139,41 +1139,12 @@ omap_i2c_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_SUSPEND
-static int omap_i2c_suspend(struct device *dev)
-{
-        if (!pm_runtime_suspended(dev))
-                if (dev->bus && dev->bus->pm && dev->bus->pm->runtime_suspend)
-                        dev->bus->pm->runtime_suspend(dev);
-        return 0;
-}
-static int omap_i2c_resume(struct device *dev)
-{
-        if (!pm_runtime_suspended(dev))
-                if (dev->bus && dev->bus->pm && dev->bus->pm->runtime_resume)
-                        dev->bus->pm->runtime_resume(dev);
-        return 0;
-}
-static struct dev_pm_ops omap_i2c_pm_ops = {
-        .suspend = omap_i2c_suspend,
-        .resume = omap_i2c_resume,
-};
-#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops)
-#else
-#define OMAP_I2C_PM_OPS NULL
-#endif
 static struct platform_driver omap_i2c_driver = {
        .probe          = omap_i2c_probe,
        .remove         = omap_i2c_remove,
        .driver         = {
                .name   = "omap_i2c",
                .owner  = THIS_MODULE,
-                .pm     = OMAP_I2C_PM_OPS,
        },
 };
diff --git a/drivers/i2c/busses/i2c-pxa-pci.c b/drivers/i2c/busses/i2c-pxa-pci.c
index 6659d269b841..b73da6cd6f91 100644
--- a/drivers/i2c/busses/i2c-pxa-pci.c
+++ b/drivers/i2c/busses/i2c-pxa-pci.c
@@ -109,12 +109,15 @@ static int __devinit ce4100_i2c_probe(struct pci_dev *dev,
                return -EINVAL;
        }
        sds = kzalloc(sizeof(*sds), GFP_KERNEL);
-        if (!sds)
+        if (!sds) {
+                ret = -ENOMEM;
                goto err_mem;
+        }
        for (i = 0; i < ARRAY_SIZE(sds->pdev); i++) {
                sds->pdev[i] = add_i2c_device(dev, i);
                if (IS_ERR(sds->pdev[i])) {
+                        ret = PTR_ERR(sds->pdev[i]);
                        while (--i >= 0)
                                platform_device_unregister(sds->pdev[i]);
                        goto err_dev_add;
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index 2440b7411978..3c94c4a81a55 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -270,14 +270,30 @@ static int tegra_i2c_fill_tx_fifo(struct tegra_i2c_dev *i2c_dev)
        /* Rounds down to not include partial word at the end of buf */
        words_to_transfer = buf_remaining / BYTES_PER_FIFO_WORD;
-        if (words_to_transfer > tx_fifo_avail)
-                words_to_transfer = tx_fifo_avail;
-        i2c_writesl(i2c_dev, buf, I2C_TX_FIFO, words_to_transfer);
+        /* It's very common to have < 4 bytes, so optimize that case. */
+        if (words_to_transfer) {
-        buf += words_to_transfer * BYTES_PER_FIFO_WORD;
+                if (words_to_transfer > tx_fifo_avail)
-        buf_remaining -= words_to_transfer * BYTES_PER_FIFO_WORD;
+                        words_to_transfer = tx_fifo_avail;
-        tx_fifo_avail -= words_to_transfer;
+                /*
+                 * Update state before writing to FIFO.  If this casues us
+                 * to finish writing all bytes (AKA buf_remaining goes to 0) we
+                 * have a potential for an interrupt (PACKET_XFER_COMPLETE is
+                 * not maskable).  We need to make sure that the isr sees
+                 * buf_remaining as 0 and doesn't call us back re-entrantly.
+                 */
+                buf_remaining -= words_to_transfer * BYTES_PER_FIFO_WORD;
+                tx_fifo_avail -= words_to_transfer;
+                i2c_dev->msg_buf_remaining = buf_remaining;
+                i2c_dev->msg_buf = buf +
+                        words_to_transfer * BYTES_PER_FIFO_WORD;
+                barrier();
+                i2c_writesl(i2c_dev, buf, I2C_TX_FIFO, words_to_transfer);
+                buf += words_to_transfer * BYTES_PER_FIFO_WORD;
+        }
        /*
         * If there is a partial word at the end of buf, handle it manually to
@@ -287,14 +303,15 @@ static int tegra_i2c_fill_tx_fifo(struct tegra_i2c_dev *i2c_dev)
        if (tx_fifo_avail > 0 && buf_remaining > 0) {
                BUG_ON(buf_remaining > 3);
                memcpy(&val, buf, buf_remaining);
+                /* Again update before writing to FIFO to make sure isr sees. */
+                i2c_dev->msg_buf_remaining = 0;
+                i2c_dev->msg_buf = NULL;
+                barrier();
                i2c_writel(i2c_dev, val, I2C_TX_FIFO);
-                buf_remaining = 0;
-                tx_fifo_avail--;
        }
-        BUG_ON(tx_fifo_avail > 0 && buf_remaining > 0);
-        i2c_dev->msg_buf_remaining = buf_remaining;
-        i2c_dev->msg_buf = buf;
        return 0;
 }
@@ -411,9 +428,10 @@ static irqreturn_t tegra_i2c_isr(int irq, void *dev_id)
                        tegra_i2c_mask_irq(i2c_dev, I2C_INT_TX_FIFO_DATA_REQ);
        }
-        if ((status & I2C_INT_PACKET_XFER_COMPLETE) &&
+        if (status & I2C_INT_PACKET_XFER_COMPLETE) {
-                        !i2c_dev->msg_buf_remaining)
+                BUG_ON(i2c_dev->msg_buf_remaining);
                complete(&i2c_dev->msg_complete);
+        }
        i2c_writel(i2c_dev, status, I2C_INT_STATUS);
        if (i2c_dev->is_dvc)
@@ -531,7 +549,7 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 static u32 tegra_i2c_func(struct i2c_adapter *adap)
 {
-        return I2C_FUNC_I2C;
+        return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
 }
 static const struct i2c_algorithm tegra_i2c_algo = {
@@ -719,6 +737,17 @@ static int tegra_i2c_resume(struct platform_device *pdev)
 }
 #endif
+#if defined(CONFIG_OF)
+/* Match table for of_platform binding */
+static const struct of_device_id tegra_i2c_of_match[] __devinitconst = {
+        { .compatible = "nvidia,tegra20-i2c", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, tegra_i2c_of_match);
+#else
+#define tegra_i2c_of_match NULL
+#endif
 static struct platform_driver tegra_i2c_driver = {
        .probe   = tegra_i2c_probe,
        .remove  = tegra_i2c_remove,
@@ -729,6 +758,7 @@ static struct platform_driver tegra_i2c_driver = {
        .driver  = {
                .name  = "tegra-i2c",
                .owner = THIS_MODULE,
+                .of_match_table = tegra_i2c_of_match,
        },
 };
diff --git a/drivers/input/keyboard/adp5588-keys.c b/drivers/input/keyboard/adp5588-keys.c
index 7b404e5443ed..e34eeb8ae371 100644
--- a/drivers/input/keyboard/adp5588-keys.c
+++ b/drivers/input/keyboard/adp5588-keys.c
@@ -668,4 +668,3 @@ module_exit(adp5588_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
 MODULE_DESCRIPTION("ADP5588/87 Keypad driver");
-MODULE_ALIAS("platform:adp5588-keys");
diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index b09c7d127219..ab860511f016 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -475,7 +475,7 @@ static void cm109_toggle_buzzer_sync(struct cm109_dev *dev, int on)
                                le16_to_cpu(dev->ctl_req->wIndex),
                                dev->ctl_data,
                                USB_PKT_LEN, USB_CTRL_SET_TIMEOUT);
-        if (error && error != EINTR)
+        if (error < 0 && error != -EINTR)
                err("%s: usb_control_msg() failed %d", __func__, error);
 }
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index da280189ef07..5ec617e28f7e 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -67,6 +67,10 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI    0x0245
 #define USB_DEVICE_ID_APPLE_WELLSPRING5_ISO     0x0246
 #define USB_DEVICE_ID_APPLE_WELLSPRING5_JIS     0x0247
+/* MacbookAir4,1 (unibody, July 2011) */
+#define USB_DEVICE_ID_APPLE_WELLSPRING6A_ANSI   0x0249
+#define USB_DEVICE_ID_APPLE_WELLSPRING6A_ISO    0x024a
+#define USB_DEVICE_ID_APPLE_WELLSPRING6A_JIS    0x024b
 /* MacbookAir4,2 (unibody, July 2011) */
 #define USB_DEVICE_ID_APPLE_WELLSPRING6_ANSI    0x024c
 #define USB_DEVICE_ID_APPLE_WELLSPRING6_ISO     0x024d
@@ -112,6 +116,10 @@ static const struct usb_device_id bcm5974_table[] = {
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5_ISO),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5_JIS),
+        /* MacbookAir4,1 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING6A_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING6A_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING6A_JIS),
        /* MacbookAir4,2 */
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING6_ANSI),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING6_ISO),
@@ -334,6 +342,18 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                { DIM_X, DIM_X / SN_COORD, -4750, 5280 },
                { DIM_Y, DIM_Y / SN_COORD, -150, 6730 }
        },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING6A_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING6A_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING6A_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0x84, sizeof(struct bt_data),
+                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
+                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
+                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
+                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+        },
        {}
 };
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index d27c9d91630b..958b4eb6369d 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -229,13 +229,6 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
                                                        get_unaligned_le16(&report[i + 3]);
                                                i += 4;
                                        }
-                                } else if (usage == WCM_DIGITIZER) {
-                                        /* max pressure isn't reported
-                                        features->pressure_max = (unsigned short)
-                                                        (report[i+4] << 8  | report[i + 3]);
-                                        */
-                                        features->pressure_max = 255;
-                                        i += 4;
                                }
                                break;
@@ -291,13 +284,6 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
                                pen = 1;
                                i++;
                                break;
-                        case HID_USAGE_UNDEFINED:
-                                if (usage == WCM_DESKTOP && finger) /* capacity */
-                                        features->pressure_max =
-                                                get_unaligned_le16(&report[i + 3]);
-                                i += 4;
-                                break;
                        }
                        break;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index c1c2f7b28d89..0dc97ec15c28 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -800,25 +800,26 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
        int i;
        for (i = 0; i < 2; i++) {
-                int p = data[9 * i + 2];
+                int offset = (data[1] & 0x80) ? (8 * i) : (9 * i);
-                bool touch = p && !wacom->shared->stylus_in_proximity;
+                bool touch = data[offset + 3] & 0x80;
-                input_mt_slot(input, i);
-                input_mt_report_slot_state(input, MT_TOOL_FINGER, touch);
                /*
                 * Touch events need to be disabled while stylus is
                 * in proximity because user's hand is resting on touchpad
                 * and sending unwanted events.  User expects tablet buttons
                 * to continue working though.
                 */
+                touch = touch && !wacom->shared->stylus_in_proximity;
+                input_mt_slot(input, i);
+                input_mt_report_slot_state(input, MT_TOOL_FINGER, touch);
                if (touch) {
-                        int x = get_unaligned_be16(&data[9 * i + 3]) & 0x7ff;
+                        int x = get_unaligned_be16(&data[offset + 3]) & 0x7ff;
-                        int y = get_unaligned_be16(&data[9 * i + 5]) & 0x7ff;
+                        int y = get_unaligned_be16(&data[offset + 5]) & 0x7ff;
                        if (features->quirks & WACOM_QUIRK_BBTOUCH_LOWRES) {
                                x <<= 5;
                                y <<= 5;
                        }
-                        input_report_abs(input, ABS_MT_PRESSURE, p);
                        input_report_abs(input, ABS_MT_POSITION_X, x);
                        input_report_abs(input, ABS_MT_POSITION_Y, y);
                }
@@ -1056,10 +1057,11 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
                             features->x_fuzz, 0);
        input_set_abs_params(input_dev, ABS_Y, 0, features->y_max,
                             features->y_fuzz, 0);
-        input_set_abs_params(input_dev, ABS_PRESSURE, 0, features->pressure_max,
-                             features->pressure_fuzz, 0);
        if (features->device_type == BTN_TOOL_PEN) {
+                input_set_abs_params(input_dev, ABS_PRESSURE, 0, features->pressure_max,
+                             features->pressure_fuzz, 0);
                /* penabled devices have fixed resolution for each model */
                input_abs_set_res(input_dev, ABS_X, features->x_resolution);
                input_abs_set_res(input_dev, ABS_Y, features->y_resolution);
@@ -1098,6 +1100,8 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
                __set_bit(BTN_TOOL_MOUSE, input_dev->keybit);
                __set_bit(BTN_STYLUS, input_dev->keybit);
                __set_bit(BTN_STYLUS2, input_dev->keybit);
+                __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
                break;
        case WACOM_21UX2:
@@ -1126,6 +1130,9 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
                }
                input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
+                __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
                wacom_setup_cintiq(wacom_wac);
                break;
@@ -1150,6 +1157,8 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
                /* fall through */
        case INTUOS:
+                __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
                wacom_setup_intuos(wacom_wac);
                break;
@@ -1165,6 +1174,8 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
                input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
                wacom_setup_intuos(wacom_wac);
+                __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
                break;
        case TABLETPC2FG:
@@ -1183,26 +1194,40 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
        case TABLETPC:
                __clear_bit(ABS_MISC, input_dev->absbit);
+                __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
                if (features->device_type != BTN_TOOL_PEN)
                        break;  /* no need to process stylus stuff */
                /* fall through */
        case PL:
-        case PTU:
        case DTU:
                __set_bit(BTN_TOOL_PEN, input_dev->keybit);
+                __set_bit(BTN_TOOL_RUBBER, input_dev->keybit);
                __set_bit(BTN_STYLUS, input_dev->keybit);
                __set_bit(BTN_STYLUS2, input_dev->keybit);
+                __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
+                break;
+        case PTU:
+                __set_bit(BTN_STYLUS2, input_dev->keybit);
                /* fall through */
        case PENPARTNER:
+                __set_bit(BTN_TOOL_PEN, input_dev->keybit);
                __set_bit(BTN_TOOL_RUBBER, input_dev->keybit);
+                __set_bit(BTN_STYLUS, input_dev->keybit);
+                __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
                break;
        case BAMBOO_PT:
                __clear_bit(ABS_MISC, input_dev->absbit);
+                __set_bit(INPUT_PROP_POINTER, input_dev->propbit);
                if (features->device_type == BTN_TOOL_DOUBLETAP) {
                        __set_bit(BTN_LEFT, input_dev->keybit);
                        __set_bit(BTN_FORWARD, input_dev->keybit);
diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
index c14412ef4648..9941d39df43d 100644
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -383,6 +383,8 @@ static int w8001_setup(struct w8001 *w8001)
        dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
        strlcat(w8001->name, "Wacom Serial", sizeof(w8001->name));
+        __set_bit(INPUT_PROP_DIRECT, dev->propbit);
        /* penabled? */
        error = w8001_command(w8001, W8001_CMD_QUERY, true);
        if (!error) {
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index a14f8dc23462..0e4227f457af 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -605,7 +605,9 @@ static void build_inv_all(struct iommu_cmd *cmd)
 * Writes the command to the IOMMUs command buffer and informs the
 * hardware about the new command.
 */
-static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd)
+static int iommu_queue_command_sync(struct amd_iommu *iommu,
+                                    struct iommu_cmd *cmd,
+                                    bool sync)
 {
        u32 left, tail, head, next_tail;
        unsigned long flags;
@@ -639,13 +641,18 @@ again:
        copy_cmd_to_buffer(iommu, cmd, tail);
        /* We need to sync now to make sure all commands are processed */
-        iommu->need_sync = true;
+        iommu->need_sync = sync;
        spin_unlock_irqrestore(&iommu->lock, flags);
        return 0;
 }
+static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd)
+{
+        return iommu_queue_command_sync(iommu, cmd, true);
+}
 /*
 * This function queues a completion wait command into the command
 * buffer of an IOMMU
@@ -661,7 +668,7 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
        build_completion_wait(&cmd, (u64)&sem);
-        ret = iommu_queue_command(iommu, &cmd);
+        ret = iommu_queue_command_sync(iommu, &cmd, false);
        if (ret)
                return ret;
@@ -840,14 +847,9 @@ static void domain_flush_complete(struct protection_domain *domain)
 static void domain_flush_devices(struct protection_domain *domain)
 {
        struct iommu_dev_data *dev_data;
-        unsigned long flags;
-        spin_lock_irqsave(&domain->lock, flags);
        list_for_each_entry(dev_data, &domain->dev_list, list)
                device_flush_dte(dev_data);
-        spin_unlock_irqrestore(&domain->lock, flags);
 }
 /****************************************************************************
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 3dc9befa5aec..6dcc7e2d54de 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -1388,7 +1388,7 @@ int dmar_set_interrupt(struct intel_iommu *iommu)
                return ret;
        }
-        ret = request_irq(irq, dmar_fault, 0, iommu->name, iommu);
+        ret = request_irq(irq, dmar_fault, IRQF_NO_THREAD, iommu->name, iommu);
        if (ret)
                printk(KERN_ERR "IOMMU: can't request irq\n");
        return ret;
diff --git a/drivers/leds/leds-ams-delta.c b/drivers/leds/leds-ams-delta.c
index b9826032450b..8c00937bf7e7 100644
--- a/drivers/leds/leds-ams-delta.c
+++ b/drivers/leds/leds-ams-delta.c
@@ -8,6 +8,7 @@
 * published by the Free Software Foundation.
 */
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/leds/leds-bd2802.c b/drivers/leds/leds-bd2802.c
index 3ebe3824662d..ea2185531f82 100644
--- a/drivers/leds/leds-bd2802.c
+++ b/drivers/leds/leds-bd2802.c
@@ -662,6 +662,11 @@ failed_unregister_led1_R:
 static void bd2802_unregister_led_classdev(struct bd2802_led *led)
 {
        cancel_work_sync(&led->work);
+        led_classdev_unregister(&led->cdev_led2b);
+        led_classdev_unregister(&led->cdev_led2g);
+        led_classdev_unregister(&led->cdev_led2r);
+        led_classdev_unregister(&led->cdev_led1b);
+        led_classdev_unregister(&led->cdev_led1g);
        led_classdev_unregister(&led->cdev_led1r);
 }
diff --git a/drivers/leds/leds-hp6xx.c b/drivers/leds/leds-hp6xx.c
index e4ce1fd46338..bcfbd3a60eab 100644
--- a/drivers/leds/leds-hp6xx.c
+++ b/drivers/leds/leds-hp6xx.c
@@ -10,6 +10,7 @@
 * published by the Free Software Foundation.
 */
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/leds/ledtrig-timer.c b/drivers/leds/ledtrig-timer.c
index d87c9d02f786..328c64c0841c 100644
--- a/drivers/leds/ledtrig-timer.c
+++ b/drivers/leds/ledtrig-timer.c
@@ -41,6 +41,7 @@ static ssize_t led_delay_on_store(struct device *dev,
        if (count == size) {
                led_blink_set(led_cdev, &state, &led_cdev->blink_delay_off);
+                led_cdev->blink_delay_on = state;
                ret = count;
        }
@@ -69,6 +70,7 @@ static ssize_t led_delay_off_store(struct device *dev,
        if (count == size) {
                led_blink_set(led_cdev, &led_cdev->blink_delay_on, &state);
+                led_cdev->blink_delay_off = state;
                ret = count;
        }
diff --git a/drivers/md/linear.h b/drivers/md/linear.h
index 0ce29b61605a..2f2da05b2ce9 100644
--- a/drivers/md/linear.h
+++ b/drivers/md/linear.h
@@ -10,9 +10,9 @@ typedef struct dev_info dev_info_t;
 struct linear_private_data
 {
+        struct rcu_head         rcu;
        sector_t                array_sectors;
        dev_info_t              disks[0];
-        struct rcu_head         rcu;
 };
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8e221a20f5d9..5404b2295820 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -848,7 +848,7 @@ void md_super_write(mddev_t *mddev, mdk_rdev_t *rdev,
        bio->bi_end_io = super_written;
        atomic_inc(&mddev->pending_writes);
-        submit_bio(REQ_WRITE | REQ_SYNC | REQ_FLUSH | REQ_FUA, bio);
+        submit_bio(WRITE_FLUSH_FUA, bio);
 }
 void md_super_wait(mddev_t *mddev)
@@ -1138,8 +1138,11 @@ static int super_90_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version
                        ret = 0;
        }
        rdev->sectors = rdev->sb_start;
+        /* Limit to 4TB as metadata cannot record more than that */
+        if (rdev->sectors >= (2ULL << 32))
+                rdev->sectors = (2ULL << 32) - 2;
-        if (rdev->sectors < sb->size * 2 && sb->level > 1)
+        if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
                /* "this cannot possibly happen" ... */
                ret = -EINVAL;
@@ -1173,7 +1176,7 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
                mddev->clevel[0] = 0;
                mddev->layout = sb->layout;
                mddev->raid_disks = sb->raid_disks;
-                mddev->dev_sectors = sb->size * 2;
+                mddev->dev_sectors = ((sector_t)sb->size) * 2;
                mddev->events = ev1;
                mddev->bitmap_info.offset = 0;
                mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
@@ -1415,6 +1418,11 @@ super_90_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
        rdev->sb_start = calc_dev_sboffset(rdev);
        if (!num_sectors || num_sectors > rdev->sb_start)
                num_sectors = rdev->sb_start;
+        /* Limit to 4TB as metadata cannot record more than that.
+         * 4TB == 2^32 KB, or 2*2^32 sectors.
+         */
+        if (num_sectors >= (2ULL << 32))
+                num_sectors = (2ULL << 32) - 2;
        md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
                       rdev->sb_page);
        md_super_wait(rdev->mddev);
@@ -1738,6 +1746,11 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
        sb->level = cpu_to_le32(mddev->level);
        sb->layout = cpu_to_le32(mddev->layout);
+        if (test_bit(WriteMostly, &rdev->flags))
+                sb->devflags |= WriteMostly1;
+        else
+                sb->devflags &= ~WriteMostly1;
        if (mddev->bitmap && mddev->bitmap_info.file == NULL) {
                sb->bitmap_offset = cpu_to_le32((__u32)mddev->bitmap_info.offset);
                sb->feature_map = cpu_to_le32(MD_FEATURE_BITMAP_OFFSET);
@@ -2561,7 +2574,10 @@ state_store(mdk_rdev_t *rdev, const char *buf, size_t len)
        int err = -EINVAL;
        if (cmd_match(buf, "faulty") && rdev->mddev->pers) {
                md_error(rdev->mddev, rdev);
-                err = 0;
+                if (test_bit(Faulty, &rdev->flags))
+                        err = 0;
+                else
+                        err = -EBUSY;
        } else if (cmd_match(buf, "remove")) {
                if (rdev->raid_disk >= 0)
                        err = -EBUSY;
@@ -2584,7 +2600,7 @@ state_store(mdk_rdev_t *rdev, const char *buf, size_t len)
                err = 0;
        } else if (cmd_match(buf, "-blocked")) {
                if (!test_bit(Faulty, &rdev->flags) &&
-                    test_bit(BlockedBadBlocks, &rdev->flags)) {
+                    rdev->badblocks.unacked_exist) {
                        /* metadata handler doesn't understand badblocks,
                         * so we need to fail the device
                         */
@@ -5983,6 +5999,8 @@ static int set_disk_faulty(mddev_t *mddev, dev_t dev)
                return -ENODEV;
        md_error(mddev, rdev);
+        if (!test_bit(Faulty, &rdev->flags))
+                return -EBUSY;
        return 0;
 }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 32323f0afd89..f4622dd8fc59 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1099,12 +1099,11 @@ read_again:
                bio_list_add(&conf->pending_bio_list, mbio);
                spin_unlock_irqrestore(&conf->device_lock, flags);
        }
-        r1_bio_write_done(r1_bio);
+        /* Mustn't call r1_bio_write_done before this next test,
+         * as it could result in the bio being freed.
-        /* In case raid1d snuck in to freeze_array */
+         */
-        wake_up(&conf->wait_barrier);
        if (sectors_handled < (bio->bi_size >> 9)) {
+                r1_bio_write_done(r1_bio);
                /* We need another r1_bio.  It has already been counted
                 * in bio->bi_phys_segments
                 */
@@ -1117,6 +1116,11 @@ read_again:
                goto retry_write;
        }
+        r1_bio_write_done(r1_bio);
+        /* In case raid1d snuck in to freeze_array */
+        wake_up(&conf->wait_barrier);
        if (do_sync || !bitmap || !plugged)
                md_wakeup_thread(mddev->thread);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 8b29cd4f01c8..d7a8468ddeab 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -337,6 +337,21 @@ static void close_write(r10bio_t *r10_bio)
        md_write_end(r10_bio->mddev);
 }
+static void one_write_done(r10bio_t *r10_bio)
+{
+        if (atomic_dec_and_test(&r10_bio->remaining)) {
+                if (test_bit(R10BIO_WriteError, &r10_bio->state))
+                        reschedule_retry(r10_bio);
+                else {
+                        close_write(r10_bio);
+                        if (test_bit(R10BIO_MadeGood, &r10_bio->state))
+                                reschedule_retry(r10_bio);
+                        else
+                                raid_end_bio_io(r10_bio);
+                }
+        }
+}
 static void raid10_end_write_request(struct bio *bio, int error)
 {
        int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
@@ -387,17 +402,7 @@ static void raid10_end_write_request(struct bio *bio, int error)
         * Let's see if all mirrored write operations have finished
         * already.
         */
-        if (atomic_dec_and_test(&r10_bio->remaining)) {
+        one_write_done(r10_bio);
-                if (test_bit(R10BIO_WriteError, &r10_bio->state))
-                        reschedule_retry(r10_bio);
-                else {
-                        close_write(r10_bio);
-                        if (test_bit(R10BIO_MadeGood, &r10_bio->state))
-                                reschedule_retry(r10_bio);
-                        else
-                                raid_end_bio_io(r10_bio);
-                }
-        }
        if (dec_rdev)
                rdev_dec_pending(conf->mirrors[dev].rdev, conf->mddev);
 }
@@ -1127,20 +1132,12 @@ retry_write:
                spin_unlock_irqrestore(&conf->device_lock, flags);
        }
-        if (atomic_dec_and_test(&r10_bio->remaining)) {
+        /* Don't remove the bias on 'remaining' (one_write_done) until
-                /* This matches the end of raid10_end_write_request() */
+         * after checking if we need to go around again.
-                bitmap_endwrite(r10_bio->mddev->bitmap, r10_bio->sector,
+         */
-                                r10_bio->sectors,
-                                !test_bit(R10BIO_Degraded, &r10_bio->state),
-                                0);
-                md_write_end(mddev);
-                raid_end_bio_io(r10_bio);
-        }
-        /* In case raid10d snuck in to freeze_array */
-        wake_up(&conf->wait_barrier);
        if (sectors_handled < (bio->bi_size >> 9)) {
+                one_write_done(r10_bio);
                /* We need another r10_bio.  It has already been counted
                 * in bio->bi_phys_segments.
                 */
@@ -1154,6 +1151,10 @@ retry_write:
                r10_bio->state = 0;
                goto retry_write;
        }
+        one_write_done(r10_bio);
+        /* In case raid10d snuck in to freeze_array */
+        wake_up(&conf->wait_barrier);
        if (do_sync || !mddev->bitmap || !plugged)
                md_wakeup_thread(mddev->thread);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index dbae459fb02d..43709fa6b6df 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3336,7 +3336,7 @@ static void handle_stripe(struct stripe_head *sh)
 finish:
        /* wait for this device to become unblocked */
-        if (unlikely(s.blocked_rdev))
+        if (conf->mddev->external && unlikely(s.blocked_rdev))
                md_wait_for_blocked_rdev(s.blocked_rdev, conf->mddev);
        if (s.handle_bad_blocks)
diff --git a/drivers/media/dvb/dvb-usb/vp7045.c b/drivers/media/dvb/dvb-usb/vp7045.c
index 3db89e3cb0bb..536c16c943bd 100644
--- a/drivers/media/dvb/dvb-usb/vp7045.c
+++ b/drivers/media/dvb/dvb-usb/vp7045.c
@@ -224,26 +224,8 @@ static struct dvb_usb_device_properties vp7045_properties;
 static int vp7045_usb_probe(struct usb_interface *intf,
                const struct usb_device_id *id)
 {
-        struct dvb_usb_device *d;
+        return dvb_usb_device_init(intf, &vp7045_properties,
-        int ret = dvb_usb_device_init(intf, &vp7045_properties,
+                                   THIS_MODULE, NULL, adapter_nr);
-                                   THIS_MODULE, &d, adapter_nr);
-        if (ret)
-                return ret;
-        d->priv = kmalloc(20, GFP_KERNEL);
-        if (!d->priv) {
-                dvb_usb_device_exit(intf);
-                return -ENOMEM;
-        }
-        return ret;
-}
-static void vp7045_usb_disconnect(struct usb_interface *intf)
-{
-        struct dvb_usb_device *d = usb_get_intfdata(intf);
-        kfree(d->priv);
-        dvb_usb_device_exit(intf);
 }
 static struct usb_device_id vp7045_usb_table [] = {
@@ -258,7 +240,7 @@ MODULE_DEVICE_TABLE(usb, vp7045_usb_table);
 static struct dvb_usb_device_properties vp7045_properties = {
        .usb_ctrl = CYPRESS_FX2,
        .firmware = "dvb-usb-vp7045-01.fw",
-        .size_of_priv = sizeof(u8 *),
+        .size_of_priv = 20,
        .num_adapters = 1,
        .adapter = {
@@ -305,7 +287,7 @@ static struct dvb_usb_device_properties vp7045_properties = {
 static struct usb_driver vp7045_usb_driver = {
        .name           = "dvb_usb_vp7045",
        .probe          = vp7045_usb_probe,
-        .disconnect     = vp7045_usb_disconnect,
+        .disconnect     = dvb_usb_device_exit,
        .id_table       = vp7045_usb_table,
 };
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index eae05b500476..144f3f55d765 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -618,7 +618,6 @@ static void nvt_dump_rx_buf(struct nvt_dev *nvt)
 static void nvt_process_rx_ir_data(struct nvt_dev *nvt)
 {
        DEFINE_IR_RAW_EVENT(rawir);
-        unsigned int count;
        u32 carrier;
        u8 sample;
        int i;
@@ -631,65 +630,38 @@ static void nvt_process_rx_ir_data(struct nvt_dev *nvt)
        if (nvt->carrier_detect_enabled)
                carrier = nvt_rx_carrier_detect(nvt);
-        count = nvt->pkts;
+        nvt_dbg_verbose("Processing buffer of len %d", nvt->pkts);
-        nvt_dbg_verbose("Processing buffer of len %d", count);
        init_ir_raw_event(&rawir);
-        for (i = 0; i < count; i++) {
+        for (i = 0; i < nvt->pkts; i++) {
-                nvt->pkts--;
                sample = nvt->buf[i];
                rawir.pulse = ((sample & BUF_PULSE_BIT) != 0);
                rawir.duration = US_TO_NS((sample & BUF_LEN_MASK)
                                          * SAMPLE_PERIOD);
-                if ((sample & BUF_LEN_MASK) == BUF_LEN_MASK) {
+                nvt_dbg("Storing %s with duration %d",
-                        if (nvt->rawir.pulse == rawir.pulse)
+                        rawir.pulse ? "pulse" : "space", rawir.duration);
-                                nvt->rawir.duration += rawir.duration;
-                        else {
-                                nvt->rawir.duration = rawir.duration;
-                                nvt->rawir.pulse = rawir.pulse;
-                        }
-                        continue;
-                }
-                rawir.duration += nvt->rawir.duration;
-                init_ir_raw_event(&nvt->rawir);
+                ir_raw_event_store_with_filter(nvt->rdev, &rawir);
-                nvt->rawir.duration = 0;
-                nvt->rawir.pulse = rawir.pulse;
-                if (sample == BUF_PULSE_BIT)
-                        rawir.pulse = false;
-                if (rawir.duration) {
-                        nvt_dbg("Storing %s with duration %d",
-                                rawir.pulse ? "pulse" : "space",
-                                rawir.duration);
-                        ir_raw_event_store_with_filter(nvt->rdev, &rawir);
-                }
                /*
                 * BUF_PULSE_BIT indicates end of IR data, BUF_REPEAT_BYTE
                 * indicates end of IR signal, but new data incoming. In both
                 * cases, it means we're ready to call ir_raw_event_handle
                 */
-                if ((sample == BUF_PULSE_BIT) && nvt->pkts) {
+                if ((sample == BUF_PULSE_BIT) && (i + 1 < nvt->pkts)) {
                        nvt_dbg("Calling ir_raw_event_handle (signal end)\n");
                        ir_raw_event_handle(nvt->rdev);
                }
        }
+        nvt->pkts = 0;
        nvt_dbg("Calling ir_raw_event_handle (buffer empty)\n");
        ir_raw_event_handle(nvt->rdev);
-        if (nvt->pkts) {
-                nvt_dbg("Odd, pkts should be 0 now... (its %u)", nvt->pkts);
-                nvt->pkts = 0;
-        }
        nvt_dbg_verbose("%s done", __func__);
 }
@@ -1048,7 +1020,6 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
        spin_lock_init(&nvt->nvt_lock);
        spin_lock_init(&nvt->tx.lock);
-        init_ir_raw_event(&nvt->rawir);
        ret = -EBUSY;
        /* now claim resources */
diff --git a/drivers/media/rc/nuvoton-cir.h b/drivers/media/rc/nuvoton-cir.h
index 1241fc89a36c..0d5e0872a2ea 100644
--- a/drivers/media/rc/nuvoton-cir.h
+++ b/drivers/media/rc/nuvoton-cir.h
@@ -67,7 +67,6 @@ static int debug;
 struct nvt_dev {
        struct pnp_dev *pdev;
        struct rc_dev *rdev;
-        struct ir_raw_event rawir;
        spinlock_t nvt_lock;
diff --git a/drivers/media/video/gspca/ov519.c b/drivers/media/video/gspca/ov519.c
index 0800433b2092..18305c89083c 100644
--- a/drivers/media/video/gspca/ov519.c
+++ b/drivers/media/video/gspca/ov519.c
@@ -2858,7 +2858,6 @@ static void ov7xx0_configure(struct sd *sd)
                        case 0x60:
                                PDEBUG(D_PROBE, "Sensor is a OV7660");
                                sd->sensor = SEN_OV7660;
-                                sd->invert_led = 0;
                                break;
                        default:
                                PDEBUG(D_PROBE, "Unknown sensor: 0x76%x", low);
@@ -3337,7 +3336,6 @@ static int sd_config(struct gspca_dev *gspca_dev,
        case BRIDGE_OV519:
                cam->cam_mode = ov519_vga_mode;
                cam->nmodes = ARRAY_SIZE(ov519_vga_mode);
-                sd->invert_led = !sd->invert_led;
                break;
        case BRIDGE_OVFX2:
                cam->cam_mode = ov519_vga_mode;
@@ -5005,24 +5003,24 @@ static const struct sd_desc sd_desc = {
 /* -- module initialisation -- */
 static const struct usb_device_id device_table[] = {
        {USB_DEVICE(0x041e, 0x4003), .driver_info = BRIDGE_W9968CF },
-        {USB_DEVICE(0x041e, 0x4052), .driver_info = BRIDGE_OV519 },
+        {USB_DEVICE(0x041e, 0x4052),
-        {USB_DEVICE(0x041e, 0x405f),
                .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
+        {USB_DEVICE(0x041e, 0x405f), .driver_info = BRIDGE_OV519 },
        {USB_DEVICE(0x041e, 0x4060), .driver_info = BRIDGE_OV519 },
        {USB_DEVICE(0x041e, 0x4061), .driver_info = BRIDGE_OV519 },
-        {USB_DEVICE(0x041e, 0x4064),
+        {USB_DEVICE(0x041e, 0x4064), .driver_info = BRIDGE_OV519 },
-                .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
        {USB_DEVICE(0x041e, 0x4067), .driver_info = BRIDGE_OV519 },
-        {USB_DEVICE(0x041e, 0x4068),
+        {USB_DEVICE(0x041e, 0x4068), .driver_info = BRIDGE_OV519 },
+        {USB_DEVICE(0x045e, 0x028c),
                .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
-        {USB_DEVICE(0x045e, 0x028c), .driver_info = BRIDGE_OV519 },
        {USB_DEVICE(0x054c, 0x0154), .driver_info = BRIDGE_OV519 },
-        {USB_DEVICE(0x054c, 0x0155),
+        {USB_DEVICE(0x054c, 0x0155), .driver_info = BRIDGE_OV519 },
-                .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
        {USB_DEVICE(0x05a9, 0x0511), .driver_info = BRIDGE_OV511 },
        {USB_DEVICE(0x05a9, 0x0518), .driver_info = BRIDGE_OV518 },
-        {USB_DEVICE(0x05a9, 0x0519), .driver_info = BRIDGE_OV519 },
+        {USB_DEVICE(0x05a9, 0x0519),
-        {USB_DEVICE(0x05a9, 0x0530), .driver_info = BRIDGE_OV519 },
+                .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
+        {USB_DEVICE(0x05a9, 0x0530),
+                .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
        {USB_DEVICE(0x05a9, 0x2800), .driver_info = BRIDGE_OVFX2 },
        {USB_DEVICE(0x05a9, 0x4519), .driver_info = BRIDGE_OV519 },
        {USB_DEVICE(0x05a9, 0x8519), .driver_info = BRIDGE_OV519 },
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index 81b8a600783b..c477ad11f103 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -2386,7 +2386,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
                reg_w1(gspca_dev, 0x01, 0x22);
                msleep(100);
                reg01 = SCL_SEL_OD | S_PDN_INV;
-                reg17 &= MCK_SIZE_MASK;
+                reg17 &= ~MCK_SIZE_MASK;
                reg17 |= 0x04;          /* clock / 4 */
                break;
        }
@@ -2532,6 +2532,10 @@ static int sd_start(struct gspca_dev *gspca_dev)
                if (!mode) {                    /* if 640x480 */
                        reg17 &= ~MCK_SIZE_MASK;
                        reg17 |= 0x04;          /* clock / 4 */
+                } else {
+                        reg01 &= ~SYS_SEL_48M;  /* clk 24Mz */
+                        reg17 &= ~MCK_SIZE_MASK;
+                        reg17 |= 0x02;          /* clock / 2 */
                }
                break;
        case SENSOR_OV7630:
diff --git a/drivers/media/video/pwc/pwc-v4l.c b/drivers/media/video/pwc/pwc-v4l.c
index e9a0e94b9995..8c70e64444e7 100644
--- a/drivers/media/video/pwc/pwc-v4l.c
+++ b/drivers/media/video/pwc/pwc-v4l.c
@@ -338,7 +338,7 @@ int pwc_init_controls(struct pwc_device *pdev)
        if (pdev->restore_factory)
                pdev->restore_factory->flags = V4L2_CTRL_FLAG_UPDATE;
-        if (!pdev->features & FEATURE_MOTOR_PANTILT)
+        if (!(pdev->features & FEATURE_MOTOR_PANTILT))
                return hdl->error;
        /* Motor pan / tilt / reset */
diff --git a/drivers/media/video/via-camera.c b/drivers/media/video/via-camera.c
index 85d3048c1d67..bb7f17f2a33c 100644
--- a/drivers/media/video/via-camera.c
+++ b/drivers/media/video/via-camera.c
@@ -1332,6 +1332,8 @@ static __devinit bool viacam_serial_is_enabled(void)
        struct pci_bus *pbus = pci_find_bus(0, 0);
        u8 cbyte;
+        if (!pbus)
+                return false;
        pci_bus_read_config_byte(pbus, VIACAM_SERIAL_DEVFN,
                        VIACAM_SERIAL_CREG, &cbyte);
        if ((cbyte & VIACAM_SERIAL_BIT) == 0)
diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
index 5d1fca0277ef..f83103b8970d 100644
--- a/drivers/mfd/max8997.c
+++ b/drivers/mfd/max8997.c
@@ -135,10 +135,13 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
        max8997->dev = &i2c->dev;
        max8997->i2c = i2c;
        max8997->type = id->driver_data;
+        max8997->irq = i2c->irq;
        if (!pdata)
                goto err;
+        max8997->irq_base = pdata->irq_base;
+        max8997->ono = pdata->ono;
        max8997->wakeup = pdata->wakeup;
        mutex_init(&max8997->iolock);
@@ -152,6 +155,8 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
        pm_runtime_set_active(max8997->dev);
+        max8997_irq_init(max8997);
        mfd_add_devices(max8997->dev, -1, max8997_devs,
                        ARRAY_SIZE(max8997_devs),
                        NULL, 0);
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index 29601e7d606d..86e14583a082 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -17,6 +17,7 @@
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
@@ -676,7 +677,6 @@ static void usbhs_omap_tll_init(struct device *dev, u8 tll_channel_count)
                                | OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF
                                | OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE);
-                        reg |= (1 << (i + 1));
                } else
                        continue;
diff --git a/drivers/mfd/tps65910-irq.c b/drivers/mfd/tps65910-irq.c
index 2bfad5c86cc7..a56be931551c 100644
--- a/drivers/mfd/tps65910-irq.c
+++ b/drivers/mfd/tps65910-irq.c
@@ -178,8 +178,10 @@ int tps65910_irq_init(struct tps65910 *tps65910, int irq,
        switch (tps65910_chip_id(tps65910)) {
        case TPS65910:
                tps65910->irq_num = TPS65910_NUM_IRQ;
+                break;
        case TPS65911:
                tps65910->irq_num = TPS65911_NUM_IRQ;
+                break;
        }
        /* Register with genirq */
diff --git a/drivers/mfd/twl4030-madc.c b/drivers/mfd/twl4030-madc.c
index b5d598c3aa71..7cbf2aa9e64f 100644
--- a/drivers/mfd/twl4030-madc.c
+++ b/drivers/mfd/twl4030-madc.c
@@ -510,8 +510,9 @@ int twl4030_madc_conversion(struct twl4030_madc_request *req)
        u8 ch_msb, ch_lsb;
        int ret;
-        if (!req)
+        if (!req || !twl4030_madc)
                return -EINVAL;
        mutex_lock(&twl4030_madc->lock);
        if (req->method < TWL4030_MADC_RT || req->method > TWL4030_MADC_SW2) {
                ret = -EINVAL;
@@ -706,6 +707,8 @@ static int __devinit twl4030_madc_probe(struct platform_device *pdev)
        if (!madc)
                return -ENOMEM;
+        madc->dev = &pdev->dev;
        /*
         * Phoenix provides 2 interrupt lines. The first one is connected to
         * the OMAP. The other one can be connected to the other processor such
diff --git a/drivers/mfd/wm8350-gpio.c b/drivers/mfd/wm8350-gpio.c
index ebf99bef392f..d584f6b4d6e2 100644
--- a/drivers/mfd/wm8350-gpio.c
+++ b/drivers/mfd/wm8350-gpio.c
@@ -37,7 +37,7 @@ static int gpio_set_dir(struct wm8350 *wm8350, int gpio, int dir)
        return ret;
 }
-static int gpio_set_debounce(struct wm8350 *wm8350, int gpio, int db)
+static int wm8350_gpio_set_debounce(struct wm8350 *wm8350, int gpio, int db)
 {
        if (db == WM8350_GPIO_DEBOUNCE_ON)
                return wm8350_set_bits(wm8350, WM8350_GPIO_DEBOUNCE,
@@ -210,7 +210,7 @@ int wm8350_gpio_config(struct wm8350 *wm8350, int gpio, int dir, int func,
                goto err;
        if (gpio_set_polarity(wm8350, gpio, pol))
                goto err;
-        if (gpio_set_debounce(wm8350, gpio, debounce))
+        if (wm8350_gpio_set_debounce(wm8350, gpio, debounce))
                goto err;
        if (gpio_set_dir(wm8350, gpio, dir))
                goto err;
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 0a4d86c6c4a4..2d6423c2d193 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -146,6 +146,7 @@ config PHANTOM
 config INTEL_MID_PTI
        tristate "Parallel Trace Interface for MIPI P1149.7 cJTAG standard"
+        depends on PCI
        default n
        help
          The PTI (Parallel Trace Interface) driver directs
diff --git a/drivers/misc/ab8500-pwm.c b/drivers/misc/ab8500-pwm.c
index 54e3d05b63cc..35903154ca2e 100644
--- a/drivers/misc/ab8500-pwm.c
+++ b/drivers/misc/ab8500-pwm.c
@@ -164,5 +164,5 @@ subsys_initcall(ab8500_pwm_init);
 module_exit(ab8500_pwm_exit);
 MODULE_AUTHOR("Arun MURTHY <arun.murthy@stericsson.com>");
 MODULE_DESCRIPTION("AB8500 Pulse Width Modulation Driver");
-MODULE_ALIAS("AB8500 PWM driver");
+MODULE_ALIAS("platform:ab8500-pwm");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/fsa9480.c b/drivers/misc/fsa9480.c
index 5325a7e70dcf..27dc0d21aafa 100644
--- a/drivers/misc/fsa9480.c
+++ b/drivers/misc/fsa9480.c
@@ -455,7 +455,7 @@ static int __devinit fsa9480_probe(struct i2c_client *client,
 fail2:
        if (client->irq)
-                free_irq(client->irq, NULL);
+                free_irq(client->irq, usbsw);
 fail1:
        i2c_set_clientdata(client, NULL);
        kfree(usbsw);
@@ -466,7 +466,7 @@ static int __devexit fsa9480_remove(struct i2c_client *client)
 {
        struct fsa9480_usbsw *usbsw = i2c_get_clientdata(client);
        if (client->irq)
-                free_irq(client->irq, NULL);
+                free_irq(client->irq, usbsw);
        i2c_set_clientdata(client, NULL);
        sysfs_remove_group(&client->dev.kobj, &fsa9480_group);
diff --git a/drivers/misc/pti.c b/drivers/misc/pti.c
index 8653bd0b1a33..0b56e3f43573 100644
--- a/drivers/misc/pti.c
+++ b/drivers/misc/pti.c
@@ -33,6 +33,8 @@
 #include <linux/mutex.h>
 #include <linux/miscdevice.h>
 #include <linux/pti.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
 #define DRIVERNAME              "pti"
 #define PCINAME                 "pciPTI"
@@ -163,6 +165,11 @@ static void pti_write_to_aperture(struct pti_masterchannel *mc,
 static void pti_control_frame_built_and_sent(struct pti_masterchannel *mc,
                                             const char *thread_name)
 {
+        /*
+         * Since we access the comm member in current's task_struct, we only
+         * need to be as large as what 'comm' in that structure is.
+         */
+        char comm[TASK_COMM_LEN];
        struct pti_masterchannel mccontrol = {.master = CONTROL_ID,
                                              .channel = 0};
        const char *thread_name_p;
@@ -170,13 +177,6 @@ static void pti_control_frame_built_and_sent(struct pti_masterchannel *mc,
        u8 control_frame[CONTROL_FRAME_LEN];
        if (!thread_name) {
-                /*
-                 * Since we access the comm member in current's task_struct,
-                 * we only need to be as large as what 'comm' in that
-                 * structure is.
-                 */
-                char comm[TASK_COMM_LEN];
                if (!in_interrupt())
                        get_task_comm(comm, current);
                else
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index 54c91ffe4a91..ba168a7d54d4 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -338,6 +338,12 @@ void st_int_recv(void *disc_data,
                        /* Unknow packet? */
                default:
                        type = *ptr;
+                        if (st_gdata->list[type] == NULL) {
+                                pr_err("chip/interface misbehavior dropping"
+                                        " frame starting with 0x%02x", type);
+                                goto done;
+                        }
                        st_gdata->rx_skb = alloc_skb(
                                        st_gdata->list[type]->max_frame_size,
                                        GFP_ATOMIC);
@@ -354,6 +360,7 @@ void st_int_recv(void *disc_data,
                ptr++;
                count--;
        }
+done:
        spin_unlock_irqrestore(&st_gdata->lock, flags);
        pr_debug("done %s", __func__);
        return;
@@ -717,9 +724,10 @@ static void st_tty_close(struct tty_struct *tty)
         */
        spin_lock_irqsave(&st_gdata->lock, flags);
        for (i = ST_BT; i < ST_MAX_CHANNELS; i++) {
-                if (st_gdata->list[i] != NULL)
+                if (st_gdata->is_registered[i] == true)
                        pr_err("%d not un-registered", i);
                st_gdata->list[i] = NULL;
+                st_gdata->is_registered[i] = false;
        }
        st_gdata->protos_registered = 0;
        spin_unlock_irqrestore(&st_gdata->lock, flags);
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 38fd2f04c07e..3a3580566dfc 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -68,6 +68,7 @@ void validate_firmware_response(struct kim_data_s *kim_gdata)
        if (unlikely(skb->data[5] != 0)) {
                pr_err("no proper response during fw download");
                pr_err("data6 %x", skb->data[5]);
+                kfree_skb(skb);
                return;         /* keep waiting for the proper response */
        }
        /* becos of all the script being downloaded */
@@ -210,6 +211,7 @@ static long read_local_version(struct kim_data_s *kim_gdata, char *bts_scr_name)
                pr_err(" waiting for ver info- timed out ");
                return -ETIMEDOUT;
        }
+        INIT_COMPLETION(kim_gdata->kim_rcvd);
        version =
                MAKEWORD(kim_gdata->resp_buffer[13],
@@ -298,6 +300,7 @@ static long download_firmware(struct kim_data_s *kim_gdata)
                switch (((struct bts_action *)ptr)->type) {
                case ACTION_SEND_COMMAND:       /* action send */
+                        pr_debug("S");
                        action_ptr = &(((struct bts_action *)ptr)->data[0]);
                        if (unlikely
                            (((struct hci_command *)action_ptr)->opcode ==
@@ -335,6 +338,10 @@ static long download_firmware(struct kim_data_s *kim_gdata)
                                release_firmware(kim_gdata->fw_entry);
                                return -ETIMEDOUT;
                        }
+                        /* reinit completion before sending for the
+                         * relevant wait
+                         */
+                        INIT_COMPLETION(kim_gdata->kim_rcvd);
                        /*
                         * Free space found in uart buffer, call st_int_write
@@ -361,6 +368,7 @@ static long download_firmware(struct kim_data_s *kim_gdata)
                        }
                        break;
                case ACTION_WAIT_EVENT:  /* wait */
+                        pr_debug("W");
                        if (!wait_for_completion_timeout
                                        (&kim_gdata->kim_rcvd,
                                         msecs_to_jiffies(CMD_RESP_TIME))) {
@@ -434,11 +442,17 @@ long st_kim_start(void *kim_data)
 {
        long err = 0;
        long retry = POR_RETRY_COUNT;
+        struct ti_st_plat_data  *pdata;
        struct kim_data_s       *kim_gdata = (struct kim_data_s *)kim_data;
        pr_info(" %s", __func__);
+        pdata = kim_gdata->kim_pdev->dev.platform_data;
        do {
+                /* platform specific enabling code here */
+                if (pdata->chip_enable)
+                        pdata->chip_enable(kim_gdata);
                /* Configure BT nShutdown to HIGH state */
                gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
                mdelay(5);      /* FIXME: a proper toggle */
@@ -460,6 +474,12 @@ long st_kim_start(void *kim_data)
                        pr_info("ldisc_install = 0");
                        sysfs_notify(&kim_gdata->kim_pdev->dev.kobj,
                                        NULL, "install");
+                        /* the following wait is never going to be completed,
+                         * since the ldisc was never installed, hence serving
+                         * as a mdelay of LDISC_TIME msecs */
+                        err = wait_for_completion_timeout
+                                (&kim_gdata->ldisc_installed,
+                                 msecs_to_jiffies(LDISC_TIME));
                        err = -ETIMEDOUT;
                        continue;
                } else {
@@ -472,6 +492,13 @@ long st_kim_start(void *kim_data)
                                pr_info("ldisc_install = 0");
                                sysfs_notify(&kim_gdata->kim_pdev->dev.kobj,
                                                NULL, "install");
+                                /* this wait might be completed, though in the
+                                 * tty_close() since the ldisc is already
+                                 * installed */
+                                err = wait_for_completion_timeout
+                                        (&kim_gdata->ldisc_installed,
+                                         msecs_to_jiffies(LDISC_TIME));
+                                err = -EINVAL;
                                continue;
                        } else {        /* on success don't retry */
                                break;
@@ -489,6 +516,8 @@ long st_kim_stop(void *kim_data)
 {
        long err = 0;
        struct kim_data_s       *kim_gdata = (struct kim_data_s *)kim_data;
+        struct ti_st_plat_data  *pdata =
+                kim_gdata->kim_pdev->dev.platform_data;
        INIT_COMPLETION(kim_gdata->ldisc_installed);
@@ -515,6 +544,10 @@ long st_kim_stop(void *kim_data)
        gpio_set_value(kim_gdata->nshutdown, GPIO_HIGH);
        mdelay(1);
        gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
+        /* platform specific disable */
+        if (pdata->chip_disable)
+                pdata->chip_disable(kim_gdata);
        return err;
 }
diff --git a/drivers/misc/ti-st/st_ll.c b/drivers/misc/ti-st/st_ll.c
index 3f2495138855..1ff460a8e9c7 100644
--- a/drivers/misc/ti-st/st_ll.c
+++ b/drivers/misc/ti-st/st_ll.c
@@ -22,6 +22,7 @@
 #define pr_fmt(fmt) "(stll) :" fmt
 #include <linux/skbuff.h>
 #include <linux/module.h>
+#include <linux/platform_device.h>
 #include <linux/ti_wilink_st.h>
 /**********************************************************************/
@@ -37,6 +38,9 @@ static void send_ll_cmd(struct st_data_s *st_data,
 static void ll_device_want_to_sleep(struct st_data_s *st_data)
 {
+        struct kim_data_s       *kim_data;
+        struct ti_st_plat_data  *pdata;
        pr_debug("%s", __func__);
        /* sanity check */
        if (st_data->ll_state != ST_LL_AWAKE)
@@ -46,10 +50,19 @@ static void ll_device_want_to_sleep(struct st_data_s *st_data)
        send_ll_cmd(st_data, LL_SLEEP_ACK);
        /* update state */
        st_data->ll_state = ST_LL_ASLEEP;
+        /* communicate to platform about chip asleep */
+        kim_data = st_data->kim_data;
+        pdata = kim_data->kim_pdev->dev.platform_data;
+        if (pdata->chip_asleep)
+                pdata->chip_asleep(NULL);
 }
 static void ll_device_want_to_wakeup(struct st_data_s *st_data)
 {
+        struct kim_data_s       *kim_data;
+        struct ti_st_plat_data  *pdata;
        /* diff actions in diff states */
        switch (st_data->ll_state) {
        case ST_LL_ASLEEP:
@@ -70,6 +83,12 @@ static void ll_device_want_to_wakeup(struct st_data_s *st_data)
        }
        /* update state */
        st_data->ll_state = ST_LL_AWAKE;
+        /* communicate to platform about chip wakeup */
+        kim_data = st_data->kim_data;
+        pdata = kim_data->kim_pdev->dev.platform_data;
+        if (pdata->chip_asleep)
+                pdata->chip_awake(NULL);
 }
 /**********************************************************************/
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 1ff5486213fb..4c1a648d00fc 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -926,6 +926,9 @@ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
        /*
         * Reliable writes are used to implement Forced Unit Access and
         * REQ_META accesses, and are supported only on MMCs.
+         *
+         * XXX: this really needs a good explanation of why REQ_META
+         * is treated special.
         */
        bool do_rel_wr = ((req->cmd_flags & REQ_FUA) ||
                          (req->cmd_flags & REQ_META)) &&
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 91a0a7460ebb..b27b94078c21 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -133,7 +133,7 @@ void mmc_request_done(struct mmc_host *host, struct mmc_request *mrq)
                if (mrq->done)
                        mrq->done(mrq);
-                mmc_host_clk_gate(host);
+                mmc_host_clk_release(host);
        }
 }
@@ -192,7 +192,7 @@ mmc_start_request(struct mmc_host *host, struct mmc_request *mrq)
                        mrq->stop->mrq = mrq;
                }
        }
-        mmc_host_clk_ungate(host);
+        mmc_host_clk_hold(host);
        led_trigger_event(host->led, LED_FULL);
        host->ops->request(host, mrq);
 }
@@ -728,15 +728,17 @@ static inline void mmc_set_ios(struct mmc_host *host)
 */
 void mmc_set_chip_select(struct mmc_host *host, int mode)
 {
+        mmc_host_clk_hold(host);
        host->ios.chip_select = mode;
        mmc_set_ios(host);
+        mmc_host_clk_release(host);
 }
 /*
 * Sets the host clock to the highest possible frequency that
 * is below "hz".
 */
-void mmc_set_clock(struct mmc_host *host, unsigned int hz)
+static void __mmc_set_clock(struct mmc_host *host, unsigned int hz)
 {
        WARN_ON(hz < host->f_min);
@@ -747,6 +749,13 @@ void mmc_set_clock(struct mmc_host *host, unsigned int hz)
        mmc_set_ios(host);
 }
+void mmc_set_clock(struct mmc_host *host, unsigned int hz)
+{
+        mmc_host_clk_hold(host);
+        __mmc_set_clock(host, hz);
+        mmc_host_clk_release(host);
+}
 #ifdef CONFIG_MMC_CLKGATE
 /*
 * This gates the clock by setting it to 0 Hz.
@@ -779,7 +788,7 @@ void mmc_ungate_clock(struct mmc_host *host)
        if (host->clk_old) {
                BUG_ON(host->ios.clock);
                /* This call will also set host->clk_gated to false */
-                mmc_set_clock(host, host->clk_old);
+                __mmc_set_clock(host, host->clk_old);
        }
 }
@@ -807,8 +816,10 @@ void mmc_set_ungated(struct mmc_host *host)
 */
 void mmc_set_bus_mode(struct mmc_host *host, unsigned int mode)
 {
+        mmc_host_clk_hold(host);
        host->ios.bus_mode = mode;
        mmc_set_ios(host);
+        mmc_host_clk_release(host);
 }
 /*
@@ -816,8 +827,10 @@ void mmc_set_bus_mode(struct mmc_host *host, unsigned int mode)
 */
 void mmc_set_bus_width(struct mmc_host *host, unsigned int width)
 {
+        mmc_host_clk_hold(host);
        host->ios.bus_width = width;
        mmc_set_ios(host);
+        mmc_host_clk_release(host);
 }
 /**
@@ -1015,8 +1028,10 @@ u32 mmc_select_voltage(struct mmc_host *host, u32 ocr)
                ocr &= 3 << bit;
+                mmc_host_clk_hold(host);
                host->ios.vdd = bit;
                mmc_set_ios(host);
+                mmc_host_clk_release(host);
        } else {
                pr_warning("%s: host doesn't support card's voltages\n",
                                mmc_hostname(host));
@@ -1063,8 +1078,10 @@ int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage, bool cmd11
 */
 void mmc_set_timing(struct mmc_host *host, unsigned int timing)
 {
+        mmc_host_clk_hold(host);
        host->ios.timing = timing;
        mmc_set_ios(host);
+        mmc_host_clk_release(host);
 }
 /*
@@ -1072,8 +1089,10 @@ void mmc_set_timing(struct mmc_host *host, unsigned int timing)
 */
 void mmc_set_driver_type(struct mmc_host *host, unsigned int drv_type)
 {
+        mmc_host_clk_hold(host);
        host->ios.drv_type = drv_type;
        mmc_set_ios(host);
+        mmc_host_clk_release(host);
 }
 /*
@@ -1091,6 +1110,8 @@ static void mmc_power_up(struct mmc_host *host)
 {
        int bit;
+        mmc_host_clk_hold(host);
        /* If ocr is set, we use it */
        if (host->ocr)
                bit = ffs(host->ocr) - 1;
@@ -1126,10 +1147,14 @@ static void mmc_power_up(struct mmc_host *host)
         * time required to reach a stable voltage.
         */
        mmc_delay(10);
+        mmc_host_clk_release(host);
 }
 static void mmc_power_off(struct mmc_host *host)
 {
+        mmc_host_clk_hold(host);
        host->ios.clock = 0;
        host->ios.vdd = 0;
@@ -1147,6 +1172,8 @@ static void mmc_power_off(struct mmc_host *host)
        host->ios.bus_width = MMC_BUS_WIDTH_1;
        host->ios.timing = MMC_TIMING_LEGACY;
        mmc_set_ios(host);
+        mmc_host_clk_release(host);
 }
 /*
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index b29d3e8fd3a2..793d0a0dad8d 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -119,14 +119,14 @@ static void mmc_host_clk_gate_work(struct work_struct *work)
 }
 /**
- *      mmc_host_clk_ungate - ungate hardware MCI clocks
+ *      mmc_host_clk_hold - ungate hardware MCI clocks
 *      @host: host to ungate.
 *
 *      Makes sure the host ios.clock is restored to a non-zero value
 *      past this call. Increase clock reference count and ungate clock
 *      if we're the first user.
 */
-void mmc_host_clk_ungate(struct mmc_host *host)
+void mmc_host_clk_hold(struct mmc_host *host)
 {
        unsigned long flags;
@@ -164,14 +164,14 @@ static bool mmc_host_may_gate_card(struct mmc_card *card)
 }
 /**
- *      mmc_host_clk_gate - gate off hardware MCI clocks
+ *      mmc_host_clk_release - gate off hardware MCI clocks
 *      @host: host to gate.
 *
 *      Calls the host driver with ios.clock set to zero as often as possible
 *      in order to gate off hardware MCI clocks. Decrease clock reference
 *      count and schedule disabling of clock.
 */
-void mmc_host_clk_gate(struct mmc_host *host)
+void mmc_host_clk_release(struct mmc_host *host)
 {
        unsigned long flags;
@@ -179,7 +179,7 @@ void mmc_host_clk_gate(struct mmc_host *host)
        host->clk_requests--;
        if (mmc_host_may_gate_card(host->card) &&
            !host->clk_requests)
-                schedule_work(&host->clk_gate_work);
+                queue_work(system_nrt_wq, &host->clk_gate_work);
        spin_unlock_irqrestore(&host->clk_lock, flags);
 }
@@ -231,7 +231,7 @@ static inline void mmc_host_clk_exit(struct mmc_host *host)
        if (cancel_work_sync(&host->clk_gate_work))
                mmc_host_clk_gate_delayed(host);
        if (host->clk_gated)
-                mmc_host_clk_ungate(host);
+                mmc_host_clk_hold(host);
        /* There should be only one user now */
        WARN_ON(host->clk_requests > 1);
 }
diff --git a/drivers/mmc/core/host.h b/drivers/mmc/core/host.h
index de199f911928..fb8a5cd2e4a1 100644
--- a/drivers/mmc/core/host.h
+++ b/drivers/mmc/core/host.h
@@ -16,16 +16,16 @@ int mmc_register_host_class(void);
 void mmc_unregister_host_class(void);
 #ifdef CONFIG_MMC_CLKGATE
-void mmc_host_clk_ungate(struct mmc_host *host);
+void mmc_host_clk_hold(struct mmc_host *host);
-void mmc_host_clk_gate(struct mmc_host *host);
+void mmc_host_clk_release(struct mmc_host *host);
 unsigned int mmc_host_clk_rate(struct mmc_host *host);
 #else
-static inline void mmc_host_clk_ungate(struct mmc_host *host)
+static inline void mmc_host_clk_hold(struct mmc_host *host)
 {
 }
-static inline void mmc_host_clk_gate(struct mmc_host *host)
+static inline void mmc_host_clk_release(struct mmc_host *host)
 {
 }
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 633975ff2bb3..0370e03e3142 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -469,56 +469,75 @@ static int sd_select_driver_type(struct mmc_card *card, u8 *status)
        return 0;
 }
-static int sd_set_bus_speed_mode(struct mmc_card *card, u8 *status)
+static void sd_update_bus_speed_mode(struct mmc_card *card)
 {
-        unsigned int bus_speed = 0, timing = 0;
-        int err;
        /*
         * If the host doesn't support any of the UHS-I modes, fallback on
         * default speed.
         */
        if (!(card->host->caps & (MMC_CAP_UHS_SDR12 | MMC_CAP_UHS_SDR25 |
-            MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR104 | MMC_CAP_UHS_DDR50)))
+            MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR104 | MMC_CAP_UHS_DDR50))) {
-                return 0;
+                card->sd_bus_speed = 0;
+                return;
+        }
        if ((card->host->caps & MMC_CAP_UHS_SDR104) &&
            (card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR104)) {
-                        bus_speed = UHS_SDR104_BUS_SPEED;
+                        card->sd_bus_speed = UHS_SDR104_BUS_SPEED;
-                        timing = MMC_TIMING_UHS_SDR104;
-                        card->sw_caps.uhs_max_dtr = UHS_SDR104_MAX_DTR;
        } else if ((card->host->caps & MMC_CAP_UHS_DDR50) &&
                   (card->sw_caps.sd3_bus_mode & SD_MODE_UHS_DDR50)) {
-                        bus_speed = UHS_DDR50_BUS_SPEED;
+                        card->sd_bus_speed = UHS_DDR50_BUS_SPEED;
-                        timing = MMC_TIMING_UHS_DDR50;
-                        card->sw_caps.uhs_max_dtr = UHS_DDR50_MAX_DTR;
        } else if ((card->host->caps & (MMC_CAP_UHS_SDR104 |
                    MMC_CAP_UHS_SDR50)) && (card->sw_caps.sd3_bus_mode &
                    SD_MODE_UHS_SDR50)) {
-                        bus_speed = UHS_SDR50_BUS_SPEED;
+                        card->sd_bus_speed = UHS_SDR50_BUS_SPEED;
-                        timing = MMC_TIMING_UHS_SDR50;
-                        card->sw_caps.uhs_max_dtr = UHS_SDR50_MAX_DTR;
        } else if ((card->host->caps & (MMC_CAP_UHS_SDR104 |
                    MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR25)) &&
                   (card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR25)) {
-                        bus_speed = UHS_SDR25_BUS_SPEED;
+                        card->sd_bus_speed = UHS_SDR25_BUS_SPEED;
-                        timing = MMC_TIMING_UHS_SDR25;
-                        card->sw_caps.uhs_max_dtr = UHS_SDR25_MAX_DTR;
        } else if ((card->host->caps & (MMC_CAP_UHS_SDR104 |
                    MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR25 |
                    MMC_CAP_UHS_SDR12)) && (card->sw_caps.sd3_bus_mode &
                    SD_MODE_UHS_SDR12)) {
-                        bus_speed = UHS_SDR12_BUS_SPEED;
+                        card->sd_bus_speed = UHS_SDR12_BUS_SPEED;
-                        timing = MMC_TIMING_UHS_SDR12;
+        }
-                        card->sw_caps.uhs_max_dtr = UHS_SDR12_MAX_DTR;
+}
+static int sd_set_bus_speed_mode(struct mmc_card *card, u8 *status)
+{
+        int err;
+        unsigned int timing = 0;
+        switch (card->sd_bus_speed) {
+        case UHS_SDR104_BUS_SPEED:
+                timing = MMC_TIMING_UHS_SDR104;
+                card->sw_caps.uhs_max_dtr = UHS_SDR104_MAX_DTR;
+                break;
+        case UHS_DDR50_BUS_SPEED:
+                timing = MMC_TIMING_UHS_DDR50;
+                card->sw_caps.uhs_max_dtr = UHS_DDR50_MAX_DTR;
+                break;
+        case UHS_SDR50_BUS_SPEED:
+                timing = MMC_TIMING_UHS_SDR50;
+                card->sw_caps.uhs_max_dtr = UHS_SDR50_MAX_DTR;
+                break;
+        case UHS_SDR25_BUS_SPEED:
+                timing = MMC_TIMING_UHS_SDR25;
+                card->sw_caps.uhs_max_dtr = UHS_SDR25_MAX_DTR;
+                break;
+        case UHS_SDR12_BUS_SPEED:
+                timing = MMC_TIMING_UHS_SDR12;
+                card->sw_caps.uhs_max_dtr = UHS_SDR12_MAX_DTR;
+                break;
+        default:
+                return 0;
        }
-        card->sd_bus_speed = bus_speed;
+        err = mmc_sd_switch(card, 1, 0, card->sd_bus_speed, status);
-        err = mmc_sd_switch(card, 1, 0, bus_speed, status);
        if (err)
                return err;
-        if ((status[16] & 0xF) != bus_speed)
+        if ((status[16] & 0xF) != card->sd_bus_speed)
                printk(KERN_WARNING "%s: Problem setting bus speed mode!\n",
                        mmc_hostname(card->host));
        else {
@@ -618,18 +637,24 @@ static int mmc_sd_init_uhs_card(struct mmc_card *card)
                mmc_set_bus_width(card->host, MMC_BUS_WIDTH_4);
        }
+        /*
+         * Select the bus speed mode depending on host
+         * and card capability.
+         */
+        sd_update_bus_speed_mode(card);
        /* Set the driver strength for the card */
        err = sd_select_driver_type(card, status);
        if (err)
                goto out;
-        /* Set bus speed mode of the card */
+        /* Set current limit for the card */
-        err = sd_set_bus_speed_mode(card, status);
+        err = sd_set_current_limit(card, status);
        if (err)
                goto out;
-        /* Set current limit for the card */
+        /* Set bus speed mode of the card */
-        err = sd_set_current_limit(card, status);
+        err = sd_set_bus_speed_mode(card, status);
        if (err)
                goto out;
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 0e9780f5a4a9..4dc0028086a3 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -16,6 +16,7 @@
 #include <linux/err.h>
 #include <linux/clk.h>
 #include <linux/gpio.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/mmc.h>
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 2bd7bf4fece7..fe886d6c474a 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -302,6 +302,8 @@ static int sdhci_s3c_platform_8bit_width(struct sdhci_host *host, int width)
                ctrl &= ~SDHCI_CTRL_8BITBUS;
                break;
        default:
+                ctrl &= ~SDHCI_CTRL_4BITBUS;
+                ctrl &= ~SDHCI_CTRL_8BITBUS;
                break;
        }
diff --git a/drivers/mmc/host/sh_mobile_sdhi.c b/drivers/mmc/host/sh_mobile_sdhi.c
index 774f6439d7ce..0c4a672f5db6 100644
--- a/drivers/mmc/host/sh_mobile_sdhi.c
+++ b/drivers/mmc/host/sh_mobile_sdhi.c
@@ -120,11 +120,11 @@ static int __devinit sh_mobile_sdhi_probe(struct platform_device *pdev)
        mmc_data->hclk = clk_get_rate(priv->clk);
        mmc_data->set_pwr = sh_mobile_sdhi_set_pwr;
        mmc_data->get_cd = sh_mobile_sdhi_get_cd;
-        if (mmc_data->flags & TMIO_MMC_HAS_IDLE_WAIT)
-                mmc_data->write16_hook = sh_mobile_sdhi_write16_hook;
        mmc_data->capabilities = MMC_CAP_MMC_HIGHSPEED;
        if (p) {
                mmc_data->flags = p->tmio_flags;
+                if (mmc_data->flags & TMIO_MMC_HAS_IDLE_WAIT)
+                        mmc_data->write16_hook = sh_mobile_sdhi_write16_hook;
                mmc_data->ocr_mask = p->tmio_ocr_mask;
                mmc_data->capabilities |= p->tmio_caps;
diff --git a/drivers/mtd/ubi/debug.h b/drivers/mtd/ubi/debug.h
index 65b5b76cc379..64fbb0021825 100644
--- a/drivers/mtd/ubi/debug.h
+++ b/drivers/mtd/ubi/debug.h
@@ -181,7 +181,7 @@ static inline int ubi_dbg_is_erase_failure(const struct ubi_device *ubi)
 #define ubi_dbg_msg(fmt, ...) do {                                           \
        if (0)                                                               \
-                pr_debug(fmt "\n", ##__VA_ARGS__);                           \
+                printk(KERN_DEBUG fmt "\n", ##__VA_ARGS__);                  \
 } while (0)
 #define dbg_msg(fmt, ...)  ubi_dbg_msg(fmt, ##__VA_ARGS__)
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 8d0314dbd946..a44874e24f2a 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2535,7 +2535,7 @@ config S6GMAC
 source "drivers/net/stmmac/Kconfig"
 config PCH_GBE
-        tristate "Intel EG20T PCH / OKI SEMICONDUCTOR ML7223 IOH GbE"
+        tristate "Intel EG20T PCH/OKI SEMICONDUCTOR IOH(ML7223/ML7831) GbE"
        depends on PCI
        select MII
        ---help---
@@ -2548,10 +2548,11 @@ config PCH_GBE
          This driver enables Gigabit Ethernet function.
          This driver also can be used for OKI SEMICONDUCTOR IOH(Input/
-          Output Hub), ML7223.
+          Output Hub), ML7223/ML7831.
-          ML7223 IOH is for MP(Media Phone) use.
+          ML7223 IOH is for MP(Media Phone) use. ML7831 IOH is for general
-          ML7223 is companion chip for Intel Atom E6xx series.
+          purpose use.
-          ML7223 is completely compatible for Intel EG20T PCH.
+          ML7223/ML7831 is companion chip for Intel Atom E6xx series.
+          ML7223/ML7831 is completely compatible for Intel EG20T PCH.
 config FTGMAC100
        tristate "Faraday FTGMAC100 Gigabit Ethernet support"
diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index 52fe21e1e2cd..3b1416e3d217 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -308,8 +308,11 @@ static void am79c961_timer(unsigned long data)
        struct net_device *dev = (struct net_device *)data;
        struct dev_priv *priv = netdev_priv(dev);
        unsigned int lnkstat, carrier;
+        unsigned long flags;
+        spin_lock_irqsave(&priv->chip_lock, flags);
        lnkstat = read_ireg(dev->base_addr, ISALED0) & ISALED0_LNKST;
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
        carrier = netif_carrier_ok(dev);
        if (lnkstat && !carrier) {
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index c423504a755f..e46df5331c55 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -315,6 +315,14 @@ union db_prod {
        u32             raw;
 };
+/* dropless fc FW/HW related params */
+#define BRB_SIZE(bp)            (CHIP_IS_E3(bp) ? 1024 : 512)
+#define MAX_AGG_QS(bp)          (CHIP_IS_E1(bp) ? \
+                                        ETH_MAX_AGGREGATION_QUEUES_E1 :\
+                                        ETH_MAX_AGGREGATION_QUEUES_E1H_E2)
+#define FW_DROP_LEVEL(bp)       (3 + MAX_SPQ_PENDING + MAX_AGG_QS(bp))
+#define FW_PREFETCH_CNT         16
+#define DROPLESS_FC_HEADROOM    100
 /* MC hsi */
 #define BCM_PAGE_SHIFT          12
@@ -331,15 +339,35 @@ union db_prod {
 /* SGE ring related macros */
 #define NUM_RX_SGE_PAGES        2
 #define RX_SGE_CNT              (BCM_PAGE_SIZE / sizeof(struct eth_rx_sge))
-#define MAX_RX_SGE_CNT          (RX_SGE_CNT - 2)
+#define NEXT_PAGE_SGE_DESC_CNT  2
+#define MAX_RX_SGE_CNT          (RX_SGE_CNT - NEXT_PAGE_SGE_DESC_CNT)
 /* RX_SGE_CNT is promised to be a power of 2 */
 #define RX_SGE_MASK             (RX_SGE_CNT - 1)
 #define NUM_RX_SGE              (RX_SGE_CNT * NUM_RX_SGE_PAGES)
 #define MAX_RX_SGE              (NUM_RX_SGE - 1)
 #define NEXT_SGE_IDX(x)         ((((x) & RX_SGE_MASK) == \
-                                  (MAX_RX_SGE_CNT - 1)) ? (x) + 3 : (x) + 1)
+                                  (MAX_RX_SGE_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_SGE_DESC_CNT : \
+                                        (x) + 1)
 #define RX_SGE(x)               ((x) & MAX_RX_SGE)
+/*
+ * Number of required  SGEs is the sum of two:
+ * 1. Number of possible opened aggregations (next packet for
+ *    these aggregations will probably consume SGE immidiatelly)
+ * 2. Rest of BRB blocks divided by 2 (block will consume new SGE only
+ *    after placement on BD for new TPA aggregation)
+ *
+ * Takes into account NEXT_PAGE_SGE_DESC_CNT "next" elements on each page
+ */
+#define NUM_SGE_REQ             (MAX_AGG_QS(bp) + \
+                                        (BRB_SIZE(bp) - MAX_AGG_QS(bp)) / 2)
+#define NUM_SGE_PG_REQ          ((NUM_SGE_REQ + MAX_RX_SGE_CNT - 1) / \
+                                                MAX_RX_SGE_CNT)
+#define SGE_TH_LO(bp)           (NUM_SGE_REQ + \
+                                 NUM_SGE_PG_REQ * NEXT_PAGE_SGE_DESC_CNT)
+#define SGE_TH_HI(bp)           (SGE_TH_LO(bp) + DROPLESS_FC_HEADROOM)
 /* Manipulate a bit vector defined as an array of u64 */
 /* Number of bits in one sge_mask array element */
@@ -551,24 +579,43 @@ struct bnx2x_fastpath {
 #define NUM_TX_RINGS            16
 #define TX_DESC_CNT             (BCM_PAGE_SIZE / sizeof(union eth_tx_bd_types))
-#define MAX_TX_DESC_CNT         (TX_DESC_CNT - 1)
+#define NEXT_PAGE_TX_DESC_CNT   1
+#define MAX_TX_DESC_CNT         (TX_DESC_CNT - NEXT_PAGE_TX_DESC_CNT)
 #define NUM_TX_BD               (TX_DESC_CNT * NUM_TX_RINGS)
 #define MAX_TX_BD               (NUM_TX_BD - 1)
 #define MAX_TX_AVAIL            (MAX_TX_DESC_CNT * NUM_TX_RINGS - 2)
 #define NEXT_TX_IDX(x)          ((((x) & MAX_TX_DESC_CNT) == \
-                                  (MAX_TX_DESC_CNT - 1)) ? (x) + 2 : (x) + 1)
+                                  (MAX_TX_DESC_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_TX_DESC_CNT : \
+                                        (x) + 1)
 #define TX_BD(x)                ((x) & MAX_TX_BD)
 #define TX_BD_POFF(x)           ((x) & MAX_TX_DESC_CNT)
 /* The RX BD ring is special, each bd is 8 bytes but the last one is 16 */
 #define NUM_RX_RINGS            8
 #define RX_DESC_CNT             (BCM_PAGE_SIZE / sizeof(struct eth_rx_bd))
-#define MAX_RX_DESC_CNT         (RX_DESC_CNT - 2)
+#define NEXT_PAGE_RX_DESC_CNT   2
+#define MAX_RX_DESC_CNT         (RX_DESC_CNT - NEXT_PAGE_RX_DESC_CNT)
 #define RX_DESC_MASK            (RX_DESC_CNT - 1)
 #define NUM_RX_BD               (RX_DESC_CNT * NUM_RX_RINGS)
 #define MAX_RX_BD               (NUM_RX_BD - 1)
 #define MAX_RX_AVAIL            (MAX_RX_DESC_CNT * NUM_RX_RINGS - 2)
-#define MIN_RX_AVAIL            128
+/* dropless fc calculations for BDs
+ *
+ * Number of BDs should as number of buffers in BRB:
+ * Low threshold takes into account NEXT_PAGE_RX_DESC_CNT
+ * "next" elements on each page
+ */
+#define NUM_BD_REQ              BRB_SIZE(bp)
+#define NUM_BD_PG_REQ           ((NUM_BD_REQ + MAX_RX_DESC_CNT - 1) / \
+                                              MAX_RX_DESC_CNT)
+#define BD_TH_LO(bp)            (NUM_BD_REQ + \
+                                 NUM_BD_PG_REQ * NEXT_PAGE_RX_DESC_CNT + \
+                                 FW_DROP_LEVEL(bp))
+#define BD_TH_HI(bp)            (BD_TH_LO(bp) + DROPLESS_FC_HEADROOM)
+#define MIN_RX_AVAIL            ((bp)->dropless_fc ? BD_TH_HI(bp) + 128 : 128)
 #define MIN_RX_SIZE_TPA_HW      (CHIP_IS_E1(bp) ? \
                                        ETH_MIN_RX_CQES_WITH_TPA_E1 : \
@@ -579,7 +626,9 @@ struct bnx2x_fastpath {
                                                                MIN_RX_AVAIL))
 #define NEXT_RX_IDX(x)          ((((x) & RX_DESC_MASK) == \
-                                  (MAX_RX_DESC_CNT - 1)) ? (x) + 3 : (x) + 1)
+                                  (MAX_RX_DESC_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_RX_DESC_CNT : \
+                                        (x) + 1)
 #define RX_BD(x)                ((x) & MAX_RX_BD)
 /*
@@ -589,14 +638,31 @@ struct bnx2x_fastpath {
 #define CQE_BD_REL      (sizeof(union eth_rx_cqe) / sizeof(struct eth_rx_bd))
 #define NUM_RCQ_RINGS           (NUM_RX_RINGS * CQE_BD_REL)
 #define RCQ_DESC_CNT            (BCM_PAGE_SIZE / sizeof(union eth_rx_cqe))
-#define MAX_RCQ_DESC_CNT        (RCQ_DESC_CNT - 1)
+#define NEXT_PAGE_RCQ_DESC_CNT  1
+#define MAX_RCQ_DESC_CNT        (RCQ_DESC_CNT - NEXT_PAGE_RCQ_DESC_CNT)
 #define NUM_RCQ_BD              (RCQ_DESC_CNT * NUM_RCQ_RINGS)
 #define MAX_RCQ_BD              (NUM_RCQ_BD - 1)
 #define MAX_RCQ_AVAIL           (MAX_RCQ_DESC_CNT * NUM_RCQ_RINGS - 2)
 #define NEXT_RCQ_IDX(x)         ((((x) & MAX_RCQ_DESC_CNT) == \
-                                  (MAX_RCQ_DESC_CNT - 1)) ? (x) + 2 : (x) + 1)
+                                  (MAX_RCQ_DESC_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_RCQ_DESC_CNT : \
+                                        (x) + 1)
 #define RCQ_BD(x)               ((x) & MAX_RCQ_BD)
+/* dropless fc calculations for RCQs
+ *
+ * Number of RCQs should be as number of buffers in BRB:
+ * Low threshold takes into account NEXT_PAGE_RCQ_DESC_CNT
+ * "next" elements on each page
+ */
+#define NUM_RCQ_REQ             BRB_SIZE(bp)
+#define NUM_RCQ_PG_REQ          ((NUM_BD_REQ + MAX_RCQ_DESC_CNT - 1) / \
+                                              MAX_RCQ_DESC_CNT)
+#define RCQ_TH_LO(bp)           (NUM_RCQ_REQ + \
+                                 NUM_RCQ_PG_REQ * NEXT_PAGE_RCQ_DESC_CNT + \
+                                 FW_DROP_LEVEL(bp))
+#define RCQ_TH_HI(bp)           (RCQ_TH_LO(bp) + DROPLESS_FC_HEADROOM)
 /* This is needed for determining of last_max */
 #define SUB_S16(a, b)           (s16)((s16)(a) - (s16)(b))
@@ -685,24 +751,17 @@ struct bnx2x_fastpath {
 #define FP_CSB_FUNC_OFF \
                        offsetof(struct cstorm_status_block_c, func)
-#define HC_INDEX_TOE_RX_CQ_CONS         0 /* Formerly Ustorm TOE CQ index */
+#define HC_INDEX_ETH_RX_CQ_CONS         1
-                                          /* (HC_INDEX_U_TOE_RX_CQ_CONS)  */
-#define HC_INDEX_ETH_RX_CQ_CONS         1 /* Formerly Ustorm ETH CQ index */
-                                          /* (HC_INDEX_U_ETH_RX_CQ_CONS)  */
-#define HC_INDEX_ETH_RX_BD_CONS         2 /* Formerly Ustorm ETH BD index */
-                                          /* (HC_INDEX_U_ETH_RX_BD_CONS)  */
-#define HC_INDEX_TOE_TX_CQ_CONS         4 /* Formerly Cstorm TOE CQ index   */
-                                          /* (HC_INDEX_C_TOE_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_TX_CQ_CONS_COS0    5 /* Formerly Cstorm ETH CQ index   */
-                                          /* (HC_INDEX_C_ETH_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_TX_CQ_CONS_COS1    6 /* Formerly Cstorm ETH CQ index   */
-                                          /* (HC_INDEX_C_ETH_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_TX_CQ_CONS_COS2    7 /* Formerly Cstorm ETH CQ index   */
-                                          /* (HC_INDEX_C_ETH_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_FIRST_TX_CQ_CONS   HC_INDEX_ETH_TX_CQ_CONS_COS0
+#define HC_INDEX_OOO_TX_CQ_CONS         4
+#define HC_INDEX_ETH_TX_CQ_CONS_COS0    5
+#define HC_INDEX_ETH_TX_CQ_CONS_COS1    6
+#define HC_INDEX_ETH_TX_CQ_CONS_COS2    7
+#define HC_INDEX_ETH_FIRST_TX_CQ_CONS   HC_INDEX_ETH_TX_CQ_CONS_COS0
 #define BNX2X_RX_SB_INDEX \
        (&fp->sb_index_values[HC_INDEX_ETH_RX_CQ_CONS])
@@ -1100,11 +1159,12 @@ struct bnx2x {
 #define BP_PORT(bp)                     (bp->pfid & 1)
 #define BP_FUNC(bp)                     (bp->pfid)
 #define BP_ABS_FUNC(bp)                 (bp->pf_num)
-#define BP_E1HVN(bp)                    (bp->pfid >> 1)
+#define BP_VN(bp)                       ((bp)->pfid >> 1)
-#define BP_VN(bp)                       (BP_E1HVN(bp)) /*remove when approved*/
+#define BP_MAX_VN_NUM(bp)               (CHIP_MODE_IS_4_PORT(bp) ? 2 : 4)
-#define BP_L_ID(bp)                     (BP_E1HVN(bp) << 2)
+#define BP_L_ID(bp)                     (BP_VN(bp) << 2)
-#define BP_FW_MB_IDX(bp)                (BP_PORT(bp) +\
+#define BP_FW_MB_IDX_VN(bp, vn)         (BP_PORT(bp) +\
-          BP_VN(bp) * ((CHIP_IS_E1x(bp) || (CHIP_MODE_IS_4_PORT(bp))) ? 2  : 1))
+          (vn) * ((CHIP_IS_E1x(bp) || (CHIP_MODE_IS_4_PORT(bp))) ? 2  : 1))
+#define BP_FW_MB_IDX(bp)                BP_FW_MB_IDX_VN(bp, BP_VN(bp))
        struct net_device       *dev;
        struct pci_dev          *pdev;
@@ -1767,7 +1827,7 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 #define MAX_DMAE_C_PER_PORT             8
 #define INIT_DMAE_C(bp)                 (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
-                                         BP_E1HVN(bp))
+                                         BP_VN(bp))
 #define PMF_DMAE_C(bp)                  (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
                                         E1HVN_MAX)
@@ -1793,7 +1853,7 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 /* must be used on a CID before placing it on a HW ring */
 #define HW_CID(bp, x)                   ((BP_PORT(bp) << 23) | \
-                                         (BP_E1HVN(bp) << BNX2X_SWCID_SHIFT) | \
+                                         (BP_VN(bp) << BNX2X_SWCID_SHIFT) | \
                                         (x))
 #define SP_DESC_CNT             (BCM_PAGE_SIZE / sizeof(struct eth_spe))
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index 37e5790681ad..c4cbf9736414 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -987,8 +987,6 @@ void __bnx2x_link_report(struct bnx2x *bp)
 void bnx2x_init_rx_rings(struct bnx2x *bp)
 {
        int func = BP_FUNC(bp);
-        int max_agg_queues = CHIP_IS_E1(bp) ? ETH_MAX_AGGREGATION_QUEUES_E1 :
-                                              ETH_MAX_AGGREGATION_QUEUES_E1H_E2;
        u16 ring_prod;
        int i, j;
@@ -1001,7 +999,7 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
                if (!fp->disable_tpa) {
                        /* Fill the per-aggregtion pool */
-                        for (i = 0; i < max_agg_queues; i++) {
+                        for (i = 0; i < MAX_AGG_QS(bp); i++) {
                                struct bnx2x_agg_info *tpa_info =
                                        &fp->tpa_info[i];
                                struct sw_rx_bd *first_buf =
@@ -1041,7 +1039,7 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
                                        bnx2x_free_rx_sge_range(bp, fp,
                                                                ring_prod);
                                        bnx2x_free_tpa_pool(bp, fp,
-                                                            max_agg_queues);
+                                                            MAX_AGG_QS(bp));
                                        fp->disable_tpa = 1;
                                        ring_prod = 0;
                                        break;
@@ -1137,9 +1135,7 @@ static void bnx2x_free_rx_skbs(struct bnx2x *bp)
                bnx2x_free_rx_bds(fp);
                if (!fp->disable_tpa)
-                        bnx2x_free_tpa_pool(bp, fp, CHIP_IS_E1(bp) ?
+                        bnx2x_free_tpa_pool(bp, fp, MAX_AGG_QS(bp));
-                                            ETH_MAX_AGGREGATION_QUEUES_E1 :
-                                            ETH_MAX_AGGREGATION_QUEUES_E1H_E2);
        }
 }
@@ -3095,15 +3091,20 @@ static int bnx2x_alloc_fp_mem_at(struct bnx2x *bp, int index)
        struct bnx2x_fastpath *fp = &bp->fp[index];
        int ring_size = 0;
        u8 cos;
+        int rx_ring_size = 0;
        /* if rx_ring_size specified - use it */
-        int rx_ring_size = bp->rx_ring_size ? bp->rx_ring_size :
+        if (!bp->rx_ring_size) {
-                           MAX_RX_AVAIL/BNX2X_NUM_RX_QUEUES(bp);
-        /* allocate at least number of buffers required by FW */
+                rx_ring_size = MAX_RX_AVAIL/BNX2X_NUM_RX_QUEUES(bp);
-        rx_ring_size = max_t(int, bp->disable_tpa ? MIN_RX_SIZE_NONTPA :
-                                                    MIN_RX_SIZE_TPA,
+                /* allocate at least number of buffers required by FW */
-                                  rx_ring_size);
+                rx_ring_size = max_t(int, bp->disable_tpa ? MIN_RX_SIZE_NONTPA :
+                                     MIN_RX_SIZE_TPA, rx_ring_size);
+                bp->rx_ring_size = rx_ring_size;
+        } else
+                rx_ring_size = bp->rx_ring_size;
        /* Common */
        sb = &bnx2x_fp(bp, index, status_blk);
diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
index 221863059dae..cf3e47914dd7 100644
--- a/drivers/net/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
@@ -363,13 +363,50 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                }
                /* advertise the requested speed and duplex if supported */
-                cmd->advertising &= bp->port.supported[cfg_idx];
+                if (cmd->advertising & ~(bp->port.supported[cfg_idx])) {
+                        DP(NETIF_MSG_LINK, "Advertisement parameters "
+                                           "are not supported\n");
+                        return -EINVAL;
+                }
                bp->link_params.req_line_speed[cfg_idx] = SPEED_AUTO_NEG;
-                bp->link_params.req_duplex[cfg_idx] = DUPLEX_FULL;
+                bp->link_params.req_duplex[cfg_idx] = cmd->duplex;
-                bp->port.advertising[cfg_idx] |= (ADVERTISED_Autoneg |
+                bp->port.advertising[cfg_idx] = (ADVERTISED_Autoneg |
                                         cmd->advertising);
+                if (cmd->advertising) {
+                        bp->link_params.speed_cap_mask[cfg_idx] = 0;
+                        if (cmd->advertising & ADVERTISED_10baseT_Half) {
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF;
+                        }
+                        if (cmd->advertising & ADVERTISED_10baseT_Full)
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL;
+                        if (cmd->advertising & ADVERTISED_100baseT_Full)
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL;
+                        if (cmd->advertising & ADVERTISED_100baseT_Half) {
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                     PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF;
+                        }
+                        if (cmd->advertising & ADVERTISED_1000baseT_Half) {
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G;
+                        }
+                        if (cmd->advertising & (ADVERTISED_1000baseT_Full |
+                                                ADVERTISED_1000baseKX_Full))
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G;
+                        if (cmd->advertising & (ADVERTISED_10000baseT_Full |
+                                                ADVERTISED_10000baseKX4_Full |
+                                                ADVERTISED_10000baseKR_Full))
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10G;
+                }
        } else { /* forced speed */
                /* advertise the requested speed and duplex if supported */
                switch (speed) {
@@ -1310,10 +1347,7 @@ static void bnx2x_get_ringparam(struct net_device *dev,
        if (bp->rx_ring_size)
                ering->rx_pending = bp->rx_ring_size;
        else
-                if (bp->state == BNX2X_STATE_OPEN && bp->num_queues)
+                ering->rx_pending = MAX_RX_AVAIL;
-                        ering->rx_pending = MAX_RX_AVAIL/bp->num_queues;
-                else
-                        ering->rx_pending = MAX_RX_AVAIL;
        ering->rx_mini_pending = 0;
        ering->rx_jumbo_pending = 0;
diff --git a/drivers/net/bnx2x/bnx2x_link.c b/drivers/net/bnx2x/bnx2x_link.c
index d45b1555a602..ba15bdc5a1a9 100644
--- a/drivers/net/bnx2x/bnx2x_link.c
+++ b/drivers/net/bnx2x/bnx2x_link.c
@@ -778,9 +778,9 @@ static int bnx2x_ets_e3b0_set_cos_bw(struct bnx2x *bp,
 {
        u32 nig_reg_adress_crd_weight = 0;
        u32 pbf_reg_adress_crd_weight = 0;
-        /* Calculate and set BW for this COS*/
+        /* Calculate and set BW for this COS - use 1 instead of 0 for BW */
-        const u32 cos_bw_nig = (bw * min_w_val_nig) / total_bw;
+        const u32 cos_bw_nig = ((bw ? bw : 1) * min_w_val_nig) / total_bw;
-        const u32 cos_bw_pbf = (bw * min_w_val_pbf) / total_bw;
+        const u32 cos_bw_pbf = ((bw ? bw : 1) * min_w_val_pbf) / total_bw;
        switch (cos_entry) {
        case 0:
@@ -852,18 +852,12 @@ static int bnx2x_ets_e3b0_get_total_bw(
        /* Calculate total BW requested */
        for (cos_idx = 0; cos_idx < ets_params->num_of_cos; cos_idx++) {
                if (bnx2x_cos_state_bw == ets_params->cos[cos_idx].state) {
+                        *total_bw +=
-                        if (0 == ets_params->cos[cos_idx].params.bw_params.bw) {
+                                ets_params->cos[cos_idx].params.bw_params.bw;
-                                DP(NETIF_MSG_LINK, "bnx2x_ets_E3B0_config BW"
-                                                   "was set to 0\n");
-                        return -EINVAL;
                }
-                *total_bw +=
-                    ets_params->cos[cos_idx].params.bw_params.bw;
-            }
        }
-        /*Check taotl BW is valid */
+        /* Check total BW is valid */
        if ((100 != *total_bw) || (0 == *total_bw)) {
                if (0 == *total_bw) {
                        DP(NETIF_MSG_LINK, "bnx2x_ets_E3B0_config toatl BW"
@@ -1726,7 +1720,7 @@ static int bnx2x_xmac_enable(struct link_params *params,
        /* Check loopback mode */
        if (lb)
-                val |= XMAC_CTRL_REG_CORE_LOCAL_LPBK;
+                val |= XMAC_CTRL_REG_LINE_LOCAL_LPBK;
        REG_WR(bp, xmac_base + XMAC_REG_CTRL, val);
        bnx2x_set_xumac_nig(params,
                            ((vars->flow_ctrl & BNX2X_FLOW_CTRL_TX) != 0), 1);
@@ -3630,6 +3624,12 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
                         MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT1, val16);
+        /* Advertised and set FEC (Forward Error Correction) */
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
+                         MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT2,
+                         (MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_ABILITY |
+                          MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_REQ));
        /* Enable CL37 BAM */
        if (REG_RD(bp, params->shmem_base +
                   offsetof(struct shmem_region, dev_info.
@@ -5924,7 +5924,7 @@ int bnx2x_set_led(struct link_params *params,
                                        (tmp | EMAC_LED_OVERRIDE));
                                /*
                                 * return here without enabling traffic
-                                 * LED blink andsetting rate in ON mode.
+                                 * LED blink and setting rate in ON mode.
                                 * In oper mode, enabling LED blink
                                 * and setting rate is needed.
                                 */
@@ -5936,7 +5936,11 @@ int bnx2x_set_led(struct link_params *params,
                         * This is a work-around for HW issue found when link
                         * is up in CL73
                         */
-                        REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 1);
+                        if ((!CHIP_IS_E3(bp)) ||
+                            (CHIP_IS_E3(bp) &&
+                             mode == LED_MODE_ON))
+                                REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 1);
                        if (CHIP_IS_E1x(bp) ||
                            CHIP_IS_E2(bp) ||
                            (mode == LED_MODE_ON))
@@ -10638,8 +10642,7 @@ static struct bnx2x_phy phy_warpcore = {
        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT,
        .addr           = 0xff,
        .def_md_devad   = 0,
-        .flags          = (FLAGS_HW_LOCK_REQUIRED |
+        .flags          = FLAGS_HW_LOCK_REQUIRED,
-                           FLAGS_TX_ERROR_CHECK),
        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .mdio_ctrl      = 0,
@@ -10765,8 +10768,7 @@ static struct bnx2x_phy phy_8706 = {
        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706,
        .addr           = 0xff,
        .def_md_devad   = 0,
-        .flags          = (FLAGS_INIT_XGXS_FIRST |
+        .flags          = FLAGS_INIT_XGXS_FIRST,
-                           FLAGS_TX_ERROR_CHECK),
        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .mdio_ctrl      = 0,
@@ -10797,8 +10799,7 @@ static struct bnx2x_phy phy_8726 = {
        .addr           = 0xff,
        .def_md_devad   = 0,
        .flags          = (FLAGS_HW_LOCK_REQUIRED |
-                           FLAGS_INIT_XGXS_FIRST |
+                           FLAGS_INIT_XGXS_FIRST),
-                           FLAGS_TX_ERROR_CHECK),
        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .mdio_ctrl      = 0,
@@ -10829,8 +10830,7 @@ static struct bnx2x_phy phy_8727 = {
        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
        .addr           = 0xff,
        .def_md_devad   = 0,
-        .flags          = (FLAGS_FAN_FAILURE_DET_REQ |
+        .flags          = FLAGS_FAN_FAILURE_DET_REQ,
-                           FLAGS_TX_ERROR_CHECK),
        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .mdio_ctrl      = 0,
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index f74582a22c68..c027e9341a1a 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -407,8 +407,8 @@ u32 bnx2x_dmae_opcode(struct bnx2x *bp, u8 src_type, u8 dst_type,
        opcode |= (DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET);
        opcode |= (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0);
-        opcode |= ((BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT) |
+        opcode |= ((BP_VN(bp) << DMAE_CMD_E1HVN_SHIFT) |
-                   (BP_E1HVN(bp) << DMAE_COMMAND_DST_VN_SHIFT));
+                   (BP_VN(bp) << DMAE_COMMAND_DST_VN_SHIFT));
        opcode |= (DMAE_COM_SET_ERR << DMAE_COMMAND_ERR_POLICY_SHIFT);
 #ifdef __BIG_ENDIAN
@@ -1419,7 +1419,7 @@ static void bnx2x_hc_int_enable(struct bnx2x *bp)
        if (!CHIP_IS_E1(bp)) {
                /* init leading/trailing edge */
                if (IS_MF(bp)) {
-                        val = (0xee0f | (1 << (BP_E1HVN(bp) + 4)));
+                        val = (0xee0f | (1 << (BP_VN(bp) + 4)));
                        if (bp->port.pmf)
                                /* enable nig and gpio3 attention */
                                val |= 0x1100;
@@ -1471,7 +1471,7 @@ static void bnx2x_igu_int_enable(struct bnx2x *bp)
        /* init leading/trailing edge */
        if (IS_MF(bp)) {
-                val = (0xee0f | (1 << (BP_E1HVN(bp) + 4)));
+                val = (0xee0f | (1 << (BP_VN(bp) + 4)));
                if (bp->port.pmf)
                        /* enable nig and gpio3 attention */
                        val |= 0x1100;
@@ -2287,7 +2287,7 @@ static void bnx2x_calc_vn_weight_sum(struct bnx2x *bp)
        int vn;
        bp->vn_weight_sum = 0;
-        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++) {
                u32 vn_cfg = bp->mf_config[vn];
                u32 vn_min_rate = ((vn_cfg & FUNC_MF_CFG_MIN_BW_MASK) >>
                                   FUNC_MF_CFG_MIN_BW_SHIFT) * 100;
@@ -2320,12 +2320,18 @@ static void bnx2x_calc_vn_weight_sum(struct bnx2x *bp)
                                        CMNG_FLAGS_PER_PORT_FAIRNESS_VN;
 }
+/* returns func by VN for current port */
+static inline int func_by_vn(struct bnx2x *bp, int vn)
+{
+        return 2 * vn + BP_PORT(bp);
+}
 static void bnx2x_init_vn_minmax(struct bnx2x *bp, int vn)
 {
        struct rate_shaping_vars_per_vn m_rs_vn;
        struct fairness_vars_per_vn m_fair_vn;
        u32 vn_cfg = bp->mf_config[vn];
-        int func = 2*vn + BP_PORT(bp);
+        int func = func_by_vn(bp, vn);
        u16 vn_min_rate, vn_max_rate;
        int i;
@@ -2422,7 +2428,7 @@ void bnx2x_read_mf_cfg(struct bnx2x *bp)
         *
         *      and there are 2 functions per port
         */
-        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++) {
                int /*abs*/func = n * (2 * vn + BP_PORT(bp)) + BP_PATH(bp);
                if (func >= E1H_FUNC_MAX)
@@ -2454,7 +2460,7 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
                /* calculate and set min-max rate for each vn */
                if (bp->port.pmf)
-                        for (vn = VN_0; vn < E1HVN_MAX; vn++)
+                        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++)
                                bnx2x_init_vn_minmax(bp, vn);
                /* always enable rate shaping and fairness */
@@ -2473,16 +2479,15 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
 static inline void bnx2x_link_sync_notify(struct bnx2x *bp)
 {
-        int port = BP_PORT(bp);
        int func;
        int vn;
        /* Set the attention towards other drivers on the same port */
-        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++) {
-                if (vn == BP_E1HVN(bp))
+                if (vn == BP_VN(bp))
                        continue;
-                func = ((vn << 1) | port);
+                func = func_by_vn(bp, vn);
                REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_0 +
                       (LINK_SYNC_ATTENTION_BIT_FUNC_0 + func)*4, 1);
        }
@@ -2577,7 +2582,7 @@ static void bnx2x_pmf_update(struct bnx2x *bp)
        bnx2x_dcbx_pmf_update(bp);
        /* enable nig attention */
-        val = (0xff0f | (1 << (BP_E1HVN(bp) + 4)));
+        val = (0xff0f | (1 << (BP_VN(bp) + 4)));
        if (bp->common.int_block == INT_BLOCK_HC) {
                REG_WR(bp, HC_REG_TRAILING_EDGE_0 + port*8, val);
                REG_WR(bp, HC_REG_LEADING_EDGE_0 + port*8, val);
@@ -2756,8 +2761,14 @@ static void bnx2x_pf_rx_q_prep(struct bnx2x *bp,
        u16 tpa_agg_size = 0;
        if (!fp->disable_tpa) {
-                pause->sge_th_hi = 250;
+                pause->sge_th_lo = SGE_TH_LO(bp);
-                pause->sge_th_lo = 150;
+                pause->sge_th_hi = SGE_TH_HI(bp);
+                /* validate SGE ring has enough to cross high threshold */
+                WARN_ON(bp->dropless_fc &&
+                                pause->sge_th_hi + FW_PREFETCH_CNT >
+                                MAX_RX_SGE_CNT * NUM_RX_SGE_PAGES);
                tpa_agg_size = min_t(u32,
                        (min_t(u32, 8, MAX_SKB_FRAGS) *
                        SGE_PAGE_SIZE * PAGES_PER_SGE), 0xffff);
@@ -2771,10 +2782,21 @@ static void bnx2x_pf_rx_q_prep(struct bnx2x *bp,
        /* pause - not for e1 */
        if (!CHIP_IS_E1(bp)) {
-                pause->bd_th_hi = 350;
+                pause->bd_th_lo = BD_TH_LO(bp);
-                pause->bd_th_lo = 250;
+                pause->bd_th_hi = BD_TH_HI(bp);
-                pause->rcq_th_hi = 350;
-                pause->rcq_th_lo = 250;
+                pause->rcq_th_lo = RCQ_TH_LO(bp);
+                pause->rcq_th_hi = RCQ_TH_HI(bp);
+                /*
+                 * validate that rings have enough entries to cross
+                 * high thresholds
+                 */
+                WARN_ON(bp->dropless_fc &&
+                                pause->bd_th_hi + FW_PREFETCH_CNT >
+                                bp->rx_ring_size);
+                WARN_ON(bp->dropless_fc &&
+                                pause->rcq_th_hi + FW_PREFETCH_CNT >
+                                NUM_RCQ_RINGS * MAX_RCQ_DESC_CNT);
                pause->pri_map = 1;
        }
@@ -2802,9 +2824,7 @@ static void bnx2x_pf_rx_q_prep(struct bnx2x *bp,
         * For PF Clients it should be the maximum avaliable number.
         * VF driver(s) may want to define it to a smaller value.
         */
-        rxq_init->max_tpa_queues =
+        rxq_init->max_tpa_queues = MAX_AGG_QS(bp);
-                (CHIP_IS_E1(bp) ? ETH_MAX_AGGREGATION_QUEUES_E1 :
-                ETH_MAX_AGGREGATION_QUEUES_E1H_E2);
        rxq_init->cache_line_log = BNX2X_RX_ALIGN_SHIFT;
        rxq_init->fw_sb_id = fp->fw_sb_id;
@@ -4808,6 +4828,37 @@ void bnx2x_setup_ndsb_state_machine(struct hc_status_block_sm *hc_sm,
        hc_sm->time_to_expire = 0xFFFFFFFF;
 }
+/* allocates state machine ids. */
+static inline
+void bnx2x_map_sb_state_machines(struct hc_index_data *index_data)
+{
+        /* zero out state machine indices */
+        /* rx indices */
+        index_data[HC_INDEX_ETH_RX_CQ_CONS].flags &= ~HC_INDEX_DATA_SM_ID;
+        /* tx indices */
+        index_data[HC_INDEX_OOO_TX_CQ_CONS].flags &= ~HC_INDEX_DATA_SM_ID;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS0].flags &= ~HC_INDEX_DATA_SM_ID;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS1].flags &= ~HC_INDEX_DATA_SM_ID;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS2].flags &= ~HC_INDEX_DATA_SM_ID;
+        /* map indices */
+        /* rx indices */
+        index_data[HC_INDEX_ETH_RX_CQ_CONS].flags |=
+                SM_RX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        /* tx indices */
+        index_data[HC_INDEX_OOO_TX_CQ_CONS].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS0].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS1].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS2].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+}
 static void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
                          u8 vf_valid, int fw_sb_id, int igu_sb_id)
 {
@@ -4839,6 +4890,7 @@ static void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
                hc_sm_p = sb_data_e2.common.state_machine;
                sb_data_p = (u32 *)&sb_data_e2;
                data_size = sizeof(struct hc_status_block_data_e2)/sizeof(u32);
+                bnx2x_map_sb_state_machines(sb_data_e2.index_data);
        } else {
                memset(&sb_data_e1x, 0,
                       sizeof(struct hc_status_block_data_e1x));
@@ -4853,6 +4905,7 @@ static void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
                hc_sm_p = sb_data_e1x.common.state_machine;
                sb_data_p = (u32 *)&sb_data_e1x;
                data_size = sizeof(struct hc_status_block_data_e1x)/sizeof(u32);
+                bnx2x_map_sb_state_machines(sb_data_e1x.index_data);
        }
        bnx2x_setup_ndsb_state_machine(&hc_sm_p[SM_RX_ID],
@@ -5802,7 +5855,7 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
         * take the UNDI lock to protect undi_unload flow from accessing
         * registers while we're resetting the chip
         */
-        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
        bnx2x_reset_common(bp);
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET, 0xffffffff);
@@ -5814,7 +5867,7 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
        }
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET, val);
-        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
        bnx2x_init_block(bp, BLOCK_MISC, PHASE_COMMON);
@@ -6671,12 +6724,16 @@ static int bnx2x_init_hw_func(struct bnx2x *bp)
                        if (CHIP_MODE_IS_4_PORT(bp))
                                dsb_idx = BP_FUNC(bp);
                        else
-                                dsb_idx = BP_E1HVN(bp);
+                                dsb_idx = BP_VN(bp);
                        prod_offset = (CHIP_INT_MODE_IS_BC(bp) ?
                                       IGU_BC_BASE_DSB_PROD + dsb_idx :
                                       IGU_NORM_BASE_DSB_PROD + dsb_idx);
+                        /*
+                         * igu prods come in chunks of E1HVN_MAX (4) -
+                         * does not matters what is the current chip mode
+                         */
                        for (i = 0; i < (num_segs * E1HVN_MAX);
                             i += E1HVN_MAX) {
                                addr = IGU_REG_PROD_CONS_MEMORY +
@@ -7570,7 +7627,7 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                u32 val;
                /* The mac address is written to entries 1-4 to
                   preserve entry 0 which is used by the PMF */
-                u8 entry = (BP_E1HVN(bp) + 1)*8;
+                u8 entry = (BP_VN(bp) + 1)*8;
                val = (mac_addr[0] << 8) | mac_addr[1];
                EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry, val);
@@ -8546,10 +8603,12 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
        /* Check if there is any driver already loaded */
        val = REG_RD(bp, MISC_REG_UNPREPARED);
        if (val == 0x1) {
-                /* Check if it is the UNDI driver
+                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
+                /*
+                 * Check if it is the UNDI driver
                 * UNDI driver initializes CID offset for normal bell to 0x7
                 */
-                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
                val = REG_RD(bp, DORQ_REG_NORM_CID_OFST);
                if (val == 0x7) {
                        u32 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
@@ -8587,9 +8646,6 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                                bnx2x_fw_command(bp, reset_code, 0);
                        }
-                        /* now it's safe to release the lock */
-                        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
                        bnx2x_undi_int_disable(bp);
                        port = BP_PORT(bp);
@@ -8639,8 +8695,10 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                        bp->fw_seq =
                              (SHMEM_RD(bp, func_mb[bp->pf_num].drv_mb_header) &
                                DRV_MSG_SEQ_NUMBER_MASK);
-                } else
+                }
-                        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+                /* now it's safe to release the lock */
+                bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
        }
 }
@@ -8777,13 +8835,13 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
 static void __devinit bnx2x_get_igu_cam_info(struct bnx2x *bp)
 {
        int pfid = BP_FUNC(bp);
-        int vn = BP_E1HVN(bp);
        int igu_sb_id;
        u32 val;
        u8 fid, igu_sb_cnt = 0;
        bp->igu_base_sb = 0xff;
        if (CHIP_INT_MODE_IS_BC(bp)) {
+                int vn = BP_VN(bp);
                igu_sb_cnt = bp->igu_sb_cnt;
                bp->igu_base_sb = (CHIP_MODE_IS_4_PORT(bp) ? pfid : vn) *
                        FP_SB_MAX_E1x;
@@ -9416,6 +9474,10 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
                bp->igu_base_sb = 0;
        } else {
                bp->common.int_block = INT_BLOCK_IGU;
+                /* do not allow device reset during IGU info preocessing */
+                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
                val = REG_RD(bp, IGU_REG_BLOCK_CONFIGURATION);
                if (val & IGU_BLOCK_CONFIGURATION_REG_BACKWARD_COMP_EN) {
@@ -9447,6 +9509,7 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
                bnx2x_get_igu_cam_info(bp);
+                bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
        }
        /*
@@ -9473,7 +9536,7 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
        bp->mf_ov = 0;
        bp->mf_mode = 0;
-        vn = BP_E1HVN(bp);
+        vn = BP_VN(bp);
        if (!CHIP_IS_E1(bp) && !BP_NOMCP(bp)) {
                BNX2X_DEV_INFO("shmem2base 0x%x, size %d, mfcfg offset %d\n",
@@ -9593,13 +9656,6 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
        /* port info */
        bnx2x_get_port_hwinfo(bp);
-        if (!BP_NOMCP(bp)) {
-                bp->fw_seq =
-                        (SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
-                         DRV_MSG_SEQ_NUMBER_MASK);
-                BNX2X_DEV_INFO("fw_seq 0x%08x\n", bp->fw_seq);
-        }
        /* Get MAC addresses */
        bnx2x_get_mac_hwinfo(bp);
@@ -9765,6 +9821,14 @@ static int __devinit bnx2x_init_bp(struct bnx2x *bp)
        if (!BP_NOMCP(bp))
                bnx2x_undi_unload(bp);
+        /* init fw_seq after undi_unload! */
+        if (!BP_NOMCP(bp)) {
+                bp->fw_seq =
+                        (SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
+                         DRV_MSG_SEQ_NUMBER_MASK);
+                BNX2X_DEV_INFO("fw_seq 0x%08x\n", bp->fw_seq);
+        }
        if (CHIP_REV_IS_FPGA(bp))
                dev_err(&bp->pdev->dev, "FPGA detected\n");
@@ -10259,17 +10323,21 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
        /* clean indirect addresses */
        pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
                               PCICFG_VENDOR_ID_OFFSET);
-        /* Clean the following indirect addresses for all functions since it
+        /*
+         * Clean the following indirect addresses for all functions since it
         * is not used by the driver.
         */
        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F0, 0);
        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F0, 0);
        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F0, 0);
        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F0, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F1, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F1, 0);
+        if (CHIP_IS_E1x(bp)) {
-        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_88_F1, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_90_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_94_F1, 0);
+        }
        /*
         * Enable internal target-read (in case we are probed after PF FLR).
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 40266c14e6dc..750e8445dac4 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -5320,7 +5320,7 @@
 #define XCM_REG_XX_OVFL_EVNT_ID                                  0x20058
 #define XMAC_CLEAR_RX_LSS_STATUS_REG_CLEAR_LOCAL_FAULT_STATUS    (0x1<<0)
 #define XMAC_CLEAR_RX_LSS_STATUS_REG_CLEAR_REMOTE_FAULT_STATUS   (0x1<<1)
-#define XMAC_CTRL_REG_CORE_LOCAL_LPBK                            (0x1<<3)
+#define XMAC_CTRL_REG_LINE_LOCAL_LPBK                            (0x1<<2)
 #define XMAC_CTRL_REG_RX_EN                                      (0x1<<1)
 #define XMAC_CTRL_REG_SOFT_RESET                                 (0x1<<6)
 #define XMAC_CTRL_REG_TX_EN                                      (0x1<<0)
@@ -5766,7 +5766,7 @@
 #define HW_LOCK_RESOURCE_RECOVERY_LEADER_0                       8
 #define HW_LOCK_RESOURCE_RECOVERY_LEADER_1                       9
 #define HW_LOCK_RESOURCE_SPIO                                    2
-#define HW_LOCK_RESOURCE_UNDI                                    5
+#define HW_LOCK_RESOURCE_RESET                                   5
 #define AEU_INPUTS_ATTN_BITS_ATC_HW_INTERRUPT                    (0x1<<4)
 #define AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR                    (0x1<<5)
 #define AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR                    (0x1<<18)
@@ -6853,6 +6853,9 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_WC_REG_IEEE0BLK_AUTONEGNP                  0x7
 #define MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT0       0x10
 #define MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT1       0x11
+#define MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT2       0x12
+#define MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_ABILITY     0x4000
+#define MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_REQ         0x8000
 #define MDIO_WC_REG_PMD_IEEE9BLK_TENGBASE_KR_PMD_CONTROL_REGISTER_150  0x96
 #define MDIO_WC_REG_XGXSBLK0_XGXSCONTROL                0x8000
 #define MDIO_WC_REG_XGXSBLK0_MISCCONTROL1               0x800e
diff --git a/drivers/net/bnx2x/bnx2x_stats.c b/drivers/net/bnx2x/bnx2x_stats.c
index 771f6803b238..9908f2bbcf73 100644
--- a/drivers/net/bnx2x/bnx2x_stats.c
+++ b/drivers/net/bnx2x/bnx2x_stats.c
@@ -710,7 +710,8 @@ static int bnx2x_hw_stats_update(struct bnx2x *bp)
                break;
        case MAC_TYPE_NONE: /* unreached */
-                BNX2X_ERR("stats updated by DMAE but no MAC active\n");
+                DP(BNX2X_MSG_STATS,
+                   "stats updated by DMAE but no MAC active\n");
                return -1;
        default: /* unreached */
@@ -1391,7 +1392,7 @@ static void bnx2x_port_stats_base_init(struct bnx2x *bp)
 static void bnx2x_func_stats_base_init(struct bnx2x *bp)
 {
-        int vn, vn_max = IS_MF(bp) ? E1HVN_MAX : E1VN_MAX;
+        int vn, vn_max = IS_MF(bp) ? BP_MAX_VN_NUM(bp) : E1VN_MAX;
        u32 func_stx;
        /* sanity */
@@ -1404,7 +1405,7 @@ static void bnx2x_func_stats_base_init(struct bnx2x *bp)
        func_stx = bp->func_stx;
        for (vn = VN_0; vn < vn_max; vn++) {
-                int mb_idx = CHIP_IS_E1x(bp) ? 2*vn + BP_PORT(bp) : vn;
+                int mb_idx = BP_FW_MB_IDX_VN(bp, vn);
                bp->func_stx = SHMEM_RD(bp, func_mb[mb_idx].fw_mb_param);
                bnx2x_func_stats_init(bp);
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index f7bbde9eb2cb..2adc294f512a 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -46,6 +46,7 @@
 #include <linux/skbuff.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/io.h>
 #include <linux/can/dev.h>
 #include <linux/can/error.h>
@@ -503,9 +504,9 @@ static netdev_tx_t ti_hecc_xmit(struct sk_buff *skb, struct net_device *ndev)
        spin_unlock_irqrestore(&priv->mbx_lock, flags);
        /* Prepare mailbox for transmission */
+        data = cf->can_dlc | (get_tx_head_prio(priv) << 8);
        if (cf->can_id & CAN_RTR_FLAG) /* Remote transmission request */
                data |= HECC_CANMCF_RTR;
-        data |= get_tx_head_prio(priv) << 8;
        hecc_write_mbx(priv, mbxno, HECC_CANMCF, data);
        if (cf->can_id & CAN_EFF_FLAG) /* Extended frame format */
@@ -923,6 +924,7 @@ static int ti_hecc_probe(struct platform_device *pdev)
        priv->can.do_get_state = ti_hecc_get_state;
        priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES;
+        spin_lock_init(&priv->mbx_lock);
        ndev->irq = irq->start;
        ndev->flags |= IFF_ECHO;
        platform_set_drvdata(pdev, ndev);
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 646c86bcc545..fdb7a1756409 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -2452,14 +2452,13 @@ static irqreturn_t cas_interruptN(int irq, void *dev_id)
        struct net_device *dev = dev_id;
        struct cas *cp = netdev_priv(dev);
        unsigned long flags;
-        int ring;
+        int ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
        u32 status = readl(cp->regs + REG_PLUS_INTRN_STATUS(ring));
        /* check for shared irq */
        if (status == 0)
                return IRQ_NONE;
-        ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
        spin_lock_irqsave(&cp->lock, flags);
        if (status & INTR_RX_DONE_ALT) { /* handle rx separately */
 #ifdef USE_NAPI
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 8545c7aa93eb..a5a89ecb6f36 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -4026,6 +4026,12 @@ s32 e1000_validate_eeprom_checksum(struct e1000_hw *hw)
                checksum += eeprom_data;
        }
+#ifdef CONFIG_PARISC
+        /* This is a signature and not a checksum on HP c8000 */
+        if ((hw->subsystem_vendor_id == 0x103C) && (eeprom_data == 0x16d6))
+                return E1000_SUCCESS;
+#endif
        if (checksum == (u16) EEPROM_SUM)
                return E1000_SUCCESS;
        else {
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 25a8c2adb001..0caf3c323ec0 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -1669,10 +1669,10 @@ static int gfar_get_cls_all(struct gfar_private *priv,
        u32 i = 0;
        list_for_each_entry(comp, &priv->rx_list.list, list) {
-                if (i <= cmd->rule_cnt) {
+                if (i == cmd->rule_cnt)
-                        rule_locs[i] = comp->fs.location;
+                        return -EMSGSIZE;
-                        i++;
+                rule_locs[i] = comp->fs.location;
-                }
+                i++;
        }
        cmd->data = MAX_FILER_IDX;
diff --git a/drivers/net/greth.c b/drivers/net/greth.c
index 16ce45c11934..52a39000c42c 100644
--- a/drivers/net/greth.c
+++ b/drivers/net/greth.c
@@ -428,6 +428,7 @@ greth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dma_sync_single_for_device(greth->dev, dma_addr, skb->len, DMA_TO_DEVICE);
        status = GRETH_BD_EN | GRETH_BD_IE | (skb->len & GRETH_BD_LEN);
+        greth->tx_bufs_length[greth->tx_next] = skb->len & GRETH_BD_LEN;
        /* Wrap around descriptor ring */
        if (greth->tx_next == GRETH_TXBD_NUM_MASK) {
@@ -490,7 +491,8 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
        if (nr_frags != 0)
                status = GRETH_TXBD_MORE;
-        status |= GRETH_TXBD_CSALL;
+        if (skb->ip_summed == CHECKSUM_PARTIAL)
+                status |= GRETH_TXBD_CSALL;
        status |= skb_headlen(skb) & GRETH_BD_LEN;
        if (greth->tx_next == GRETH_TXBD_NUM_MASK)
                status |= GRETH_BD_WR;
@@ -513,7 +515,9 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
                greth->tx_skbuff[curr_tx] = NULL;
                bdp = greth->tx_bd_base + curr_tx;
-                status = GRETH_TXBD_CSALL | GRETH_BD_EN;
+                status = GRETH_BD_EN;
+                if (skb->ip_summed == CHECKSUM_PARTIAL)
+                        status |= GRETH_TXBD_CSALL;
                status |= frag->size & GRETH_BD_LEN;
                /* Wrap around descriptor ring */
@@ -641,6 +645,7 @@ static void greth_clean_tx(struct net_device *dev)
                                dev->stats.tx_fifo_errors++;
                }
                dev->stats.tx_packets++;
+                dev->stats.tx_bytes += greth->tx_bufs_length[greth->tx_last];
                greth->tx_last = NEXT_TX(greth->tx_last);
                greth->tx_free++;
        }
@@ -695,6 +700,7 @@ static void greth_clean_tx_gbit(struct net_device *dev)
                greth->tx_skbuff[greth->tx_last] = NULL;
                greth_update_tx_stats(dev, stat);
+                dev->stats.tx_bytes += skb->len;
                bdp = greth->tx_bd_base + greth->tx_last;
@@ -796,6 +802,7 @@ static int greth_rx(struct net_device *dev, int limit)
                                memcpy(skb_put(skb, pkt_len), phys_to_virt(dma_addr), pkt_len);
                                skb->protocol = eth_type_trans(skb, dev);
+                                dev->stats.rx_bytes += pkt_len;
                                dev->stats.rx_packets++;
                                netif_receive_skb(skb);
                        }
@@ -910,6 +917,7 @@ static int greth_rx_gbit(struct net_device *dev, int limit)
                                skb->protocol = eth_type_trans(skb, dev);
                                dev->stats.rx_packets++;
+                                dev->stats.rx_bytes += pkt_len;
                                netif_receive_skb(skb);
                                greth->rx_skbuff[greth->rx_cur] = newskb;
diff --git a/drivers/net/greth.h b/drivers/net/greth.h
index 9a0040dee4da..232a622a85b7 100644
--- a/drivers/net/greth.h
+++ b/drivers/net/greth.h
@@ -103,6 +103,7 @@ struct greth_private {
        unsigned char *tx_bufs[GRETH_TXBD_NUM];
        unsigned char *rx_bufs[GRETH_RXBD_NUM];
+        u16 tx_bufs_length[GRETH_TXBD_NUM];
        u16 tx_next;
        u16 tx_last;
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index ba99af05bf62..8dd5fccef725 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -395,7 +395,7 @@ static inline struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *ada
 }
 /* recycle the current buffer on the rx queue */
-static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
+static int ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
 {
        u32 q_index = adapter->rx_queue.index;
        u64 correlator = adapter->rx_queue.queue_addr[q_index].correlator;
@@ -403,6 +403,7 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
        unsigned int index = correlator & 0xffffffffUL;
        union ibmveth_buf_desc desc;
        unsigned long lpar_rc;
+        int ret = 1;
        BUG_ON(pool >= IBMVETH_NUM_BUFF_POOLS);
        BUG_ON(index >= adapter->rx_buff_pool[pool].size);
@@ -410,7 +411,7 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
        if (!adapter->rx_buff_pool[pool].active) {
                ibmveth_rxq_harvest_buffer(adapter);
                ibmveth_free_buffer_pool(adapter, &adapter->rx_buff_pool[pool]);
-                return;
+                goto out;
        }
        desc.fields.flags_len = IBMVETH_BUF_VALID |
@@ -423,12 +424,16 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
                netdev_dbg(adapter->netdev, "h_add_logical_lan_buffer failed "
                           "during recycle rc=%ld", lpar_rc);
                ibmveth_remove_buffer_from_pool(adapter, adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator);
+                ret = 0;
        }
        if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) {
                adapter->rx_queue.index = 0;
                adapter->rx_queue.toggle = !adapter->rx_queue.toggle;
        }
+out:
+        return ret;
 }
 static void ibmveth_rxq_harvest_buffer(struct ibmveth_adapter *adapter)
@@ -752,7 +757,7 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
        struct ibmveth_adapter *adapter = netdev_priv(dev);
        unsigned long set_attr, clr_attr, ret_attr;
        unsigned long set_attr6, clr_attr6;
-        long ret, ret6;
+        long ret, ret4, ret6;
        int rc1 = 0, rc2 = 0;
        int restart = 0;
@@ -765,6 +770,8 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
        set_attr = 0;
        clr_attr = 0;
+        set_attr6 = 0;
+        clr_attr6 = 0;
        if (data) {
                set_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;
@@ -779,16 +786,20 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
        if (ret == H_SUCCESS && !(ret_attr & IBMVETH_ILLAN_ACTIVE_TRUNK) &&
            !(ret_attr & IBMVETH_ILLAN_TRUNK_PRI_MASK) &&
            (ret_attr & IBMVETH_ILLAN_PADDED_PKT_CSUM)) {
-                ret = h_illan_attributes(adapter->vdev->unit_address, clr_attr,
+                ret4 = h_illan_attributes(adapter->vdev->unit_address, clr_attr,
                                         set_attr, &ret_attr);
-                if (ret != H_SUCCESS) {
+                if (ret4 != H_SUCCESS) {
                        netdev_err(dev, "unable to change IPv4 checksum "
                                        "offload settings. %d rc=%ld\n",
-                                        data, ret);
+                                        data, ret4);
+                        h_illan_attributes(adapter->vdev->unit_address,
+                                           set_attr, clr_attr, &ret_attr);
+                        if (data == 1)
+                                dev->features &= ~NETIF_F_IP_CSUM;
-                        ret = h_illan_attributes(adapter->vdev->unit_address,
-                                                 set_attr, clr_attr, &ret_attr);
                } else {
                        adapter->fw_ipv4_csum_support = data;
                }
@@ -799,15 +810,18 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
                if (ret6 != H_SUCCESS) {
                        netdev_err(dev, "unable to change IPv6 checksum "
                                        "offload settings. %d rc=%ld\n",
-                                        data, ret);
+                                        data, ret6);
+                        h_illan_attributes(adapter->vdev->unit_address,
+                                           set_attr6, clr_attr6, &ret_attr);
+                        if (data == 1)
+                                dev->features &= ~NETIF_F_IPV6_CSUM;
-                        ret = h_illan_attributes(adapter->vdev->unit_address,
-                                                 set_attr6, clr_attr6,
-                                                 &ret_attr);
                } else
                        adapter->fw_ipv6_csum_support = data;
-                if (ret != H_SUCCESS || ret6 != H_SUCCESS)
+                if (ret4 == H_SUCCESS || ret6 == H_SUCCESS)
                        adapter->rx_csum = data;
                else
                        rc1 = -EIO;
@@ -925,6 +939,7 @@ static netdev_tx_t ibmveth_start_xmit(struct sk_buff *skb,
        union ibmveth_buf_desc descs[6];
        int last, i;
        int force_bounce = 0;
+        dma_addr_t dma_addr;
        /*
         * veth handles a maximum of 6 segments including the header, so
@@ -989,17 +1004,16 @@ retry_bounce:
        }
        /* Map the header */
-        descs[0].fields.address = dma_map_single(&adapter->vdev->dev, skb->data,
+        dma_addr = dma_map_single(&adapter->vdev->dev, skb->data,
-                                                 skb_headlen(skb),
+                                  skb_headlen(skb), DMA_TO_DEVICE);
-                                                 DMA_TO_DEVICE);
+        if (dma_mapping_error(&adapter->vdev->dev, dma_addr))
-        if (dma_mapping_error(&adapter->vdev->dev, descs[0].fields.address))
                goto map_failed;
        descs[0].fields.flags_len = desc_flags | skb_headlen(skb);
+        descs[0].fields.address = dma_addr;
        /* Map the frags */
        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                unsigned long dma_addr;
                skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
                dma_addr = dma_map_page(&adapter->vdev->dev, frag->page,
@@ -1021,7 +1035,12 @@ retry_bounce:
                netdev->stats.tx_bytes += skb->len;
        }
-        for (i = 0; i < skb_shinfo(skb)->nr_frags + 1; i++)
+        dma_unmap_single(&adapter->vdev->dev,
+                         descs[0].fields.address,
+                         descs[0].fields.flags_len & IBMVETH_BUF_LEN_MASK,
+                         DMA_TO_DEVICE);
+        for (i = 1; i < skb_shinfo(skb)->nr_frags + 1; i++)
                dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
                               descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
                               DMA_TO_DEVICE);
@@ -1084,8 +1103,9 @@ restart_poll:
                                if (rx_flush)
                                        ibmveth_flush_buffer(skb->data,
                                                length + offset);
+                                if (!ibmveth_rxq_recycle_buffer(adapter))
+                                        kfree_skb(skb);
                                skb = new_skb;
-                                ibmveth_rxq_recycle_buffer(adapter);
                        } else {
                                ibmveth_rxq_harvest_buffer(adapter);
                                skb_reserve(skb, offset);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 22790394318a..e1fcc9589278 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1321,8 +1321,8 @@ static void ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                if (ring_is_rsc_enabled(rx_ring))
                        pkt_is_rsc = ixgbe_get_rsc_state(rx_desc);
-                /* if this is a skb from previous receive DMA will be 0 */
+                /* linear means we are building an skb from multiple pages */
-                if (rx_buffer_info->dma) {
+                if (!skb_is_nonlinear(skb)) {
                        u16 hlen;
                        if (pkt_is_rsc &&
                            !(staterr & IXGBE_RXD_STAT_EOP) &&
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index dfc82720065a..ed2a3977c6e7 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -799,5 +799,11 @@ static void __exit cleanup_netconsole(void)
        }
 }
-module_init(init_netconsole);
+/*
+ * Use late_initcall to ensure netconsole is
+ * initialized after network device driver if built-in.
+ *
+ * late_initcall() and module_init() are identical if built as module.
+ */
+late_initcall(init_netconsole);
 module_exit(cleanup_netconsole);
diff --git a/drivers/net/pch_gbe/pch_gbe.h b/drivers/net/pch_gbe/pch_gbe.h
index 59fac77d0dbb..a09a07197eb5 100644
--- a/drivers/net/pch_gbe/pch_gbe.h
+++ b/drivers/net/pch_gbe/pch_gbe.h
@@ -127,8 +127,8 @@ struct pch_gbe_regs {
 /* Reset */
 #define PCH_GBE_ALL_RST         0x80000000  /* All reset */
-#define PCH_GBE_TX_RST          0x40000000  /* TX MAC, TX FIFO, TX DMA reset */
+#define PCH_GBE_TX_RST          0x00008000  /* TX MAC, TX FIFO, TX DMA reset */
-#define PCH_GBE_RX_RST          0x04000000  /* RX MAC, RX FIFO, RX DMA reset */
+#define PCH_GBE_RX_RST          0x00004000  /* RX MAC, RX FIFO, RX DMA reset */
 /* TCP/IP Accelerator Control */
 #define PCH_GBE_EX_LIST_EN      0x00000008  /* External List Enable */
@@ -276,6 +276,9 @@ struct pch_gbe_regs {
 #define PCH_GBE_RX_DMA_EN       0x00000002   /* Enables Receive DMA */
 #define PCH_GBE_TX_DMA_EN       0x00000001   /* Enables Transmission DMA */
+/* RX DMA STATUS */
+#define PCH_GBE_IDLE_CHECK       0xFFFFFFFE
 /* Wake On LAN Status */
 #define PCH_GBE_WLS_BR          0x00000008 /* Broadcas Address */
 #define PCH_GBE_WLS_MLT         0x00000004 /* Multicast Address */
@@ -471,6 +474,7 @@ struct pch_gbe_tx_desc {
 struct pch_gbe_buffer {
        struct sk_buff *skb;
        dma_addr_t dma;
+        unsigned char *rx_buffer;
        unsigned long time_stamp;
        u16 length;
        bool mapped;
@@ -511,6 +515,9 @@ struct pch_gbe_tx_ring {
 struct pch_gbe_rx_ring {
        struct pch_gbe_rx_desc *desc;
        dma_addr_t dma;
+        unsigned char *rx_buff_pool;
+        dma_addr_t rx_buff_pool_logic;
+        unsigned int rx_buff_pool_size;
        unsigned int size;
        unsigned int count;
        unsigned int next_to_use;
@@ -622,6 +629,7 @@ struct pch_gbe_adapter {
        unsigned long rx_buffer_len;
        unsigned long tx_queue_len;
        bool have_msi;
+        bool rx_stop_flag;
 };
 extern const char pch_driver_version[];
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index eac3c5ca9731..567ff10889be 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -20,7 +20,6 @@
 #include "pch_gbe.h"
 #include "pch_gbe_api.h"
-#include <linux/prefetch.h>
 #define DRV_VERSION     "1.00"
 const char pch_driver_version[] = DRV_VERSION;
@@ -34,11 +33,15 @@ const char pch_driver_version[] = DRV_VERSION;
 #define PCH_GBE_WATCHDOG_PERIOD         (1 * HZ)        /* watchdog time */
 #define PCH_GBE_COPYBREAK_DEFAULT       256
 #define PCH_GBE_PCI_BAR                 1
+#define PCH_GBE_RESERVE_MEMORY          0x200000        /* 2MB */
 /* Macros for ML7223 */
 #define PCI_VENDOR_ID_ROHM                      0x10db
 #define PCI_DEVICE_ID_ROHM_ML7223_GBE           0x8013
+/* Macros for ML7831 */
+#define PCI_DEVICE_ID_ROHM_ML7831_GBE           0x8802
 #define PCH_GBE_TX_WEIGHT         64
 #define PCH_GBE_RX_WEIGHT         64
 #define PCH_GBE_RX_BUFFER_WRITE   16
@@ -52,6 +55,7 @@ const char pch_driver_version[] = DRV_VERSION;
        )
 /* Ethertype field values */
+#define PCH_GBE_MAX_RX_BUFFER_SIZE      0x2880
 #define PCH_GBE_MAX_JUMBO_FRAME_SIZE    10318
 #define PCH_GBE_FRAME_SIZE_2048         2048
 #define PCH_GBE_FRAME_SIZE_4096         4096
@@ -83,10 +87,12 @@ const char pch_driver_version[] = DRV_VERSION;
 #define PCH_GBE_INT_ENABLE_MASK ( \
        PCH_GBE_INT_RX_DMA_CMPLT |    \
        PCH_GBE_INT_RX_DSC_EMP   |    \
+        PCH_GBE_INT_RX_FIFO_ERR  |    \
        PCH_GBE_INT_WOL_DET      |    \
        PCH_GBE_INT_TX_CMPLT          \
        )
+#define PCH_GBE_INT_DISABLE_ALL         0
 static unsigned int copybreak __read_mostly = PCH_GBE_COPYBREAK_DEFAULT;
@@ -138,6 +144,27 @@ static void pch_gbe_wait_clr_bit(void *reg, u32 bit)
        if (!tmp)
                pr_err("Error: busy bit is not cleared\n");
 }
+/**
+ * pch_gbe_wait_clr_bit_irq - Wait to clear a bit for interrupt context
+ * @reg:        Pointer of register
+ * @busy:       Busy bit
+ */
+static int pch_gbe_wait_clr_bit_irq(void *reg, u32 bit)
+{
+        u32 tmp;
+        int ret = -1;
+        /* wait busy */
+        tmp = 20;
+        while ((ioread32(reg) & bit) && --tmp)
+                udelay(5);
+        if (!tmp)
+                pr_err("Error: busy bit is not cleared\n");
+        else
+                ret = 0;
+        return ret;
+}
 /**
 * pch_gbe_mac_mar_set - Set MAC address register
 * @hw:     Pointer to the HW structure
@@ -189,6 +216,17 @@ static void pch_gbe_mac_reset_hw(struct pch_gbe_hw *hw)
        return;
 }
+static void pch_gbe_mac_reset_rx(struct pch_gbe_hw *hw)
+{
+        /* Read the MAC address. and store to the private data */
+        pch_gbe_mac_read_mac_addr(hw);
+        iowrite32(PCH_GBE_RX_RST, &hw->reg->RESET);
+        pch_gbe_wait_clr_bit_irq(&hw->reg->RESET, PCH_GBE_RX_RST);
+        /* Setup the MAC address */
+        pch_gbe_mac_mar_set(hw, hw->mac.addr, 0);
+        return;
+}
 /**
 * pch_gbe_mac_init_rx_addrs - Initialize receive address's
 * @hw: Pointer to the HW structure
@@ -671,13 +709,8 @@ static void pch_gbe_setup_rctl(struct pch_gbe_adapter *adapter)
        tcpip = ioread32(&hw->reg->TCPIP_ACC);
-        if (netdev->features & NETIF_F_RXCSUM) {
+        tcpip |= PCH_GBE_RX_TCPIPACC_OFF;
-                tcpip &= ~PCH_GBE_RX_TCPIPACC_OFF;
+        tcpip &= ~PCH_GBE_RX_TCPIPACC_EN;
-                tcpip |= PCH_GBE_RX_TCPIPACC_EN;
-        } else {
-                tcpip |= PCH_GBE_RX_TCPIPACC_OFF;
-                tcpip &= ~PCH_GBE_RX_TCPIPACC_EN;
-        }
        iowrite32(tcpip, &hw->reg->TCPIP_ACC);
        return;
 }
@@ -717,13 +750,6 @@ static void pch_gbe_configure_rx(struct pch_gbe_adapter *adapter)
        iowrite32(rdba, &hw->reg->RX_DSC_BASE);
        iowrite32(rdlen, &hw->reg->RX_DSC_SIZE);
        iowrite32((rdba + rdlen), &hw->reg->RX_DSC_SW_P);
-        /* Enables Receive DMA */
-        rxdma = ioread32(&hw->reg->DMA_CTRL);
-        rxdma |= PCH_GBE_RX_DMA_EN;
-        iowrite32(rxdma, &hw->reg->DMA_CTRL);
-        /* Enables Receive */
-        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
 }
 /**
@@ -1097,6 +1123,48 @@ void pch_gbe_update_stats(struct pch_gbe_adapter *adapter)
        spin_unlock_irqrestore(&adapter->stats_lock, flags);
 }
+static void pch_gbe_stop_receive(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 rxdma;
+        u16 value;
+        int ret;
+        /* Disable Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma &= ~PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+        /* Wait Rx DMA BUS is IDLE */
+        ret = pch_gbe_wait_clr_bit_irq(&hw->reg->RX_DMA_ST, PCH_GBE_IDLE_CHECK);
+        if (ret) {
+                /* Disable Bus master */
+                pci_read_config_word(adapter->pdev, PCI_COMMAND, &value);
+                value &= ~PCI_COMMAND_MASTER;
+                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
+                /* Stop Receive */
+                pch_gbe_mac_reset_rx(hw);
+                /* Enable Bus master */
+                value |= PCI_COMMAND_MASTER;
+                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
+        } else {
+                /* Stop Receive */
+                pch_gbe_mac_reset_rx(hw);
+        }
+}
+static void pch_gbe_start_receive(struct pch_gbe_hw *hw)
+{
+        u32 rxdma;
+        /* Enables Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma |= PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+        /* Enables Receive */
+        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
+        return;
+}
 /**
 * pch_gbe_intr - Interrupt Handler
 * @irq:   Interrupt number
@@ -1123,7 +1191,15 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
        if (int_st & PCH_GBE_INT_RX_FRAME_ERR)
                adapter->stats.intr_rx_frame_err_count++;
        if (int_st & PCH_GBE_INT_RX_FIFO_ERR)
-                adapter->stats.intr_rx_fifo_err_count++;
+                if (!adapter->rx_stop_flag) {
+                        adapter->stats.intr_rx_fifo_err_count++;
+                        pr_debug("Rx fifo over run\n");
+                        adapter->rx_stop_flag = true;
+                        int_en = ioread32(&hw->reg->INT_EN);
+                        iowrite32((int_en & ~PCH_GBE_INT_RX_FIFO_ERR),
+                                  &hw->reg->INT_EN);
+                        pch_gbe_stop_receive(adapter);
+                }
        if (int_st & PCH_GBE_INT_RX_DMA_ERR)
                adapter->stats.intr_rx_dma_err_count++;
        if (int_st & PCH_GBE_INT_TX_FIFO_ERR)
@@ -1135,7 +1211,7 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
        /* When Rx descriptor is empty  */
        if ((int_st & PCH_GBE_INT_RX_DSC_EMP)) {
                adapter->stats.intr_rx_dsc_empty_count++;
-                pr_err("Rx descriptor is empty\n");
+                pr_debug("Rx descriptor is empty\n");
                int_en = ioread32(&hw->reg->INT_EN);
                iowrite32((int_en & ~PCH_GBE_INT_RX_DSC_EMP), &hw->reg->INT_EN);
                if (hw->mac.tx_fc_enable) {
@@ -1185,29 +1261,23 @@ pch_gbe_alloc_rx_buffers(struct pch_gbe_adapter *adapter,
        unsigned int i;
        unsigned int bufsz;
-        bufsz = adapter->rx_buffer_len + PCH_GBE_DMA_ALIGN;
+        bufsz = adapter->rx_buffer_len + NET_IP_ALIGN;
        i = rx_ring->next_to_use;
        while ((cleaned_count--)) {
                buffer_info = &rx_ring->buffer_info[i];
-                skb = buffer_info->skb;
+                skb = netdev_alloc_skb(netdev, bufsz);
-                if (skb) {
+                if (unlikely(!skb)) {
-                        skb_trim(skb, 0);
+                        /* Better luck next round */
-                } else {
+                        adapter->stats.rx_alloc_buff_failed++;
-                        skb = netdev_alloc_skb(netdev, bufsz);
+                        break;
-                        if (unlikely(!skb)) {
-                                /* Better luck next round */
-                                adapter->stats.rx_alloc_buff_failed++;
-                                break;
-                        }
-                        /* 64byte align */
-                        skb_reserve(skb, PCH_GBE_DMA_ALIGN);
-                        buffer_info->skb = skb;
-                        buffer_info->length = adapter->rx_buffer_len;
                }
+                /* align */
+                skb_reserve(skb, NET_IP_ALIGN);
+                buffer_info->skb = skb;
                buffer_info->dma = dma_map_single(&pdev->dev,
-                                                  skb->data,
+                                                  buffer_info->rx_buffer,
                                                  buffer_info->length,
                                                  DMA_FROM_DEVICE);
                if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) {
@@ -1240,6 +1310,36 @@ pch_gbe_alloc_rx_buffers(struct pch_gbe_adapter *adapter,
        return;
 }
+static int
+pch_gbe_alloc_rx_buffers_pool(struct pch_gbe_adapter *adapter,
+                         struct pch_gbe_rx_ring *rx_ring, int cleaned_count)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_buffer *buffer_info;
+        unsigned int i;
+        unsigned int bufsz;
+        unsigned int size;
+        bufsz = adapter->rx_buffer_len;
+        size = rx_ring->count * bufsz + PCH_GBE_RESERVE_MEMORY;
+        rx_ring->rx_buff_pool = dma_alloc_coherent(&pdev->dev, size,
+                                                &rx_ring->rx_buff_pool_logic,
+                                                GFP_KERNEL);
+        if (!rx_ring->rx_buff_pool) {
+                pr_err("Unable to allocate memory for the receive poll buffer\n");
+                return -ENOMEM;
+        }
+        memset(rx_ring->rx_buff_pool, 0, size);
+        rx_ring->rx_buff_pool_size = size;
+        for (i = 0; i < rx_ring->count; i++) {
+                buffer_info = &rx_ring->buffer_info[i];
+                buffer_info->rx_buffer = rx_ring->rx_buff_pool + bufsz * i;
+                buffer_info->length = bufsz;
+        }
+        return 0;
+}
 /**
 * pch_gbe_alloc_tx_buffers - Allocate transmit buffers
 * @adapter:   Board private structure
@@ -1380,7 +1480,7 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
        unsigned int i;
        unsigned int cleaned_count = 0;
        bool cleaned = false;
-        struct sk_buff *skb, *new_skb;
+        struct sk_buff *skb;
        u8 dma_status;
        u16 gbec_status;
        u32 tcp_ip_status;
@@ -1401,13 +1501,12 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
                rx_desc->gbec_status = DSC_INIT16;
                buffer_info = &rx_ring->buffer_info[i];
                skb = buffer_info->skb;
+                buffer_info->skb = NULL;
                /* unmap dma */
                dma_unmap_single(&pdev->dev, buffer_info->dma,
                                   buffer_info->length, DMA_FROM_DEVICE);
                buffer_info->mapped = false;
-                /* Prefetch the packet */
-                prefetch(skb->data);
                pr_debug("RxDecNo = 0x%04x  Status[DMA:0x%02x GBE:0x%04x "
                         "TCP:0x%08x]  BufInf = 0x%p\n",
@@ -1427,70 +1526,16 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
                        pr_err("Receive CRC Error\n");
                } else {
                        /* get receive length */
-                        /* length convert[-3] */
+                        /* length convert[-3], length includes FCS length */
-                        length = (rx_desc->rx_words_eob) - 3;
+                        length = (rx_desc->rx_words_eob) - 3 - ETH_FCS_LEN;
+                        if (rx_desc->rx_words_eob & 0x02)
-                        /* Decide the data conversion method */
+                                length = length - 4;
-                        if (!(netdev->features & NETIF_F_RXCSUM)) {
+                        /*
-                                /* [Header:14][payload] */
+                         * buffer_info->rx_buffer: [Header:14][payload]
-                                if (NET_IP_ALIGN) {
+                         * skb->data: [Reserve:2][Header:14][payload]
-                                        /* Because alignment differs,
+                         */
-                                         * the new_skb is newly allocated,
+                        memcpy(skb->data, buffer_info->rx_buffer, length);
-                                         * and data is copied to new_skb.*/
-                                        new_skb = netdev_alloc_skb(netdev,
-                                                         length + NET_IP_ALIGN);
-                                        if (!new_skb) {
-                                                /* dorrop error */
-                                                pr_err("New skb allocation "
-                                                        "Error\n");
-                                                goto dorrop;
-                                        }
-                                        skb_reserve(new_skb, NET_IP_ALIGN);
-                                        memcpy(new_skb->data, skb->data,
-                                               length);
-                                        skb = new_skb;
-                                } else {
-                                        /* DMA buffer is used as SKB as it is.*/
-                                        buffer_info->skb = NULL;
-                                }
-                        } else {
-                                /* [Header:14][padding:2][payload] */
-                                /* The length includes padding length */
-                                length = length - PCH_GBE_DMA_PADDING;
-                                if ((length < copybreak) ||
-                                    (NET_IP_ALIGN != PCH_GBE_DMA_PADDING)) {
-                                        /* Because alignment differs,
-                                         * the new_skb is newly allocated,
-                                         * and data is copied to new_skb.
-                                         * Padding data is deleted
-                                         * at the time of a copy.*/
-                                        new_skb = netdev_alloc_skb(netdev,
-                                                         length + NET_IP_ALIGN);
-                                        if (!new_skb) {
-                                                /* dorrop error */
-                                                pr_err("New skb allocation "
-                                                        "Error\n");
-                                                goto dorrop;
-                                        }
-                                        skb_reserve(new_skb, NET_IP_ALIGN);
-                                        memcpy(new_skb->data, skb->data,
-                                               ETH_HLEN);
-                                        memcpy(&new_skb->data[ETH_HLEN],
-                                               &skb->data[ETH_HLEN +
-                                               PCH_GBE_DMA_PADDING],
-                                               length - ETH_HLEN);
-                                        skb = new_skb;
-                                } else {
-                                        /* Padding data is deleted
-                                         * by moving header data.*/
-                                        memmove(&skb->data[PCH_GBE_DMA_PADDING],
-                                                &skb->data[0], ETH_HLEN);
-                                        skb_reserve(skb, NET_IP_ALIGN);
-                                        buffer_info->skb = NULL;
-                                }
-                        }
-                        /* The length includes FCS length */
-                        length = length - ETH_FCS_LEN;
                        /* update status of driver */
                        adapter->stats.rx_bytes += length;
                        adapter->stats.rx_packets++;
@@ -1509,7 +1554,6 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
                        pr_debug("Receive skb->ip_summed: %d length: %d\n",
                                 skb->ip_summed, length);
                }
-dorrop:
                /* return some buffers to hardware, one at a time is too slow */
                if (unlikely(cleaned_count >= PCH_GBE_RX_BUFFER_WRITE)) {
                        pch_gbe_alloc_rx_buffers(adapter, rx_ring,
@@ -1714,9 +1758,15 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
                pr_err("Error: can't bring device up\n");
                return err;
        }
+        err = pch_gbe_alloc_rx_buffers_pool(adapter, rx_ring, rx_ring->count);
+        if (err) {
+                pr_err("Error: can't bring device up\n");
+                return err;
+        }
        pch_gbe_alloc_tx_buffers(adapter, tx_ring);
        pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);
        adapter->tx_queue_len = netdev->tx_queue_len;
+        pch_gbe_start_receive(&adapter->hw);
        mod_timer(&adapter->watchdog_timer, jiffies);
@@ -1734,6 +1784,7 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
 void pch_gbe_down(struct pch_gbe_adapter *adapter)
 {
        struct net_device *netdev = adapter->netdev;
+        struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
        /* signal that we're down so the interrupt handler does not
         * reschedule our watchdog timer */
@@ -1752,6 +1803,12 @@ void pch_gbe_down(struct pch_gbe_adapter *adapter)
        pch_gbe_reset(adapter);
        pch_gbe_clean_tx_ring(adapter, adapter->tx_ring);
        pch_gbe_clean_rx_ring(adapter, adapter->rx_ring);
+        pci_free_consistent(adapter->pdev, rx_ring->rx_buff_pool_size,
+                            rx_ring->rx_buff_pool, rx_ring->rx_buff_pool_logic);
+        rx_ring->rx_buff_pool_logic = 0;
+        rx_ring->rx_buff_pool_size = 0;
+        rx_ring->rx_buff_pool = NULL;
 }
 /**
@@ -2004,6 +2061,8 @@ static int pch_gbe_change_mtu(struct net_device *netdev, int new_mtu)
 {
        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
        int max_frame;
+        unsigned long old_rx_buffer_len = adapter->rx_buffer_len;
+        int err;
        max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
        if ((max_frame < ETH_ZLEN + ETH_FCS_LEN) ||
@@ -2018,14 +2077,24 @@ static int pch_gbe_change_mtu(struct net_device *netdev, int new_mtu)
        else if (max_frame <= PCH_GBE_FRAME_SIZE_8192)
                adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_8192;
        else
-                adapter->rx_buffer_len = PCH_GBE_MAX_JUMBO_FRAME_SIZE;
+                adapter->rx_buffer_len = PCH_GBE_MAX_RX_BUFFER_SIZE;
-        netdev->mtu = new_mtu;
-        adapter->hw.mac.max_frame_size = max_frame;
-        if (netif_running(netdev))
+        if (netif_running(netdev)) {
-                pch_gbe_reinit_locked(adapter);
+                pch_gbe_down(adapter);
-        else
+                err = pch_gbe_up(adapter);
+                if (err) {
+                        adapter->rx_buffer_len = old_rx_buffer_len;
+                        pch_gbe_up(adapter);
+                        return -ENOMEM;
+                } else {
+                        netdev->mtu = new_mtu;
+                        adapter->hw.mac.max_frame_size = max_frame;
+                }
+        } else {
                pch_gbe_reset(adapter);
+                netdev->mtu = new_mtu;
+                adapter->hw.mac.max_frame_size = max_frame;
+        }
        pr_debug("max_frame : %d  rx_buffer_len : %d  mtu : %d  max_frame_size : %d\n",
                 max_frame, (u32) adapter->rx_buffer_len, netdev->mtu,
@@ -2103,6 +2172,7 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
        int work_done = 0;
        bool poll_end_flag = false;
        bool cleaned = false;
+        u32 int_en;
        pr_debug("budget : %d\n", budget);
@@ -2110,8 +2180,15 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
        if (!netif_carrier_ok(netdev)) {
                poll_end_flag = true;
        } else {
-                cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
                pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
+                if (adapter->rx_stop_flag) {
+                        adapter->rx_stop_flag = false;
+                        pch_gbe_start_receive(&adapter->hw);
+                        int_en = ioread32(&adapter->hw.reg->INT_EN);
+                        iowrite32((int_en | PCH_GBE_INT_RX_FIFO_ERR),
+                                        &adapter->hw.reg->INT_EN);
+                }
+                cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
                if (cleaned)
                        work_done = budget;
@@ -2452,6 +2529,13 @@ static DEFINE_PCI_DEVICE_TABLE(pch_gbe_pcidev_id) = {
         .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
         .class_mask = (0xFFFF00)
         },
+        {.vendor = PCI_VENDOR_ID_ROHM,
+         .device = PCI_DEVICE_ID_ROHM_ML7831_GBE,
+         .subvendor = PCI_ANY_ID,
+         .subdevice = PCI_ANY_ID,
+         .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
+         .class_mask = (0xFFFF00)
+         },
        /* required last entry */
        {0}
 };
diff --git a/drivers/net/phy/national.c b/drivers/net/phy/national.c
index 0620ba963508..04bb8fcc0cb5 100644
--- a/drivers/net/phy/national.c
+++ b/drivers/net/phy/national.c
@@ -25,8 +25,9 @@
 /* DP83865 phy identifier values */
 #define DP83865_PHY_ID  0x20005c7a
-#define DP83865_INT_MASK_REG 0x15
+#define DP83865_INT_STATUS      0x14
-#define DP83865_INT_MASK_STATUS 0x14
+#define DP83865_INT_MASK        0x15
+#define DP83865_INT_CLEAR       0x17
 #define DP83865_INT_REMOTE_FAULT 0x0008
 #define DP83865_INT_ANE_COMPLETED 0x0010
@@ -68,21 +69,25 @@ static int ns_config_intr(struct phy_device *phydev)
        int err;
        if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
-                err = phy_write(phydev, DP83865_INT_MASK_REG,
+                err = phy_write(phydev, DP83865_INT_MASK,
                                DP83865_INT_MASK_DEFAULT);
        else
-                err = phy_write(phydev, DP83865_INT_MASK_REG, 0);
+                err = phy_write(phydev, DP83865_INT_MASK, 0);
        return err;
 }
 static int ns_ack_interrupt(struct phy_device *phydev)
 {
-        int ret = phy_read(phydev, DP83865_INT_MASK_STATUS);
+        int ret = phy_read(phydev, DP83865_INT_STATUS);
        if (ret < 0)
                return ret;
-        return 0;
+        /* Clear the interrupt status bit by writing a “1”
+         * to the corresponding bit in INT_CLEAR (2:0 are reserved) */
+        ret = phy_write(phydev, DP83865_INT_CLEAR, ret & ~0x7);
+        return ret;
 }
 static void ns_giga_speed_fallback(struct phy_device *phydev, int mode)
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 10e5d985afa3..edfa15d2e795 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1465,7 +1465,12 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                        continue;
                }
-                mtu = pch->chan->mtu - hdrlen;
+                /*
+                 * hdrlen includes the 2-byte PPP protocol field, but the
+                 * MTU counts only the payload excluding the protocol field.
+                 * (RFC1661 Section 2)
+                 */
+                mtu = pch->chan->mtu - (hdrlen - 2);
                if (mtu < 4)
                        mtu = 4;
                if (flen > mtu)
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 1a3033d8e7ed..d17d0624c5e6 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -40,6 +40,7 @@
 #include <linux/clk.h>
 #include <linux/phy.h>
 #include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/types.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 02339b3352e7..c23667017922 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -407,6 +407,7 @@ enum rtl_register_content {
        RxOK            = 0x0001,
        /* RxStatusDesc */
+        RxBOVF  = (1 << 24),
        RxFOVF  = (1 << 23),
        RxRWT   = (1 << 22),
        RxRES   = (1 << 21),
@@ -682,6 +683,7 @@ struct rtl8169_private {
        struct mii_if_info mii;
        struct rtl8169_counters counters;
        u32 saved_wolopts;
+        u32 opts1_mask;
        struct rtl_fw {
                const struct firmware *fw;
@@ -710,6 +712,7 @@ MODULE_FIRMWARE(FIRMWARE_8168D_1);
 MODULE_FIRMWARE(FIRMWARE_8168D_2);
 MODULE_FIRMWARE(FIRMWARE_8168E_1);
 MODULE_FIRMWARE(FIRMWARE_8168E_2);
+MODULE_FIRMWARE(FIRMWARE_8168E_3);
 MODULE_FIRMWARE(FIRMWARE_8105E_1);
 static int rtl8169_open(struct net_device *dev);
@@ -3077,6 +3080,14 @@ static void rtl8169_phy_reset(struct net_device *dev,
        netif_err(tp, link, dev, "PHY reset failed\n");
 }
+static bool rtl_tbi_enabled(struct rtl8169_private *tp)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+        return (tp->mac_version == RTL_GIGA_MAC_VER_01) &&
+            (RTL_R8(PHYstatus) & TBI_Enable);
+}
 static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
 {
        void __iomem *ioaddr = tp->mmio_addr;
@@ -3109,7 +3120,7 @@ static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
                           ADVERTISED_1000baseT_Half |
                           ADVERTISED_1000baseT_Full : 0));
-        if (RTL_R8(PHYstatus) & TBI_Enable)
+        if (rtl_tbi_enabled(tp))
                netif_info(tp, link, dev, "TBI auto-negotiating\n");
 }
@@ -3319,9 +3330,16 @@ static void r810x_phy_power_up(struct rtl8169_private *tp)
 static void r810x_pll_power_down(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
        if (__rtl8169_get_wol(tp) & WAKE_ANY) {
                rtl_writephy(tp, 0x1f, 0x0000);
                rtl_writephy(tp, MII_BMCR, 0x0000);
+                if (tp->mac_version == RTL_GIGA_MAC_VER_29 ||
+                    tp->mac_version == RTL_GIGA_MAC_VER_30)
+                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
+                                AcceptMulticast | AcceptMyPhys);
                return;
        }
@@ -3417,7 +3435,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
                rtl_writephy(tp, MII_BMCR, 0x0000);
                if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_33)
+                    tp->mac_version == RTL_GIGA_MAC_VER_33 ||
+                    tp->mac_version == RTL_GIGA_MAC_VER_34)
                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
                                AcceptMulticast | AcceptMyPhys);
                return;
@@ -3727,8 +3746,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->features |= rtl_try_msi(pdev, ioaddr, cfg);
        RTL_W8(Cfg9346, Cfg9346_Lock);
-        if ((tp->mac_version <= RTL_GIGA_MAC_VER_06) &&
+        if (rtl_tbi_enabled(tp)) {
-            (RTL_R8(PHYstatus) & TBI_Enable)) {
                tp->set_speed = rtl8169_set_speed_tbi;
                tp->get_settings = rtl8169_gset_tbi;
                tp->phy_reset_enable = rtl8169_tbi_reset_enable;
@@ -3777,6 +3795,9 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->intr_event = cfg->intr_event;
        tp->napi_event = cfg->napi_event;
+        tp->opts1_mask = (tp->mac_version != RTL_GIGA_MAC_VER_01) ?
+                ~(RxBOVF | RxFOVF) : ~0;
        init_timer(&tp->timer);
        tp->timer.data = (unsigned long) dev;
        tp->timer.function = rtl8169_phy_timer;
@@ -3988,6 +4009,7 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
                while (RTL_R8(TxPoll) & NPQ)
                        udelay(20);
        } else if (tp->mac_version == RTL_GIGA_MAC_VER_34) {
+                RTL_W8(ChipCmd, RTL_R8(ChipCmd) | StopReq);
                while (!(RTL_R32(TxConfig) & TXCFG_EMPTY))
                        udelay(100);
        } else {
@@ -5314,7 +5336,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                u32 status;
                rmb();
-                status = le32_to_cpu(desc->opts1);
+                status = le32_to_cpu(desc->opts1) & tp->opts1_mask;
                if (status & DescOwn)
                        break;
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 86ac38c96bcf..3bb131137033 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -80,13 +80,13 @@ static int rionet_capable = 1;
 */
 static struct rio_dev **rionet_active;
-#define is_rionet_capable(pef, src_ops, dst_ops)                \
+#define is_rionet_capable(src_ops, dst_ops)                     \
-                        ((pef & RIO_PEF_INB_MBOX) &&            \
+                        ((src_ops & RIO_SRC_OPS_DATA_MSG) &&    \
-                         (pef & RIO_PEF_INB_DOORBELL) &&        \
+                         (dst_ops & RIO_DST_OPS_DATA_MSG) &&    \
                         (src_ops & RIO_SRC_OPS_DOORBELL) &&    \
                         (dst_ops & RIO_DST_OPS_DOORBELL))
 #define dev_rionet_capable(dev) \
-        is_rionet_capable(dev->pef, dev->src_ops, dev->dst_ops)
+        is_rionet_capable(dev->src_ops, dev->dst_ops)
 #define RIONET_MAC_MATCH(x)     (*(u32 *)x == 0x00010001)
 #define RIONET_GET_DESTID(x)    (*(u16 *)(x + 4))
@@ -282,7 +282,6 @@ static int rionet_open(struct net_device *ndev)
 {
        int i, rc = 0;
        struct rionet_peer *peer, *tmp;
-        u32 pwdcsr;
        struct rionet_private *rnet = netdev_priv(ndev);
        if (netif_msg_ifup(rnet))
@@ -332,13 +331,8 @@ static int rionet_open(struct net_device *ndev)
                        continue;
                }
-                /*
+                /* Send a join message */
-                 * If device has initialized inbound doorbells,
+                rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
-                 * send a join message
-                 */
-                rio_read_config_32(peer->rdev, RIO_WRITE_PORT_CSR, &pwdcsr);
-                if (pwdcsr & RIO_DOORBELL_AVAIL)
-                        rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
        }
      out:
@@ -492,7 +486,7 @@ static int rionet_setup_netdev(struct rio_mport *mport, struct net_device *ndev)
 static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
 {
        int rc = -ENODEV;
-        u32 lpef, lsrc_ops, ldst_ops;
+        u32 lsrc_ops, ldst_ops;
        struct rionet_peer *peer;
        struct net_device *ndev = NULL;
@@ -515,12 +509,11 @@ static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
         * on later probes
         */
        if (!rionet_check) {
-                rio_local_read_config_32(rdev->net->hport, RIO_PEF_CAR, &lpef);
                rio_local_read_config_32(rdev->net->hport, RIO_SRC_OPS_CAR,
                                         &lsrc_ops);
                rio_local_read_config_32(rdev->net->hport, RIO_DST_OPS_CAR,
                                         &ldst_ops);
-                if (!is_rionet_capable(lpef, lsrc_ops, ldst_ops)) {
+                if (!is_rionet_capable(lsrc_ops, ldst_ops)) {
                        printk(KERN_ERR
                               "%s: local device is not network capable\n",
                               DRV_NAME);
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index faca764aa21b..b59abc706d93 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -1050,7 +1050,6 @@ static int efx_init_io(struct efx_nic *efx)
 {
        struct pci_dev *pci_dev = efx->pci_dev;
        dma_addr_t dma_mask = efx->type->max_dma_mask;
-        bool use_wc;
        int rc;
        netif_dbg(efx, probe, efx->net_dev, "initialising I/O\n");
@@ -1101,21 +1100,8 @@ static int efx_init_io(struct efx_nic *efx)
                rc = -EIO;
                goto fail3;
        }
+        efx->membase = ioremap_nocache(efx->membase_phys,
-        /* bug22643: If SR-IOV is enabled then tx push over a write combined
+                                       efx->type->mem_map_size);
-         * mapping is unsafe. We need to disable write combining in this case.
-         * MSI is unsupported when SR-IOV is enabled, and the firmware will
-         * have removed the MSI capability. So write combining is safe if
-         * there is an MSI capability.
-         */
-        use_wc = (!EFX_WORKAROUND_22643(efx) ||
-                  pci_find_capability(pci_dev, PCI_CAP_ID_MSI));
-        if (use_wc)
-                efx->membase = ioremap_wc(efx->membase_phys,
-                                          efx->type->mem_map_size);
-        else
-                efx->membase = ioremap_nocache(efx->membase_phys,
-                                               efx->type->mem_map_size);
        if (!efx->membase) {
                netif_err(efx, probe, efx->net_dev,
                          "could not map memory BAR at %llx+%x\n",
diff --git a/drivers/net/sfc/io.h b/drivers/net/sfc/io.h
index cc978803d484..751d1ec112cc 100644
--- a/drivers/net/sfc/io.h
+++ b/drivers/net/sfc/io.h
@@ -103,7 +103,6 @@ static inline void efx_writeo(struct efx_nic *efx, efx_oword_t *value,
        _efx_writed(efx, value->u32[2], reg + 8);
        _efx_writed(efx, value->u32[3], reg + 12);
 #endif
-        wmb();
        mmiowb();
        spin_unlock_irqrestore(&efx->biu_lock, flags);
 }
@@ -126,7 +125,6 @@ static inline void efx_sram_writeq(struct efx_nic *efx, void __iomem *membase,
        __raw_writel((__force u32)value->u32[0], membase + addr);
        __raw_writel((__force u32)value->u32[1], membase + addr + 4);
 #endif
-        wmb();
        mmiowb();
        spin_unlock_irqrestore(&efx->biu_lock, flags);
 }
@@ -141,7 +139,6 @@ static inline void efx_writed(struct efx_nic *efx, efx_dword_t *value,
        /* No lock required */
        _efx_writed(efx, value->u32[0], reg);
-        wmb();
 }
 /* Read a 128-bit CSR, locking as appropriate. */
@@ -152,7 +149,6 @@ static inline void efx_reado(struct efx_nic *efx, efx_oword_t *value,
        spin_lock_irqsave(&efx->biu_lock, flags);
        value->u32[0] = _efx_readd(efx, reg + 0);
-        rmb();
        value->u32[1] = _efx_readd(efx, reg + 4);
        value->u32[2] = _efx_readd(efx, reg + 8);
        value->u32[3] = _efx_readd(efx, reg + 12);
@@ -175,7 +171,6 @@ static inline void efx_sram_readq(struct efx_nic *efx, void __iomem *membase,
        value->u64[0] = (__force __le64)__raw_readq(membase + addr);
 #else
        value->u32[0] = (__force __le32)__raw_readl(membase + addr);
-        rmb();
        value->u32[1] = (__force __le32)__raw_readl(membase + addr + 4);
 #endif
        spin_unlock_irqrestore(&efx->biu_lock, flags);
@@ -249,7 +244,6 @@ static inline void _efx_writeo_page(struct efx_nic *efx, efx_oword_t *value,
        _efx_writed(efx, value->u32[2], reg + 8);
        _efx_writed(efx, value->u32[3], reg + 12);
 #endif
-        wmb();
 }
 #define efx_writeo_page(efx, value, reg, page)                          \
        _efx_writeo_page(efx, value,                                    \
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 3dd45ed61f0a..81a425397468 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -50,20 +50,6 @@ static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
        return &nic_data->mcdi;
 }
-static inline void
-efx_mcdi_readd(struct efx_nic *efx, efx_dword_t *value, unsigned reg)
-{
-        struct siena_nic_data *nic_data = efx->nic_data;
-        value->u32[0] = (__force __le32)__raw_readl(nic_data->mcdi_smem + reg);
-}
-static inline void
-efx_mcdi_writed(struct efx_nic *efx, const efx_dword_t *value, unsigned reg)
-{
-        struct siena_nic_data *nic_data = efx->nic_data;
-        __raw_writel((__force u32)value->u32[0], nic_data->mcdi_smem + reg);
-}
 void efx_mcdi_init(struct efx_nic *efx)
 {
        struct efx_mcdi_iface *mcdi;
@@ -84,8 +70,8 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                            const u8 *inbuf, size_t inlen)
 {
        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned pdu = MCDI_PDU(efx);
+        unsigned pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
-        unsigned doorbell = MCDI_DOORBELL(efx);
+        unsigned doorbell = FR_CZ_MC_TREG_SMEM + MCDI_DOORBELL(efx);
        unsigned int i;
        efx_dword_t hdr;
        u32 xflags, seqno;
@@ -106,28 +92,29 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                             MCDI_HEADER_SEQ, seqno,
                             MCDI_HEADER_XFLAGS, xflags);
-        efx_mcdi_writed(efx, &hdr, pdu);
+        efx_writed(efx, &hdr, pdu);
        for (i = 0; i < inlen; i += 4)
-                efx_mcdi_writed(efx, (const efx_dword_t *)(inbuf + i),
+                _efx_writed(efx, *((__le32 *)(inbuf + i)), pdu + 4 + i);
-                                pdu + 4 + i);
+        /* Ensure the payload is written out before the header */
+        wmb();
        /* ring the doorbell with a distinctive value */
-        EFX_POPULATE_DWORD_1(hdr, EFX_DWORD_0, 0x45789abc);
+        _efx_writed(efx, (__force __le32) 0x45789abc, doorbell);
-        efx_mcdi_writed(efx, &hdr, doorbell);
 }
 static void efx_mcdi_copyout(struct efx_nic *efx, u8 *outbuf, size_t outlen)
 {
        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned int pdu = MCDI_PDU(efx);
+        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
        int i;
        BUG_ON(atomic_read(&mcdi->state) == MCDI_STATE_QUIESCENT);
        BUG_ON(outlen & 3 || outlen >= 0x100);
        for (i = 0; i < outlen; i += 4)
-                efx_mcdi_readd(efx, (efx_dword_t *)(outbuf + i), pdu + 4 + i);
+                *((__le32 *)(outbuf + i)) = _efx_readd(efx, pdu + 4 + i);
 }
 static int efx_mcdi_poll(struct efx_nic *efx)
@@ -135,7 +122,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
        unsigned int time, finish;
        unsigned int respseq, respcmd, error;
-        unsigned int pdu = MCDI_PDU(efx);
+        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
        unsigned int rc, spins;
        efx_dword_t reg;
@@ -161,7 +148,8 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                time = get_seconds();
-                efx_mcdi_readd(efx, &reg, pdu);
+                rmb();
+                efx_readd(efx, &reg, pdu);
                /* All 1's indicates that shared memory is in reset (and is
                 * not a valid header). Wait for it to come out reset before
@@ -188,7 +176,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                          respseq, mcdi->seqno);
                rc = EIO;
        } else if (error) {
-                efx_mcdi_readd(efx, &reg, pdu + 4);
+                efx_readd(efx, &reg, pdu + 4);
                switch (EFX_DWORD_FIELD(reg, EFX_DWORD_0)) {
 #define TRANSLATE_ERROR(name)                                   \
                case MC_CMD_ERR_ ## name:                       \
@@ -222,21 +210,21 @@ out:
 /* Test and clear MC-rebooted flag for this port/function */
 int efx_mcdi_poll_reboot(struct efx_nic *efx)
 {
-        unsigned int addr = MCDI_REBOOT_FLAG(efx);
+        unsigned int addr = FR_CZ_MC_TREG_SMEM + MCDI_REBOOT_FLAG(efx);
        efx_dword_t reg;
        uint32_t value;
        if (efx_nic_rev(efx) < EFX_REV_SIENA_A0)
                return false;
-        efx_mcdi_readd(efx, &reg, addr);
+        efx_readd(efx, &reg, addr);
        value = EFX_DWORD_FIELD(reg, EFX_DWORD_0);
        if (value == 0)
                return 0;
        EFX_ZERO_DWORD(reg);
-        efx_mcdi_writed(efx, &reg, addr);
+        efx_writed(efx, &reg, addr);
        if (value == MC_STATUS_DWORD_ASSERT)
                return -EINTR;
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index bafa23a6874c..3edfbaf5f022 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -1936,13 +1936,6 @@ void efx_nic_get_regs(struct efx_nic *efx, void *buf)
                size = min_t(size_t, table->step, 16);
-                if (table->offset >= efx->type->mem_map_size) {
-                        /* No longer mapped; return dummy data */
-                        memcpy(buf, "\xde\xc0\xad\xde", 4);
-                        buf += table->rows * size;
-                        continue;
-                }
                for (i = 0; i < table->rows; i++) {
                        switch (table->step) {
                        case 4: /* 32-bit register or SRAM */
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 4bd1f2839dfe..7443f99c977f 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -143,12 +143,10 @@ static inline struct falcon_board *falcon_board(struct efx_nic *efx)
 /**
 * struct siena_nic_data - Siena NIC state
 * @mcdi: Management-Controller-to-Driver Interface
- * @mcdi_smem: MCDI shared memory mapping. The mapping is always uncacheable.
 * @wol_filter_id: Wake-on-LAN packet filter id
 */
 struct siena_nic_data {
        struct efx_mcdi_iface mcdi;
-        void __iomem *mcdi_smem;
        int wol_filter_id;
 };
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 5735e84c69de..2c3bd93fab54 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -250,26 +250,12 @@ static int siena_probe_nic(struct efx_nic *efx)
        efx_reado(efx, &reg, FR_AZ_CS_DEBUG);
        efx->net_dev->dev_id = EFX_OWORD_FIELD(reg, FRF_CZ_CS_PORT_NUM) - 1;
-        /* Initialise MCDI */
-        nic_data->mcdi_smem = ioremap_nocache(efx->membase_phys +
-                                              FR_CZ_MC_TREG_SMEM,
-                                              FR_CZ_MC_TREG_SMEM_STEP *
-                                              FR_CZ_MC_TREG_SMEM_ROWS);
-        if (!nic_data->mcdi_smem) {
-                netif_err(efx, probe, efx->net_dev,
-                          "could not map MCDI at %llx+%x\n",
-                          (unsigned long long)efx->membase_phys +
-                          FR_CZ_MC_TREG_SMEM,
-                          FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS);
-                rc = -ENOMEM;
-                goto fail1;
-        }
        efx_mcdi_init(efx);
        /* Recover from a failed assertion before probing */
        rc = efx_mcdi_handle_assertion(efx);
        if (rc)
-                goto fail2;
+                goto fail1;
        /* Let the BMC know that the driver is now in charge of link and
         * filter settings. We must do this before we reset the NIC */
@@ -324,7 +310,6 @@ fail4:
 fail3:
        efx_mcdi_drv_attach(efx, false, NULL);
 fail2:
-        iounmap(nic_data->mcdi_smem);
 fail1:
        kfree(efx->nic_data);
        return rc;
@@ -404,8 +389,6 @@ static int siena_init_nic(struct efx_nic *efx)
 static void siena_remove_nic(struct efx_nic *efx)
 {
-        struct siena_nic_data *nic_data = efx->nic_data;
        efx_nic_free_buffer(efx, &efx->irq_status);
        siena_reset_hw(efx, RESET_TYPE_ALL);
@@ -415,8 +398,7 @@ static void siena_remove_nic(struct efx_nic *efx)
                efx_mcdi_drv_attach(efx, false, NULL);
        /* Tear down the private nic state */
-        iounmap(nic_data->mcdi_smem);
+        kfree(efx->nic_data);
-        kfree(nic_data);
        efx->nic_data = NULL;
 }
@@ -656,7 +638,8 @@ const struct efx_nic_type siena_a0_nic_type = {
        .default_mac_ops = &efx_mcdi_mac_operations,
        .revision = EFX_REV_SIENA_A0,
-        .mem_map_size = FR_CZ_MC_TREG_SMEM, /* MC_TREG_SMEM mapped separately */
+        .mem_map_size = (FR_CZ_MC_TREG_SMEM +
+                         FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS),
        .txd_ptr_tbl_base = FR_BZ_TX_DESC_PTR_TBL,
        .rxd_ptr_tbl_base = FR_BZ_RX_DESC_PTR_TBL,
        .buf_tbl_base = FR_BZ_BUF_FULL_TBL,
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index 99ff11400cef..e4dd3a7f304b 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -38,8 +38,6 @@
 #define EFX_WORKAROUND_15783 EFX_WORKAROUND_ALWAYS
 /* Legacy interrupt storm when interrupt fifo fills */
 #define EFX_WORKAROUND_17213 EFX_WORKAROUND_SIENA
-/* Write combining and sriov=enabled are incompatible */
-#define EFX_WORKAROUND_22643 EFX_WORKAROUND_SIENA
 /* Spurious parity errors in TSORT buffers */
 #define EFX_WORKAROUND_5129 EFX_WORKAROUND_FALCON_A
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index 190f619e4215..1c1666e99106 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -31,6 +31,7 @@
 #include <linux/phy.h>
 #include <linux/cache.h>
 #include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/pm_runtime.h>
 #include <linux/slab.h>
 #include <linux/ethtool.h>
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index dc3fbf61910b..4a1374df6084 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -6234,12 +6234,10 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        }
-#ifdef BCM_KERNEL_SUPPORTS_8021Q
        if (vlan_tx_tag_present(skb)) {
                base_flags |= TXD_FLAG_VLAN;
                vlan = vlan_tx_tag_get(skb);
        }
-#endif
        if (tg3_flag(tp, USE_JUMBO_BDFLAG) &&
            !mss && skb->len > VLAN_ETH_FRAME_LEN)
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 15772b1b6a91..13c1f044b40d 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -59,6 +59,7 @@
 #define USB_PRODUCT_IPHONE_3G   0x1292
 #define USB_PRODUCT_IPHONE_3GS  0x1294
 #define USB_PRODUCT_IPHONE_4    0x1297
+#define USB_PRODUCT_IPHONE_4_VZW 0x129c
 #define IPHETH_USBINTF_CLASS    255
 #define IPHETH_USBINTF_SUBCLASS 253
@@ -98,6 +99,10 @@ static struct usb_device_id ipheth_table[] = {
                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4,
                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4_VZW,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
        { }
 };
 MODULE_DEVICE_TABLE(usb, ipheth_table);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index 2d4c0910295b..2d394af82171 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -41,7 +41,8 @@ static bool ar9002_hw_is_cal_supported(struct ath_hw *ah,
        case ADC_DC_CAL:
                /* Run ADC Gain Cal for non-CCK & non 2GHz-HT20 only */
                if (!IS_CHAN_B(chan) &&
-                    !(IS_CHAN_2GHZ(chan) && IS_CHAN_HT20(chan)))
+                    !((IS_CHAN_2GHZ(chan) || IS_CHAN_A_FAST_CLOCK(ah, chan)) &&
+                      IS_CHAN_HT20(chan)))
                        supported = true;
                break;
        }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index c34bef1bf2b0..1b9400371eaf 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -69,7 +69,7 @@ static int ar9003_hw_power_interpolate(int32_t x,
 static const struct ar9300_eeprom ar9300_default = {
        .eepromVersion = 2,
        .templateVersion = 2,
-        .macAddr = {1, 2, 3, 4, 5, 6},
+        .macAddr = {0, 2, 3, 4, 5, 6},
        .custData = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
                     0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
        .baseEepHeader = {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 1baca8e4715d..fcafec0605f4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -671,7 +671,7 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                REG_WRITE_ARRAY(&ah->iniModesAdditional,
                                modesIndex, regWrites);
-        if (AR_SREV_9300(ah))
+        if (AR_SREV_9330(ah))
                REG_WRITE_ARRAY(&ah->iniModesAdditional, 1, regWrites);
        if (AR_SREV_9340(ah) && !ah->is_clk_25mhz)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 9098aaad97a9..722967b86cf1 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2283,7 +2283,11 @@ static void ath9k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
        mutex_lock(&sc->mutex);
        ah->coverage_class = coverage_class;
+        ath9k_ps_wakeup(sc);
        ath9k_hw_init_global_settings(ah);
+        ath9k_ps_restore(sc);
        mutex_unlock(&sc->mutex);
 }
@@ -2299,6 +2303,12 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
        mutex_lock(&sc->mutex);
        cancel_delayed_work_sync(&sc->tx_complete_work);
+        if (ah->ah_flags & AH_UNPLUGGED) {
+                ath_dbg(common, ATH_DBG_ANY, "Device has been unplugged!\n");
+                mutex_unlock(&sc->mutex);
+                return;
+        }
        if (sc->sc_flags & SC_OP_INVALID) {
                ath_dbg(common, ATH_DBG_ANY, "Device not present\n");
                mutex_unlock(&sc->mutex);
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 0122930b14c7..0474e6638d21 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1066,8 +1066,10 @@ static int carl9170_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         * the high througput speed in 802.11n networks.
         */
-        if (!is_main_vif(ar, vif))
+        if (!is_main_vif(ar, vif)) {
+                mutex_lock(&ar->mutex);
                goto err_softw;
+        }
        /*
         * While the hardware supports *catch-all* key, for offloading
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 26f1ab840cc7..e293a7921bf0 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1632,7 +1632,8 @@ static void handle_irq_beacon(struct b43_wldev *dev)
        u32 cmd, beacon0_valid, beacon1_valid;
        if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
-            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
+            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
+            !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
                return;
        /* This is the bottom half of the asynchronous beacon update. */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 3774dd034746..ef9ad79d1bfd 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1903,15 +1903,17 @@ static void ipw2100_down(struct ipw2100_priv *priv)
 static int ipw2100_net_init(struct net_device *dev)
 {
        struct ipw2100_priv *priv = libipw_priv(dev);
+        return ipw2100_up(priv, 1);
+}
+static int ipw2100_wdev_init(struct net_device *dev)
+{
+        struct ipw2100_priv *priv = libipw_priv(dev);
        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
        struct wireless_dev *wdev = &priv->ieee->wdev;
-        int ret;
        int i;
-        ret = ipw2100_up(priv, 1);
-        if (ret)
-                return ret;
        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
        /* fill-out priv->ieee->bg_band */
@@ -6350,9 +6352,13 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                       "Error calling register_netdev.\n");
                goto fail;
        }
+        registered = 1;
+        err = ipw2100_wdev_init(dev);
+        if (err)
+                goto fail;
        mutex_lock(&priv->action_mutex);
-        registered = 1;
        IPW_DEBUG_INFO("%s: Bound to %s\n", dev->name, pci_name(pci_dev));
@@ -6389,7 +6395,8 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
      fail_unlock:
        mutex_unlock(&priv->action_mutex);
+        wiphy_unregister(priv->ieee->wdev.wiphy);
+        kfree(priv->ieee->bg_band.channels);
      fail:
        if (dev) {
                if (registered)
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 87813c33bdc2..4ffebede5e03 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -11425,16 +11425,23 @@ static void ipw_bg_down(struct work_struct *work)
 /* Called by register_netdev() */
 static int ipw_net_init(struct net_device *dev)
 {
+        int rc = 0;
+        struct ipw_priv *priv = libipw_priv(dev);
+        mutex_lock(&priv->mutex);
+        if (ipw_up(priv))
+                rc = -EIO;
+        mutex_unlock(&priv->mutex);
+        return rc;
+}
+static int ipw_wdev_init(struct net_device *dev)
+{
        int i, rc = 0;
        struct ipw_priv *priv = libipw_priv(dev);
        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
        struct wireless_dev *wdev = &priv->ieee->wdev;
-        mutex_lock(&priv->mutex);
-        if (ipw_up(priv)) {
-                rc = -EIO;
-                goto out;
-        }
        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
@@ -11519,13 +11526,9 @@ static int ipw_net_init(struct net_device *dev)
        set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
        /* With that information in place, we can now register the wiphy... */
-        if (wiphy_register(wdev->wiphy)) {
+        if (wiphy_register(wdev->wiphy))
                rc = -EIO;
-                goto out;
-        }
 out:
-        mutex_unlock(&priv->mutex);
        return rc;
 }
@@ -11832,14 +11835,22 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
                goto out_remove_sysfs;
        }
+        err = ipw_wdev_init(net_dev);
+        if (err) {
+                IPW_ERROR("failed to register wireless device\n");
+                goto out_unregister_netdev;
+        }
 #ifdef CONFIG_IPW2200_PROMISCUOUS
        if (rtap_iface) {
                err = ipw_prom_alloc(priv);
                if (err) {
                        IPW_ERROR("Failed to register promiscuous network "
                                  "device (error %d).\n", err);
-                        unregister_netdev(priv->net_dev);
+                        wiphy_unregister(priv->ieee->wdev.wiphy);
-                        goto out_remove_sysfs;
+                        kfree(priv->ieee->a_band.channels);
+                        kfree(priv->ieee->bg_band.channels);
+                        goto out_unregister_netdev;
                }
        }
 #endif
@@ -11851,6 +11862,8 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
        return 0;
+      out_unregister_netdev:
+        unregister_netdev(priv->net_dev);
      out_remove_sysfs:
        sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
      out_release_irq:
diff --git a/drivers/net/wireless/iwlegacy/iwl-3945-rs.c b/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
index 977bd2477c6a..164bcae821f8 100644
--- a/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
@@ -822,12 +822,15 @@ static void iwl3945_rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
 out:
-        rs_sta->last_txrate_idx = index;
+        if (sband->band == IEEE80211_BAND_5GHZ) {
-        if (sband->band == IEEE80211_BAND_5GHZ)
+                if (WARN_ON_ONCE(index < IWL_FIRST_OFDM_RATE))
-                info->control.rates[0].idx = rs_sta->last_txrate_idx -
+                        index = IWL_FIRST_OFDM_RATE;
-                                IWL_FIRST_OFDM_RATE;
+                rs_sta->last_txrate_idx = index;
-        else
+                info->control.rates[0].idx = index - IWL_FIRST_OFDM_RATE;
+        } else {
+                rs_sta->last_txrate_idx = index;
                info->control.rates[0].idx = rs_sta->last_txrate_idx;
+        }
        IWL_DEBUG_RATE(priv, "leave: %d\n", index);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
index a895a099d086..56211006a182 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -167,7 +167,7 @@ static int iwlagn_set_temperature_offset_calib(struct iwl_priv *priv)
        memset(&cmd, 0, sizeof(cmd));
        iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD);
-        memcpy(&cmd.radio_sensor_offset, offset_calib, sizeof(offset_calib));
+        memcpy(&cmd.radio_sensor_offset, offset_calib, sizeof(*offset_calib));
        if (!(cmd.radio_sensor_offset))
                cmd.radio_sensor_offset = DEFAULT_RADIO_SENSOR_OFFSET;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index b0ae4de7f083..f9c3cd95d614 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2140,7 +2140,12 @@ static int iwl_mac_setup_register(struct iwl_priv *priv,
                    IEEE80211_HW_SPECTRUM_MGMT |
                    IEEE80211_HW_REPORTS_TX_ACK_STATUS;
+        /*
+         * Including the following line will crash some AP's.  This
+         * workaround removes the stimulus which causes the crash until
+         * the AP software can be fixed.
        hw->max_tx_aggregation_subframes = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
+         */
        hw->flags |= IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
index a6b2b1db0b1d..222d410c586e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
@@ -771,6 +771,8 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
        cmd = txq->cmd[cmd_index];
        meta = &txq->meta[cmd_index];
+        txq->time_stamp = jiffies;
        iwlagn_unmap_tfd(priv, meta, &txq->tfds[index], DMA_BIDIRECTIONAL);
        /* Input error checking is done when commands are added to queue. */
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index ef67f6786a84..0019dfd8fb01 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -3697,14 +3697,15 @@ static void rt2800_efuse_read(struct rt2x00_dev *rt2x00dev, unsigned int i)
        rt2800_regbusy_read(rt2x00dev, EFUSE_CTRL, EFUSE_CTRL_KICK, &reg);
        /* Apparently the data is read from end to start */
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3,
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3, &reg);
-                                        (u32 *)&rt2x00dev->eeprom[i]);
+        /* The returned value is in CPU order, but eeprom is le */
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2,
+        rt2x00dev->eeprom[i] = cpu_to_le32(reg);
-                                        (u32 *)&rt2x00dev->eeprom[i + 2]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2, &reg);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1,
+        *(u32 *)&rt2x00dev->eeprom[i + 2] = cpu_to_le32(reg);
-                                        (u32 *)&rt2x00dev->eeprom[i + 4]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1, &reg);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0,
+        *(u32 *)&rt2x00dev->eeprom[i + 4] = cpu_to_le32(reg);
-                                        (u32 *)&rt2x00dev->eeprom[i + 6]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0, &reg);
+        *(u32 *)&rt2x00dev->eeprom[i + 6] = cpu_to_le32(reg);
        mutex_unlock(&rt2x00dev->csr_mutex);
 }
@@ -3870,19 +3871,23 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
                return -ENODEV;
        }
-        if (!rt2x00_rf(rt2x00dev, RF2820) &&
+        switch (rt2x00dev->chip.rf) {
-            !rt2x00_rf(rt2x00dev, RF2850) &&
+        case RF2820:
-            !rt2x00_rf(rt2x00dev, RF2720) &&
+        case RF2850:
-            !rt2x00_rf(rt2x00dev, RF2750) &&
+        case RF2720:
-            !rt2x00_rf(rt2x00dev, RF3020) &&
+        case RF2750:
-            !rt2x00_rf(rt2x00dev, RF2020) &&
+        case RF3020:
-            !rt2x00_rf(rt2x00dev, RF3021) &&
+        case RF2020:
-            !rt2x00_rf(rt2x00dev, RF3022) &&
+        case RF3021:
-            !rt2x00_rf(rt2x00dev, RF3052) &&
+        case RF3022:
-            !rt2x00_rf(rt2x00dev, RF3320) &&
+        case RF3052:
-            !rt2x00_rf(rt2x00dev, RF5370) &&
+        case RF3320:
-            !rt2x00_rf(rt2x00dev, RF5390)) {
+        case RF5370:
-                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
+        case RF5390:
+                break;
+        default:
+                ERROR(rt2x00dev, "Invalid RF chipset 0x%x detected.\n",
+                      rt2x00dev->chip.rf);
                return -ENODEV;
        }
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 7fbb55c9da82..1e31050dafc9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -871,18 +871,8 @@ int rt2x00usb_suspend(struct usb_interface *usb_intf, pm_message_t state)
 {
        struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
        struct rt2x00_dev *rt2x00dev = hw->priv;
-        int retval;
-        retval = rt2x00lib_suspend(rt2x00dev, state);
-        if (retval)
-                return retval;
-        /*
+        return rt2x00lib_suspend(rt2x00dev, state);
-         * Decrease usbdev refcount.
-         */
-        usb_put_dev(interface_to_usbdev(usb_intf));
-        return 0;
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_suspend);
@@ -891,8 +881,6 @@ int rt2x00usb_resume(struct usb_interface *usb_intf)
        struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
        struct rt2x00_dev *rt2x00dev = hw->priv;
-        usb_get_dev(interface_to_usbdev(usb_intf));
        return rt2x00lib_resume(rt2x00dev);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_resume);
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 1bdc1aa305c0..04c4e9eb6ee6 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -610,6 +610,11 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
                        mac->link_state = MAC80211_NOLINK;
                        memset(mac->bssid, 0, 6);
+                        /* reset sec info */
+                        rtl_cam_reset_sec_info(hw);
+                        rtl_cam_reset_all_entry(hw);
                        mac->vendor = PEER_UNKNOWN;
                        RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
@@ -1063,6 +1068,9 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 *or clear all entry here.
                 */
                rtl_cam_delete_one_entry(hw, mac_addr, key_idx);
+                rtl_cam_reset_sec_info(hw);
                break;
        default:
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 906e7aa55bc3..3e52a5496224 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -549,15 +549,16 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
                               (tcb_desc->rts_use_shortpreamble ? 1 : 0)
                               : (tcb_desc->rts_use_shortgi ? 1 : 0)));
        if (mac->bw_40) {
-                if (tcb_desc->packet_bw) {
+                if (rate_flag & IEEE80211_TX_RC_DUP_DATA) {
                        SET_TX_DESC_DATA_BW(txdesc, 1);
                        SET_TX_DESC_DATA_SC(txdesc, 3);
+                } else if(rate_flag & IEEE80211_TX_RC_40_MHZ_WIDTH){
+                        SET_TX_DESC_DATA_BW(txdesc, 1);
+                        SET_TX_DESC_DATA_SC(txdesc, mac->cur_40_prime_sc);
                } else {
                        SET_TX_DESC_DATA_BW(txdesc, 0);
-                                if (rate_flag & IEEE80211_TX_RC_DUP_DATA)
+                        SET_TX_DESC_DATA_SC(txdesc, 0);
-                                        SET_TX_DESC_DATA_SC(txdesc,
+                }
-                                                          mac->cur_40_prime_sc);
-                        }
        } else {
                SET_TX_DESC_DATA_BW(txdesc, 0);
                SET_TX_DESC_DATA_SC(txdesc, 0);
diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
index e58c22d21e39..b70ae40ad660 100644
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -4283,6 +4283,7 @@ int wl1271_init_ieee80211(struct wl1271 *wl)
        wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                BIT(NL80211_IFTYPE_ADHOC) | BIT(NL80211_IFTYPE_AP);
        wl->hw->wiphy->max_scan_ssids = 1;
+        wl->hw->wiphy->max_sched_scan_ssids = 1;
        /*
         * Maximum length of elements in scanning probe request templates
         * should be the maximum length possible for a template, without
diff --git a/drivers/net/wireless/wl12xx/sdio.c b/drivers/net/wireless/wl12xx/sdio.c
index 5cf18c2c23f0..fb1fd5af75ea 100644
--- a/drivers/net/wireless/wl12xx/sdio.c
+++ b/drivers/net/wireless/wl12xx/sdio.c
@@ -164,7 +164,7 @@ static int wl1271_sdio_power_on(struct wl1271 *wl)
        /* If enabled, tell runtime PM not to power off the card */
        if (pm_runtime_enabled(&func->dev)) {
                ret = pm_runtime_get_sync(&func->dev);
-                if (ret)
+                if (ret < 0)
                        goto out;
        } else {
                /* Runtime PM is disabled: power up the card manually */
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
index 88add68bd9ac..4ae8effaee22 100644
--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
@@ -36,7 +36,6 @@ enum wl1271_tm_commands {
        WL1271_TM_CMD_TEST,
        WL1271_TM_CMD_INTERROGATE,
        WL1271_TM_CMD_CONFIGURE,
-        WL1271_TM_CMD_NVS_PUSH,
        WL1271_TM_CMD_SET_PLT_MODE,
        WL1271_TM_CMD_RECOVER,
@@ -190,48 +189,6 @@ static int wl1271_tm_cmd_configure(struct wl1271 *wl, struct nlattr *tb[])
        return 0;
 }
-static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
-{
-        int ret = 0;
-        size_t len;
-        void *buf;
-        wl1271_debug(DEBUG_TESTMODE, "testmode cmd nvs push");
-        if (!tb[WL1271_TM_ATTR_DATA])
-                return -EINVAL;
-        buf = nla_data(tb[WL1271_TM_ATTR_DATA]);
-        len = nla_len(tb[WL1271_TM_ATTR_DATA]);
-        mutex_lock(&wl->mutex);
-        kfree(wl->nvs);
-        if ((wl->chip.id == CHIP_ID_1283_PG20) &&
-            (len != sizeof(struct wl128x_nvs_file)))
-                return -EINVAL;
-        else if (len != sizeof(struct wl1271_nvs_file))
-                return -EINVAL;
-        wl->nvs = kzalloc(len, GFP_KERNEL);
-        if (!wl->nvs) {
-                wl1271_error("could not allocate memory for the nvs file");
-                ret = -ENOMEM;
-                goto out;
-        }
-        memcpy(wl->nvs, buf, len);
-        wl->nvs_len = len;
-        wl1271_debug(DEBUG_TESTMODE, "testmode pushed nvs");
-out:
-        mutex_unlock(&wl->mutex);
-        return ret;
-}
 static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
 {
        u32 val;
@@ -288,8 +245,6 @@ int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len)
                return wl1271_tm_cmd_interrogate(wl, tb);
        case WL1271_TM_CMD_CONFIGURE:
                return wl1271_tm_cmd_configure(wl, tb);
-        case WL1271_TM_CMD_NVS_PUSH:
-                return wl1271_tm_cmd_nvs_push(wl, tb);
        case WL1271_TM_CMD_SET_PLT_MODE:
                return wl1271_tm_cmd_set_plt_mode(wl, tb);
        case WL1271_TM_CMD_RECOVER:
diff --git a/drivers/pci/hotplug/pcihp_slot.c b/drivers/pci/hotplug/pcihp_slot.c
index 753b21aaea61..3ffd9c1acc0a 100644
--- a/drivers/pci/hotplug/pcihp_slot.c
+++ b/drivers/pci/hotplug/pcihp_slot.c
@@ -169,7 +169,9 @@ void pci_configure_slot(struct pci_dev *dev)
                        (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
                return;
-        pcie_bus_configure_settings(dev->bus, dev->bus->self->pcie_mpss);
+        if (dev->bus && dev->bus->self)
+                pcie_bus_configure_settings(dev->bus,
+                                            dev->bus->self->pcie_mpss);
        memset(&hpp, 0, sizeof(hpp));
        ret = pci_get_hp_params(dev, &hpp);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 0ce67423a0a3..4e84fd4a4312 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -77,7 +77,7 @@ unsigned long pci_cardbus_mem_size = DEFAULT_CARDBUS_MEM_SIZE;
 unsigned long pci_hotplug_io_size  = DEFAULT_HOTPLUG_IO_SIZE;
 unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE;
-enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_PERFORMANCE;
+enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_SAFE;
 /*
 * The default CLS is used if arch didn't set CLS explicitly and not
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 8473727b29fa..f3f94a5c068f 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1351,7 +1351,8 @@ static int pcie_find_smpss(struct pci_dev *dev, void *data)
         * will occur as normal.
         */
        if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) ||
-            dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT))
+             (dev->bus->self &&
+              dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT)))
                *smpss = 0;
        if (*smpss > dev->pcie_mpss)
@@ -1396,34 +1397,37 @@ static void pcie_write_mps(struct pci_dev *dev, int mps)
 static void pcie_write_mrrs(struct pci_dev *dev, int mps)
 {
-        int rc, mrrs;
+        int rc, mrrs, dev_mpss;
-        if (pcie_bus_config == PCIE_BUS_PERFORMANCE) {
+        /* In the "safe" case, do not configure the MRRS.  There appear to be
-                int dev_mpss = 128 << dev->pcie_mpss;
+         * issues with setting MRRS to 0 on a number of devices.
+         */
-                /* For Max performance, the MRRS must be set to the largest
+        if (pcie_bus_config != PCIE_BUS_PERFORMANCE)
-                 * supported value.  However, it cannot be configured larger
+                return;
-                 * than the MPS the device or the bus can support.  This assumes
-                 * that the largest MRRS available on the device cannot be
-                 * smaller than the device MPSS.
-                 */
-                mrrs = mps < dev_mpss ? mps : dev_mpss;
-        } else
-                /* In the "safe" case, configure the MRRS for fairness on the
-                 * bus by making all devices have the same size
-                 */
-                mrrs = mps;
+        dev_mpss = 128 << dev->pcie_mpss;
+        /* For Max performance, the MRRS must be set to the largest supported
+         * value.  However, it cannot be configured larger than the MPS the
+         * device or the bus can support.  This assumes that the largest MRRS
+         * available on the device cannot be smaller than the device MPSS.
+         */
+        mrrs = min(mps, dev_mpss);
        /* MRRS is a R/W register.  Invalid values can be written, but a
-         * subsiquent read will verify if the value is acceptable or not.
+         * subsequent read will verify if the value is acceptable or not.
         * If the MRRS value provided is not acceptable (e.g., too large),
         * shrink the value until it is acceptable to the HW.
         */
        while (mrrs != pcie_get_readrq(dev) && mrrs >= 128) {
+                dev_warn(&dev->dev, "Attempting to modify the PCI-E MRRS value"
+                         " to %d.  If any issues are encountered, please try "
+                         "running with pci=pcie_bus_safe\n", mrrs);
                rc = pcie_set_readrq(dev, mrrs);
                if (rc)
-                        dev_err(&dev->dev, "Failed attempting to set the MRRS\n");
+                        dev_err(&dev->dev,
+                                "Failed attempting to set the MRRS\n");
                mrrs /= 2;
        }
@@ -1436,13 +1440,13 @@ static int pcie_bus_configure_set(struct pci_dev *dev, void *data)
        if (!pci_is_pcie(dev))
                return 0;
-        dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n",
+        dev_dbg(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n",
                 pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev));
        pcie_write_mps(dev, mps);
        pcie_write_mrrs(dev, mps);
-        dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n",
+        dev_dbg(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n",
                 pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev));
        return 0;
@@ -1456,9 +1460,6 @@ void pcie_bus_configure_settings(struct pci_bus *bus, u8 mpss)
 {
        u8 smpss = mpss;
-        if (!bus->self)
-                return;
        if (!pci_is_pcie(bus->self))
                return;
diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
index ee893581d4b7..ebe77dd87daf 100644
--- a/drivers/rapidio/rio-scan.c
+++ b/drivers/rapidio/rio-scan.c
@@ -505,8 +505,7 @@ static struct rio_dev __devinit *rio_setup_device(struct rio_net *net,
        rdev->dev.dma_mask = &rdev->dma_mask;
        rdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
-        if ((rdev->pef & RIO_PEF_INB_DOORBELL) &&
+        if (rdev->dst_ops & RIO_DST_OPS_DOORBELL)
-            (rdev->dst_ops & RIO_DST_OPS_DOORBELL))
                rio_init_dbell_res(&rdev->riores[RIO_DOORBELL_RESOURCE],
                                   0, 0xffff);
diff --git a/drivers/rtc/rtc-ep93xx.c b/drivers/rtc/rtc-ep93xx.c
index 335551d333b2..14a42a1edc66 100644
--- a/drivers/rtc/rtc-ep93xx.c
+++ b/drivers/rtc/rtc-ep93xx.c
@@ -36,6 +36,7 @@
 */
 struct ep93xx_rtc {
        void __iomem    *mmio_base;
+        struct rtc_device *rtc;
 };
 static int ep93xx_rtc_get_swcomp(struct device *dev, unsigned short *preload,
@@ -130,7 +131,6 @@ static int __init ep93xx_rtc_probe(struct platform_device *pdev)
 {
        struct ep93xx_rtc *ep93xx_rtc;
        struct resource *res;
-        struct rtc_device *rtc;
        int err;
        ep93xx_rtc = devm_kzalloc(&pdev->dev, sizeof(*ep93xx_rtc), GFP_KERNEL);
@@ -151,12 +151,12 @@ static int __init ep93xx_rtc_probe(struct platform_device *pdev)
                return -ENXIO;
        pdev->dev.platform_data = ep93xx_rtc;
-        platform_set_drvdata(pdev, rtc);
+        platform_set_drvdata(pdev, ep93xx_rtc);
-        rtc = rtc_device_register(pdev->name,
+        ep93xx_rtc->rtc = rtc_device_register(pdev->name,
                                &pdev->dev, &ep93xx_rtc_ops, THIS_MODULE);
-        if (IS_ERR(rtc)) {
+        if (IS_ERR(ep93xx_rtc->rtc)) {
-                err = PTR_ERR(rtc);
+                err = PTR_ERR(ep93xx_rtc->rtc);
                goto exit;
        }
@@ -167,7 +167,7 @@ static int __init ep93xx_rtc_probe(struct platform_device *pdev)
        return 0;
 fail:
-        rtc_device_unregister(rtc);
+        rtc_device_unregister(ep93xx_rtc->rtc);
 exit:
        platform_set_drvdata(pdev, NULL);
        pdev->dev.platform_data = NULL;
@@ -176,11 +176,11 @@ exit:
 static int __exit ep93xx_rtc_remove(struct platform_device *pdev)
 {
-        struct rtc_device *rtc = platform_get_drvdata(pdev);
+        struct ep93xx_rtc *ep93xx_rtc = platform_get_drvdata(pdev);
        sysfs_remove_group(&pdev->dev.kobj, &ep93xx_rtc_sysfs_files);
        platform_set_drvdata(pdev, NULL);
-        rtc_device_unregister(rtc);
+        rtc_device_unregister(ep93xx_rtc->rtc);
        pdev->dev.platform_data = NULL;
        return 0;
diff --git a/drivers/rtc/rtc-imxdi.c b/drivers/rtc/rtc-imxdi.c
index 2dd3c0163272..d93a9608b1f0 100644
--- a/drivers/rtc/rtc-imxdi.c
+++ b/drivers/rtc/rtc-imxdi.c
@@ -35,6 +35,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/rtc.h>
+#include <linux/sched.h>
 #include <linux/workqueue.h>
 /* DryIce Register Definitions */
diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c
index 075f1708deae..c4cf05731118 100644
--- a/drivers/rtc/rtc-lib.c
+++ b/drivers/rtc/rtc-lib.c
@@ -85,6 +85,8 @@ void rtc_time_to_tm(unsigned long time, struct rtc_time *tm)
        time -= tm->tm_hour * 3600;
        tm->tm_min = time / 60;
        tm->tm_sec = time - tm->tm_min * 60;
+        tm->tm_isdst = 0;
 }
 EXPORT_SYMBOL(rtc_time_to_tm);
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 9329dbb9ebab..7639ab906f02 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -51,6 +51,27 @@ static enum s3c_cpu_type s3c_rtc_cpu_type;
 static DEFINE_SPINLOCK(s3c_rtc_pie_lock);
+static void s3c_rtc_alarm_clk_enable(bool enable)
+{
+        static DEFINE_SPINLOCK(s3c_rtc_alarm_clk_lock);
+        static bool alarm_clk_enabled;
+        unsigned long irq_flags;
+        spin_lock_irqsave(&s3c_rtc_alarm_clk_lock, irq_flags);
+        if (enable) {
+                if (!alarm_clk_enabled) {
+                        clk_enable(rtc_clk);
+                        alarm_clk_enabled = true;
+                }
+        } else {
+                if (alarm_clk_enabled) {
+                        clk_disable(rtc_clk);
+                        alarm_clk_enabled = false;
+                }
+        }
+        spin_unlock_irqrestore(&s3c_rtc_alarm_clk_lock, irq_flags);
+}
 /* IRQ Handlers */
 static irqreturn_t s3c_rtc_alarmirq(int irq, void *id)
@@ -64,6 +85,9 @@ static irqreturn_t s3c_rtc_alarmirq(int irq, void *id)
                writeb(S3C2410_INTP_ALM, s3c_rtc_base + S3C2410_INTP);
        clk_disable(rtc_clk);
+        s3c_rtc_alarm_clk_enable(false);
        return IRQ_HANDLED;
 }
@@ -97,6 +121,8 @@ static int s3c_rtc_setaie(struct device *dev, unsigned int enabled)
        writeb(tmp, s3c_rtc_base + S3C2410_RTCALM);
        clk_disable(rtc_clk);
+        s3c_rtc_alarm_clk_enable(enabled);
        return 0;
 }
@@ -152,10 +178,6 @@ static int s3c_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm)
                goto retry_get_time;
        }
-        pr_debug("read time %04d.%02d.%02d %02d:%02d:%02d\n",
-                 1900 + rtc_tm->tm_year, rtc_tm->tm_mon, rtc_tm->tm_mday,
-                 rtc_tm->tm_hour, rtc_tm->tm_min, rtc_tm->tm_sec);
        rtc_tm->tm_sec = bcd2bin(rtc_tm->tm_sec);
        rtc_tm->tm_min = bcd2bin(rtc_tm->tm_min);
        rtc_tm->tm_hour = bcd2bin(rtc_tm->tm_hour);
@@ -164,6 +186,11 @@ static int s3c_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm)
        rtc_tm->tm_year = bcd2bin(rtc_tm->tm_year);
        rtc_tm->tm_year += 100;
+        pr_debug("read time %04d.%02d.%02d %02d:%02d:%02d\n",
+                 1900 + rtc_tm->tm_year, rtc_tm->tm_mon, rtc_tm->tm_mday,
+                 rtc_tm->tm_hour, rtc_tm->tm_min, rtc_tm->tm_sec);
        rtc_tm->tm_mon -= 1;
        clk_disable(rtc_clk);
@@ -269,10 +296,9 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        clk_enable(rtc_clk);
        pr_debug("s3c_rtc_setalarm: %d, %04d.%02d.%02d %02d:%02d:%02d\n",
                 alrm->enabled,
-                 1900 + tm->tm_year, tm->tm_mon, tm->tm_mday,
+                 1900 + tm->tm_year, tm->tm_mon + 1, tm->tm_mday,
                 tm->tm_hour, tm->tm_min, tm->tm_sec);
        alrm_en = readb(base + S3C2410_RTCALM) & S3C2410_RTCALM_ALMEN;
        writeb(0x00, base + S3C2410_RTCALM);
@@ -319,49 +345,7 @@ static int s3c_rtc_proc(struct device *dev, struct seq_file *seq)
        return 0;
 }
-static int s3c_rtc_open(struct device *dev)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct rtc_device *rtc_dev = platform_get_drvdata(pdev);
-        int ret;
-        ret = request_irq(s3c_rtc_alarmno, s3c_rtc_alarmirq,
-                          IRQF_DISABLED,  "s3c2410-rtc alarm", rtc_dev);
-        if (ret) {
-                dev_err(dev, "IRQ%d error %d\n", s3c_rtc_alarmno, ret);
-                return ret;
-        }
-        ret = request_irq(s3c_rtc_tickno, s3c_rtc_tickirq,
-                          IRQF_DISABLED,  "s3c2410-rtc tick", rtc_dev);
-        if (ret) {
-                dev_err(dev, "IRQ%d error %d\n", s3c_rtc_tickno, ret);
-                goto tick_err;
-        }
-        return ret;
- tick_err:
-        free_irq(s3c_rtc_alarmno, rtc_dev);
-        return ret;
-}
-static void s3c_rtc_release(struct device *dev)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct rtc_device *rtc_dev = platform_get_drvdata(pdev);
-        /* do not clear AIE here, it may be needed for wake */
-        free_irq(s3c_rtc_alarmno, rtc_dev);
-        free_irq(s3c_rtc_tickno, rtc_dev);
-}
 static const struct rtc_class_ops s3c_rtcops = {
-        .open           = s3c_rtc_open,
-        .release        = s3c_rtc_release,
        .read_time      = s3c_rtc_gettime,
        .set_time       = s3c_rtc_settime,
        .read_alarm     = s3c_rtc_getalarm,
@@ -425,6 +409,9 @@ static int __devexit s3c_rtc_remove(struct platform_device *dev)
 {
        struct rtc_device *rtc = platform_get_drvdata(dev);
+        free_irq(s3c_rtc_alarmno, rtc);
+        free_irq(s3c_rtc_tickno, rtc);
        platform_set_drvdata(dev, NULL);
        rtc_device_unregister(rtc);
@@ -548,10 +535,32 @@ static int __devinit s3c_rtc_probe(struct platform_device *pdev)
        s3c_rtc_setfreq(&pdev->dev, 1);
+        ret = request_irq(s3c_rtc_alarmno, s3c_rtc_alarmirq,
+                          IRQF_DISABLED,  "s3c2410-rtc alarm", rtc);
+        if (ret) {
+                dev_err(&pdev->dev, "IRQ%d error %d\n", s3c_rtc_alarmno, ret);
+                goto err_alarm_irq;
+        }
+        ret = request_irq(s3c_rtc_tickno, s3c_rtc_tickirq,
+                          IRQF_DISABLED,  "s3c2410-rtc tick", rtc);
+        if (ret) {
+                dev_err(&pdev->dev, "IRQ%d error %d\n", s3c_rtc_tickno, ret);
+                free_irq(s3c_rtc_alarmno, rtc);
+                goto err_tick_irq;
+        }
        clk_disable(rtc_clk);
        return 0;
+ err_tick_irq:
+        free_irq(s3c_rtc_alarmno, rtc);
+ err_alarm_irq:
+        platform_set_drvdata(pdev, NULL);
+        rtc_device_unregister(rtc);
 err_nortc:
        s3c_rtc_enable(pdev, 0);
        clk_disable(rtc_clk);
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index 9a81f778d6b2..20687d55e7a7 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -362,14 +362,6 @@ static irqreturn_t twl_rtc_interrupt(int irq, void *rtc)
        int res;
        u8 rd_reg;
-#ifdef CONFIG_LOCKDEP
-        /* WORKAROUND for lockdep forcing IRQF_DISABLED on us, which
-         * we don't want and can't tolerate.  Although it might be
-         * friendlier not to borrow this thread context...
-         */
-        local_irq_enable();
-#endif
        res = twl_rtc_read_u8(&rd_reg, REG_RTC_STATUS_REG);
        if (res)
                goto out;
@@ -428,24 +420,12 @@ static struct rtc_class_ops twl_rtc_ops = {
 static int __devinit twl_rtc_probe(struct platform_device *pdev)
 {
        struct rtc_device *rtc;
-        int ret = 0;
+        int ret = -EINVAL;
        int irq = platform_get_irq(pdev, 0);
        u8 rd_reg;
        if (irq <= 0)
-                return -EINVAL;
+                goto out1;
-        rtc = rtc_device_register(pdev->name,
-                                  &pdev->dev, &twl_rtc_ops, THIS_MODULE);
-        if (IS_ERR(rtc)) {
-                ret = PTR_ERR(rtc);
-                dev_err(&pdev->dev, "can't register RTC device, err %ld\n",
-                        PTR_ERR(rtc));
-                goto out0;
-        }
-        platform_set_drvdata(pdev, rtc);
        ret = twl_rtc_read_u8(&rd_reg, REG_RTC_STATUS_REG);
        if (ret < 0)
@@ -462,14 +442,6 @@ static int __devinit twl_rtc_probe(struct platform_device *pdev)
        if (ret < 0)
                goto out1;
-        ret = request_irq(irq, twl_rtc_interrupt,
-                                IRQF_TRIGGER_RISING,
-                                dev_name(&rtc->dev), rtc);
-        if (ret < 0) {
-                dev_err(&pdev->dev, "IRQ is not free.\n");
-                goto out1;
-        }
        if (twl_class_is_6030()) {
                twl6030_interrupt_unmask(TWL6030_RTC_INT_MASK,
                        REG_INT_MSK_LINE_A);
@@ -480,28 +452,44 @@ static int __devinit twl_rtc_probe(struct platform_device *pdev)
        /* Check RTC module status, Enable if it is off */
        ret = twl_rtc_read_u8(&rd_reg, REG_RTC_CTRL_REG);
        if (ret < 0)
-                goto out2;
+                goto out1;
        if (!(rd_reg & BIT_RTC_CTRL_REG_STOP_RTC_M)) {
                dev_info(&pdev->dev, "Enabling TWL-RTC.\n");
                rd_reg = BIT_RTC_CTRL_REG_STOP_RTC_M;
                ret = twl_rtc_write_u8(rd_reg, REG_RTC_CTRL_REG);
                if (ret < 0)
-                        goto out2;
+                        goto out1;
        }
        /* init cached IRQ enable bits */
        ret = twl_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
        if (ret < 0)
+                goto out1;
+        rtc = rtc_device_register(pdev->name,
+                                  &pdev->dev, &twl_rtc_ops, THIS_MODULE);
+        if (IS_ERR(rtc)) {
+                ret = PTR_ERR(rtc);
+                dev_err(&pdev->dev, "can't register RTC device, err %ld\n",
+                        PTR_ERR(rtc));
+                goto out1;
+        }
+        ret = request_threaded_irq(irq, NULL, twl_rtc_interrupt,
+                                   IRQF_TRIGGER_RISING,
+                                   dev_name(&rtc->dev), rtc);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "IRQ is not free.\n");
                goto out2;
+        }
-        return ret;
+        platform_set_drvdata(pdev, rtc);
+        return 0;
 out2:
-        free_irq(irq, rtc);
-out1:
        rtc_device_unregister(rtc);
-out0:
+out1:
        return ret;
 }
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index eb4e034378cd..f1a2016829fc 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -249,6 +249,7 @@ static int dasd_ioctl_reset_profile(struct dasd_block *block)
 static int dasd_ioctl_read_profile(struct dasd_block *block, void __user *argp)
 {
        struct dasd_profile_info_t *data;
+        int rc = 0;
        data = kmalloc(sizeof(*data), GFP_KERNEL);
        if (!data)
@@ -279,11 +280,14 @@ static int dasd_ioctl_read_profile(struct dasd_block *block, void __user *argp)
                spin_unlock_bh(&block->profile.lock);
        } else {
                spin_unlock_bh(&block->profile.lock);
-                return -EIO;
+                rc = -EIO;
+                goto out;
        }
        if (copy_to_user(argp, data, sizeof(*data)))
-                return -EFAULT;
+                rc = -EFAULT;
-        return 0;
+out:
+        kfree(data);
+        return rc;
 }
 #else
 static int dasd_ioctl_reset_profile(struct dasd_block *block)
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index be55fb2b1b1c..837e010299a8 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -383,8 +383,10 @@ static int sclp_attach_storage(u8 id)
        switch (sccb->header.response_code) {
        case 0x0020:
                set_bit(id, sclp_storage_ids);
-                for (i = 0; i < sccb->assigned; i++)
+                for (i = 0; i < sccb->assigned; i++) {
-                        sclp_unassign_storage(sccb->entries[i] >> 16);
+                        if (sccb->entries[i])
+                                sclp_unassign_storage(sccb->entries[i] >> 16);
+                }
                break;
        default:
                rc = -EIO;
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 8d9dae89f065..3878b7395081 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -837,6 +837,7 @@ config SCSI_ISCI
        # (temporary): known alpha quality driver
        depends on EXPERIMENTAL
        select SCSI_SAS_LIBSAS
+        select SCSI_SAS_HOST_SMP
        ---help---
          This driver supports the 6Gb/s SAS capabilities of the storage
          control unit found in the Intel(R) C600 series chipset.
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index 9ae80cd5953b..dba72a4e6a1c 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -563,7 +563,7 @@ int bnx2i_send_iscsi_nopout(struct bnx2i_conn *bnx2i_conn,
        nopout_wqe->itt = ((u16)task->itt |
                           (ISCSI_TASK_TYPE_MPATH <<
                            ISCSI_TMF_REQUEST_TYPE_SHIFT));
-        nopout_wqe->ttt = nopout_hdr->ttt;
+        nopout_wqe->ttt = be32_to_cpu(nopout_hdr->ttt);
        nopout_wqe->flags = 0;
        if (!unsol)
                nopout_wqe->flags = ISCSI_NOP_OUT_REQUEST_LOCAL_COMPLETION;
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index ba710e350ac5..5d0e9a24ae94 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -432,6 +432,8 @@ void fcoe_interface_cleanup(struct fcoe_interface *fcoe)
        u8 flogi_maddr[ETH_ALEN];
        const struct net_device_ops *ops;
+        rtnl_lock();
        /*
         * Don't listen for Ethernet packets anymore.
         * synchronize_net() ensures that the packet handlers are not running
@@ -461,6 +463,8 @@ void fcoe_interface_cleanup(struct fcoe_interface *fcoe)
                                        " specific feature for LLD.\n");
        }
+        rtnl_unlock();
        /* Release the self-reference taken during fcoe_interface_create() */
        fcoe_interface_put(fcoe);
 }
@@ -1951,11 +1955,8 @@ static void fcoe_destroy_work(struct work_struct *work)
        fcoe_if_destroy(port->lport);
        /* Do not tear down the fcoe interface for NPIV port */
-        if (!npiv) {
+        if (!npiv)
-                rtnl_lock();
                fcoe_interface_cleanup(fcoe);
-                rtnl_unlock();
-        }
        mutex_unlock(&fcoe_config_mutex);
 }
@@ -2009,8 +2010,9 @@ static int fcoe_create(struct net_device *netdev, enum fip_state fip_mode)
                printk(KERN_ERR "fcoe: Failed to create interface (%s)\n",
                       netdev->name);
                rc = -EIO;
+                rtnl_unlock();
                fcoe_interface_cleanup(fcoe);
-                goto out_nodev;
+                goto out_nortnl;
        }
        /* Make this the "master" N_Port */
@@ -2027,6 +2029,7 @@ static int fcoe_create(struct net_device *netdev, enum fip_state fip_mode)
 out_nodev:
        rtnl_unlock();
+out_nortnl:
        mutex_unlock(&fcoe_config_mutex);
        return rc;
 }
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index ec61bdb833ac..b200b736b000 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -676,6 +676,16 @@ static void hpsa_scsi_replace_entry(struct ctlr_info *h, int hostno,
        BUG_ON(entry < 0 || entry >= HPSA_MAX_SCSI_DEVS_PER_HBA);
        removed[*nremoved] = h->dev[entry];
        (*nremoved)++;
+        /*
+         * New physical devices won't have target/lun assigned yet
+         * so we need to preserve the values in the slot we are replacing.
+         */
+        if (new_entry->target == -1) {
+                new_entry->target = h->dev[entry]->target;
+                new_entry->lun = h->dev[entry]->lun;
+        }
        h->dev[entry] = new_entry;
        added[*nadded] = new_entry;
        (*nadded)++;
@@ -1548,10 +1558,17 @@ static inline void hpsa_set_bus_target_lun(struct hpsa_scsi_dev_t *device,
 }
 static int hpsa_update_device_info(struct ctlr_info *h,
-        unsigned char scsi3addr[], struct hpsa_scsi_dev_t *this_device)
+        unsigned char scsi3addr[], struct hpsa_scsi_dev_t *this_device,
+        unsigned char *is_OBDR_device)
 {
-#define OBDR_TAPE_INQ_SIZE 49
+#define OBDR_SIG_OFFSET 43
+#define OBDR_TAPE_SIG "$DR-10"
+#define OBDR_SIG_LEN (sizeof(OBDR_TAPE_SIG) - 1)
+#define OBDR_TAPE_INQ_SIZE (OBDR_SIG_OFFSET + OBDR_SIG_LEN)
        unsigned char *inq_buff;
+        unsigned char *obdr_sig;
        inq_buff = kzalloc(OBDR_TAPE_INQ_SIZE, GFP_KERNEL);
        if (!inq_buff)
@@ -1583,6 +1600,16 @@ static int hpsa_update_device_info(struct ctlr_info *h,
        else
                this_device->raid_level = RAID_UNKNOWN;
+        if (is_OBDR_device) {
+                /* See if this is a One-Button-Disaster-Recovery device
+                 * by looking for "$DR-10" at offset 43 in inquiry data.
+                 */
+                obdr_sig = &inq_buff[OBDR_SIG_OFFSET];
+                *is_OBDR_device = (this_device->devtype == TYPE_ROM &&
+                                        strncmp(obdr_sig, OBDR_TAPE_SIG,
+                                                OBDR_SIG_LEN) == 0);
+        }
        kfree(inq_buff);
        return 0;
@@ -1716,7 +1743,7 @@ static int add_msa2xxx_enclosure_device(struct ctlr_info *h,
                return 0;
        }
-        if (hpsa_update_device_info(h, scsi3addr, this_device))
+        if (hpsa_update_device_info(h, scsi3addr, this_device, NULL))
                return 0;
        (*nmsa2xxx_enclosures)++;
        hpsa_set_bus_target_lun(this_device, bus, target, 0);
@@ -1808,7 +1835,6 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h, int hostno)
         */
        struct ReportLUNdata *physdev_list = NULL;
        struct ReportLUNdata *logdev_list = NULL;
-        unsigned char *inq_buff = NULL;
        u32 nphysicals = 0;
        u32 nlogicals = 0;
        u32 ndev_allocated = 0;
@@ -1824,11 +1850,9 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h, int hostno)
                GFP_KERNEL);
        physdev_list = kzalloc(reportlunsize, GFP_KERNEL);
        logdev_list = kzalloc(reportlunsize, GFP_KERNEL);
-        inq_buff = kmalloc(OBDR_TAPE_INQ_SIZE, GFP_KERNEL);
        tmpdevice = kzalloc(sizeof(*tmpdevice), GFP_KERNEL);
-        if (!currentsd || !physdev_list || !logdev_list ||
+        if (!currentsd || !physdev_list || !logdev_list || !tmpdevice) {
-                !inq_buff || !tmpdevice) {
                dev_err(&h->pdev->dev, "out of memory\n");
                goto out;
        }
@@ -1863,7 +1887,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h, int hostno)
        /* adjust our table of devices */
        nmsa2xxx_enclosures = 0;
        for (i = 0; i < nphysicals + nlogicals + 1; i++) {
-                u8 *lunaddrbytes;
+                u8 *lunaddrbytes, is_OBDR = 0;
                /* Figure out where the LUN ID info is coming from */
                lunaddrbytes = figure_lunaddrbytes(h, raid_ctlr_position,
@@ -1874,7 +1898,8 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h, int hostno)
                        continue;
                /* Get device type, vendor, model, device id */
-                if (hpsa_update_device_info(h, lunaddrbytes, tmpdevice))
+                if (hpsa_update_device_info(h, lunaddrbytes, tmpdevice,
+                                                        &is_OBDR))
                        continue; /* skip it if we can't talk to it. */
                figure_bus_target_lun(h, lunaddrbytes, &bus, &target, &lun,
                        tmpdevice);
@@ -1898,7 +1923,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h, int hostno)
                hpsa_set_bus_target_lun(this_device, bus, target, lun);
                switch (this_device->devtype) {
-                case TYPE_ROM: {
+                case TYPE_ROM:
                        /* We don't *really* support actual CD-ROM devices,
                         * just "One Button Disaster Recovery" tape drive
                         * which temporarily pretends to be a CD-ROM drive.
@@ -1906,15 +1931,8 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h, int hostno)
                         * device by checking for "$DR-10" in bytes 43-48 of
                         * the inquiry data.
                         */
-                                char obdr_sig[7];
+                        if (is_OBDR)
-#define OBDR_TAPE_SIG "$DR-10"
+                                ncurrent++;
-                                strncpy(obdr_sig, &inq_buff[43], 6);
-                                obdr_sig[6] = '\0';
-                                if (strncmp(obdr_sig, OBDR_TAPE_SIG, 6) != 0)
-                                        /* Not OBDR device, ignore it. */
-                                        break;
-                        }
-                        ncurrent++;
                        break;
                case TYPE_DISK:
                        if (i < nphysicals)
@@ -1947,7 +1965,6 @@ out:
        for (i = 0; i < ndev_allocated; i++)
                kfree(currentsd[i]);
        kfree(currentsd);
-        kfree(inq_buff);
        kfree(physdev_list);
        kfree(logdev_list);
 }
diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c
index 26072f1e9852..6981b773a88d 100644
--- a/drivers/scsi/isci/host.c
+++ b/drivers/scsi/isci/host.c
@@ -531,6 +531,9 @@ static void sci_controller_process_completions(struct isci_host *ihost)
                        break;
                case SCU_COMPLETION_TYPE_EVENT:
+                        sci_controller_event_completion(ihost, ent);
+                        break;
                case SCU_COMPLETION_TYPE_NOTIFY: {
                        event_cycle ^= ((event_get+1) & SCU_MAX_EVENTS) <<
                                       (SMU_COMPLETION_QUEUE_GET_EVENT_CYCLE_BIT_SHIFT - SCU_MAX_EVENTS_SHIFT);
@@ -1091,6 +1094,7 @@ static void isci_host_completion_routine(unsigned long data)
        struct isci_request *request;
        struct isci_request *next_request;
        struct sas_task     *task;
+        u16 active;
        INIT_LIST_HEAD(&completed_request_list);
        INIT_LIST_HEAD(&errored_request_list);
@@ -1181,6 +1185,13 @@ static void isci_host_completion_routine(unsigned long data)
                }
        }
+        /* the coalesence timeout doubles at each encoding step, so
+         * update it based on the ilog2 value of the outstanding requests
+         */
+        active = isci_tci_active(ihost);
+        writel(SMU_ICC_GEN_VAL(NUMBER, active) |
+               SMU_ICC_GEN_VAL(TIMER, ISCI_COALESCE_BASE + ilog2(active)),
+               &ihost->smu_registers->interrupt_coalesce_control);
 }
 /**
@@ -1471,7 +1482,7 @@ static void sci_controller_ready_state_enter(struct sci_base_state_machine *sm)
        struct isci_host *ihost = container_of(sm, typeof(*ihost), sm);
        /* set the default interrupt coalescence number and timeout value. */
-        sci_controller_set_interrupt_coalescence(ihost, 0x10, 250);
+        sci_controller_set_interrupt_coalescence(ihost, 0, 0);
 }
 static void sci_controller_ready_state_exit(struct sci_base_state_machine *sm)
diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h
index 062101a39f79..9f33831a2f04 100644
--- a/drivers/scsi/isci/host.h
+++ b/drivers/scsi/isci/host.h
@@ -369,6 +369,9 @@ static inline struct isci_host *dev_to_ihost(struct domain_device *dev)
 #define ISCI_TAG_SEQ(tag) (((tag) >> 12) & (SCI_MAX_SEQ-1))
 #define ISCI_TAG_TCI(tag) ((tag) & (SCI_MAX_IO_REQUESTS-1))
+/* interrupt coalescing baseline: 9 == 3 to 5us interrupt delay per command */
+#define ISCI_COALESCE_BASE 9
 /* expander attached sata devices require 3 rnc slots */
 static inline int sci_remote_device_node_count(struct isci_remote_device *idev)
 {
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index 61e0d09e2b57..29aa34efb0f5 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -59,10 +59,19 @@
 #include <linux/firmware.h>
 #include <linux/efi.h>
 #include <asm/string.h>
+#include <scsi/scsi_host.h>
 #include "isci.h"
 #include "task.h"
 #include "probe_roms.h"
+#define MAJ 1
+#define MIN 0
+#define BUILD 0
+#define DRV_VERSION __stringify(MAJ) "." __stringify(MIN) "." \
+        __stringify(BUILD)
+MODULE_VERSION(DRV_VERSION);
 static struct scsi_transport_template *isci_transport_template;
 static DEFINE_PCI_DEVICE_TABLE(isci_id_table) = {
@@ -113,6 +122,22 @@ unsigned char max_concurr_spinup = 1;
 module_param(max_concurr_spinup, byte, 0);
 MODULE_PARM_DESC(max_concurr_spinup, "Max concurrent device spinup");
+static ssize_t isci_show_id(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct Scsi_Host *shost = container_of(dev, typeof(*shost), shost_dev);
+        struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(shost);
+        struct isci_host *ihost = container_of(sas_ha, typeof(*ihost), sas_ha);
+        return snprintf(buf, PAGE_SIZE, "%d\n", ihost->id);
+}
+static DEVICE_ATTR(isci_id, S_IRUGO, isci_show_id, NULL);
+struct device_attribute *isci_host_attrs[] = {
+        &dev_attr_isci_id,
+        NULL
+};
 static struct scsi_host_template isci_sht = {
        .module                         = THIS_MODULE,
@@ -138,6 +163,7 @@ static struct scsi_host_template isci_sht = {
        .slave_alloc                    = sas_slave_alloc,
        .target_destroy                 = sas_target_destroy,
        .ioctl                          = sas_ioctl,
+        .shost_attrs                    = isci_host_attrs,
 };
 static struct sas_domain_function_template isci_transport_ops  = {
@@ -232,17 +258,6 @@ static int isci_register_sas_ha(struct isci_host *isci_host)
        return 0;
 }
-static ssize_t isci_show_id(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct Scsi_Host *shost = container_of(dev, typeof(*shost), shost_dev);
-        struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(shost);
-        struct isci_host *ihost = container_of(sas_ha, typeof(*ihost), sas_ha);
-        return snprintf(buf, PAGE_SIZE, "%d\n", ihost->id);
-}
-static DEVICE_ATTR(isci_id, S_IRUGO, isci_show_id, NULL);
 static void isci_unregister(struct isci_host *isci_host)
 {
        struct Scsi_Host *shost;
@@ -251,7 +266,6 @@ static void isci_unregister(struct isci_host *isci_host)
                return;
        shost = isci_host->shost;
-        device_remove_file(&shost->shost_dev, &dev_attr_isci_id);
        sas_unregister_ha(&isci_host->sas_ha);
@@ -415,14 +429,8 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
        if (err)
                goto err_shost_remove;
-        err = device_create_file(&shost->shost_dev, &dev_attr_isci_id);
-        if (err)
-                goto err_unregister_ha;
        return isci_host;
- err_unregister_ha:
-        sas_unregister_ha(&(isci_host->sas_ha));
 err_shost_remove:
        scsi_remove_host(shost);
 err_shost:
@@ -540,7 +548,8 @@ static __init int isci_init(void)
 {
        int err;
-        pr_info("%s: Intel(R) C600 SAS Controller Driver\n", DRV_NAME);
+        pr_info("%s: Intel(R) C600 SAS Controller Driver - version %s\n",
+                DRV_NAME, DRV_VERSION);
        isci_transport_template = sas_domain_attach_transport(&isci_transport_ops);
        if (!isci_transport_template)
diff --git a/drivers/scsi/isci/phy.c b/drivers/scsi/isci/phy.c
index 79313a7a2356..430fc8ff014a 100644
--- a/drivers/scsi/isci/phy.c
+++ b/drivers/scsi/isci/phy.c
@@ -104,6 +104,7 @@ sci_phy_link_layer_initialization(struct isci_phy *iphy,
        u32 parity_count = 0;
        u32 llctl, link_rate;
        u32 clksm_value = 0;
+        u32 sp_timeouts = 0;
        iphy->link_layer_registers = reg;
@@ -211,6 +212,18 @@ sci_phy_link_layer_initialization(struct isci_phy *iphy,
        llctl |= SCU_SAS_LLCTL_GEN_VAL(MAX_LINK_RATE, link_rate);
        writel(llctl, &iphy->link_layer_registers->link_layer_control);
+        sp_timeouts = readl(&iphy->link_layer_registers->sas_phy_timeouts);
+        /* Clear the default 0x36 (54us) RATE_CHANGE timeout value. */
+        sp_timeouts &= ~SCU_SAS_PHYTOV_GEN_VAL(RATE_CHANGE, 0xFF);
+        /* Set RATE_CHANGE timeout value to 0x3B (59us).  This ensures SCU can
+         * lock with 3Gb drive when SCU max rate is set to 1.5Gb.
+         */
+        sp_timeouts |= SCU_SAS_PHYTOV_GEN_VAL(RATE_CHANGE, 0x3B);
+        writel(sp_timeouts, &iphy->link_layer_registers->sas_phy_timeouts);
        if (is_a2(ihost->pdev)) {
                /* Program the max ARB time for the PHY to 700us so we inter-operate with
                 * the PMC expander which shuts down PHYs if the expander PHY generates too
diff --git a/drivers/scsi/isci/registers.h b/drivers/scsi/isci/registers.h
index 9b266c7428e8..00afc738bbed 100644
--- a/drivers/scsi/isci/registers.h
+++ b/drivers/scsi/isci/registers.h
@@ -1299,6 +1299,18 @@ struct scu_transport_layer_registers {
 #define SCU_AFE_XCVRCR_OFFSET       0x00DC
 #define SCU_AFE_LUTCR_OFFSET        0x00E0
+#define SCU_SAS_PHY_TIMER_TIMEOUT_VALUES_ALIGN_DETECTION_SHIFT          (0UL)
+#define SCU_SAS_PHY_TIMER_TIMEOUT_VALUES_ALIGN_DETECTION_MASK           (0x000000FFUL)
+#define SCU_SAS_PHY_TIMER_TIMEOUT_VALUES_HOT_PLUG_SHIFT                 (8UL)
+#define SCU_SAS_PHY_TIMER_TIMEOUT_VALUES_HOT_PLUG_MASK                  (0x0000FF00UL)
+#define SCU_SAS_PHY_TIMER_TIMEOUT_VALUES_COMSAS_DETECTION_SHIFT         (16UL)
+#define SCU_SAS_PHY_TIMER_TIMEOUT_VALUES_COMSAS_DETECTION_MASK          (0x00FF0000UL)
+#define SCU_SAS_PHY_TIMER_TIMEOUT_VALUES_RATE_CHANGE_SHIFT              (24UL)
+#define SCU_SAS_PHY_TIMER_TIMEOUT_VALUES_RATE_CHANGE_MASK               (0xFF000000UL)
+#define SCU_SAS_PHYTOV_GEN_VAL(name, value) \
+        SCU_GEN_VALUE(SCU_SAS_PHY_TIMER_TIMEOUT_VALUES_##name, value)
 #define SCU_SAS_LINK_LAYER_CONTROL_MAX_LINK_RATE_SHIFT                  (0)
 #define SCU_SAS_LINK_LAYER_CONTROL_MAX_LINK_RATE_MASK                   (0x00000003)
 #define SCU_SAS_LINK_LAYER_CONTROL_MAX_LINK_RATE_GEN1                   (0)
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
index a46e07ac789f..b5d3a8c4d329 100644
--- a/drivers/scsi/isci/request.c
+++ b/drivers/scsi/isci/request.c
@@ -732,12 +732,20 @@ sci_io_request_terminate(struct isci_request *ireq)
                sci_change_state(&ireq->sm, SCI_REQ_ABORTING);
                return SCI_SUCCESS;
        case SCI_REQ_TASK_WAIT_TC_RESP:
+                /* The task frame was already confirmed to have been
+                 * sent by the SCU HW.  Since the state machine is
+                 * now only waiting for the task response itself,
+                 * abort the request and complete it immediately
+                 * and don't wait for the task response.
+                 */
                sci_change_state(&ireq->sm, SCI_REQ_ABORTING);
                sci_change_state(&ireq->sm, SCI_REQ_COMPLETED);
                return SCI_SUCCESS;
        case SCI_REQ_ABORTING:
-                sci_change_state(&ireq->sm, SCI_REQ_COMPLETED);
+                /* If a request has a termination requested twice, return
-                return SCI_SUCCESS;
+                 * a failure indication, since HW confirmation of the first
+                 * abort is still outstanding.
+                 */
        case SCI_REQ_COMPLETED:
        default:
                dev_warn(&ireq->owning_controller->pdev->dev,
@@ -2399,22 +2407,19 @@ static void isci_task_save_for_upper_layer_completion(
        }
 }
-static void isci_request_process_stp_response(struct sas_task *task,
+static void isci_process_stp_response(struct sas_task *task, struct dev_to_host_fis *fis)
-                                              void *response_buffer)
 {
-        struct dev_to_host_fis *d2h_reg_fis = response_buffer;
        struct task_status_struct *ts = &task->task_status;
        struct ata_task_resp *resp = (void *)&ts->buf[0];
-        resp->frame_len = le16_to_cpu(*(__le16 *)(response_buffer + 6));
+        resp->frame_len = sizeof(*fis);
-        memcpy(&resp->ending_fis[0], response_buffer + 16, 24);
+        memcpy(resp->ending_fis, fis, sizeof(*fis));
        ts->buf_valid_size = sizeof(*resp);
-        /**
+        /* If the device fault bit is set in the status register, then
-         * If the device fault bit is set in the status register, then
         * set the sense data and return.
         */
-        if (d2h_reg_fis->status & ATA_DF)
+        if (fis->status & ATA_DF)
                ts->stat = SAS_PROTO_RESPONSE;
        else
                ts->stat = SAM_STAT_GOOD;
@@ -2428,7 +2433,6 @@ static void isci_request_io_request_complete(struct isci_host *ihost,
 {
        struct sas_task *task = isci_request_access_task(request);
        struct ssp_response_iu *resp_iu;
-        void *resp_buf;
        unsigned long task_flags;
        struct isci_remote_device *idev = isci_lookup_device(task->dev);
        enum service_response response       = SAS_TASK_UNDELIVERED;
@@ -2565,9 +2569,7 @@ static void isci_request_io_request_complete(struct isci_host *ihost,
                                task);
                        if (sas_protocol_ata(task->task_proto)) {
-                                resp_buf = &request->stp.rsp;
+                                isci_process_stp_response(task, &request->stp.rsp);
-                                isci_request_process_stp_response(task,
-                                                                  resp_buf);
                        } else if (SAS_PROTOCOL_SSP == task->task_proto) {
                                /* crack the iu response buffer. */
diff --git a/drivers/scsi/isci/unsolicited_frame_control.c b/drivers/scsi/isci/unsolicited_frame_control.c
index e9e1e2abacb9..16f88ab939c8 100644
--- a/drivers/scsi/isci/unsolicited_frame_control.c
+++ b/drivers/scsi/isci/unsolicited_frame_control.c
@@ -72,7 +72,7 @@ int sci_unsolicited_frame_control_construct(struct isci_host *ihost)
         */
        buf_len = SCU_MAX_UNSOLICITED_FRAMES * SCU_UNSOLICITED_FRAME_BUFFER_SIZE;
        header_len = SCU_MAX_UNSOLICITED_FRAMES * sizeof(struct scu_unsolicited_frame_header);
-        size = buf_len + header_len + SCU_MAX_UNSOLICITED_FRAMES * sizeof(dma_addr_t);
+        size = buf_len + header_len + SCU_MAX_UNSOLICITED_FRAMES * sizeof(uf_control->address_table.array[0]);
        /*
         * The Unsolicited Frame buffers are set at the start of the UF
diff --git a/drivers/scsi/isci/unsolicited_frame_control.h b/drivers/scsi/isci/unsolicited_frame_control.h
index 31cb9506f52d..75d896686f5a 100644
--- a/drivers/scsi/isci/unsolicited_frame_control.h
+++ b/drivers/scsi/isci/unsolicited_frame_control.h
@@ -214,7 +214,7 @@ struct sci_uf_address_table_array {
         * starting address of the UF address table.
         * 64-bit pointers are required by the hardware.
         */
-        dma_addr_t *array;
+        u64 *array;
        /**
         * This field specifies the physical address location for the UF
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 01ff082dc34c..d261e982a2fa 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -494,6 +494,9 @@ static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
         */
        error = lport->tt.frame_send(lport, fp);
+        if (fh->fh_type == FC_TYPE_BLS)
+                return error;
        /*
         * Update the exchange and sequence flags,
         * assuming all frames for the sequence have been sent.
@@ -575,42 +578,35 @@ static void fc_seq_set_resp(struct fc_seq *sp,
 }
 /**
- * fc_seq_exch_abort() - Abort an exchange and sequence
+ * fc_exch_abort_locked() - Abort an exchange
- * @req_sp:     The sequence to be aborted
+ * @ep: The exchange to be aborted
 * @timer_msec: The period of time to wait before aborting
 *
- * Generally called because of a timeout or an abort from the upper layer.
+ * Locking notes:  Called with exch lock held
+ *
+ * Return value: 0 on success else error code
 */
-static int fc_seq_exch_abort(const struct fc_seq *req_sp,
+static int fc_exch_abort_locked(struct fc_exch *ep,
-                             unsigned int timer_msec)
+                                unsigned int timer_msec)
 {
        struct fc_seq *sp;
-        struct fc_exch *ep;
        struct fc_frame *fp;
        int error;
-        ep = fc_seq_exch(req_sp);
-        spin_lock_bh(&ep->ex_lock);
        if (ep->esb_stat & (ESB_ST_COMPLETE | ESB_ST_ABNORMAL) ||
-            ep->state & (FC_EX_DONE | FC_EX_RST_CLEANUP)) {
+            ep->state & (FC_EX_DONE | FC_EX_RST_CLEANUP))
-                spin_unlock_bh(&ep->ex_lock);
                return -ENXIO;
-        }
        /*
         * Send the abort on a new sequence if possible.
         */
        sp = fc_seq_start_next_locked(&ep->seq);
-        if (!sp) {
+        if (!sp)
-                spin_unlock_bh(&ep->ex_lock);
                return -ENOMEM;
-        }
        ep->esb_stat |= ESB_ST_SEQ_INIT | ESB_ST_ABNORMAL;
        if (timer_msec)
                fc_exch_timer_set_locked(ep, timer_msec);
-        spin_unlock_bh(&ep->ex_lock);
        /*
         * If not logged into the fabric, don't send ABTS but leave
@@ -633,6 +629,28 @@ static int fc_seq_exch_abort(const struct fc_seq *req_sp,
 }
 /**
+ * fc_seq_exch_abort() - Abort an exchange and sequence
+ * @req_sp:     The sequence to be aborted
+ * @timer_msec: The period of time to wait before aborting
+ *
+ * Generally called because of a timeout or an abort from the upper layer.
+ *
+ * Return value: 0 on success else error code
+ */
+static int fc_seq_exch_abort(const struct fc_seq *req_sp,
+                             unsigned int timer_msec)
+{
+        struct fc_exch *ep;
+        int error;
+        ep = fc_seq_exch(req_sp);
+        spin_lock_bh(&ep->ex_lock);
+        error = fc_exch_abort_locked(ep, timer_msec);
+        spin_unlock_bh(&ep->ex_lock);
+        return error;
+}
+/**
 * fc_exch_timeout() - Handle exchange timer expiration
 * @work: The work_struct identifying the exchange that timed out
 */
@@ -1715,6 +1733,7 @@ static void fc_exch_reset(struct fc_exch *ep)
        int rc = 1;
        spin_lock_bh(&ep->ex_lock);
+        fc_exch_abort_locked(ep, 0);
        ep->state |= FC_EX_RST_CLEANUP;
        if (cancel_delayed_work(&ep->timeout_work))
                atomic_dec(&ep->ex_refcnt);     /* drop hold for timer */
@@ -1962,6 +1981,7 @@ static struct fc_seq *fc_exch_seq_send(struct fc_lport *lport,
        struct fc_exch *ep;
        struct fc_seq *sp = NULL;
        struct fc_frame_header *fh;
+        struct fc_fcp_pkt *fsp = NULL;
        int rc = 1;
        ep = fc_exch_alloc(lport, fp);
@@ -1984,8 +2004,10 @@ static struct fc_seq *fc_exch_seq_send(struct fc_lport *lport,
        fc_exch_setup_hdr(ep, fp, ep->f_ctl);
        sp->cnt++;
-        if (ep->xid <= lport->lro_xid && fh->fh_r_ctl == FC_RCTL_DD_UNSOL_CMD)
+        if (ep->xid <= lport->lro_xid && fh->fh_r_ctl == FC_RCTL_DD_UNSOL_CMD) {
+                fsp = fr_fsp(fp);
                fc_fcp_ddp_setup(fr_fsp(fp), ep->xid);
+        }
        if (unlikely(lport->tt.frame_send(lport, fp)))
                goto err;
@@ -1999,7 +2021,8 @@ static struct fc_seq *fc_exch_seq_send(struct fc_lport *lport,
        spin_unlock_bh(&ep->ex_lock);
        return sp;
 err:
-        fc_fcp_ddp_done(fr_fsp(fp));
+        if (fsp)
+                fc_fcp_ddp_done(fsp);
        rc = fc_exch_done_locked(ep);
        spin_unlock_bh(&ep->ex_lock);
        if (!rc)
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index afb63c843144..4c41ee816f0b 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -2019,6 +2019,11 @@ int fc_eh_abort(struct scsi_cmnd *sc_cmd)
        struct fc_fcp_internal *si;
        int rc = FAILED;
        unsigned long flags;
+        int rval;
+        rval = fc_block_scsi_eh(sc_cmd);
+        if (rval)
+                return rval;
        lport = shost_priv(sc_cmd->device->host);
        if (lport->state != LPORT_ST_READY)
@@ -2068,9 +2073,9 @@ int fc_eh_device_reset(struct scsi_cmnd *sc_cmd)
        int rc = FAILED;
        int rval;
-        rval = fc_remote_port_chkready(rport);
+        rval = fc_block_scsi_eh(sc_cmd);
        if (rval)
-                goto out;
+                return rval;
        lport = shost_priv(sc_cmd->device->host);
@@ -2116,6 +2121,8 @@ int fc_eh_host_reset(struct scsi_cmnd *sc_cmd)
        FC_SCSI_DBG(lport, "Resetting host\n");
+        fc_block_scsi_eh(sc_cmd);
        lport->tt.lport_reset(lport);
        wait_tmo = jiffies + FC_HOST_RESET_TIMEOUT;
        while (!fc_fcp_lport_queue_ready(lport) && time_before(jiffies,
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index e55ed9cf23fb..628f347404f9 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -88,6 +88,7 @@
 */
 #include <linux/timer.h>
+#include <linux/delay.h>
 #include <linux/slab.h>
 #include <asm/unaligned.h>
@@ -1029,8 +1030,16 @@ static void fc_lport_enter_reset(struct fc_lport *lport)
                           FCH_EVT_LIPRESET, 0);
        fc_vports_linkchange(lport);
        fc_lport_reset_locked(lport);
-        if (lport->link_up)
+        if (lport->link_up) {
+                /*
+                 * Wait upto resource allocation time out before
+                 * doing re-login since incomplete FIP exchanged
+                 * from last session may collide with exchanges
+                 * in new session.
+                 */
+                msleep(lport->r_a_tov);
                fc_lport_enter_flogi(lport);
+        }
 }
 /**
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 7836eb01c7fc..a31e05f3bfd4 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1786,13 +1786,16 @@ qla24xx_vport_create(struct fc_vport *fc_vport, bool disable)
                        fc_vport_set_state(fc_vport, FC_VPORT_LINKDOWN);
        }
-        if ((IS_QLA25XX(ha) || IS_QLA81XX(ha)) && ql2xenabledif) {
+        if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) {
                if (ha->fw_attributes & BIT_4) {
+                        int prot = 0;
                        vha->flags.difdix_supported = 1;
                        ql_dbg(ql_dbg_user, vha, 0x7082,
                            "Registered for DIF/DIX type 1 and 3 protection.\n");
+                        if (ql2xenabledif == 1)
+                                prot = SHOST_DIX_TYPE0_PROTECTION;
                        scsi_host_set_prot(vha->host,
-                            SHOST_DIF_TYPE1_PROTECTION
+                            prot | SHOST_DIF_TYPE1_PROTECTION
                            | SHOST_DIF_TYPE2_PROTECTION
                            | SHOST_DIF_TYPE3_PROTECTION
                            | SHOST_DIX_TYPE1_PROTECTION
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 2155071f3100..d79cd8a5f831 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -8,24 +8,24 @@
 /*
 * Table for showing the current message id in use for particular level
 * Change this table for addition of log/debug messages.
- * -----------------------------------------------------
+ * ----------------------------------------------------------------------
- * |             Level            |   Last Value Used  |
+ * |             Level            |   Last Value Used  |     Holes      |
- * -----------------------------------------------------
+ * ----------------------------------------------------------------------
- * | Module Init and Probe        |       0x0116       |
+ * | Module Init and Probe        |       0x0116       |                |
- * | Mailbox commands             |       0x111e       |
+ * | Mailbox commands             |       0x1126       |                |
- * | Device Discovery             |       0x2083       |
+ * | Device Discovery             |       0x2083       |                |
- * | Queue Command and IO tracing |       0x302e       |
+ * | Queue Command and IO tracing |       0x302e       |     0x3008     |
- * | DPC Thread                   |       0x401c       |
+ * | DPC Thread                   |       0x401c       |                |
- * | Async Events                 |       0x5059       |
+ * | Async Events                 |       0x5059       |                |
- * | Timer Routines               |       0x600d       |
+ * | Timer Routines               |       0x600d       |                |
- * | User Space Interactions      |       0x709c       |
+ * | User Space Interactions      |       0x709d       |                |
- * | Task Management              |       0x8043       |
+ * | Task Management              |       0x8041       |                |
- * | AER/EEH                      |       0x900f       |
+ * | AER/EEH                      |       0x900f       |                |
- * | Virtual Port                 |       0xa007       |
+ * | Virtual Port                 |       0xa007       |                |
- * | ISP82XX Specific             |       0xb027       |
+ * | ISP82XX Specific             |       0xb04f       |                |
- * | MultiQ                       |       0xc00b       |
+ * | MultiQ                       |       0xc00b       |                |
- * | Misc                         |       0xd00b       |
+ * | Misc                         |       0xd00b       |                |
- * -----------------------------------------------------
+ * ----------------------------------------------------------------------
 */
 #include "qla_def.h"
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index cc5a79259d33..a03eaf40f377 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -2529,6 +2529,7 @@ struct qla_hw_data {
 #define DT_ISP8021                      BIT_14
 #define DT_ISP_LAST                     (DT_ISP8021 << 1)
+#define DT_T10_PI                       BIT_25
 #define DT_IIDMA                        BIT_26
 #define DT_FWI2                         BIT_27
 #define DT_ZIO_SUPPORTED                BIT_28
@@ -2572,6 +2573,7 @@ struct qla_hw_data {
 #define IS_NOCACHE_VPD_TYPE(ha) (IS_QLA81XX(ha))
 #define IS_ALOGIO_CAPABLE(ha)   (IS_QLA23XX(ha) || IS_FWI2_CAPABLE(ha))
+#define IS_T10_PI_CAPABLE(ha)   ((ha)->device_type & DT_T10_PI)
 #define IS_IIDMA_CAPABLE(ha)    ((ha)->device_type & DT_IIDMA)
 #define IS_FWI2_CAPABLE(ha)     ((ha)->device_type & DT_FWI2)
 #define IS_ZIO_SUPPORTED(ha)    ((ha)->device_type & DT_ZIO_SUPPORTED)
diff --git a/drivers/scsi/qla2xxx/qla_fw.h b/drivers/scsi/qla2xxx/qla_fw.h
index 691783abfb69..aa69486dc064 100644
--- a/drivers/scsi/qla2xxx/qla_fw.h
+++ b/drivers/scsi/qla2xxx/qla_fw.h
@@ -537,6 +537,11 @@ struct sts_entry_24xx {
        /*
         * If DIF Error is set in comp_status, these additional fields are
         * defined:
+         *
+         * !!! NOTE: Firmware sends expected/actual DIF data in big endian
+         * format; but all of the "data" field gets swab32-d in the beginning
+         * of qla2x00_status_entry().
+         *
         * &data[10] : uint8_t report_runt_bg[2];       - computed guard
         * &data[12] : uint8_t actual_dif[8];           - DIF Data received
         * &data[20] : uint8_t expected_dif[8];         - DIF Data computed
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index def694271bf7..37da04d3db26 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -3838,15 +3838,12 @@ qla2x00_loop_resync(scsi_qla_host_t *vha)
                req = vha->req;
        rsp = req->rsp;
-        atomic_set(&vha->loop_state, LOOP_UPDATE);
        clear_bit(ISP_ABORT_RETRY, &vha->dpc_flags);
        if (vha->flags.online) {
                if (!(rval = qla2x00_fw_ready(vha))) {
                        /* Wait at most MAX_TARGET RSCNs for a stable link. */
                        wait_time = 256;
                        do {
-                                atomic_set(&vha->loop_state, LOOP_UPDATE);
                                /* Issue a marker after FW becomes ready. */
                                qla2x00_marker(vha, req, rsp, 0, 0,
                                        MK_SYNC_ALL);
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index d2e904bc21c0..9902834e0b74 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -102,3 +102,32 @@ qla2x00_set_fcport_state(fc_port_t *fcport, int state)
                    fcport->d_id.b.al_pa);
        }
 }
+static inline int
+qla2x00_hba_err_chk_enabled(srb_t *sp)
+{
+        /*
+         * Uncomment when corresponding SCSI changes are done.
+         *
+        if (!sp->cmd->prot_chk)
+                return 0;
+         *
+         */
+        switch (scsi_get_prot_op(sp->cmd)) {
+        case SCSI_PROT_READ_STRIP:
+        case SCSI_PROT_WRITE_INSERT:
+                if (ql2xenablehba_err_chk >= 1)
+                        return 1;
+                break;
+        case SCSI_PROT_READ_PASS:
+        case SCSI_PROT_WRITE_PASS:
+                if (ql2xenablehba_err_chk >= 2)
+                        return 1;
+                break;
+        case SCSI_PROT_READ_INSERT:
+        case SCSI_PROT_WRITE_STRIP:
+                return 1;
+        }
+        return 0;
+}
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 49d6906af886..dbec89622a0f 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -709,20 +709,28 @@ struct fw_dif_context {
 *
 */
 static inline void
-qla24xx_set_t10dif_tags(struct scsi_cmnd *cmd, struct fw_dif_context *pkt,
+qla24xx_set_t10dif_tags(srb_t *sp, struct fw_dif_context *pkt,
    unsigned int protcnt)
 {
-        struct sd_dif_tuple *spt;
+        struct scsi_cmnd *cmd = sp->cmd;
        scsi_qla_host_t *vha = shost_priv(cmd->device->host);
-        unsigned char op = scsi_get_prot_op(cmd);
        switch (scsi_get_prot_type(cmd)) {
-        /* For TYPE 0 protection: no checking */
        case SCSI_PROT_DIF_TYPE0:
-                pkt->ref_tag_mask[0] = 0x00;
+                /*
-                pkt->ref_tag_mask[1] = 0x00;
+                 * No check for ql2xenablehba_err_chk, as it would be an
-                pkt->ref_tag_mask[2] = 0x00;
+                 * I/O error if hba tag generation is not done.
-                pkt->ref_tag_mask[3] = 0x00;
+                 */
+                pkt->ref_tag = cpu_to_le32((uint32_t)
+                    (0xffffffff & scsi_get_lba(cmd)));
+                if (!qla2x00_hba_err_chk_enabled(sp))
+                        break;
+                pkt->ref_tag_mask[0] = 0xff;
+                pkt->ref_tag_mask[1] = 0xff;
+                pkt->ref_tag_mask[2] = 0xff;
+                pkt->ref_tag_mask[3] = 0xff;
                break;
        /*
@@ -730,20 +738,16 @@ qla24xx_set_t10dif_tags(struct scsi_cmnd *cmd, struct fw_dif_context *pkt,
         * match LBA in CDB + N
         */
        case SCSI_PROT_DIF_TYPE2:
-                if (!ql2xenablehba_err_chk)
+                pkt->app_tag = __constant_cpu_to_le16(0);
-                        break;
+                pkt->app_tag_mask[0] = 0x0;
+                pkt->app_tag_mask[1] = 0x0;
-                if (scsi_prot_sg_count(cmd)) {
-                        spt = page_address(sg_page(scsi_prot_sglist(cmd))) +
-                            scsi_prot_sglist(cmd)[0].offset;
-                        pkt->app_tag = swab32(spt->app_tag);
-                        pkt->app_tag_mask[0] =  0xff;
-                        pkt->app_tag_mask[1] =  0xff;
-                }
                pkt->ref_tag = cpu_to_le32((uint32_t)
                    (0xffffffff & scsi_get_lba(cmd)));
+                if (!qla2x00_hba_err_chk_enabled(sp))
+                        break;
                /* enable ALL bytes of the ref tag */
                pkt->ref_tag_mask[0] = 0xff;
                pkt->ref_tag_mask[1] = 0xff;
@@ -763,26 +767,15 @@ qla24xx_set_t10dif_tags(struct scsi_cmnd *cmd, struct fw_dif_context *pkt,
         * 16 bit app tag.
         */
        case SCSI_PROT_DIF_TYPE1:
-                if (!ql2xenablehba_err_chk)
+                pkt->ref_tag = cpu_to_le32((uint32_t)
+                    (0xffffffff & scsi_get_lba(cmd)));
+                pkt->app_tag = __constant_cpu_to_le16(0);
+                pkt->app_tag_mask[0] = 0x0;
+                pkt->app_tag_mask[1] = 0x0;
+                if (!qla2x00_hba_err_chk_enabled(sp))
                        break;
-                if (protcnt && (op == SCSI_PROT_WRITE_STRIP ||
-                    op == SCSI_PROT_WRITE_PASS)) {
-                        spt = page_address(sg_page(scsi_prot_sglist(cmd))) +
-                            scsi_prot_sglist(cmd)[0].offset;
-                        ql_dbg(ql_dbg_io, vha, 0x3008,
-                            "LBA from user %p, lba = 0x%x for cmd=%p.\n",
-                            spt, (int)spt->ref_tag, cmd);
-                        pkt->ref_tag = swab32(spt->ref_tag);
-                        pkt->app_tag_mask[0] = 0x0;
-                        pkt->app_tag_mask[1] = 0x0;
-                } else {
-                        pkt->ref_tag = cpu_to_le32((uint32_t)
-                            (0xffffffff & scsi_get_lba(cmd)));
-                        pkt->app_tag = __constant_cpu_to_le16(0);
-                        pkt->app_tag_mask[0] = 0x0;
-                        pkt->app_tag_mask[1] = 0x0;
-                }
                /* enable ALL bytes of the ref tag */
                pkt->ref_tag_mask[0] = 0xff;
                pkt->ref_tag_mask[1] = 0xff;
@@ -798,8 +791,162 @@ qla24xx_set_t10dif_tags(struct scsi_cmnd *cmd, struct fw_dif_context *pkt,
            scsi_get_prot_type(cmd), cmd);
 }
+struct qla2_sgx {
+        dma_addr_t              dma_addr;       /* OUT */
+        uint32_t                dma_len;        /* OUT */
+        uint32_t                tot_bytes;      /* IN */
+        struct scatterlist      *cur_sg;        /* IN */
+        /* for book keeping, bzero on initial invocation */
+        uint32_t                bytes_consumed;
+        uint32_t                num_bytes;
+        uint32_t                tot_partial;
+        /* for debugging */
+        uint32_t                num_sg;
+        srb_t                   *sp;
+};
 static int
+qla24xx_get_one_block_sg(uint32_t blk_sz, struct qla2_sgx *sgx,
+        uint32_t *partial)
+{
+        struct scatterlist *sg;
+        uint32_t cumulative_partial, sg_len;
+        dma_addr_t sg_dma_addr;
+        if (sgx->num_bytes == sgx->tot_bytes)
+                return 0;
+        sg = sgx->cur_sg;
+        cumulative_partial = sgx->tot_partial;
+        sg_dma_addr = sg_dma_address(sg);
+        sg_len = sg_dma_len(sg);
+        sgx->dma_addr = sg_dma_addr + sgx->bytes_consumed;
+        if ((cumulative_partial + (sg_len - sgx->bytes_consumed)) >= blk_sz) {
+                sgx->dma_len = (blk_sz - cumulative_partial);
+                sgx->tot_partial = 0;
+                sgx->num_bytes += blk_sz;
+                *partial = 0;
+        } else {
+                sgx->dma_len = sg_len - sgx->bytes_consumed;
+                sgx->tot_partial += sgx->dma_len;
+                *partial = 1;
+        }
+        sgx->bytes_consumed += sgx->dma_len;
+        if (sg_len == sgx->bytes_consumed) {
+                sg = sg_next(sg);
+                sgx->num_sg++;
+                sgx->cur_sg = sg;
+                sgx->bytes_consumed = 0;
+        }
+        return 1;
+}
+static int
+qla24xx_walk_and_build_sglist_no_difb(struct qla_hw_data *ha, srb_t *sp,
+        uint32_t *dsd, uint16_t tot_dsds)
+{
+        void *next_dsd;
+        uint8_t avail_dsds = 0;
+        uint32_t dsd_list_len;
+        struct dsd_dma *dsd_ptr;
+        struct scatterlist *sg_prot;
+        uint32_t *cur_dsd = dsd;
+        uint16_t        used_dsds = tot_dsds;
+        uint32_t        prot_int;
+        uint32_t        partial;
+        struct qla2_sgx sgx;
+        dma_addr_t      sle_dma;
+        uint32_t        sle_dma_len, tot_prot_dma_len = 0;
+        struct scsi_cmnd *cmd = sp->cmd;
+        prot_int = cmd->device->sector_size;
+        memset(&sgx, 0, sizeof(struct qla2_sgx));
+        sgx.tot_bytes = scsi_bufflen(sp->cmd);
+        sgx.cur_sg = scsi_sglist(sp->cmd);
+        sgx.sp = sp;
+        sg_prot = scsi_prot_sglist(sp->cmd);
+        while (qla24xx_get_one_block_sg(prot_int, &sgx, &partial)) {
+                sle_dma = sgx.dma_addr;
+                sle_dma_len = sgx.dma_len;
+alloc_and_fill:
+                /* Allocate additional continuation packets? */
+                if (avail_dsds == 0) {
+                        avail_dsds = (used_dsds > QLA_DSDS_PER_IOCB) ?
+                                        QLA_DSDS_PER_IOCB : used_dsds;
+                        dsd_list_len = (avail_dsds + 1) * 12;
+                        used_dsds -= avail_dsds;
+                        /* allocate tracking DS */
+                        dsd_ptr = kzalloc(sizeof(struct dsd_dma), GFP_ATOMIC);
+                        if (!dsd_ptr)
+                                return 1;
+                        /* allocate new list */
+                        dsd_ptr->dsd_addr = next_dsd =
+                            dma_pool_alloc(ha->dl_dma_pool, GFP_ATOMIC,
+                                &dsd_ptr->dsd_list_dma);
+                        if (!next_dsd) {
+                                /*
+                                 * Need to cleanup only this dsd_ptr, rest
+                                 * will be done by sp_free_dma()
+                                 */
+                                kfree(dsd_ptr);
+                                return 1;
+                        }
+                        list_add_tail(&dsd_ptr->list,
+                            &((struct crc_context *)sp->ctx)->dsd_list);
+                        sp->flags |= SRB_CRC_CTX_DSD_VALID;
+                        /* add new list to cmd iocb or last list */
+                        *cur_dsd++ = cpu_to_le32(LSD(dsd_ptr->dsd_list_dma));
+                        *cur_dsd++ = cpu_to_le32(MSD(dsd_ptr->dsd_list_dma));
+                        *cur_dsd++ = dsd_list_len;
+                        cur_dsd = (uint32_t *)next_dsd;
+                }
+                *cur_dsd++ = cpu_to_le32(LSD(sle_dma));
+                *cur_dsd++ = cpu_to_le32(MSD(sle_dma));
+                *cur_dsd++ = cpu_to_le32(sle_dma_len);
+                avail_dsds--;
+                if (partial == 0) {
+                        /* Got a full protection interval */
+                        sle_dma = sg_dma_address(sg_prot) + tot_prot_dma_len;
+                        sle_dma_len = 8;
+                        tot_prot_dma_len += sle_dma_len;
+                        if (tot_prot_dma_len == sg_dma_len(sg_prot)) {
+                                tot_prot_dma_len = 0;
+                                sg_prot = sg_next(sg_prot);
+                        }
+                        partial = 1; /* So as to not re-enter this block */
+                        goto alloc_and_fill;
+                }
+        }
+        /* Null termination */
+        *cur_dsd++ = 0;
+        *cur_dsd++ = 0;
+        *cur_dsd++ = 0;
+        return 0;
+}
+static int
 qla24xx_walk_and_build_sglist(struct qla_hw_data *ha, srb_t *sp, uint32_t *dsd,
        uint16_t tot_dsds)
 {
@@ -981,7 +1128,7 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
        struct scsi_cmnd        *cmd;
        struct scatterlist      *cur_seg;
        int                     sgc;
-        uint32_t                total_bytes;
+        uint32_t                total_bytes = 0;
        uint32_t                data_bytes;
        uint32_t                dif_bytes;
        uint8_t                 bundling = 1;
@@ -1023,8 +1170,10 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
                    __constant_cpu_to_le16(CF_READ_DATA);
        }
-        tot_prot_dsds = scsi_prot_sg_count(cmd);
+        if ((scsi_get_prot_op(sp->cmd) == SCSI_PROT_READ_INSERT) ||
-        if (!tot_prot_dsds)
+            (scsi_get_prot_op(sp->cmd) == SCSI_PROT_WRITE_STRIP) ||
+            (scsi_get_prot_op(sp->cmd) == SCSI_PROT_READ_STRIP) ||
+            (scsi_get_prot_op(sp->cmd) == SCSI_PROT_WRITE_INSERT))
                bundling = 0;
        /* Allocate CRC context from global pool */
@@ -1047,7 +1196,7 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
        INIT_LIST_HEAD(&crc_ctx_pkt->dsd_list);
-        qla24xx_set_t10dif_tags(cmd, (struct fw_dif_context *)
+        qla24xx_set_t10dif_tags(sp, (struct fw_dif_context *)
            &crc_ctx_pkt->ref_tag, tot_prot_dsds);
        cmd_pkt->crc_context_address[0] = cpu_to_le32(LSD(crc_ctx_dma));
@@ -1076,7 +1225,6 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
                fcp_cmnd->additional_cdb_len |= 2;
        int_to_scsilun(sp->cmd->device->lun, &fcp_cmnd->lun);
-        host_to_fcp_swap((uint8_t *)&fcp_cmnd->lun, sizeof(fcp_cmnd->lun));
        memcpy(fcp_cmnd->cdb, cmd->cmnd, cmd->cmd_len);
        cmd_pkt->fcp_cmnd_dseg_len = cpu_to_le16(fcp_cmnd_len);
        cmd_pkt->fcp_cmnd_dseg_address[0] = cpu_to_le32(
@@ -1107,15 +1255,28 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
        cmd_pkt->fcp_rsp_dseg_len = 0; /* Let response come in status iocb */
        /* Compute dif len and adjust data len to incude protection */
-        total_bytes = data_bytes;
        dif_bytes = 0;
        blk_size = cmd->device->sector_size;
-        if (scsi_get_prot_op(cmd) != SCSI_PROT_NORMAL) {
+        dif_bytes = (data_bytes / blk_size) * 8;
-                dif_bytes = (data_bytes / blk_size) * 8;
-                total_bytes += dif_bytes;
+        switch (scsi_get_prot_op(sp->cmd)) {
+        case SCSI_PROT_READ_INSERT:
+        case SCSI_PROT_WRITE_STRIP:
+            total_bytes = data_bytes;
+            data_bytes += dif_bytes;
+            break;
+        case SCSI_PROT_READ_STRIP:
+        case SCSI_PROT_WRITE_INSERT:
+        case SCSI_PROT_READ_PASS:
+        case SCSI_PROT_WRITE_PASS:
+            total_bytes = data_bytes + dif_bytes;
+            break;
+        default:
+            BUG();
        }
-        if (!ql2xenablehba_err_chk)
+        if (!qla2x00_hba_err_chk_enabled(sp))
                fw_prot_opts |= 0x10; /* Disable Guard tag checking */
        if (!bundling) {
@@ -1151,7 +1312,12 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
        cmd_pkt->control_flags |=
            __constant_cpu_to_le16(CF_DATA_SEG_DESCR_ENABLE);
-        if (qla24xx_walk_and_build_sglist(ha, sp, cur_dsd,
+        if (!bundling && tot_prot_dsds) {
+                if (qla24xx_walk_and_build_sglist_no_difb(ha, sp,
+                    cur_dsd, tot_dsds))
+                        goto crc_queuing_error;
+        } else if (qla24xx_walk_and_build_sglist(ha, sp, cur_dsd,
            (tot_dsds - tot_prot_dsds)))
                goto crc_queuing_error;
@@ -1414,6 +1580,22 @@ qla24xx_dif_start_scsi(srb_t *sp)
                        goto queuing_error;
                else
                        sp->flags |= SRB_DMA_VALID;
+                if ((scsi_get_prot_op(cmd) == SCSI_PROT_READ_INSERT) ||
+                    (scsi_get_prot_op(cmd) == SCSI_PROT_WRITE_STRIP)) {
+                        struct qla2_sgx sgx;
+                        uint32_t        partial;
+                        memset(&sgx, 0, sizeof(struct qla2_sgx));
+                        sgx.tot_bytes = scsi_bufflen(cmd);
+                        sgx.cur_sg = scsi_sglist(cmd);
+                        sgx.sp = sp;
+                        nseg = 0;
+                        while (qla24xx_get_one_block_sg(
+                            cmd->device->sector_size, &sgx, &partial))
+                                nseg++;
+                }
        } else
                nseg = 0;
@@ -1428,6 +1610,11 @@ qla24xx_dif_start_scsi(srb_t *sp)
                        goto queuing_error;
                else
                        sp->flags |= SRB_CRC_PROT_DMA_VALID;
+                if ((scsi_get_prot_op(cmd) == SCSI_PROT_READ_INSERT) ||
+                    (scsi_get_prot_op(cmd) == SCSI_PROT_WRITE_STRIP)) {
+                        nseg = scsi_bufflen(cmd) / cmd->device->sector_size;
+                }
        } else {
                nseg = 0;
        }
@@ -1454,6 +1641,7 @@ qla24xx_dif_start_scsi(srb_t *sp)
        /* Build header part of command packet (excluding the OPCODE). */
        req->current_outstanding_cmd = handle;
        req->outstanding_cmds[handle] = sp;
+        sp->handle = handle;
        sp->cmd->host_scribble = (unsigned char *)(unsigned long)handle;
        req->cnt -= req_cnt;
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index b16b7725dee0..8a7591f035e6 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -719,7 +719,6 @@ skip_rio:
                        vha->flags.rscn_queue_overflow = 1;
                }
-                atomic_set(&vha->loop_state, LOOP_UPDATE);
                atomic_set(&vha->loop_down_timer, 0);
                vha->flags.management_server_logged_in = 0;
@@ -1435,25 +1434,27 @@ struct scsi_dif_tuple {
 * ASC/ASCQ fields in the sense buffer with ILLEGAL_REQUEST
 * to indicate to the kernel that the HBA detected error.
 */
-static inline void
+static inline int
 qla2x00_handle_dif_error(srb_t *sp, struct sts_entry_24xx *sts24)
 {
        struct scsi_qla_host *vha = sp->fcport->vha;
        struct scsi_cmnd *cmd = sp->cmd;
-        struct scsi_dif_tuple   *ep =
+        uint8_t         *ap = &sts24->data[12];
-                        (struct scsi_dif_tuple *)&sts24->data[20];
+        uint8_t         *ep = &sts24->data[20];
-        struct scsi_dif_tuple   *ap =
-                        (struct scsi_dif_tuple *)&sts24->data[12];
        uint32_t        e_ref_tag, a_ref_tag;
        uint16_t        e_app_tag, a_app_tag;
        uint16_t        e_guard, a_guard;
-        e_ref_tag = be32_to_cpu(ep->ref_tag);
+        /*
-        a_ref_tag = be32_to_cpu(ap->ref_tag);
+         * swab32 of the "data" field in the beginning of qla2x00_status_entry()
-        e_app_tag = be16_to_cpu(ep->app_tag);
+         * would make guard field appear at offset 2
-        a_app_tag = be16_to_cpu(ap->app_tag);
+         */
-        e_guard = be16_to_cpu(ep->guard);
+        a_guard   = le16_to_cpu(*(uint16_t *)(ap + 2));
-        a_guard = be16_to_cpu(ap->guard);
+        a_app_tag = le16_to_cpu(*(uint16_t *)(ap + 0));
+        a_ref_tag = le32_to_cpu(*(uint32_t *)(ap + 4));
+        e_guard   = le16_to_cpu(*(uint16_t *)(ep + 2));
+        e_app_tag = le16_to_cpu(*(uint16_t *)(ep + 0));
+        e_ref_tag = le32_to_cpu(*(uint32_t *)(ep + 4));
        ql_dbg(ql_dbg_io, vha, 0x3023,
            "iocb(s) %p Returned STATUS.\n", sts24);
@@ -1465,6 +1466,63 @@ qla2x00_handle_dif_error(srb_t *sp, struct sts_entry_24xx *sts24)
            cmd->cmnd[0], (u64)scsi_get_lba(cmd), a_ref_tag, e_ref_tag,
            a_app_tag, e_app_tag, a_guard, e_guard);
+        /*
+         * Ignore sector if:
+         * For type     3: ref & app tag is all 'f's
+         * For type 0,1,2: app tag is all 'f's
+         */
+        if ((a_app_tag == 0xffff) &&
+            ((scsi_get_prot_type(cmd) != SCSI_PROT_DIF_TYPE3) ||
+             (a_ref_tag == 0xffffffff))) {
+                uint32_t blocks_done, resid;
+                sector_t lba_s = scsi_get_lba(cmd);
+                /* 2TB boundary case covered automatically with this */
+                blocks_done = e_ref_tag - (uint32_t)lba_s + 1;
+                resid = scsi_bufflen(cmd) - (blocks_done *
+                    cmd->device->sector_size);
+                scsi_set_resid(cmd, resid);
+                cmd->result = DID_OK << 16;
+                /* Update protection tag */
+                if (scsi_prot_sg_count(cmd)) {
+                        uint32_t i, j = 0, k = 0, num_ent;
+                        struct scatterlist *sg;
+                        struct sd_dif_tuple *spt;
+                        /* Patch the corresponding protection tags */
+                        scsi_for_each_prot_sg(cmd, sg,
+                            scsi_prot_sg_count(cmd), i) {
+                                num_ent = sg_dma_len(sg) / 8;
+                                if (k + num_ent < blocks_done) {
+                                        k += num_ent;
+                                        continue;
+                                }
+                                j = blocks_done - k - 1;
+                                k = blocks_done;
+                                break;
+                        }
+                        if (k != blocks_done) {
+                                qla_printk(KERN_WARNING, sp->fcport->vha->hw,
+                                    "unexpected tag values tag:lba=%x:%llx)\n",
+                                    e_ref_tag, (unsigned long long)lba_s);
+                                return 1;
+                        }
+                        spt = page_address(sg_page(sg)) + sg->offset;
+                        spt += j;
+                        spt->app_tag = 0xffff;
+                        if (scsi_get_prot_type(cmd) == SCSI_PROT_DIF_TYPE3)
+                                spt->ref_tag = 0xffffffff;
+                }
+                return 0;
+        }
        /* check guard */
        if (e_guard != a_guard) {
                scsi_build_sense_buffer(1, cmd->sense_buffer, ILLEGAL_REQUEST,
@@ -1472,28 +1530,30 @@ qla2x00_handle_dif_error(srb_t *sp, struct sts_entry_24xx *sts24)
                set_driver_byte(cmd, DRIVER_SENSE);
                set_host_byte(cmd, DID_ABORT);
                cmd->result |= SAM_STAT_CHECK_CONDITION << 1;
-                return;
+                return 1;
        }
-        /* check appl tag */
+        /* check ref tag */
-        if (e_app_tag != a_app_tag) {
+        if (e_ref_tag != a_ref_tag) {
                scsi_build_sense_buffer(1, cmd->sense_buffer, ILLEGAL_REQUEST,
-                    0x10, 0x2);
+                    0x10, 0x3);
                set_driver_byte(cmd, DRIVER_SENSE);
                set_host_byte(cmd, DID_ABORT);
                cmd->result |= SAM_STAT_CHECK_CONDITION << 1;
-                return;
+                return 1;
        }
-        /* check ref tag */
+        /* check appl tag */
-        if (e_ref_tag != a_ref_tag) {
+        if (e_app_tag != a_app_tag) {
                scsi_build_sense_buffer(1, cmd->sense_buffer, ILLEGAL_REQUEST,
-                    0x10, 0x3);
+                    0x10, 0x2);
                set_driver_byte(cmd, DRIVER_SENSE);
                set_host_byte(cmd, DID_ABORT);
                cmd->result |= SAM_STAT_CHECK_CONDITION << 1;
-                return;
+                return 1;
        }
+        return 1;
 }
 /**
@@ -1767,7 +1827,7 @@ check_scsi_status:
                break;
        case CS_DIF_ERROR:
-                qla2x00_handle_dif_error(sp, sts24);
+                logit = qla2x00_handle_dif_error(sp, sts24);
                break;
        default:
                cp->result = DID_ERROR << 16;
@@ -2468,11 +2528,10 @@ qla2x00_request_irqs(struct qla_hw_data *ha, struct rsp_que *rsp)
                goto skip_msi;
        }
-        if (IS_QLA2432(ha) && (ha->pdev->revision < QLA_MSIX_CHIP_REV_24XX ||
+        if (IS_QLA2432(ha) && (ha->pdev->revision < QLA_MSIX_CHIP_REV_24XX)) {
-                !QLA_MSIX_FW_MODE_1(ha->fw_attributes))) {
                ql_log(ql_log_warn, vha, 0x0035,
                    "MSI-X; Unsupported ISP2432 (0x%X, 0x%X).\n",
-                    ha->pdev->revision, ha->fw_attributes);
+                    ha->pdev->revision, QLA_MSIX_CHIP_REV_24XX);
                goto skip_msix;
        }
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index c706ed370000..f488cc69fc79 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -472,7 +472,7 @@ qla24xx_create_vhost(struct fc_vport *fc_vport)
        host->can_queue = base_vha->req->length + 128;
        host->this_id = 255;
        host->cmd_per_lun = 3;
-        if ((IS_QLA25XX(ha) || IS_QLA81XX(ha)) && ql2xenabledif)
+        if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif)
                host->max_cmd_len = 32;
        else
                host->max_cmd_len = MAX_CMDSZ;
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 5cbf33a50b14..049807cda419 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -2208,6 +2208,7 @@ qla82xx_msix_rsp_q(int irq, void *dev_id)
        struct qla_hw_data *ha;
        struct rsp_que *rsp;
        struct device_reg_82xx __iomem *reg;
+        unsigned long flags;
        rsp = (struct rsp_que *) dev_id;
        if (!rsp) {
@@ -2218,11 +2219,11 @@ qla82xx_msix_rsp_q(int irq, void *dev_id)
        ha = rsp->hw;
        reg = &ha->iobase->isp82;
-        spin_lock_irq(&ha->hardware_lock);
+        spin_lock_irqsave(&ha->hardware_lock, flags);
        vha = pci_get_drvdata(ha->pdev);
        qla24xx_process_response_queue(vha, rsp);
        WRT_REG_DWORD(&reg->host_int, 0);
-        spin_unlock_irq(&ha->hardware_lock);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        return IRQ_HANDLED;
 }
@@ -2838,6 +2839,16 @@ sufficient_dsds:
                int_to_scsilun(sp->cmd->device->lun, &cmd_pkt->lun);
                host_to_fcp_swap((uint8_t *)&cmd_pkt->lun, sizeof(cmd_pkt->lun));
+                /* build FCP_CMND IU */
+                memset(ctx->fcp_cmnd, 0, sizeof(struct fcp_cmnd));
+                int_to_scsilun(sp->cmd->device->lun, &ctx->fcp_cmnd->lun);
+                ctx->fcp_cmnd->additional_cdb_len = additional_cdb_len;
+                if (cmd->sc_data_direction == DMA_TO_DEVICE)
+                        ctx->fcp_cmnd->additional_cdb_len |= 1;
+                else if (cmd->sc_data_direction == DMA_FROM_DEVICE)
+                        ctx->fcp_cmnd->additional_cdb_len |= 2;
                /*
                 * Update tagged queuing modifier -- default is TSK_SIMPLE (0).
                 */
@@ -2854,16 +2865,6 @@ sufficient_dsds:
                        }
                }
-                /* build FCP_CMND IU */
-                memset(ctx->fcp_cmnd, 0, sizeof(struct fcp_cmnd));
-                int_to_scsilun(sp->cmd->device->lun, &ctx->fcp_cmnd->lun);
-                ctx->fcp_cmnd->additional_cdb_len = additional_cdb_len;
-                if (cmd->sc_data_direction == DMA_TO_DEVICE)
-                        ctx->fcp_cmnd->additional_cdb_len |= 1;
-                else if (cmd->sc_data_direction == DMA_FROM_DEVICE)
-                        ctx->fcp_cmnd->additional_cdb_len |= 2;
                memcpy(ctx->fcp_cmnd->cdb, cmd->cmnd, cmd->cmd_len);
                fcp_dl = (uint32_t *)(ctx->fcp_cmnd->cdb + 16 +
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index e02df276804e..4cace3f20c04 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -106,17 +106,21 @@ MODULE_PARM_DESC(ql2xmaxqdepth,
                "Maximum queue depth to report for target devices.");
 /* Do not change the value of this after module load */
-int ql2xenabledif = 1;
+int ql2xenabledif = 0;
 module_param(ql2xenabledif, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(ql2xenabledif,
                " Enable T10-CRC-DIF "
-                " Default is 0 - No DIF Support. 1 - Enable it");
+                " Default is 0 - No DIF Support. 1 - Enable it"
+                ", 2 - Enable DIF for all types, except Type 0.");
-int ql2xenablehba_err_chk;
+int ql2xenablehba_err_chk = 2;
 module_param(ql2xenablehba_err_chk, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(ql2xenablehba_err_chk,
-                " Enable T10-CRC-DIF Error isolation by HBA"
+                " Enable T10-CRC-DIF Error isolation by HBA:\n"
-                " Default is 0 - Error isolation disabled, 1 - Enable it");
+                " Default is 1.\n"
+                "  0 -- Error isolation disabled\n"
+                "  1 -- Error isolation enabled only for DIX Type 0\n"
+                "  2 -- Error isolation enabled for all Types\n");
 int ql2xiidmaenable=1;
 module_param(ql2xiidmaenable, int, S_IRUGO);
@@ -909,7 +913,14 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
                    "Abort command mbx success.\n");
                wait = 1;
        }
+        spin_lock_irqsave(&ha->hardware_lock, flags);
        qla2x00_sp_compl(ha, sp);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+        /* Did the command return during mailbox execution? */
+        if (ret == FAILED && !CMD_SP(cmd))
+                ret = SUCCESS;
        /* Wait for the command to be returned. */
        if (wait) {
@@ -2251,7 +2262,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        host->this_id = 255;
        host->cmd_per_lun = 3;
        host->unique_id = host->host_no;
-        if ((IS_QLA25XX(ha) || IS_QLA81XX(ha)) && ql2xenabledif)
+        if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif)
                host->max_cmd_len = 32;
        else
                host->max_cmd_len = MAX_CMDSZ;
@@ -2378,13 +2389,16 @@ skip_dpc:
            "Detected hba at address=%p.\n",
            ha);
-        if ((IS_QLA25XX(ha) || IS_QLA81XX(ha)) && ql2xenabledif) {
+        if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) {
                if (ha->fw_attributes & BIT_4) {
+                        int prot = 0;
                        base_vha->flags.difdix_supported = 1;
                        ql_dbg(ql_dbg_init, base_vha, 0x00f1,
                            "Registering for DIF/DIX type 1 and 3 protection.\n");
+                        if (ql2xenabledif == 1)
+                                prot = SHOST_DIX_TYPE0_PROTECTION;
                        scsi_host_set_prot(host,
-                            SHOST_DIF_TYPE1_PROTECTION
+                            prot | SHOST_DIF_TYPE1_PROTECTION
                            | SHOST_DIF_TYPE2_PROTECTION
                            | SHOST_DIF_TYPE3_PROTECTION
                            | SHOST_DIX_TYPE1_PROTECTION
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 062c97bf62f5..13b6357c1fa2 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
 * Driver version
 */
-#define QLA2XXX_VERSION      "8.03.07.03-k"
+#define QLA2XXX_VERSION      "8.03.07.07-k"
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    3
diff --git a/drivers/scsi/qla4xxx/Kconfig b/drivers/scsi/qla4xxx/Kconfig
index 2c33ce6eac1e..0f5599e0abf6 100644
--- a/drivers/scsi/qla4xxx/Kconfig
+++ b/drivers/scsi/qla4xxx/Kconfig
@@ -1,6 +1,6 @@
 config SCSI_QLA_ISCSI
        tristate "QLogic ISP4XXX and ISP82XX host adapter family support"
-        depends on PCI && SCSI
+        depends on PCI && SCSI && NET
        select SCSI_ISCSI_ATTRS
        ---help---
        This driver supports the QLogic 40xx (ISP4XXX) and 8022 (ISP82XX)
diff --git a/drivers/sh/intc/chip.c b/drivers/sh/intc/chip.c
index f33e2dd97934..33b2ed451e09 100644
--- a/drivers/sh/intc/chip.c
+++ b/drivers/sh/intc/chip.c
@@ -186,6 +186,9 @@ static unsigned char intc_irq_sense_table[IRQ_TYPE_SENSE_MASK + 1] = {
    !defined(CONFIG_CPU_SUBTYPE_SH7709)
        [IRQ_TYPE_LEVEL_HIGH] = VALID(3),
 #endif
+#if defined(CONFIG_ARCH_SH7372)
+        [IRQ_TYPE_EDGE_BOTH] = VALID(4),
+#endif
 };
 static int intc_set_type(struct irq_data *data, unsigned int type)
diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index d2407558773f..24cacff57786 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -825,6 +825,9 @@ static void fsl_spi_cpm_free(struct mpc8xxx_spi *mspi)
 {
        struct device *dev = mspi->dev;
+        if (!(mspi->flags & SPI_CPM_MODE))
+                return;
        dma_unmap_single(dev, mspi->dma_dummy_rx, SPI_MRBLR, DMA_FROM_DEVICE);
        dma_unmap_single(dev, mspi->dma_dummy_tx, PAGE_SIZE, DMA_TO_DEVICE);
        cpm_muram_free(cpm_muram_offset(mspi->tx_bd));
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 8ac6542aedcd..fa594d604aca 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -786,9 +786,11 @@ static int __devinit spi_imx_probe(struct platform_device *pdev)
                int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
                if (cs_gpio < 0)
                        cs_gpio = mxc_platform_info->chipselect[i];
+                spi_imx->chipselect[i] = cs_gpio;
                if (cs_gpio < 0)
                        continue;
-                spi_imx->chipselect[i] = cs_gpio;
                ret = gpio_request(spi_imx->chipselect[i], DRIVER_NAME);
                if (ret) {
                        while (i > 0) {
diff --git a/drivers/staging/brcm80211/brcmsmac/otp.c b/drivers/staging/brcm80211/brcmsmac/otp.c
index 34253cf37812..4a70180eba5d 100644
--- a/drivers/staging/brcm80211/brcmsmac/otp.c
+++ b/drivers/staging/brcm80211/brcmsmac/otp.c
@@ -16,6 +16,7 @@
 #include <linux/io.h>
 #include <linux/errno.h>
+#include <linux/string.h>
 #include <brcm_hw_ids.h>
 #include <chipcommon.h>
diff --git a/drivers/staging/brcm80211/brcmsmac/types.h b/drivers/staging/brcm80211/brcmsmac/types.h
index bbf21897ae0e..823b5e4672e2 100644
--- a/drivers/staging/brcm80211/brcmsmac/types.h
+++ b/drivers/staging/brcm80211/brcmsmac/types.h
@@ -18,6 +18,7 @@
 #define _BRCM_TYPES_H_
 #include <linux/types.h>
+#include <linux/io.h>
 /* Bus types */
 #define SI_BUS                  0       /* SOC Interconnect */
diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c
index 6859af0778cf..7611def97d06 100644
--- a/drivers/staging/comedi/drivers/ni_labpc.c
+++ b/drivers/staging/comedi/drivers/ni_labpc.c
@@ -241,8 +241,10 @@ static int labpc_eeprom_write_insn(struct comedi_device *dev,
                                   struct comedi_insn *insn,
                                   unsigned int *data);
 static void labpc_adc_timing(struct comedi_device *dev, struct comedi_cmd *cmd);
-#ifdef CONFIG_COMEDI_PCI
+#ifdef CONFIG_ISA_DMA_API
 static unsigned int labpc_suggest_transfer_size(struct comedi_cmd cmd);
+#endif
+#ifdef CONFIG_COMEDI_PCI
 static int labpc_find_device(struct comedi_device *dev, int bus, int slot);
 #endif
 static int labpc_dio_mem_callback(int dir, int port, int data,
diff --git a/drivers/staging/octeon/ethernet-rgmii.c b/drivers/staging/octeon/ethernet-rgmii.c
index 9c0d2936e486..c3d73f8431ae 100644
--- a/drivers/staging/octeon/ethernet-rgmii.c
+++ b/drivers/staging/octeon/ethernet-rgmii.c
@@ -26,6 +26,7 @@
 **********************************************************************/
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/interrupt.h>
 #include <linux/phy.h>
 #include <linux/ratelimit.h>
 #include <net/dst.h>
diff --git a/drivers/staging/octeon/ethernet-spi.c b/drivers/staging/octeon/ethernet-spi.c
index 970825421884..d0e2d514968a 100644
--- a/drivers/staging/octeon/ethernet-spi.c
+++ b/drivers/staging/octeon/ethernet-spi.c
@@ -26,6 +26,7 @@
 **********************************************************************/
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/interrupt.h>
 #include <net/dst.h>
 #include <asm/octeon/octeon.h>
diff --git a/drivers/staging/tidspbridge/core/dsp-clock.c b/drivers/staging/tidspbridge/core/dsp-clock.c
index 589a0554332e..3d1279c424a8 100644
--- a/drivers/staging/tidspbridge/core/dsp-clock.c
+++ b/drivers/staging/tidspbridge/core/dsp-clock.c
@@ -209,7 +209,6 @@ int dsp_clk_enable(enum dsp_clk_id clk_id)
                break;
 #ifdef CONFIG_OMAP_MCBSP
        case MCBSP_CLK:
-                omap_mcbsp_set_io_type(MCBSP_ID(clk_id), OMAP_MCBSP_POLL_IO);
                omap_mcbsp_request(MCBSP_ID(clk_id));
                omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PAD_SRC);
                break;
diff --git a/drivers/staging/zcache/tmem.c b/drivers/staging/zcache/tmem.c
index 975e34bcd722..1ca66ea9b281 100644
--- a/drivers/staging/zcache/tmem.c
+++ b/drivers/staging/zcache/tmem.c
@@ -604,7 +604,7 @@ int tmem_get(struct tmem_pool *pool, struct tmem_oid *oidp, uint32_t index,
        struct tmem_obj *obj;
        void *pampd;
        bool ephemeral = is_ephemeral(pool);
-        uint32_t ret = -1;
+        int ret = -1;
        struct tmem_hashbucket *hb;
        bool free = (get_and_free == 1) || ((get_and_free == 0) && ephemeral);
        bool lock_held = false;
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index 855a5bb56a47..462fbc20561f 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1158,7 +1158,7 @@ static void *zcache_pampd_create(char *data, size_t size, bool raw, int eph,
        size_t clen;
        int ret;
        unsigned long count;
-        struct page *page = virt_to_page(data);
+        struct page *page = (struct page *)(data);
        struct zcache_client *cli = pool->client;
        uint16_t client_id = get_client_id_from_client(cli);
        unsigned long zv_mean_zsize;
@@ -1227,7 +1227,7 @@ static int zcache_pampd_get_data(char *data, size_t *bufsize, bool raw,
        int ret = 0;
        BUG_ON(is_ephemeral(pool));
-        zv_decompress(virt_to_page(data), pampd);
+        zv_decompress((struct page *)(data), pampd);
        return ret;
 }
@@ -1242,7 +1242,7 @@ static int zcache_pampd_get_data_and_free(char *data, size_t *bufsize, bool raw,
        int ret = 0;
        BUG_ON(!is_ephemeral(pool));
-        zbud_decompress(virt_to_page(data), pampd);
+        zbud_decompress((struct page *)(data), pampd);
        zbud_free_and_delist((struct zbud_hdr *)pampd);
        atomic_dec(&zcache_curr_eph_pampd_count);
        return ret;
@@ -1539,7 +1539,7 @@ static int zcache_put_page(int cli_id, int pool_id, struct tmem_oid *oidp,
                goto out;
        if (!zcache_freeze && zcache_do_preload(pool) == 0) {
                /* preload does preempt_disable on success */
-                ret = tmem_put(pool, oidp, index, page_address(page),
+                ret = tmem_put(pool, oidp, index, (char *)(page),
                                PAGE_SIZE, 0, is_ephemeral(pool));
                if (ret < 0) {
                        if (is_ephemeral(pool))
@@ -1572,7 +1572,7 @@ static int zcache_get_page(int cli_id, int pool_id, struct tmem_oid *oidp,
        pool = zcache_get_pool_by_id(cli_id, pool_id);
        if (likely(pool != NULL)) {
                if (atomic_read(&pool->obj_count) > 0)
-                        ret = tmem_get(pool, oidp, index, page_address(page),
+                        ret = tmem_get(pool, oidp, index, (char *)(page),
                                        &size, 0, is_ephemeral(pool));
                zcache_put_pool(pool);
        }
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index c24fb10de60b..6a4ea29c2f36 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -2243,7 +2243,6 @@ static int iscsit_handle_snack(
        case 0:
                return iscsit_handle_recovery_datain_or_r2t(conn, buf,
                        hdr->itt, hdr->ttt, hdr->begrun, hdr->runlength);
-                return 0;
        case ISCSI_FLAG_SNACK_TYPE_STATUS:
                return iscsit_handle_status_snack(conn, hdr->itt, hdr->ttt,
                        hdr->begrun, hdr->runlength);
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index f095e65b1ccf..f1643dbf6a92 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -268,7 +268,7 @@ struct se_tpg_np *lio_target_call_addnptotpg(
                                ISCSI_TCP);
        if (IS_ERR(tpg_np)) {
                iscsit_put_tpg(tpg);
-                return ERR_PTR(PTR_ERR(tpg_np));
+                return ERR_CAST(tpg_np);
        }
        pr_debug("LIO_Target_ConfigFS: addnptotpg done!\n");
@@ -1285,7 +1285,7 @@ struct se_wwn *lio_target_call_coreaddtiqn(
        tiqn = iscsit_add_tiqn((unsigned char *)name);
        if (IS_ERR(tiqn))
-                return ERR_PTR(PTR_ERR(tiqn));
+                return ERR_CAST(tiqn);
        /*
         * Setup struct iscsi_wwn_stat_grps for se_wwn->fabric_stat_group.
         */
diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
index 980650792cf6..c4c68da3e500 100644
--- a/drivers/target/iscsi/iscsi_target_erl1.c
+++ b/drivers/target/iscsi/iscsi_target_erl1.c
@@ -834,7 +834,7 @@ static int iscsit_attach_ooo_cmdsn(
                         */
                        list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
                                                ooo_list) {
-                                while (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn)
+                                if (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn)
                                        continue;
                                list_add(&ooo_cmdsn->ooo_list,
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index bcaf82f47037..daad362a93ce 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1013,19 +1013,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                                        ISCSI_LOGIN_STATUS_TARGET_ERROR);
                        goto new_sess_out;
                }
-#if 0
+                snprintf(conn->login_ip, sizeof(conn->login_ip), "%pI6c",
-                if (!iscsi_ntop6((const unsigned char *)
+                                &sock_in6.sin6_addr.in6_u);
-                                &sock_in6.sin6_addr.in6_u,
+                conn->login_port = ntohs(sock_in6.sin6_port);
-                                (char *)&conn->ipv6_login_ip[0],
-                                IPV6_ADDRESS_SPACE)) {
-                        pr_err("iscsi_ntop6() failed\n");
-                        iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                        ISCSI_LOGIN_STATUS_TARGET_ERROR);
-                        goto new_sess_out;
-                }
-#else
-                pr_debug("Skipping iscsi_ntop6()\n");
-#endif
        } else {
                memset(&sock_in, 0, sizeof(struct sockaddr_in));
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index 252e246cf51e..5b773160200f 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -545,13 +545,13 @@ int iscsi_copy_param_list(
        struct iscsi_param_list *src_param_list,
        int leading)
 {
-        struct iscsi_param *new_param = NULL, *param = NULL;
+        struct iscsi_param *param = NULL;
+        struct iscsi_param *new_param = NULL;
        struct iscsi_param_list *param_list = NULL;
        param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL);
        if (!param_list) {
-                pr_err("Unable to allocate memory for"
+                pr_err("Unable to allocate memory for struct iscsi_param_list.\n");
-                                " struct iscsi_param_list.\n");
                goto err_out;
        }
        INIT_LIST_HEAD(&param_list->param_list);
@@ -567,8 +567,17 @@ int iscsi_copy_param_list(
                new_param = kzalloc(sizeof(struct iscsi_param), GFP_KERNEL);
                if (!new_param) {
-                        pr_err("Unable to allocate memory for"
+                        pr_err("Unable to allocate memory for struct iscsi_param.\n");
-                                " struct iscsi_param.\n");
+                        goto err_out;
+                }
+                new_param->name = kstrdup(param->name, GFP_KERNEL);
+                new_param->value = kstrdup(param->value, GFP_KERNEL);
+                if (!new_param->value || !new_param->name) {
+                        kfree(new_param->value);
+                        kfree(new_param->name);
+                        kfree(new_param);
+                        pr_err("Unable to allocate memory for parameter name/value.\n");
                        goto err_out;
                }
@@ -580,32 +589,12 @@ int iscsi_copy_param_list(
                new_param->use = param->use;
                new_param->type_range = param->type_range;
-                new_param->name = kzalloc(strlen(param->name) + 1, GFP_KERNEL);
-                if (!new_param->name) {
-                        pr_err("Unable to allocate memory for"
-                                " parameter name.\n");
-                        goto err_out;
-                }
-                new_param->value = kzalloc(strlen(param->value) + 1,
-                                GFP_KERNEL);
-                if (!new_param->value) {
-                        pr_err("Unable to allocate memory for"
-                                " parameter value.\n");
-                        goto err_out;
-                }
-                memcpy(new_param->name, param->name, strlen(param->name));
-                new_param->name[strlen(param->name)] = '\0';
-                memcpy(new_param->value, param->value, strlen(param->value));
-                new_param->value[strlen(param->value)] = '\0';
                list_add_tail(&new_param->p_list, &param_list->param_list);
        }
-        if (!list_empty(&param_list->param_list))
+        if (!list_empty(&param_list->param_list)) {
                *dst_param_list = param_list;
-        else {
+        } else {
                pr_err("No parameters allocated.\n");
                goto err_out;
        }
@@ -1441,7 +1430,7 @@ static int iscsi_enforce_integrity_rules(
        u8 DataSequenceInOrder = 0;
        u8 ErrorRecoveryLevel = 0, SessionType = 0;
        u8 IFMarker = 0, OFMarker = 0;
-        u8 IFMarkInt_Reject = 0, OFMarkInt_Reject = 0;
+        u8 IFMarkInt_Reject = 1, OFMarkInt_Reject = 1;
        u32 FirstBurstLength = 0, MaxBurstLength = 0;
        struct iscsi_param *param = NULL;
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index a1acb0167902..f00137f377b2 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -243,7 +243,7 @@ struct iscsi_cmd *iscsit_allocate_se_cmd_for_tmr(
        if (!cmd->tmr_req) {
                pr_err("Unable to allocate memory for"
                        " Task Management command!\n");
-                return NULL;
+                goto out;
        }
        /*
         * TASK_REASSIGN for ERL=2 / connection stays inside of
@@ -298,8 +298,6 @@ struct iscsi_cmd *iscsit_allocate_se_cmd_for_tmr(
        return cmd;
 out:
        iscsit_release_cmd(cmd);
-        if (se_cmd)
-                transport_free_se_cmd(se_cmd);
        return NULL;
 }
@@ -877,40 +875,6 @@ void iscsit_inc_session_usage_count(struct iscsi_session *sess)
 }
 /*
- *      Used before iscsi_do[rx,tx]_data() to determine iov and [rx,tx]_marker
- *      array counts needed for sync and steering.
- */
-static int iscsit_determine_sync_and_steering_counts(
-        struct iscsi_conn *conn,
-        struct iscsi_data_count *count)
-{
-        u32 length = count->data_length;
-        u32 marker, markint;
-        count->sync_and_steering = 1;
-        marker = (count->type == ISCSI_RX_DATA) ?
-                        conn->of_marker : conn->if_marker;
-        markint = (count->type == ISCSI_RX_DATA) ?
-                        (conn->conn_ops->OFMarkInt * 4) :
-                        (conn->conn_ops->IFMarkInt * 4);
-        count->ss_iov_count = count->iov_count;
-        while (length > 0) {
-                if (length >= marker) {
-                        count->ss_iov_count += 3;
-                        count->ss_marker_count += 2;
-                        length -= marker;
-                        marker = markint;
-                } else
-                        length = 0;
-        }
-        return 0;
-}
-/*
 *      Setup conn->if_marker and conn->of_marker values based upon
 *      the initial marker-less interval. (see iSCSI v19 A.2)
 */
@@ -1292,7 +1256,7 @@ int iscsit_fe_sendpage_sg(
        struct kvec iov;
        u32 tx_hdr_size, data_len;
        u32 offset = cmd->first_data_sg_off;
-        int tx_sent;
+        int tx_sent, iov_off;
 send_hdr:
        tx_hdr_size = ISCSI_HDR_LEN;
@@ -1312,9 +1276,19 @@ send_hdr:
        }
        data_len = cmd->tx_size - tx_hdr_size - cmd->padding;
-        if (conn->conn_ops->DataDigest)
+        /*
+         * Set iov_off used by padding and data digest tx_data() calls below
+         * in order to determine proper offset into cmd->iov_data[]
+         */
+        if (conn->conn_ops->DataDigest) {
                data_len -= ISCSI_CRC_LEN;
+                if (cmd->padding)
+                        iov_off = (cmd->iov_data_count - 2);
+                else
+                        iov_off = (cmd->iov_data_count - 1);
+        } else {
+                iov_off = (cmd->iov_data_count - 1);
+        }
        /*
         * Perform sendpage() for each page in the scatterlist
         */
@@ -1343,8 +1317,7 @@ send_pg:
 send_padding:
        if (cmd->padding) {
-                struct kvec *iov_p =
+                struct kvec *iov_p = &cmd->iov_data[iov_off++];
-                        &cmd->iov_data[cmd->iov_data_count-1];
                tx_sent = tx_data(conn, iov_p, 1, cmd->padding);
                if (cmd->padding != tx_sent) {
@@ -1358,8 +1331,7 @@ send_padding:
 send_datacrc:
        if (conn->conn_ops->DataDigest) {
-                struct kvec *iov_d =
+                struct kvec *iov_d = &cmd->iov_data[iov_off];
-                        &cmd->iov_data[cmd->iov_data_count];
                tx_sent = tx_data(conn, iov_d, 1, ISCSI_CRC_LEN);
                if (ISCSI_CRC_LEN != tx_sent) {
@@ -1433,8 +1405,7 @@ static int iscsit_do_rx_data(
        struct iscsi_data_count *count)
 {
        int data = count->data_length, rx_loop = 0, total_rx = 0, iov_len;
-        u32 rx_marker_val[count->ss_marker_count], rx_marker_iov = 0;
+        struct kvec *iov_p;
-        struct kvec iov[count->ss_iov_count], *iov_p;
        struct msghdr msg;
        if (!conn || !conn->sock || !conn->conn_ops)
@@ -1442,93 +1413,8 @@ static int iscsit_do_rx_data(
        memset(&msg, 0, sizeof(struct msghdr));
-        if (count->sync_and_steering) {
+        iov_p = count->iov;
-                int size = 0;
+        iov_len = count->iov_count;
-                u32 i, orig_iov_count = 0;
-                u32 orig_iov_len = 0, orig_iov_loc = 0;
-                u32 iov_count = 0, per_iov_bytes = 0;
-                u32 *rx_marker, old_rx_marker = 0;
-                struct kvec *iov_record;
-                memset(&rx_marker_val, 0,
-                                count->ss_marker_count * sizeof(u32));
-                memset(&iov, 0, count->ss_iov_count * sizeof(struct kvec));
-                iov_record = count->iov;
-                orig_iov_count = count->iov_count;
-                rx_marker = &conn->of_marker;
-                i = 0;
-                size = data;
-                orig_iov_len = iov_record[orig_iov_loc].iov_len;
-                while (size > 0) {
-                        pr_debug("rx_data: #1 orig_iov_len %u,"
-                        " orig_iov_loc %u\n", orig_iov_len, orig_iov_loc);
-                        pr_debug("rx_data: #2 rx_marker %u, size"
-                                " %u\n", *rx_marker, size);
-                        if (orig_iov_len >= *rx_marker) {
-                                iov[iov_count].iov_len = *rx_marker;
-                                iov[iov_count++].iov_base =
-                                        (iov_record[orig_iov_loc].iov_base +
-                                                per_iov_bytes);
-                                iov[iov_count].iov_len = (MARKER_SIZE / 2);
-                                iov[iov_count++].iov_base =
-                                        &rx_marker_val[rx_marker_iov++];
-                                iov[iov_count].iov_len = (MARKER_SIZE / 2);
-                                iov[iov_count++].iov_base =
-                                        &rx_marker_val[rx_marker_iov++];
-                                old_rx_marker = *rx_marker;
-                                /*
-                                 * OFMarkInt is in 32-bit words.
-                                 */
-                                *rx_marker = (conn->conn_ops->OFMarkInt * 4);
-                                size -= old_rx_marker;
-                                orig_iov_len -= old_rx_marker;
-                                per_iov_bytes += old_rx_marker;
-                                pr_debug("rx_data: #3 new_rx_marker"
-                                        " %u, size %u\n", *rx_marker, size);
-                        } else {
-                                iov[iov_count].iov_len = orig_iov_len;
-                                iov[iov_count++].iov_base =
-                                        (iov_record[orig_iov_loc].iov_base +
-                                                per_iov_bytes);
-                                per_iov_bytes = 0;
-                                *rx_marker -= orig_iov_len;
-                                size -= orig_iov_len;
-                                if (size)
-                                        orig_iov_len =
-                                        iov_record[++orig_iov_loc].iov_len;
-                                pr_debug("rx_data: #4 new_rx_marker"
-                                        " %u, size %u\n", *rx_marker, size);
-                        }
-                }
-                data += (rx_marker_iov * (MARKER_SIZE / 2));
-                iov_p   = &iov[0];
-                iov_len = iov_count;
-                if (iov_count > count->ss_iov_count) {
-                        pr_err("iov_count: %d, count->ss_iov_count:"
-                                " %d\n", iov_count, count->ss_iov_count);
-                        return -1;
-                }
-                if (rx_marker_iov > count->ss_marker_count) {
-                        pr_err("rx_marker_iov: %d, count->ss_marker"
-                                "_count: %d\n", rx_marker_iov,
-                                count->ss_marker_count);
-                        return -1;
-                }
-        } else {
-                iov_p = count->iov;
-                iov_len = count->iov_count;
-        }
        while (total_rx < data) {
                rx_loop = kernel_recvmsg(conn->sock, &msg, iov_p, iov_len,
@@ -1543,16 +1429,6 @@ static int iscsit_do_rx_data(
                                rx_loop, total_rx, data);
        }
-        if (count->sync_and_steering) {
-                int j;
-                for (j = 0; j < rx_marker_iov; j++) {
-                        pr_debug("rx_data: #5 j: %d, offset: %d\n",
-                                j, rx_marker_val[j]);
-                        conn->of_marker_offset = rx_marker_val[j];
-                }
-                total_rx -= (rx_marker_iov * (MARKER_SIZE / 2));
-        }
        return total_rx;
 }
@@ -1561,8 +1437,7 @@ static int iscsit_do_tx_data(
        struct iscsi_data_count *count)
 {
        int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len;
-        u32 tx_marker_val[count->ss_marker_count], tx_marker_iov = 0;
+        struct kvec *iov_p;
-        struct kvec iov[count->ss_iov_count], *iov_p;
        struct msghdr msg;
        if (!conn || !conn->sock || !conn->conn_ops)
@@ -1575,98 +1450,8 @@ static int iscsit_do_tx_data(
        memset(&msg, 0, sizeof(struct msghdr));
-        if (count->sync_and_steering) {
+        iov_p = count->iov;
-                int size = 0;
+        iov_len = count->iov_count;
-                u32 i, orig_iov_count = 0;
-                u32 orig_iov_len = 0, orig_iov_loc = 0;
-                u32 iov_count = 0, per_iov_bytes = 0;
-                u32 *tx_marker, old_tx_marker = 0;
-                struct kvec *iov_record;
-                memset(&tx_marker_val, 0,
-                        count->ss_marker_count * sizeof(u32));
-                memset(&iov, 0, count->ss_iov_count * sizeof(struct kvec));
-                iov_record = count->iov;
-                orig_iov_count = count->iov_count;
-                tx_marker = &conn->if_marker;
-                i = 0;
-                size = data;
-                orig_iov_len = iov_record[orig_iov_loc].iov_len;
-                while (size > 0) {
-                        pr_debug("tx_data: #1 orig_iov_len %u,"
-                        " orig_iov_loc %u\n", orig_iov_len, orig_iov_loc);
-                        pr_debug("tx_data: #2 tx_marker %u, size"
-                                " %u\n", *tx_marker, size);
-                        if (orig_iov_len >= *tx_marker) {
-                                iov[iov_count].iov_len = *tx_marker;
-                                iov[iov_count++].iov_base =
-                                        (iov_record[orig_iov_loc].iov_base +
-                                                per_iov_bytes);
-                                tx_marker_val[tx_marker_iov] =
-                                                (size - *tx_marker);
-                                iov[iov_count].iov_len = (MARKER_SIZE / 2);
-                                iov[iov_count++].iov_base =
-                                        &tx_marker_val[tx_marker_iov++];
-                                iov[iov_count].iov_len = (MARKER_SIZE / 2);
-                                iov[iov_count++].iov_base =
-                                        &tx_marker_val[tx_marker_iov++];
-                                old_tx_marker = *tx_marker;
-                                /*
-                                 * IFMarkInt is in 32-bit words.
-                                 */
-                                *tx_marker = (conn->conn_ops->IFMarkInt * 4);
-                                size -= old_tx_marker;
-                                orig_iov_len -= old_tx_marker;
-                                per_iov_bytes += old_tx_marker;
-                                pr_debug("tx_data: #3 new_tx_marker"
-                                        " %u, size %u\n", *tx_marker, size);
-                                pr_debug("tx_data: #4 offset %u\n",
-                                        tx_marker_val[tx_marker_iov-1]);
-                        } else {
-                                iov[iov_count].iov_len = orig_iov_len;
-                                iov[iov_count++].iov_base
-                                        = (iov_record[orig_iov_loc].iov_base +
-                                                per_iov_bytes);
-                                per_iov_bytes = 0;
-                                *tx_marker -= orig_iov_len;
-                                size -= orig_iov_len;
-                                if (size)
-                                        orig_iov_len =
-                                        iov_record[++orig_iov_loc].iov_len;
-                                pr_debug("tx_data: #5 new_tx_marker"
-                                        " %u, size %u\n", *tx_marker, size);
-                        }
-                }
-                data += (tx_marker_iov * (MARKER_SIZE / 2));
-                iov_p = &iov[0];
-                iov_len = iov_count;
-                if (iov_count > count->ss_iov_count) {
-                        pr_err("iov_count: %d, count->ss_iov_count:"
-                                " %d\n", iov_count, count->ss_iov_count);
-                        return -1;
-                }
-                if (tx_marker_iov > count->ss_marker_count) {
-                        pr_err("tx_marker_iov: %d, count->ss_marker"
-                                "_count: %d\n", tx_marker_iov,
-                                count->ss_marker_count);
-                        return -1;
-                }
-        } else {
-                iov_p = count->iov;
-                iov_len = count->iov_count;
-        }
        while (total_tx < data) {
                tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
@@ -1681,9 +1466,6 @@ static int iscsit_do_tx_data(
                                        tx_loop, total_tx, data);
        }
-        if (count->sync_and_steering)
-                total_tx -= (tx_marker_iov * (MARKER_SIZE / 2));
        return total_tx;
 }
@@ -1704,12 +1486,6 @@ int rx_data(
        c.data_length = data;
        c.type = ISCSI_RX_DATA;
-        if (conn->conn_ops->OFMarker &&
-           (conn->conn_state >= TARG_CONN_STATE_LOGGED_IN)) {
-                if (iscsit_determine_sync_and_steering_counts(conn, &c) < 0)
-                        return -1;
-        }
        return iscsit_do_rx_data(conn, &c);
 }
@@ -1730,12 +1506,6 @@ int tx_data(
        c.data_length = data;
        c.type = ISCSI_TX_DATA;
-        if (conn->conn_ops->IFMarker &&
-           (conn->conn_state >= TARG_CONN_STATE_LOGGED_IN)) {
-                if (iscsit_determine_sync_and_steering_counts(conn, &c) < 0)
-                        return -1;
-        }
        return iscsit_do_tx_data(conn, &c);
 }
diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
index 8ae09a1bdf74..f04d4ef99dca 100644
--- a/drivers/target/target_core_cdb.c
+++ b/drivers/target/target_core_cdb.c
@@ -24,6 +24,7 @@
 */
 #include <linux/kernel.h>
+#include <linux/ctype.h>
 #include <asm/unaligned.h>
 #include <scsi/scsi.h>
@@ -67,6 +68,7 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
 {
        struct se_lun *lun = cmd->se_lun;
        struct se_device *dev = cmd->se_dev;
+        struct se_portal_group *tpg = lun->lun_sep->sep_tpg;
        unsigned char *buf;
        /*
@@ -81,9 +83,13 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
        buf = transport_kmap_first_data_page(cmd);
-        buf[0] = dev->transport->get_device_type(dev);
+        if (dev == tpg->tpg_virt_lun0.lun_se_dev) {
-        if (buf[0] == TYPE_TAPE)
+                buf[0] = 0x3f; /* Not connected */
-                buf[1] = 0x80;
+        } else {
+                buf[0] = dev->transport->get_device_type(dev);
+                if (buf[0] == TYPE_TAPE)
+                        buf[1] = 0x80;
+        }
        buf[2] = dev->transport->get_device_rev(dev);
        /*
@@ -149,6 +155,37 @@ target_emulate_evpd_80(struct se_cmd *cmd, unsigned char *buf)
        return 0;
 }
+static void
+target_parse_naa_6h_vendor_specific(struct se_device *dev, unsigned char *buf_off)
+{
+        unsigned char *p = &dev->se_sub_dev->t10_wwn.unit_serial[0];
+        unsigned char *buf = buf_off;
+        int cnt = 0, next = 1;
+        /*
+         * Generate up to 36 bits of VENDOR SPECIFIC IDENTIFIER starting on
+         * byte 3 bit 3-0 for NAA IEEE Registered Extended DESIGNATOR field
+         * format, followed by 64 bits of VENDOR SPECIFIC IDENTIFIER EXTENSION
+         * to complete the payload.  These are based from VPD=0x80 PRODUCT SERIAL
+         * NUMBER set via vpd_unit_serial in target_core_configfs.c to ensure
+         * per device uniqeness.
+         */
+        while (*p != '\0') {
+                if (cnt >= 13)
+                        break;
+                if (!isxdigit(*p)) {
+                        p++;
+                        continue;
+                }
+                if (next != 0) {
+                        buf[cnt++] |= hex_to_bin(*p++);
+                        next = 0;
+                } else {
+                        buf[cnt] = hex_to_bin(*p++) << 4;
+                        next = 1;
+                }
+        }
+}
 /*
 * Device identification VPD, for a complete list of
 * DESIGNATOR TYPEs see spc4r17 Table 459.
@@ -214,8 +251,7 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
         * VENDOR_SPECIFIC_IDENTIFIER and
         * VENDOR_SPECIFIC_IDENTIFIER_EXTENTION
         */
-        buf[off++] |= hex_to_bin(dev->se_sub_dev->t10_wwn.unit_serial[0]);
+        target_parse_naa_6h_vendor_specific(dev, &buf[off]);
-        hex2bin(&buf[off], &dev->se_sub_dev->t10_wwn.unit_serial[1], 12);
        len = 20;
        off = (len + 4);
@@ -915,8 +951,8 @@ target_emulate_modesense(struct se_cmd *cmd, int ten)
                length += target_modesense_control(dev, &buf[offset+length]);
                break;
        default:
-                pr_err("Got Unknown Mode Page: 0x%02x\n",
+                pr_err("MODE SENSE: unimplemented page/subpage: 0x%02x/0x%02x\n",
-                                cdb[2] & 0x3f);
+                       cdb[2] & 0x3f, cdb[3]);
                return PYX_TRANSPORT_UNKNOWN_MODE_PAGE;
        }
        offset += length;
@@ -1072,8 +1108,6 @@ target_emulate_unmap(struct se_task *task)
                size -= 16;
        }
-        task->task_scsi_status = GOOD;
-        transport_complete_task(task, 1);
 err:
        transport_kunmap_first_data_page(cmd);
@@ -1085,24 +1119,17 @@ err:
 * Note this is not used for TCM/pSCSI passthrough
 */
 static int
-target_emulate_write_same(struct se_task *task, int write_same32)
+target_emulate_write_same(struct se_task *task, u32 num_blocks)
 {
        struct se_cmd *cmd = task->task_se_cmd;
        struct se_device *dev = cmd->se_dev;
        sector_t range;
        sector_t lba = cmd->t_task_lba;
-        unsigned int num_blocks;
        int ret;
        /*
-         * Extract num_blocks from the WRITE_SAME_* CDB.  Then use the explict
+         * Use the explicit range when non zero is supplied, otherwise calculate
-         * range when non zero is supplied, otherwise calculate the remaining
+         * the remaining range based on ->get_blocks() - starting LBA.
-         * range based on ->get_blocks() - starting LBA.
         */
-        if (write_same32)
-                num_blocks = get_unaligned_be32(&cmd->t_task_cdb[28]);
-        else
-                num_blocks = get_unaligned_be32(&cmd->t_task_cdb[10]);
        if (num_blocks != 0)
                range = num_blocks;
        else
@@ -1117,8 +1144,6 @@ target_emulate_write_same(struct se_task *task, int write_same32)
                return ret;
        }
-        task->task_scsi_status = GOOD;
-        transport_complete_task(task, 1);
        return 0;
 }
@@ -1165,13 +1190,23 @@ transport_emulate_control_cdb(struct se_task *task)
                }
                ret = target_emulate_unmap(task);
                break;
+        case WRITE_SAME:
+                if (!dev->transport->do_discard) {
+                        pr_err("WRITE_SAME emulation not supported"
+                                        " for: %s\n", dev->transport->name);
+                        return PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                }
+                ret = target_emulate_write_same(task,
+                                get_unaligned_be16(&cmd->t_task_cdb[7]));
+                break;
        case WRITE_SAME_16:
                if (!dev->transport->do_discard) {
                        pr_err("WRITE_SAME_16 emulation not supported"
                                        " for: %s\n", dev->transport->name);
                        return PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
                }
-                ret = target_emulate_write_same(task, 0);
+                ret = target_emulate_write_same(task,
+                                get_unaligned_be32(&cmd->t_task_cdb[10]));
                break;
        case VARIABLE_LENGTH_CMD:
                service_action =
@@ -1184,7 +1219,8 @@ transport_emulate_control_cdb(struct se_task *task)
                                        dev->transport->name);
                                return PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
                        }
-                        ret = target_emulate_write_same(task, 1);
+                        ret = target_emulate_write_same(task,
+                                get_unaligned_be32(&cmd->t_task_cdb[28]));
                        break;
                default:
                        pr_err("Unsupported VARIABLE_LENGTH_CMD SA:"
@@ -1219,8 +1255,14 @@ transport_emulate_control_cdb(struct se_task *task)
        if (ret < 0)
                return ret;
-        task->task_scsi_status = GOOD;
+        /*
-        transport_complete_task(task, 1);
+         * Handle the successful completion here unless a caller
+         * has explictly requested an asychronous completion.
+         */
+        if (!(cmd->se_cmd_flags & SCF_EMULATE_CDB_ASYNC)) {
+                task->task_scsi_status = GOOD;
+                transport_complete_task(task, 1);
+        }
        return PYX_TRANSPORT_SENT_TO_TRANSPORT;
 }
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index b38b6c993e65..ca6e4a4df134 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -472,9 +472,9 @@ void core_clear_lun_from_tpg(struct se_lun *lun, struct se_portal_group *tpg)
        struct se_dev_entry *deve;
        u32 i;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        list_for_each_entry(nacl, &tpg->acl_node_list, acl_list) {
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
                spin_lock_irq(&nacl->device_list_lock);
                for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
@@ -491,9 +491,9 @@ void core_clear_lun_from_tpg(struct se_lun *lun, struct se_portal_group *tpg)
                }
                spin_unlock_irq(&nacl->device_list_lock);
-                spin_lock_bh(&tpg->acl_node_lock);
+                spin_lock_irq(&tpg->acl_node_lock);
        }
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
 }
 static struct se_port *core_alloc_port(struct se_device *dev)
@@ -839,6 +839,24 @@ int se_dev_check_shutdown(struct se_device *dev)
        return ret;
 }
+u32 se_dev_align_max_sectors(u32 max_sectors, u32 block_size)
+{
+        u32 tmp, aligned_max_sectors;
+        /*
+         * Limit max_sectors to a PAGE_SIZE aligned value for modern
+         * transport_allocate_data_tasks() operation.
+         */
+        tmp = rounddown((max_sectors * block_size), PAGE_SIZE);
+        aligned_max_sectors = (tmp / block_size);
+        if (max_sectors != aligned_max_sectors) {
+                printk(KERN_INFO "Rounding down aligned max_sectors from %u"
+                                " to %u\n", max_sectors, aligned_max_sectors);
+                return aligned_max_sectors;
+        }
+        return max_sectors;
+}
 void se_dev_set_default_attribs(
        struct se_device *dev,
        struct se_dev_limits *dev_limits)
@@ -878,6 +896,11 @@ void se_dev_set_default_attribs(
         * max_sectors is based on subsystem plugin dependent requirements.
         */
        dev->se_sub_dev->se_dev_attrib.hw_max_sectors = limits->max_hw_sectors;
+        /*
+         * Align max_sectors down to PAGE_SIZE to follow transport_allocate_data_tasks()
+         */
+        limits->max_sectors = se_dev_align_max_sectors(limits->max_sectors,
+                                                limits->logical_block_size);
        dev->se_sub_dev->se_dev_attrib.max_sectors = limits->max_sectors;
        /*
         * Set optimal_sectors from max_sectors, which can be lowered via
@@ -1242,6 +1265,11 @@ int se_dev_set_max_sectors(struct se_device *dev, u32 max_sectors)
                        return -EINVAL;
                }
        }
+        /*
+         * Align max_sectors down to PAGE_SIZE to follow transport_allocate_data_tasks()
+         */
+        max_sectors = se_dev_align_max_sectors(max_sectors,
+                                dev->se_sub_dev->se_dev_attrib.block_size);
        dev->se_sub_dev->se_dev_attrib.max_sectors = max_sectors;
        pr_debug("dev[%p]: SE Device max_sectors changed to %u\n",
@@ -1344,15 +1372,17 @@ struct se_lun *core_dev_add_lun(
         */
        if (tpg->se_tpg_tfo->tpg_check_demo_mode(tpg)) {
                struct se_node_acl *acl;
-                spin_lock_bh(&tpg->acl_node_lock);
+                spin_lock_irq(&tpg->acl_node_lock);
                list_for_each_entry(acl, &tpg->acl_node_list, acl_list) {
-                        if (acl->dynamic_node_acl) {
+                        if (acl->dynamic_node_acl &&
-                                spin_unlock_bh(&tpg->acl_node_lock);
+                            (!tpg->se_tpg_tfo->tpg_check_demo_mode_login_only ||
+                             !tpg->se_tpg_tfo->tpg_check_demo_mode_login_only(tpg))) {
+                                spin_unlock_irq(&tpg->acl_node_lock);
                                core_tpg_add_node_to_devs(acl, tpg);
-                                spin_lock_bh(&tpg->acl_node_lock);
+                                spin_lock_irq(&tpg->acl_node_lock);
                        }
                }
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
        }
        return lun_p;
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index f1654694f4ea..55bbe0847a6d 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -481,7 +481,7 @@ static struct config_group *target_fabric_make_nodeacl(
        se_nacl = tf->tf_ops.fabric_make_nodeacl(se_tpg, group, name);
        if (IS_ERR(se_nacl))
-                return ERR_PTR(PTR_ERR(se_nacl));
+                return ERR_CAST(se_nacl);
        nacl_cg = &se_nacl->acl_group;
        nacl_cg->default_groups = se_nacl->acl_default_groups;
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 1c1b849cd4fb..7fd3a161f7cc 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1598,14 +1598,14 @@ static int core_scsi3_decode_spec_i_port(
                         * from the decoded fabric module specific TransportID
                         * at *i_str.
                         */
-                        spin_lock_bh(&tmp_tpg->acl_node_lock);
+                        spin_lock_irq(&tmp_tpg->acl_node_lock);
                        dest_node_acl = __core_tpg_get_initiator_node_acl(
                                                tmp_tpg, i_str);
                        if (dest_node_acl) {
                                atomic_inc(&dest_node_acl->acl_pr_ref_count);
                                smp_mb__after_atomic_inc();
                        }
-                        spin_unlock_bh(&tmp_tpg->acl_node_lock);
+                        spin_unlock_irq(&tmp_tpg->acl_node_lock);
                        if (!dest_node_acl) {
                                core_scsi3_tpg_undepend_item(tmp_tpg);
@@ -3496,14 +3496,14 @@ after_iport_check:
        /*
         * Locate the destination struct se_node_acl from the received Transport ID
         */
-        spin_lock_bh(&dest_se_tpg->acl_node_lock);
+        spin_lock_irq(&dest_se_tpg->acl_node_lock);
        dest_node_acl = __core_tpg_get_initiator_node_acl(dest_se_tpg,
                                initiator_str);
        if (dest_node_acl) {
                atomic_inc(&dest_node_acl->acl_pr_ref_count);
                smp_mb__after_atomic_inc();
        }
-        spin_unlock_bh(&dest_se_tpg->acl_node_lock);
+        spin_unlock_irq(&dest_se_tpg->acl_node_lock);
        if (!dest_node_acl) {
                pr_err("Unable to locate %s dest_node_acl for"
diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
index 3dd81d24d9a9..e567e129c697 100644
--- a/drivers/target/target_core_rd.c
+++ b/drivers/target/target_core_rd.c
@@ -390,12 +390,10 @@ static int rd_MEMCPY_read(struct rd_request *req)
                                length = req->rd_size;
                        dst = sg_virt(&sg_d[i++]) + dst_offset;
-                        if (!dst)
+                        BUG_ON(!dst);
-                                BUG();
                        src = sg_virt(&sg_s[j]) + src_offset;
-                        if (!src)
+                        BUG_ON(!src);
-                                BUG();
                        dst_offset = 0;
                        src_offset = length;
@@ -415,8 +413,7 @@ static int rd_MEMCPY_read(struct rd_request *req)
                                length = req->rd_size;
                        dst = sg_virt(&sg_d[i]) + dst_offset;
-                        if (!dst)
+                        BUG_ON(!dst);
-                                BUG();
                        if (sg_d[i].length == length) {
                                i++;
@@ -425,8 +422,7 @@ static int rd_MEMCPY_read(struct rd_request *req)
                                dst_offset = length;
                        src = sg_virt(&sg_s[j++]) + src_offset;
-                        if (!src)
+                        BUG_ON(!src);
-                                BUG();
                        src_offset = 0;
                        page_end = 1;
@@ -510,12 +506,10 @@ static int rd_MEMCPY_write(struct rd_request *req)
                                length = req->rd_size;
                        src = sg_virt(&sg_s[i++]) + src_offset;
-                        if (!src)
+                        BUG_ON(!src);
-                                BUG();
                        dst = sg_virt(&sg_d[j]) + dst_offset;
-                        if (!dst)
+                        BUG_ON(!dst);
-                                BUG();
                        src_offset = 0;
                        dst_offset = length;
@@ -535,8 +529,7 @@ static int rd_MEMCPY_write(struct rd_request *req)
                                length = req->rd_size;
                        src = sg_virt(&sg_s[i]) + src_offset;
-                        if (!src)
+                        BUG_ON(!src);
-                                BUG();
                        if (sg_s[i].length == length) {
                                i++;
@@ -545,8 +538,7 @@ static int rd_MEMCPY_write(struct rd_request *req)
                                src_offset = length;
                        dst = sg_virt(&sg_d[j++]) + dst_offset;
-                        if (!dst)
+                        BUG_ON(!dst);
-                                BUG();
                        dst_offset = 0;
                        page_end = 1;
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index 4f1ba4c5ef11..162b736c7342 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -137,15 +137,15 @@ struct se_node_acl *core_tpg_get_initiator_node_acl(
 {
        struct se_node_acl *acl;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        list_for_each_entry(acl, &tpg->acl_node_list, acl_list) {
                if (!strcmp(acl->initiatorname, initiatorname) &&
                    !acl->dynamic_node_acl) {
-                        spin_unlock_bh(&tpg->acl_node_lock);
+                        spin_unlock_irq(&tpg->acl_node_lock);
                        return acl;
                }
        }
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        return NULL;
 }
@@ -298,13 +298,21 @@ struct se_node_acl *core_tpg_check_initiator_node_acl(
                tpg->se_tpg_tfo->tpg_release_fabric_acl(tpg, acl);
                return NULL;
        }
+        /*
+         * Here we only create demo-mode MappedLUNs from the active
+         * TPG LUNs if the fabric is not explictly asking for
+         * tpg_check_demo_mode_login_only() == 1.
+         */
+        if ((tpg->se_tpg_tfo->tpg_check_demo_mode_login_only != NULL) &&
+            (tpg->se_tpg_tfo->tpg_check_demo_mode_login_only(tpg) == 1))
+                do { ; } while (0);
+        else
+                core_tpg_add_node_to_devs(acl, tpg);
-        core_tpg_add_node_to_devs(acl, tpg);
+        spin_lock_irq(&tpg->acl_node_lock);
-        spin_lock_bh(&tpg->acl_node_lock);
        list_add_tail(&acl->acl_list, &tpg->acl_node_list);
        tpg->num_node_acls++;
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        pr_debug("%s_TPG[%u] - Added DYNAMIC ACL with TCQ Depth: %d for %s"
                " Initiator Node: %s\n", tpg->se_tpg_tfo->get_fabric_name(),
@@ -354,7 +362,7 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
 {
        struct se_node_acl *acl = NULL;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        acl = __core_tpg_get_initiator_node_acl(tpg, initiatorname);
        if (acl) {
                if (acl->dynamic_node_acl) {
@@ -362,7 +370,7 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
                        pr_debug("%s_TPG[%u] - Replacing dynamic ACL"
                                " for %s\n", tpg->se_tpg_tfo->get_fabric_name(),
                                tpg->se_tpg_tfo->tpg_get_tag(tpg), initiatorname);
-                        spin_unlock_bh(&tpg->acl_node_lock);
+                        spin_unlock_irq(&tpg->acl_node_lock);
                        /*
                         * Release the locally allocated struct se_node_acl
                         * because * core_tpg_add_initiator_node_acl() returned
@@ -378,10 +386,10 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
                        " Node %s already exists for TPG %u, ignoring"
                        " request.\n",  tpg->se_tpg_tfo->get_fabric_name(),
                        initiatorname, tpg->se_tpg_tfo->tpg_get_tag(tpg));
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
                return ERR_PTR(-EEXIST);
        }
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        if (!se_nacl) {
                pr_err("struct se_node_acl pointer is NULL\n");
@@ -418,10 +426,10 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
                return ERR_PTR(-EINVAL);
        }
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        list_add_tail(&acl->acl_list, &tpg->acl_node_list);
        tpg->num_node_acls++;
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
 done:
        pr_debug("%s_TPG[%hu] - Added ACL with TCQ Depth: %d for %s"
@@ -445,14 +453,14 @@ int core_tpg_del_initiator_node_acl(
        struct se_session *sess, *sess_tmp;
        int dynamic_acl = 0;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        if (acl->dynamic_node_acl) {
                acl->dynamic_node_acl = 0;
                dynamic_acl = 1;
        }
        list_del(&acl->acl_list);
        tpg->num_node_acls--;
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        spin_lock_bh(&tpg->session_lock);
        list_for_each_entry_safe(sess, sess_tmp,
@@ -503,21 +511,21 @@ int core_tpg_set_initiator_node_queue_depth(
        struct se_node_acl *acl;
        int dynamic_acl = 0;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        acl = __core_tpg_get_initiator_node_acl(tpg, initiatorname);
        if (!acl) {
                pr_err("Access Control List entry for %s Initiator"
                        " Node %s does not exists for TPG %hu, ignoring"
                        " request.\n", tpg->se_tpg_tfo->get_fabric_name(),
                        initiatorname, tpg->se_tpg_tfo->tpg_get_tag(tpg));
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
                return -ENODEV;
        }
        if (acl->dynamic_node_acl) {
                acl->dynamic_node_acl = 0;
                dynamic_acl = 1;
        }
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        spin_lock_bh(&tpg->session_lock);
        list_for_each_entry(sess, &tpg->tpg_sess_list, sess_list) {
@@ -533,10 +541,10 @@ int core_tpg_set_initiator_node_queue_depth(
                                tpg->se_tpg_tfo->get_fabric_name(), initiatorname);
                        spin_unlock_bh(&tpg->session_lock);
-                        spin_lock_bh(&tpg->acl_node_lock);
+                        spin_lock_irq(&tpg->acl_node_lock);
                        if (dynamic_acl)
                                acl->dynamic_node_acl = 1;
-                        spin_unlock_bh(&tpg->acl_node_lock);
+                        spin_unlock_irq(&tpg->acl_node_lock);
                        return -EEXIST;
                }
                /*
@@ -571,10 +579,10 @@ int core_tpg_set_initiator_node_queue_depth(
                if (init_sess)
                        tpg->se_tpg_tfo->close_session(init_sess);
-                spin_lock_bh(&tpg->acl_node_lock);
+                spin_lock_irq(&tpg->acl_node_lock);
                if (dynamic_acl)
                        acl->dynamic_node_acl = 1;
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
                return -EINVAL;
        }
        spin_unlock_bh(&tpg->session_lock);
@@ -590,10 +598,10 @@ int core_tpg_set_initiator_node_queue_depth(
                initiatorname, tpg->se_tpg_tfo->get_fabric_name(),
                tpg->se_tpg_tfo->tpg_get_tag(tpg));
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        if (dynamic_acl)
                acl->dynamic_node_acl = 1;
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        return 0;
 }
@@ -717,20 +725,20 @@ int core_tpg_deregister(struct se_portal_group *se_tpg)
         * not been released because of TFO->tpg_check_demo_mode_cache() == 1
         * in transport_deregister_session().
         */
-        spin_lock_bh(&se_tpg->acl_node_lock);
+        spin_lock_irq(&se_tpg->acl_node_lock);
        list_for_each_entry_safe(nacl, nacl_tmp, &se_tpg->acl_node_list,
                        acl_list) {
                list_del(&nacl->acl_list);
                se_tpg->num_node_acls--;
-                spin_unlock_bh(&se_tpg->acl_node_lock);
+                spin_unlock_irq(&se_tpg->acl_node_lock);
                core_tpg_wait_for_nacl_pr_ref(nacl);
                core_free_device_list_for_node(nacl, se_tpg);
                se_tpg->se_tpg_tfo->tpg_release_fabric_acl(se_tpg, nacl);
-                spin_lock_bh(&se_tpg->acl_node_lock);
+                spin_lock_irq(&se_tpg->acl_node_lock);
        }
-        spin_unlock_bh(&se_tpg->acl_node_lock);
+        spin_unlock_irq(&se_tpg->acl_node_lock);
        if (se_tpg->se_tpg_type == TRANSPORT_TPG_TYPE_NORMAL)
                core_tpg_release_virtual_lun0(se_tpg);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 89760329d5d0..a4b0a8d27f25 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -389,17 +389,18 @@ void transport_deregister_session(struct se_session *se_sess)
 {
        struct se_portal_group *se_tpg = se_sess->se_tpg;
        struct se_node_acl *se_nacl;
+        unsigned long flags;
        if (!se_tpg) {
                transport_free_session(se_sess);
                return;
        }
-        spin_lock_bh(&se_tpg->session_lock);
+        spin_lock_irqsave(&se_tpg->session_lock, flags);
        list_del(&se_sess->sess_list);
        se_sess->se_tpg = NULL;
        se_sess->fabric_sess_ptr = NULL;
-        spin_unlock_bh(&se_tpg->session_lock);
+        spin_unlock_irqrestore(&se_tpg->session_lock, flags);
        /*
         * Determine if we need to do extra work for this initiator node's
@@ -407,22 +408,22 @@ void transport_deregister_session(struct se_session *se_sess)
         */
        se_nacl = se_sess->se_node_acl;
        if (se_nacl) {
-                spin_lock_bh(&se_tpg->acl_node_lock);
+                spin_lock_irqsave(&se_tpg->acl_node_lock, flags);
                if (se_nacl->dynamic_node_acl) {
                        if (!se_tpg->se_tpg_tfo->tpg_check_demo_mode_cache(
                                        se_tpg)) {
                                list_del(&se_nacl->acl_list);
                                se_tpg->num_node_acls--;
-                                spin_unlock_bh(&se_tpg->acl_node_lock);
+                                spin_unlock_irqrestore(&se_tpg->acl_node_lock, flags);
                                core_tpg_wait_for_nacl_pr_ref(se_nacl);
                                core_free_device_list_for_node(se_nacl, se_tpg);
                                se_tpg->se_tpg_tfo->tpg_release_fabric_acl(se_tpg,
                                                se_nacl);
-                                spin_lock_bh(&se_tpg->acl_node_lock);
+                                spin_lock_irqsave(&se_tpg->acl_node_lock, flags);
                        }
                }
-                spin_unlock_bh(&se_tpg->acl_node_lock);
+                spin_unlock_irqrestore(&se_tpg->acl_node_lock, flags);
        }
        transport_free_session(se_sess);
@@ -976,15 +977,17 @@ static void target_qf_do_work(struct work_struct *work)
 {
        struct se_device *dev = container_of(work, struct se_device,
                                        qf_work_queue);
+        LIST_HEAD(qf_cmd_list);
        struct se_cmd *cmd, *cmd_tmp;
        spin_lock_irq(&dev->qf_cmd_lock);
-        list_for_each_entry_safe(cmd, cmd_tmp, &dev->qf_cmd_list, se_qf_node) {
+        list_splice_init(&dev->qf_cmd_list, &qf_cmd_list);
+        spin_unlock_irq(&dev->qf_cmd_lock);
+        list_for_each_entry_safe(cmd, cmd_tmp, &qf_cmd_list, se_qf_node) {
                list_del(&cmd->se_qf_node);
                atomic_dec(&dev->dev_qf_count);
                smp_mb__after_atomic_dec();
-                spin_unlock_irq(&dev->qf_cmd_lock);
                pr_debug("Processing %s cmd: %p QUEUE_FULL in work queue"
                        " context: %s\n", cmd->se_tfo->get_fabric_name(), cmd,
@@ -996,10 +999,7 @@ static void target_qf_do_work(struct work_struct *work)
                 * has been added to head of queue
                 */
                transport_add_cmd_to_queue(cmd, cmd->t_state);
-                spin_lock_irq(&dev->qf_cmd_lock);
        }
-        spin_unlock_irq(&dev->qf_cmd_lock);
 }
 unsigned char *transport_dump_cmd_direction(struct se_cmd *cmd)
@@ -2053,8 +2053,14 @@ static void transport_generic_request_failure(
                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
                break;
        }
+        /*
-        if (!sc)
+         * If a fabric does not define a cmd->se_tfo->new_cmd_map caller,
+         * make the call to transport_send_check_condition_and_sense()
+         * directly.  Otherwise expect the fabric to make the call to
+         * transport_send_check_condition_and_sense() after handling
+         * possible unsoliticied write data payloads.
+         */
+        if (!sc && !cmd->se_tfo->new_cmd_map)
                transport_new_cmd_failure(cmd);
        else {
                ret = transport_send_check_condition_and_sense(cmd,
@@ -2847,12 +2853,42 @@ static int transport_cmd_get_valid_sectors(struct se_cmd *cmd)
                        " transport_dev_end_lba(): %llu\n",
                        cmd->t_task_lba, sectors,
                        transport_dev_end_lba(dev));
-                pr_err("  We should return CHECK_CONDITION"
+                return -EINVAL;
-                       " but we don't yet\n");
-                return 0;
        }
-        return sectors;
+        return 0;
+}
+static int target_check_write_same_discard(unsigned char *flags, struct se_device *dev)
+{
+        /*
+         * Determine if the received WRITE_SAME is used to for direct
+         * passthrough into Linux/SCSI with struct request via TCM/pSCSI
+         * or we are signaling the use of internal WRITE_SAME + UNMAP=1
+         * emulation for -> Linux/BLOCK disbard with TCM/IBLOCK code.
+         */
+        int passthrough = (dev->transport->transport_type ==
+                                TRANSPORT_PLUGIN_PHBA_PDEV);
+        if (!passthrough) {
+                if ((flags[0] & 0x04) || (flags[0] & 0x02)) {
+                        pr_err("WRITE_SAME PBDATA and LBDATA"
+                                " bits not supported for Block Discard"
+                                " Emulation\n");
+                        return -ENOSYS;
+                }
+                /*
+                 * Currently for the emulated case we only accept
+                 * tpws with the UNMAP=1 bit set.
+                 */
+                if (!(flags[0] & 0x08)) {
+                        pr_err("WRITE_SAME w/o UNMAP bit not"
+                                " supported for Block Discard Emulation\n");
+                        return -ENOSYS;
+                }
+        }
+        return 0;
 }
 /*      transport_generic_cmd_sequencer():
@@ -3065,7 +3101,7 @@ static int transport_generic_cmd_sequencer(
                                goto out_unsupported_cdb;
                        if (sectors)
-                                size = transport_get_size(sectors, cdb, cmd);
+                                size = transport_get_size(1, cdb, cmd);
                        else {
                                pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not"
                                       " supported\n");
@@ -3075,27 +3111,9 @@ static int transport_generic_cmd_sequencer(
                        cmd->t_task_lba = get_unaligned_be64(&cdb[12]);
                        cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
-                        /*
+                        if (target_check_write_same_discard(&cdb[10], dev) < 0)
-                         * Skip the remaining assignments for TCM/PSCSI passthrough
-                         */
-                        if (passthrough)
-                                break;
-                        if ((cdb[10] & 0x04) || (cdb[10] & 0x02)) {
-                                pr_err("WRITE_SAME PBDATA and LBDATA"
-                                        " bits not supported for Block Discard"
-                                        " Emulation\n");
                                goto out_invalid_cdb_field;
-                        }
-                        /*
-                         * Currently for the emulated case we only accept
-                         * tpws with the UNMAP=1 bit set.
-                         */
-                        if (!(cdb[10] & 0x08)) {
-                                pr_err("WRITE_SAME w/o UNMAP bit not"
-                                        " supported for Block Discard Emulation\n");
-                                goto out_invalid_cdb_field;
-                        }
                        break;
                default:
                        pr_err("VARIABLE_LENGTH_CMD service action"
@@ -3330,10 +3348,12 @@ static int transport_generic_cmd_sequencer(
                cmd->se_cmd_flags |= SCF_EMULATE_CDB_ASYNC;
                /*
                 * Check to ensure that LBA + Range does not exceed past end of
-                 * device.
+                 * device for IBLOCK and FILEIO ->do_sync_cache() backend calls
                 */
-                if (!transport_cmd_get_valid_sectors(cmd))
+                if ((cmd->t_task_lba != 0) || (sectors != 0)) {
-                        goto out_invalid_cdb_field;
+                        if (transport_cmd_get_valid_sectors(cmd) < 0)
+                                goto out_invalid_cdb_field;
+                }
                break;
        case UNMAP:
                size = get_unaligned_be16(&cdb[7]);
@@ -3345,40 +3365,38 @@ static int transport_generic_cmd_sequencer(
                        goto out_unsupported_cdb;
                if (sectors)
-                        size = transport_get_size(sectors, cdb, cmd);
+                        size = transport_get_size(1, cdb, cmd);
                else {
                        pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
                        goto out_invalid_cdb_field;
                }
                cmd->t_task_lba = get_unaligned_be64(&cdb[2]);
-                passthrough = (dev->transport->transport_type ==
+                cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
-                                TRANSPORT_PLUGIN_PHBA_PDEV);
-                /*
+                if (target_check_write_same_discard(&cdb[1], dev) < 0)
-                 * Determine if the received WRITE_SAME_16 is used to for direct
+                        goto out_invalid_cdb_field;
-                 * passthrough into Linux/SCSI with struct request via TCM/pSCSI
+                break;
-                 * or we are signaling the use of internal WRITE_SAME + UNMAP=1
+        case WRITE_SAME:
-                 * emulation for -> Linux/BLOCK disbard with TCM/IBLOCK and
+                sectors = transport_get_sectors_10(cdb, cmd, &sector_ret);
-                 * TCM/FILEIO subsystem plugin backstores.
+                if (sector_ret)
-                 */
+                        goto out_unsupported_cdb;
-                if (!passthrough) {
-                        if ((cdb[1] & 0x04) || (cdb[1] & 0x02)) {
+                if (sectors)
-                                pr_err("WRITE_SAME PBDATA and LBDATA"
+                        size = transport_get_size(1, cdb, cmd);
-                                        " bits not supported for Block Discard"
+                else {
-                                        " Emulation\n");
+                        pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
-                                goto out_invalid_cdb_field;
+                        goto out_invalid_cdb_field;
-                        }
-                        /*
-                         * Currently for the emulated case we only accept
-                         * tpws with the UNMAP=1 bit set.
-                         */
-                        if (!(cdb[1] & 0x08)) {
-                                pr_err("WRITE_SAME w/o UNMAP bit not "
-                                        " supported for Block Discard Emulation\n");
-                                goto out_invalid_cdb_field;
-                        }
                }
+                cmd->t_task_lba = get_unaligned_be32(&cdb[2]);
                cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
+                /*
+                 * Follow sbcr26 with WRITE_SAME (10) and check for the existence
+                 * of byte 1 bit 3 UNMAP instead of original reserved field
+                 */
+                if (target_check_write_same_discard(&cdb[1], dev) < 0)
+                        goto out_invalid_cdb_field;
                break;
        case ALLOW_MEDIUM_REMOVAL:
        case GPCMD_CLOSE_TRACK:
@@ -3873,9 +3891,7 @@ EXPORT_SYMBOL(transport_generic_map_mem_to_cmd);
 static int transport_new_cmd_obj(struct se_cmd *cmd)
 {
        struct se_device *dev = cmd->se_dev;
-        u32 task_cdbs;
+        int set_counts = 1, rc, task_cdbs;
-        u32 rc;
-        int set_counts = 1;
        /*
         * Setup any BIDI READ tasks and memory from
@@ -3893,7 +3909,7 @@ static int transport_new_cmd_obj(struct se_cmd *cmd)
                        cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
                        cmd->scsi_sense_reason =
                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                        return PYX_TRANSPORT_LU_COMM_FAILURE;
+                        return -EINVAL;
                }
                atomic_inc(&cmd->t_fe_count);
                atomic_inc(&cmd->t_se_count);
@@ -3912,7 +3928,7 @@ static int transport_new_cmd_obj(struct se_cmd *cmd)
                cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
                cmd->scsi_sense_reason =
                        TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                return -EINVAL;
        }
        if (set_counts) {
@@ -4028,8 +4044,6 @@ void transport_do_task_sg_chain(struct se_cmd *cmd)
                if (!task->task_sg)
                        continue;
-                BUG_ON(!task->task_padded_sg);
                if (!sg_first) {
                        sg_first = task->task_sg;
                        chained_nents = task->task_sg_nents;
@@ -4037,9 +4051,19 @@ void transport_do_task_sg_chain(struct se_cmd *cmd)
                        sg_chain(sg_prev, sg_prev_nents, task->task_sg);
                        chained_nents += task->task_sg_nents;
                }
+                /*
+                 * For the padded tasks, use the extra SGL vector allocated
+                 * in transport_allocate_data_tasks() for the sg_prev_nents
+                 * offset into sg_chain() above..  The last task of a
+                 * multi-task list, or a single task will not have
+                 * task->task_sg_padded set..
+                 */
+                if (task->task_padded_sg)
+                        sg_prev_nents = (task->task_sg_nents + 1);
+                else
+                        sg_prev_nents = task->task_sg_nents;
                sg_prev = task->task_sg;
-                sg_prev_nents = task->task_sg_nents;
        }
        /*
         * Setup the starting pointer and total t_tasks_sg_linked_no including
@@ -4091,7 +4115,7 @@ static int transport_allocate_data_tasks(
        
        cmd_sg = sgl;
        for (i = 0; i < task_count; i++) {
-                unsigned int task_size;
+                unsigned int task_size, task_sg_nents_padded;
                int count;
                task = transport_generic_get_task(cmd, data_direction);
@@ -4110,30 +4134,33 @@ static int transport_allocate_data_tasks(
                /* Update new cdb with updated lba/sectors */
                cmd->transport_split_cdb(task->task_lba, task->task_sectors, cdb);
+                /*
+                 * This now assumes that passed sg_ents are in PAGE_SIZE chunks
+                 * in order to calculate the number per task SGL entries
+                 */
+                task->task_sg_nents = DIV_ROUND_UP(task->task_size, PAGE_SIZE);
                /*
                 * Check if the fabric module driver is requesting that all
                 * struct se_task->task_sg[] be chained together..  If so,
                 * then allocate an extra padding SG entry for linking and
-                 * marking the end of the chained SGL.
+                 * marking the end of the chained SGL for every task except
-                 * Possibly over-allocate task sgl size by using cmd sgl size.
+                 * the last one for (task_count > 1) operation, or skipping
-                 * It's so much easier and only a waste when task_count > 1.
+                 * the extra padding for the (task_count == 1) case.
-                 * That is extremely rare.
                 */
-                task->task_sg_nents = sgl_nents;
+                if (cmd->se_tfo->task_sg_chaining && (i < (task_count - 1))) {
-                if (cmd->se_tfo->task_sg_chaining) {
+                        task_sg_nents_padded = (task->task_sg_nents + 1);
-                        task->task_sg_nents++;
                        task->task_padded_sg = 1;
-                }
+                } else
+                        task_sg_nents_padded = task->task_sg_nents;
                task->task_sg = kmalloc(sizeof(struct scatterlist) *
-                                        task->task_sg_nents, GFP_KERNEL);
+                                        task_sg_nents_padded, GFP_KERNEL);
                if (!task->task_sg) {
                        cmd->se_dev->transport->free_task(task);
                        return -ENOMEM;
                }
-                sg_init_table(task->task_sg, task->task_sg_nents);
+                sg_init_table(task->task_sg, task_sg_nents_padded);
                task_size = task->task_size;
@@ -4230,10 +4257,13 @@ static u32 transport_allocate_tasks(
        struct scatterlist *sgl,
        unsigned int sgl_nents)
 {
-        if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB)
+        if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) {
+                if (transport_cmd_get_valid_sectors(cmd) < 0)
+                        return -EINVAL;
                return transport_allocate_data_tasks(cmd, lba, data_direction,
                                                     sgl, sgl_nents);
-        else
+        } else
                return transport_allocate_control_task(cmd);
 }
@@ -4726,6 +4756,13 @@ int transport_send_check_condition_and_sense(
         */
        switch (reason) {
        case TCM_NON_EXISTENT_LUN:
+                /* CURRENT ERROR */
+                buffer[offset] = 0x70;
+                /* ILLEGAL REQUEST */
+                buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+                /* LOGICAL UNIT NOT SUPPORTED */
+                buffer[offset+SPC_ASC_KEY_OFFSET] = 0x25;
+                break;
        case TCM_UNSUPPORTED_SCSI_OPCODE:
        case TCM_SECTOR_COUNT_TOO_MANY:
                /* CURRENT ERROR */
diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h
index bd4fe21a23b8..3749d8b4b423 100644
--- a/drivers/target/tcm_fc/tcm_fc.h
+++ b/drivers/target/tcm_fc/tcm_fc.h
@@ -98,8 +98,7 @@ struct ft_tpg {
        struct list_head list;          /* linkage in ft_lport_acl tpg_list */
        struct list_head lun_list;      /* head of LUNs */
        struct se_portal_group se_tpg;
-        struct task_struct *thread;     /* processing thread */
+        struct workqueue_struct *workqueue;
-        struct se_queue_obj qobj;       /* queue for processing thread */
 };
 struct ft_lport_acl {
@@ -110,16 +109,10 @@ struct ft_lport_acl {
        struct se_wwn fc_lport_wwn;
 };
-enum ft_cmd_state {
-        FC_CMD_ST_NEW = 0,
-        FC_CMD_ST_REJ
-};
 /*
 * Commands
 */
 struct ft_cmd {
-        enum ft_cmd_state state;
        u32 lun;                        /* LUN from request */
        struct ft_sess *sess;           /* session held for cmd */
        struct fc_seq *seq;             /* sequence in exchange mgr */
@@ -127,7 +120,7 @@ struct ft_cmd {
        struct fc_frame *req_frame;
        unsigned char *cdb;             /* pointer to CDB inside frame */
        u32 write_data_len;             /* data received on writes */
-        struct se_queue_req se_req;
+        struct work_struct work;
        /* Local sense buffer */
        unsigned char ft_sense_buffer[TRANSPORT_SENSE_BUFFER];
        u32 was_ddp_setup:1;            /* Set only if ddp is setup */
@@ -177,7 +170,6 @@ int ft_is_state_remove(struct se_cmd *);
 /*
 * other internal functions.
 */
-int ft_thread(void *);
 void ft_recv_req(struct ft_sess *, struct fc_frame *);
 struct ft_tpg *ft_lport_find_tpg(struct fc_lport *);
 struct ft_node_acl *ft_acl_get(struct ft_tpg *, struct fc_rport_priv *);
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 5654dc22f7ae..80fbcde00cb6 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -62,8 +62,8 @@ void ft_dump_cmd(struct ft_cmd *cmd, const char *caller)
        int count;
        se_cmd = &cmd->se_cmd;
-        pr_debug("%s: cmd %p state %d sess %p seq %p se_cmd %p\n",
+        pr_debug("%s: cmd %p sess %p seq %p se_cmd %p\n",
-                caller, cmd, cmd->state, cmd->sess, cmd->seq, se_cmd);
+                caller, cmd, cmd->sess, cmd->seq, se_cmd);
        pr_debug("%s: cmd %p cdb %p\n",
                caller, cmd, cmd->cdb);
        pr_debug("%s: cmd %p lun %d\n", caller, cmd, cmd->lun);
@@ -90,38 +90,6 @@ void ft_dump_cmd(struct ft_cmd *cmd, const char *caller)
                16, 4, cmd->cdb, MAX_COMMAND_SIZE, 0);
 }
-static void ft_queue_cmd(struct ft_sess *sess, struct ft_cmd *cmd)
-{
-        struct ft_tpg *tpg = sess->tport->tpg;
-        struct se_queue_obj *qobj = &tpg->qobj;
-        unsigned long flags;
-        qobj = &sess->tport->tpg->qobj;
-        spin_lock_irqsave(&qobj->cmd_queue_lock, flags);
-        list_add_tail(&cmd->se_req.qr_list, &qobj->qobj_list);
-        atomic_inc(&qobj->queue_cnt);
-        spin_unlock_irqrestore(&qobj->cmd_queue_lock, flags);
-        wake_up_process(tpg->thread);
-}
-static struct ft_cmd *ft_dequeue_cmd(struct se_queue_obj *qobj)
-{
-        unsigned long flags;
-        struct se_queue_req *qr;
-        spin_lock_irqsave(&qobj->cmd_queue_lock, flags);
-        if (list_empty(&qobj->qobj_list)) {
-                spin_unlock_irqrestore(&qobj->cmd_queue_lock, flags);
-                return NULL;
-        }
-        qr = list_first_entry(&qobj->qobj_list, struct se_queue_req, qr_list);
-        list_del(&qr->qr_list);
-        atomic_dec(&qobj->queue_cnt);
-        spin_unlock_irqrestore(&qobj->cmd_queue_lock, flags);
-        return container_of(qr, struct ft_cmd, se_req);
-}
 static void ft_free_cmd(struct ft_cmd *cmd)
 {
        struct fc_frame *fp;
@@ -282,9 +250,7 @@ u32 ft_get_task_tag(struct se_cmd *se_cmd)
 int ft_get_cmd_state(struct se_cmd *se_cmd)
 {
-        struct ft_cmd *cmd = container_of(se_cmd, struct ft_cmd, se_cmd);
+        return 0;
-        return cmd->state;
 }
 int ft_is_state_remove(struct se_cmd *se_cmd)
@@ -505,6 +471,8 @@ int ft_queue_tm_resp(struct se_cmd *se_cmd)
        return 0;
 }
+static void ft_send_work(struct work_struct *work);
 /*
 * Handle incoming FCP command.
 */
@@ -523,7 +491,9 @@ static void ft_recv_cmd(struct ft_sess *sess, struct fc_frame *fp)
                goto busy;
        }
        cmd->req_frame = fp;            /* hold frame during cmd */
-        ft_queue_cmd(sess, cmd);
+        INIT_WORK(&cmd->work, ft_send_work);
+        queue_work(sess->tport->tpg->workqueue, &cmd->work);
        return;
 busy:
@@ -563,12 +533,13 @@ void ft_recv_req(struct ft_sess *sess, struct fc_frame *fp)
 /*
 * Send new command to target.
 */
-static void ft_send_cmd(struct ft_cmd *cmd)
+static void ft_send_work(struct work_struct *work)
 {
+        struct ft_cmd *cmd = container_of(work, struct ft_cmd, work);
        struct fc_frame_header *fh = fc_frame_header_get(cmd->req_frame);
        struct se_cmd *se_cmd;
        struct fcp_cmnd *fcp;
-        int data_dir;
+        int data_dir = 0;
        u32 data_len;
        int task_attr;
        int ret;
@@ -675,42 +646,3 @@ static void ft_send_cmd(struct ft_cmd *cmd)
 err:
        ft_send_resp_code_and_free(cmd, FCP_CMND_FIELDS_INVALID);
 }
-/*
- * Handle request in the command thread.
- */
-static void ft_exec_req(struct ft_cmd *cmd)
-{
-        pr_debug("cmd state %x\n", cmd->state);
-        switch (cmd->state) {
-        case FC_CMD_ST_NEW:
-                ft_send_cmd(cmd);
-                break;
-        default:
-                break;
-        }
-}
-/*
- * Processing thread.
- * Currently one thread per tpg.
- */
-int ft_thread(void *arg)
-{
-        struct ft_tpg *tpg = arg;
-        struct se_queue_obj *qobj = &tpg->qobj;
-        struct ft_cmd *cmd;
-        while (!kthread_should_stop()) {
-                schedule_timeout_interruptible(MAX_SCHEDULE_TIMEOUT);
-                if (kthread_should_stop())
-                        goto out;
-                cmd = ft_dequeue_cmd(qobj);
-                if (cmd)
-                        ft_exec_req(cmd);
-        }
-out:
-        return 0;
-}
diff --git a/drivers/target/tcm_fc/tfc_conf.c b/drivers/target/tcm_fc/tfc_conf.c
index 8781d1e423df..8fa39b74f22c 100644
--- a/drivers/target/tcm_fc/tfc_conf.c
+++ b/drivers/target/tcm_fc/tfc_conf.c
@@ -256,7 +256,7 @@ struct ft_node_acl *ft_acl_get(struct ft_tpg *tpg, struct fc_rport_priv *rdata)
        struct se_portal_group *se_tpg = &tpg->se_tpg;
        struct se_node_acl *se_acl;
-        spin_lock_bh(&se_tpg->acl_node_lock);
+        spin_lock_irq(&se_tpg->acl_node_lock);
        list_for_each_entry(se_acl, &se_tpg->acl_node_list, acl_list) {
                acl = container_of(se_acl, struct ft_node_acl, se_node_acl);
                pr_debug("acl %p port_name %llx\n",
@@ -270,7 +270,7 @@ struct ft_node_acl *ft_acl_get(struct ft_tpg *tpg, struct fc_rport_priv *rdata)
                        break;
                }
        }
-        spin_unlock_bh(&se_tpg->acl_node_lock);
+        spin_unlock_irq(&se_tpg->acl_node_lock);
        return found;
 }
@@ -327,7 +327,6 @@ static struct se_portal_group *ft_add_tpg(
        tpg->index = index;
        tpg->lport_acl = lacl;
        INIT_LIST_HEAD(&tpg->lun_list);
-        transport_init_queue_obj(&tpg->qobj);
        ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg,
                                tpg, TRANSPORT_TPG_TYPE_NORMAL);
@@ -336,8 +335,8 @@ static struct se_portal_group *ft_add_tpg(
                return NULL;
        }
-        tpg->thread = kthread_run(ft_thread, tpg, "ft_tpg%lu", index);
+        tpg->workqueue = alloc_workqueue("tcm_fc", 0, 1);
-        if (IS_ERR(tpg->thread)) {
+        if (!tpg->workqueue) {
                kfree(tpg);
                return NULL;
        }
@@ -356,7 +355,7 @@ static void ft_del_tpg(struct se_portal_group *se_tpg)
        pr_debug("del tpg %s\n",
                    config_item_name(&tpg->se_tpg.tpg_group.cg_item));
-        kthread_stop(tpg->thread);
+        destroy_workqueue(tpg->workqueue);
        /* Wait for sessions to be freed thru RCU, for BUG_ON below */
        synchronize_rcu();
@@ -655,9 +654,7 @@ static void __exit ft_exit(void)
        synchronize_rcu();
 }
-#ifdef MODULE
 MODULE_DESCRIPTION("FC TCM fabric driver " FT_VERSION);
 MODULE_LICENSE("GPL");
 module_init(ft_init);
 module_exit(ft_exit);
-#endif /* MODULE */
diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
index c37f4cd96452..d35ea5a3d56c 100644
--- a/drivers/target/tcm_fc/tfc_io.c
+++ b/drivers/target/tcm_fc/tfc_io.c
@@ -219,43 +219,41 @@ void ft_recv_write_data(struct ft_cmd *cmd, struct fc_frame *fp)
        if (cmd->was_ddp_setup) {
                BUG_ON(!ep);
                BUG_ON(!lport);
-        }
+                /*
+                 * Since DDP (Large Rx offload) was setup for this request,
-        /*
+                 * payload is expected to be copied directly to user buffers.
-         * Doesn't expect payload if DDP is setup. Payload
+                 */
-         * is expected to be copied directly to user buffers
+                buf = fc_frame_payload_get(fp, 1);
-         * due to DDP (Large Rx offload),
+                if (buf)
-         */
+                        pr_err("%s: xid 0x%x, f_ctl 0x%x, cmd->sg %p, "
-        buf = fc_frame_payload_get(fp, 1);
-        if (buf)
-                pr_err("%s: xid 0x%x, f_ctl 0x%x, cmd->sg %p, "
                                "cmd->sg_cnt 0x%x. DDP was setup"
                                " hence not expected to receive frame with "
-                                "payload, Frame will be dropped if "
+                                "payload, Frame will be dropped if"
-                                "'Sequence Initiative' bit in f_ctl is "
+                                "'Sequence Initiative' bit in f_ctl is"
                                "not set\n", __func__, ep->xid, f_ctl,
                                cmd->sg, cmd->sg_cnt);
-        /*
+                /*
-         * Invalidate HW DDP context if it was setup for respective
+                 * Invalidate HW DDP context if it was setup for respective
-         * command. Invalidation of HW DDP context is requited in both
+                 * command. Invalidation of HW DDP context is requited in both
-         * situation (success and error). 
+                 * situation (success and error).
-         */
+                 */
-        ft_invl_hw_context(cmd);
+                ft_invl_hw_context(cmd);
-        /*
+                /*
-         * If "Sequence Initiative (TSI)" bit set in f_ctl, means last
+                 * If "Sequence Initiative (TSI)" bit set in f_ctl, means last
-         * write data frame is received successfully where payload is
+                 * write data frame is received successfully where payload is
-         * posted directly to user buffer and only the last frame's
+                 * posted directly to user buffer and only the last frame's
-         * header is posted in receive queue.
+                 * header is posted in receive queue.
-         *
+                 *
-         * If "Sequence Initiative (TSI)" bit is not set, means error
+                 * If "Sequence Initiative (TSI)" bit is not set, means error
-         * condition w.r.t. DDP, hence drop the packet and let explict
+                 * condition w.r.t. DDP, hence drop the packet and let explict
-         * ABORTS from other end of exchange timer trigger the recovery.
+                 * ABORTS from other end of exchange timer trigger the recovery.
-         */
+                 */
-        if (f_ctl & FC_FC_SEQ_INIT)
+                if (f_ctl & FC_FC_SEQ_INIT)
-                goto last_frame;
+                        goto last_frame;
-        else
+                else
-                goto drop;
+                        goto drop;
+        }
        rel_off = ntohl(fh->fh_parm_offset);
        frame_len = fr_len(fp);
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 98b6e3bdb000..e809e9d4683c 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -446,8 +446,19 @@ static inline void legacy_pty_init(void) { }
 int pty_limit = NR_UNIX98_PTY_DEFAULT;
 static int pty_limit_min;
 static int pty_limit_max = NR_UNIX98_PTY_MAX;
+static int tty_count;
 static int pty_count;
+static inline void pty_inc_count(void)
+{
+        pty_count = (++tty_count) / 2;
+}
+static inline void pty_dec_count(void)
+{
+        pty_count = (--tty_count) / 2;
+}
 static struct cdev ptmx_cdev;
 static struct ctl_table pty_table[] = {
@@ -542,6 +553,7 @@ static struct tty_struct *pts_unix98_lookup(struct tty_driver *driver,
 static void pty_unix98_shutdown(struct tty_struct *tty)
 {
+        tty_driver_remove_tty(tty->driver, tty);
        /* We have our own method as we don't use the tty index */
        kfree(tty->termios);
 }
@@ -588,7 +600,8 @@ static int pty_unix98_install(struct tty_driver *driver, struct tty_struct *tty)
         */
        tty_driver_kref_get(driver);
        tty->count++;
-        pty_count++;
+        pty_inc_count(); /* tty */
+        pty_inc_count(); /* tty->link */
        return 0;
 err_free_mem:
        deinitialize_tty_struct(o_tty);
@@ -602,7 +615,7 @@ err_free_tty:
 static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
 {
-        pty_count--;
+        pty_dec_count();
 }
 static const struct tty_operations ptm_unix98_ops = {
diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c
index f2dfec82faf8..7f50999eebc2 100644
--- a/drivers/tty/serial/8250.c
+++ b/drivers/tty/serial/8250.c
@@ -1819,6 +1819,8 @@ static void serial8250_backup_timeout(unsigned long data)
        unsigned int iir, ier = 0, lsr;
        unsigned long flags;
+        spin_lock_irqsave(&up->port.lock, flags);
        /*
         * Must disable interrupts or else we risk racing with the interrupt
         * based handler.
@@ -1836,10 +1838,8 @@ static void serial8250_backup_timeout(unsigned long data)
         * the "Diva" UART used on the management processor on many HP
         * ia64 and parisc boxes.
         */
-        spin_lock_irqsave(&up->port.lock, flags);
        lsr = serial_in(up, UART_LSR);
        up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
-        spin_unlock_irqrestore(&up->port.lock, flags);
        if ((iir & UART_IIR_NO_INT) && (up->ier & UART_IER_THRI) &&
            (!uart_circ_empty(&up->port.state->xmit) || up->port.x_char) &&
            (lsr & UART_LSR_THRE)) {
@@ -1848,11 +1848,13 @@ static void serial8250_backup_timeout(unsigned long data)
        }
        if (!(iir & UART_IIR_NO_INT))
-                serial8250_handle_port(up);
+                transmit_chars(up);
        if (is_real_interrupt(up->port.irq))
                serial_out(up, UART_IER, ier);
+        spin_unlock_irqrestore(&up->port.lock, flags);
        /* Standard timer interval plus 0.2s to keep the port running */
        mod_timer(&up->timer,
                jiffies + uart_poll_timeout(&up->port) + HZ / 5);
diff --git a/drivers/tty/serial/8250_pci.c b/drivers/tty/serial/8250_pci.c
index 6b887d90a205..3abeca2a2a1b 100644
--- a/drivers/tty/serial/8250_pci.c
+++ b/drivers/tty/serial/8250_pci.c
@@ -1599,11 +1599,6 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                .device         = 0x800D,
                .init           = pci_eg20t_init,
        },
-        {
-                .vendor         = 0x10DB,
-                .device         = 0x800D,
-                .init           = pci_eg20t_init,
-        },
        /*
         * Cronyx Omega PCI (PLX-chip based)
         */
@@ -4021,7 +4016,7 @@ static struct pci_device_id serial_pci_tbl[] = {
                0, 0, pbn_NETMOS9900_2s_115200 },
        /*
-         * Best Connectivity PCI Multi I/O cards
+         * Best Connectivity and Rosewill PCI Multi I/O cards
         */
        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,
@@ -4029,6 +4024,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                0, 0, pbn_b0_1_115200 },
        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,
+                0xA000, 0x3002,
+                0, 0, pbn_b0_bt_2_115200 },
+        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,
                0xA000, 0x3004,
                0, 0, pbn_b0_bt_4_115200 },
        /* Intel CE4100 */
diff --git a/drivers/tty/serial/8250_pnp.c b/drivers/tty/serial/8250_pnp.c
index fc301f6722e1..a2f236510ff1 100644
--- a/drivers/tty/serial/8250_pnp.c
+++ b/drivers/tty/serial/8250_pnp.c
@@ -109,6 +109,9 @@ static const struct pnp_device_id pnp_dev_table[] = {
        /* IBM */
        /* IBM Thinkpad 701 Internal Modem Voice */
        {       "IBM0033",              0       },
+        /* Intermec */
+        /* Intermec CV60 touchscreen port */
+        {       "PNP4972",              0       },
        /* Intertex */
        /* Intertex 28k8 33k6 Voice EXT PnP */
        {       "IXDC801",              0       },
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index af9b7814965a..b922f5d2e61e 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1609,9 +1609,11 @@ static struct console atmel_console = {
 static int __init atmel_console_init(void)
 {
        if (atmel_default_console_device) {
-                add_preferred_console(ATMEL_DEVICENAME,
+                struct atmel_uart_data *pdata =
-                                      atmel_default_console_device->id, NULL);
+                        atmel_default_console_device->dev.platform_data;
-                atmel_init_port(&atmel_ports[atmel_default_console_device->id],
+                add_preferred_console(ATMEL_DEVICENAME, pdata->num, NULL);
+                atmel_init_port(&atmel_ports[pdata->num],
                                atmel_default_console_device);
                register_console(&atmel_console);
        }
diff --git a/drivers/tty/serial/crisv10.c b/drivers/tty/serial/crisv10.c
index 225123b37f19..58be715913cd 100644
--- a/drivers/tty/serial/crisv10.c
+++ b/drivers/tty/serial/crisv10.c
@@ -4450,7 +4450,7 @@ static int __init rs_init(void)
 #if defined(CONFIG_ETRAX_RS485)
 #if defined(CONFIG_ETRAX_RS485_ON_PA)
-        if (cris_io_interface_allocate_pins(if_ser0, 'a', rs485_pa_bit,
+        if (cris_io_interface_allocate_pins(if_serial_0, 'a', rs485_pa_bit,
                        rs485_pa_bit)) {
                printk(KERN_CRIT "ETRAX100LX serial: Could not allocate "
                        "RS485 pin\n");
@@ -4459,7 +4459,7 @@ static int __init rs_init(void)
        }
 #endif
 #if defined(CONFIG_ETRAX_RS485_ON_PORT_G)
-        if (cris_io_interface_allocate_pins(if_ser0, 'g', rs485_pa_bit,
+        if (cris_io_interface_allocate_pins(if_serial_0, 'g', rs485_pa_bit,
                        rs485_port_g_bit)) {
                printk(KERN_CRIT "ETRAX100LX serial: Could not allocate "
                        "RS485 pin\n");
diff --git a/drivers/tty/serial/max3107-aava.c b/drivers/tty/serial/max3107-aava.c
index a1fe304f2f52..d73aadd7a9ad 100644
--- a/drivers/tty/serial/max3107-aava.c
+++ b/drivers/tty/serial/max3107-aava.c
@@ -340,5 +340,5 @@ module_exit(max3107_exit);
 MODULE_DESCRIPTION("MAX3107 driver");
 MODULE_AUTHOR("Aavamobile");
-MODULE_ALIAS("aava-max3107-spi");
+MODULE_ALIAS("spi:aava-max3107");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/tty/serial/max3107.c b/drivers/tty/serial/max3107.c
index 750b4f627315..a8164601c0ea 100644
--- a/drivers/tty/serial/max3107.c
+++ b/drivers/tty/serial/max3107.c
@@ -1209,5 +1209,5 @@ module_exit(max3107_exit);
 MODULE_DESCRIPTION("MAX3107 driver");
 MODULE_AUTHOR("Aavamobile");
-MODULE_ALIAS("max3107-spi");
+MODULE_ALIAS("spi:max3107");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/tty/serial/mrst_max3110.c b/drivers/tty/serial/mrst_max3110.c
index a764bf99743b..23bc743f2a22 100644
--- a/drivers/tty/serial/mrst_max3110.c
+++ b/drivers/tty/serial/mrst_max3110.c
@@ -917,4 +917,4 @@ module_init(serial_m3110_init);
 module_exit(serial_m3110_exit);
 MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("max3110-uart");
+MODULE_ALIAS("spi:max3110-uart");
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index c37df8d0fa28..5e713d3ef1f4 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -806,8 +806,7 @@ serial_omap_set_termios(struct uart_port *port, struct ktermios *termios,
        serial_omap_set_mctrl(&up->port, up->port.mctrl);
        /* Software Flow Control Configuration */
-        if (termios->c_iflag & (IXON | IXOFF))
+        serial_omap_configure_xonxoff(up, termios);
-                serial_omap_configure_xonxoff(up, termios);
        spin_unlock_irqrestore(&up->port.lock, flags);
        dev_dbg(up->port.dev, "serial_omap_set_termios+%d\n", up->pdev->id);
diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index 846dfcd3ce0d..b46218d679e2 100644
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -598,7 +598,8 @@ static void pch_request_dma(struct uart_port *port)
        dma_cap_zero(mask);
        dma_cap_set(DMA_SLAVE, mask);
-        dma_dev = pci_get_bus_and_slot(2, PCI_DEVFN(0xa, 0)); /* Get DMA's dev
+        dma_dev = pci_get_bus_and_slot(priv->pdev->bus->number,
+                                       PCI_DEVFN(0xa, 0)); /* Get DMA's dev
                                                                information */
        /* Set Tx DMA */
        param = &priv->param_tx;
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index afc629423152..6edafb5ace18 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1225,15 +1225,19 @@ static const struct dev_pm_ops s3c24xx_serial_pm_ops = {
        .suspend = s3c24xx_serial_suspend,
        .resume = s3c24xx_serial_resume,
 };
+#define SERIAL_SAMSUNG_PM_OPS   (&s3c24xx_serial_pm_ops)
 #else /* !CONFIG_PM_SLEEP */
-#define s3c24xx_serial_pm_ops   NULL
+#define SERIAL_SAMSUNG_PM_OPS   NULL
 #endif /* CONFIG_PM_SLEEP */
 int s3c24xx_serial_init(struct platform_driver *drv,
                        struct s3c24xx_uart_info *info)
 {
        dbg("s3c24xx_serial_init(%p,%p)\n", drv, info);
-        drv->driver.pm = &s3c24xx_serial_pm_ops;
+        drv->driver.pm = SERIAL_SAMSUNG_PM_OPS;
        return platform_driver_register(drv);
 }
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index db7912cb7ae0..a3efbea5dbba 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -200,6 +200,11 @@ static int uart_startup(struct tty_struct *tty, struct uart_state *state, int in
                clear_bit(TTY_IO_ERROR, &tty->flags);
        }
+        /*
+         * This is to allow setserial on this port. People may want to set
+         * port/irq/type and then reconfigure the port properly if it failed
+         * now.
+         */
        if (retval && capable(CAP_SYS_ADMIN))
                retval = 0;
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index a9414facda47..5ea6ec3442e6 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -47,6 +47,7 @@
 #include <linux/ctype.h>
 #include <linux/err.h>
 #include <linux/dmaengine.h>
+#include <linux/dma-mapping.h>
 #include <linux/scatterlist.h>
 #include <linux/slab.h>
@@ -95,6 +96,12 @@ struct sci_port {
 #endif
        struct notifier_block           freq_transition;
+#ifdef CONFIG_SERIAL_SH_SCI_CONSOLE
+        unsigned short saved_smr;
+        unsigned short saved_fcr;
+        unsigned char saved_brr;
+#endif
 };
 /* Function prototypes */
@@ -1076,7 +1083,7 @@ static unsigned int sci_get_mctrl(struct uart_port *port)
        /* This routine is used for getting signals of: DTR, DCD, DSR, RI,
           and CTS/RTS */
-        return TIOCM_DTR | TIOCM_RTS | TIOCM_DSR;
+        return TIOCM_DTR | TIOCM_RTS | TIOCM_CTS | TIOCM_DSR;
 }
 #ifdef CONFIG_SERIAL_SH_SCI_DMA
@@ -1633,11 +1640,25 @@ static unsigned int sci_scbrr_calc(unsigned int algo_id, unsigned int bps,
        return ((freq + 16 * bps) / (32 * bps) - 1);
 }
+static void sci_reset(struct uart_port *port)
+{
+        unsigned int status;
+        do {
+                status = sci_in(port, SCxSR);
+        } while (!(status & SCxSR_TEND(port)));
+        sci_out(port, SCSCR, 0x00);     /* TE=0, RE=0, CKE1=0 */
+        if (port->type != PORT_SCI)
+                sci_out(port, SCFCR, SCFCR_RFRST | SCFCR_TFRST);
+}
 static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
                            struct ktermios *old)
 {
        struct sci_port *s = to_sci_port(port);
-        unsigned int status, baud, smr_val, max_baud;
+        unsigned int baud, smr_val, max_baud;
        int t = -1;
        u16 scfcr = 0;
@@ -1657,14 +1678,7 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
        sci_port_enable(s);
-        do {
+        sci_reset(port);
-                status = sci_in(port, SCxSR);
-        } while (!(status & SCxSR_TEND(port)));
-        sci_out(port, SCSCR, 0x00);     /* TE=0, RE=0, CKE1=0 */
-        if (port->type != PORT_SCI)
-                sci_out(port, SCFCR, scfcr | SCFCR_RFRST | SCFCR_TFRST);
        smr_val = sci_in(port, SCSMR) & 3;
@@ -2037,7 +2051,8 @@ static int __devinit serial_console_setup(struct console *co, char *options)
        if (options)
                uart_parse_options(options, &baud, &parity, &bits, &flow);
-        /* TODO: disable clock */
+        sci_port_disable(sci_port);
        return uart_set_options(port, co, baud, parity, bits, flow);
 }
@@ -2080,6 +2095,36 @@ static int __devinit sci_probe_earlyprintk(struct platform_device *pdev)
        return 0;
 }
+#define uart_console(port)      ((port)->cons->index == (port)->line)
+static int sci_runtime_suspend(struct device *dev)
+{
+        struct sci_port *sci_port = dev_get_drvdata(dev);
+        struct uart_port *port = &sci_port->port;
+        if (uart_console(port)) {
+                sci_port->saved_smr = sci_in(port, SCSMR);
+                sci_port->saved_brr = sci_in(port, SCBRR);
+                sci_port->saved_fcr = sci_in(port, SCFCR);
+        }
+        return 0;
+}
+static int sci_runtime_resume(struct device *dev)
+{
+        struct sci_port *sci_port = dev_get_drvdata(dev);
+        struct uart_port *port = &sci_port->port;
+        if (uart_console(port)) {
+                sci_reset(port);
+                sci_out(port, SCSMR, sci_port->saved_smr);
+                sci_out(port, SCBRR, sci_port->saved_brr);
+                sci_out(port, SCFCR, sci_port->saved_fcr);
+                sci_out(port, SCSCR, sci_port->cfg->scscr);
+        }
+        return 0;
+}
 #define SCI_CONSOLE     (&serial_console)
 #else
@@ -2089,6 +2134,8 @@ static inline int __devinit sci_probe_earlyprintk(struct platform_device *pdev)
 }
 #define SCI_CONSOLE     NULL
+#define sci_runtime_suspend     NULL
+#define sci_runtime_resume      NULL
 #endif /* CONFIG_SERIAL_SH_SCI_CONSOLE */
@@ -2204,6 +2251,8 @@ static int sci_resume(struct device *dev)
 }
 static const struct dev_pm_ops sci_dev_pm_ops = {
+        .runtime_suspend = sci_runtime_suspend,
+        .runtime_resume = sci_runtime_resume,
        .suspend        = sci_suspend,
        .resume         = sci_resume,
 };
diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
index c327218cad44..9af9f0879a24 100644
--- a/drivers/tty/serial/ucc_uart.c
+++ b/drivers/tty/serial/ucc_uart.c
@@ -235,7 +235,7 @@ static inline void *qe2cpu_addr(dma_addr_t addr, struct uart_qe_port *qe_port)
                return qe_port->bd_virt + (addr - qe_port->bd_dma_addr);
        /* something nasty happened */
-        printk(KERN_ERR "%s: addr=%x\n", __func__, addr);
+        printk(KERN_ERR "%s: addr=%llx\n", __func__, (u64)addr);
        BUG();
        return NULL;
 }
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 150e4f747c7d..4f1fc81112e6 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1295,8 +1295,7 @@ static int tty_driver_install_tty(struct tty_driver *driver,
 *
 *      Locking: tty_mutex for now
 */
-static void tty_driver_remove_tty(struct tty_driver *driver,
+void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
-                                                struct tty_struct *tty)
 {
        if (driver->ops->remove)
                driver->ops->remove(driver, tty);
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 8669ba3fe794..73cbbd85219f 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1775,6 +1775,8 @@ int usb_hcd_alloc_bandwidth(struct usb_device *udev,
                struct usb_interface *iface = usb_ifnum_to_if(udev,
                                cur_alt->desc.bInterfaceNumber);
+                if (!iface)
+                        return -EINVAL;
                if (iface->resetting_device) {
                        /*
                         * The USB core just reset the device, so the xHCI host
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 8f8d3f6cd89e..8f3eab1af885 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -434,6 +434,7 @@ static int pn_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
                            config_ep_by_speed(gadget, f, fp->out_ep)) {
                                fp->in_ep->desc = NULL;
                                fp->out_ep->desc = NULL;
+                                spin_unlock(&port->lock);
                                return -EINVAL;
                        }
                        usb_ep_enable(fp->out_ep);
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index e051b30c1847..4c32cb19b405 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -343,7 +343,7 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
        u32                     temp;
        u32                     power_okay;
        int                     i;
-        u8                      resume_needed = 0;
+        unsigned long           resume_needed = 0;
        if (time_before (jiffies, ehci->next_statechange))
                msleep(5);
@@ -416,7 +416,7 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
                if (test_bit(i, &ehci->bus_suspended) &&
                                (temp & PORT_SUSPEND)) {
                        temp |= PORT_RESUME;
-                        resume_needed = 1;
+                        set_bit(i, &resume_needed);
                }
                ehci_writel(ehci, temp, &ehci->regs->port_status [i]);
        }
@@ -431,8 +431,7 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
        i = HCS_N_PORTS (ehci->hcs_params);
        while (i--) {
                temp = ehci_readl(ehci, &ehci->regs->port_status [i]);
-                if (test_bit(i, &ehci->bus_suspended) &&
+                if (test_bit(i, &resume_needed)) {
-                                (temp & PORT_SUSPEND)) {
                        temp &= ~(PORT_RWC_BITS | PORT_RESUME);
                        ehci_writel(ehci, temp, &ehci->regs->port_status [i]);
                        ehci_vdbg (ehci, "resumed port %d\n", i + 1);
diff --git a/drivers/usb/host/ehci-s5p.c b/drivers/usb/host/ehci-s5p.c
index b3958b3d3163..9e77f1c8bdbd 100644
--- a/drivers/usb/host/ehci-s5p.c
+++ b/drivers/usb/host/ehci-s5p.c
@@ -86,6 +86,7 @@ static int __devinit s5p_ehci_probe(struct platform_device *pdev)
                goto fail_hcd;
        }
+        s5p_ehci->hcd = hcd;
        s5p_ehci->clk = clk_get(&pdev->dev, "usbhost");
        if (IS_ERR(s5p_ehci->clk)) {
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 0be788cc2fdb..723f8231193d 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -463,11 +463,12 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                        && (temp & PORT_POWER))
                                status |= USB_PORT_STAT_SUSPEND;
                }
-                if ((temp & PORT_PLS_MASK) == XDEV_RESUME) {
+                if ((temp & PORT_PLS_MASK) == XDEV_RESUME &&
+                                !DEV_SUPERSPEED(temp)) {
                        if ((temp & PORT_RESET) || !(temp & PORT_PE))
                                goto error;
-                        if (!DEV_SUPERSPEED(temp) && time_after_eq(jiffies,
+                        if (time_after_eq(jiffies,
-                                                bus_state->resume_done[wIndex])) {
+                                        bus_state->resume_done[wIndex])) {
                                xhci_dbg(xhci, "Resume USB2 port %d\n",
                                        wIndex + 1);
                                bus_state->resume_done[wIndex] = 0;
@@ -487,6 +488,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                xhci_ring_device(xhci, slot_id);
                                bus_state->port_c_suspend |= 1 << wIndex;
                                bus_state->suspended_ports &= ~(1 << wIndex);
+                        } else {
+                                /*
+                                 * The resume has been signaling for less than
+                                 * 20ms. Report the port status as SUSPEND,
+                                 * let the usbcore check port status again
+                                 * and clear resume signaling later.
+                                 */
+                                status |= USB_PORT_STAT_SUSPEND;
                        }
                }
                if ((temp & PORT_PLS_MASK) == XDEV_U0
@@ -664,7 +673,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                        xhci_dbg(xhci, "PORTSC %04x\n", temp);
                        if (temp & PORT_RESET)
                                goto error;
-                        if (temp & XDEV_U3) {
+                        if ((temp & PORT_PLS_MASK) == XDEV_U3) {
                                if ((temp & PORT_PE) == 0)
                                        goto error;
@@ -752,7 +761,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
        memset(buf, 0, retval);
        status = 0;
-        mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC;
+        mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC;
        spin_lock_irqsave(&xhci->lock, flags);
        /* For each port, did anything change?  If so, set that bit in buf. */
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 7113d16e2d3a..952e2ded61af 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -514,8 +514,12 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
                        (unsigned long long) addr);
 }
+/* flip_cycle means flip the cycle bit of all but the first and last TRB.
+ * (The last TRB actually points to the ring enqueue pointer, which is not part
+ * of this TD.)  This is used to remove partially enqueued isoc TDs from a ring.
+ */
 static void td_to_noop(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
-                struct xhci_td *cur_td)
+                struct xhci_td *cur_td, bool flip_cycle)
 {
        struct xhci_segment *cur_seg;
        union xhci_trb *cur_trb;
@@ -528,6 +532,12 @@ static void td_to_noop(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
                         * leave the pointers intact.
                         */
                        cur_trb->generic.field[3] &= cpu_to_le32(~TRB_CHAIN);
+                        /* Flip the cycle bit (link TRBs can't be the first
+                         * or last TRB).
+                         */
+                        if (flip_cycle)
+                                cur_trb->generic.field[3] ^=
+                                        cpu_to_le32(TRB_CYCLE);
                        xhci_dbg(xhci, "Cancel (unchain) link TRB\n");
                        xhci_dbg(xhci, "Address = %p (0x%llx dma); "
                                        "in seg %p (0x%llx dma)\n",
@@ -541,6 +551,11 @@ static void td_to_noop(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
                        cur_trb->generic.field[2] = 0;
                        /* Preserve only the cycle bit of this TRB */
                        cur_trb->generic.field[3] &= cpu_to_le32(TRB_CYCLE);
+                        /* Flip the cycle bit except on the first or last TRB */
+                        if (flip_cycle && cur_trb != cur_td->first_trb &&
+                                        cur_trb != cur_td->last_trb)
+                                cur_trb->generic.field[3] ^=
+                                        cpu_to_le32(TRB_CYCLE);
                        cur_trb->generic.field[3] |= cpu_to_le32(
                                TRB_TYPE(TRB_TR_NOOP));
                        xhci_dbg(xhci, "Cancel TRB %p (0x%llx dma) "
@@ -719,14 +734,14 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
                                        cur_td->urb->stream_id,
                                        cur_td, &deq_state);
                else
-                        td_to_noop(xhci, ep_ring, cur_td);
+                        td_to_noop(xhci, ep_ring, cur_td, false);
 remove_finished_td:
                /*
                 * The event handler won't see a completion for this TD anymore,
                 * so remove it from the endpoint ring's TD list.  Keep it in
                 * the cancelled TD list for URB completion later.
                 */
-                list_del(&cur_td->td_list);
+                list_del_init(&cur_td->td_list);
        }
        last_unlinked_td = cur_td;
        xhci_stop_watchdog_timer_in_irq(xhci, ep);
@@ -754,7 +769,7 @@ remove_finished_td:
        do {
                cur_td = list_entry(ep->cancelled_td_list.next,
                                struct xhci_td, cancelled_td_list);
-                list_del(&cur_td->cancelled_td_list);
+                list_del_init(&cur_td->cancelled_td_list);
                /* Clean up the cancelled URB */
                /* Doesn't matter what we pass for status, since the core will
@@ -862,9 +877,9 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
                                cur_td = list_first_entry(&ring->td_list,
                                                struct xhci_td,
                                                td_list);
-                                list_del(&cur_td->td_list);
+                                list_del_init(&cur_td->td_list);
                                if (!list_empty(&cur_td->cancelled_td_list))
-                                        list_del(&cur_td->cancelled_td_list);
+                                        list_del_init(&cur_td->cancelled_td_list);
                                xhci_giveback_urb_in_irq(xhci, cur_td,
                                                -ESHUTDOWN, "killed");
                        }
@@ -873,7 +888,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
                                                &temp_ep->cancelled_td_list,
                                                struct xhci_td,
                                                cancelled_td_list);
-                                list_del(&cur_td->cancelled_td_list);
+                                list_del_init(&cur_td->cancelled_td_list);
                                xhci_giveback_urb_in_irq(xhci, cur_td,
                                                -ESHUTDOWN, "killed");
                        }
@@ -1565,10 +1580,10 @@ td_cleanup:
                        else
                                *status = 0;
                }
-                list_del(&td->td_list);
+                list_del_init(&td->td_list);
                /* Was this TD slated to be cancelled but completed anyway? */
                if (!list_empty(&td->cancelled_td_list))
-                        list_del(&td->cancelled_td_list);
+                        list_del_init(&td->cancelled_td_list);
                urb_priv->td_cnt++;
                /* Giveback the urb when all the tds are completed */
@@ -1919,8 +1934,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
        int status = -EINPROGRESS;
        struct urb_priv *urb_priv;
        struct xhci_ep_ctx *ep_ctx;
+        struct list_head *tmp;
        u32 trb_comp_code;
        int ret = 0;
+        int td_num = 0;
        slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
        xdev = xhci->devs[slot_id];
@@ -1942,6 +1959,12 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                return -ENODEV;
        }
+        /* Count current td numbers if ep->skip is set */
+        if (ep->skip) {
+                list_for_each(tmp, &ep_ring->td_list)
+                        td_num++;
+        }
        event_dma = le64_to_cpu(event->buffer);
        trb_comp_code = GET_COMP_CODE(le32_to_cpu(event->transfer_len));
        /* Look for common error cases */
@@ -2053,7 +2076,18 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                        goto cleanup;
                }
+                /* We've skipped all the TDs on the ep ring when ep->skip set */
+                if (ep->skip && td_num == 0) {
+                        ep->skip = false;
+                        xhci_dbg(xhci, "All tds on the ep_ring skipped. "
+                                                "Clear skip flag.\n");
+                        ret = 0;
+                        goto cleanup;
+                }
                td = list_entry(ep_ring->td_list.next, struct xhci_td, td_list);
+                if (ep->skip)
+                        td_num--;
                /* Is this a TRB in the currently executing TD? */
                event_seg = trb_in_td(ep_ring->deq_seg, ep_ring->dequeue,
@@ -2500,11 +2534,8 @@ static int prepare_transfer(struct xhci_hcd *xhci,
        if (td_index == 0) {
                ret = usb_hcd_link_urb_to_ep(bus_to_hcd(urb->dev->bus), urb);
-                if (unlikely(ret)) {
+                if (unlikely(ret))
-                        xhci_urb_free_priv(xhci, urb_priv);
-                        urb->hcpriv = NULL;
                        return ret;
-                }
        }
        td->urb = urb;
@@ -2672,6 +2703,10 @@ static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len,
 {
        int packets_transferred;
+        /* One TRB with a zero-length data packet. */
+        if (running_total == 0 && trb_buff_len == 0)
+                return 0;
        /* All the TRB queueing functions don't count the current TRB in
         * running_total.
         */
@@ -3113,20 +3148,15 @@ static int count_isoc_trbs_needed(struct xhci_hcd *xhci,
                struct urb *urb, int i)
 {
        int num_trbs = 0;
-        u64 addr, td_len, running_total;
+        u64 addr, td_len;
        addr = (u64) (urb->transfer_dma + urb->iso_frame_desc[i].offset);
        td_len = urb->iso_frame_desc[i].length;
-        running_total = TRB_MAX_BUFF_SIZE - (addr & (TRB_MAX_BUFF_SIZE - 1));
+        num_trbs = DIV_ROUND_UP(td_len + (addr & (TRB_MAX_BUFF_SIZE - 1)),
-        running_total &= TRB_MAX_BUFF_SIZE - 1;
+                        TRB_MAX_BUFF_SIZE);
-        if (running_total != 0)
+        if (num_trbs == 0)
-                num_trbs++;
-        while (running_total < td_len) {
                num_trbs++;
-                running_total += TRB_MAX_BUFF_SIZE;
-        }
        return num_trbs;
 }
@@ -3226,6 +3256,7 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        start_trb = &ep_ring->enqueue->generic;
        start_cycle = ep_ring->cycle_state;
+        urb_priv = urb->hcpriv;
        /* Queue the first TRB, even if it's zero-length */
        for (i = 0; i < num_tds; i++) {
                unsigned int total_packet_count;
@@ -3237,9 +3268,11 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                addr = start_addr + urb->iso_frame_desc[i].offset;
                td_len = urb->iso_frame_desc[i].length;
                td_remain_len = td_len;
-                /* FIXME: Ignoring zero-length packets, can those happen? */
                total_packet_count = roundup(td_len,
                                le16_to_cpu(urb->ep->desc.wMaxPacketSize));
+                /* A zero-length transfer still involves at least one packet. */
+                if (total_packet_count == 0)
+                        total_packet_count++;
                burst_count = xhci_get_burst_count(xhci, urb->dev, urb,
                                total_packet_count);
                residue = xhci_get_last_burst_packet_count(xhci,
@@ -3249,12 +3282,13 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                ret = prepare_transfer(xhci, xhci->devs[slot_id], ep_index,
                                urb->stream_id, trbs_per_td, urb, i, mem_flags);
-                if (ret < 0)
+                if (ret < 0) {
-                        return ret;
+                        if (i == 0)
+                                return ret;
+                        goto cleanup;
+                }
-                urb_priv = urb->hcpriv;
                td = urb_priv->td[i];
                for (j = 0; j < trbs_per_td; j++) {
                        u32 remainder = 0;
                        field = TRB_TBC(burst_count) | TRB_TLBPC(residue);
@@ -3344,6 +3378,27 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
                        start_cycle, start_trb);
        return 0;
+cleanup:
+        /* Clean up a partially enqueued isoc transfer. */
+        for (i--; i >= 0; i--)
+                list_del_init(&urb_priv->td[i]->td_list);
+        /* Use the first TD as a temporary variable to turn the TDs we've queued
+         * into No-ops with a software-owned cycle bit. That way the hardware
+         * won't accidentally start executing bogus TDs when we partially
+         * overwrite them.  td->first_trb and td->start_seg are already set.
+         */
+        urb_priv->td[0]->last_trb = ep_ring->enqueue;
+        /* Every TRB except the first & last will have its cycle bit flipped. */
+        td_to_noop(xhci, ep_ring, urb_priv->td[0], true);
+        /* Reset the ring enqueue back to the first TRB and its cycle bit. */
+        ep_ring->enqueue = urb_priv->td[0]->first_trb;
+        ep_ring->enq_seg = urb_priv->td[0]->start_seg;
+        ep_ring->cycle_state = start_cycle;
+        usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
+        return ret;
 }
 /*
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 1c4432d8fc10..3a0f695138f4 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1085,8 +1085,11 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                if (urb->dev->speed == USB_SPEED_FULL) {
                        ret = xhci_check_maxpacket(xhci, slot_id,
                                        ep_index, urb);
-                        if (ret < 0)
+                        if (ret < 0) {
+                                xhci_urb_free_priv(xhci, urb_priv);
+                                urb->hcpriv = NULL;
                                return ret;
+                        }
                }
                /* We have a spinlock and interrupts disabled, so we must pass
@@ -1097,6 +1100,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                        goto dying;
                ret = xhci_queue_ctrl_tx(xhci, GFP_ATOMIC, urb,
                                slot_id, ep_index);
+                if (ret)
+                        goto free_priv;
                spin_unlock_irqrestore(&xhci->lock, flags);
        } else if (usb_endpoint_xfer_bulk(&urb->ep->desc)) {
                spin_lock_irqsave(&xhci->lock, flags);
@@ -1117,6 +1122,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                        ret = xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb,
                                        slot_id, ep_index);
                }
+                if (ret)
+                        goto free_priv;
                spin_unlock_irqrestore(&xhci->lock, flags);
        } else if (usb_endpoint_xfer_int(&urb->ep->desc)) {
                spin_lock_irqsave(&xhci->lock, flags);
@@ -1124,6 +1131,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                        goto dying;
                ret = xhci_queue_intr_tx(xhci, GFP_ATOMIC, urb,
                                slot_id, ep_index);
+                if (ret)
+                        goto free_priv;
                spin_unlock_irqrestore(&xhci->lock, flags);
        } else {
                spin_lock_irqsave(&xhci->lock, flags);
@@ -1131,18 +1140,22 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                        goto dying;
                ret = xhci_queue_isoc_tx_prepare(xhci, GFP_ATOMIC, urb,
                                slot_id, ep_index);
+                if (ret)
+                        goto free_priv;
                spin_unlock_irqrestore(&xhci->lock, flags);
        }
 exit:
        return ret;
 dying:
-        xhci_urb_free_priv(xhci, urb_priv);
-        urb->hcpriv = NULL;
        xhci_dbg(xhci, "Ep 0x%x: URB %p submitted for "
                        "non-responsive xHCI host.\n",
                        urb->ep->desc.bEndpointAddress, urb);
+        ret = -ESHUTDOWN;
+free_priv:
+        xhci_urb_free_priv(xhci, urb_priv);
+        urb->hcpriv = NULL;
        spin_unlock_irqrestore(&xhci->lock, flags);
-        return -ESHUTDOWN;
+        return ret;
 }
 /* Get the right ring for the given URB.
@@ -1239,6 +1252,13 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
        if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_HALTED)) {
                xhci_dbg(xhci, "HW died, freeing TD.\n");
                urb_priv = urb->hcpriv;
+                for (i = urb_priv->td_cnt; i < urb_priv->length; i++) {
+                        td = urb_priv->td[i];
+                        if (!list_empty(&td->td_list))
+                                list_del_init(&td->td_list);
+                        if (!list_empty(&td->cancelled_td_list))
+                                list_del_init(&td->cancelled_td_list);
+                }
                usb_hcd_unlink_urb_from_ep(hcd, urb);
                spin_unlock_irqrestore(&xhci->lock, flags);
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index ae8c39617743..5e7cfba5b079 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -17,6 +17,7 @@
 #include <linux/io.h>
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
+#include <linux/prefetch.h>
 #include <asm/cacheflush.h>
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index 149f3f310a0a..318fb4e8a885 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -226,8 +226,10 @@ static int cppi_controller_stop(struct dma_controller *c)
        struct cppi             *controller;
        void __iomem            *tibase;
        int                     i;
+        struct musb             *musb;
        controller = container_of(c, struct cppi, controller);
+        musb = controller->musb;
        tibase = controller->tibase;
        /* DISABLE INDIVIDUAL CHANNEL Interrupts */
@@ -289,9 +291,11 @@ cppi_channel_allocate(struct dma_controller *c,
        u8                      index;
        struct cppi_channel     *cppi_ch;
        void __iomem            *tibase;
+        struct musb             *musb;
        controller = container_of(c, struct cppi, controller);
        tibase = controller->tibase;
+        musb = controller->musb;
        /* ep0 doesn't use DMA; remember cppi indices are 0..N-1 */
        index = ep->epnum - 1;
@@ -339,7 +343,8 @@ static void cppi_channel_release(struct dma_channel *channel)
        c = container_of(channel, struct cppi_channel, channel);
        tibase = c->controller->tibase;
        if (!c->hw_ep)
-                dev_dbg(musb->controller, "releasing idle DMA channel %p\n", c);
+                dev_dbg(c->controller->musb->controller,
+                        "releasing idle DMA channel %p\n", c);
        else if (!c->transmit)
                core_rxirq_enable(tibase, c->index + 1);
@@ -357,10 +362,11 @@ cppi_dump_rx(int level, struct cppi_channel *c, const char *tag)
        musb_ep_select(base, c->index + 1);
-        DBG(level, "RX DMA%d%s: %d left, csr %04x, "
+        dev_dbg(c->controller->musb->controller,
-                        "%08x H%08x S%08x C%08x, "
+                "RX DMA%d%s: %d left, csr %04x, "
-                        "B%08x L%08x %08x .. %08x"
+                "%08x H%08x S%08x C%08x, "
-                        "\n",
+                "B%08x L%08x %08x .. %08x"
+                "\n",
                c->index, tag,
                musb_readl(c->controller->tibase,
                        DAVINCI_RXCPPI_BUFCNT0_REG + 4 * c->index),
@@ -387,10 +393,11 @@ cppi_dump_tx(int level, struct cppi_channel *c, const char *tag)
        musb_ep_select(base, c->index + 1);
-        DBG(level, "TX DMA%d%s: csr %04x, "
+        dev_dbg(c->controller->musb->controller,
-                        "H%08x S%08x C%08x %08x, "
+                "TX DMA%d%s: csr %04x, "
-                        "F%08x L%08x .. %08x"
+                "H%08x S%08x C%08x %08x, "
-                        "\n",
+                "F%08x L%08x .. %08x"
+                "\n",
                c->index, tag,
                musb_readw(c->hw_ep->regs, MUSB_TXCSR),
@@ -1022,6 +1029,7 @@ static bool cppi_rx_scan(struct cppi *cppi, unsigned ch)
        int                             i;
        dma_addr_t                      safe2ack;
        void __iomem                    *regs = rx->hw_ep->regs;
+        struct musb                     *musb = cppi->musb;
        cppi_dump_rx(6, rx, "/K");
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 668eeef601ae..b3c065ab9dbc 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -172,7 +172,8 @@ enum musb_g_ep0_state {
 #endif
 /* TUSB mapping: "flat" plus ep0 special cases */
-#if     defined(CONFIG_USB_MUSB_TUSB6010)
+#if defined(CONFIG_USB_MUSB_TUSB6010) || \
+        defined(CONFIG_USB_MUSB_TUSB6010_MODULE)
 #define musb_ep_select(_mbase, _epnum) \
        musb_writeb((_mbase), MUSB_INDEX, (_epnum))
 #define MUSB_EP_OFFSET                  MUSB_TUSB_OFFSET
@@ -241,7 +242,8 @@ struct musb_hw_ep {
        void __iomem            *fifo;
        void __iomem            *regs;
-#ifdef CONFIG_USB_MUSB_TUSB6010
+#if defined(CONFIG_USB_MUSB_TUSB6010) || \
+        defined(CONFIG_USB_MUSB_TUSB6010_MODULE)
        void __iomem            *conf;
 #endif
@@ -258,7 +260,8 @@ struct musb_hw_ep {
        struct dma_channel      *tx_channel;
        struct dma_channel      *rx_channel;
-#ifdef CONFIG_USB_MUSB_TUSB6010
+#if defined(CONFIG_USB_MUSB_TUSB6010) || \
+        defined(CONFIG_USB_MUSB_TUSB6010_MODULE)
        /* TUSB has "asynchronous" and "synchronous" dma modes */
        dma_addr_t              fifo_async;
        dma_addr_t              fifo_sync;
@@ -356,7 +359,8 @@ struct musb {
        void __iomem            *ctrl_base;
        void __iomem            *mregs;
-#ifdef CONFIG_USB_MUSB_TUSB6010
+#if defined(CONFIG_USB_MUSB_TUSB6010) || \
+        defined(CONFIG_USB_MUSB_TUSB6010_MODULE)
        dma_addr_t              async;
        dma_addr_t              sync;
        void __iomem            *sync_va;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 8c41a2e6ea77..e81820370d6f 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1856,6 +1856,7 @@ int __init musb_gadget_setup(struct musb *musb)
        return 0;
 err:
+        musb->g.dev.parent = NULL;
        device_unregister(&musb->g.dev);
        return status;
 }
@@ -1863,7 +1864,8 @@ err:
 void musb_gadget_cleanup(struct musb *musb)
 {
        usb_del_gadget_udc(&musb->g);
-        device_unregister(&musb->g.dev);
+        if (musb->g.dev.parent)
+                device_unregister(&musb->g.dev);
 }
 /*
diff --git a/drivers/usb/musb/musb_regs.h b/drivers/usb/musb/musb_regs.h
index 82410703dcd3..03f2655af290 100644
--- a/drivers/usb/musb/musb_regs.h
+++ b/drivers/usb/musb/musb_regs.h
@@ -234,7 +234,8 @@
 #define MUSB_TESTMODE           0x0F    /* 8 bit */
 /* Get offset for a given FIFO from musb->mregs */
-#ifdef  CONFIG_USB_MUSB_TUSB6010
+#if defined(CONFIG_USB_MUSB_TUSB6010) ||        \
+        defined(CONFIG_USB_MUSB_TUSB6010_MODULE)
 #define MUSB_FIFO_OFFSET(epnum) (0x200 + ((epnum) * 0x20))
 #else
 #define MUSB_FIFO_OFFSET(epnum) (0x20 + ((epnum) * 4))
@@ -295,7 +296,8 @@
 #define MUSB_FLAT_OFFSET(_epnum, _offset)       \
        (0x100 + (0x10*(_epnum)) + (_offset))
-#ifdef CONFIG_USB_MUSB_TUSB6010
+#if defined(CONFIG_USB_MUSB_TUSB6010) ||        \
+        defined(CONFIG_USB_MUSB_TUSB6010_MODULE)
 /* TUSB6010 EP0 configuration register is special */
 #define MUSB_TUSB_OFFSET(_epnum, _offset)       \
        (0x10 + _offset)
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 9eec41fbf3a4..ec1480191f78 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -18,6 +18,7 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/init.h>
+#include <linux/prefetch.h>
 #include <linux/usb.h>
 #include <linux/irq.h>
 #include <linux/platform_device.h>
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index 07c8a73dfe41..b67b4bc596c1 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -20,6 +20,7 @@
 #include <plat/mux.h>
 #include "musb_core.h"
+#include "tusb6010.h"
 #define to_chdat(c)             ((struct tusb_omap_dma_ch *)(c)->private_data)
diff --git a/drivers/usb/musb/ux500_dma.c b/drivers/usb/musb/ux500_dma.c
index cecace411832..ef4333f4bbe0 100644
--- a/drivers/usb/musb/ux500_dma.c
+++ b/drivers/usb/musb/ux500_dma.c
@@ -65,7 +65,8 @@ static void ux500_tx_work(struct work_struct *data)
        struct musb *musb = hw_ep->musb;
        unsigned long flags;
-        DBG(4, "DMA tx transfer done on hw_ep=%d\n", hw_ep->epnum);
+        dev_dbg(musb->controller, "DMA tx transfer done on hw_ep=%d\n",
+                hw_ep->epnum);
        spin_lock_irqsave(&musb->lock, flags);
        ux500_channel->channel.actual_len = ux500_channel->cur_len;
@@ -84,7 +85,8 @@ static void ux500_rx_work(struct work_struct *data)
        struct musb *musb = hw_ep->musb;
        unsigned long flags;
-        DBG(4, "DMA rx transfer done on hw_ep=%d\n", hw_ep->epnum);
+        dev_dbg(musb->controller, "DMA rx transfer done on hw_ep=%d\n",
+                hw_ep->epnum);
        spin_lock_irqsave(&musb->lock, flags);
        ux500_channel->channel.actual_len = ux500_channel->cur_len;
@@ -116,9 +118,11 @@ static bool ux500_configure_channel(struct dma_channel *channel,
        enum dma_slave_buswidth addr_width;
        dma_addr_t usb_fifo_addr = (MUSB_FIFO_OFFSET(hw_ep->epnum) +
                                        ux500_channel->controller->phy_base);
+        struct musb *musb = ux500_channel->controller->private_data;
-        DBG(4, "packet_sz=%d, mode=%d, dma_addr=0x%x, len=%d is_tx=%d\n",
+        dev_dbg(musb->controller,
-                        packet_sz, mode, dma_addr, len, ux500_channel->is_tx);
+                "packet_sz=%d, mode=%d, dma_addr=0x%x, len=%d is_tx=%d\n",
+                packet_sz, mode, dma_addr, len, ux500_channel->is_tx);
        ux500_channel->cur_len = len;
@@ -133,15 +137,13 @@ static bool ux500_configure_channel(struct dma_channel *channel,
                                        DMA_SLAVE_BUSWIDTH_4_BYTES;
        slave_conf.direction = direction;
-        if (direction == DMA_FROM_DEVICE) {
+        slave_conf.src_addr = usb_fifo_addr;
-                slave_conf.src_addr = usb_fifo_addr;
+        slave_conf.src_addr_width = addr_width;
-                slave_conf.src_addr_width = addr_width;
+        slave_conf.src_maxburst = 16;
-                slave_conf.src_maxburst = 16;
+        slave_conf.dst_addr = usb_fifo_addr;
-        } else {
+        slave_conf.dst_addr_width = addr_width;
-                slave_conf.dst_addr = usb_fifo_addr;
+        slave_conf.dst_maxburst = 16;
-                slave_conf.dst_addr_width = addr_width;
-                slave_conf.dst_maxburst = 16;
-        }
        dma_chan->device->device_control(dma_chan, DMA_SLAVE_CONFIG,
                                             (unsigned long) &slave_conf);
@@ -166,6 +168,7 @@ static struct dma_channel *ux500_dma_channel_allocate(struct dma_controller *c,
        struct ux500_dma_controller *controller = container_of(c,
                        struct ux500_dma_controller, controller);
        struct ux500_dma_channel *ux500_channel = NULL;
+        struct musb *musb = controller->private_data;
        u8 ch_num = hw_ep->epnum - 1;
        u32 max_ch;
@@ -192,7 +195,7 @@ static struct dma_channel *ux500_dma_channel_allocate(struct dma_controller *c,
        ux500_channel->hw_ep = hw_ep;
        ux500_channel->is_allocated = 1;
-        DBG(7, "hw_ep=%d, is_tx=0x%x, channel=%d\n",
+        dev_dbg(musb->controller, "hw_ep=%d, is_tx=0x%x, channel=%d\n",
                hw_ep->epnum, is_tx, ch_num);
        return &(ux500_channel->channel);
@@ -201,8 +204,9 @@ static struct dma_channel *ux500_dma_channel_allocate(struct dma_controller *c,
 static void ux500_dma_channel_release(struct dma_channel *channel)
 {
        struct ux500_dma_channel *ux500_channel = channel->private_data;
+        struct musb *musb = ux500_channel->controller->private_data;
-        DBG(7, "channel=%d\n", ux500_channel->ch_num);
+        dev_dbg(musb->controller, "channel=%d\n", ux500_channel->ch_num);
        if (ux500_channel->is_allocated) {
                ux500_channel->is_allocated = 0;
@@ -252,8 +256,8 @@ static int ux500_dma_channel_abort(struct dma_channel *channel)
        void __iomem *epio = musb->endpoints[ux500_channel->hw_ep->epnum].regs;
        u16 csr;
-        DBG(4, "channel=%d, is_tx=%d\n", ux500_channel->ch_num,
+        dev_dbg(musb->controller, "channel=%d, is_tx=%d\n",
-                                                ux500_channel->is_tx);
+                ux500_channel->ch_num, ux500_channel->is_tx);
        if (channel->status == MUSB_DMA_STATUS_BUSY) {
                if (ux500_channel->is_tx) {
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 78a2cf9551cc..5fc13e717911 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -101,6 +101,7 @@ static int   ftdi_jtag_probe(struct usb_serial *serial);
 static int   ftdi_mtxorb_hack_setup(struct usb_serial *serial);
 static int   ftdi_NDI_device_setup(struct usb_serial *serial);
 static int   ftdi_stmclite_probe(struct usb_serial *serial);
+static int   ftdi_8u2232c_probe(struct usb_serial *serial);
 static void  ftdi_USB_UIRT_setup(struct ftdi_private *priv);
 static void  ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
@@ -128,6 +129,10 @@ static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
        .probe  = ftdi_stmclite_probe,
 };
+static struct ftdi_sio_quirk ftdi_8u2232c_quirk = {
+        .probe  = ftdi_8u2232c_probe,
+};
 /*
 * The 8U232AM has the same API as the sio except for:
 * - it can support MUCH higher baudrates; up to:
@@ -178,7 +183,8 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(FTDI_VID, FTDI_8U232AM_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_8U232AM_ALT_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_232RL_PID) },
-        { USB_DEVICE(FTDI_VID, FTDI_8U2232C_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_8U2232C_PID) ,
+                .driver_info = (kernel_ulong_t)&ftdi_8u2232c_quirk },
        { USB_DEVICE(FTDI_VID, FTDI_4232H_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_232H_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_MICRO_CHAMELEON_PID) },
@@ -1737,6 +1743,18 @@ static int ftdi_jtag_probe(struct usb_serial *serial)
        return 0;
 }
+static int ftdi_8u2232c_probe(struct usb_serial *serial)
+{
+        struct usb_device *udev = serial->dev;
+        dbg("%s", __func__);
+        if (strcmp(udev->manufacturer, "CALAO Systems") == 0)
+                return ftdi_jtag_probe(serial);
+        return 0;
+}
 /*
 * First and second port on STMCLiteadaptors is reserved for JTAG interface
 * and the forth port for pio
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 815656198914..fe22e90bc879 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -148,6 +148,8 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_E14AC                    0x14AC
+#define HUAWEI_PRODUCT_K3806                    0x14AE
+#define HUAWEI_PRODUCT_K4605                    0x14C6
 #define HUAWEI_PRODUCT_K3770                    0x14C9
 #define HUAWEI_PRODUCT_K3771                    0x14CA
 #define HUAWEI_PRODUCT_K4510                    0x14CB
@@ -416,6 +418,56 @@ static void option_instat_callback(struct urb *urb);
 #define SAMSUNG_VENDOR_ID                       0x04e8
 #define SAMSUNG_PRODUCT_GT_B3730                0x6889
+/* YUGA products  www.yuga-info.com*/
+#define YUGA_VENDOR_ID                          0x257A
+#define YUGA_PRODUCT_CEM600                     0x1601
+#define YUGA_PRODUCT_CEM610                     0x1602
+#define YUGA_PRODUCT_CEM500                     0x1603
+#define YUGA_PRODUCT_CEM510                     0x1604
+#define YUGA_PRODUCT_CEM800                     0x1605
+#define YUGA_PRODUCT_CEM900                     0x1606
+#define YUGA_PRODUCT_CEU818                     0x1607
+#define YUGA_PRODUCT_CEU816                     0x1608
+#define YUGA_PRODUCT_CEU828                     0x1609
+#define YUGA_PRODUCT_CEU826                     0x160A
+#define YUGA_PRODUCT_CEU518                     0x160B
+#define YUGA_PRODUCT_CEU516                     0x160C
+#define YUGA_PRODUCT_CEU528                     0x160D
+#define YUGA_PRODUCT_CEU526                     0x160F
+#define YUGA_PRODUCT_CWM600                     0x2601
+#define YUGA_PRODUCT_CWM610                     0x2602
+#define YUGA_PRODUCT_CWM500                     0x2603
+#define YUGA_PRODUCT_CWM510                     0x2604
+#define YUGA_PRODUCT_CWM800                     0x2605
+#define YUGA_PRODUCT_CWM900                     0x2606
+#define YUGA_PRODUCT_CWU718                     0x2607
+#define YUGA_PRODUCT_CWU716                     0x2608
+#define YUGA_PRODUCT_CWU728                     0x2609
+#define YUGA_PRODUCT_CWU726                     0x260A
+#define YUGA_PRODUCT_CWU518                     0x260B
+#define YUGA_PRODUCT_CWU516                     0x260C
+#define YUGA_PRODUCT_CWU528                     0x260D
+#define YUGA_PRODUCT_CWU526                     0x260F
+#define YUGA_PRODUCT_CLM600                     0x2601
+#define YUGA_PRODUCT_CLM610                     0x2602
+#define YUGA_PRODUCT_CLM500                     0x2603
+#define YUGA_PRODUCT_CLM510                     0x2604
+#define YUGA_PRODUCT_CLM800                     0x2605
+#define YUGA_PRODUCT_CLM900                     0x2606
+#define YUGA_PRODUCT_CLU718                     0x2607
+#define YUGA_PRODUCT_CLU716                     0x2608
+#define YUGA_PRODUCT_CLU728                     0x2609
+#define YUGA_PRODUCT_CLU726                     0x260A
+#define YUGA_PRODUCT_CLU518                     0x260B
+#define YUGA_PRODUCT_CLU516                     0x260C
+#define YUGA_PRODUCT_CLU528                     0x260D
+#define YUGA_PRODUCT_CLU526                     0x260F
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                OPTION_BLACKLIST_NONE = 0,
@@ -551,6 +603,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
@@ -1005,6 +1059,48 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
        { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM610) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM500) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM510) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM800) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM900) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU818) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU816) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU828) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU826) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU518) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU516) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU528) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU526) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM600) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM610) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM500) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM510) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM800) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWM900) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU718) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU716) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU728) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU726) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU518) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU516) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU528) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU526) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM600) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM610) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM500) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM510) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM800) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLM900) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU718) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU716) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU728) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU726) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU518) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU516) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
@@ -1134,11 +1230,13 @@ static int option_probe(struct usb_serial *serial,
                serial->interface->cur_altsetting->desc.bInterfaceClass != 0xff)
                return -ENODEV;
-        /* Don't bind network interfaces on Huawei K3765 & K4505 */
+        /* Don't bind network interfaces on Huawei K3765, K4505 & K4605 */
        if (serial->dev->descriptor.idVendor == HUAWEI_VENDOR_ID &&
                (serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K3765 ||
-                        serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K4505) &&
+                        serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K4505 ||
-                serial->interface->cur_altsetting->desc.bInterfaceNumber == 1)
+                        serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K4605) &&
+                (serial->interface->cur_altsetting->desc.bInterfaceNumber == 1 ||
+                        serial->interface->cur_altsetting->desc.bInterfaceNumber == 2))
                return -ENODEV;
        /* Don't bind network interface on Samsung GT-B3730, it is handled by a separate module */
diff --git a/drivers/video/backlight/adp8870_bl.c b/drivers/video/backlight/adp8870_bl.c
index 05a8832bb3eb..d06886a2bfb5 100644
--- a/drivers/video/backlight/adp8870_bl.c
+++ b/drivers/video/backlight/adp8870_bl.c
@@ -1009,4 +1009,4 @@ module_exit(adp8870_exit);
 MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
 MODULE_DESCRIPTION("ADP8870 Backlight driver");
-MODULE_ALIAS("platform:adp8870-backlight");
+MODULE_ALIAS("i2c:adp8870-backlight");
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index 80d292fb92d8..7363c1b169e8 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -19,7 +19,7 @@
 #include <asm/backlight.h>
 #endif
-static const char const *backlight_types[] = {
+static const char *const backlight_types[] = {
        [BACKLIGHT_RAW] = "raw",
        [BACKLIGHT_PLATFORM] = "platform",
        [BACKLIGHT_FIRMWARE] = "firmware",
diff --git a/drivers/video/backlight/ep93xx_bl.c b/drivers/video/backlight/ep93xx_bl.c
index 9f1e389d51d2..b0582917f0c8 100644
--- a/drivers/video/backlight/ep93xx_bl.c
+++ b/drivers/video/backlight/ep93xx_bl.c
@@ -11,7 +11,7 @@
 * BRIGHT, on the Cirrus EP9307, EP9312, and EP9315 processors.
 */
+#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
 #include <linux/fb.h>
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index b8f38ec6eb18..8b5b2a4124c7 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -28,6 +28,8 @@ struct pwm_bl_data {
        unsigned int            lth_brightness;
        int                     (*notify)(struct device *,
                                          int brightness);
+        void                    (*notify_after)(struct device *,
+                                        int brightness);
        int                     (*check_fb)(struct device *, struct fb_info *);
 };
@@ -55,6 +57,10 @@ static int pwm_backlight_update_status(struct backlight_device *bl)
                pwm_config(pb->pwm, brightness, pb->period);
                pwm_enable(pb->pwm);
        }
+        if (pb->notify_after)
+                pb->notify_after(pb->dev, brightness);
        return 0;
 }
@@ -105,6 +111,7 @@ static int pwm_backlight_probe(struct platform_device *pdev)
        pb->period = data->pwm_period_ns;
        pb->notify = data->notify;
+        pb->notify_after = data->notify_after;
        pb->check_fb = data->check_fb;
        pb->lth_brightness = data->lth_brightness *
                (data->pwm_period_ns / data->max_brightness);
@@ -172,6 +179,8 @@ static int pwm_backlight_suspend(struct platform_device *pdev,
                pb->notify(pb->dev, 0);
        pwm_config(pb->pwm, 0, pb->period);
        pwm_disable(pb->pwm);
+        if (pb->notify_after)
+                pb->notify_after(pb->dev, 0);
        return 0;
 }
diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c
index 02bf7bf7160b..b5abaae38e97 100644
--- a/drivers/w1/masters/ds2490.c
+++ b/drivers/w1/masters/ds2490.c
@@ -1,7 +1,7 @@
 /*
 *      dscore.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -1024,5 +1024,5 @@ module_init(ds_init);
 module_exit(ds_fini);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("DS2490 USB <-> W1 bus master driver (DS9490*)");
diff --git a/drivers/w1/masters/matrox_w1.c b/drivers/w1/masters/matrox_w1.c
index 334d1ccf9c92..f667c26b2195 100644
--- a/drivers/w1/masters/matrox_w1.c
+++ b/drivers/w1/masters/matrox_w1.c
@@ -1,7 +1,7 @@
 /*
 *      matrox_w1.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -39,7 +39,7 @@
 #include "../w1_log.h"
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Driver for transport(Dallas 1-wire prtocol) over VGA DDC(matrox gpio).");
 static struct pci_device_id matrox_w1_tbl[] = {
diff --git a/drivers/w1/slaves/w1_ds2408.c b/drivers/w1/slaves/w1_ds2408.c
index c37781899d90..7c8cdb8aed26 100644
--- a/drivers/w1/slaves/w1_ds2408.c
+++ b/drivers/w1/slaves/w1_ds2408.c
@@ -373,7 +373,7 @@ static int w1_f29_add_slave(struct w1_slave *sl)
 static void w1_f29_remove_slave(struct w1_slave *sl)
 {
        int i;
-        for (i = NB_SYSFS_BIN_FILES; i <= 0; --i)
+        for (i = NB_SYSFS_BIN_FILES - 1; i >= 0; --i)
                sysfs_remove_bin_file(&sl->dev.kobj,
                        &(w1_f29_sysfs_bin_files[i]));
 }
diff --git a/drivers/w1/slaves/w1_smem.c b/drivers/w1/slaves/w1_smem.c
index cc8c02e92593..84655625c870 100644
--- a/drivers/w1/slaves/w1_smem.c
+++ b/drivers/w1/slaves/w1_smem.c
@@ -1,7 +1,7 @@
 /*
 *      w1_smem.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -32,7 +32,7 @@
 #include "../w1_family.h"
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Driver for 1-wire Dallas network protocol, 64bit memory family.");
 static struct w1_family w1_smem_family_01 = {
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 402928b135d1..a1ef9b5b38cf 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -1,7 +1,7 @@
 /*
 *      w1_therm.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -34,7 +34,7 @@
 #include "../w1_family.h"
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Driver for 1-wire Dallas network protocol, temperature family.");
 /* Allow the strong pullup to be disabled, but default to enabled.
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index 6c136c19e982..c37497823851 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -1,7 +1,7 @@
 /*
 *      w1.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -42,7 +42,7 @@
 #include "w1_netlink.h"
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Driver for 1-wire Dallas network protocol.");
 static int w1_timeout = 10;
diff --git a/drivers/w1/w1.h b/drivers/w1/w1.h
index 1ce23fc6186c..4d012ca3f32c 100644
--- a/drivers/w1/w1.h
+++ b/drivers/w1/w1.h
@@ -1,7 +1,7 @@
 /*
 *      w1.h
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_family.c b/drivers/w1/w1_family.c
index 4a099041f28a..63359797c8b1 100644
--- a/drivers/w1/w1_family.c
+++ b/drivers/w1/w1_family.c
@@ -1,7 +1,7 @@
 /*
 *      w1_family.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_family.h b/drivers/w1/w1_family.h
index 98a1ac0f4693..490cda2281bc 100644
--- a/drivers/w1/w1_family.h
+++ b/drivers/w1/w1_family.h
@@ -1,7 +1,7 @@
 /*
 *      w1_family.h
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_int.c b/drivers/w1/w1_int.c
index b50be3f1073d..d220bce2cee4 100644
--- a/drivers/w1/w1_int.c
+++ b/drivers/w1/w1_int.c
@@ -1,7 +1,7 @@
 /*
 *      w1_int.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_int.h b/drivers/w1/w1_int.h
index 4274082d2262..2ad7d4414bed 100644
--- a/drivers/w1/w1_int.h
+++ b/drivers/w1/w1_int.h
@@ -1,7 +1,7 @@
 /*
 *      w1_int.h
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_io.c b/drivers/w1/w1_io.c
index 8e8b64cfafb6..765b37b62a4f 100644
--- a/drivers/w1/w1_io.c
+++ b/drivers/w1/w1_io.c
@@ -1,7 +1,7 @@
 /*
 *      w1_io.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_log.h b/drivers/w1/w1_log.h
index e6ab7cf08f88..9c7bd62e6bdc 100644
--- a/drivers/w1/w1_log.h
+++ b/drivers/w1/w1_log.h
@@ -1,7 +1,7 @@
 /*
 *      w1_log.h
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c
index 55aabd927c60..40788c925d1c 100644
--- a/drivers/w1/w1_netlink.c
+++ b/drivers/w1/w1_netlink.c
@@ -1,7 +1,7 @@
 /*
 * w1_netlink.c
 *
- * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2003 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_netlink.h b/drivers/w1/w1_netlink.h
index 27e950f935b1..b0922dc29658 100644
--- a/drivers/w1/w1_netlink.h
+++ b/drivers/w1/w1_netlink.h
@@ -1,7 +1,7 @@
 /*
 * w1_netlink.h
 *
- * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2003 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 410fba45378d..809cbda03d7a 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -494,15 +494,16 @@ static int hpwdt_pretimeout(struct notifier_block *nb, unsigned long ulReason,
                asminline_call(&cmn_regs, cru_rom_addr);
        die_nmi_called = 1;
        spin_unlock_irqrestore(&rom_lock, rom_pl);
+        if (allow_kdump)
+                hpwdt_stop();
        if (!is_icru) {
                if (cmn_regs.u1.ral == 0) {
-                        printk(KERN_WARNING "hpwdt: An NMI occurred, "
+                        panic("An NMI occurred, "
                                "but unable to determine source.\n");
                }
        }
-        if (allow_kdump)
-                hpwdt_stop();
        panic("An NMI occurred, please see the Integrated "
                "Management Log for details.\n");
diff --git a/drivers/watchdog/lantiq_wdt.c b/drivers/watchdog/lantiq_wdt.c
index 7d82adac1cb2..102aed0efbf1 100644
--- a/drivers/watchdog/lantiq_wdt.c
+++ b/drivers/watchdog/lantiq_wdt.c
@@ -51,16 +51,16 @@ static int ltq_wdt_ok_to_close;
 static void
 ltq_wdt_enable(void)
 {
-        ltq_wdt_timeout = ltq_wdt_timeout *
+        unsigned long int timeout = ltq_wdt_timeout *
                        (ltq_io_region_clk_rate / LTQ_WDT_DIVIDER) + 0x1000;
-        if (ltq_wdt_timeout > LTQ_MAX_TIMEOUT)
+        if (timeout > LTQ_MAX_TIMEOUT)
-                ltq_wdt_timeout = LTQ_MAX_TIMEOUT;
+                timeout = LTQ_MAX_TIMEOUT;
        /* write the first password magic */
        ltq_w32(LTQ_WDT_PW1, ltq_wdt_membase + LTQ_WDT_CR);
        /* write the second magic plus the configuration and new timeout */
        ltq_w32(LTQ_WDT_SR_EN | LTQ_WDT_SR_PWD | LTQ_WDT_SR_CLKDIV |
-                LTQ_WDT_PW2 | ltq_wdt_timeout, ltq_wdt_membase + LTQ_WDT_CR);
+                LTQ_WDT_PW2 | timeout, ltq_wdt_membase + LTQ_WDT_CR);
 }
 static void
diff --git a/drivers/watchdog/sbc_epx_c3.c b/drivers/watchdog/sbc_epx_c3.c
index 3066a5127ca8..eaca366b7234 100644
--- a/drivers/watchdog/sbc_epx_c3.c
+++ b/drivers/watchdog/sbc_epx_c3.c
@@ -173,7 +173,7 @@ static struct notifier_block epx_c3_notifier = {
        .notifier_call = epx_c3_notify_sys,
 };
-static const char banner[] __initdata = KERN_INFO PFX
+static const char banner[] __initconst = KERN_INFO PFX
        "Hardware Watchdog Timer for Winsystems EPX-C3 SBC: 0.1\n";
 static int __init watchdog_init(void)
diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
index d33520d0b4c9..1199da0f98cf 100644
--- a/drivers/watchdog/watchdog_dev.c
+++ b/drivers/watchdog/watchdog_dev.c
@@ -59,7 +59,7 @@ static struct watchdog_device *wdd;
 static int watchdog_ping(struct watchdog_device *wddev)
 {
-        if (test_bit(WDOG_ACTIVE, &wdd->status)) {
+        if (test_bit(WDOG_ACTIVE, &wddev->status)) {
                if (wddev->ops->ping)
                        return wddev->ops->ping(wddev);  /* ping the watchdog */
                else
@@ -81,12 +81,12 @@ static int watchdog_start(struct watchdog_device *wddev)
 {
        int err;
-        if (!test_bit(WDOG_ACTIVE, &wdd->status)) {
+        if (!test_bit(WDOG_ACTIVE, &wddev->status)) {
                err = wddev->ops->start(wddev);
                if (err < 0)
                        return err;
-                set_bit(WDOG_ACTIVE, &wdd->status);
+                set_bit(WDOG_ACTIVE, &wddev->status);
        }
        return 0;
 }
@@ -105,18 +105,18 @@ static int watchdog_stop(struct watchdog_device *wddev)
 {
        int err = -EBUSY;
-        if (test_bit(WDOG_NO_WAY_OUT, &wdd->status)) {
+        if (test_bit(WDOG_NO_WAY_OUT, &wddev->status)) {
                pr_info("%s: nowayout prevents watchdog to be stopped!\n",
-                                                        wdd->info->identity);
+                                                        wddev->info->identity);
                return err;
        }
-        if (test_bit(WDOG_ACTIVE, &wdd->status)) {
+        if (test_bit(WDOG_ACTIVE, &wddev->status)) {
                err = wddev->ops->stop(wddev);
                if (err < 0)
                        return err;
-                clear_bit(WDOG_ACTIVE, &wdd->status);
+                clear_bit(WDOG_ACTIVE, &wddev->status);
        }
        return 0;
 }
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index da70f5c32eb9..7523719bf8a4 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -54,7 +54,7 @@
 * This lock protects updates to the following mapping and reference-count
 * arrays. The lock does not need to be acquired to read the mapping tables.
 */
-static DEFINE_SPINLOCK(irq_mapping_update_lock);
+static DEFINE_MUTEX(irq_mapping_update_lock);
 static LIST_HEAD(xen_irq_list_head);
@@ -631,7 +631,7 @@ int xen_bind_pirq_gsi_to_irq(unsigned gsi,
        int irq = -1;
        struct physdev_irq irq_op;
-        spin_lock(&irq_mapping_update_lock);
+        mutex_lock(&irq_mapping_update_lock);
        irq = find_irq_by_gsi(gsi);
        if (irq != -1) {
@@ -684,7 +684,7 @@ int xen_bind_pirq_gsi_to_irq(unsigned gsi,
                                handle_edge_irq, name);
 out:
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
        return irq;
 }
@@ -710,7 +710,7 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev, struct msi_desc *msidesc,
 {
        int irq, ret;
-        spin_lock(&irq_mapping_update_lock);
+        mutex_lock(&irq_mapping_update_lock);
        irq = xen_allocate_irq_dynamic();
        if (irq == -1)
@@ -724,10 +724,10 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev, struct msi_desc *msidesc,
        if (ret < 0)
                goto error_irq;
 out:
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
        return irq;
 error_irq:
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
        xen_free_irq(irq);
        return -1;
 }
@@ -740,7 +740,7 @@ int xen_destroy_irq(int irq)
        struct irq_info *info = info_for_irq(irq);
        int rc = -ENOENT;
-        spin_lock(&irq_mapping_update_lock);
+        mutex_lock(&irq_mapping_update_lock);
        desc = irq_to_desc(irq);
        if (!desc)
@@ -766,7 +766,7 @@ int xen_destroy_irq(int irq)
        xen_free_irq(irq);
 out:
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
        return rc;
 }
@@ -776,7 +776,7 @@ int xen_irq_from_pirq(unsigned pirq)
        struct irq_info *info;
-        spin_lock(&irq_mapping_update_lock);
+        mutex_lock(&irq_mapping_update_lock);
        list_for_each_entry(info, &xen_irq_list_head, list) {
                if (info == NULL || info->type != IRQT_PIRQ)
@@ -787,7 +787,7 @@ int xen_irq_from_pirq(unsigned pirq)
        }
        irq = -1;
 out:
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
        return irq;
 }
@@ -802,7 +802,7 @@ int bind_evtchn_to_irq(unsigned int evtchn)
 {
        int irq;
-        spin_lock(&irq_mapping_update_lock);
+        mutex_lock(&irq_mapping_update_lock);
        irq = evtchn_to_irq[evtchn];
@@ -818,7 +818,7 @@ int bind_evtchn_to_irq(unsigned int evtchn)
        }
 out:
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
        return irq;
 }
@@ -829,7 +829,7 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
        struct evtchn_bind_ipi bind_ipi;
        int evtchn, irq;
-        spin_lock(&irq_mapping_update_lock);
+        mutex_lock(&irq_mapping_update_lock);
        irq = per_cpu(ipi_to_irq, cpu)[ipi];
@@ -853,7 +853,7 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
        }
 out:
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
        return irq;
 }
@@ -878,7 +878,7 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
        struct evtchn_bind_virq bind_virq;
        int evtchn, irq;
-        spin_lock(&irq_mapping_update_lock);
+        mutex_lock(&irq_mapping_update_lock);
        irq = per_cpu(virq_to_irq, cpu)[virq];
@@ -903,7 +903,7 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
        }
 out:
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
        return irq;
 }
@@ -913,7 +913,7 @@ static void unbind_from_irq(unsigned int irq)
        struct evtchn_close close;
        int evtchn = evtchn_from_irq(irq);
-        spin_lock(&irq_mapping_update_lock);
+        mutex_lock(&irq_mapping_update_lock);
        if (VALID_EVTCHN(evtchn)) {
                close.port = evtchn;
@@ -943,7 +943,7 @@ static void unbind_from_irq(unsigned int irq)
        xen_free_irq(irq);
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
 }
 int bind_evtchn_to_irqhandler(unsigned int evtchn,
@@ -1279,7 +1279,7 @@ void rebind_evtchn_irq(int evtchn, int irq)
           will also be masked. */
        disable_irq(irq);
-        spin_lock(&irq_mapping_update_lock);
+        mutex_lock(&irq_mapping_update_lock);
        /* After resume the irq<->evtchn mappings are all cleared out */
        BUG_ON(evtchn_to_irq[evtchn] != -1);
@@ -1289,7 +1289,7 @@ void rebind_evtchn_irq(int evtchn, int irq)
        xen_irq_info_evtchn_init(irq, evtchn);
-        spin_unlock(&irq_mapping_update_lock);
+        mutex_unlock(&irq_mapping_update_lock);
        /* new event channels are always bound to cpu 0 */
        irq_set_affinity(irq, cpumask_of(0));
diff --git a/drivers/zorro/zorro.c b/drivers/zorro/zorro.c
index e0c2807b0970..181fa8158a8b 100644
--- a/drivers/zorro/zorro.c
+++ b/drivers/zorro/zorro.c
@@ -148,10 +148,10 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
        }
        platform_set_drvdata(pdev, bus);
-        /* Register all devices */
        pr_info("Zorro: Probing AutoConfig expansion devices: %u device%s\n",
                 zorro_num_autocon, zorro_num_autocon == 1 ? "" : "s");
+        /* First identify all devices ... */
        for (i = 0; i < zorro_num_autocon; i++) {
                z = &zorro_autocon[i];
                z->id = (z->rom.er_Manufacturer<<16) | (z->rom.er_Product<<8);
@@ -172,6 +172,11 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
                dev_set_name(&z->dev, "%02x", i);
                z->dev.parent = &bus->dev;
                z->dev.bus = &zorro_bus_type;
+        }
+        /* ... then register them */
+        for (i = 0; i < zorro_num_autocon; i++) {
+                z = &zorro_autocon[i];
                error = device_register(&z->dev);
                if (error) {
                        dev_err(&bus->dev, "Error registering device %s\n",
diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index 46ce357ca1ab..410ffd6ceb5f 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -54,9 +54,9 @@ extern struct kmem_cache *v9fs_inode_cache;
 struct inode *v9fs_alloc_inode(struct super_block *sb);
 void v9fs_destroy_inode(struct inode *inode);
-struct inode *v9fs_get_inode(struct super_block *sb, int mode);
+struct inode *v9fs_get_inode(struct super_block *sb, int mode, dev_t);
 int v9fs_init_inode(struct v9fs_session_info *v9ses,
-                    struct inode *inode, int mode);
+                    struct inode *inode, int mode, dev_t);
 void v9fs_evict_inode(struct inode *inode);
 ino_t v9fs_qid2ino(struct p9_qid *qid);
 void v9fs_stat2inode(struct p9_wstat *, struct inode *, struct super_block *);
@@ -83,4 +83,6 @@ static inline void v9fs_invalidate_inode_attr(struct inode *inode)
        v9inode->cache_validity |= V9FS_INO_INVALID_ATTR;
        return;
 }
+int v9fs_open_to_dotl_flags(int flags);
 #endif
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 3c173fcc2c5a..62857a810a79 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -65,7 +65,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
        v9inode = V9FS_I(inode);
        v9ses = v9fs_inode2v9ses(inode);
        if (v9fs_proto_dotl(v9ses))
-                omode = file->f_flags;
+                omode = v9fs_open_to_dotl_flags(file->f_flags);
        else
                omode = v9fs_uflags2omode(file->f_flags,
                                        v9fs_proto_dotu(v9ses));
@@ -169,7 +169,18 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
        /* convert posix lock to p9 tlock args */
        memset(&flock, 0, sizeof(flock));
-        flock.type = fl->fl_type;
+        /* map the lock type */
+        switch (fl->fl_type) {
+        case F_RDLCK:
+                flock.type = P9_LOCK_TYPE_RDLCK;
+                break;
+        case F_WRLCK:
+                flock.type = P9_LOCK_TYPE_WRLCK;
+                break;
+        case F_UNLCK:
+                flock.type = P9_LOCK_TYPE_UNLCK;
+                break;
+        }
        flock.start = fl->fl_start;
        if (fl->fl_end == OFFSET_MAX)
                flock.length = 0;
@@ -245,7 +256,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
        /* convert posix lock to p9 tgetlock args */
        memset(&glock, 0, sizeof(glock));
-        glock.type = fl->fl_type;
+        glock.type  = P9_LOCK_TYPE_UNLCK;
        glock.start = fl->fl_start;
        if (fl->fl_end == OFFSET_MAX)
                glock.length = 0;
@@ -257,17 +268,26 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
        res = p9_client_getlock_dotl(fid, &glock);
        if (res < 0)
                return res;
-        if (glock.type != F_UNLCK) {
+        /* map 9p lock type to os lock type */
-                fl->fl_type = glock.type;
+        switch (glock.type) {
+        case P9_LOCK_TYPE_RDLCK:
+                fl->fl_type = F_RDLCK;
+                break;
+        case P9_LOCK_TYPE_WRLCK:
+                fl->fl_type = F_WRLCK;
+                break;
+        case P9_LOCK_TYPE_UNLCK:
+                fl->fl_type = F_UNLCK;
+                break;
+        }
+        if (glock.type != P9_LOCK_TYPE_UNLCK) {
                fl->fl_start = glock.start;
                if (glock.length == 0)
                        fl->fl_end = OFFSET_MAX;
                else
                        fl->fl_end = glock.start + glock.length - 1;
                fl->fl_pid = glock.proc_id;
-        } else
+        }
-                fl->fl_type = F_UNLCK;
        return res;
 }
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 8bb5507e822f..e3c03db3c788 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -95,15 +95,18 @@ static int unixmode2p9mode(struct v9fs_session_info *v9ses, int mode)
 /**
 * p9mode2unixmode- convert plan9 mode bits to unix mode bits
 * @v9ses: v9fs session information
- * @mode: mode to convert
+ * @stat: p9_wstat from which mode need to be derived
+ * @rdev: major number, minor number in case of device files.
 *
 */
+static int p9mode2unixmode(struct v9fs_session_info *v9ses,
-static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
+                           struct p9_wstat *stat, dev_t *rdev)
 {
        int res;
+        int mode = stat->mode;
-        res = mode & 0777;
+        res = mode & S_IALLUGO;
+        *rdev = 0;
        if ((mode & P9_DMDIR) == P9_DMDIR)
                res |= S_IFDIR;
@@ -116,9 +119,26 @@ static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
                 && (v9ses->nodev == 0))
                res |= S_IFIFO;
        else if ((mode & P9_DMDEVICE) && (v9fs_proto_dotu(v9ses))
-                 && (v9ses->nodev == 0))
+                 && (v9ses->nodev == 0)) {
-                res |= S_IFBLK;
+                char type = 0, ext[32];
-        else
+                int major = -1, minor = -1;
+                strncpy(ext, stat->extension, sizeof(ext));
+                sscanf(ext, "%c %u %u", &type, &major, &minor);
+                switch (type) {
+                case 'c':
+                        res |= S_IFCHR;
+                        break;
+                case 'b':
+                        res |= S_IFBLK;
+                        break;
+                default:
+                        P9_DPRINTK(P9_DEBUG_ERROR,
+                                "Unknown special type %c %s\n", type,
+                                stat->extension);
+                };
+                *rdev = MKDEV(major, minor);
+        } else
                res |= S_IFREG;
        if (v9fs_proto_dotu(v9ses)) {
@@ -131,7 +151,6 @@ static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
                if ((mode & P9_DMSETVTX) == P9_DMSETVTX)
                        res |= S_ISVTX;
        }
        return res;
 }
@@ -242,13 +261,13 @@ void v9fs_destroy_inode(struct inode *inode)
 }
 int v9fs_init_inode(struct v9fs_session_info *v9ses,
-                    struct inode *inode, int mode)
+                    struct inode *inode, int mode, dev_t rdev)
 {
        int err = 0;
        inode_init_owner(inode, NULL, mode);
        inode->i_blocks = 0;
-        inode->i_rdev = 0;
+        inode->i_rdev = rdev;
        inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
        inode->i_mapping->a_ops = &v9fs_addr_operations;
@@ -335,7 +354,7 @@ error:
 *
 */
-struct inode *v9fs_get_inode(struct super_block *sb, int mode)
+struct inode *v9fs_get_inode(struct super_block *sb, int mode, dev_t rdev)
 {
        int err;
        struct inode *inode;
@@ -348,7 +367,7 @@ struct inode *v9fs_get_inode(struct super_block *sb, int mode)
                P9_EPRINTK(KERN_WARNING, "Problem allocating inode\n");
                return ERR_PTR(-ENOMEM);
        }
-        err = v9fs_init_inode(v9ses, inode, mode);
+        err = v9fs_init_inode(v9ses, inode, mode, rdev);
        if (err) {
                iput(inode);
                return ERR_PTR(err);
@@ -435,11 +454,12 @@ void v9fs_evict_inode(struct inode *inode)
 static int v9fs_test_inode(struct inode *inode, void *data)
 {
        int umode;
+        dev_t rdev;
        struct v9fs_inode *v9inode = V9FS_I(inode);
        struct p9_wstat *st = (struct p9_wstat *)data;
        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(inode);
-        umode = p9mode2unixmode(v9ses, st->mode);
+        umode = p9mode2unixmode(v9ses, st, &rdev);
        /* don't match inode of different type */
        if ((inode->i_mode & S_IFMT) != (umode & S_IFMT))
                return 0;
@@ -473,6 +493,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
                                   struct p9_wstat *st,
                                   int new)
 {
+        dev_t rdev;
        int retval, umode;
        unsigned long i_ino;
        struct inode *inode;
@@ -496,8 +517,8 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
         * later.
         */
        inode->i_ino = i_ino;
-        umode = p9mode2unixmode(v9ses, st->mode);
+        umode = p9mode2unixmode(v9ses, st, &rdev);
-        retval = v9fs_init_inode(v9ses, inode, umode);
+        retval = v9fs_init_inode(v9ses, inode, umode, rdev);
        if (retval)
                goto error;
@@ -532,6 +553,19 @@ v9fs_inode_from_fid(struct v9fs_session_info *v9ses, struct p9_fid *fid,
 }
 /**
+ * v9fs_at_to_dotl_flags- convert Linux specific AT flags to
+ * plan 9 AT flag.
+ * @flags: flags to convert
+ */
+static int v9fs_at_to_dotl_flags(int flags)
+{
+        int rflags = 0;
+        if (flags & AT_REMOVEDIR)
+                rflags |= P9_DOTL_AT_REMOVEDIR;
+        return rflags;
+}
+/**
 * v9fs_remove - helper function to remove files and directories
 * @dir: directory inode that is being deleted
 * @dentry:  dentry that is being deleted
@@ -558,7 +592,8 @@ static int v9fs_remove(struct inode *dir, struct dentry *dentry, int flags)
                return retval;
        }
        if (v9fs_proto_dotl(v9ses))
-                retval = p9_client_unlinkat(dfid, dentry->d_name.name, flags);
+                retval = p9_client_unlinkat(dfid, dentry->d_name.name,
+                                            v9fs_at_to_dotl_flags(flags));
        if (retval == -EOPNOTSUPP) {
                /* Try the one based on path */
                v9fid = v9fs_fid_clone(dentry);
@@ -645,13 +680,11 @@ v9fs_create(struct v9fs_session_info *v9ses, struct inode *dir,
                P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n", err);
                goto error;
        }
-        d_instantiate(dentry, inode);
        err = v9fs_fid_add(dentry, fid);
        if (err < 0)
                goto error;
+        d_instantiate(dentry, inode);
        return ofid;
 error:
        if (ofid)
                p9_client_clunk(ofid);
@@ -792,6 +825,7 @@ static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
                                      struct nameidata *nameidata)
 {
+        struct dentry *res;
        struct super_block *sb;
        struct v9fs_session_info *v9ses;
        struct p9_fid *dfid, *fid;
@@ -823,22 +857,35 @@ struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
                return ERR_PTR(result);
        }
+        /*
-        inode = v9fs_get_inode_from_fid(v9ses, fid, dir->i_sb);
+         * Make sure we don't use a wrong inode due to parallel
+         * unlink. For cached mode create calls request for new
+         * inode. But with cache disabled, lookup should do this.
+         */
+        if (v9ses->cache)
+                inode = v9fs_get_inode_from_fid(v9ses, fid, dir->i_sb);
+        else
+                inode = v9fs_get_new_inode_from_fid(v9ses, fid, dir->i_sb);
        if (IS_ERR(inode)) {
                result = PTR_ERR(inode);
                inode = NULL;
                goto error;
        }
        result = v9fs_fid_add(dentry, fid);
        if (result < 0)
                goto error_iput;
 inst_out:
-        d_add(dentry, inode);
+        /*
-        return NULL;
+         * If we had a rename on the server and a parallel lookup
+         * for the new name, then make sure we instantiate with
+         * the new name. ie look up for a/b, while on server somebody
+         * moved b under k and client parallely did a lookup for
+         * k/b.
+         */
+        res = d_materialise_unique(dentry, inode);
+        if (!IS_ERR(res))
+                return res;
+        result = PTR_ERR(res);
 error_iput:
        iput(inode);
 error:
@@ -1002,7 +1049,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
                return PTR_ERR(st);
        v9fs_stat2inode(st, dentry->d_inode, dentry->d_inode->i_sb);
-                generic_fillattr(dentry->d_inode, stat);
+        generic_fillattr(dentry->d_inode, stat);
        p9stat_free(st);
        kfree(st);
@@ -1086,6 +1133,7 @@ void
 v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
        struct super_block *sb)
 {
+        mode_t mode;
        char ext[32];
        char tag_name[14];
        unsigned int i_nlink;
@@ -1121,31 +1169,9 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
                                inode->i_nlink = i_nlink;
                }
        }
-        inode->i_mode = p9mode2unixmode(v9ses, stat->mode);
+        mode = stat->mode & S_IALLUGO;
-        if ((S_ISBLK(inode->i_mode)) || (S_ISCHR(inode->i_mode))) {
+        mode |= inode->i_mode & ~S_IALLUGO;
-                char type = 0;
+        inode->i_mode = mode;
-                int major = -1;
-                int minor = -1;
-                strncpy(ext, stat->extension, sizeof(ext));
-                sscanf(ext, "%c %u %u", &type, &major, &minor);
-                switch (type) {
-                case 'c':
-                        inode->i_mode &= ~S_IFBLK;
-                        inode->i_mode |= S_IFCHR;
-                        break;
-                case 'b':
-                        break;
-                default:
-                        P9_DPRINTK(P9_DEBUG_ERROR,
-                                "Unknown special type %c %s\n", type,
-                                stat->extension);
-                };
-                inode->i_rdev = MKDEV(major, minor);
-                init_special_inode(inode, inode->i_mode, inode->i_rdev);
-        } else
-                inode->i_rdev = 0;
        i_size_write(inode, stat->length);
        /* not real number of blocks, but 512 byte ones ... */
@@ -1411,6 +1437,8 @@ v9fs_vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t rdev)
 int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
 {
+        int umode;
+        dev_t rdev;
        loff_t i_size;
        struct p9_wstat *st;
        struct v9fs_session_info *v9ses;
@@ -1419,6 +1447,12 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
        st = p9_client_stat(fid);
        if (IS_ERR(st))
                return PTR_ERR(st);
+        /*
+         * Don't update inode if the file type is different
+         */
+        umode = p9mode2unixmode(v9ses, st, &rdev);
+        if ((inode->i_mode & S_IFMT) != (umode & S_IFMT))
+                goto out;
        spin_lock(&inode->i_lock);
        /*
@@ -1430,6 +1464,7 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
        if (v9ses->cache)
                inode->i_size = i_size;
        spin_unlock(&inode->i_lock);
+out:
        p9stat_free(st);
        kfree(st);
        return 0;
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index b6c8ed205192..aded79fcd5cf 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -153,7 +153,8 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
         * later.
         */
        inode->i_ino = i_ino;
-        retval = v9fs_init_inode(v9ses, inode, st->st_mode);
+        retval = v9fs_init_inode(v9ses, inode,
+                                 st->st_mode, new_decode_dev(st->st_rdev));
        if (retval)
                goto error;
@@ -190,6 +191,58 @@ v9fs_inode_from_fid_dotl(struct v9fs_session_info *v9ses, struct p9_fid *fid,
        return inode;
 }
+struct dotl_openflag_map {
+        int open_flag;
+        int dotl_flag;
+};
+static int v9fs_mapped_dotl_flags(int flags)
+{
+        int i;
+        int rflags = 0;
+        struct dotl_openflag_map dotl_oflag_map[] = {
+                { O_CREAT,      P9_DOTL_CREATE },
+                { O_EXCL,       P9_DOTL_EXCL },
+                { O_NOCTTY,     P9_DOTL_NOCTTY },
+                { O_TRUNC,      P9_DOTL_TRUNC },
+                { O_APPEND,     P9_DOTL_APPEND },
+                { O_NONBLOCK,   P9_DOTL_NONBLOCK },
+                { O_DSYNC,      P9_DOTL_DSYNC },
+                { FASYNC,       P9_DOTL_FASYNC },
+                { O_DIRECT,     P9_DOTL_DIRECT },
+                { O_LARGEFILE,  P9_DOTL_LARGEFILE },
+                { O_DIRECTORY,  P9_DOTL_DIRECTORY },
+                { O_NOFOLLOW,   P9_DOTL_NOFOLLOW },
+                { O_NOATIME,    P9_DOTL_NOATIME },
+                { O_CLOEXEC,    P9_DOTL_CLOEXEC },
+                { O_SYNC,       P9_DOTL_SYNC},
+        };
+        for (i = 0; i < ARRAY_SIZE(dotl_oflag_map); i++) {
+                if (flags & dotl_oflag_map[i].open_flag)
+                        rflags |= dotl_oflag_map[i].dotl_flag;
+        }
+        return rflags;
+}
+/**
+ * v9fs_open_to_dotl_flags- convert Linux specific open flags to
+ * plan 9 open flag.
+ * @flags: flags to convert
+ */
+int v9fs_open_to_dotl_flags(int flags)
+{
+        int rflags = 0;
+        /*
+         * We have same bits for P9_DOTL_READONLY, P9_DOTL_WRONLY
+         * and P9_DOTL_NOACCESS
+         */
+        rflags |= flags & O_ACCMODE;
+        rflags |= v9fs_mapped_dotl_flags(flags);
+        return rflags;
+}
 /**
 * v9fs_vfs_create_dotl - VFS hook to create files for 9P2000.L protocol.
 * @dir: directory inode that is being created
@@ -258,7 +311,8 @@ v9fs_vfs_create_dotl(struct inode *dir, struct dentry *dentry, int omode,
                           "Failed to get acl values in creat %d\n", err);
                goto error;
        }
-        err = p9_client_create_dotl(ofid, name, flags, mode, gid, &qid);
+        err = p9_client_create_dotl(ofid, name, v9fs_open_to_dotl_flags(flags),
+                                    mode, gid, &qid);
        if (err < 0) {
                P9_DPRINTK(P9_DEBUG_VFS,
                                "p9_client_open_dotl failed in creat %d\n",
@@ -281,10 +335,10 @@ v9fs_vfs_create_dotl(struct inode *dir, struct dentry *dentry, int omode,
                P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n", err);
                goto error;
        }
-        d_instantiate(dentry, inode);
        err = v9fs_fid_add(dentry, fid);
        if (err < 0)
                goto error;
+        d_instantiate(dentry, inode);
        /* Now set the ACL based on the default value */
        v9fs_set_create_acl(dentry, &dacl, &pacl);
@@ -403,10 +457,10 @@ static int v9fs_vfs_mkdir_dotl(struct inode *dir,
                                err);
                        goto error;
                }
-                d_instantiate(dentry, inode);
                err = v9fs_fid_add(dentry, fid);
                if (err < 0)
                        goto error;
+                d_instantiate(dentry, inode);
                fid = NULL;
        } else {
                /*
@@ -414,7 +468,7 @@ static int v9fs_vfs_mkdir_dotl(struct inode *dir,
                 * inode with stat. We need to get an inode
                 * so that we can set the acl with dentry
                 */
-                inode = v9fs_get_inode(dir->i_sb, mode);
+                inode = v9fs_get_inode(dir->i_sb, mode, 0);
                if (IS_ERR(inode)) {
                        err = PTR_ERR(inode);
                        goto error;
@@ -540,6 +594,7 @@ int v9fs_vfs_setattr_dotl(struct dentry *dentry, struct iattr *iattr)
 void
 v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
 {
+        mode_t mode;
        struct v9fs_inode *v9inode = V9FS_I(inode);
        if ((stat->st_result_mask & P9_STATS_BASIC) == P9_STATS_BASIC) {
@@ -552,11 +607,10 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
                inode->i_uid = stat->st_uid;
                inode->i_gid = stat->st_gid;
                inode->i_nlink = stat->st_nlink;
-                inode->i_mode = stat->st_mode;
-                inode->i_rdev = new_decode_dev(stat->st_rdev);
-                if ((S_ISBLK(inode->i_mode)) || (S_ISCHR(inode->i_mode)))
+                mode = stat->st_mode & S_IALLUGO;
-                        init_special_inode(inode, inode->i_mode, inode->i_rdev);
+                mode |= inode->i_mode & ~S_IALLUGO;
+                inode->i_mode = mode;
                i_size_write(inode, stat->st_size);
                inode->i_blocks = stat->st_blocks;
@@ -657,14 +711,14 @@ v9fs_vfs_symlink_dotl(struct inode *dir, struct dentry *dentry,
                                        err);
                        goto error;
                }
-                d_instantiate(dentry, inode);
                err = v9fs_fid_add(dentry, fid);
                if (err < 0)
                        goto error;
+                d_instantiate(dentry, inode);
                fid = NULL;
        } else {
                /* Not in cached mode. No need to populate inode with stat */
-                inode = v9fs_get_inode(dir->i_sb, S_IFLNK);
+                inode = v9fs_get_inode(dir->i_sb, S_IFLNK, 0);
                if (IS_ERR(inode)) {
                        err = PTR_ERR(inode);
                        goto error;
@@ -810,17 +864,17 @@ v9fs_vfs_mknod_dotl(struct inode *dir, struct dentry *dentry, int omode,
                                err);
                        goto error;
                }
-                d_instantiate(dentry, inode);
                err = v9fs_fid_add(dentry, fid);
                if (err < 0)
                        goto error;
+                d_instantiate(dentry, inode);
                fid = NULL;
        } else {
                /*
                 * Not in cached mode. No need to populate inode with stat.
                 * socket syscall returns a fd, so we need instantiate
                 */
-                inode = v9fs_get_inode(dir->i_sb, mode);
+                inode = v9fs_get_inode(dir->i_sb, mode, rdev);
                if (IS_ERR(inode)) {
                        err = PTR_ERR(inode);
                        goto error;
@@ -886,6 +940,11 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
        st = p9_client_getattr_dotl(fid, P9_STATS_ALL);
        if (IS_ERR(st))
                return PTR_ERR(st);
+        /*
+         * Don't update inode if the file type is different
+         */
+        if ((inode->i_mode & S_IFMT) != (st->st_mode & S_IFMT))
+                goto out;
        spin_lock(&inode->i_lock);
        /*
@@ -897,6 +956,7 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
        if (v9ses->cache)
                inode->i_size = i_size;
        spin_unlock(&inode->i_lock);
+out:
        kfree(st);
        return 0;
 }
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index feef6cdc1fd2..c70251d47ed1 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -149,7 +149,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
        else
                sb->s_d_op = &v9fs_dentry_operations;
-        inode = v9fs_get_inode(sb, S_IFDIR | mode);
+        inode = v9fs_get_inode(sb, S_IFDIR | mode, 0);
        if (IS_ERR(inode)) {
                retval = PTR_ERR(inode);
                goto release_sb;
diff --git a/fs/block_dev.c b/fs/block_dev.c
index ff77262e887c..95f786ec7f08 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1429,6 +1429,11 @@ static int __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
                WARN_ON_ONCE(bdev->bd_holders);
                sync_blockdev(bdev);
                kill_bdev(bdev);
+                /* ->release can cause the old bdi to disappear,
+                 * so must switch it out first
+                 */
+                bdev_inode_switch_bdi(bdev->bd_inode,
+                                        &default_backing_dev_info);
        }
        if (bdev->bd_contains == bdev) {
                if (disk->fops->release)
@@ -1442,8 +1447,6 @@ static int __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
                disk_put_part(bdev->bd_part);
                bdev->bd_part = NULL;
                bdev->bd_disk = NULL;
-                bdev_inode_switch_bdi(bdev->bd_inode,
-                                        &default_backing_dev_info);
                if (bdev != bdev->bd_contains)
                        victim = bdev->bd_contains;
                bdev->bd_contains = NULL;
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index 502b9e988679..d9f99a16edd6 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -176,7 +176,11 @@ static inline u64 btrfs_ino(struct inode *inode)
 {
        u64 ino = BTRFS_I(inode)->location.objectid;
-        if (ino <= BTRFS_FIRST_FREE_OBJECTID)
+        /*
+         * !ino: btree_inode
+         * type == BTRFS_ROOT_ITEM_KEY: subvol dir
+         */
+        if (!ino || BTRFS_I(inode)->location.type == BTRFS_ROOT_ITEM_KEY)
                ino = inode->i_ino;
        return ino;
 }
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index b910694f61ed..a1cb7821becd 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -183,8 +183,10 @@ static int __btrfs_lookup_bio_sums(struct btrfs_root *root,
         * read from the commit root and sidestep a nasty deadlock
         * between reading the free space cache and updating the csum tree.
         */
-        if (btrfs_is_free_space_inode(root, inode))
+        if (btrfs_is_free_space_inode(root, inode)) {
                path->search_commit_root = 1;
+                path->skip_locking = 1;
+        }
        disk_bytenr = (u64)bio->bi_sector << 9;
        if (dio)
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index e7872e485f13..a381cd22f518 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1075,12 +1075,6 @@ static noinline int prepare_pages(struct btrfs_root *root, struct file *file,
        start_pos = pos & ~((u64)root->sectorsize - 1);
        last_pos = ((u64)index + num_pages) << PAGE_CACHE_SHIFT;
-        if (start_pos > inode->i_size) {
-                err = btrfs_cont_expand(inode, i_size_read(inode), start_pos);
-                if (err)
-                        return err;
-        }
 again:
        for (i = 0; i < num_pages; i++) {
                pages[i] = find_or_create_page(inode->i_mapping, index + i,
@@ -1338,6 +1332,7 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
        struct inode *inode = fdentry(file)->d_inode;
        struct btrfs_root *root = BTRFS_I(inode)->root;
        loff_t *ppos = &iocb->ki_pos;
+        u64 start_pos;
        ssize_t num_written = 0;
        ssize_t err = 0;
        size_t count, ocount;
@@ -1386,6 +1381,15 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
        file_update_time(file);
        BTRFS_I(inode)->sequence++;
+        start_pos = round_down(pos, root->sectorsize);
+        if (start_pos > i_size_read(inode)) {
+                err = btrfs_cont_expand(inode, i_size_read(inode), start_pos);
+                if (err) {
+                        mutex_unlock(&inode->i_mutex);
+                        goto out;
+                }
+        }
        if (unlikely(file->f_flags & O_DIRECT)) {
                num_written = __btrfs_direct_write(iocb, iov, nr_segs,
                                                   pos, ppos, count, ocount);
@@ -1813,6 +1817,11 @@ static loff_t btrfs_file_llseek(struct file *file, loff_t offset, int origin)
                goto out;
        case SEEK_DATA:
        case SEEK_HOLE:
+                if (offset >= i_size_read(inode)) {
+                        mutex_unlock(&inode->i_mutex);
+                        return -ENXIO;
+                }
                ret = find_desired_extent(inode, &offset, origin);
                if (ret) {
                        mutex_unlock(&inode->i_mutex);
@@ -1821,11 +1830,11 @@ static loff_t btrfs_file_llseek(struct file *file, loff_t offset, int origin)
        }
        if (offset < 0 && !(file->f_mode & FMODE_UNSIGNED_OFFSET)) {
-                ret = -EINVAL;
+                offset = -EINVAL;
                goto out;
        }
        if (offset > inode->i_sb->s_maxbytes) {
-                ret = -EINVAL;
+                offset = -EINVAL;
                goto out;
        }
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 6a265b9f85f2..41ac927401d0 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -190,9 +190,11 @@ int btrfs_truncate_free_space_cache(struct btrfs_root *root,
                                    struct btrfs_path *path,
                                    struct inode *inode)
 {
+        struct btrfs_block_rsv *rsv;
        loff_t oldsize;
        int ret = 0;
+        rsv = trans->block_rsv;
        trans->block_rsv = root->orphan_block_rsv;
        ret = btrfs_block_rsv_check(trans, root,
                                    root->orphan_block_rsv,
@@ -210,6 +212,8 @@ int btrfs_truncate_free_space_cache(struct btrfs_root *root,
         */
        ret = btrfs_truncate_inode_items(trans, root, inode,
                                         0, BTRFS_EXTENT_DATA_KEY);
+        trans->block_rsv = rsv;
        if (ret) {
                WARN_ON(1);
                return ret;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 0ccc7438ad34..b2d004ad66a0 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1786,7 +1786,7 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
                          &ordered_extent->list);
        ret = btrfs_ordered_update_i_size(inode, 0, ordered_extent);
-        if (!ret) {
+        if (!ret || !test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags)) {
                ret = btrfs_update_inode(trans, root, inode);
                BUG_ON(ret);
        }
@@ -3510,15 +3510,19 @@ int btrfs_cont_expand(struct inode *inode, loff_t oldsize, loff_t size)
                        err = btrfs_drop_extents(trans, inode, cur_offset,
                                                 cur_offset + hole_size,
                                                 &hint_byte, 1);
-                        if (err)
+                        if (err) {
+                                btrfs_end_transaction(trans, root);
                                break;
+                        }
                        err = btrfs_insert_file_extent(trans, root,
                                        btrfs_ino(inode), cur_offset, 0,
                                        0, hole_size, 0, hole_size,
                                        0, 0, 0);
-                        if (err)
+                        if (err) {
+                                btrfs_end_transaction(trans, root);
                                break;
+                        }
                        btrfs_drop_extent_cache(inode, hole_start,
                                        last_byte - 1, 0);
@@ -3952,7 +3956,6 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
                         struct btrfs_root *root, int *new)
 {
        struct inode *inode;
-        int bad_inode = 0;
        inode = btrfs_iget_locked(s, location->objectid, root);
        if (!inode)
@@ -3968,15 +3971,12 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
                        if (new)
                                *new = 1;
                } else {
-                        bad_inode = 1;
+                        unlock_new_inode(inode);
+                        iput(inode);
+                        inode = ERR_PTR(-ESTALE);
                }
        }
-        if (bad_inode) {
-                iput(inode);
-                inode = ERR_PTR(-ESTALE);
-        }
        return inode;
 }
@@ -4018,7 +4018,8 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
                memcpy(&location, dentry->d_fsdata, sizeof(struct btrfs_key));
                kfree(dentry->d_fsdata);
                dentry->d_fsdata = NULL;
-                d_clear_need_lookup(dentry);
+                /* This thing is hashed, drop it for now */
+                d_drop(dentry);
        } else {
                ret = btrfs_inode_by_name(dir, dentry, &location);
        }
@@ -4085,7 +4086,15 @@ static void btrfs_dentry_release(struct dentry *dentry)
 static struct dentry *btrfs_lookup(struct inode *dir, struct dentry *dentry,
                                   struct nameidata *nd)
 {
-        return d_splice_alias(btrfs_lookup_dentry(dir, dentry), dentry);
+        struct dentry *ret;
+        ret = d_splice_alias(btrfs_lookup_dentry(dir, dentry), dentry);
+        if (unlikely(d_need_lookup(dentry))) {
+                spin_lock(&dentry->d_lock);
+                dentry->d_flags &= ~DCACHE_NEED_LOOKUP;
+                spin_unlock(&dentry->d_lock);
+        }
+        return ret;
 }
 unsigned char btrfs_filetype_table[] = {
@@ -4125,7 +4134,8 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
        /* special case for "." */
        if (filp->f_pos == 0) {
-                over = filldir(dirent, ".", 1, 1, btrfs_ino(inode), DT_DIR);
+                over = filldir(dirent, ".", 1,
+                               filp->f_pos, btrfs_ino(inode), DT_DIR);
                if (over)
                        return 0;
                filp->f_pos = 1;
@@ -4134,7 +4144,7 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
        if (filp->f_pos == 1) {
                u64 pino = parent_ino(filp->f_path.dentry);
                over = filldir(dirent, "..", 2,
-                               2, pino, DT_DIR);
+                               filp->f_pos, pino, DT_DIR);
                if (over)
                        return 0;
                filp->f_pos = 2;
@@ -5823,7 +5833,7 @@ again:
        add_pending_csums(trans, inode, ordered->file_offset, &ordered->list);
        ret = btrfs_ordered_update_i_size(inode, 0, ordered);
-        if (!ret)
+        if (!ret || !test_bit(BTRFS_ORDERED_PREALLOC, &ordered->flags))
                btrfs_update_inode(trans, root, inode);
        ret = 0;
 out_unlock:
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 970977aab224..538f65a79ec5 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2177,6 +2177,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
        if (!(src_file->f_mode & FMODE_READ))
                goto out_fput;
+        /* don't make the dst file partly checksummed */
+        if ((BTRFS_I(src)->flags & BTRFS_INODE_NODATASUM) !=
+            (BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM))
+                goto out_fput;
        ret = -EISDIR;
        if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode))
                goto out_fput;
@@ -2220,6 +2225,16 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
            !IS_ALIGNED(destoff, bs))
                goto out_unlock;
+        if (destoff > inode->i_size) {
+                ret = btrfs_cont_expand(inode, inode->i_size, destoff);
+                if (ret)
+                        goto out_unlock;
+        }
+        /* truncate page cache pages from target inode range */
+        truncate_inode_pages_range(&inode->i_data, destoff,
+                                   PAGE_CACHE_ALIGN(destoff + len) - 1);
        /* do any pending delalloc/csum calc on src, one way or
           another, and lock file content */
        while (1) {
@@ -2236,10 +2251,6 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                btrfs_wait_ordered_range(src, off, len);
        }
-        /* truncate page cache pages from target inode range */
-        truncate_inode_pages_range(&inode->i_data, off,
-                                   ALIGN(off + len, PAGE_CACHE_SIZE) - 1);
        /* clone data */
        key.objectid = btrfs_ino(src);
        key.type = BTRFS_EXTENT_DATA_KEY;
@@ -2317,7 +2328,12 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                        else
                                new_key.offset = destoff;
-                        trans = btrfs_start_transaction(root, 1);
+                        /*
+                         * 1 - adjusting old extent (we may have to split it)
+                         * 1 - add new extent
+                         * 1 - inode update
+                         */
+                        trans = btrfs_start_transaction(root, 3);
                        if (IS_ERR(trans)) {
                                ret = PTR_ERR(trans);
                                goto out;
@@ -2325,14 +2341,21 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                        if (type == BTRFS_FILE_EXTENT_REG ||
                            type == BTRFS_FILE_EXTENT_PREALLOC) {
+                                /*
+                                 *    a  | --- range to clone ---|  b
+                                 * | ------------- extent ------------- |
+                                 */
+                                /* substract range b */
+                                if (key.offset + datal > off + len)
+                                        datal = off + len - key.offset;
+                                /* substract range a */
                                if (off > key.offset) {
                                        datao += off - key.offset;
                                        datal -= off - key.offset;
                                }
-                                if (key.offset + datal > off + len)
-                                        datal = off + len - key.offset;
                                ret = btrfs_drop_extents(trans, inode,
                                                         new_key.offset,
                                                         new_key.offset + datal,
@@ -2429,7 +2452,6 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                        if (endoff > inode->i_size)
                                btrfs_i_size_write(inode, endoff);
-                        BTRFS_I(inode)->flags = BTRFS_I(src)->flags;
                        ret = btrfs_update_inode(trans, root, inode);
                        BUG_ON(ret);
                        btrfs_end_transaction(trans, root);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 7dc36fab4afc..e24b7964a155 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -884,6 +884,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        struct btrfs_root *tree_root = fs_info->tree_root;
        struct btrfs_root *root = pending->root;
        struct btrfs_root *parent_root;
+        struct btrfs_block_rsv *rsv;
        struct inode *parent_inode;
        struct dentry *parent;
        struct dentry *dentry;
@@ -895,6 +896,8 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        u64 objectid;
        u64 root_flags;
+        rsv = trans->block_rsv;
        new_root_item = kmalloc(sizeof(*new_root_item), GFP_NOFS);
        if (!new_root_item) {
                pending->error = -ENOMEM;
@@ -1002,6 +1005,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        btrfs_orphan_post_snapshot(trans, pending);
 fail:
        kfree(new_root_item);
+        trans->block_rsv = rsv;
        btrfs_block_rsv_release(root, &pending->block_rsv, (u64)-1);
        return 0;
 }
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index d733b9cfea34..69565e5fc6a0 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -116,6 +116,12 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
                if (ret)
                        goto out;
                btrfs_release_path(path);
+                /*
+                 * remove the attribute
+                 */
+                if (!value)
+                        goto out;
        }
 again:
@@ -158,6 +164,9 @@ out:
        return ret;
 }
+/*
+ * @value: "" makes the attribute to empty, NULL removes it
+ */
 int __btrfs_setxattr(struct btrfs_trans_handle *trans,
                     struct inode *inode, const char *name,
                     const void *value, size_t size, int flags)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index fee028b5332e..86c59e16ba74 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1595,7 +1595,7 @@ static int set_request_path_attr(struct inode *rinode, struct dentry *rdentry,
                r = build_dentry_path(rdentry, ppath, pathlen, ino, freepath);
                dout(" dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen,
                     *ppath);
-        } else if (rpath) {
+        } else if (rpath || rino) {
                *ino = rino;
                *ppath = rpath;
                *pathlen = strlen(rpath);
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index d47c5ec7fb1f..88bacaf385d9 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -813,8 +813,8 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
        fsc = create_fs_client(fsopt, opt);
        if (IS_ERR(fsc)) {
                res = ERR_CAST(fsc);
-                kfree(fsopt);
+                destroy_mount_options(fsopt);
-                kfree(opt);
+                ceph_destroy_options(opt);
                goto out_final;
        }
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index e76bfeb68267..30acd22147e1 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -351,9 +351,7 @@ static int
 build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
 {
        unsigned int dlen;
-        unsigned int wlen;
+        unsigned int size = 2 * sizeof(struct ntlmssp2_name);
-        unsigned int size = 6 * sizeof(struct ntlmssp2_name);
-        __le64  curtime;
        char *defdmname = "WORKGROUP";
        unsigned char *blobptr;
        struct ntlmssp2_name *attrptr;
@@ -365,15 +363,14 @@ build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
        }
        dlen = strlen(ses->domainName);
-        wlen = strlen(ses->server->hostname);
-        /* The length of this blob is a size which is
+        /*
-         * six times the size of a structure which holds name/size +
+         * The length of this blob is two times the size of a
-         * two times the unicode length of a domain name +
+         * structure (av pair) which holds name/size
-         * two times the unicode length of a server name +
+         * ( for NTLMSSP_AV_NB_DOMAIN_NAME followed by NTLMSSP_AV_EOL ) +
-         * size of a timestamp (which is 8 bytes).
+         * unicode length of a netbios domain name
         */
-        ses->auth_key.len = size + 2 * (2 * dlen) + 2 * (2 * wlen) + 8;
+        ses->auth_key.len = size + 2 * dlen;
        ses->auth_key.response = kzalloc(ses->auth_key.len, GFP_KERNEL);
        if (!ses->auth_key.response) {
                ses->auth_key.len = 0;
@@ -384,44 +381,15 @@ build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
        blobptr = ses->auth_key.response;
        attrptr = (struct ntlmssp2_name *) blobptr;
+        /*
+         * As defined in MS-NTLM 3.3.2, just this av pair field
+         * is sufficient as part of the temp
+         */
        attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_DOMAIN_NAME);
        attrptr->length = cpu_to_le16(2 * dlen);
        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
        cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
-        blobptr += 2 * dlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_COMPUTER_NAME);
-        attrptr->length = cpu_to_le16(2 * wlen);
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->server->hostname, wlen, nls_cp);
-        blobptr += 2 * wlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_DNS_DOMAIN_NAME);
-        attrptr->length = cpu_to_le16(2 * dlen);
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
-        blobptr += 2 * dlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_DNS_COMPUTER_NAME);
-        attrptr->length = cpu_to_le16(2 * wlen);
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->server->hostname, wlen, nls_cp);
-        blobptr += 2 * wlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_TIMESTAMP);
-        attrptr->length = cpu_to_le16(sizeof(__le64));
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        curtime = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
-        memcpy(blobptr, &curtime, sizeof(__le64));
        return 0;
 }
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f93eb948d071..54b8f1e7da94 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -548,6 +548,12 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                struct inode *dir = dentry->d_inode;
                struct dentry *child;
+                if (!dir) {
+                        dput(dentry);
+                        dentry = ERR_PTR(-ENOENT);
+                        break;
+                }
                /* skip separators */
                while (*s == sep)
                        s++;
@@ -563,10 +569,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                mutex_unlock(&dir->i_mutex);
                dput(dentry);
                dentry = child;
-                if (!dentry->d_inode) {
-                        dput(dentry);
-                        dentry = ERR_PTR(-ENOENT);
-                }
        } while (!IS_ERR(dentry));
        _FreeXid(xid);
        kfree(full_path);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index aac37d99a487..a80f7bd97b90 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4079,7 +4079,8 @@ int CIFSFindNext(const int xid, struct cifs_tcon *tcon,
        T2_FNEXT_RSP_PARMS *parms;
        char *response_data;
        int rc = 0;
-        int bytes_returned, name_len;
+        int bytes_returned;
+        unsigned int name_len;
        __u16 params, byte_count;
        cFYI(1, "In FindNext");
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 633c246b6775..f4af4cc37500 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1298,7 +1298,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                        /* ignore */
                } else if (strnicmp(data, "guest", 5) == 0) {
                        /* ignore */
-                } else if (strnicmp(data, "rw", 2) == 0) {
+                } else if (strnicmp(data, "rw", 2) == 0 && strlen(data) == 2) {
                        /* ignore */
                } else if (strnicmp(data, "ro", 2) == 0) {
                        /* ignore */
@@ -1401,7 +1401,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                        vol->server_ino = 1;
                } else if (strnicmp(data, "noserverino", 9) == 0) {
                        vol->server_ino = 0;
-                } else if (strnicmp(data, "rwpidforward", 4) == 0) {
+                } else if (strnicmp(data, "rwpidforward", 12) == 0) {
                        vol->rwpidforward = 1;
                } else if (strnicmp(data, "cifsacl", 7) == 0) {
                        vol->cifs_acl = 1;
diff --git a/fs/compat.c b/fs/compat.c
index 0b48d018e38a..58b1da459893 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1675,11 +1675,6 @@ asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
 }
 #endif /* HAVE_SET_RESTORE_SIGMASK */
-long asmlinkage compat_sys_nfsservctl(int cmd, void *notused, void *notused2)
-{
-        return sys_ni_syscall();
-}
 #ifdef CONFIG_EPOLL
 #ifdef HAVE_SET_RESTORE_SIGMASK
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 04da6acde85d..12661e1deedd 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1134,7 +1134,7 @@ struct buffer_head *ext3_bread(handle_t *handle, struct inode *inode,
                return bh;
        if (buffer_uptodate(bh))
                return bh;
-        ll_rw_block(READ_META, 1, &bh);
+        ll_rw_block(READ | REQ_META | REQ_PRIO, 1, &bh);
        wait_on_buffer(bh);
        if (buffer_uptodate(bh))
                return bh;
@@ -2807,7 +2807,7 @@ make_io:
                trace_ext3_load_inode(inode);
                get_bh(bh);
                bh->b_end_io = end_buffer_read_sync;
-                submit_bh(READ_META, bh);
+                submit_bh(READ | REQ_META | REQ_PRIO, bh);
                wait_on_buffer(bh);
                if (!buffer_uptodate(bh)) {
                        ext3_error(inode->i_sb, "ext3_get_inode_loc",
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 5571708b6a58..0629e09f6511 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -922,7 +922,8 @@ restart:
                                bh = ext3_getblk(NULL, dir, b++, 0, &err);
                                bh_use[ra_max] = bh;
                                if (bh)
-                                        ll_rw_block(READ_META, 1, &bh);
+                                        ll_rw_block(READ | REQ_META | REQ_PRIO,
+                                                    1, &bh);
                        }
                }
                if ((bh = bh_use[ra_ptr++]) == NULL)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index e717dfd2f2b4..b7d7bd0f066e 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -175,6 +175,7 @@ struct mpage_da_data {
 */
 #define EXT4_IO_END_UNWRITTEN   0x0001
 #define EXT4_IO_END_ERROR       0x0002
+#define EXT4_IO_END_QUEUED      0x0004
 struct ext4_io_page {
        struct page     *p_page;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index c4da98a959ae..986e2388f031 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -121,9 +121,6 @@ void ext4_evict_inode(struct inode *inode)
        trace_ext4_evict_inode(inode);
-        mutex_lock(&inode->i_mutex);
-        ext4_flush_completed_IO(inode);
-        mutex_unlock(&inode->i_mutex);
        ext4_ioend_wait(inode);
        if (inode->i_nlink) {
@@ -650,7 +647,7 @@ struct buffer_head *ext4_bread(handle_t *handle, struct inode *inode,
                return bh;
        if (buffer_uptodate(bh))
                return bh;
-        ll_rw_block(READ_META, 1, &bh);
+        ll_rw_block(READ | REQ_META | REQ_PRIO, 1, &bh);
        wait_on_buffer(bh);
        if (buffer_uptodate(bh))
                return bh;
@@ -3301,7 +3298,7 @@ make_io:
                trace_ext4_load_inode(inode);
                get_bh(bh);
                bh->b_end_io = end_buffer_read_sync;
-                submit_bh(READ_META, bh);
+                submit_bh(READ | REQ_META | REQ_PRIO, bh);
                wait_on_buffer(bh);
                if (!buffer_uptodate(bh)) {
                        EXT4_ERROR_INODE_BLOCK(inode, block,
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index f8068c7bae9f..1c924faeb6c8 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -922,7 +922,8 @@ restart:
                                bh = ext4_getblk(NULL, dir, b++, 0, &err);
                                bh_use[ra_max] = bh;
                                if (bh)
-                                        ll_rw_block(READ_META, 1, &bh);
+                                        ll_rw_block(READ | REQ_META | REQ_PRIO,
+                                                    1, &bh);
                        }
                }
                if ((bh = bh_use[ra_ptr++]) == NULL)
diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index 78839af7ce29..92f38ee13f8a 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -142,7 +142,23 @@ static void ext4_end_io_work(struct work_struct *work)
        unsigned long           flags;
        int                     ret;
-        mutex_lock(&inode->i_mutex);
+        if (!mutex_trylock(&inode->i_mutex)) {
+                /*
+                 * Requeue the work instead of waiting so that the work
+                 * items queued after this can be processed.
+                 */
+                queue_work(EXT4_SB(inode->i_sb)->dio_unwritten_wq, &io->work);
+                /*
+                 * To prevent the ext4-dio-unwritten thread from keeping
+                 * requeueing end_io requests and occupying cpu for too long,
+                 * yield the cpu if it sees an end_io request that has already
+                 * been requeued.
+                 */
+                if (io->flag & EXT4_IO_END_QUEUED)
+                        yield();
+                io->flag |= EXT4_IO_END_QUEUED;
+                return;
+        }
        ret = ext4_end_io_nolock(io);
        if (ret < 0) {
                mutex_unlock(&inode->i_mutex);
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 168a80f7f12b..5cb8614508c3 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -258,10 +258,14 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
        forget->forget_one.nlookup = nlookup;
        spin_lock(&fc->lock);
-        fc->forget_list_tail->next = forget;
+        if (fc->connected) {
-        fc->forget_list_tail = forget;
+                fc->forget_list_tail->next = forget;
-        wake_up(&fc->waitq);
+                fc->forget_list_tail = forget;
-        kill_fasync(&fc->fasync, SIGIO, POLL_IN);
+                wake_up(&fc->waitq);
+                kill_fasync(&fc->fasync, SIGIO, POLL_IN);
+        } else {
+                kfree(forget);
+        }
        spin_unlock(&fc->lock);
 }
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 12b502929da9..add96f6ffda5 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -812,6 +812,9 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                        if (arg->minor >= 17) {
                                if (!(arg->flags & FUSE_FLOCK_LOCKS))
                                        fc->no_flock = 1;
+                        } else {
+                                if (!(arg->flags & FUSE_POSIX_LOCKS))
+                                        fc->no_flock = 1;
                        }
                        if (arg->flags & FUSE_ATOMIC_O_TRUNC)
                                fc->atomic_o_trunc = 1;
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 85c62923ee29..598646434362 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -624,9 +624,9 @@ static void log_write_header(struct gfs2_sbd *sdp, u32 flags, int pull)
        bh->b_end_io = end_buffer_write_sync;
        get_bh(bh);
        if (test_bit(SDF_NOBARRIERS, &sdp->sd_flags))
-                submit_bh(WRITE_SYNC | REQ_META, bh);
+                submit_bh(WRITE_SYNC | REQ_META | REQ_PRIO, bh);
        else
-                submit_bh(WRITE_FLUSH_FUA | REQ_META, bh);
+                submit_bh(WRITE_FLUSH_FUA | REQ_META | REQ_PRIO, bh);
        wait_on_buffer(bh);
        if (!buffer_uptodate(bh))
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 747238cd9f96..be29858900f6 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -37,7 +37,7 @@ static int gfs2_aspace_writepage(struct page *page, struct writeback_control *wb
 {
        struct buffer_head *bh, *head;
        int nr_underway = 0;
-        int write_op = REQ_META |
+        int write_op = REQ_META | REQ_PRIO |
                (wbc->sync_mode == WB_SYNC_ALL ? WRITE_SYNC : WRITE);
        BUG_ON(!PageLocked(page));
@@ -225,7 +225,7 @@ int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags,
        }
        bh->b_end_io = end_buffer_read_sync;
        get_bh(bh);
-        submit_bh(READ_SYNC | REQ_META, bh);
+        submit_bh(READ_SYNC | REQ_META | REQ_PRIO, bh);
        if (!(flags & DIO_WAIT))
                return 0;
@@ -435,7 +435,7 @@ struct buffer_head *gfs2_meta_ra(struct gfs2_glock *gl, u64 dblock, u32 extlen)
        if (buffer_uptodate(first_bh))
                goto out;
        if (!buffer_locked(first_bh))
-                ll_rw_block(READ_SYNC | REQ_META, 1, &first_bh);
+                ll_rw_block(READ_SYNC | REQ_META | REQ_PRIO, 1, &first_bh);
        dblock++;
        extlen--;
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 3bc073a4cf82..079587e53849 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -224,7 +224,7 @@ static int gfs2_read_super(struct gfs2_sbd *sdp, sector_t sector, int silent)
        bio->bi_end_io = end_bio_io_page;
        bio->bi_private = page;
-        submit_bio(READ_SYNC | REQ_META, bio);
+        submit_bio(READ_SYNC | REQ_META | REQ_PRIO, bio);
        wait_on_page_locked(page);
        bio_put(bio);
        if (!PageUptodate(page)) {
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 42e8d23bc047..0e8bb13381e4 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -709,7 +709,7 @@ get_a_page:
                set_buffer_uptodate(bh);
        if (!buffer_uptodate(bh)) {
-                ll_rw_block(READ_META, 1, &bh);
+                ll_rw_block(READ | REQ_META | REQ_PRIO, 1, &bh);
                wait_on_buffer(bh);
                if (!buffer_uptodate(bh))
                        goto unlock_out;
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index c106ca22e812..d24a9b666a23 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -344,6 +344,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
        struct inode *root, *inode;
        struct qstr str;
        struct nls_table *nls = NULL;
+        u64 last_fs_block, last_fs_page;
        int err;
        err = -EINVAL;
@@ -399,9 +400,13 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
        if (!sbi->rsrc_clump_blocks)
                sbi->rsrc_clump_blocks = 1;
-        err = generic_check_addressable(sbi->alloc_blksz_shift,
+        err = -EFBIG;
-                                        sbi->total_blocks);
+        last_fs_block = sbi->total_blocks - 1;
-        if (err) {
+        last_fs_page = (last_fs_block << sbi->alloc_blksz_shift) >>
+                        PAGE_CACHE_SHIFT;
+        if ((last_fs_block > (sector_t)(~0ULL) >> (sbi->alloc_blksz_shift - 9)) ||
+            (last_fs_page > (pgoff_t)(~0ULL))) {
                printk(KERN_ERR "hfs: filesystem size too large.\n");
                goto out_free_vhdr;
        }
@@ -525,8 +530,8 @@ out_close_cat_tree:
 out_close_ext_tree:
        hfs_btree_close(sbi->ext_tree);
 out_free_vhdr:
-        kfree(sbi->s_vhdr);
+        kfree(sbi->s_vhdr_buf);
-        kfree(sbi->s_backup_vhdr);
+        kfree(sbi->s_backup_vhdr_buf);
 out_unload_nls:
        unload_nls(sbi->nls);
        unload_nls(nls);
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 10e515a0d452..7daf4b852d1c 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -272,9 +272,9 @@ reread:
        return 0;
 out_free_backup_vhdr:
-        kfree(sbi->s_backup_vhdr);
+        kfree(sbi->s_backup_vhdr_buf);
 out_free_vhdr:
-        kfree(sbi->s_vhdr);
+        kfree(sbi->s_vhdr_buf);
 out:
        return error;
 }
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 87b6e0421c12..ec889538e5a6 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -491,6 +491,7 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb, uid_t uid,
                        inode->i_op = &page_symlink_inode_operations;
                        break;
                }
+                lockdep_annotate_inode_mutex_key(inode);
        }
        return inode;
 }
diff --git a/fs/inode.c b/fs/inode.c
index 73920d555c88..ec7924696a13 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -848,16 +848,9 @@ struct inode *new_inode(struct super_block *sb)
 }
 EXPORT_SYMBOL(new_inode);
-/**
- * unlock_new_inode - clear the I_NEW state and wake up any waiters
- * @inode:      new inode to unlock
- *
- * Called when the inode is fully initialised to clear the new state of the
- * inode and wake up anyone waiting for the inode to finish initialisation.
- */
-void unlock_new_inode(struct inode *inode)
-{
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
+void lockdep_annotate_inode_mutex_key(struct inode *inode)
+{
        if (S_ISDIR(inode->i_mode)) {
                struct file_system_type *type = inode->i_sb->s_type;
@@ -873,7 +866,20 @@ void unlock_new_inode(struct inode *inode)
                                          &type->i_mutex_dir_key);
                }
        }
+}
+EXPORT_SYMBOL(lockdep_annotate_inode_mutex_key);
 #endif
+/**
+ * unlock_new_inode - clear the I_NEW state and wake up any waiters
+ * @inode:      new inode to unlock
+ *
+ * Called when the inode is fully initialised to clear the new state of the
+ * inode and wake up anyone waiting for the inode to finish initialisation.
+ */
+void unlock_new_inode(struct inode *inode)
+{
+        lockdep_annotate_inode_mutex_key(inode);
        spin_lock(&inode->i_lock);
        WARN_ON(!(inode->i_state & I_NEW));
        inode->i_state &= ~I_NEW;
diff --git a/fs/namei.c b/fs/namei.c
index 2826db35dc25..f4788365ea22 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -727,25 +727,22 @@ static int follow_automount(struct path *path, unsigned flags,
        if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_PARENT))
                return -EISDIR; /* we actually want to stop here */
-        /*
+        /* We don't want to mount if someone's just doing a stat -
-         * We don't want to mount if someone's just doing a stat and they've
+         * unless they're stat'ing a directory and appended a '/' to
-         * set AT_SYMLINK_NOFOLLOW - unless they're stat'ing a directory and
+         * the name.
-         * appended a '/' to the name.
+         *
+         * We do, however, want to mount if someone wants to open or
+         * create a file of any type under the mountpoint, wants to
+         * traverse through the mountpoint or wants to open the
+         * mounted directory.  Also, autofs may mark negative dentries
+         * as being automount points.  These will need the attentions
+         * of the daemon to instantiate them before they can be used.
         */
-        if (!(flags & LOOKUP_FOLLOW)) {
+        if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
-                /* We do, however, want to mount if someone wants to open or
+                     LOOKUP_OPEN | LOOKUP_CREATE)) &&
-                 * create a file of any type under the mountpoint, wants to
+            path->dentry->d_inode)
-                 * traverse through the mountpoint or wants to open the mounted
+                return -EISDIR;
-                 * directory.
-                 * Also, autofs may mark negative dentries as being automount
-                 * points.  These will need the attentions of the daemon to
-                 * instantiate them before they can be used.
-                 */
-                if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
-                             LOOKUP_OPEN | LOOKUP_CREATE)) &&
-                    path->dentry->d_inode)
-                        return -EISDIR;
-        }
        current->total_link_count++;
        if (current->total_link_count >= 40)
                return -ELOOP;
@@ -2619,6 +2616,7 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
        if (!dir->i_op->rmdir)
                return -EPERM;
+        dget(dentry);
        mutex_lock(&dentry->d_inode->i_mutex);
        error = -EBUSY;
@@ -2639,6 +2637,7 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
 out:
        mutex_unlock(&dentry->d_inode->i_mutex);
+        dput(dentry);
        if (!error)
                d_delete(dentry);
        return error;
@@ -3028,6 +3027,7 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
        if (error)
                return error;
+        dget(new_dentry);
        if (target)
                mutex_lock(&target->i_mutex);
@@ -3048,6 +3048,7 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
 out:
        if (target)
                mutex_unlock(&target->i_mutex);
+        dput(new_dentry);
        if (!error)
                if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
                        d_move(old_dentry,new_dentry);
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 1ec1a85fa71c..3e93e9a1bee1 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -56,6 +56,9 @@ enum nfs4_session_state {
        NFS4_SESSION_DRAINING,
 };
+#define NFS4_RENEW_TIMEOUT              0x01
+#define NFS4_RENEW_DELEGATION_CB        0x02
 struct nfs4_minor_version_ops {
        u32     minor_version;
@@ -225,7 +228,7 @@ struct nfs4_state_recovery_ops {
 };
 struct nfs4_state_maintenance_ops {
-        int (*sched_state_renewal)(struct nfs_client *, struct rpc_cred *);
+        int (*sched_state_renewal)(struct nfs_client *, struct rpc_cred *, unsigned);
        struct rpc_cred * (*get_state_renewal_cred_locked)(struct nfs_client *);
        int (*renew_lease)(struct nfs_client *, struct rpc_cred *);
 };
@@ -237,8 +240,6 @@ extern const struct inode_operations nfs4_dir_inode_operations;
 extern int nfs4_proc_setclientid(struct nfs_client *, u32, unsigned short, struct rpc_cred *, struct nfs4_setclientid_res *);
 extern int nfs4_proc_setclientid_confirm(struct nfs_client *, struct nfs4_setclientid_res *arg, struct rpc_cred *);
 extern int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred);
-extern int nfs4_proc_async_renew(struct nfs_client *, struct rpc_cred *);
-extern int nfs4_proc_renew(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs41_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_do_close(struct nfs4_state *state, gfp_t gfp_mask, int wait, bool roc);
@@ -349,6 +350,7 @@ extern void nfs4_close_sync(struct nfs4_state *, fmode_t);
 extern void nfs4_state_set_mode_locked(struct nfs4_state *, fmode_t);
 extern void nfs4_schedule_lease_recovery(struct nfs_client *);
 extern void nfs4_schedule_state_manager(struct nfs_client *);
+extern void nfs4_schedule_path_down_recovery(struct nfs_client *clp);
 extern void nfs4_schedule_stateid_recovery(const struct nfs_server *, struct nfs4_state *);
 extern void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags);
 extern void nfs41_handle_recall_slot(struct nfs_client *clp);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 8c77039e7a81..4700fae1ada0 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3374,9 +3374,13 @@ static void nfs4_renew_done(struct rpc_task *task, void *calldata)
        if (task->tk_status < 0) {
                /* Unless we're shutting down, schedule state recovery! */
-                if (test_bit(NFS_CS_RENEWD, &clp->cl_res_state) != 0)
+                if (test_bit(NFS_CS_RENEWD, &clp->cl_res_state) == 0)
+                        return;
+                if (task->tk_status != NFS4ERR_CB_PATH_DOWN) {
                        nfs4_schedule_lease_recovery(clp);
-                return;
+                        return;
+                }
+                nfs4_schedule_path_down_recovery(clp);
        }
        do_renew_lease(clp, timestamp);
 }
@@ -3386,7 +3390,7 @@ static const struct rpc_call_ops nfs4_renew_ops = {
        .rpc_release = nfs4_renew_release,
 };
-int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
+static int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred, unsigned renew_flags)
 {
        struct rpc_message msg = {
                .rpc_proc       = &nfs4_procedures[NFSPROC4_CLNT_RENEW],
@@ -3395,9 +3399,11 @@ int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
        };
        struct nfs4_renewdata *data;
+        if (renew_flags == 0)
+                return 0;
        if (!atomic_inc_not_zero(&clp->cl_count))
                return -EIO;
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
+        data = kmalloc(sizeof(*data), GFP_NOFS);
        if (data == NULL)
                return -ENOMEM;
        data->client = clp;
@@ -3406,7 +3412,7 @@ int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
                        &nfs4_renew_ops, data);
 }
-int nfs4_proc_renew(struct nfs_client *clp, struct rpc_cred *cred)
+static int nfs4_proc_renew(struct nfs_client *clp, struct rpc_cred *cred)
 {
        struct rpc_message msg = {
                .rpc_proc       = &nfs4_procedures[NFSPROC4_CLNT_RENEW],
@@ -5504,11 +5510,13 @@ static struct rpc_task *_nfs41_proc_sequence(struct nfs_client *clp, struct rpc_
        return rpc_run_task(&task_setup_data);
 }
-static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cred)
+static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cred, unsigned renew_flags)
 {
        struct rpc_task *task;
        int ret = 0;
+        if ((renew_flags & NFS4_RENEW_TIMEOUT) == 0)
+                return 0;
        task = _nfs41_proc_sequence(clp, cred);
        if (IS_ERR(task))
                ret = PTR_ERR(task);
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index df8e7f3ca56d..dc484c0eae7f 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -60,6 +60,7 @@ nfs4_renew_state(struct work_struct *work)
        struct rpc_cred *cred;
        long lease;
        unsigned long last, now;
+        unsigned renew_flags = 0;
        ops = clp->cl_mvops->state_renewal_ops;
        dprintk("%s: start\n", __func__);
@@ -72,18 +73,23 @@ nfs4_renew_state(struct work_struct *work)
        last = clp->cl_last_renewal;
        now = jiffies;
        /* Are we close to a lease timeout? */
-        if (time_after(now, last + lease/3)) {
+        if (time_after(now, last + lease/3))
+                renew_flags |= NFS4_RENEW_TIMEOUT;
+        if (nfs_delegations_present(clp))
+                renew_flags |= NFS4_RENEW_DELEGATION_CB;
+        if (renew_flags != 0) {
                cred = ops->get_state_renewal_cred_locked(clp);
                spin_unlock(&clp->cl_lock);
                if (cred == NULL) {
-                        if (!nfs_delegations_present(clp)) {
+                        if (!(renew_flags & NFS4_RENEW_DELEGATION_CB)) {
                                set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
                                goto out;
                        }
                        nfs_expire_all_delegations(clp);
                } else {
                        /* Queue an asynchronous RENEW. */
-                        ops->sched_state_renewal(clp, cred);
+                        ops->sched_state_renewal(clp, cred, renew_flags);
                        put_rpccred(cred);
                        goto out_exp;
                }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 72ab97ef3d61..39914be40b03 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1038,6 +1038,12 @@ void nfs4_schedule_lease_recovery(struct nfs_client *clp)
        nfs4_schedule_state_manager(clp);
 }
+void nfs4_schedule_path_down_recovery(struct nfs_client *clp)
+{
+        nfs_handle_cb_pathdown(clp);
+        nfs4_schedule_state_manager(clp);
+}
 static int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
 {
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index b961ceac66b4..9b7dd7013b15 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2035,9 +2035,6 @@ static inline void nfs_initialise_sb(struct super_block *sb)
                sb->s_blocksize = nfs_block_bits(server->wsize,
                                                 &sb->s_blocksize_bits);
-        if (server->flags & NFS_MOUNT_NOAC)
-                sb->s_flags |= MS_SYNCHRONOUS;
        sb->s_bdi = &server->backing_dev_info;
        nfs_super_set_maxbytes(sb, server->maxfilesize);
@@ -2249,6 +2246,10 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
        if (server->flags & NFS_MOUNT_UNSHARED)
                compare_super = NULL;
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
        /* Get a superblock - note that we may end up sharing one that already exists */
        s = sget(fs_type, compare_super, nfs_set_super, &sb_mntdata);
        if (IS_ERR(s)) {
@@ -2361,6 +2362,10 @@ nfs_xdev_mount(struct file_system_type *fs_type, int flags,
        if (server->flags & NFS_MOUNT_UNSHARED)
                compare_super = NULL;
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
        /* Get a superblock - note that we may end up sharing one that already exists */
        s = sget(&nfs_fs_type, compare_super, nfs_set_super, &sb_mntdata);
        if (IS_ERR(s)) {
@@ -2628,6 +2633,10 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
        if (server->flags & NFS4_MOUNT_UNSHARED)
                compare_super = NULL;
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
        /* Get a superblock - note that we may end up sharing one that already exists */
        s = sget(&nfs4_fs_type, compare_super, nfs_set_super, &sb_mntdata);
        if (IS_ERR(s)) {
@@ -2916,6 +2925,10 @@ nfs4_xdev_mount(struct file_system_type *fs_type, int flags,
        if (server->flags & NFS4_MOUNT_UNSHARED)
                compare_super = NULL;
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
        /* Get a superblock - note that we may end up sharing one that already exists */
        s = sget(&nfs4_fs_type, compare_super, nfs_set_super, &sb_mntdata);
        if (IS_ERR(s)) {
@@ -3003,6 +3016,10 @@ nfs4_remote_referral_mount(struct file_system_type *fs_type, int flags,
        if (server->flags & NFS4_MOUNT_UNSHARED)
                compare_super = NULL;
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
        /* Get a superblock - note that we may end up sharing one that already exists */
        s = sget(&nfs4_fs_type, compare_super, nfs_set_super, &sb_mntdata);
        if (IS_ERR(s)) {
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index b39b37f80913..c9bd2a6b7d4b 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -958,7 +958,7 @@ static int nfs_flush_multi(struct nfs_pageio_descriptor *desc, struct list_head
                if (!data)
                        goto out_bad;
                data->pagevec[0] = page;
-                nfs_write_rpcsetup(req, data, wsize, offset, desc->pg_ioflags);
+                nfs_write_rpcsetup(req, data, len, offset, desc->pg_ioflags);
                list_add(&data->list, res);
                requests++;
                nbytes -= len;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 25b6a887adb9..5afaa58a8630 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -877,30 +877,54 @@ struct numa_maps_private {
        struct numa_maps md;
 };
-static void gather_stats(struct page *page, struct numa_maps *md, int pte_dirty)
+static void gather_stats(struct page *page, struct numa_maps *md, int pte_dirty,
+                        unsigned long nr_pages)
 {
        int count = page_mapcount(page);
-        md->pages++;
+        md->pages += nr_pages;
        if (pte_dirty || PageDirty(page))
-                md->dirty++;
+                md->dirty += nr_pages;
        if (PageSwapCache(page))
-                md->swapcache++;
+                md->swapcache += nr_pages;
        if (PageActive(page) || PageUnevictable(page))
-                md->active++;
+                md->active += nr_pages;
        if (PageWriteback(page))
-                md->writeback++;
+                md->writeback += nr_pages;
        if (PageAnon(page))
-                md->anon++;
+                md->anon += nr_pages;
        if (count > md->mapcount_max)
                md->mapcount_max = count;
-        md->node[page_to_nid(page)]++;
+        md->node[page_to_nid(page)] += nr_pages;
+}
+static struct page *can_gather_numa_stats(pte_t pte, struct vm_area_struct *vma,
+                unsigned long addr)
+{
+        struct page *page;
+        int nid;
+        if (!pte_present(pte))
+                return NULL;
+        page = vm_normal_page(vma, addr, pte);
+        if (!page)
+                return NULL;
+        if (PageReserved(page))
+                return NULL;
+        nid = page_to_nid(page);
+        if (!node_isset(nid, node_states[N_HIGH_MEMORY]))
+                return NULL;
+        return page;
 }
 static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
@@ -912,26 +936,32 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
        pte_t *pte;
        md = walk->private;
-        orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+        spin_lock(&walk->mm->page_table_lock);
-        do {
+        if (pmd_trans_huge(*pmd)) {
-                struct page *page;
+                if (pmd_trans_splitting(*pmd)) {
-                int nid;
+                        spin_unlock(&walk->mm->page_table_lock);
+                        wait_split_huge_page(md->vma->anon_vma, pmd);
+                } else {
+                        pte_t huge_pte = *(pte_t *)pmd;
+                        struct page *page;
-                if (!pte_present(*pte))
+                        page = can_gather_numa_stats(huge_pte, md->vma, addr);
-                        continue;
+                        if (page)
+                                gather_stats(page, md, pte_dirty(huge_pte),
+                                                HPAGE_PMD_SIZE/PAGE_SIZE);
+                        spin_unlock(&walk->mm->page_table_lock);
+                        return 0;
+                }
+        } else {
+                spin_unlock(&walk->mm->page_table_lock);
+        }
-                page = vm_normal_page(md->vma, addr, *pte);
+        orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+        do {
+                struct page *page = can_gather_numa_stats(*pte, md->vma, addr);
                if (!page)
                        continue;
+                gather_stats(page, md, pte_dirty(*pte), 1);
-                if (PageReserved(page))
-                        continue;
-                nid = page_to_nid(page);
-                if (!node_isset(nid, node_states[N_HIGH_MEMORY]))
-                        continue;
-                gather_stats(page, md, pte_dirty(*pte));
        } while (pte++, addr += PAGE_SIZE, addr != end);
        pte_unmap_unlock(orig_pte, ptl);
@@ -952,7 +982,7 @@ static int gather_hugetbl_stats(pte_t *pte, unsigned long hmask,
                return 0;
        md = walk->private;
-        gather_stats(page, md, pte_dirty(*pte));
+        gather_stats(page, md, pte_dirty(*pte), 1);
        return 0;
 }
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 45174b534377..feb361e252ac 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -335,9 +335,9 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c);
 #define DBGKEY(key)  ((char *)(key))
 #define DBGKEY1(key) ((char *)(key))
-#define ubifs_dbg_msg(fmt, ...) do {               \
+#define ubifs_dbg_msg(fmt, ...) do {                        \
-        if (0)                                     \
+        if (0)                                              \
-                pr_debug(fmt "\n", ##__VA_ARGS__); \
+                printk(KERN_DEBUG fmt "\n", ##__VA_ARGS__); \
 } while (0)
 #define dbg_dump_stack()
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 63e971e2b837..8c37dde4c521 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1300,6 +1300,7 @@ xfs_end_io_direct_write(
        bool                    is_async)
 {
        struct xfs_ioend        *ioend = iocb->private;
+        struct inode            *inode = ioend->io_inode;
        /*
         * blockdev_direct_IO can return an error even after the I/O
@@ -1331,7 +1332,7 @@ xfs_end_io_direct_write(
        }
        /* XXX: probably should move into the real I/O completion handler */
-        inode_dio_done(ioend->io_inode);
+        inode_dio_done(inode);
 }
 STATIC ssize_t
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index b9c172b3fbbe..673704fab748 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -70,9 +70,8 @@ xfs_synchronize_times(
 }
 /*
- * If the linux inode is valid, mark it dirty.
+ * If the linux inode is valid, mark it dirty, else mark the dirty state
- * Used when committing a dirty inode into a transaction so that
+ * in the XFS inode to make sure we pick it up when reclaiming the inode.
- * the inode will get written back by the linux code
 */
 void
 xfs_mark_inode_dirty_sync(
@@ -82,6 +81,10 @@ xfs_mark_inode_dirty_sync(
        if (!(inode->i_state & (I_WILL_FREE|I_FREEING)))
                mark_inode_dirty_sync(inode);
+        else {
+                barrier();
+                ip->i_update_core = 1;
+        }
 }
 void
@@ -92,6 +95,11 @@ xfs_mark_inode_dirty(
        if (!(inode->i_state & (I_WILL_FREE|I_FREEING)))
                mark_inode_dirty(inode);
+        else {
+                barrier();
+                ip->i_update_core = 1;
+        }
 }
 /*
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 9a72dda58bd0..2366c54cc4fa 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -356,6 +356,8 @@ xfs_parseargs(
                        mp->m_flags |= XFS_MOUNT_DELAYLOG;
                } else if (!strcmp(this_char, MNTOPT_NODELAYLOG)) {
                        mp->m_flags &= ~XFS_MOUNT_DELAYLOG;
+                        xfs_warn(mp,
+        "nodelaylog is deprecated and will be removed in Linux 3.3");
                } else if (!strcmp(this_char, MNTOPT_DISCARD)) {
                        mp->m_flags |= XFS_MOUNT_DISCARD;
                } else if (!strcmp(this_char, MNTOPT_NODISCARD)) {
@@ -877,33 +879,17 @@ xfs_log_inode(
        struct xfs_trans        *tp;
        int                     error;
-        xfs_iunlock(ip, XFS_ILOCK_SHARED);
        tp = xfs_trans_alloc(mp, XFS_TRANS_FSYNC_TS);
        error = xfs_trans_reserve(tp, 0, XFS_FSYNC_TS_LOG_RES(mp), 0, 0, 0);
        if (error) {
                xfs_trans_cancel(tp, 0);
-                /* we need to return with the lock hold shared */
-                xfs_ilock(ip, XFS_ILOCK_SHARED);
                return error;
        }
        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        xfs_trans_ijoin_ref(tp, ip, XFS_ILOCK_EXCL);
-        /*
-         * Note - it's possible that we might have pushed ourselves out of the
-         * way during trans_reserve which would flush the inode.  But there's
-         * no guarantee that the inode buffer has actually gone out yet (it's
-         * delwri).  Plus the buffer could be pinned anyway if it's part of
-         * an inode in another recent transaction.  So we play it safe and
-         * fire off the transaction anyway.
-         */
-        xfs_trans_ijoin(tp, ip);
        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-        error = xfs_trans_commit(tp, 0);
+        return xfs_trans_commit(tp, 0);
-        xfs_ilock_demote(ip, XFS_ILOCK_EXCL);
-        return error;
 }
 STATIC int
@@ -918,7 +904,9 @@ xfs_fs_write_inode(
        trace_xfs_write_inode(ip);
        if (XFS_FORCED_SHUTDOWN(mp))
-                return XFS_ERROR(EIO);
+                return -XFS_ERROR(EIO);
+        if (!ip->i_update_core)
+                return 0;
        if (wbc->sync_mode == WB_SYNC_ALL) {
                /*
@@ -929,12 +917,10 @@ xfs_fs_write_inode(
                 * of synchronous log foces dramatically.
                 */
                xfs_ioend_wait(ip);
-                xfs_ilock(ip, XFS_ILOCK_SHARED);
+                error = xfs_log_inode(ip);
-                if (ip->i_update_core) {
+                if (error)
-                        error = xfs_log_inode(ip);
+                        goto out;
-                        if (error)
+                return 0;
-                                goto out_unlock;
-                }
        } else {
                /*
                 * We make this non-blocking if the inode is contended, return
diff --git a/include/asm-generic/unistd.h b/include/asm-generic/unistd.h
index 4f76959397fa..f4c38d8c6674 100644
--- a/include/asm-generic/unistd.h
+++ b/include/asm-generic/unistd.h
@@ -143,7 +143,7 @@ __SYSCALL(__NR_pivot_root, sys_pivot_root)
 /* fs/nfsctl.c */
 #define __NR_nfsservctl 42
-__SC_COMP(__NR_nfsservctl, sys_nfsservctl, compat_sys_nfsservctl)
+__SYSCALL(__NR_nfsservctl, sys_ni_syscall)
 /* fs/open.c */
 #define __NR3264_statfs 43
diff --git a/include/linux/basic_mmio_gpio.h b/include/linux/basic_mmio_gpio.h
index 98999cf107ce..feb912196745 100644
--- a/include/linux/basic_mmio_gpio.h
+++ b/include/linux/basic_mmio_gpio.h
@@ -63,15 +63,10 @@ static inline struct bgpio_chip *to_bgpio_chip(struct gpio_chip *gc)
        return container_of(gc, struct bgpio_chip, gc);
 }
-int __devexit bgpio_remove(struct bgpio_chip *bgc);
+int bgpio_remove(struct bgpio_chip *bgc);
-int __devinit bgpio_init(struct bgpio_chip *bgc,
+int bgpio_init(struct bgpio_chip *bgc, struct device *dev,
-                         struct device *dev,
+               unsigned long sz, void __iomem *dat, void __iomem *set,
-                         unsigned long sz,
+               void __iomem *clr, void __iomem *dirout, void __iomem *dirin,
-                         void __iomem *dat,
+               bool big_endian);
-                         void __iomem *set,
-                         void __iomem *clr,
-                         void __iomem *dirout,
-                         void __iomem *dirin,
-                         bool big_endian);
 #endif /* __BASIC_MMIO_GPIO_H */
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 32f0076e844b..71fc53bb8f1c 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -124,6 +124,7 @@ enum rq_flag_bits {
        __REQ_SYNC,             /* request is sync (sync write or read) */
        __REQ_META,             /* metadata io request */
+        __REQ_PRIO,             /* boost priority in cfq */
        __REQ_DISCARD,          /* request to discard sectors */
        __REQ_SECURE,           /* secure discard (used with __REQ_DISCARD) */
@@ -161,14 +162,15 @@ enum rq_flag_bits {
 #define REQ_FAILFAST_DRIVER     (1 << __REQ_FAILFAST_DRIVER)
 #define REQ_SYNC                (1 << __REQ_SYNC)
 #define REQ_META                (1 << __REQ_META)
+#define REQ_PRIO                (1 << __REQ_PRIO)
 #define REQ_DISCARD             (1 << __REQ_DISCARD)
 #define REQ_NOIDLE              (1 << __REQ_NOIDLE)
 #define REQ_FAILFAST_MASK \
        (REQ_FAILFAST_DEV | REQ_FAILFAST_TRANSPORT | REQ_FAILFAST_DRIVER)
 #define REQ_COMMON_MASK \
-        (REQ_WRITE | REQ_FAILFAST_MASK | REQ_SYNC | REQ_META | REQ_DISCARD | \
+        (REQ_WRITE | REQ_FAILFAST_MASK | REQ_SYNC | REQ_META | REQ_PRIO | \
-         REQ_NOIDLE | REQ_FLUSH | REQ_FUA | REQ_SECURE)
+         REQ_DISCARD | REQ_NOIDLE | REQ_FLUSH | REQ_FUA | REQ_SECURE)
 #define REQ_CLONE_MASK          REQ_COMMON_MASK
 #define REQ_RAHEAD              (1 << __REQ_RAHEAD)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 84b15d54f8c2..7fbaa9103344 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -873,7 +873,6 @@ struct blk_plug {
        struct list_head list;
        struct list_head cb_list;
        unsigned int should_sort;
-        unsigned int count;
 };
 #define BLK_MAX_REQUEST_COUNT 16
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 8779405e15a8..c6e7523bf765 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -438,7 +438,6 @@ asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
                                 struct compat_timespec __user *tsp,
                                 const compat_sigset_t __user *sigmask,
                                 compat_size_t sigsetsize);
-asmlinkage long compat_sys_nfsservctl(int cmd, void *notused, void *notused2);
 asmlinkage long compat_sys_signalfd4(int ufd,
                                     const compat_sigset_t __user *sigmask,
                                     compat_size_t sigsetsize, int flags);
diff --git a/include/linux/connector.h b/include/linux/connector.h
index 0c69ad825b39..3c9c54fd5690 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -1,7 +1,7 @@
 /*
 *      connector.h
 * 
- * 2004-2005 Copyright (c) Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * 2004-2005 Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
 * All rights reserved.
 * 
 * This program is free software; you can redistribute it and/or modify
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 178cdb4f1d4a..277f497923a2 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -162,10 +162,8 @@ struct inodes_stat_t {
 #define READA                   RWA_MASK
 #define READ_SYNC               (READ | REQ_SYNC)
-#define READ_META               (READ | REQ_META)
 #define WRITE_SYNC              (WRITE | REQ_SYNC | REQ_NOIDLE)
 #define WRITE_ODIRECT           (WRITE | REQ_SYNC)
-#define WRITE_META              (WRITE | REQ_META)
 #define WRITE_FLUSH             (WRITE | REQ_SYNC | REQ_NOIDLE | REQ_FLUSH)
 #define WRITE_FUA               (WRITE | REQ_SYNC | REQ_NOIDLE | REQ_FUA)
 #define WRITE_FLUSH_FUA         (WRITE | REQ_SYNC | REQ_NOIDLE | REQ_FLUSH | REQ_FUA)
@@ -2318,6 +2316,11 @@ extern struct inode * iget5_locked(struct super_block *, unsigned long, int (*te
 extern struct inode * iget_locked(struct super_block *, unsigned long);
 extern int insert_inode_locked4(struct inode *, unsigned long, int (*test)(struct inode *, void *), void *);
 extern int insert_inode_locked(struct inode *);
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+extern void lockdep_annotate_inode_mutex_key(struct inode *inode);
+#else
+static inline void lockdep_annotate_inode_mutex_key(struct inode *inode) { };
+#endif
 extern void unlock_new_inode(struct inode *);
 extern unsigned int get_next_ino(void);
diff --git a/include/linux/kvm.h b/include/linux/kvm.h
index 2c366b52f505..aace6b8691a2 100644
--- a/include/linux/kvm.h
+++ b/include/linux/kvm.h
@@ -553,6 +553,7 @@ struct kvm_ppc_pvinfo {
 #define KVM_CAP_SPAPR_TCE 63
 #define KVM_CAP_PPC_SMT 64
 #define KVM_CAP_PPC_RMA 65
+#define KVM_CAP_S390_GMAP 71
 #ifdef KVM_CAP_IRQ_ROUTING
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 3b535db00a94..343bd7661f2a 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -39,16 +39,6 @@ extern unsigned long mem_cgroup_isolate_pages(unsigned long nr_to_scan,
                                        struct mem_cgroup *mem_cont,
                                        int active, int file);
-struct memcg_scanrecord {
-        struct mem_cgroup *mem; /* scanend memory cgroup */
-        struct mem_cgroup *root; /* scan target hierarchy root */
-        int context;            /* scanning context (see memcontrol.c) */
-        unsigned long nr_scanned[2]; /* the number of scanned pages */
-        unsigned long nr_rotated[2]; /* the number of rotated pages */
-        unsigned long nr_freed[2]; /* the number of freed pages */
-        unsigned long elapsed; /* nsec of time elapsed while scanning */
-};
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR
 /*
 * All "charge" functions with gfp_mask should use GFP_KERNEL or
@@ -127,15 +117,6 @@ mem_cgroup_get_reclaim_stat_from_page(struct page *page);
 extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
                                        struct task_struct *p);
-extern unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem,
-                                                  gfp_t gfp_mask, bool noswap,
-                                                  struct memcg_scanrecord *rec);
-extern unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
-                                                gfp_t gfp_mask, bool noswap,
-                                                struct zone *zone,
-                                                struct memcg_scanrecord *rec,
-                                                unsigned long *nr_scanned);
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
 extern int do_swap_account;
 #endif
diff --git a/include/linux/mfd/wm8994/pdata.h b/include/linux/mfd/wm8994/pdata.h
index d12f8d635a81..97cf4f27d647 100644
--- a/include/linux/mfd/wm8994/pdata.h
+++ b/include/linux/mfd/wm8994/pdata.h
@@ -26,7 +26,7 @@ struct wm8994_ldo_pdata {
        struct regulator_init_data *init_data;
 };
-#define WM8994_CONFIGURE_GPIO 0x8000
+#define WM8994_CONFIGURE_GPIO 0x10000
 #define WM8994_DRC_REGS 5
 #define WM8994_EQ_REGS  20
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 245bafdafd5e..c816075c01ce 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -944,8 +944,10 @@ extern void perf_pmu_unregister(struct pmu *pmu);
 extern int perf_num_counters(void);
 extern const char *perf_pmu_name(void);
-extern void __perf_event_task_sched_in(struct task_struct *task);
+extern void __perf_event_task_sched_in(struct task_struct *prev,
-extern void __perf_event_task_sched_out(struct task_struct *task, struct task_struct *next);
+                                       struct task_struct *task);
+extern void __perf_event_task_sched_out(struct task_struct *prev,
+                                        struct task_struct *next);
 extern int perf_event_init_task(struct task_struct *child);
 extern void perf_event_exit_task(struct task_struct *child);
 extern void perf_event_free_task(struct task_struct *task);
@@ -1059,17 +1061,20 @@ perf_sw_event(u32 event_id, u64 nr, struct pt_regs *regs, u64 addr)
 extern struct jump_label_key perf_sched_events;
-static inline void perf_event_task_sched_in(struct task_struct *task)
+static inline void perf_event_task_sched_in(struct task_struct *prev,
+                                            struct task_struct *task)
 {
        if (static_branch(&perf_sched_events))
-                __perf_event_task_sched_in(task);
+                __perf_event_task_sched_in(prev, task);
 }
-static inline void perf_event_task_sched_out(struct task_struct *task, struct task_struct *next)
+static inline void perf_event_task_sched_out(struct task_struct *prev,
+                                             struct task_struct *next)
 {
        perf_sw_event(PERF_COUNT_SW_CONTEXT_SWITCHES, 1, NULL, 0);
-        __perf_event_task_sched_out(task, next);
+        if (static_branch(&perf_sched_events))
+                __perf_event_task_sched_out(prev, next);
 }
 extern void perf_event_mmap(struct vm_area_struct *vma);
@@ -1139,10 +1144,11 @@ extern void perf_event_disable(struct perf_event *event);
 extern void perf_event_task_tick(void);
 #else
 static inline void
-perf_event_task_sched_in(struct task_struct *task)                      { }
+perf_event_task_sched_in(struct task_struct *prev,
+                         struct task_struct *task)                      { }
 static inline void
-perf_event_task_sched_out(struct task_struct *task,
+perf_event_task_sched_out(struct task_struct *prev,
-                            struct task_struct *next)                   { }
+                          struct task_struct *next)                     { }
 static inline int perf_event_init_task(struct task_struct *child)       { return 0; }
 static inline void perf_event_exit_task(struct task_struct *child)      { }
 static inline void perf_event_free_task(struct task_struct *task)       { }
diff --git a/include/linux/personality.h b/include/linux/personality.h
index eec3bae164d4..8fc7dd1a57ff 100644
--- a/include/linux/personality.h
+++ b/include/linux/personality.h
@@ -22,6 +22,7 @@ extern int		__set_personality(unsigned int);
 * These occupy the top three bytes.
 */
 enum {
+        UNAME26 =               0x0020000,
        ADDR_NO_RANDOMIZE =     0x0040000,      /* disable randomization of VA space */
        FDPIC_FUNCPTRS =        0x0080000,      /* userspace function ptrs point to descriptors
                                                 * (signal handling)
diff --git a/include/linux/pwm_backlight.h b/include/linux/pwm_backlight.h
index 5e3e25a3c9c3..63d2df43e61a 100644
--- a/include/linux/pwm_backlight.h
+++ b/include/linux/pwm_backlight.h
@@ -14,6 +14,7 @@ struct platform_pwm_backlight_data {
        unsigned int pwm_period_ns;
        int (*init)(struct device *dev);
        int (*notify)(struct device *dev, int brightness);
+        void (*notify_after)(struct device *dev, int brightness);
        void (*exit)(struct device *dev);
        int (*check_fb)(struct device *dev, struct fb_info *info);
 };
diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h
index 26f6ea4444e3..b47771aa5718 100644
--- a/include/linux/regulator/consumer.h
+++ b/include/linux/regulator/consumer.h
@@ -123,7 +123,7 @@ struct regulator_bulk_data {
        const char *supply;
        struct regulator *consumer;
-        /* Internal use */
+        /* private: Internal use */
        int ret;
 };
diff --git a/include/linux/rio_regs.h b/include/linux/rio_regs.h
index 9026b30238f3..218168a2b5e9 100644
--- a/include/linux/rio_regs.h
+++ b/include/linux/rio_regs.h
@@ -36,12 +36,12 @@
 #define  RIO_PEF_PROCESSOR              0x20000000      /* [I] Processor */
 #define  RIO_PEF_SWITCH                 0x10000000      /* [I] Switch */
 #define  RIO_PEF_MULTIPORT              0x08000000      /* [VI, 2.1] Multiport */
-#define  RIO_PEF_INB_MBOX               0x00f00000      /* [II] Mailboxes */
+#define  RIO_PEF_INB_MBOX               0x00f00000      /* [II, <= 1.2] Mailboxes */
-#define  RIO_PEF_INB_MBOX0              0x00800000      /* [II] Mailbox 0 */
+#define  RIO_PEF_INB_MBOX0              0x00800000      /* [II, <= 1.2] Mailbox 0 */
-#define  RIO_PEF_INB_MBOX1              0x00400000      /* [II] Mailbox 1 */
+#define  RIO_PEF_INB_MBOX1              0x00400000      /* [II, <= 1.2] Mailbox 1 */
-#define  RIO_PEF_INB_MBOX2              0x00200000      /* [II] Mailbox 2 */
+#define  RIO_PEF_INB_MBOX2              0x00200000      /* [II, <= 1.2] Mailbox 2 */
-#define  RIO_PEF_INB_MBOX3              0x00100000      /* [II] Mailbox 3 */
+#define  RIO_PEF_INB_MBOX3              0x00100000      /* [II, <= 1.2] Mailbox 3 */
-#define  RIO_PEF_INB_DOORBELL           0x00080000      /* [II] Doorbells */
+#define  RIO_PEF_INB_DOORBELL           0x00080000      /* [II, <= 1.2] Doorbells */
 #define  RIO_PEF_EXT_RT                 0x00000200      /* [III, 1.3] Extended route table support */
 #define  RIO_PEF_STD_RT                 0x00000100      /* [III, 1.3] Standard route table support */
 #define  RIO_PEF_CTLS                   0x00000010      /* [III] CTLS */
@@ -102,7 +102,7 @@
 #define RIO_SWITCH_RT_LIMIT     0x34    /* [III, 1.3] Switch Route Table Destination ID Limit CAR */
 #define  RIO_RT_MAX_DESTID              0x0000ffff
-#define RIO_MBOX_CSR            0x40    /* [II] Mailbox CSR */
+#define RIO_MBOX_CSR            0x40    /* [II, <= 1.2] Mailbox CSR */
 #define  RIO_MBOX0_AVAIL                0x80000000      /* [II] Mbox 0 avail */
 #define  RIO_MBOX0_FULL                 0x40000000      /* [II] Mbox 0 full */
 #define  RIO_MBOX0_EMPTY                0x20000000      /* [II] Mbox 0 empty */
@@ -128,8 +128,8 @@
 #define  RIO_MBOX3_FAIL                 0x00000008      /* [II] Mbox 3 fail */
 #define  RIO_MBOX3_ERROR                0x00000004      /* [II] Mbox 3 error */
-#define RIO_WRITE_PORT_CSR      0x44    /* [I] Write Port CSR */
+#define RIO_WRITE_PORT_CSR      0x44    /* [I, <= 1.2] Write Port CSR */
-#define RIO_DOORBELL_CSR        0x44    /* [II] Doorbell CSR */
+#define RIO_DOORBELL_CSR        0x44    /* [II, <= 1.2] Doorbell CSR */
 #define  RIO_DOORBELL_AVAIL             0x80000000      /* [II] Doorbell avail */
 #define  RIO_DOORBELL_FULL              0x40000000      /* [II] Doorbell full */
 #define  RIO_DOORBELL_EMPTY             0x20000000      /* [II] Doorbell empty */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 7b996ed86d5b..8bd383caa363 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -524,6 +524,7 @@ static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
 extern bool skb_recycle_check(struct sk_buff *skb, int skb_size);
 extern struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src);
+extern int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask);
 extern struct sk_buff *skb_clone(struct sk_buff *skb,
                                 gfp_t priority);
 extern struct sk_buff *skb_copy(const struct sk_buff *skb,
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 12b2b18e50c1..e16557a357e5 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -231,6 +231,8 @@ enum
        LINUX_MIB_TCPDEFERACCEPTDROP,
        LINUX_MIB_IPRPFILTER, /* IP Reverse Path Filter (rp_filter) */
        LINUX_MIB_TCPTIMEWAITOVERFLOW,          /* TCPTimeWaitOverflow */
+        LINUX_MIB_TCPREQQFULLDOCOOKIES,         /* TCPReqQFullDoCookies */
+        LINUX_MIB_TCPREQQFULLDROP,              /* TCPReqQFullDrop */
        __LINUX_MIB_MAX
 };
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 14d62490922e..c71f84bb62ec 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -252,6 +252,12 @@ static inline void lru_cache_add_file(struct page *page)
 extern unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
                                        gfp_t gfp_mask, nodemask_t *mask);
 extern int __isolate_lru_page(struct page *page, int mode, int file);
+extern unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem,
+                                                  gfp_t gfp_mask, bool noswap);
+extern unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
+                                                gfp_t gfp_mask, bool noswap,
+                                                struct zone *zone,
+                                                unsigned long *nr_scanned);
 extern unsigned long shrink_all_memory(unsigned long nr_pages);
 extern int vm_swappiness;
 extern int remove_mapping(struct address_space *mapping, struct page *page);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 8c03b98df5f9..1ff0ec2a5e8d 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -702,9 +702,6 @@ asmlinkage long sys_sysctl(struct __sysctl_args __user *args);
 asmlinkage long sys_sysinfo(struct sysinfo __user *info);
 asmlinkage long sys_sysfs(int option,
                                unsigned long arg1, unsigned long arg2);
-asmlinkage long sys_nfsservctl(int cmd,
-                                struct nfsctl_arg __user *arg,
-                                void __user *res);
 asmlinkage long sys_syslog(int type, char __user *buf, int len);
 asmlinkage long sys_uselib(const char __user *library);
 asmlinkage long sys_ni_syscall(void);
diff --git a/include/linux/ti_wilink_st.h b/include/linux/ti_wilink_st.h
index b004e557caa9..2ef4385da6bf 100644
--- a/include/linux/ti_wilink_st.h
+++ b/include/linux/ti_wilink_st.h
@@ -410,7 +410,28 @@ struct gps_event_hdr {
        u16 plen;
 } __attribute__ ((packed));
-/* platform data */
+/**
+ * struct ti_st_plat_data - platform data shared between ST driver and
+ *      platform specific board file which adds the ST device.
+ * @nshutdown_gpio: Host's GPIO line to which chip's BT_EN is connected.
+ * @dev_name: The UART/TTY name to which chip is interfaced. (eg: /dev/ttyS1)
+ * @flow_cntrl: Should always be 1, since UART's CTS/RTS is used for PM
+ *      purposes.
+ * @baud_rate: The baud rate supported by the Host UART controller, this will
+ *      be shared across with the chip via a HCI VS command from User-Space Init
+ *      Mgr application.
+ * @suspend:
+ * @resume: legacy PM routines hooked to platform specific board file, so as
+ *      to take chip-host interface specific action.
+ * @chip_enable:
+ * @chip_disable: Platform/Interface specific mux mode setting, GPIO
+ *      configuring, Host side PM disabling etc.. can be done here.
+ * @chip_asleep:
+ * @chip_awake: Chip specific deep sleep states is communicated to Host
+ *      specific board-xx.c to take actions such as cut UART clocks when chip
+ *      asleep or run host faster when chip awake etc..
+ *
+ */
 struct ti_st_plat_data {
        long nshutdown_gpio;
        unsigned char dev_name[UART_DEV_NAME_LEN]; /* uart name */
@@ -418,6 +439,10 @@ struct ti_st_plat_data {
        unsigned long baud_rate;
        int (*suspend)(struct platform_device *, pm_message_t);
        int (*resume)(struct platform_device *);
+        int (*chip_enable) (struct kim_data_s *);
+        int (*chip_disable) (struct kim_data_s *);
+        int (*chip_asleep) (struct kim_data_s *);
+        int (*chip_awake) (struct kim_data_s *);
 };
 #endif /* TI_WILINK_ST_H */
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 44bc0c5617e1..5f2ede82b3d6 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -421,6 +421,8 @@ extern void tty_driver_flush_buffer(struct tty_struct *tty);
 extern void tty_throttle(struct tty_struct *tty);
 extern void tty_unthrottle(struct tty_struct *tty);
 extern int tty_do_resize(struct tty_struct *tty, struct winsize *ws);
+extern void tty_driver_remove_tty(struct tty_driver *driver,
+                                  struct tty_struct *tty);
 extern void tty_shutdown(struct tty_struct *tty);
 extern void tty_free_termios(struct tty_struct *tty);
 extern int is_current_pgrp_orphaned(void);
diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index 9deeac855240..ecdaeb98b293 100644
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -47,6 +47,9 @@
 *
 *      This routine is called synchronously when a particular tty device
 *      is closed for the last time freeing up the resources.
+ *      Note that tty_shutdown() is not called if ops->shutdown is defined.
+ *      This means one is responsible to take care of calling ops->remove (e.g.
+ *      via tty_driver_remove_tty) and releasing tty->termios.
 *
 *
 * void (*cleanup)(struct tty_struct * tty);
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index f1bfa12ea246..2b8963ff0f35 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -12,15 +12,6 @@
 *
 *      (thresh - thresh/DIRTY_FULL_SCOPE, thresh)
 *
- * The 1/16 region above the global dirty limit will be put to maximum pauses:
- *
- *      (limit, limit + limit/DIRTY_MAXPAUSE_AREA)
- *
- * The 1/16 region above the max-pause region, dirty exceeded bdi's will be put
- * to loops:
- *
- *      (limit + limit/DIRTY_MAXPAUSE_AREA, limit + limit/DIRTY_PASSGOOD_AREA)
- *
 * Further beyond, all dirtier tasks will enter a loop waiting (possibly long
 * time) for the dirty pages to drop, unless written enough pages.
 *
@@ -31,8 +22,6 @@
 */
 #define DIRTY_SCOPE             8
 #define DIRTY_FULL_SCOPE        (DIRTY_SCOPE / 2)
-#define DIRTY_MAXPAUSE_AREA             16
-#define DIRTY_PASSGOOD_AREA             8
 /*
 * 4MB minimal write chunk size
diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index 342dcf13d039..a6326ef8ade6 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -288,6 +288,35 @@ enum p9_perm_t {
        P9_DMSETVTX = 0x00010000,
 };
+/* 9p2000.L open flags */
+#define P9_DOTL_RDONLY        00000000
+#define P9_DOTL_WRONLY        00000001
+#define P9_DOTL_RDWR          00000002
+#define P9_DOTL_NOACCESS      00000003
+#define P9_DOTL_CREATE        00000100
+#define P9_DOTL_EXCL          00000200
+#define P9_DOTL_NOCTTY        00000400
+#define P9_DOTL_TRUNC         00001000
+#define P9_DOTL_APPEND        00002000
+#define P9_DOTL_NONBLOCK      00004000
+#define P9_DOTL_DSYNC         00010000
+#define P9_DOTL_FASYNC        00020000
+#define P9_DOTL_DIRECT        00040000
+#define P9_DOTL_LARGEFILE     00100000
+#define P9_DOTL_DIRECTORY     00200000
+#define P9_DOTL_NOFOLLOW      00400000
+#define P9_DOTL_NOATIME       01000000
+#define P9_DOTL_CLOEXEC       02000000
+#define P9_DOTL_SYNC          04000000
+/* 9p2000.L at flags */
+#define P9_DOTL_AT_REMOVEDIR            0x200
+/* 9p2000.L lock type */
+#define P9_LOCK_TYPE_RDLCK 0
+#define P9_LOCK_TYPE_WRLCK 1
+#define P9_LOCK_TYPE_UNLCK 2
 /**
 * enum p9_qid_t - QID types
 * @P9_QTDIR: directory
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index d17f47fc9e31..401d73bd151f 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1744,6 +1744,8 @@ struct wiphy_wowlan_support {
 *      by default for perm_addr. In this case, the mask should be set to
 *      all-zeroes. In this case it is assumed that the device can handle
 *      the same number of arbitrary MAC addresses.
+ * @registered: protects ->resume and ->suspend sysfs callbacks against
+ *      unregister hardware
 * @debugfsdir: debugfs directory used for this wiphy, will be renamed
 *      automatically on wiphy renames
 * @dev: (virtual) struct device for this wiphy
@@ -1865,6 +1867,9 @@ struct wiphy {
         * you need use set_wiphy_dev() (see below) */
        struct device dev;
+        /* protects ->resume, ->suspend sysfs callbacks against unregister hw */
+        bool registered;
        /* dir in debugfs: ieee80211/<wiphyname> */
        struct dentry *debugfsdir;
diff --git a/include/net/flow.h b/include/net/flow.h
index 78113daadd63..a09447749e2d 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -7,6 +7,7 @@
 #ifndef _NET_FLOW_H
 #define _NET_FLOW_H
+#include <linux/socket.h>
 #include <linux/in6.h>
 #include <linux/atomic.h>
@@ -68,7 +69,7 @@ struct flowi4 {
 #define fl4_ipsec_spi           uli.spi
 #define fl4_mh_type             uli.mht.type
 #define fl4_gre_key             uli.gre_key
-};
+} __attribute__((__aligned__(BITS_PER_LONG/8)));
 static inline void flowi4_init_output(struct flowi4 *fl4, int oif,
                                      __u32 mark, __u8 tos, __u8 scope,
@@ -112,7 +113,7 @@ struct flowi6 {
 #define fl6_ipsec_spi           uli.spi
 #define fl6_mh_type             uli.mht.type
 #define fl6_gre_key             uli.gre_key
-};
+} __attribute__((__aligned__(BITS_PER_LONG/8)));
 struct flowidn {
        struct flowi_common     __fl_common;
@@ -127,7 +128,7 @@ struct flowidn {
        union flowi_uli         uli;
 #define fld_sport               uli.ports.sport
 #define fld_dport               uli.ports.dport
-};
+} __attribute__((__aligned__(BITS_PER_LONG/8)));
 struct flowi {
        union {
@@ -161,6 +162,24 @@ static inline struct flowi *flowidn_to_flowi(struct flowidn *fldn)
        return container_of(fldn, struct flowi, u.dn);
 }
+typedef unsigned long flow_compare_t;
+static inline size_t flow_key_size(u16 family)
+{
+        switch (family) {
+        case AF_INET:
+                BUILD_BUG_ON(sizeof(struct flowi4) % sizeof(flow_compare_t));
+                return sizeof(struct flowi4) / sizeof(flow_compare_t);
+        case AF_INET6:
+                BUILD_BUG_ON(sizeof(struct flowi6) % sizeof(flow_compare_t));
+                return sizeof(struct flowi6) / sizeof(flow_compare_t);
+        case AF_DECnet:
+                BUILD_BUG_ON(sizeof(struct flowidn) % sizeof(flow_compare_t));
+                return sizeof(struct flowidn) / sizeof(flow_compare_t);
+        }
+        return 0;
+}
 #define FLOW_DIR_IN     0
 #define FLOW_DIR_OUT    1
 #define FLOW_DIR_FWD    2
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index 99e6e19b57c2..4c0766e201e3 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -96,7 +96,8 @@ extern int sysctl_max_syn_backlog;
 */
 struct listen_sock {
        u8                      max_qlen_log;
-        /* 3 bytes hole, try to use */
+        u8                      synflood_warned;
+        /* 2 bytes hole, try to use */
        int                     qlen;
        int                     qlen_young;
        int                     clock_hand;
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 6506458ccd33..712b3bebeda7 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -109,6 +109,7 @@ typedef enum {
        SCTP_CMD_SEND_MSG,       /* Send the whole use message */
        SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */
        SCTP_CMD_PURGE_ASCONF_QUEUE, /* Purge all asconf queues.*/
+        SCTP_CMD_SET_ASOC,       /* Restore association context */
        SCTP_CMD_LAST
 } sctp_verb_t;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 149a415d1e0a..acc620a4a45f 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -431,17 +431,34 @@ extern int tcp_disconnect(struct sock *sk, int flags);
 extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
 extern struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 
                                    struct ip_options *opt);
+#ifdef CONFIG_SYN_COOKIES
 extern __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, 
                                     __u16 *mss);
+#else
+static inline __u32 cookie_v4_init_sequence(struct sock *sk,
+                                            struct sk_buff *skb,
+                                            __u16 *mss)
+{
+        return 0;
+}
+#endif
 extern __u32 cookie_init_timestamp(struct request_sock *req);
 extern bool cookie_check_timestamp(struct tcp_options_received *opt, bool *);
 /* From net/ipv6/syncookies.c */
 extern struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb);
+#ifdef CONFIG_SYN_COOKIES
 extern __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb,
                                     __u16 *mss);
+#else
+static inline __u32 cookie_v6_init_sequence(struct sock *sk,
+                                            struct sk_buff *skb,
+                                            __u16 *mss)
+{
+        return 0;
+}
+#endif
 /* tcp_output.c */
 extern void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
@@ -460,6 +477,9 @@ extern int tcp_write_wakeup(struct sock *);
 extern void tcp_send_fin(struct sock *sk);
 extern void tcp_send_active_reset(struct sock *sk, gfp_t priority);
 extern int tcp_send_synack(struct sock *);
+extern int tcp_syn_flood_action(struct sock *sk,
+                                const struct sk_buff *skb,
+                                const char *proto);
 extern void tcp_push_one(struct sock *, unsigned int mss_now);
 extern void tcp_send_ack(struct sock *sk);
 extern void tcp_send_delayed_ack(struct sock *sk);
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index 5271a741c3a3..498433dd067d 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -39,6 +39,7 @@ extern int			datagram_recv_ctl(struct sock *sk,
                                                  struct sk_buff *skb);
 extern int                      datagram_send_ctl(struct net *net,
+                                                  struct sock *sk,
                                                  struct msghdr *msg,
                                                  struct flowi6 *fl6,
                                                  struct ipv6_txoptions *opt,
diff --git a/include/target/target_core_fabric_ops.h b/include/target/target_core_fabric_ops.h
index 2de8fe907596..126c675f4f14 100644
--- a/include/target/target_core_fabric_ops.h
+++ b/include/target/target_core_fabric_ops.h
@@ -27,6 +27,12 @@ struct target_core_fabric_ops {
        int (*tpg_check_demo_mode_cache)(struct se_portal_group *);
        int (*tpg_check_demo_mode_write_protect)(struct se_portal_group *);
        int (*tpg_check_prod_mode_write_protect)(struct se_portal_group *);
+        /*
+         * Optionally used by fabrics to allow demo-mode login, but not
+         * expose any TPG LUNs, and return 'not connected' in standard
+         * inquiry response
+         */
+        int (*tpg_check_demo_mode_login_only)(struct se_portal_group *);
        struct se_node_acl *(*tpg_alloc_fabric_acl)(
                                        struct se_portal_group *);
        void (*tpg_release_fabric_acl)(struct se_portal_group *,
diff --git a/init/main.c b/init/main.c
index 9c51ee7adf3d..2a9b88aa5e76 100644
--- a/init/main.c
+++ b/init/main.c
@@ -209,8 +209,19 @@ early_param("quiet", quiet_kernel);
 static int __init loglevel(char *str)
 {
-        get_option(&str, &console_loglevel);
+        int newlevel;
-        return 0;
+        /*
+         * Only update loglevel value when a correct setting was passed,
+         * to prevent blind crashes (when loglevel being set to 0) that
+         * are quite hard to debug
+         */
+        if (get_option(&str, &newlevel)) {
+                console_loglevel = newlevel;
+                return 0;
+        }
+        return -EINVAL;
 }
 early_param("loglevel", loglevel);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index b8785e26ee1c..0f857782d06f 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -399,14 +399,54 @@ void perf_cgroup_switch(struct task_struct *task, int mode)
        local_irq_restore(flags);
 }
-static inline void perf_cgroup_sched_out(struct task_struct *task)
+static inline void perf_cgroup_sched_out(struct task_struct *task,
+                                         struct task_struct *next)
 {
-        perf_cgroup_switch(task, PERF_CGROUP_SWOUT);
+        struct perf_cgroup *cgrp1;
+        struct perf_cgroup *cgrp2 = NULL;
+        /*
+         * we come here when we know perf_cgroup_events > 0
+         */
+        cgrp1 = perf_cgroup_from_task(task);
+        /*
+         * next is NULL when called from perf_event_enable_on_exec()
+         * that will systematically cause a cgroup_switch()
+         */
+        if (next)
+                cgrp2 = perf_cgroup_from_task(next);
+        /*
+         * only schedule out current cgroup events if we know
+         * that we are switching to a different cgroup. Otherwise,
+         * do no touch the cgroup events.
+         */
+        if (cgrp1 != cgrp2)
+                perf_cgroup_switch(task, PERF_CGROUP_SWOUT);
 }
-static inline void perf_cgroup_sched_in(struct task_struct *task)
+static inline void perf_cgroup_sched_in(struct task_struct *prev,
+                                        struct task_struct *task)
 {
-        perf_cgroup_switch(task, PERF_CGROUP_SWIN);
+        struct perf_cgroup *cgrp1;
+        struct perf_cgroup *cgrp2 = NULL;
+        /*
+         * we come here when we know perf_cgroup_events > 0
+         */
+        cgrp1 = perf_cgroup_from_task(task);
+        /* prev can never be NULL */
+        cgrp2 = perf_cgroup_from_task(prev);
+        /*
+         * only need to schedule in cgroup events if we are changing
+         * cgroup during ctxsw. Cgroup events were not scheduled
+         * out of ctxsw out if that was not the case.
+         */
+        if (cgrp1 != cgrp2)
+                perf_cgroup_switch(task, PERF_CGROUP_SWIN);
 }
 static inline int perf_cgroup_connect(int fd, struct perf_event *event,
@@ -518,11 +558,13 @@ static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
 {
 }
-static inline void perf_cgroup_sched_out(struct task_struct *task)
+static inline void perf_cgroup_sched_out(struct task_struct *task,
+                                         struct task_struct *next)
 {
 }
-static inline void perf_cgroup_sched_in(struct task_struct *task)
+static inline void perf_cgroup_sched_in(struct task_struct *prev,
+                                        struct task_struct *task)
 {
 }
@@ -1988,7 +2030,7 @@ void __perf_event_task_sched_out(struct task_struct *task,
         * cgroup event are system-wide mode only
         */
        if (atomic_read(&__get_cpu_var(perf_cgroup_events)))
-                perf_cgroup_sched_out(task);
+                perf_cgroup_sched_out(task, next);
 }
 static void task_ctx_sched_out(struct perf_event_context *ctx)
@@ -2153,7 +2195,8 @@ static void perf_event_context_sched_in(struct perf_event_context *ctx,
 * accessing the event control register. If a NMI hits, then it will
 * keep the event running.
 */
-void __perf_event_task_sched_in(struct task_struct *task)
+void __perf_event_task_sched_in(struct task_struct *prev,
+                                struct task_struct *task)
 {
        struct perf_event_context *ctx;
        int ctxn;
@@ -2171,7 +2214,7 @@ void __perf_event_task_sched_in(struct task_struct *task)
         * cgroup event are system-wide mode only
         */
        if (atomic_read(&__get_cpu_var(perf_cgroup_events)))
-                perf_cgroup_sched_in(task);
+                perf_cgroup_sched_in(prev, task);
 }
 static u64 perf_calculate_period(struct perf_event *event, u64 nsec, u64 count)
@@ -2427,7 +2470,7 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx)
         * ctxswin cgroup events which are already scheduled
         * in.
         */
-        perf_cgroup_sched_out(current);
+        perf_cgroup_sched_out(current, NULL);
        raw_spin_lock(&ctx->lock);
        task_ctx_sched_out(ctx);
@@ -3353,8 +3396,8 @@ static int perf_event_index(struct perf_event *event)
 }
 static void calc_timer_values(struct perf_event *event,
-                                u64 *running,
+                                u64 *enabled,
-                                u64 *enabled)
+                                u64 *running)
 {
        u64 now, ctx_time;
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index d5a3009da71a..dc5114b4c16c 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -178,7 +178,7 @@ void irq_shutdown(struct irq_desc *desc)
        desc->depth = 1;
        if (desc->irq_data.chip->irq_shutdown)
                desc->irq_data.chip->irq_shutdown(&desc->irq_data);
-        if (desc->irq_data.chip->irq_disable)
+        else if (desc->irq_data.chip->irq_disable)
                desc->irq_data.chip->irq_disable(&desc->irq_data);
        else
                desc->irq_data.chip->irq_mask(&desc->irq_data);
diff --git a/kernel/printk.c b/kernel/printk.c
index 836a2ae0ac31..28a40d8171b8 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -1604,7 +1604,7 @@ static int __init printk_late_init(void)
        struct console *con;
        for_each_console(con) {
-                if (con->flags & CON_BOOT) {
+                if (!keep_bootcon && con->flags & CON_BOOT) {
                        printk(KERN_INFO "turn off boot console %s%d\n",
                                con->name, con->index);
                        unregister_console(con);
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 9de3ecfd20f9..a70d2a5d8c7b 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -744,20 +744,17 @@ int ptrace_request(struct task_struct *child, long request,
                        break;
                si = child->last_siginfo;
-                if (unlikely(!si || si->si_code >> 8 != PTRACE_EVENT_STOP))
+                if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) {
-                        break;
+                        child->jobctl |= JOBCTL_LISTENING;
+                        /*
-                child->jobctl |= JOBCTL_LISTENING;
+                         * If NOTIFY is set, it means event happened between
+                         * start of this trap and now.  Trigger re-trap.
-                /*
+                         */
-                 * If NOTIFY is set, it means event happened between start
+                        if (child->jobctl & JOBCTL_TRAP_NOTIFY)
-                 * of this trap and now.  Trigger re-trap immediately.
+                                signal_wake_up(child, true);
-                 */
+                        ret = 0;
-                if (child->jobctl & JOBCTL_TRAP_NOTIFY)
+                }
-                        signal_wake_up(child, true);
                unlock_task_sighand(child, &flags);
-                ret = 0;
                break;
        case PTRACE_DETACH:      /* detach a process that was attached. */
diff --git a/kernel/sched.c b/kernel/sched.c
index ccacdbdecf45..ec5f472bc5b9 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -3065,7 +3065,7 @@ static void finish_task_switch(struct rq *rq, struct task_struct *prev)
 #ifdef __ARCH_WANT_INTERRUPTS_ON_CTXSW
        local_irq_disable();
 #endif /* __ARCH_WANT_INTERRUPTS_ON_CTXSW */
-        perf_event_task_sched_in(current);
+        perf_event_task_sched_in(prev, current);
 #ifdef __ARCH_WANT_INTERRUPTS_ON_CTXSW
        local_irq_enable();
 #endif /* __ARCH_WANT_INTERRUPTS_ON_CTXSW */
@@ -4279,9 +4279,9 @@ pick_next_task(struct rq *rq)
 }
 /*
- * schedule() is the main scheduler function.
+ * __schedule() is the main scheduler function.
 */
-asmlinkage void __sched schedule(void)
+static void __sched __schedule(void)
 {
        struct task_struct *prev, *next;
        unsigned long *switch_count;
@@ -4322,16 +4322,6 @@ need_resched:
                                if (to_wakeup)
                                        try_to_wake_up_local(to_wakeup);
                        }
-                        /*
-                         * If we are going to sleep and we have plugged IO
-                         * queued, make sure to submit it to avoid deadlocks.
-                         */
-                        if (blk_needs_flush_plug(prev)) {
-                                raw_spin_unlock(&rq->lock);
-                                blk_schedule_flush_plug(prev);
-                                raw_spin_lock(&rq->lock);
-                        }
                }
                switch_count = &prev->nvcsw;
        }
@@ -4369,6 +4359,26 @@ need_resched:
        if (need_resched())
                goto need_resched;
 }
+static inline void sched_submit_work(struct task_struct *tsk)
+{
+        if (!tsk->state)
+                return;
+        /*
+         * If we are going to sleep and we have plugged IO queued,
+         * make sure to submit it to avoid deadlocks.
+         */
+        if (blk_needs_flush_plug(tsk))
+                blk_schedule_flush_plug(tsk);
+}
+asmlinkage void schedule(void)
+{
+        struct task_struct *tsk = current;
+        sched_submit_work(tsk);
+        __schedule();
+}
 EXPORT_SYMBOL(schedule);
 #ifdef CONFIG_MUTEX_SPIN_ON_OWNER
@@ -4435,7 +4445,7 @@ asmlinkage void __sched notrace preempt_schedule(void)
        do {
                add_preempt_count_notrace(PREEMPT_ACTIVE);
-                schedule();
+                __schedule();
                sub_preempt_count_notrace(PREEMPT_ACTIVE);
                /*
@@ -4463,7 +4473,7 @@ asmlinkage void __sched preempt_schedule_irq(void)
        do {
                add_preempt_count(PREEMPT_ACTIVE);
                local_irq_enable();
-                schedule();
+                __schedule();
                local_irq_disable();
                sub_preempt_count(PREEMPT_ACTIVE);
@@ -5588,7 +5598,7 @@ static inline int should_resched(void)
 static void __cond_resched(void)
 {
        add_preempt_count(PREEMPT_ACTIVE);
-        schedule();
+        __schedule();
        sub_preempt_count(PREEMPT_ACTIVE);
 }
@@ -7443,6 +7453,7 @@ static void __sdt_free(const struct cpumask *cpu_map)
                        struct sched_domain *sd = *per_cpu_ptr(sdd->sd, j);
                        if (sd && (sd->flags & SD_OVERLAP))
                                free_sched_groups(sd->groups, 0);
+                        kfree(*per_cpu_ptr(sdd->sd, j));
                        kfree(*per_cpu_ptr(sdd->sg, j));
                        kfree(*per_cpu_ptr(sdd->sgp, j));
                }
diff --git a/kernel/sys.c b/kernel/sys.c
index dd948a1fca4c..18ee1d2f6474 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -37,6 +37,8 @@
 #include <linux/fs_struct.h>
 #include <linux/gfp.h>
 #include <linux/syscore_ops.h>
+#include <linux/version.h>
+#include <linux/ctype.h>
 #include <linux/compat.h>
 #include <linux/syscalls.h>
@@ -44,6 +46,8 @@
 #include <linux/user_namespace.h>
 #include <linux/kmsg_dump.h>
+/* Move somewhere else to avoid recompiling? */
+#include <generated/utsrelease.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -1161,6 +1165,34 @@ DECLARE_RWSEM(uts_sem);
 #define override_architecture(name)     0
 #endif
+/*
+ * Work around broken programs that cannot handle "Linux 3.0".
+ * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40
+ */
+static int override_release(char __user *release, int len)
+{
+        int ret = 0;
+        char buf[len];
+        if (current->personality & UNAME26) {
+                char *rest = UTS_RELEASE;
+                int ndots = 0;
+                unsigned v;
+                while (*rest) {
+                        if (*rest == '.' && ++ndots >= 3)
+                                break;
+                        if (!isdigit(*rest) && *rest != '.')
+                                break;
+                        rest++;
+                }
+                v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
+                snprintf(buf, len, "2.6.%u%s", v, rest);
+                ret = copy_to_user(release, buf, len);
+        }
+        return ret;
+}
 SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
 {
        int errno = 0;
@@ -1170,6 +1202,8 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
                errno = -EFAULT;
        up_read(&uts_sem);
+        if (!errno && override_release(name->release, sizeof(name->release)))
+                errno = -EFAULT;
        if (!errno && override_architecture(name))
                errno = -EFAULT;
        return errno;
@@ -1191,6 +1225,8 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
                error = -EFAULT;
        up_read(&uts_sem);
+        if (!error && override_release(name->release, sizeof(name->release)))
+                error = -EFAULT;
        if (!error && override_architecture(name))
                error = -EFAULT;
        return error;
@@ -1225,6 +1261,8 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
        if (!error && override_architecture(name))
                error = -EFAULT;
+        if (!error && override_release(name->release, sizeof(name->release)))
+                error = -EFAULT;
        return error ? -EFAULT : 0;
 }
 #endif
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 62cbc8877fef..a9a5de07c4f1 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -16,7 +16,6 @@ asmlinkage long sys_ni_syscall(void)
        return -ENOSYS;
 }
-cond_syscall(sys_nfsservctl);
 cond_syscall(sys_quotactl);
 cond_syscall(sys32_quotactl);
 cond_syscall(sys_acct);
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index e19ce1454ee1..e66046456f4f 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -655,6 +655,7 @@ static struct genl_ops taskstats_ops = {
        .cmd            = TASKSTATS_CMD_GET,
        .doit           = taskstats_user_cmd,
        .policy         = taskstats_cmd_get_policy,
+        .flags          = GENL_ADMIN_PERM,
 };
 static struct genl_ops cgroupstats_ops = {
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index 59f369f98a04..ea5e1a928d5b 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -441,6 +441,8 @@ static int alarm_timer_create(struct k_itimer *new_timer)
 static void alarm_timer_get(struct k_itimer *timr,
                                struct itimerspec *cur_setting)
 {
+        memset(cur_setting, 0, sizeof(struct itimerspec));
        cur_setting->it_interval =
                        ktime_to_timespec(timr->it.alarmtimer.period);
        cur_setting->it_value =
@@ -479,11 +481,17 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
        if (!rtcdev)
                return -ENOTSUPP;
-        /* Save old values */
+        /*
-        old_setting->it_interval =
+         * XXX HACK! Currently we can DOS a system if the interval
-                        ktime_to_timespec(timr->it.alarmtimer.period);
+         * period on alarmtimers is too small. Cap the interval here
-        old_setting->it_value =
+         * to 100us and solve this properly in a future patch! -jstultz
-                        ktime_to_timespec(timr->it.alarmtimer.node.expires);
+         */
+        if ((new_setting->it_interval.tv_sec == 0) &&
+                        (new_setting->it_interval.tv_nsec < 100000))
+                new_setting->it_interval.tv_nsec = 100000;
+        if (old_setting)
+                alarm_timer_get(timr, old_setting);
        /* If the timer was already set, cancel it */
        alarm_cancel(&timr->it.alarmtimer);
diff --git a/kernel/tsacct.c b/kernel/tsacct.c
index 24dc60d9fa1f..5bbfac85866e 100644
--- a/kernel/tsacct.c
+++ b/kernel/tsacct.c
@@ -78,6 +78,7 @@ void bacct_add_tsk(struct taskstats *stats, struct task_struct *tsk)
 #define KB 1024
 #define MB (1024*KB)
+#define KB_MASK (~(KB-1))
 /*
 * fill in extended accounting fields
 */
@@ -95,14 +96,14 @@ void xacct_add_tsk(struct taskstats *stats, struct task_struct *p)
                stats->hiwater_vm    = get_mm_hiwater_vm(mm)  * PAGE_SIZE / KB;
                mmput(mm);
        }
-        stats->read_char        = p->ioac.rchar;
+        stats->read_char        = p->ioac.rchar & KB_MASK;
-        stats->write_char       = p->ioac.wchar;
+        stats->write_char       = p->ioac.wchar & KB_MASK;
-        stats->read_syscalls    = p->ioac.syscr;
+        stats->read_syscalls    = p->ioac.syscr & KB_MASK;
-        stats->write_syscalls   = p->ioac.syscw;
+        stats->write_syscalls   = p->ioac.syscw & KB_MASK;
 #ifdef CONFIG_TASK_IO_ACCOUNTING
-        stats->read_bytes       = p->ioac.read_bytes;
+        stats->read_bytes       = p->ioac.read_bytes & KB_MASK;
-        stats->write_bytes      = p->ioac.write_bytes;
+        stats->write_bytes      = p->ioac.write_bytes & KB_MASK;
-        stats->cancelled_write_bytes = p->ioac.cancelled_write_bytes;
+        stats->cancelled_write_bytes = p->ioac.cancelled_write_bytes & KB_MASK;
 #else
        stats->read_bytes       = 0;
        stats->write_bytes      = 0;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 25fb1b0e53fa..1783aabc6128 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2412,8 +2412,13 @@ reflush:
        for_each_cwq_cpu(cpu, wq) {
                struct cpu_workqueue_struct *cwq = get_cwq(cpu, wq);
+                bool drained;
-                if (!cwq->nr_active && list_empty(&cwq->delayed_works))
+                spin_lock_irq(&cwq->gcwq->lock);
+                drained = !cwq->nr_active && list_empty(&cwq->delayed_works);
+                spin_unlock_irq(&cwq->gcwq->lock);
+                if (drained)
                        continue;
                if (++flush_cnt == 10 ||
diff --git a/lib/Makefile b/lib/Makefile
index d5d175c8a6ca..3f5bc6d903e0 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -12,7 +12,7 @@ lib-y := ctype.o string.o vsprintf.o cmdline.o \
         idr.o int_sqrt.o extable.o prio_tree.o \
         sha1.o md5.o irq_regs.o reciprocal_div.o argv_split.o \
         proportions.o prio_heap.o ratelimit.o show_mem.o \
-         is_single_threaded.o plist.o decompress.o find_next_bit.o
+         is_single_threaded.o plist.o decompress.o
 lib-$(CONFIG_MMU) += ioremap.o
 lib-$(CONFIG_SMP) += cpumask.o
@@ -22,7 +22,7 @@ lib-y	+= kobject.o kref.o klist.o
 obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
         bust_spinlocks.o hexdump.o kasprintf.o bitmap.o scatterlist.o \
         string_helpers.o gcd.o lcm.o list_sort.o uuid.o flex_array.o \
-         bsearch.o find_last_bit.o
+         bsearch.o find_last_bit.o find_next_bit.o
 obj-y += kstrtox.o
 obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
diff --git a/lib/sha1.c b/lib/sha1.c
index f33271dd00cb..1de509a159c8 100644
--- a/lib/sha1.c
+++ b/lib/sha1.c
@@ -8,6 +8,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/bitops.h>
+#include <linux/cryptohash.h>
 #include <asm/unaligned.h>
 /*
diff --git a/lib/xz/xz_dec_bcj.c b/lib/xz/xz_dec_bcj.c
index e51e2558ca9d..a768e6d28bbb 100644
--- a/lib/xz/xz_dec_bcj.c
+++ b/lib/xz/xz_dec_bcj.c
@@ -441,8 +441,12 @@ XZ_EXTERN enum xz_ret xz_dec_bcj_run(struct xz_dec_bcj *s,
         * next filter in the chain. Apply the BCJ filter on the new data
         * in the output buffer. If everything cannot be filtered, copy it
         * to temp and rewind the output buffer position accordingly.
+         *
+         * This needs to be always run when temp.size == 0 to handle a special
+         * case where the output buffer is full and the next filter has no
+         * more output coming but hasn't returned XZ_STREAM_END yet.
         */
-        if (s->temp.size < b->out_size - b->out_pos) {
+        if (s->temp.size < b->out_size - b->out_pos || s->temp.size == 0) {
                out_start = b->out_pos;
                memcpy(b->out + b->out_pos, s->temp.buf, s->temp.size);
                b->out_pos += s->temp.size;
@@ -465,16 +469,25 @@ XZ_EXTERN enum xz_ret xz_dec_bcj_run(struct xz_dec_bcj *s,
                s->temp.size = b->out_pos - out_start;
                b->out_pos -= s->temp.size;
                memcpy(s->temp.buf, b->out + b->out_pos, s->temp.size);
+                /*
+                 * If there wasn't enough input to the next filter to fill
+                 * the output buffer with unfiltered data, there's no point
+                 * to try decoding more data to temp.
+                 */
+                if (b->out_pos + s->temp.size < b->out_size)
+                        return XZ_OK;
        }
        /*
-         * If we have unfiltered data in temp, try to fill by decoding more
+         * We have unfiltered data in temp. If the output buffer isn't full
-         * data from the next filter. Apply the BCJ filter on temp. Then we
+         * yet, try to fill the temp buffer by decoding more data from the
-         * hopefully can fill the actual output buffer by copying filtered
+         * next filter. Apply the BCJ filter on temp. Then we hopefully can
-         * data from temp. A mix of filtered and unfiltered data may be left
+         * fill the actual output buffer by copying filtered data from temp.
-         * in temp; it will be taken care on the next call to this function.
+         * A mix of filtered and unfiltered data may be left in temp; it will
+         * be taken care on the next call to this function.
         */
-        if (s->temp.size > 0) {
+        if (b->out_pos < b->out_size) {
                /* Make b->out{,_pos,_size} temporarily point to s->temp. */
                s->out = b->out;
                s->out_pos = b->out_pos;
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index d6edf8d14f9c..a87da524a4a0 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -359,6 +359,17 @@ static unsigned long bdi_longest_inactive(void)
        return max(5UL * 60 * HZ, interval);
 }
+/*
+ * Clear pending bit and wakeup anybody waiting for flusher thread creation or
+ * shutdown
+ */
+static void bdi_clear_pending(struct backing_dev_info *bdi)
+{
+        clear_bit(BDI_pending, &bdi->state);
+        smp_mb__after_clear_bit();
+        wake_up_bit(&bdi->state, BDI_pending);
+}
 static int bdi_forker_thread(void *ptr)
 {
        struct bdi_writeback *me = ptr;
@@ -390,6 +401,13 @@ static int bdi_forker_thread(void *ptr)
                }
                spin_lock_bh(&bdi_lock);
+                /*
+                 * In the following loop we are going to check whether we have
+                 * some work to do without any synchronization with tasks
+                 * waking us up to do work for them. So we have to set task
+                 * state already here so that we don't miss wakeups coming
+                 * after we verify some condition.
+                 */
                set_current_state(TASK_INTERRUPTIBLE);
                list_for_each_entry(bdi, &bdi_list, bdi_list) {
@@ -469,11 +487,13 @@ static int bdi_forker_thread(void *ptr)
                                spin_unlock_bh(&bdi->wb_lock);
                                wake_up_process(task);
                        }
+                        bdi_clear_pending(bdi);
                        break;
                case KILL_THREAD:
                        __set_current_state(TASK_RUNNING);
                        kthread_stop(task);
+                        bdi_clear_pending(bdi);
                        break;
                case NO_ACTION:
@@ -489,16 +509,8 @@ static int bdi_forker_thread(void *ptr)
                        else
                                schedule_timeout(msecs_to_jiffies(dirty_writeback_interval * 10));
                        try_to_freeze();
-                        /* Back to the main loop */
+                        break;
-                        continue;
                }
-                /*
-                 * Clear pending bit and wakeup anybody waiting to tear us down.
-                 */
-                clear_bit(BDI_pending, &bdi->state);
-                smp_mb__after_clear_bit();
-                wake_up_bit(&bdi->state, BDI_pending);
        }
        return 0;
diff --git a/mm/filemap.c b/mm/filemap.c
index 645a080ba4df..7771871fa353 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -827,13 +827,14 @@ unsigned find_get_pages(struct address_space *mapping, pgoff_t start,
 {
        unsigned int i;
        unsigned int ret;
-        unsigned int nr_found;
+        unsigned int nr_found, nr_skip;
        rcu_read_lock();
 restart:
        nr_found = radix_tree_gang_lookup_slot(&mapping->page_tree,
                                (void ***)pages, NULL, start, nr_pages);
        ret = 0;
+        nr_skip = 0;
        for (i = 0; i < nr_found; i++) {
                struct page *page;
 repeat:
@@ -856,6 +857,7 @@ repeat:
                         * here as an exceptional entry: so skip over it -
                         * we only reach this from invalidate_mapping_pages().
                         */
+                        nr_skip++;
                        continue;
                }
@@ -876,7 +878,7 @@ repeat:
         * If all entries were removed before we could secure them,
         * try again, because callers stop trying once 0 is returned.
         */
-        if (unlikely(!ret && nr_found))
+        if (unlikely(!ret && nr_found > nr_skip))
                goto restart;
        rcu_read_unlock();
        return ret;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 930de9437271..3508777837c7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -204,50 +204,6 @@ struct mem_cgroup_eventfd_list {
 static void mem_cgroup_threshold(struct mem_cgroup *mem);
 static void mem_cgroup_oom_notify(struct mem_cgroup *mem);
-enum {
-        SCAN_BY_LIMIT,
-        SCAN_BY_SYSTEM,
-        NR_SCAN_CONTEXT,
-        SCAN_BY_SHRINK, /* not recorded now */
-};
-enum {
-        SCAN,
-        SCAN_ANON,
-        SCAN_FILE,
-        ROTATE,
-        ROTATE_ANON,
-        ROTATE_FILE,
-        FREED,
-        FREED_ANON,
-        FREED_FILE,
-        ELAPSED,
-        NR_SCANSTATS,
-};
-struct scanstat {
-        spinlock_t      lock;
-        unsigned long   stats[NR_SCAN_CONTEXT][NR_SCANSTATS];
-        unsigned long   rootstats[NR_SCAN_CONTEXT][NR_SCANSTATS];
-};
-const char *scanstat_string[NR_SCANSTATS] = {
-        "scanned_pages",
-        "scanned_anon_pages",
-        "scanned_file_pages",
-        "rotated_pages",
-        "rotated_anon_pages",
-        "rotated_file_pages",
-        "freed_pages",
-        "freed_anon_pages",
-        "freed_file_pages",
-        "elapsed_ns",
-};
-#define SCANSTAT_WORD_LIMIT     "_by_limit"
-#define SCANSTAT_WORD_SYSTEM    "_by_system"
-#define SCANSTAT_WORD_HIERARCHY "_under_hierarchy"
 /*
 * The memory controller data structure. The memory controller controls both
 * page cache and RSS per cgroup. We would eventually like to provide
@@ -313,8 +269,7 @@ struct mem_cgroup {
        /* For oom notifier event fd */
        struct list_head oom_notify;
-        /* For recording LRU-scan statistics */
-        struct scanstat scanstat;
        /*
         * Should we move charges of a task when a task is moved into this
         * mem_cgroup ? And what type of charges should we move ?
@@ -1678,44 +1633,6 @@ bool mem_cgroup_reclaimable(struct mem_cgroup *mem, bool noswap)
 }
 #endif
-static void __mem_cgroup_record_scanstat(unsigned long *stats,
-                           struct memcg_scanrecord *rec)
-{
-        stats[SCAN] += rec->nr_scanned[0] + rec->nr_scanned[1];
-        stats[SCAN_ANON] += rec->nr_scanned[0];
-        stats[SCAN_FILE] += rec->nr_scanned[1];
-        stats[ROTATE] += rec->nr_rotated[0] + rec->nr_rotated[1];
-        stats[ROTATE_ANON] += rec->nr_rotated[0];
-        stats[ROTATE_FILE] += rec->nr_rotated[1];
-        stats[FREED] += rec->nr_freed[0] + rec->nr_freed[1];
-        stats[FREED_ANON] += rec->nr_freed[0];
-        stats[FREED_FILE] += rec->nr_freed[1];
-        stats[ELAPSED] += rec->elapsed;
-}
-static void mem_cgroup_record_scanstat(struct memcg_scanrecord *rec)
-{
-        struct mem_cgroup *mem;
-        int context = rec->context;
-        if (context >= NR_SCAN_CONTEXT)
-                return;
-        mem = rec->mem;
-        spin_lock(&mem->scanstat.lock);
-        __mem_cgroup_record_scanstat(mem->scanstat.stats[context], rec);
-        spin_unlock(&mem->scanstat.lock);
-        mem = rec->root;
-        spin_lock(&mem->scanstat.lock);
-        __mem_cgroup_record_scanstat(mem->scanstat.rootstats[context], rec);
-        spin_unlock(&mem->scanstat.lock);
-}
 /*
 * Scan the hierarchy if needed to reclaim memory. We remember the last child
 * we reclaimed from, so that we don't end up penalizing one child extensively
@@ -1740,9 +1657,8 @@ static int mem_cgroup_hierarchical_reclaim(struct mem_cgroup *root_mem,
        bool noswap = reclaim_options & MEM_CGROUP_RECLAIM_NOSWAP;
        bool shrink = reclaim_options & MEM_CGROUP_RECLAIM_SHRINK;
        bool check_soft = reclaim_options & MEM_CGROUP_RECLAIM_SOFT;
-        struct memcg_scanrecord rec;
        unsigned long excess;
-        unsigned long scanned;
+        unsigned long nr_scanned;
        excess = res_counter_soft_limit_excess(&root_mem->res) >> PAGE_SHIFT;
@@ -1750,15 +1666,6 @@ static int mem_cgroup_hierarchical_reclaim(struct mem_cgroup *root_mem,
        if (!check_soft && !shrink && root_mem->memsw_is_minimum)
                noswap = true;
-        if (shrink)
-                rec.context = SCAN_BY_SHRINK;
-        else if (check_soft)
-                rec.context = SCAN_BY_SYSTEM;
-        else
-                rec.context = SCAN_BY_LIMIT;
-        rec.root = root_mem;
        while (1) {
                victim = mem_cgroup_select_victim(root_mem);
                if (victim == root_mem) {
@@ -1799,23 +1706,14 @@ static int mem_cgroup_hierarchical_reclaim(struct mem_cgroup *root_mem,
                        css_put(&victim->css);
                        continue;
                }
-                rec.mem = victim;
-                rec.nr_scanned[0] = 0;
-                rec.nr_scanned[1] = 0;
-                rec.nr_rotated[0] = 0;
-                rec.nr_rotated[1] = 0;
-                rec.nr_freed[0] = 0;
-                rec.nr_freed[1] = 0;
-                rec.elapsed = 0;
                /* we use swappiness of local cgroup */
                if (check_soft) {
                        ret = mem_cgroup_shrink_node_zone(victim, gfp_mask,
-                                noswap, zone, &rec, &scanned);
+                                noswap, zone, &nr_scanned);
-                        *total_scanned += scanned;
+                        *total_scanned += nr_scanned;
                } else
                        ret = try_to_free_mem_cgroup_pages(victim, gfp_mask,
-                                                noswap, &rec);
+                                                noswap);
-                mem_cgroup_record_scanstat(&rec);
                css_put(&victim->css);
                /*
                 * At shrinking usage, we can't check we should stop here or
@@ -1841,29 +1739,23 @@ static int mem_cgroup_hierarchical_reclaim(struct mem_cgroup *root_mem,
 */
 static bool mem_cgroup_oom_lock(struct mem_cgroup *mem)
 {
-        int lock_count = -1;
        struct mem_cgroup *iter, *failed = NULL;
        bool cond = true;
        for_each_mem_cgroup_tree_cond(iter, mem, cond) {
-                bool locked = iter->oom_lock;
+                if (iter->oom_lock) {
-                iter->oom_lock = true;
-                if (lock_count == -1)
-                        lock_count = iter->oom_lock;
-                else if (lock_count != locked) {
                        /*
                         * this subtree of our hierarchy is already locked
                         * so we cannot give a lock.
                         */
-                        lock_count = 0;
                        failed = iter;
                        cond = false;
-                }
+                } else
+                        iter->oom_lock = true;
        }
        if (!failed)
-                goto done;
+                return true;
        /*
         * OK, we failed to lock the whole subtree so we have to clean up
@@ -1877,8 +1769,7 @@ static bool mem_cgroup_oom_lock(struct mem_cgroup *mem)
                }
                iter->oom_lock = false;
        }
-done:
+        return false;
-        return lock_count;
 }
 /*
@@ -2169,13 +2060,7 @@ static void drain_all_stock(struct mem_cgroup *root_mem, bool sync)
        /* Notify other cpus that system-wide "drain" is running */
        get_online_cpus();
-        /*
+        curcpu = get_cpu();
-         * Get a hint for avoiding draining charges on the current cpu,
-         * which must be exhausted by our charging.  It is not required that
-         * this be a precise check, so we use raw_smp_processor_id() instead of
-         * getcpu()/putcpu().
-         */
-        curcpu = raw_smp_processor_id();
        for_each_online_cpu(cpu) {
                struct memcg_stock_pcp *stock = &per_cpu(memcg_stock, cpu);
                struct mem_cgroup *mem;
@@ -2192,6 +2077,7 @@ static void drain_all_stock(struct mem_cgroup *root_mem, bool sync)
                                schedule_work_on(cpu, &stock->work);
                }
        }
+        put_cpu();
        if (!sync)
                goto out;
@@ -3866,18 +3752,14 @@ try_to_free:
        /* try to free all pages in this cgroup */
        shrink = 1;
        while (nr_retries && mem->res.usage > 0) {
-                struct memcg_scanrecord rec;
                int progress;
                if (signal_pending(current)) {
                        ret = -EINTR;
                        goto out;
                }
-                rec.context = SCAN_BY_SHRINK;
-                rec.mem = mem;
-                rec.root = mem;
                progress = try_to_free_mem_cgroup_pages(mem, GFP_KERNEL,
-                                                false, &rec);
+                                                false);
                if (!progress) {
                        nr_retries--;
                        /* maybe some writeback is necessary */
@@ -4721,54 +4603,6 @@ static int mem_control_numa_stat_open(struct inode *unused, struct file *file)
 }
 #endif /* CONFIG_NUMA */
-static int mem_cgroup_vmscan_stat_read(struct cgroup *cgrp,
-                                struct cftype *cft,
-                                struct cgroup_map_cb *cb)
-{
-        struct mem_cgroup *mem = mem_cgroup_from_cont(cgrp);
-        char string[64];
-        int i;
-        for (i = 0; i < NR_SCANSTATS; i++) {
-                strcpy(string, scanstat_string[i]);
-                strcat(string, SCANSTAT_WORD_LIMIT);
-                cb->fill(cb, string,  mem->scanstat.stats[SCAN_BY_LIMIT][i]);
-        }
-        for (i = 0; i < NR_SCANSTATS; i++) {
-                strcpy(string, scanstat_string[i]);
-                strcat(string, SCANSTAT_WORD_SYSTEM);
-                cb->fill(cb, string,  mem->scanstat.stats[SCAN_BY_SYSTEM][i]);
-        }
-        for (i = 0; i < NR_SCANSTATS; i++) {
-                strcpy(string, scanstat_string[i]);
-                strcat(string, SCANSTAT_WORD_LIMIT);
-                strcat(string, SCANSTAT_WORD_HIERARCHY);
-                cb->fill(cb, string,  mem->scanstat.rootstats[SCAN_BY_LIMIT][i]);
-        }
-        for (i = 0; i < NR_SCANSTATS; i++) {
-                strcpy(string, scanstat_string[i]);
-                strcat(string, SCANSTAT_WORD_SYSTEM);
-                strcat(string, SCANSTAT_WORD_HIERARCHY);
-                cb->fill(cb, string,  mem->scanstat.rootstats[SCAN_BY_SYSTEM][i]);
-        }
-        return 0;
-}
-static int mem_cgroup_reset_vmscan_stat(struct cgroup *cgrp,
-                                unsigned int event)
-{
-        struct mem_cgroup *mem = mem_cgroup_from_cont(cgrp);
-        spin_lock(&mem->scanstat.lock);
-        memset(&mem->scanstat.stats, 0, sizeof(mem->scanstat.stats));
-        memset(&mem->scanstat.rootstats, 0, sizeof(mem->scanstat.rootstats));
-        spin_unlock(&mem->scanstat.lock);
-        return 0;
-}
 static struct cftype mem_cgroup_files[] = {
        {
                .name = "usage_in_bytes",
@@ -4839,11 +4673,6 @@ static struct cftype mem_cgroup_files[] = {
                .mode = S_IRUGO,
        },
 #endif
-        {
-                .name = "vmscan_stat",
-                .read_map = mem_cgroup_vmscan_stat_read,
-                .trigger = mem_cgroup_reset_vmscan_stat,
-        },
 };
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
@@ -5107,7 +4936,6 @@ mem_cgroup_create(struct cgroup_subsys *ss, struct cgroup *cont)
        atomic_set(&mem->refcnt, 1);
        mem->move_charge_at_immigrate = 0;
        mutex_init(&mem->thresholds_lock);
-        spin_lock_init(&mem->scanstat.lock);
        return &mem->css;
 free_out:
        __mem_cgroup_free(mem);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 8b57173c1dd5..9c51f9f58cac 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -636,7 +636,6 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
        struct vm_area_struct *prev;
        struct vm_area_struct *vma;
        int err = 0;
-        pgoff_t pgoff;
        unsigned long vmstart;
        unsigned long vmend;
@@ -649,9 +648,9 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                vmstart = max(start, vma->vm_start);
                vmend   = min(end, vma->vm_end);
-                pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT);
                prev = vma_merge(mm, prev, vmstart, vmend, vma->vm_flags,
-                                  vma->anon_vma, vma->vm_file, pgoff, new_pol);
+                                  vma->anon_vma, vma->vm_file, vma->vm_pgoff,
+                                  new_pol);
                if (prev) {
                        vma = prev;
                        next = vma->vm_next;
@@ -1412,7 +1411,9 @@ asmlinkage long compat_sys_get_mempolicy(int __user *policy,
        err = sys_get_mempolicy(policy, nm, nr_bits+1, addr, flags);
        if (!err && nmask) {
-                err = copy_from_user(bm, nm, alloc_size);
+                unsigned long copy_size;
+                copy_size = min_t(unsigned long, sizeof(bm), alloc_size);
+                err = copy_from_user(bm, nm, copy_size);
                /* ensure entire bitmap is zeroed */
                err |= clear_user(nmask, ALIGN(maxnode-1, 8) / 8);
                err |= compat_put_bitmap(nmask, bm, nr_bits);
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index d1960744f881..0e309cd1b5b9 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -754,21 +754,10 @@ static void balance_dirty_pages(struct address_space *mapping,
                 * 200ms is typically more than enough to curb heavy dirtiers;
                 * (b) the pause time limit makes the dirtiers more responsive.
                 */
-                if (nr_dirty < dirty_thresh +
+                if (nr_dirty < dirty_thresh &&
-                               dirty_thresh / DIRTY_MAXPAUSE_AREA &&
+                    bdi_dirty < (task_bdi_thresh + bdi_thresh) / 2 &&
                    time_after(jiffies, start_time + MAX_PAUSE))
                        break;
-                /*
-                 * pass-good area. When some bdi gets blocked (eg. NFS server
-                 * not responding), or write bandwidth dropped dramatically due
-                 * to concurrent reads, or dirty threshold suddenly dropped and
-                 * the dirty pages cannot be brought down anytime soon (eg. on
-                 * slow USB stick), at least let go of the good bdi's.
-                 */
-                if (nr_dirty < dirty_thresh +
-                               dirty_thresh / DIRTY_PASSGOOD_AREA &&
-                    bdi_dirty < bdi_thresh)
-                        break;
                /*
                 * Increase the delay for each loop, up to our previous
diff --git a/mm/slub.c b/mm/slub.c
index 9f662d70eb47..7c54fe83a90c 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2377,7 +2377,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
                 */
                if (unlikely(!prior)) {
                        remove_full(s, page);
-                        add_partial(n, page, 0);
+                        add_partial(n, page, 1);
                        stat(s, FREE_ADD_PARTIAL);
                }
        }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 7ef0903058ee..5016f19e1661 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2140,6 +2140,14 @@ struct vm_struct *alloc_vm_area(size_t size)
                return NULL;
        }
+        /*
+         * If the allocated address space is passed to a hypercall
+         * before being used then we cannot rely on a page fault to
+         * trigger an update of the page tables.  So sync all the page
+         * tables here.
+         */
+        vmalloc_sync_all();
        return area;
 }
 EXPORT_SYMBOL_GPL(alloc_vm_area);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 7ef69124fa3e..b55699cd9067 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -105,7 +105,6 @@ struct scan_control {
        /* Which cgroup do we reclaim from */
        struct mem_cgroup *mem_cgroup;
-        struct memcg_scanrecord *memcg_record;
        /*
         * Nodemask of nodes allowed by the caller. If NULL, all nodes
@@ -1349,8 +1348,6 @@ putback_lru_pages(struct zone *zone, struct scan_control *sc,
                        int file = is_file_lru(lru);
                        int numpages = hpage_nr_pages(page);
                        reclaim_stat->recent_rotated[file] += numpages;
-                        if (!scanning_global_lru(sc))
-                                sc->memcg_record->nr_rotated[file] += numpages;
                }
                if (!pagevec_add(&pvec, page)) {
                        spin_unlock_irq(&zone->lru_lock);
@@ -1394,10 +1391,6 @@ static noinline_for_stack void update_isolated_counts(struct zone *zone,
        reclaim_stat->recent_scanned[0] += *nr_anon;
        reclaim_stat->recent_scanned[1] += *nr_file;
-        if (!scanning_global_lru(sc)) {
-                sc->memcg_record->nr_scanned[0] += *nr_anon;
-                sc->memcg_record->nr_scanned[1] += *nr_file;
-        }
 }
 /*
@@ -1511,9 +1504,6 @@ shrink_inactive_list(unsigned long nr_to_scan, struct zone *zone,
                nr_reclaimed += shrink_page_list(&page_list, zone, sc);
        }
-        if (!scanning_global_lru(sc))
-                sc->memcg_record->nr_freed[file] += nr_reclaimed;
        local_irq_disable();
        if (current_is_kswapd())
                __count_vm_events(KSWAPD_STEAL, nr_reclaimed);
@@ -1613,8 +1603,6 @@ static void shrink_active_list(unsigned long nr_pages, struct zone *zone,
        }
        reclaim_stat->recent_scanned[file] += nr_taken;
-        if (!scanning_global_lru(sc))
-                sc->memcg_record->nr_scanned[file] += nr_taken;
        __count_zone_vm_events(PGREFILL, zone, pgscanned);
        if (file)
@@ -1666,8 +1654,6 @@ static void shrink_active_list(unsigned long nr_pages, struct zone *zone,
         * get_scan_ratio.
         */
        reclaim_stat->recent_rotated[file] += nr_rotated;
-        if (!scanning_global_lru(sc))
-                sc->memcg_record->nr_rotated[file] += nr_rotated;
        move_active_pages_to_lru(zone, &l_active,
                                                LRU_ACTIVE + file * LRU_FILE);
@@ -1808,23 +1794,15 @@ static void get_scan_count(struct zone *zone, struct scan_control *sc,
        u64 fraction[2], denominator;
        enum lru_list l;
        int noswap = 0;
-        int force_scan = 0;
+        bool force_scan = false;
        unsigned long nr_force_scan[2];
+        /* kswapd does zone balancing and needs to scan this zone */
-        anon  = zone_nr_lru_pages(zone, sc, LRU_ACTIVE_ANON) +
+        if (scanning_global_lru(sc) && current_is_kswapd())
-                zone_nr_lru_pages(zone, sc, LRU_INACTIVE_ANON);
+                force_scan = true;
-        file  = zone_nr_lru_pages(zone, sc, LRU_ACTIVE_FILE) +
+        /* memcg may have small limit and need to avoid priority drop */
-                zone_nr_lru_pages(zone, sc, LRU_INACTIVE_FILE);
+        if (!scanning_global_lru(sc))
+                force_scan = true;
-        if (((anon + file) >> priority) < SWAP_CLUSTER_MAX) {
-                /* kswapd does zone balancing and need to scan this zone */
-                if (scanning_global_lru(sc) && current_is_kswapd())
-                        force_scan = 1;
-                /* memcg may have small limit and need to avoid priority drop */
-                if (!scanning_global_lru(sc))
-                        force_scan = 1;
-        }
        /* If we have no swap space, do not bother scanning anon pages. */
        if (!sc->may_swap || (nr_swap_pages <= 0)) {
@@ -1837,6 +1815,11 @@ static void get_scan_count(struct zone *zone, struct scan_control *sc,
                goto out;
        }
+        anon  = zone_nr_lru_pages(zone, sc, LRU_ACTIVE_ANON) +
+                zone_nr_lru_pages(zone, sc, LRU_INACTIVE_ANON);
+        file  = zone_nr_lru_pages(zone, sc, LRU_ACTIVE_FILE) +
+                zone_nr_lru_pages(zone, sc, LRU_INACTIVE_FILE);
        if (scanning_global_lru(sc)) {
                free  = zone_page_state(zone, NR_FREE_PAGES);
                /* If we have very few page cache pages,
@@ -2268,10 +2251,9 @@ unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR
 unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
-                                        gfp_t gfp_mask, bool noswap,
+                                                gfp_t gfp_mask, bool noswap,
-                                        struct zone *zone,
+                                                struct zone *zone,
-                                        struct memcg_scanrecord *rec,
+                                                unsigned long *nr_scanned)
-                                        unsigned long *scanned)
 {
        struct scan_control sc = {
                .nr_scanned = 0,
@@ -2281,9 +2263,7 @@ unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
                .may_swap = !noswap,
                .order = 0,
                .mem_cgroup = mem,
-                .memcg_record = rec,
        };
-        unsigned long start, end;
        sc.gfp_mask = (gfp_mask & GFP_RECLAIM_MASK) |
                        (GFP_HIGHUSER_MOVABLE & ~GFP_RECLAIM_MASK);
@@ -2292,7 +2272,6 @@ unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
                                                      sc.may_writepage,
                                                      sc.gfp_mask);
-        start = sched_clock();
        /*
         * NOTE: Although we can get the priority field, using it
         * here is not a good idea, since it limits the pages we can scan.
@@ -2301,25 +2280,19 @@ unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
         * the priority and make it zero.
         */
        shrink_zone(0, zone, &sc);
-        end = sched_clock();
-        if (rec)
-                rec->elapsed += end - start;
-        *scanned = sc.nr_scanned;
        trace_mm_vmscan_memcg_softlimit_reclaim_end(sc.nr_reclaimed);
+        *nr_scanned = sc.nr_scanned;
        return sc.nr_reclaimed;
 }
 unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
                                           gfp_t gfp_mask,
-                                           bool noswap,
+                                           bool noswap)
-                                           struct memcg_scanrecord *rec)
 {
        struct zonelist *zonelist;
        unsigned long nr_reclaimed;
-        unsigned long start, end;
        int nid;
        struct scan_control sc = {
                .may_writepage = !laptop_mode,
@@ -2328,7 +2301,6 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
                .nr_to_reclaim = SWAP_CLUSTER_MAX,
                .order = 0,
                .mem_cgroup = mem_cont,
-                .memcg_record = rec,
                .nodemask = NULL, /* we don't care the placement */
                .gfp_mask = (gfp_mask & GFP_RECLAIM_MASK) |
                                (GFP_HIGHUSER_MOVABLE & ~GFP_RECLAIM_MASK),
@@ -2337,7 +2309,6 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
                .gfp_mask = sc.gfp_mask,
        };
-        start = sched_clock();
        /*
         * Unlike direct reclaim via alloc_pages(), memcg's reclaim doesn't
         * take care of from where we get pages. So the node where we start the
@@ -2352,9 +2323,6 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
                                            sc.gfp_mask);
        nr_reclaimed = do_try_to_free_pages(zonelist, &sc, &shrink);
-        end = sched_clock();
-        if (rec)
-                rec->elapsed += end - start;
        trace_mm_vmscan_memcg_reclaim_end(nr_reclaimed);
@@ -2529,6 +2497,9 @@ loop_again:
                                        high_wmark_pages(zone), 0, 0)) {
                                end_zone = i;
                                break;
+                        } else {
+                                /* If balanced, clear the congested flag */
+                                zone_clear_flag(zone, ZONE_CONGESTED);
                        }
                }
                if (i < 0)
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 20c18b7694b2..d52b13d28e8f 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -659,7 +659,7 @@ static void walk_zones_in_node(struct seq_file *m, pg_data_t *pgdat,
 }
 #endif
-#if defined(CONFIG_PROC_FS) || defined(CONFIG_SYSFS)
+#if defined(CONFIG_PROC_FS) || defined(CONFIG_SYSFS) || defined(CONFIG_NUMA)
 #ifdef CONFIG_ZONE_DMA
 #define TEXT_FOR_DMA(xx) xx "_dma",
 #else
@@ -788,7 +788,7 @@ const char * const vmstat_text[] = {
 #endif /* CONFIG_VM_EVENTS_COUNTERS */
 };
-#endif /* CONFIG_PROC_FS || CONFIG_SYSFS */
+#endif /* CONFIG_PROC_FS || CONFIG_SYSFS || CONFIG_NUMA */
 #ifdef CONFIG_PROC_FS
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 175b5135bdcf..e317583fcc73 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -263,7 +263,6 @@ p9_virtio_request(struct p9_client *client, struct p9_req_t *req)
 {
        int in, out, inp, outp;
        struct virtio_chan *chan = client->trans;
-        char *rdata = (char *)req->rc+sizeof(struct p9_fcall);
        unsigned long flags;
        size_t pdata_off = 0;
        struct trans_rpage_info *rpinfo = NULL;
@@ -346,7 +345,8 @@ req_retry_pinned:
                 * Arrange in such a way that server places header in the
                 * alloced memory and payload onto the user buffer.
                 */
-                inp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, rdata, 11);
+                inp = pack_sg_list(chan->sg, out,
+                                   VIRTQUEUE_NUM, req->rc->sdata, 11);
                /*
                 * Running executables in the filesystem may result in
                 * a read request with kernel buffer as opposed to user buffer.
@@ -366,8 +366,8 @@ req_retry_pinned:
                }
                in += inp;
        } else {
-                in = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, rdata,
+                in = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM,
-                                req->rc->capacity);
+                                  req->rc->sdata, req->rc->capacity);
        }
        err = virtqueue_add_buf(chan->vq, chan->sg, out, in, req->tc);
@@ -592,7 +592,14 @@ static struct p9_trans_module p9_virtio_trans = {
        .close = p9_virtio_close,
        .request = p9_virtio_request,
        .cancel = p9_virtio_cancel,
-        .maxsize = PAGE_SIZE*VIRTQUEUE_NUM,
+        /*
+         * We leave one entry for input and one entry for response
+         * headers. We also skip one more entry to accomodate, address
+         * that are not at page boundary, that can result in an extra
+         * page in zero copy.
+         */
+        .maxsize = PAGE_SIZE * (VIRTQUEUE_NUM - 3),
        .pref = P9_TRANS_PREF_PAYLOAD_SEP,
        .def = 0,
        .owner = THIS_MODULE,
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 8add9b499912..117e0d161780 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -494,9 +494,8 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
        BT_DBG("sk %p", sk);
        add_wait_queue(sk_sleep(sk), &wait);
+        set_current_state(TASK_INTERRUPTIBLE);
        while (sk->sk_state != state) {
-                set_current_state(TASK_INTERRUPTIBLE);
                if (!timeo) {
                        err = -EINPROGRESS;
                        break;
@@ -510,12 +509,13 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
                release_sock(sk);
                timeo = schedule_timeout(timeo);
                lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
                err = sock_error(sk);
                if (err)
                        break;
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        return err;
 }
diff --git a/net/bluetooth/bnep/bnep.h b/net/bluetooth/bnep/bnep.h
index 8e6c06158f8e..e7ee5314f39a 100644
--- a/net/bluetooth/bnep/bnep.h
+++ b/net/bluetooth/bnep/bnep.h
@@ -155,6 +155,7 @@ struct bnep_session {
        unsigned int  role;
        unsigned long state;
        unsigned long flags;
+        atomic_t      terminate;
        struct task_struct *task;
        struct ethhdr eh;
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index ca39fcf010ce..d9edfe8bf9d6 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -484,9 +484,11 @@ static int bnep_session(void *arg)
        init_waitqueue_entry(&wait, current);
        add_wait_queue(sk_sleep(sk), &wait);
-        while (!kthread_should_stop()) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
+                if (atomic_read(&s->terminate))
+                        break;
                /* RX */
                while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
                        skb_orphan(skb);
@@ -504,7 +506,7 @@ static int bnep_session(void *arg)
                schedule();
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        /* Cleanup session */
@@ -640,9 +642,10 @@ int bnep_del_connection(struct bnep_conndel_req *req)
        down_read(&bnep_session_sem);
        s = __bnep_get_session(req->dst);
-        if (s)
+        if (s) {
-                kthread_stop(s->task);
+                atomic_inc(&s->terminate);
-        else
+                wake_up_process(s->task);
+        } else
                err = -ENOENT;
        up_read(&bnep_session_sem);
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index 040f67b12978..50f0d135eb8f 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -386,7 +386,8 @@ static void cmtp_reset_ctr(struct capi_ctr *ctrl)
        capi_ctr_down(ctrl);
-        kthread_stop(session->task);
+        atomic_inc(&session->terminate);
+        wake_up_process(session->task);
 }
 static void cmtp_register_appl(struct capi_ctr *ctrl, __u16 appl, capi_register_params *rp)
diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
index db43b54ac9af..c32638dddbf9 100644
--- a/net/bluetooth/cmtp/cmtp.h
+++ b/net/bluetooth/cmtp/cmtp.h
@@ -81,6 +81,7 @@ struct cmtp_session {
        char name[BTNAMSIZ];
+        atomic_t terminate;
        struct task_struct *task;
        wait_queue_head_t wait;
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index c5b11af908be..521baa4fe835 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -292,9 +292,11 @@ static int cmtp_session(void *arg)
        init_waitqueue_entry(&wait, current);
        add_wait_queue(sk_sleep(sk), &wait);
-        while (!kthread_should_stop()) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
+                if (atomic_read(&session->terminate))
+                        break;
                if (sk->sk_state != BT_CONNECTED)
                        break;
@@ -307,7 +309,7 @@ static int cmtp_session(void *arg)
                schedule();
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        down_write(&cmtp_session_sem);
@@ -380,16 +382,17 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
        if (!(session->flags & (1 << CMTP_LOOPBACK))) {
                err = cmtp_attach_device(session);
-                if (err < 0)
+                if (err < 0) {
-                        goto detach;
+                        atomic_inc(&session->terminate);
+                        wake_up_process(session->task);
+                        up_write(&cmtp_session_sem);
+                        return err;
+                }
        }
        up_write(&cmtp_session_sem);
        return 0;
-detach:
-        cmtp_detach_device(session);
 unlink:
        __cmtp_unlink_session(session);
@@ -414,7 +417,8 @@ int cmtp_del_connection(struct cmtp_conndel_req *req)
                skb_queue_purge(&session->transmit);
                /* Stop session thread */
-                kthread_stop(session->task);
+                atomic_inc(&session->terminate);
+                wake_up_process(session->task);
        } else
                err = -ENOENT;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index ec0bc3f60f2e..56943add45cc 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1209,7 +1209,6 @@ static void hci_cmd_timer(unsigned long arg)
        BT_ERR("%s command tx timeout", hdev->name);
        atomic_set(&hdev->cmd_cnt, 1);
-        clear_bit(HCI_RESET, &hdev->flags);
        tasklet_schedule(&hdev->cmd_task);
 }
@@ -1327,7 +1326,7 @@ int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
        entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
        if (!entry) {
-                return -ENOMEM;
+                err = -ENOMEM;
                goto err;
        }
@@ -2408,7 +2407,10 @@ static void hci_cmd_task(unsigned long arg)
                if (hdev->sent_cmd) {
                        atomic_dec(&hdev->cmd_cnt);
                        hci_send_frame(skb);
-                        mod_timer(&hdev->cmd_timer,
+                        if (test_bit(HCI_RESET, &hdev->flags))
+                                del_timer(&hdev->cmd_timer);
+                        else
+                                mod_timer(&hdev->cmd_timer,
                                  jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
                } else {
                        skb_queue_head(&hdev->cmd_q, skb);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index a40170e022e8..7ef4eb4435fb 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -58,8 +58,8 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
        if (status)
                return;
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                        test_bit(HCI_MGMT, &hdev->flags))
                mgmt_discovering(hdev->id, 0);
        hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
@@ -76,8 +76,8 @@ static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
        if (status)
                return;
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                                test_bit(HCI_MGMT, &hdev->flags))
                mgmt_discovering(hdev->id, 0);
        hci_conn_check_pending(hdev);
@@ -959,9 +959,8 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
                return;
        }
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags) &&
-                                        !test_and_set_bit(HCI_INQUIRY,
+                                test_bit(HCI_MGMT, &hdev->flags))
-                                                        &hdev->flags))
                mgmt_discovering(hdev->id, 1);
 }
@@ -1340,8 +1339,8 @@ static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff
        BT_DBG("%s status %d", hdev->name, status);
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                                test_bit(HCI_MGMT, &hdev->flags))
                mgmt_discovering(hdev->id, 0);
        hci_req_complete(hdev, HCI_OP_INQUIRY, status);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 43b4c2deb7cc..fb68f344c34a 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -764,6 +764,7 @@ static int hidp_session(void *arg)
        up_write(&hidp_session_sem);
+        kfree(session->rd_data);
        kfree(session);
        return 0;
 }
@@ -841,7 +842,8 @@ static int hidp_setup_input(struct hidp_session *session,
        err = input_register_device(input);
        if (err < 0) {
-                hci_conn_put_device(session->conn);
+                input_free_device(input);
+                session->input = NULL;
                return err;
        }
@@ -1044,8 +1046,12 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
        }
        err = hid_add_device(session->hid);
-        if (err < 0)
+        if (err < 0) {
-                goto err_add_device;
+                atomic_inc(&session->terminate);
+                wake_up_process(session->task);
+                up_write(&hidp_session_sem);
+                return err;
+        }
        if (session->input) {
                hidp_send_ctrl_message(session,
@@ -1059,12 +1065,6 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
        up_write(&hidp_session_sem);
        return 0;
-err_add_device:
-        hid_destroy_device(session->hid);
-        session->hid = NULL;
-        atomic_inc(&session->terminate);
-        wake_up_process(session->task);
 unlink:
        hidp_del_timer(session);
@@ -1090,7 +1090,6 @@ purge:
 failed:
        up_write(&hidp_session_sem);
-        input_free_device(session->input);
        kfree(session);
        return err;
 }
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 3204ba8a701c..b3bdb482bbe6 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1159,9 +1159,8 @@ int __l2cap_wait_ack(struct sock *sk)
        int timeo = HZ/5;
        add_wait_queue(sk_sleep(sk), &wait);
-        while ((chan->unacked_frames > 0 && chan->conn)) {
+        set_current_state(TASK_INTERRUPTIBLE);
-                set_current_state(TASK_INTERRUPTIBLE);
+        while (chan->unacked_frames > 0 && chan->conn) {
                if (!timeo)
                        timeo = HZ/5;
@@ -1173,6 +1172,7 @@ int __l2cap_wait_ack(struct sock *sk)
                release_sock(sk);
                timeo = schedule_timeout(timeo);
                lock_sock(sk);
+                set_current_state(TASK_INTERRUPTIBLE);
                err = sock_error(sk);
                if (err)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 5c36b3e8739c..61f1f623091d 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -235,30 +235,26 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
        lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
        BT_DBG("sk %p timeo %ld", sk, timeo);
        /* Wait for an incoming connection. (wake-one). */
        add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                        break;
                }
-                release_sock(sk);
+                nsk = bt_accept_dequeue(sk, newsock);
-                timeo = schedule_timeout(timeo);
+                if (nsk)
-                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+                        break;
-                if (sk->sk_state != BT_LISTEN) {
+                if (!timeo) {
-                        err = -EBADFD;
+                        err = -EAGAIN;
                        break;
                }
@@ -266,8 +262,12 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
                        err = sock_intr_errno(timeo);
                        break;
                }
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        if (err)
@@ -993,7 +993,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
        INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
        sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
+        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
        sock_reset_flag(sk, SOCK_ZAPPED);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 5759bb7054f7..5ba3f6df665c 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -62,7 +62,6 @@ static DEFINE_MUTEX(rfcomm_mutex);
 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
-static unsigned long rfcomm_event;
 static LIST_HEAD(session_list);
@@ -120,7 +119,6 @@ static inline void rfcomm_schedule(void)
 {
        if (!rfcomm_thread)
                return;
-        set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
        wake_up_process(rfcomm_thread);
 }
@@ -2038,19 +2036,18 @@ static int rfcomm_run(void *unused)
        rfcomm_add_listener(BDADDR_ANY);
-        while (!kthread_should_stop()) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
-                if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
-                        /* No pending events. Let's sleep.
+                if (kthread_should_stop())
-                         * Incoming connections and data will wake us up. */
+                        break;
-                        schedule();
-                }
-                set_current_state(TASK_RUNNING);
                /* Process stuff */
-                clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
                rfcomm_process_sessions();
+                schedule();
        }
+        __set_current_state(TASK_RUNNING);
        rfcomm_kill_listener();
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 8f01e6b11a70..482722bbc7a0 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -485,11 +485,6 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
        lock_sock(sk);
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
        if (sk->sk_type != SOCK_STREAM) {
                err = -EINVAL;
                goto done;
@@ -501,19 +496,20 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
        /* Wait for an incoming connection. (wake-one). */
        add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                        break;
                }
-                release_sock(sk);
+                nsk = bt_accept_dequeue(sk, newsock);
-                timeo = schedule_timeout(timeo);
+                if (nsk)
-                lock_sock(sk);
+                        break;
-                if (sk->sk_state != BT_LISTEN) {
+                if (!timeo) {
-                        err = -EBADFD;
+                        err = -EAGAIN;
                        break;
                }
@@ -521,8 +517,12 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
                        err = sock_intr_errno(timeo);
                        break;
                }
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        if (err)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 4c3621b5e0aa..8270f05e3f1f 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -564,30 +564,26 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
        lock_sock(sk);
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
        BT_DBG("sk %p timeo %ld", sk, timeo);
        /* Wait for an incoming connection. (wake-one). */
        add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(ch = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                        break;
                }
-                release_sock(sk);
+                ch = bt_accept_dequeue(sk, newsock);
-                timeo = schedule_timeout(timeo);
+                if (ch)
-                lock_sock(sk);
+                        break;
-                if (sk->sk_state != BT_LISTEN) {
+                if (!timeo) {
-                        err = -EBADFD;
+                        err = -EAGAIN;
                        break;
                }
@@ -595,8 +591,12 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
                        err = sock_intr_errno(timeo);
                        break;
                }
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
        }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
        if (err)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2d85ca7111d3..995cbe0ac0b2 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1456,7 +1456,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 {
        struct sk_buff *skb2;
        const struct ipv6hdr *ip6h;
-        struct icmp6hdr *icmp6h;
+        u8 icmp6_type;
        u8 nexthdr;
        unsigned len;
        int offset;
@@ -1502,9 +1502,9 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
        __skb_pull(skb2, offset);
        skb_reset_transport_header(skb2);
-        icmp6h = icmp6_hdr(skb2);
+        icmp6_type = icmp6_hdr(skb2)->icmp6_type;
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
        case ICMPV6_MGM_QUERY:
        case ICMPV6_MGM_REPORT:
        case ICMPV6_MGM_REDUCTION:
@@ -1520,16 +1520,23 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                err = pskb_trim_rcsum(skb2, len);
                if (err)
                        goto out;
+                err = -EINVAL;
        }
+        ip6h = ipv6_hdr(skb2);
        switch (skb2->ip_summed) {
        case CHECKSUM_COMPLETE:
-                if (!csum_fold(skb2->csum))
+                if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, skb2->len,
+                                        IPPROTO_ICMPV6, skb2->csum))
                        break;
                /*FALLTHROUGH*/
        case CHECKSUM_NONE:
-                skb2->csum = 0;
+                skb2->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
-                if (skb_checksum_complete(skb2))
+                                                        &ip6h->daddr,
+                                                        skb2->len,
+                                                        IPPROTO_ICMPV6, 0));
+                if (__skb_checksum_complete(skb2))
                        goto out;
        }
@@ -1537,7 +1544,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
        BR_INPUT_SKB_CB(skb)->igmp = 1;
-        switch (icmp6h->icmp6_type) {
+        switch (icmp6_type) {
        case ICMPV6_MGM_REPORT:
            {
                struct mld_msg *mld;
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index ba6f73eb06c6..a9aff9c7d027 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -4,7 +4,7 @@
 menuconfig BRIDGE_NF_EBTABLES
        tristate "Ethernet Bridge tables (ebtables) support"
-        depends on BRIDGE && BRIDGE_NETFILTER
+        depends on BRIDGE && NETFILTER
        select NETFILTER_XTABLES
        help
          ebtables is a general, extensible frame/packet identification
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 7c2fa0a08148..7f9ac0742d19 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -93,10 +93,14 @@ static struct caif_device_entry *caif_device_alloc(struct net_device *dev)
        caifdevs = caif_device_list(dev_net(dev));
        BUG_ON(!caifdevs);
-        caifd = kzalloc(sizeof(*caifd), GFP_ATOMIC);
+        caifd = kzalloc(sizeof(*caifd), GFP_KERNEL);
        if (!caifd)
                return NULL;
        caifd->pcpu_refcnt = alloc_percpu(int);
+        if (!caifd->pcpu_refcnt) {
+                kfree(caifd);
+                return NULL;
+        }
        caifd->netdev = dev;
        dev_hold(dev);
        return caifd;
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 8ce926d3b2cb..9b0c32a2690c 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -857,7 +857,7 @@ static __exit void can_exit(void)
        struct net_device *dev;
        if (stats_timer)
-                del_timer(&can_stattimer);
+                del_timer_sync(&can_stattimer);
        can_remove_proc();
diff --git a/net/ceph/msgpool.c b/net/ceph/msgpool.c
index d5f2d97ac05c..1f4cb30a42c5 100644
--- a/net/ceph/msgpool.c
+++ b/net/ceph/msgpool.c
@@ -7,27 +7,37 @@
 #include <linux/ceph/msgpool.h>
-static void *alloc_fn(gfp_t gfp_mask, void *arg)
+static void *msgpool_alloc(gfp_t gfp_mask, void *arg)
 {
        struct ceph_msgpool *pool = arg;
-        void *p;
+        struct ceph_msg *msg;
-        p = ceph_msg_new(0, pool->front_len, gfp_mask);
+        msg = ceph_msg_new(0, pool->front_len, gfp_mask);
-        if (!p)
+        if (!msg) {
-                pr_err("msgpool %s alloc failed\n", pool->name);
+                dout("msgpool_alloc %s failed\n", pool->name);
-        return p;
+        } else {
+                dout("msgpool_alloc %s %p\n", pool->name, msg);
+                msg->pool = pool;
+        }
+        return msg;
 }
-static void free_fn(void *element, void *arg)
+static void msgpool_free(void *element, void *arg)
 {
-        ceph_msg_put(element);
+        struct ceph_msgpool *pool = arg;
+        struct ceph_msg *msg = element;
+        dout("msgpool_release %s %p\n", pool->name, msg);
+        msg->pool = NULL;
+        ceph_msg_put(msg);
 }
 int ceph_msgpool_init(struct ceph_msgpool *pool,
                      int front_len, int size, bool blocking, const char *name)
 {
+        dout("msgpool %s init\n", name);
        pool->front_len = front_len;
-        pool->pool = mempool_create(size, alloc_fn, free_fn, pool);
+        pool->pool = mempool_create(size, msgpool_alloc, msgpool_free, pool);
        if (!pool->pool)
                return -ENOMEM;
        pool->name = name;
@@ -36,14 +46,17 @@ int ceph_msgpool_init(struct ceph_msgpool *pool,
 void ceph_msgpool_destroy(struct ceph_msgpool *pool)
 {
+        dout("msgpool %s destroy\n", pool->name);
        mempool_destroy(pool->pool);
 }
 struct ceph_msg *ceph_msgpool_get(struct ceph_msgpool *pool,
                                  int front_len)
 {
+        struct ceph_msg *msg;
        if (front_len > pool->front_len) {
-                pr_err("msgpool_get pool %s need front %d, pool size is %d\n",
+                dout("msgpool_get %s need front %d, pool size is %d\n",
                       pool->name, front_len, pool->front_len);
                WARN_ON(1);
@@ -51,14 +64,19 @@ struct ceph_msg *ceph_msgpool_get(struct ceph_msgpool *pool,
                return ceph_msg_new(0, front_len, GFP_NOFS);
        }
-        return mempool_alloc(pool->pool, GFP_NOFS);
+        msg = mempool_alloc(pool->pool, GFP_NOFS);
+        dout("msgpool_get %s %p\n", pool->name, msg);
+        return msg;
 }
 void ceph_msgpool_put(struct ceph_msgpool *pool, struct ceph_msg *msg)
 {
+        dout("msgpool_put %s %p\n", pool->name, msg);
        /* reset msg front_len; user may have changed it */
        msg->front.iov_len = pool->front_len;
        msg->hdr.front_len = cpu_to_le32(pool->front_len);
        kref_init(&msg->kref);  /* retake single ref */
+        mempool_free(msg, pool->pool);
 }
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index ce310eee708d..16836a7df7a6 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -685,6 +685,18 @@ static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
        put_osd(osd);
 }
+static void remove_all_osds(struct ceph_osd_client *osdc)
+{
+        dout("__remove_old_osds %p\n", osdc);
+        mutex_lock(&osdc->request_mutex);
+        while (!RB_EMPTY_ROOT(&osdc->osds)) {
+                struct ceph_osd *osd = rb_entry(rb_first(&osdc->osds),
+                                                struct ceph_osd, o_node);
+                __remove_osd(osdc, osd);
+        }
+        mutex_unlock(&osdc->request_mutex);
+}
 static void __move_osd_to_lru(struct ceph_osd_client *osdc,
                              struct ceph_osd *osd)
 {
@@ -701,14 +713,14 @@ static void __remove_osd_from_lru(struct ceph_osd *osd)
                list_del_init(&osd->o_osd_lru);
 }
-static void remove_old_osds(struct ceph_osd_client *osdc, int remove_all)
+static void remove_old_osds(struct ceph_osd_client *osdc)
 {
        struct ceph_osd *osd, *nosd;
        dout("__remove_old_osds %p\n", osdc);
        mutex_lock(&osdc->request_mutex);
        list_for_each_entry_safe(osd, nosd, &osdc->osd_lru, o_osd_lru) {
-                if (!remove_all && time_before(jiffies, osd->lru_ttl))
+                if (time_before(jiffies, osd->lru_ttl))
                        break;
                __remove_osd(osdc, osd);
        }
@@ -751,6 +763,7 @@ static void __insert_osd(struct ceph_osd_client *osdc, struct ceph_osd *new)
        struct rb_node *parent = NULL;
        struct ceph_osd *osd = NULL;
+        dout("__insert_osd %p osd%d\n", new, new->o_osd);
        while (*p) {
                parent = *p;
                osd = rb_entry(parent, struct ceph_osd, o_node);
@@ -1144,7 +1157,7 @@ static void handle_osds_timeout(struct work_struct *work)
        dout("osds timeout\n");
        down_read(&osdc->map_sem);
-        remove_old_osds(osdc, 0);
+        remove_old_osds(osdc);
        up_read(&osdc->map_sem);
        schedule_delayed_work(&osdc->osds_timeout_work,
@@ -1862,8 +1875,7 @@ void ceph_osdc_stop(struct ceph_osd_client *osdc)
                ceph_osdmap_destroy(osdc->osdmap);
                osdc->osdmap = NULL;
        }
-        remove_old_osds(osdc, 1);
+        remove_all_osds(osdc);
-        WARN_ON(!RB_EMPTY_ROOT(&osdc->osds));
        mempool_destroy(osdc->req_mempool);
        ceph_msgpool_destroy(&osdc->msgpool_op);
        ceph_msgpool_destroy(&osdc->msgpool_op_reply);
diff --git a/net/core/dev.c b/net/core/dev.c
index 17d67b579beb..b10ff0a71855 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1515,6 +1515,14 @@ static inline bool is_skb_forwardable(struct net_device *dev,
 */
 int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 {
+        if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) {
+                if (skb_copy_ubufs(skb, GFP_ATOMIC)) {
+                        atomic_long_inc(&dev->rx_dropped);
+                        kfree_skb(skb);
+                        return NET_RX_DROP;
+                }
+        }
        skb_orphan(skb);
        nf_reset(skb);
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index e7ab0c0285b5..3231b468bb72 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -384,8 +384,8 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 */
                list_for_each_entry(r, &ops->rules_list, list) {
                        if (r->action == FR_ACT_GOTO &&
-                            r->target == rule->pref) {
+                            r->target == rule->pref &&
-                                BUG_ON(rtnl_dereference(r->ctarget) != NULL);
+                            rtnl_dereference(r->ctarget) == NULL) {
                                rcu_assign_pointer(r->ctarget, rule);
                                if (--ops->unresolved_rules == 0)
                                        break;
diff --git a/net/core/flow.c b/net/core/flow.c
index bf32c33cad3b..555a456efb07 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -30,6 +30,7 @@ struct flow_cache_entry {
                struct hlist_node       hlist;
                struct list_head        gc_list;
        } u;
+        struct net                      *net;
        u16                             family;
        u8                              dir;
        u32                             genid;
@@ -172,29 +173,26 @@ static void flow_new_hash_rnd(struct flow_cache *fc,
 static u32 flow_hash_code(struct flow_cache *fc,
                          struct flow_cache_percpu *fcp,
-                          const struct flowi *key)
+                          const struct flowi *key,
+                          size_t keysize)
 {
        const u32 *k = (const u32 *) key;
+        const u32 length = keysize * sizeof(flow_compare_t) / sizeof(u32);
-        return jhash2(k, (sizeof(*key) / sizeof(u32)), fcp->hash_rnd)
+        return jhash2(k, length, fcp->hash_rnd)
                & (flow_cache_hash_size(fc) - 1);
 }
-typedef unsigned long flow_compare_t;
 /* I hear what you're saying, use memcmp.  But memcmp cannot make
- * important assumptions that we can here, such as alignment and
+ * important assumptions that we can here, such as alignment.
- * constant size.
 */
-static int flow_key_compare(const struct flowi *key1, const struct flowi *key2)
+static int flow_key_compare(const struct flowi *key1, const struct flowi *key2,
+                            size_t keysize)
 {
        const flow_compare_t *k1, *k1_lim, *k2;
-        const int n_elem = sizeof(struct flowi) / sizeof(flow_compare_t);
-        BUILD_BUG_ON(sizeof(struct flowi) % sizeof(flow_compare_t));
        k1 = (const flow_compare_t *) key1;
-        k1_lim = k1 + n_elem;
+        k1_lim = k1 + keysize;
        k2 = (const flow_compare_t *) key2;
@@ -215,6 +213,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
        struct flow_cache_entry *fle, *tfle;
        struct hlist_node *entry;
        struct flow_cache_object *flo;
+        size_t keysize;
        unsigned int hash;
        local_bh_disable();
@@ -222,6 +221,11 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
        fle = NULL;
        flo = NULL;
+        keysize = flow_key_size(family);
+        if (!keysize)
+                goto nocache;
        /* Packet really early in init?  Making flow_cache_init a
         * pre-smp initcall would solve this.  --RR */
        if (!fcp->hash_table)
@@ -230,11 +234,12 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
        if (fcp->hash_rnd_recalc)
                flow_new_hash_rnd(fc, fcp);
-        hash = flow_hash_code(fc, fcp, key);
+        hash = flow_hash_code(fc, fcp, key, keysize);
        hlist_for_each_entry(tfle, entry, &fcp->hash_table[hash], u.hlist) {
-                if (tfle->family == family &&
+                if (tfle->net == net &&
+                    tfle->family == family &&
                    tfle->dir == dir &&
-                    flow_key_compare(key, &tfle->key) == 0) {
+                    flow_key_compare(key, &tfle->key, keysize) == 0) {
                        fle = tfle;
                        break;
                }
@@ -246,9 +251,10 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                fle = kmem_cache_alloc(flow_cachep, GFP_ATOMIC);
                if (fle) {
+                        fle->net = net;
                        fle->family = family;
                        fle->dir = dir;
-                        memcpy(&fle->key, key, sizeof(*key));
+                        memcpy(&fle->key, key, keysize * sizeof(flow_compare_t));
                        fle->object = NULL;
                        hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
                        fcp->hash_count++;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 8fab9b0bb203..1334d7e56f02 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1319,11 +1319,15 @@ static void neigh_proxy_process(unsigned long arg)
                if (tdif <= 0) {
                        struct net_device *dev = skb->dev;
                        __skb_unlink(skb, &tbl->proxy_queue);
-                        if (tbl->proxy_redo && netif_running(dev))
+                        if (tbl->proxy_redo && netif_running(dev)) {
+                                rcu_read_lock();
                                tbl->proxy_redo(skb);
-                        else
+                                rcu_read_unlock();
+                        } else {
                                kfree_skb(skb);
+                        }
                        dev_put(dev);
                } else if (!sched_next || tdif < sched_next)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index adf84dd8c7b5..52622517e0d8 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -558,13 +558,14 @@ int __netpoll_rx(struct sk_buff *skb)
        if (skb_shared(skb))
                goto out;
-        iph = (struct iphdr *)skb->data;
        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                goto out;
+        iph = (struct iphdr *)skb->data;
        if (iph->ihl < 5 || iph->version != 4)
                goto out;
        if (!pskb_may_pull(skb, iph->ihl*4))
                goto out;
+        iph = (struct iphdr *)skb->data;
        if (ip_fast_csum((u8 *)iph, iph->ihl) != 0)
                goto out;
@@ -579,6 +580,7 @@ int __netpoll_rx(struct sk_buff *skb)
        if (pskb_trim_rcsum(skb, len))
                goto out;
+        iph = (struct iphdr *)skb->data;
        if (iph->protocol != IPPROTO_UDP)
                goto out;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 27002dffe7ed..387703f56fce 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -611,8 +611,21 @@ struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src)
 }
 EXPORT_SYMBOL_GPL(skb_morph);
-/* skb frags copy userspace buffers to kernel */
+/*      skb_copy_ubufs  -       copy userspace skb frags buffers to kernel
-static int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
+ *      @skb: the skb to modify
+ *      @gfp_mask: allocation priority
+ *
+ *      This must be called on SKBTX_DEV_ZEROCOPY skb.
+ *      It will copy all frags into kernel and drop the reference
+ *      to userspace pages.
+ *
+ *      If this function is called from an interrupt gfp_mask() must be
+ *      %GFP_ATOMIC.
+ *
+ *      Returns 0 on success or a negative error code on failure
+ *      to allocate kernel memory to copy to.
+ */
+int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
 {
        int i;
        int num_frags = skb_shinfo(skb)->nr_frags;
@@ -652,6 +665,8 @@ static int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
                skb_shinfo(skb)->frags[i - 1].page = head;
                head = (struct page *)head->private;
        }
+        skb_shinfo(skb)->tx_flags &= ~SKBTX_DEV_ZEROCOPY;
        return 0;
 }
@@ -677,7 +692,6 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
        if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) {
                if (skb_copy_ubufs(skb, gfp_mask))
                        return NULL;
-                skb_shinfo(skb)->tx_flags &= ~SKBTX_DEV_ZEROCOPY;
        }
        n = skb + 1;
@@ -803,7 +817,6 @@ struct sk_buff *pskb_copy(struct sk_buff *skb, gfp_t gfp_mask)
                                n = NULL;
                                goto out;
                        }
-                        skb_shinfo(skb)->tx_flags &= ~SKBTX_DEV_ZEROCOPY;
                }
                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                        skb_shinfo(n)->frags[i] = skb_shinfo(skb)->frags[i];
@@ -896,7 +909,6 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) {
                        if (skb_copy_ubufs(skb, gfp_mask))
                                goto nofrags;
-                        skb_shinfo(skb)->tx_flags &= ~SKBTX_DEV_ZEROCOPY;
                }
                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
                        get_page(skb_shinfo(skb)->frags[i].page);
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 27997d35ebd3..a2468363978e 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -340,7 +340,7 @@ void ether_setup(struct net_device *dev)
        dev->addr_len           = ETH_ALEN;
        dev->tx_queue_len       = 1000; /* Ethernet wants good queues */
        dev->flags              = IFF_BROADCAST|IFF_MULTICAST;
-        dev->priv_flags         = IFF_TX_SKB_SHARING;
+        dev->priv_flags         |= IFF_TX_SKB_SHARING;
        memset(dev->broadcast, 0xFF, ETH_ALEN);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1b745d412cf6..dd2b9478ddd1 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -466,8 +466,13 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                goto out;
        if (addr->sin_family != AF_INET) {
+                /* Compatibility games : accept AF_UNSPEC (mapped to AF_INET)
+                 * only if s_addr is INADDR_ANY.
+                 */
                err = -EAFNOSUPPORT;
-                goto out;
+                if (addr->sin_family != AF_UNSPEC ||
+                    addr->sin_addr.s_addr != htonl(INADDR_ANY))
+                        goto out;
        }
        chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 33e2c35b74b7..80106d89d548 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -142,6 +142,14 @@ const struct fib_prop fib_props[RTN_MAX + 1] = {
 };
 /* Release a nexthop info record */
+static void free_fib_info_rcu(struct rcu_head *head)
+{
+        struct fib_info *fi = container_of(head, struct fib_info, rcu);
+        if (fi->fib_metrics != (u32 *) dst_default_metrics)
+                kfree(fi->fib_metrics);
+        kfree(fi);
+}
 void free_fib_info(struct fib_info *fi)
 {
@@ -156,7 +164,7 @@ void free_fib_info(struct fib_info *fi)
        } endfor_nexthops(fi);
        fib_info_cnt--;
        release_net(fi->fib_net);
-        kfree_rcu(fi, rcu);
+        call_rcu(&fi->rcu, free_fib_info_rcu);
 }
 void fib_release_info(struct fib_info *fi)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 283c0a26e03f..d577199eabd5 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -767,7 +767,7 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
                        break;
                for (i=0; i<nsrcs; i++) {
                        /* skip inactive filters */
-                        if (pmc->sfcount[MCAST_INCLUDE] ||
+                        if (psf->sf_count[MCAST_INCLUDE] ||
                            pmc->sfcount[MCAST_EXCLUDE] !=
                            psf->sf_count[MCAST_EXCLUDE])
                                continue;
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 5c9b9d963918..e59aabd0eae4 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -218,6 +218,7 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
        return skb;
 nlmsg_failure:
+        kfree_skb(skb);
        *errp = -EINVAL;
        printk(KERN_ERR "ip_queue: error creating packet message\n");
        return NULL;
@@ -313,7 +314,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
 {
        struct nf_queue_entry *entry;
-        if (vmsg->value > NF_MAX_VERDICT)
+        if (vmsg->value > NF_MAX_VERDICT || vmsg->value == NF_STOLEN)
                return -EINVAL;
        entry = ipq_find_dequeue_entry(vmsg->id);
@@ -358,12 +359,9 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
                break;
        case IPQM_VERDICT:
-                if (pmsg->msg.verdict.value > NF_MAX_VERDICT)
+                status = ipq_set_verdict(&pmsg->msg.verdict,
-                        status = -EINVAL;
+                                         len - sizeof(*pmsg));
-                else
+                break;
-                        status = ipq_set_verdict(&pmsg->msg.verdict,
-                                                 len - sizeof(*pmsg));
-                        break;
        default:
                status = -EINVAL;
        }
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index b14ec7d03b6e..4bfad5da94f4 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -254,6 +254,8 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPDeferAcceptDrop", LINUX_MIB_TCPDEFERACCEPTDROP),
        SNMP_MIB_ITEM("IPReversePathFilter", LINUX_MIB_IPRPFILTER),
        SNMP_MIB_ITEM("TCPTimeWaitOverflow", LINUX_MIB_TCPTIMEWAITOVERFLOW),
+        SNMP_MIB_ITEM("TCPReqQFullDoCookies", LINUX_MIB_TCPREQQFULLDOCOOKIES),
+        SNMP_MIB_ITEM("TCPReqQFullDrop", LINUX_MIB_TCPREQQFULLDROP),
        SNMP_MIB_SENTINEL
 };
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index ea0d2183df4b..21fab3edb92c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1124,7 +1124,7 @@ static int tcp_is_sackblock_valid(struct tcp_sock *tp, int is_dsack,
                return 0;
        /* ...Then it's D-SACK, and must reside below snd_una completely */
-        if (!after(end_seq, tp->snd_una))
+        if (after(end_seq, tp->snd_una))
                return 0;
        if (!before(start_seq, tp->undo_marker))
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1c12b8ec849d..c34f01513945 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -808,20 +808,38 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
        kfree(inet_rsk(req)->opt);
 }
-static void syn_flood_warning(const struct sk_buff *skb)
+/*
+ * Return 1 if a syncookie should be sent
+ */
+int tcp_syn_flood_action(struct sock *sk,
+                         const struct sk_buff *skb,
+                         const char *proto)
 {
-        const char *msg;
+        const char *msg = "Dropping request";
+        int want_cookie = 0;
+        struct listen_sock *lopt;
 #ifdef CONFIG_SYN_COOKIES
-        if (sysctl_tcp_syncookies)
+        if (sysctl_tcp_syncookies) {
                msg = "Sending cookies";
-        else
+                want_cookie = 1;
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES);
+        } else
 #endif
-                msg = "Dropping request";
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
-        pr_info("TCP: Possible SYN flooding on port %d. %s.\n",
+        lopt = inet_csk(sk)->icsk_accept_queue.listen_opt;
-                                ntohs(tcp_hdr(skb)->dest), msg);
+        if (!lopt->synflood_warned) {
+                lopt->synflood_warned = 1;
+                pr_info("%s: Possible SYN flooding on port %d. %s. "
+                        " Check SNMP counters.\n",
+                        proto, ntohs(tcp_hdr(skb)->dest), msg);
+        }
+        return want_cookie;
 }
+EXPORT_SYMBOL(tcp_syn_flood_action);
 /*
 * Save and compile IPv4 options into the request_sock if needed.
@@ -1235,11 +1253,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
        __be32 saddr = ip_hdr(skb)->saddr;
        __be32 daddr = ip_hdr(skb)->daddr;
        __u32 isn = TCP_SKB_CB(skb)->when;
-#ifdef CONFIG_SYN_COOKIES
        int want_cookie = 0;
-#else
-#define want_cookie 0 /* Argh, why doesn't gcc optimize this :( */
-#endif
        /* Never answer to SYNs send to broadcast or multicast */
        if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -1250,14 +1264,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         * evidently real one.
         */
        if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
-                if (net_ratelimit())
+                want_cookie = tcp_syn_flood_action(sk, skb, "TCP");
-                        syn_flood_warning(skb);
+                if (!want_cookie)
-#ifdef CONFIG_SYN_COOKIES
+                        goto drop;
-                if (sysctl_tcp_syncookies) {
-                        want_cookie = 1;
-                } else
-#endif
-                goto drop;
        }
        /* Accept backlog is full. If we have already queued enough
@@ -1303,9 +1312,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                while (l-- > 0)
                        *c++ ^= *hash_location++;
-#ifdef CONFIG_SYN_COOKIES
                want_cookie = 0;        /* not our kind of cookie */
-#endif
                tmp_ext.cookie_out_never = 0; /* false */
                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
        } else if (!tp->rx_opt.cookie_in_always) {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f012ebd87b43..12368c586068 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                        "%s(): cannot allocate memory for statistics; dev=%s.\n",
                        __func__, dev->name));
                neigh_parms_release(&nd_tbl, ndev->nd_parms);
-                ndev->dead = 1;
+                dev_put(dev);
-                in6_dev_finish_destroy(ndev);
+                kfree(ndev);
                return NULL;
        }
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 9ef1831746ef..b46e9f88ce37 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -599,7 +599,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
        return 0;
 }
-int datagram_send_ctl(struct net *net,
+int datagram_send_ctl(struct net *net, struct sock *sk,
                      struct msghdr *msg, struct flowi6 *fl6,
                      struct ipv6_txoptions *opt,
                      int *hlimit, int *tclass, int *dontfrag)
@@ -658,7 +658,8 @@ int datagram_send_ctl(struct net *net,
                        if (addr_type != IPV6_ADDR_ANY) {
                                int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL;
-                                if (!ipv6_chk_addr(net, &src_info->ipi6_addr,
+                                if (!inet_sk(sk)->transparent &&
+                                    !ipv6_chk_addr(net, &src_info->ipi6_addr,
                                                   strict ? dev : NULL, 0))
                                        err = -EINVAL;
                                else
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index f3caf1b8d572..543039450193 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -322,8 +322,8 @@ static int fl6_renew(struct ip6_flowlabel *fl, unsigned long linger, unsigned lo
 }
 static struct ip6_flowlabel *
-fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
+fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
-          int optlen, int *err_p)
+          char __user *optval, int optlen, int *err_p)
 {
        struct ip6_flowlabel *fl = NULL;
        int olen;
@@ -360,7 +360,7 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                msg.msg_control = (void*)(fl->opt+1);
                memset(&flowi6, 0, sizeof(flowi6));
-                err = datagram_send_ctl(net, &msg, &flowi6, fl->opt, &junk,
+                err = datagram_send_ctl(net, sk, &msg, &flowi6, fl->opt, &junk,
                                        &junk, &junk);
                if (err)
                        goto done;
@@ -528,7 +528,7 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
                if (freq.flr_label & ~IPV6_FLOWLABEL_MASK)
                        return -EINVAL;
-                fl = fl_create(net, &freq, optval, optlen, &err);
+                fl = fl_create(net, sk, &freq, optval, optlen, &err);
                if (fl == NULL)
                        return err;
                sfl1 = kmalloc(sizeof(*sfl1), GFP_KERNEL);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 147ede38ab48..2fbda5fc4cc4 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -475,7 +475,7 @@ sticky_done:
                msg.msg_controllen = optlen;
                msg.msg_control = (void*)(opt+1);
-                retv = datagram_send_ctl(net, &msg, &fl6, opt, &junk, &junk,
+                retv = datagram_send_ctl(net, sk, &msg, &fl6, opt, &junk, &junk,
                                         &junk);
                if (retv)
                        goto done;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 3e6ebcdb4779..ee7839f4d6e3 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1059,7 +1059,7 @@ static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
                        break;
                for (i=0; i<nsrcs; i++) {
                        /* skip inactive filters */
-                        if (pmc->mca_sfcount[MCAST_INCLUDE] ||
+                        if (psf->sf_count[MCAST_INCLUDE] ||
                            pmc->mca_sfcount[MCAST_EXCLUDE] !=
                            psf->sf_count[MCAST_EXCLUDE])
                                continue;
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 249394863284..e63c3972a739 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -218,6 +218,7 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
        return skb;
 nlmsg_failure:
+        kfree_skb(skb);
        *errp = -EINVAL;
        printk(KERN_ERR "ip6_queue: error creating packet message\n");
        return NULL;
@@ -313,7 +314,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
 {
        struct nf_queue_entry *entry;
-        if (vmsg->value > NF_MAX_VERDICT)
+        if (vmsg->value > NF_MAX_VERDICT || vmsg->value == NF_STOLEN)
                return -EINVAL;
        entry = ipq_find_dequeue_entry(vmsg->id);
@@ -358,12 +359,9 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
                break;
        case IPQM_VERDICT:
-                if (pmsg->msg.verdict.value > NF_MAX_VERDICT)
+                status = ipq_set_verdict(&pmsg->msg.verdict,
-                        status = -EINVAL;
+                                         len - sizeof(*pmsg));
-                else
+                break;
-                        status = ipq_set_verdict(&pmsg->msg.verdict,
-                                                 len - sizeof(*pmsg));
-                        break;
        default:
                status = -EINVAL;
        }
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 6a79f3081bdb..343852e5c703 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -817,8 +817,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(struct ipv6_txoptions);
-                err = datagram_send_ctl(sock_net(sk), msg, &fl6, opt, &hlimit,
+                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &tclass, &dontfrag);
+                                        &hlimit, &tclass, &dontfrag);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9e69eb0ec6dd..1250f9020670 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -104,6 +104,9 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
        struct inet_peer *peer;
        u32 *p = NULL;
+        if (!(rt->dst.flags & DST_HOST))
+                return NULL;
        if (!rt->rt6i_peer)
                rt6_bind_peer(rt, 1);
@@ -252,6 +255,9 @@ static void ip6_dst_destroy(struct dst_entry *dst)
        struct inet6_dev *idev = rt->rt6i_idev;
        struct inet_peer *peer = rt->rt6i_peer;
+        if (!(rt->dst.flags & DST_HOST))
+                dst_destroy_metrics_generic(dst);
        if (idev != NULL) {
                rt->rt6i_idev = NULL;
                in6_dev_put(idev);
@@ -723,9 +729,7 @@ static struct rt6_info *rt6_alloc_cow(const struct rt6_info *ort,
                        ipv6_addr_copy(&rt->rt6i_gateway, daddr);
                }
-                rt->rt6i_dst.plen = 128;
                rt->rt6i_flags |= RTF_CACHE;
-                rt->dst.flags |= DST_HOST;
 #ifdef CONFIG_IPV6_SUBTREES
                if (rt->rt6i_src.plen && saddr) {
@@ -775,9 +779,7 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort,
        struct rt6_info *rt = ip6_rt_copy(ort, daddr);
        if (rt) {
-                rt->rt6i_dst.plen = 128;
                rt->rt6i_flags |= RTF_CACHE;
-                rt->dst.flags |= DST_HOST;
                dst_set_neighbour(&rt->dst, neigh_clone(dst_get_neighbour_raw(&ort->dst)));
        }
        return rt;
@@ -1078,12 +1080,15 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
                        neigh = NULL;
        }
-        rt->rt6i_idev     = idev;
+        rt->dst.flags |= DST_HOST;
+        rt->dst.output  = ip6_output;
        dst_set_neighbour(&rt->dst, neigh);
        atomic_set(&rt->dst.__refcnt, 1);
-        ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 255);
-        rt->dst.output  = ip6_output;
+        ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
+        rt->rt6i_dst.plen = 128;
+        rt->rt6i_idev     = idev;
        spin_lock_bh(&icmp6_dst_lock);
        rt->dst.next = icmp6_dst_gc_list;
@@ -1261,6 +1266,14 @@ int ip6_route_add(struct fib6_config *cfg)
        if (rt->rt6i_dst.plen == 128)
               rt->dst.flags |= DST_HOST;
+        if (!(rt->dst.flags & DST_HOST) && cfg->fc_mx) {
+                u32 *metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+                if (!metrics) {
+                        err = -ENOMEM;
+                        goto out;
+                }
+                dst_init_metrics(&rt->dst, metrics, 0);
+        }
 #ifdef CONFIG_IPV6_SUBTREES
        ipv6_addr_prefix(&rt->rt6i_src.addr, &cfg->fc_src, cfg->fc_src_len);
        rt->rt6i_src.plen = cfg->fc_src_len;
@@ -1607,9 +1620,6 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
        if (on_link)
                nrt->rt6i_flags &= ~RTF_GATEWAY;
-        nrt->rt6i_dst.plen = 128;
-        nrt->dst.flags |= DST_HOST;
        ipv6_addr_copy(&nrt->rt6i_gateway, (struct in6_addr*)neigh->primary_key);
        dst_set_neighbour(&nrt->dst, neigh_clone(neigh));
@@ -1754,9 +1764,10 @@ static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
        if (rt) {
                rt->dst.input = ort->dst.input;
                rt->dst.output = ort->dst.output;
+                rt->dst.flags |= DST_HOST;
                ipv6_addr_copy(&rt->rt6i_dst.addr, dest);
-                rt->rt6i_dst.plen = ort->rt6i_dst.plen;
+                rt->rt6i_dst.plen = 128;
                dst_copy_metrics(&rt->dst, &ort->dst);
                rt->dst.error = ort->dst.error;
                rt->rt6i_idev = ort->rt6i_idev;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index d1fb63f4aeb7..3c9fa618b69d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -531,20 +531,6 @@ static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
        return tcp_v6_send_synack(sk, req, rvp);
 }
-static inline void syn_flood_warning(struct sk_buff *skb)
-{
-#ifdef CONFIG_SYN_COOKIES
-        if (sysctl_tcp_syncookies)
-                printk(KERN_INFO
-                       "TCPv6: Possible SYN flooding on port %d. "
-                       "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
-        else
-#endif
-                printk(KERN_INFO
-                       "TCPv6: Possible SYN flooding on port %d. "
-                       "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
-}
 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 {
        kfree_skb(inet6_rsk(req)->pktopts);
@@ -1179,11 +1165,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        struct tcp_sock *tp = tcp_sk(sk);
        __u32 isn = TCP_SKB_CB(skb)->when;
        struct dst_entry *dst = NULL;
-#ifdef CONFIG_SYN_COOKIES
        int want_cookie = 0;
-#else
-#define want_cookie 0
-#endif
        if (skb->protocol == htons(ETH_P_IP))
                return tcp_v4_conn_request(sk, skb);
@@ -1192,14 +1174,9 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                goto drop;
        if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
-                if (net_ratelimit())
+                want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
-                        syn_flood_warning(skb);
+                if (!want_cookie)
-#ifdef CONFIG_SYN_COOKIES
+                        goto drop;
-                if (sysctl_tcp_syncookies)
-                        want_cookie = 1;
-                else
-#endif
-                goto drop;
        }
        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
@@ -1249,9 +1226,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                while (l-- > 0)
                        *c++ ^= *hash_location++;
-#ifdef CONFIG_SYN_COOKIES
                want_cookie = 0;        /* not our kind of cookie */
-#endif
                tmp_ext.cookie_out_never = 0; /* false */
                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
        } else if (!tp->rx_opt.cookie_in_always) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 29213b51c499..bb95e8e1c6f9 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1090,8 +1090,8 @@ do_udp_sendmsg:
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(*opt);
-                err = datagram_send_ctl(sock_net(sk), msg, &fl6, opt, &hlimit,
+                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &tclass, &dontfrag);
+                                        &hlimit, &tclass, &dontfrag);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
diff --git a/net/irda/irsysctl.c b/net/irda/irsysctl.c
index d0b70dadf73b..2615ffc8e785 100644
--- a/net/irda/irsysctl.c
+++ b/net/irda/irsysctl.c
@@ -40,9 +40,9 @@ extern int  sysctl_slot_timeout;
 extern int  sysctl_fast_poll_increase;
 extern char sysctl_devname[];
 extern int  sysctl_max_baud_rate;
-extern int  sysctl_min_tx_turn_time;
+extern unsigned int sysctl_min_tx_turn_time;
-extern int  sysctl_max_tx_data_size;
+extern unsigned int sysctl_max_tx_data_size;
-extern int  sysctl_max_tx_window;
+extern unsigned int sysctl_max_tx_window;
 extern int  sysctl_max_noreply_time;
 extern int  sysctl_warn_noreply_time;
 extern int  sysctl_lap_keepalive_time;
diff --git a/net/irda/qos.c b/net/irda/qos.c
index 1b51bcf42394..4369f7f41bcb 100644
--- a/net/irda/qos.c
+++ b/net/irda/qos.c
@@ -60,7 +60,7 @@ int sysctl_max_noreply_time = 12;
 * Default is 10us which means using the unmodified value given by the
 * peer except if it's 0 (0 is likely a bug in the other stack).
 */
-unsigned sysctl_min_tx_turn_time = 10;
+unsigned int sysctl_min_tx_turn_time = 10;
 /*
 * Maximum data size to be used in transmission in payload of LAP frame.
 * There is a bit of confusion in the IrDA spec :
@@ -75,13 +75,13 @@ unsigned sysctl_min_tx_turn_time = 10;
 * bytes frames or all negotiated frame sizes, but you can use the sysctl
 * to play with this value anyway.
 * Jean II */
-unsigned sysctl_max_tx_data_size = 2042;
+unsigned int sysctl_max_tx_data_size = 2042;
 /*
 * Maximum transmit window, i.e. number of LAP frames between turn-around.
 * This allow to override what the peer told us. Some peers are buggy and
 * don't always support what they tell us.
 * Jean II */
-unsigned sysctl_max_tx_window = 7;
+unsigned int sysctl_max_tx_window = 7;
 static int irlap_param_baud_rate(void *instance, irda_param_t *param, int get);
 static int irlap_param_link_disconnect(void *instance, irda_param_t *parm,
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 866f269183cf..acb44230b251 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1012,7 +1012,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
        cancel_work_sync(&local->reconfig_filter);
        ieee80211_clear_tx_pending(local);
-        sta_info_stop(local);
        rate_control_deinitialize(local);
        if (skb_queue_len(&local->skb_queue) ||
@@ -1024,6 +1023,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
        destroy_workqueue(local->workqueue);
        wiphy_unregister(local->hw.wiphy);
+        sta_info_stop(local);
        ieee80211_wep_free(local);
        ieee80211_led_exit(local);
        kfree(local->int_scan_req);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 3db78b696c5c..21070e9bc8d0 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -665,7 +665,7 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
                BUG_ON(!sdata->bss);
                atomic_dec(&sdata->bss->num_sta_ps);
-                __sta_info_clear_tim_bit(sdata->bss, sta);
+                sta_info_clear_tim_bit(sta);
        }
        local->num_sta--;
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 2fd4565144de..31d56b23b9e9 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -364,6 +364,7 @@ pptp_inbound_pkt(struct sk_buff *skb,
                break;
        case PPTP_WAN_ERROR_NOTIFY:
+        case PPTP_SET_LINK_INFO:
        case PPTP_ECHO_REQUEST:
        case PPTP_ECHO_REPLY:
                /* I don't have to explain these ;) */
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 37bf94394be0..8235b86b4e87 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -409,7 +409,7 @@ static void tcp_options(const struct sk_buff *skb,
                        if (opsize < 2) /* "silly options" */
                                return;
                        if (opsize > length)
-                                break;  /* don't parse partial options */
+                                return; /* don't parse partial options */
                        if (opcode == TCPOPT_SACK_PERM
                            && opsize == TCPOLEN_SACK_PERM)
@@ -447,7 +447,7 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
        BUG_ON(ptr == NULL);
        /* Fast path for timestamp-only option */
-        if (length == TCPOLEN_TSTAMP_ALIGNED*4
+        if (length == TCPOLEN_TSTAMP_ALIGNED
            && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
                                       | (TCPOPT_NOP << 16)
                                       | (TCPOPT_TIMESTAMP << 8)
@@ -469,7 +469,7 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
                        if (opsize < 2) /* "silly options" */
                                return;
                        if (opsize > length)
-                                break;  /* don't parse partial options */
+                                return; /* don't parse partial options */
                        if (opcode == TCPOPT_SACK
                            && opsize >= (TCPOLEN_SACK_BASE
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 00bd475eab4b..a80b0cb03f17 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -646,8 +646,8 @@ verdicthdr_get(const struct nlattr * const nfqa[])
                return NULL;
        vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
-        verdict = ntohl(vhdr->verdict);
+        verdict = ntohl(vhdr->verdict) & NF_VERDICT_MASK;
-        if ((verdict & NF_VERDICT_MASK) > NF_MAX_VERDICT)
+        if (verdict > NF_MAX_VERDICT || verdict == NF_STOLEN)
                return NULL;
        return vhdr;
 }
diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
index 76a083184d8e..ed0db15ab00e 100644
--- a/net/netfilter/xt_rateest.c
+++ b/net/netfilter/xt_rateest.c
@@ -78,7 +78,7 @@ static int xt_rateest_mt_checkentry(const struct xt_mtchk_param *par)
 {
        struct xt_rateest_match_info *info = par->matchinfo;
        struct xt_rateest *est1, *est2;
-        int ret = false;
+        int ret = -EINVAL;
        if (hweight32(info->flags & (XT_RATEEST_MATCH_ABS |
                                     XT_RATEEST_MATCH_REL)) != 1)
@@ -101,13 +101,12 @@ static int xt_rateest_mt_checkentry(const struct xt_mtchk_param *par)
        if (!est1)
                goto err1;
+        est2 = NULL;
        if (info->flags & XT_RATEEST_MATCH_REL) {
                est2 = xt_rateest_lookup(info->name2);
                if (!est2)
                        goto err2;
-        } else
+        }
-                est2 = NULL;
        info->est1 = est1;
        info->est2 = est2;
@@ -116,7 +115,7 @@ static int xt_rateest_mt_checkentry(const struct xt_mtchk_param *par)
 err2:
        xt_rateest_put(est1);
 err1:
-        return -EINVAL;
+        return ret;
 }
 static void xt_rateest_mt_destroy(const struct xt_mtdtor_param *par)
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index be4505ee67a9..b01427924f81 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -425,7 +425,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
        struct rsvp_filter *f, **fp;
        struct rsvp_session *s, **sp;
        struct tc_rsvp_pinfo *pinfo = NULL;
-        struct nlattr *opt = tca[TCA_OPTIONS-1];
+        struct nlattr *opt = tca[TCA_OPTIONS];
        struct nlattr *tb[TCA_RSVP_MAX + 1];
        struct tcf_exts e;
        unsigned int h1, h2;
@@ -439,7 +439,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
        if (err < 0)
                return err;
-        err = tcf_exts_validate(tp, tb, tca[TCA_RATE-1], &e, &rsvp_ext_map);
+        err = tcf_exts_validate(tp, tb, tca[TCA_RATE], &e, &rsvp_ext_map);
        if (err < 0)
                return err;
@@ -449,8 +449,8 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
                if (f->handle != handle && handle)
                        goto errout2;
-                if (tb[TCA_RSVP_CLASSID-1]) {
+                if (tb[TCA_RSVP_CLASSID]) {
-                        f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID-1]);
+                        f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
                        tcf_bind_filter(tp, &f->res, base);
                }
@@ -462,7 +462,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
        err = -EINVAL;
        if (handle)
                goto errout2;
-        if (tb[TCA_RSVP_DST-1] == NULL)
+        if (tb[TCA_RSVP_DST] == NULL)
                goto errout2;
        err = -ENOBUFS;
@@ -471,19 +471,19 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
                goto errout2;
        h2 = 16;
-        if (tb[TCA_RSVP_SRC-1]) {
+        if (tb[TCA_RSVP_SRC]) {
-                memcpy(f->src, nla_data(tb[TCA_RSVP_SRC-1]), sizeof(f->src));
+                memcpy(f->src, nla_data(tb[TCA_RSVP_SRC]), sizeof(f->src));
                h2 = hash_src(f->src);
        }
-        if (tb[TCA_RSVP_PINFO-1]) {
+        if (tb[TCA_RSVP_PINFO]) {
-                pinfo = nla_data(tb[TCA_RSVP_PINFO-1]);
+                pinfo = nla_data(tb[TCA_RSVP_PINFO]);
                f->spi = pinfo->spi;
                f->tunnelhdr = pinfo->tunnelhdr;
        }
-        if (tb[TCA_RSVP_CLASSID-1])
+        if (tb[TCA_RSVP_CLASSID])
-                f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID-1]);
+                f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
-        dst = nla_data(tb[TCA_RSVP_DST-1]);
+        dst = nla_data(tb[TCA_RSVP_DST]);
        h1 = hash_dst(dst, pinfo ? pinfo->protocol : 0, pinfo ? pinfo->tunnelid : 0);
        err = -ENOMEM;
@@ -642,8 +642,7 @@ nla_put_failure:
        return -1;
 }
-static struct tcf_proto_ops RSVP_OPS = {
+static struct tcf_proto_ops RSVP_OPS __read_mostly = {
-        .next           =       NULL,
        .kind           =       RSVP_ID,
        .classify       =       rsvp_classify,
        .init           =       rsvp_init,
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 167c880cf8da..76388b083f28 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1689,6 +1689,11 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                case SCTP_CMD_PURGE_ASCONF_QUEUE:
                        sctp_asconf_queue_teardown(asoc);
                        break;
+                case SCTP_CMD_SET_ASOC:
+                        asoc = cmd->obj.asoc;
+                        break;
                default:
                        pr_warn("Impossible command: %u, %p\n",
                                cmd->verb, cmd->obj.ptr);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 49b847b00f99..a0f31e6c1c63 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2047,6 +2047,12 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
        sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
+        /* Restore association pointer to provide SCTP command interpeter
+         * with a valid context in case it needs to manipulate
+         * the queues */
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
+                         SCTP_ASOC((struct sctp_association *)asoc));
        return retval;
 nomem:
diff --git a/net/socket.c b/net/socket.c
index 24a77400b65e..ffe92ca32f2a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1965,8 +1965,9 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
         * used_address->name_len is initialized to UINT_MAX so that the first
         * destination address never matches.
         */
-        if (used_address && used_address->name_len == msg_sys->msg_namelen &&
+        if (used_address && msg_sys->msg_name &&
-            !memcmp(&used_address->name, msg->msg_name,
+            used_address->name_len == msg_sys->msg_namelen &&
+            !memcmp(&used_address->name, msg_sys->msg_name,
                    used_address->name_len)) {
                err = sock_sendmsg_nosec(sock, msg_sys, total_len);
                goto out_freectl;
@@ -1978,8 +1979,9 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
         */
        if (used_address && err >= 0) {
                used_address->name_len = msg_sys->msg_namelen;
-                memcpy(&used_address->name, msg->msg_name,
+                if (msg_sys->msg_name)
-                       used_address->name_len);
+                        memcpy(&used_address->name, msg_sys->msg_name,
+                               used_address->name_len);
        }
 out_freectl:
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 645437cfc464..c14865172da7 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -616,6 +616,9 @@ int wiphy_register(struct wiphy *wiphy)
        if (res)
                goto out_rm_dev;
+        rtnl_lock();
+        rdev->wiphy.registered = true;
+        rtnl_unlock();
        return 0;
 out_rm_dev:
@@ -647,6 +650,10 @@ void wiphy_unregister(struct wiphy *wiphy)
 {
        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        rtnl_lock();
+        rdev->wiphy.registered = false;
+        rtnl_unlock();
        rfkill_unregister(rdev->rfkill);
        /* protect the device list */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 02751dbc5a97..68a471ba193f 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -852,6 +852,7 @@ static void handle_channel(struct wiphy *wiphy,
                return;
        }
+        chan->beacon_found = false;
        chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
        chan->max_antenna_gain = min(chan->orig_mag,
                (int) MBI_TO_DBI(power_rule->max_antenna_gain));
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index b7b6ff8be553..dec0fa28372e 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -118,6 +118,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
                             i++, j++)
                                request->channels[i] =
                                        &wdev->wiphy->bands[band]->channels[j];
+                        request->rates[band] =
+                                (1 << wdev->wiphy->bands[band]->n_bitrates) - 1;
                }
        }
        request->n_channels = n_channels;
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index c6e4ca6a7d2e..ff574597a854 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -93,7 +93,8 @@ static int wiphy_suspend(struct device *dev, pm_message_t state)
        if (rdev->ops->suspend) {
                rtnl_lock();
-                ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
+                if (rdev->wiphy.registered)
+                        ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
                rtnl_unlock();
        }
@@ -112,7 +113,8 @@ static int wiphy_resume(struct device *dev)
        if (rdev->ops->resume) {
                rtnl_lock();
-                ret = rdev->ops->resume(&rdev->wiphy);
+                if (rdev->wiphy.registered)
+                        ret = rdev->ops->resume(&rdev->wiphy);
                rtnl_unlock();
        }
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index a026b0ef2443..54a0dc2e2f8d 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -212,6 +212,11 @@ resume:
                /* only the first xfrm gets the encap type */
                encap_type = 0;
+                if (async && x->repl->check(x, skb, seq)) {
+                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
+                        goto drop_unlock;
+                }
                x->repl->advance(x, seq);
                x->curlft.bytes += skb->len;
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 9d761c95eca2..3dfc47134e51 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2574,7 +2574,8 @@ sub process {
                                } else {
                                        $cast = $cast2;
                                }
-                                WARN("$call() should probably be ${call}_t($cast, $arg1, $arg2)\n" . $herecurr);
+                                WARN("MINMAX",
+                                     "$call() should probably be ${call}_t($cast, $arg1, $arg2)\n" . $herecurr);
                        }
                }
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index eb2f1e64edf7..4594f3341051 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -1389,7 +1389,7 @@ sub vcs_exists {
        warn("$P: No supported VCS found.  Add --nogit to options?\n");
        warn("Using a git repository produces better results.\n");
        warn("Try Linus Torvalds' latest git repository using:\n");
-        warn("git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git\n");
+        warn("git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\n");
        $printed_novcs = 1;
    }
    return 0;
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 86d0caf91b35..62e90b862a0d 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1761,6 +1761,10 @@ static int wait_for_avail(struct snd_pcm_substream *substream,
        snd_pcm_uframes_t avail = 0;
        long wait_time, tout;
+        init_waitqueue_entry(&wait, current);
+        set_current_state(TASK_INTERRUPTIBLE);
+        add_wait_queue(&runtime->tsleep, &wait);
        if (runtime->no_period_wakeup)
                wait_time = MAX_SCHEDULE_TIMEOUT;
        else {
@@ -1771,16 +1775,32 @@ static int wait_for_avail(struct snd_pcm_substream *substream,
                }
                wait_time = msecs_to_jiffies(wait_time * 1000);
        }
-        init_waitqueue_entry(&wait, current);
-        add_wait_queue(&runtime->tsleep, &wait);
        for (;;) {
                if (signal_pending(current)) {
                        err = -ERESTARTSYS;
                        break;
                }
+                /*
+                 * We need to check if space became available already
+                 * (and thus the wakeup happened already) first to close
+                 * the race of space already having become available.
+                 * This check must happen after been added to the waitqueue
+                 * and having current state be INTERRUPTIBLE.
+                 */
+                if (is_playback)
+                        avail = snd_pcm_playback_avail(runtime);
+                else
+                        avail = snd_pcm_capture_avail(runtime);
+                if (avail >= runtime->twake)
+                        break;
                snd_pcm_stream_unlock_irq(substream);
-                tout = schedule_timeout_interruptible(wait_time);
+                tout = schedule_timeout(wait_time);
                snd_pcm_stream_lock_irq(substream);
+                set_current_state(TASK_INTERRUPTIBLE);
                switch (runtime->status->state) {
                case SNDRV_PCM_STATE_SUSPENDED:
                        err = -ESTRPIPE;
@@ -1806,14 +1826,9 @@ static int wait_for_avail(struct snd_pcm_substream *substream,
                        err = -EIO;
                        break;
                }
-                if (is_playback)
-                        avail = snd_pcm_playback_avail(runtime);
-                else
-                        avail = snd_pcm_capture_avail(runtime);
-                if (avail >= runtime->twake)
-                        break;
        }
 _endloop:
+        set_current_state(TASK_RUNNING);
        remove_wait_queue(&runtime->tsleep, &wait);
        *availp = avail;
        return err;
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
index f9123f09e83e..32b02d906703 100644
--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -68,6 +68,7 @@ MODULE_PARM_DESC(enable, "Enable FM801 soundcard.");
 module_param_array(tea575x_tuner, int, NULL, 0444);
 MODULE_PARM_DESC(tea575x_tuner, "TEA575x tuner access method (0 = auto, 1 = SF256-PCS, 2=SF256-PCP, 3=SF64-PCR, 8=disable, +16=tuner-only).");
+#define TUNER_DISABLED          (1<<3)
 #define TUNER_ONLY              (1<<4)
 #define TUNER_TYPE_MASK         (~TUNER_ONLY & 0xFFFF)
@@ -1150,7 +1151,8 @@ static int snd_fm801_free(struct fm801 *chip)
      __end_hw:
 #ifdef CONFIG_SND_FM801_TEA575X_BOOL
-        snd_tea575x_exit(&chip->tea);
+        if (!(chip->tea575x_tuner & TUNER_DISABLED))
+                snd_tea575x_exit(&chip->tea);
 #endif
        if (chip->irq >= 0)
                free_irq(chip->irq, chip);
@@ -1236,7 +1238,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
            (tea575x_tuner & TUNER_TYPE_MASK) < 4) {
                if (snd_tea575x_init(&chip->tea)) {
                        snd_printk(KERN_ERR "TEA575x radio not found\n");
-                        snd_fm801_free(chip);
                        return -ENODEV;
                }
        } else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) {
@@ -1251,11 +1252,15 @@ static int __devinit snd_fm801_create(struct snd_card *card,
                }
                if (tea575x_tuner == 4) {
                        snd_printk(KERN_ERR "TEA575x radio not found\n");
-                        snd_fm801_free(chip);
+                        chip->tea575x_tuner = TUNER_DISABLED;
-                        return -ENODEV;
                }
        }
-        strlcpy(chip->tea.card, snd_fm801_tea575x_gpios[(tea575x_tuner & TUNER_TYPE_MASK) - 1].name, sizeof(chip->tea.card));
+        if (!(chip->tea575x_tuner & TUNER_DISABLED)) {
+                strlcpy(chip->tea.card,
+                        snd_fm801_tea575x_gpios[(tea575x_tuner &
+                                                 TUNER_TYPE_MASK) - 1].name,
+                        sizeof(chip->tea.card));
+        }
 #endif
        *rchip = chip;
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 3e7850c238c3..f3aefef37216 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -579,9 +579,13 @@ int snd_hda_get_conn_index(struct hda_codec *codec, hda_nid_t mux,
                return -1;
        }
        recursive++;
-        for (i = 0; i < nums; i++)
+        for (i = 0; i < nums; i++) {
+                unsigned int type = get_wcaps_type(get_wcaps(codec, conn[i]));
+                if (type == AC_WID_PIN || type == AC_WID_AUD_OUT)
+                        continue;
                if (snd_hda_get_conn_index(codec, conn[i], nid, recursive) >= 0)
                        return i;
+        }
        return -1;
 }
 EXPORT_SYMBOL_HDA(snd_hda_get_conn_index);
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index d6c93d92b550..c45f3e69bcf0 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -535,7 +535,7 @@ static int add_volume(struct hda_codec *codec, const char *name,
                      int index, unsigned int pval, int dir,
                      struct snd_kcontrol **kctlp)
 {
-        char tmp[32];
+        char tmp[44];
        struct snd_kcontrol_new knew =
                HDA_CODEC_VOLUME_IDX(tmp, index, 0, 0, HDA_OUTPUT);
        knew.private_value = pval;
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 502fc9499453..7696d05b9356 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3348,6 +3348,8 @@ static hda_nid_t get_unassigned_dac(struct hda_codec *codec, hda_nid_t pin,
 #define MAX_AUTO_DACS   5
+#define DAC_SLAVE_FLAG  0x8000  /* filled dac is a slave */
 /* fill analog DAC list from the widget tree */
 static int fill_cx_auto_dacs(struct hda_codec *codec, hda_nid_t *dacs)
 {
@@ -3370,16 +3372,26 @@ static int fill_cx_auto_dacs(struct hda_codec *codec, hda_nid_t *dacs)
 /* fill pin_dac_pair list from the pin and dac list */
 static int fill_dacs_for_pins(struct hda_codec *codec, hda_nid_t *pins,
                              int num_pins, hda_nid_t *dacs, int *rest,
-                              struct pin_dac_pair *filled, int type)
+                              struct pin_dac_pair *filled, int nums, 
+                              int type)
 {
-        int i, nums;
+        int i, start = nums;
-        nums = 0;
+        for (i = 0; i < num_pins; i++, nums++) {
-        for (i = 0; i < num_pins; i++) {
                filled[nums].pin = pins[i];
                filled[nums].type = type;
                filled[nums].dac = get_unassigned_dac(codec, pins[i], dacs, rest);
-                nums++;
+                if (filled[nums].dac) 
+                        continue;
+                if (filled[start].dac && get_connection_index(codec, pins[i], filled[start].dac) >= 0) {
+                        filled[nums].dac = filled[start].dac | DAC_SLAVE_FLAG;
+                        continue;
+                }
+                if (filled[0].dac && get_connection_index(codec, pins[i], filled[0].dac) >= 0) {
+                        filled[nums].dac = filled[0].dac | DAC_SLAVE_FLAG;
+                        continue;
+                }
+                snd_printdd("Failed to find a DAC for pin 0x%x", pins[i]);
        }
        return nums;
 }
@@ -3395,19 +3407,19 @@ static void cx_auto_parse_output(struct hda_codec *codec)
        rest = fill_cx_auto_dacs(codec, dacs);
        /* parse all analog output pins */
        nums = fill_dacs_for_pins(codec, cfg->line_out_pins, cfg->line_outs,
-                                  dacs, &rest, spec->dac_info,
+                          dacs, &rest, spec->dac_info, 0,
-                                  AUTO_PIN_LINE_OUT);
+                          AUTO_PIN_LINE_OUT);
-        nums += fill_dacs_for_pins(codec, cfg->hp_pins, cfg->hp_outs,
+        nums = fill_dacs_for_pins(codec, cfg->hp_pins, cfg->hp_outs,
-                                  dacs, &rest, spec->dac_info + nums,
+                          dacs, &rest, spec->dac_info, nums,
-                                  AUTO_PIN_HP_OUT);
+                          AUTO_PIN_HP_OUT);
-        nums += fill_dacs_for_pins(codec, cfg->speaker_pins, cfg->speaker_outs,
+        nums = fill_dacs_for_pins(codec, cfg->speaker_pins, cfg->speaker_outs,
-                                  dacs, &rest, spec->dac_info + nums,
+                          dacs, &rest, spec->dac_info, nums,
-                                  AUTO_PIN_SPEAKER_OUT);
+                          AUTO_PIN_SPEAKER_OUT);
        spec->dac_info_filled = nums;
        /* fill multiout struct */
        for (i = 0; i < nums; i++) {
                hda_nid_t dac = spec->dac_info[i].dac;
-                if (!dac)
+                if (!dac || (dac & DAC_SLAVE_FLAG))
                        continue;
                switch (spec->dac_info[i].type) {
                case AUTO_PIN_LINE_OUT:
@@ -3862,7 +3874,7 @@ static void cx_auto_parse_input(struct hda_codec *codec)
        }
        if (imux->num_items >= 2 && cfg->num_inputs == imux->num_items)
                cx_auto_check_auto_mic(codec);
-        if (imux->num_items > 1 && !spec->auto_mic) {
+        if (imux->num_items > 1) {
                for (i = 1; i < imux->num_items; i++) {
                        if (spec->imux_info[i].adc != spec->imux_info[0].adc) {
                                spec->adc_switching = 1;
@@ -4035,6 +4047,8 @@ static void cx_auto_init_output(struct hda_codec *codec)
                nid = spec->dac_info[i].dac;
                if (!nid)
                        nid = spec->multiout.dac_nids[0];
+                else if (nid & DAC_SLAVE_FLAG)
+                        nid &= ~DAC_SLAVE_FLAG;
                select_connection(codec, spec->dac_info[i].pin, nid);
        }
        if (spec->auto_mute) {
@@ -4167,9 +4181,11 @@ static int try_add_pb_volume(struct hda_codec *codec, hda_nid_t dac,
                             hda_nid_t pin, const char *name, int idx)
 {
        unsigned int caps;
-        caps = query_amp_caps(codec, dac, HDA_OUTPUT);
+        if (dac && !(dac & DAC_SLAVE_FLAG)) {
-        if (caps & AC_AMPCAP_NUM_STEPS)
+                caps = query_amp_caps(codec, dac, HDA_OUTPUT);
-                return cx_auto_add_pb_volume(codec, dac, name, idx);
+                if (caps & AC_AMPCAP_NUM_STEPS)
+                        return cx_auto_add_pb_volume(codec, dac, name, idx);
+        }
        caps = query_amp_caps(codec, pin, HDA_OUTPUT);
        if (caps & AC_AMPCAP_NUM_STEPS)
                return cx_auto_add_pb_volume(codec, pin, name, idx);
@@ -4191,8 +4207,7 @@ static int cx_auto_build_output_controls(struct hda_codec *codec)
        for (i = 0; i < spec->dac_info_filled; i++) {
                const char *label;
                int idx, type;
-                if (!spec->dac_info[i].dac)
+                hda_nid_t dac = spec->dac_info[i].dac;
-                        continue;
                type = spec->dac_info[i].type;
                if (type == AUTO_PIN_LINE_OUT)
                        type = spec->autocfg.line_out_type;
@@ -4211,7 +4226,7 @@ static int cx_auto_build_output_controls(struct hda_codec *codec)
                        idx = num_spk++;
                        break;
                }
-                err = try_add_pb_volume(codec, spec->dac_info[i].dac,
+                err = try_add_pb_volume(codec, dac,
                                        spec->dac_info[i].pin,
                                        label, idx);
                if (err < 0)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index fcb11af9ad24..0503c999e7d3 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -168,7 +168,7 @@ struct alc_spec {
        unsigned int auto_mic_valid_imux:1;     /* valid imux for auto-mic */
        unsigned int automute:1;        /* HP automute enabled */
        unsigned int detect_line:1;     /* Line-out detection enabled */
-        unsigned int automute_lines:1;  /* automute line-out as well */
+        unsigned int automute_lines:1;  /* automute line-out as well; NOP when automute_hp_lo isn't set */
        unsigned int automute_hp_lo:1;  /* both HP and LO available */
        /* other flags */
@@ -551,7 +551,7 @@ static void update_speakers(struct hda_codec *codec)
        if (spec->autocfg.line_out_pins[0] == spec->autocfg.hp_pins[0] ||
            spec->autocfg.line_out_pins[0] == spec->autocfg.speaker_pins[0])
                return;
-        if (!spec->automute_lines || !spec->automute)
+        if (!spec->automute || (spec->automute_hp_lo && !spec->automute_lines))
                on = 0;
        else
                on = spec->jack_present;
@@ -565,11 +565,11 @@ static void alc_hp_automute(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        if (!spec->automute)
-                return;
        spec->jack_present =
                detect_jacks(codec, ARRAY_SIZE(spec->autocfg.hp_pins),
                             spec->autocfg.hp_pins);
+        if (!spec->automute)
+                return;
        update_speakers(codec);
 }
@@ -578,11 +578,11 @@ static void alc_line_automute(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        if (!spec->automute || !spec->detect_line)
-                return;
        spec->line_jack_present =
                detect_jacks(codec, ARRAY_SIZE(spec->autocfg.line_out_pins),
                             spec->autocfg.line_out_pins);
+        if (!spec->automute || !spec->detect_line)
+                return;
        update_speakers(codec);
 }
@@ -803,7 +803,7 @@ static int alc_automute_mode_get(struct snd_kcontrol *kcontrol,
        unsigned int val;
        if (!spec->automute)
                val = 0;
-        else if (!spec->automute_lines)
+        else if (!spec->automute_hp_lo || !spec->automute_lines)
                val = 1;
        else
                val = 2;
@@ -824,7 +824,8 @@ static int alc_automute_mode_put(struct snd_kcontrol *kcontrol,
                spec->automute = 0;
                break;
        case 1:
-                if (spec->automute && !spec->automute_lines)
+                if (spec->automute &&
+                    (!spec->automute_hp_lo || !spec->automute_lines))
                        return 0;
                spec->automute = 1;
                spec->automute_lines = 0;
@@ -3083,16 +3084,22 @@ static void alc_auto_init_multi_out(struct hda_codec *codec)
 static void alc_auto_init_extra_out(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t pin;
+        hda_nid_t pin, dac;
        pin = spec->autocfg.hp_pins[0];
-        if (pin)
+        if (pin) {
-                alc_auto_set_output_and_unmute(codec, pin, PIN_HP,
+                dac = spec->multiout.hp_nid;
-                                                  spec->multiout.hp_nid);
+                if (!dac)
+                        dac = spec->multiout.dac_nids[0];
+                alc_auto_set_output_and_unmute(codec, pin, PIN_HP, dac);
+        }
        pin = spec->autocfg.speaker_pins[0];
-        if (pin)
+        if (pin) {
-                alc_auto_set_output_and_unmute(codec, pin, PIN_OUT,
+                dac = spec->multiout.extra_out_nid[0];
-                                        spec->multiout.extra_out_nid[0]);
+                if (!dac)
+                        dac = spec->multiout.dac_nids[0];
+                alc_auto_set_output_and_unmute(codec, pin, PIN_OUT, dac);
+        }
 }
 /*
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 5145b663ef6e..1b7c11432aa7 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -6573,6 +6573,7 @@ static const struct hda_codec_preset snd_hda_preset_sigmatel[] = {
        { .id = 0x111d76cc, .name = "92HD89F3", .patch = patch_stac92hd73xx },
        { .id = 0x111d76cd, .name = "92HD89F2", .patch = patch_stac92hd73xx },
        { .id = 0x111d76ce, .name = "92HD89F1", .patch = patch_stac92hd73xx },
+        { .id = 0x111d76df, .name = "92HD93BXX", .patch = patch_stac92hd83xxx},
        { .id = 0x111d76e0, .name = "92HD91BXX", .patch = patch_stac92hd83xxx},
        { .id = 0x111d76e3, .name = "92HD98BXX", .patch = patch_stac92hd83xxx},
        { .id = 0x111d76e5, .name = "92HD99BXX", .patch = patch_stac92hd83xxx},
diff --git a/sound/soc/blackfin/bf5xx-ad193x.c b/sound/soc/blackfin/bf5xx-ad193x.c
index d6651c033cb7..5956584ea3a4 100644
--- a/sound/soc/blackfin/bf5xx-ad193x.c
+++ b/sound/soc/blackfin/bf5xx-ad193x.c
@@ -56,7 +56,7 @@ static int bf5xx_ad193x_hw_params(struct snd_pcm_substream *substream,
        switch (params_rate(params)) {
        case 48000:
-                clk = 12288000;
+                clk = 24576000;
                break;
        }
@@ -103,7 +103,7 @@ static struct snd_soc_dai_link bf5xx_ad193x_dai[] = {
                .cpu_dai_name = "bfin-tdm.0",
                .codec_dai_name ="ad193x-hifi",
                .platform_name = "bfin-tdm-pcm-audio",
-                .codec_name = "ad193x.5",
+                .codec_name = "spi0.5",
                .ops = &bf5xx_ad193x_ops,
        },
        {
@@ -112,7 +112,7 @@ static struct snd_soc_dai_link bf5xx_ad193x_dai[] = {
                .cpu_dai_name = "bfin-tdm.1",
                .codec_dai_name ="ad193x-hifi",
                .platform_name = "bfin-tdm-pcm-audio",
-                .codec_name = "ad193x.5",
+                .codec_name = "spi0.5",
                .ops = &bf5xx_ad193x_ops,
        },
 };
diff --git a/sound/soc/blackfin/bf5xx-ad73311.c b/sound/soc/blackfin/bf5xx-ad73311.c
index 732a247f2527..b94eb7ef7d16 100644
--- a/sound/soc/blackfin/bf5xx-ad73311.c
+++ b/sound/soc/blackfin/bf5xx-ad73311.c
@@ -128,7 +128,7 @@ static int snd_ad73311_configure(void)
        return 0;
 }
-static int bf5xx_probe(struct platform_device *pdev)
+static int bf5xx_probe(struct snd_soc_card *card)
 {
        int err;
        if (gpio_request(GPIO_SE, "AD73311_SE")) {
diff --git a/sound/soc/codecs/ad193x.c b/sound/soc/codecs/ad193x.c
index 2374ca5ffe68..eedb6f5e5823 100644
--- a/sound/soc/codecs/ad193x.c
+++ b/sound/soc/codecs/ad193x.c
@@ -27,11 +27,6 @@ struct ad193x_priv {
        int sysclk;
 };
-/* ad193x register cache & default register settings */
-static const u8 ad193x_reg[AD193X_NUM_REGS] = {
-        0, 0, 0, 0, 0, 0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0, 0, 0,
-};
 /*
 * AD193X volume/mute/de-emphasis etc. controls
 */
@@ -307,7 +302,8 @@ static int ad193x_hw_params(struct snd_pcm_substream *substream,
        snd_soc_write(codec, AD193X_PLL_CLK_CTRL0, reg);
        reg = snd_soc_read(codec, AD193X_DAC_CTRL2);
-        reg = (reg & (~AD193X_DAC_WORD_LEN_MASK)) | word_len;
+        reg = (reg & (~AD193X_DAC_WORD_LEN_MASK))
+                | (word_len << AD193X_DAC_WORD_LEN_SHFT);
        snd_soc_write(codec, AD193X_DAC_CTRL2, reg);
        reg = snd_soc_read(codec, AD193X_ADC_CTRL1);
@@ -389,9 +385,6 @@ static int ad193x_probe(struct snd_soc_codec *codec)
 static struct snd_soc_codec_driver soc_codec_dev_ad193x = {
        .probe =        ad193x_probe,
-        .reg_cache_default = ad193x_reg,
-        .reg_cache_size = AD193X_NUM_REGS,
-        .reg_word_size = sizeof(u16),
 };
 #if defined(CONFIG_SPI_MASTER)
diff --git a/sound/soc/codecs/ad193x.h b/sound/soc/codecs/ad193x.h
index 9747b5497877..cccc2e8e5fbd 100644
--- a/sound/soc/codecs/ad193x.h
+++ b/sound/soc/codecs/ad193x.h
@@ -34,7 +34,8 @@
 #define AD193X_DAC_LEFT_HIGH    (1 << 3)
 #define AD193X_DAC_BCLK_INV     (1 << 7)
 #define AD193X_DAC_CTRL2        0x804
-#define AD193X_DAC_WORD_LEN_MASK        0xC
+#define AD193X_DAC_WORD_LEN_SHFT        3
+#define AD193X_DAC_WORD_LEN_MASK        0x18
 #define AD193X_DAC_MASTER_MUTE  1
 #define AD193X_DAC_CHNL_MUTE    0x805
 #define AD193X_DACL1_MUTE       0
@@ -63,7 +64,7 @@
 #define AD193X_ADC_CTRL1        0x80f
 #define AD193X_ADC_SERFMT_MASK          0x60
 #define AD193X_ADC_SERFMT_STEREO        (0 << 5)
-#define AD193X_ADC_SERFMT_TDM           (1 << 2)
+#define AD193X_ADC_SERFMT_TDM           (1 << 5)
 #define AD193X_ADC_SERFMT_AUX           (2 << 5)
 #define AD193X_ADC_WORD_LEN_MASK        0x3
 #define AD193X_ADC_CTRL2        0x810
diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
index 409d89d1f34c..fbd7eb9e61ce 100644
--- a/sound/soc/codecs/sta32x.c
+++ b/sound/soc/codecs/sta32x.c
@@ -857,6 +857,7 @@ static __devinit int sta32x_i2c_probe(struct i2c_client *i2c,
        ret = snd_soc_register_codec(&i2c->dev, &sta32x_codec, &sta32x_dai, 1);
        if (ret != 0) {
                dev_err(&i2c->dev, "Failed to register codec (%d)\n", ret);
+                kfree(sta32x);
                return ret;
        }
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 60d740ebeb5b..d2c315fa1b9b 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -2221,6 +2221,8 @@ static int sysclk_event(struct snd_soc_dapm_widget *w,
        switch (event) {
        case SND_SOC_DAPM_PRE_PMU:
                if (fll) {
+                        try_wait_for_completion(&wm8962->fll_lock);
                        snd_soc_update_bits(codec, WM8962_FLL_CONTROL_1,
                                            WM8962_FLL_ENA, WM8962_FLL_ENA);
                        if (wm8962->irq) {
@@ -2927,10 +2929,6 @@ static int wm8962_set_bias_level(struct snd_soc_codec *codec,
                                            WM8962_BIAS_ENA | 0x180);
                        msleep(5);
-                        snd_soc_update_bits(codec, WM8962_CLOCKING2,
-                                            WM8962_CLKREG_OVD,
-                                            WM8962_CLKREG_OVD);
                }
                /* VMID 2*250k */
@@ -3288,6 +3286,8 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source,
        snd_soc_write(codec, WM8962_FLL_CONTROL_7, fll_div.lambda);
        snd_soc_write(codec, WM8962_FLL_CONTROL_8, fll_div.n);
+        try_wait_for_completion(&wm8962->fll_lock);
        snd_soc_update_bits(codec, WM8962_FLL_CONTROL_1,
                            WM8962_FLL_FRAC | WM8962_FLL_REFCLK_SRC_MASK |
                            WM8962_FLL_ENA, fll1);
@@ -3479,31 +3479,6 @@ int wm8962_mic_detect(struct snd_soc_codec *codec, struct snd_soc_jack *jack)
 }
 EXPORT_SYMBOL_GPL(wm8962_mic_detect);
-#ifdef CONFIG_PM
-static int wm8962_resume(struct snd_soc_codec *codec)
-{
-        u16 *reg_cache = codec->reg_cache;
-        int i;
-        /* Restore the registers */
-        for (i = 1; i < codec->driver->reg_cache_size; i++) {
-                switch (i) {
-                case WM8962_SOFTWARE_RESET:
-                        continue;
-                default:
-                        break;
-                }
-                if (reg_cache[i] != wm8962_reg[i])
-                        snd_soc_write(codec, i, reg_cache[i]);
-        }
-        return 0;
-}
-#else
-#define wm8962_resume NULL
-#endif
 #if defined(CONFIG_INPUT) || defined(CONFIG_INPUT_MODULE)
 static int beep_rates[] = {
        500, 1000, 2000, 4000,
@@ -3868,6 +3843,10 @@ static int wm8962_probe(struct snd_soc_codec *codec)
         */
        snd_soc_update_bits(codec, WM8962_CLOCKING2, WM8962_SYSCLK_ENA, 0);
+        /* Ensure we have soft control over all registers */
+        snd_soc_update_bits(codec, WM8962_CLOCKING2,
+                            WM8962_CLKREG_OVD, WM8962_CLKREG_OVD);
        regulator_bulk_disable(ARRAY_SIZE(wm8962->supplies), wm8962->supplies);
        if (pdata) {
@@ -4011,7 +3990,6 @@ static int wm8962_remove(struct snd_soc_codec *codec)
 static struct snd_soc_codec_driver soc_codec_dev_wm8962 = {
        .probe =        wm8962_probe,
        .remove =       wm8962_remove,
-        .resume =       wm8962_resume,
        .set_bias_level = wm8962_set_bias_level,
        .reg_cache_size = WM8962_MAX_REGISTER + 1,
        .reg_word_size = sizeof(u16),
diff --git a/sound/soc/codecs/wm8996.c b/sound/soc/codecs/wm8996.c
index ab8e9d1aaff0..0cdb9d105671 100644
--- a/sound/soc/codecs/wm8996.c
+++ b/sound/soc/codecs/wm8996.c
@@ -420,7 +420,7 @@ static const char *sidetone_hpf_text[] = {
 };
 static const struct soc_enum sidetone_hpf =
-        SOC_ENUM_SINGLE(WM8996_SIDETONE, 7, 6, sidetone_hpf_text);
+        SOC_ENUM_SINGLE(WM8996_SIDETONE, 7, 7, sidetone_hpf_text);
 static const char *hpf_mode_text[] = {
        "HiFi", "Custom", "Voice"
@@ -988,15 +988,10 @@ SND_SOC_DAPM_MICBIAS("MICB1", WM8996_POWER_MANAGEMENT_1, 8, 0),
 SND_SOC_DAPM_PGA("IN1L PGA", WM8996_POWER_MANAGEMENT_2, 5, 0, NULL, 0),
 SND_SOC_DAPM_PGA("IN1R PGA", WM8996_POWER_MANAGEMENT_2, 4, 0, NULL, 0),
-SND_SOC_DAPM_MUX("IN1L Mux", SND_SOC_NOPM, 0, 0, &in1_mux),
+SND_SOC_DAPM_MUX("IN1L Mux", WM8996_POWER_MANAGEMENT_7, 2, 0, &in1_mux),
-SND_SOC_DAPM_MUX("IN1R Mux", SND_SOC_NOPM, 0, 0, &in1_mux),
+SND_SOC_DAPM_MUX("IN1R Mux", WM8996_POWER_MANAGEMENT_7, 3, 0, &in1_mux),
-SND_SOC_DAPM_MUX("IN2L Mux", SND_SOC_NOPM, 0, 0, &in2_mux),
+SND_SOC_DAPM_MUX("IN2L Mux", WM8996_POWER_MANAGEMENT_7, 6, 0, &in2_mux),
-SND_SOC_DAPM_MUX("IN2R Mux", SND_SOC_NOPM, 0, 0, &in2_mux),
+SND_SOC_DAPM_MUX("IN2R Mux", WM8996_POWER_MANAGEMENT_7, 7, 0, &in2_mux),
-SND_SOC_DAPM_PGA("IN1L", WM8996_POWER_MANAGEMENT_7, 2, 0, NULL, 0),
-SND_SOC_DAPM_PGA("IN1R", WM8996_POWER_MANAGEMENT_7, 3, 0, NULL, 0),
-SND_SOC_DAPM_PGA("IN2L", WM8996_POWER_MANAGEMENT_7, 6, 0, NULL, 0),
-SND_SOC_DAPM_PGA("IN2R", WM8996_POWER_MANAGEMENT_7, 7, 0, NULL, 0),
 SND_SOC_DAPM_SUPPLY("DMIC2", WM8996_POWER_MANAGEMENT_7, 9, 0, NULL, 0),
 SND_SOC_DAPM_SUPPLY("DMIC1", WM8996_POWER_MANAGEMENT_7, 8, 0, NULL, 0),
@@ -1213,6 +1208,16 @@ static const struct snd_soc_dapm_route wm8996_dapm_routes[] = {
        { "AIF2RX0", NULL, "AIFCLK" },
        { "AIF2RX1", NULL, "AIFCLK" },
+        { "AIF1TX0", NULL, "AIFCLK" },
+        { "AIF1TX1", NULL, "AIFCLK" },
+        { "AIF1TX2", NULL, "AIFCLK" },
+        { "AIF1TX3", NULL, "AIFCLK" },
+        { "AIF1TX4", NULL, "AIFCLK" },
+        { "AIF1TX5", NULL, "AIFCLK" },
+        { "AIF2TX0", NULL, "AIFCLK" },
+        { "AIF2TX1", NULL, "AIFCLK" },
        { "DSP1RXL", NULL, "SYSDSPCLK" },
        { "DSP1RXR", NULL, "SYSDSPCLK" },
        { "DSP2RXL", NULL, "SYSDSPCLK" },
@@ -2106,6 +2111,9 @@ static int wm8996_set_fll(struct snd_soc_codec *codec, int fll_id, int source,
        snd_soc_write(codec, WM8996_FLL_EFS_1, fll_div.lambda);
+        /* Clear any pending completions (eg, from failed startups) */
+        try_wait_for_completion(&wm8996->fll_lock);
        snd_soc_update_bits(codec, WM8996_FLL_CONTROL_1,
                            WM8996_FLL_ENA, WM8996_FLL_ENA);
diff --git a/sound/soc/ep93xx/ep93xx-i2s.c b/sound/soc/ep93xx/ep93xx-i2s.c
index 56efa0c1c9a9..099614e16651 100644
--- a/sound/soc/ep93xx/ep93xx-i2s.c
+++ b/sound/soc/ep93xx/ep93xx-i2s.c
@@ -385,14 +385,14 @@ static int ep93xx_i2s_probe(struct platform_device *pdev)
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res) {
                err = -ENODEV;
-                goto fail;
+                goto fail_free_info;
        }
        info->mem = request_mem_region(res->start, resource_size(res),
                                       pdev->name);
        if (!info->mem) {
                err = -EBUSY;
-                goto fail;
+                goto fail_free_info;
        }
        info->regs = ioremap(info->mem->start, resource_size(info->mem));
@@ -435,6 +435,7 @@ fail_unmap_mem:
        iounmap(info->regs);
 fail_release_mem:
        release_mem_region(info->mem->start, resource_size(info->mem));
+fail_free_info:
        kfree(info);
 fail:
        return err;
diff --git a/sound/soc/fsl/fsl_dma.c b/sound/soc/fsl/fsl_dma.c
index 732208c8c0b4..cb50598338e9 100644
--- a/sound/soc/fsl/fsl_dma.c
+++ b/sound/soc/fsl/fsl_dma.c
@@ -879,10 +879,12 @@ static struct device_node *find_ssi_node(struct device_node *dma_channel_np)
                 * assume that device_node pointers are a valid comparison.
                 */
                np = of_parse_phandle(ssi_np, "fsl,playback-dma", 0);
+                of_node_put(np);
                if (np == dma_channel_np)
                        return ssi_np;
                np = of_parse_phandle(ssi_np, "fsl,capture-dma", 0);
+                of_node_put(np);
                if (np == dma_channel_np)
                        return ssi_np;
        }
diff --git a/sound/soc/fsl/mpc5200_dma.c b/sound/soc/fsl/mpc5200_dma.c
index fd0dc46afc34..5c6c2457386e 100644
--- a/sound/soc/fsl/mpc5200_dma.c
+++ b/sound/soc/fsl/mpc5200_dma.c
@@ -369,7 +369,7 @@ static struct snd_soc_platform_driver mpc5200_audio_dma_platform = {
        .pcm_free       = &psc_dma_free,
 };
-static int mpc5200_hpcd_probe(struct of_device *op)
+static int mpc5200_hpcd_probe(struct platform_device *op)
 {
        phys_addr_t fifo;
        struct psc_dma *psc_dma;
@@ -487,7 +487,7 @@ out_unmap:
        return ret;
 }
-static int mpc5200_hpcd_remove(struct of_device *op)
+static int mpc5200_hpcd_remove(struct platform_device *op)
 {
        struct psc_dma *psc_dma = dev_get_drvdata(&op->dev);
@@ -519,7 +519,7 @@ MODULE_DEVICE_TABLE(of, mpc5200_hpcd_match);
 static struct platform_driver mpc5200_hpcd_of_driver = {
        .probe          = mpc5200_hpcd_probe,
        .remove         = mpc5200_hpcd_remove,
-        .dev = {
+        .driver = {
                .owner          = THIS_MODULE,
                .name           = "mpc5200-pcm-audio",
                .of_match_table    = mpc5200_hpcd_match,
diff --git a/sound/soc/fsl/mpc8610_hpcd.c b/sound/soc/fsl/mpc8610_hpcd.c
index a19297959587..358f0baaf71b 100644
--- a/sound/soc/fsl/mpc8610_hpcd.c
+++ b/sound/soc/fsl/mpc8610_hpcd.c
@@ -345,8 +345,10 @@ static int mpc8610_hpcd_probe(struct platform_device *pdev)
        }
        machine_data = kzalloc(sizeof(struct mpc8610_hpcd_data), GFP_KERNEL);
-        if (!machine_data)
+        if (!machine_data) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto error_alloc;
+        }
        machine_data->dai[0].cpu_dai_name = dev_name(&ssi_pdev->dev);
        machine_data->dai[0].ops = &mpc8610_hpcd_ops;
@@ -494,7 +496,7 @@ static int mpc8610_hpcd_probe(struct platform_device *pdev)
        ret = platform_device_add(sound_device);
        if (ret) {
                dev_err(&pdev->dev, "platform device add failed\n");
-                goto error;
+                goto error_sound;
        }
        dev_set_drvdata(&pdev->dev, sound_device);
@@ -502,14 +504,12 @@ static int mpc8610_hpcd_probe(struct platform_device *pdev)
        return 0;
+error_sound:
+        platform_device_unregister(sound_device);
 error:
-        of_node_put(codec_np);
-        if (sound_device)
-                platform_device_unregister(sound_device);
        kfree(machine_data);
+error_alloc:
+        of_node_put(codec_np);
        return ret;
 }
diff --git a/sound/soc/fsl/p1022_ds.c b/sound/soc/fsl/p1022_ds.c
index 8fa4d5f8eda1..fcb862eb0c73 100644
--- a/sound/soc/fsl/p1022_ds.c
+++ b/sound/soc/fsl/p1022_ds.c
@@ -297,8 +297,10 @@ static int get_dma_channel(struct device_node *ssi_np,
         * dai->platform name should already point to an allocated buffer.
         */
        ret = of_address_to_resource(dma_channel_np, 0, &res);
-        if (ret)
+        if (ret) {
+                of_node_put(dma_channel_np);
                return ret;
+        }
        snprintf((char *)dai->platform_name, DAI_NAME_SIZE, "%llx.%s",
                 (unsigned long long) res.start, dma_channel_np->name);
diff --git a/sound/soc/imx/imx-pcm-fiq.c b/sound/soc/imx/imx-pcm-fiq.c
index 309c59e6fb6c..7945625e0e08 100644
--- a/sound/soc/imx/imx-pcm-fiq.c
+++ b/sound/soc/imx/imx-pcm-fiq.c
@@ -240,7 +240,6 @@ static int ssi_irq = 0;
 static int imx_pcm_fiq_new(struct snd_soc_pcm_runtime *rtd)
 {
-        struct snd_card *card = rtd->card->snd_card;
        struct snd_soc_dai *dai = rtd->cpu_dai;
        struct snd_pcm *pcm = rtd->pcm;
        int ret;
diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index a33fc51f363b..d0bcf3fcea01 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -424,7 +424,7 @@ static __devinit int kirkwood_i2s_dev_probe(struct platform_device *pdev)
        if (!priv->mem) {
                dev_err(&pdev->dev, "request_mem_region failed\n");
                err = -EBUSY;
-                goto error;
+                goto err_alloc;
        }
        priv->io = ioremap(priv->mem->start, SZ_16K);
diff --git a/sound/soc/omap/ams-delta.c b/sound/soc/omap/ams-delta.c
index 30fe0d0efe1c..0aa475f92efa 100644
--- a/sound/soc/omap/ams-delta.c
+++ b/sound/soc/omap/ams-delta.c
@@ -514,7 +514,7 @@ static int ams_delta_cx20442_init(struct snd_soc_pcm_runtime *rtd)
        }
        /* Set codec bias level */
-        ams_delta_set_bias_level(card, SND_SOC_BIAS_STANDBY);
+        ams_delta_set_bias_level(card, dapm, SND_SOC_BIAS_STANDBY);
        /* Add hook switch - can be used to control the codec from userspace
         * even if line discipline fails */
@@ -649,7 +649,9 @@ static void __exit ams_delta_module_exit(void)
                        ams_delta_hook_switch_gpios);
        /* Keep modem power on */
-        ams_delta_set_bias_level(&ams_delta_audio_card, SND_SOC_BIAS_STANDBY);
+        ams_delta_set_bias_level(&ams_delta_audio_card,
+                                 &ams_delta_audio_card.rtd[0].codec->dapm,
+                                 SND_SOC_BIAS_STANDBY);
        platform_device_unregister(cx20442_platform_device);
        platform_device_unregister(ams_delta_audio_platform_device);
diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig
index b99091fc34eb..65f980ef2870 100644
--- a/sound/soc/samsung/Kconfig
+++ b/sound/soc/samsung/Kconfig
@@ -185,6 +185,7 @@ config SND_SOC_SPEYSIDE
        select SND_SAMSUNG_I2S
        select SND_SOC_WM8996
        select SND_SOC_WM9081
+        select SND_SOC_WM1250_EV1
 config SND_SOC_SPEYSIDE_WM8962
        tristate "Audio support for Wolfson Speyside with WM8962"
diff --git a/sound/soc/samsung/h1940_uda1380.c b/sound/soc/samsung/h1940_uda1380.c
index 241f55d00660..c6c65892294e 100644
--- a/sound/soc/samsung/h1940_uda1380.c
+++ b/sound/soc/samsung/h1940_uda1380.c
@@ -13,6 +13,7 @@
 *
 */
+#include <linux/types.h>
 #include <linux/gpio.h>
 #include <sound/soc.h>
diff --git a/sound/soc/samsung/rx1950_uda1380.c b/sound/soc/samsung/rx1950_uda1380.c
index 1e574a5d440d..bc8c1676459f 100644
--- a/sound/soc/samsung/rx1950_uda1380.c
+++ b/sound/soc/samsung/rx1950_uda1380.c
@@ -17,6 +17,7 @@
 *
 */
+#include <linux/types.h>
 #include <linux/gpio.h>
 #include <sound/soc.h>
diff --git a/sound/soc/samsung/speyside_wm8962.c b/sound/soc/samsung/speyside_wm8962.c
index 0b9eb5f7ec4c..72535f2daaf2 100644
--- a/sound/soc/samsung/speyside_wm8962.c
+++ b/sound/soc/samsung/speyside_wm8962.c
@@ -23,6 +23,9 @@ static int speyside_wm8962_set_bias_level(struct snd_soc_card *card,
        struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
        int ret;
+        if (dapm->dev != codec_dai->dev)
+                return 0;
        switch (level) {
        case SND_SOC_BIAS_PREPARE:
                if (dapm->bias_level == SND_SOC_BIAS_STANDBY) {
@@ -57,6 +60,9 @@ static int speyside_wm8962_set_bias_level_post(struct snd_soc_card *card,
        struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
        int ret;
+        if (dapm->dev != codec_dai->dev)
+                return 0;
        switch (level) {
        case SND_SOC_BIAS_STANDBY:
                ret = snd_soc_dai_set_sysclk(codec_dai, WM8962_SYSCLK_MCLK,
diff --git a/sound/soc/soc-cache.c b/sound/soc/soc-cache.c
index d9f8aded51f3..20b7f3b003a3 100644
--- a/sound/soc/soc-cache.c
+++ b/sound/soc/soc-cache.c
@@ -203,14 +203,14 @@ static int snd_soc_rbtree_cache_sync(struct snd_soc_codec *codec)
                rbnode = rb_entry(node, struct snd_soc_rbtree_node, node);
                for (i = 0; i < rbnode->blklen; ++i) {
                        regtmp = rbnode->base_reg + i;
-                        WARN_ON(codec->writable_register &&
-                                codec->writable_register(codec, regtmp));
                        val = snd_soc_rbtree_get_register(rbnode, i);
                        def = snd_soc_get_cache_val(codec->reg_def_copy, i,
                                                    rbnode->word_size);
                        if (val == def)
                                continue;
+                        WARN_ON(!snd_soc_codec_writable_register(codec, regtmp));
                        codec->cache_bypass = 1;
                        ret = snd_soc_write(codec, regtmp, val);
                        codec->cache_bypass = 0;
@@ -563,8 +563,7 @@ static int snd_soc_lzo_cache_sync(struct snd_soc_codec *codec)
        lzo_blocks = codec->reg_cache;
        for_each_set_bit(i, lzo_blocks[0]->sync_bmp, lzo_blocks[0]->sync_bmp_nbits) {
-                WARN_ON(codec->writable_register &&
+                WARN_ON(!snd_soc_codec_writable_register(codec, i));
-                        codec->writable_register(codec, i));
                ret = snd_soc_cache_read(codec, i, &val);
                if (ret)
                        return ret;
@@ -823,8 +822,6 @@ static int snd_soc_flat_cache_sync(struct snd_soc_codec *codec)
        codec_drv = codec->driver;
        for (i = 0; i < codec_drv->reg_cache_size; ++i) {
-                WARN_ON(codec->writable_register &&
-                        codec->writable_register(codec, i));
                ret = snd_soc_cache_read(codec, i, &val);
                if (ret)
                        return ret;
@@ -832,6 +829,9 @@ static int snd_soc_flat_cache_sync(struct snd_soc_codec *codec)
                        if (snd_soc_get_cache_val(codec->reg_def_copy,
                                                  i, codec_drv->reg_word_size) == val)
                                continue;
+                WARN_ON(!snd_soc_codec_writable_register(codec, i));
                ret = snd_soc_write(codec, i, val);
                if (ret)
                        return ret;
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 83ad8ca27490..ef69f5a02709 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -30,6 +30,7 @@
 #include <linux/bitops.h>
 #include <linux/debugfs.h>
 #include <linux/platform_device.h>
+#include <linux/ctype.h>
 #include <linux/slab.h>
 #include <sound/ac97_codec.h>
 #include <sound/core.h>
@@ -1434,9 +1435,20 @@ static void snd_soc_instantiate_card(struct snd_soc_card *card)
                 "%s", card->name);
        snprintf(card->snd_card->longname, sizeof(card->snd_card->longname),
                 "%s", card->long_name ? card->long_name : card->name);
-        if (card->driver_name)
+        snprintf(card->snd_card->driver, sizeof(card->snd_card->driver),
-                strlcpy(card->snd_card->driver, card->driver_name,
+                 "%s", card->driver_name ? card->driver_name : card->name);
-                        sizeof(card->snd_card->driver));
+        for (i = 0; i < ARRAY_SIZE(card->snd_card->driver); i++) {
+                switch (card->snd_card->driver[i]) {
+                case '_':
+                case '-':
+                case '\0':
+                        break;
+                default:
+                        if (!isalnum(card->snd_card->driver[i]))
+                                card->snd_card->driver[i] = '_';
+                        break;
+                }
+        }
        if (card->late_probe) {
                ret = card->late_probe(card);
@@ -1633,7 +1645,7 @@ int snd_soc_codec_readable_register(struct snd_soc_codec *codec,
        if (codec->readable_register)
                return codec->readable_register(codec, reg);
        else
-                return 0;
+                return 1;
 }
 EXPORT_SYMBOL_GPL(snd_soc_codec_readable_register);
@@ -1651,7 +1663,7 @@ int snd_soc_codec_writable_register(struct snd_soc_codec *codec,
        if (codec->writable_register)
                return codec->writable_register(codec, reg);
        else
-                return 0;
+                return 1;
 }
 EXPORT_SYMBOL_GPL(snd_soc_codec_writable_register);
@@ -1913,7 +1925,7 @@ struct snd_kcontrol *snd_soc_cnew(const struct snd_kcontrol_new *_template,
        if (prefix) {
                name_len = strlen(long_name) + strlen(prefix) + 2;
-                name = kmalloc(name_len, GFP_ATOMIC);
+                name = kmalloc(name_len, GFP_KERNEL);
                if (!name)
                        return NULL;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 7e15914b3633..d67c637557a7 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2763,7 +2763,7 @@ EXPORT_SYMBOL_GPL(snd_soc_dapm_ignore_suspend);
 /**
 * snd_soc_dapm_free - free dapm resources
- * @card: SoC device
+ * @dapm: DAPM context
 *
 * Free all dapm widgets and resources.
 */
diff --git a/sound/soc/soc-io.c b/sound/soc/soc-io.c
index cca490c80589..a62f7dd4ba96 100644
--- a/sound/soc/soc-io.c
+++ b/sound/soc/soc-io.c
@@ -205,6 +205,25 @@ static unsigned int snd_soc_16_8_read_i2c(struct snd_soc_codec *codec,
 #define snd_soc_16_8_read_i2c NULL
 #endif
+#if defined(CONFIG_SPI_MASTER)
+static unsigned int snd_soc_16_8_read_spi(struct snd_soc_codec *codec,
+                                          unsigned int r)
+{
+        struct spi_device *spi = codec->control_data;
+        const u16 reg = cpu_to_be16(r | 0x100);
+        u8 data;
+        int ret;
+        ret = spi_write_then_read(spi, &reg, 2, &data, 1);
+        if (ret < 0)
+                return 0;
+        return data;
+}
+#else
+#define snd_soc_16_8_read_spi NULL
+#endif
 static int snd_soc_16_8_write(struct snd_soc_codec *codec, unsigned int reg,
                              unsigned int value)
 {
@@ -295,6 +314,7 @@ static struct {
        int (*write)(struct snd_soc_codec *codec, unsigned int, unsigned int);
        unsigned int (*read)(struct snd_soc_codec *, unsigned int);
        unsigned int (*i2c_read)(struct snd_soc_codec *, unsigned int);
+        unsigned int (*spi_read)(struct snd_soc_codec *, unsigned int);
 } io_types[] = {
        {
                .addr_bits = 4, .data_bits = 12,
@@ -318,6 +338,7 @@ static struct {
                .addr_bits = 16, .data_bits = 8,
                .write = snd_soc_16_8_write,
                .i2c_read = snd_soc_16_8_read_i2c,
+                .spi_read = snd_soc_16_8_read_spi,
        },
        {
                .addr_bits = 16, .data_bits = 16,
@@ -383,6 +404,8 @@ int snd_soc_codec_set_cache_io(struct snd_soc_codec *codec,
 #ifdef CONFIG_SPI_MASTER
                codec->hw_write = do_spi_write;
 #endif
+                if (io_types[i].spi_read)
+                        codec->hw_read = io_types[i].spi_read;
                codec->control_data = container_of(codec->dev,
                                                   struct spi_device,
diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c
index 7c17b98d5846..fa31d9c2abd8 100644
--- a/sound/soc/soc-jack.c
+++ b/sound/soc/soc-jack.c
@@ -105,7 +105,7 @@ void snd_soc_jack_report(struct snd_soc_jack *jack, int status, int mask)
        snd_soc_dapm_sync(dapm);
-        snd_jack_report(jack->jack, status);
+        snd_jack_report(jack->jack, jack->status);
 out:
        mutex_unlock(&codec->mutex);
@@ -327,7 +327,7 @@ int snd_soc_jack_add_gpios(struct snd_soc_jack *jack, int count,
                                              IRQF_TRIGGER_FALLING,
                                              gpios[i].name,
                                              &gpios[i]);
-                if (ret)
+                if (ret < 0)
                        goto err;
                if (gpios[i].wake) {
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index b5759397afa3..2879c883eebc 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -290,6 +290,9 @@ static int soc_pcm_close(struct snd_pcm_substream *substream)
        codec_dai->active--;
        codec->active--;
+        if (!cpu_dai->active && !codec_dai->active)
+                rtd->rate = 0;
        /* Muting the DAC suppresses artifacts caused during digital
         * shutdown, for example from stopping clocks.
         */
diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c
index 661373c2352a..be27f1d229af 100644
--- a/sound/soc/tegra/tegra_wm8903.c
+++ b/sound/soc/tegra/tegra_wm8903.c
@@ -319,7 +319,7 @@ static int tegra_wm8903_init(struct snd_soc_pcm_runtime *rtd)
        snd_soc_dapm_force_enable_pin(dapm, "Mic Bias");
        /* FIXME: Calculate automatically based on DAPM routes? */
-        if (!machine_is_harmony() && !machine_is_ventana())
+        if (!machine_is_harmony())
                snd_soc_dapm_nc_pin(dapm, "IN1L");
        if (!machine_is_seaboard() && !machine_is_aebl())
                snd_soc_dapm_nc_pin(dapm, "IN1R");
@@ -395,7 +395,7 @@ static __devinit int tegra_wm8903_driver_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, card);
        snd_soc_card_set_drvdata(card, machine);
-        if (machine_is_harmony() || machine_is_ventana()) {
+        if (machine_is_harmony()) {
                card->dapm_routes = harmony_audio_map;
                card->num_dapm_routes = ARRAY_SIZE(harmony_audio_map);
        } else if (machine_is_seaboard()) {
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 781d9e61adfb..ed120ca2353d 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -532,6 +532,7 @@ snd_usb_audio_probe(struct usb_device *dev,
 __error:
        if (chip && !chip->num_interfaces)
                snd_card_free(chip->card);
+        chip->probing = 0;
        mutex_unlock(&register_mutex);
 __err_val:
        return NULL;
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 3b8f7b80376b..e9d5c271db69 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -30,6 +30,8 @@ endif
 # Define EXTRA_CFLAGS=-m64 or EXTRA_CFLAGS=-m32 as appropriate for cross-builds.
 #
 # Define NO_DWARF if you do not want debug-info analysis feature at all.
+#
+# Define WERROR=0 to disable treating any warnings as errors.
 $(OUTPUT)PERF-VERSION-FILE: .FORCE-PERF-VERSION-FILE
        @$(SHELL_PATH) util/PERF-VERSION-GEN $(OUTPUT)
@@ -63,6 +65,11 @@ ifeq ($(ARCH),x86_64)
        endif
 endif
+# Treat warnings as errors unless directed not to
+ifneq ($(WERROR),0)
+        CFLAGS_WERROR := -Werror
+endif
 #
 # Include saner warnings here, which can catch bugs:
 #
@@ -95,7 +102,7 @@ ifndef PERF_DEBUG
  CFLAGS_OPTIMIZE = -O6
 endif
-CFLAGS = -fno-omit-frame-pointer -ggdb3 -Wall -Wextra -std=gnu99 -Werror $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
+CFLAGS = -fno-omit-frame-pointer -ggdb3 -Wall -Wextra -std=gnu99 $(CFLAGS_WERROR) $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
 EXTLIBS = -lpthread -lrt -lelf -lm
 ALL_CFLAGS = $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
 ALL_LDFLAGS = $(LDFLAGS)
diff --git a/tools/perf/arch/arm/util/dwarf-regs.c b/tools/perf/arch/arm/util/dwarf-regs.c
index fff6450c8c99..e8d5c551c69c 100644
--- a/tools/perf/arch/arm/util/dwarf-regs.c
+++ b/tools/perf/arch/arm/util/dwarf-regs.c
@@ -8,7 +8,10 @@
 * published by the Free Software Foundation.
 */
+#include <stdlib.h>
+#ifndef __UCLIBC__
 #include <libio.h>
+#endif
 #include <dwarf-regs.h>
 struct pt_regs_dwarfnum {
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 6b0519f885e4..f4c3fbee4bad 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -161,6 +161,7 @@ static void config_attr(struct perf_evsel *evsel, struct perf_evlist *evlist)
        struct perf_event_attr *attr = &evsel->attr;
        int track = !evsel->idx; /* only the first counter needs these */
+        attr->disabled          = 1;
        attr->inherit           = !no_inherit;
        attr->read_format       = PERF_FORMAT_TOTAL_TIME_ENABLED |
                                  PERF_FORMAT_TOTAL_TIME_RUNNING |
@@ -671,6 +672,8 @@ static int __cmd_record(int argc, const char **argv)
                }
        }
+        perf_evlist__enable(evsel_list);
        /*
         * Let the child rip
         */
diff --git a/tools/perf/builtin-test.c b/tools/perf/builtin-test.c
index 55f4c76f2821..efe696f936e2 100644
--- a/tools/perf/builtin-test.c
+++ b/tools/perf/builtin-test.c
@@ -561,7 +561,7 @@ static int test__basic_mmap(void)
                }
                err = perf_event__parse_sample(event, attr.sample_type, sample_size,
-                                               false, &sample);
+                                               false, &sample, false);
                if (err) {
                        pr_err("Can't parse sample, err = %d\n", err);
                        goto out_munmap;
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index a43433f08300..d28013b7d61c 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -191,7 +191,8 @@ static void __zero_source_counters(struct sym_entry *syme)
        symbol__annotate_zero_histograms(sym);
 }
-static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
+static void record_precise_ip(struct sym_entry *syme, struct map *map,
+                              int counter, u64 ip)
 {
        struct annotation *notes;
        struct symbol *sym;
@@ -205,8 +206,8 @@ static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
        if (pthread_mutex_trylock(&notes->lock))
                return;
-        ip = syme->map->map_ip(syme->map, ip);
+        ip = map->map_ip(map, ip);
-        symbol__inc_addr_samples(sym, syme->map, counter, ip);
+        symbol__inc_addr_samples(sym, map, counter, ip);
        pthread_mutex_unlock(&notes->lock);
 }
@@ -810,7 +811,7 @@ static void perf_event__process_sample(const union perf_event *event,
                evsel = perf_evlist__id2evsel(top.evlist, sample->id);
                assert(evsel != NULL);
                syme->count[evsel->idx]++;
-                record_precise_ip(syme, evsel->idx, ip);
+                record_precise_ip(syme, al.map, evsel->idx, ip);
                pthread_mutex_lock(&top.active_symbols_lock);
                if (list_empty(&syme->node) || !syme->node.next) {
                        static bool first = true;
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 3c1b8a632101..437f8ca679a0 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -169,12 +169,17 @@ static int perf_event__synthesize_mmap_events(union perf_event *event,
                        continue;
                pbf += n + 3;
                if (*pbf == 'x') { /* vm_exec */
+                        char anonstr[] = "//anon\n";
                        char *execname = strchr(bf, '/');
                        /* Catch VDSO */
                        if (execname == NULL)
                                execname = strstr(bf, "[vdso]");
+                        /* Catch anonymous mmaps */
+                        if ((execname == NULL) && !strstr(bf, "["))
+                                execname = anonstr;
                        if (execname == NULL)
                                continue;
diff --git a/tools/perf/util/event.h b/tools/perf/util/event.h
index 1d7f66488a88..357a85b85248 100644
--- a/tools/perf/util/event.h
+++ b/tools/perf/util/event.h
@@ -186,6 +186,6 @@ const char *perf_event__name(unsigned int id);
 int perf_event__parse_sample(const union perf_event *event, u64 type,
                             int sample_size, bool sample_id_all,
-                             struct perf_sample *sample);
+                             struct perf_sample *sample, bool swapped);
 #endif /* __PERF_RECORD_H */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index c12bd476c6f7..72e9f4886b6d 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -113,6 +113,19 @@ void perf_evlist__disable(struct perf_evlist *evlist)
        }
 }
+void perf_evlist__enable(struct perf_evlist *evlist)
+{
+        int cpu, thread;
+        struct perf_evsel *pos;
+        for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
+                list_for_each_entry(pos, &evlist->entries, node) {
+                        for (thread = 0; thread < evlist->threads->nr; thread++)
+                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_ENABLE);
+                }
+        }
+}
 int perf_evlist__alloc_pollfd(struct perf_evlist *evlist)
 {
        int nfds = evlist->cpus->nr * evlist->threads->nr * evlist->nr_entries;
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index ce85ae9ae57a..f34915002745 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -54,6 +54,7 @@ int perf_evlist__mmap(struct perf_evlist *evlist, int pages, bool overwrite);
 void perf_evlist__munmap(struct perf_evlist *evlist);
 void perf_evlist__disable(struct perf_evlist *evlist);
+void perf_evlist__enable(struct perf_evlist *evlist);
 static inline void perf_evlist__set_maps(struct perf_evlist *evlist,
                                         struct cpu_map *cpus,
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index a03a36b7908a..c5748c52318f 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -7,6 +7,8 @@
 * Released under the GPL v2. (and only v2, not any later version)
 */
+#include <byteswap.h>
+#include "asm/bug.h"
 #include "evsel.h"
 #include "evlist.h"
 #include "util.h"
@@ -342,10 +344,20 @@ static bool sample_overlap(const union perf_event *event,
 int perf_event__parse_sample(const union perf_event *event, u64 type,
                             int sample_size, bool sample_id_all,
-                             struct perf_sample *data)
+                             struct perf_sample *data, bool swapped)
 {
        const u64 *array;
+        /*
+         * used for cross-endian analysis. See git commit 65014ab3
+         * for why this goofiness is needed.
+         */
+        union {
+                u64 val64;
+                u32 val32[2];
+        } u;
        data->cpu = data->pid = data->tid = -1;
        data->stream_id = data->id = data->time = -1ULL;
@@ -366,9 +378,16 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_TID) {
-                u32 *p = (u32 *)array;
+                u.val64 = *array;
-                data->pid = p[0];
+                if (swapped) {
-                data->tid = p[1];
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
+                data->pid = u.val32[0];
+                data->tid = u.val32[1];
                array++;
        }
@@ -395,8 +414,15 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_CPU) {
-                u32 *p = (u32 *)array;
-                data->cpu = *p;
+                u.val64 = *array;
+                if (swapped) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                }
+                data->cpu = u.val32[0];
                array++;
        }
@@ -423,18 +449,24 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_RAW) {
-                u32 *p = (u32 *)array;
+                u.val64 = *array;
+                if (WARN_ONCE(swapped,
+                              "Endianness of raw data not corrected!\n")) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
                if (sample_overlap(event, array, sizeof(u32)))
                        return -EFAULT;
-                data->raw_size = *p;
+                data->raw_size = u.val32[0];
-                p++;
-                if (sample_overlap(event, p, data->raw_size))
+                if (sample_overlap(event, &u.val32[1], data->raw_size))
                        return -EFAULT;
-                data->raw_data = p;
+                data->raw_data = &u.val32[1];
        }
        return 0;
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 555fc3864b90..5d732621a462 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -659,7 +659,7 @@ static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
                if (!die_find_variable_at(&pf->cu_die, pf->pvar->var, 0, &vr_die))
                        ret = -ENOENT;
        }
-        if (ret == 0)
+        if (ret >= 0)
                ret = convert_variable(&vr_die, pf);
        if (ret < 0)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index cbc8f215d4b7..7624324efad4 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -803,7 +803,7 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
                first = list_entry(evlist->entries.next, struct perf_evsel, node);
                err = perf_event__parse_sample(event, first->attr.sample_type,
                                               perf_evsel__sample_size(first),
-                                               sample_id_all, &pevent->sample);
+                                               sample_id_all, &pevent->sample, false);
                if (err)
                        return PyErr_Format(PyExc_OSError,
                                            "perf: can't parse sample, err=%d", err);
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index 170601e67d6b..974d0cbee5e9 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -162,7 +162,8 @@ static inline int perf_session__parse_sample(struct perf_session *session,
 {
        return perf_event__parse_sample(event, session->sample_type,
                                        session->sample_size,
-                                        session->sample_id_all, sample);
+                                        session->sample_id_all, sample,
+                                        session->header.needs_swap);
 }
 struct perf_evsel *perf_session__find_first_evtype(struct perf_session *session,
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 401e220566fd..1ee8f1e40f18 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -151,11 +151,17 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)
 {
        u64 ip_l, ip_r;
+        if (!left->ms.sym && !right->ms.sym)
+                return right->level - left->level;
+        if (!left->ms.sym || !right->ms.sym)
+                return cmp_null(left->ms.sym, right->ms.sym);
        if (left->ms.sym == right->ms.sym)
                return 0;
-        ip_l = left->ms.sym ? left->ms.sym->start : left->ip;
+        ip_l = left->ms.sym->start;
-        ip_r = right->ms.sym ? right->ms.sym->start : right->ip;
+        ip_r = right->ms.sym->start;
        return (int64_t)(ip_r - ip_l);
 }
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 469c0264ed29..40eeaf07725b 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -74,16 +74,104 @@ static void dso__set_sorted_by_name(struct dso *dso, enum map_type type)
 bool symbol_type__is_a(char symbol_type, enum map_type map_type)
 {
+        symbol_type = toupper(symbol_type);
        switch (map_type) {
        case MAP__FUNCTION:
                return symbol_type == 'T' || symbol_type == 'W';
        case MAP__VARIABLE:
-                return symbol_type == 'D' || symbol_type == 'd';
+                return symbol_type == 'D';
        default:
                return false;
        }
 }
+static int prefix_underscores_count(const char *str)
+{
+        const char *tail = str;
+        while (*tail == '_')
+                tail++;
+        return tail - str;
+}
+#define SYMBOL_A 0
+#define SYMBOL_B 1
+static int choose_best_symbol(struct symbol *syma, struct symbol *symb)
+{
+        s64 a;
+        s64 b;
+        /* Prefer a symbol with non zero length */
+        a = syma->end - syma->start;
+        b = symb->end - symb->start;
+        if ((b == 0) && (a > 0))
+                return SYMBOL_A;
+        else if ((a == 0) && (b > 0))
+                return SYMBOL_B;
+        /* Prefer a non weak symbol over a weak one */
+        a = syma->binding == STB_WEAK;
+        b = symb->binding == STB_WEAK;
+        if (b && !a)
+                return SYMBOL_A;
+        if (a && !b)
+                return SYMBOL_B;
+        /* Prefer a global symbol over a non global one */
+        a = syma->binding == STB_GLOBAL;
+        b = symb->binding == STB_GLOBAL;
+        if (a && !b)
+                return SYMBOL_A;
+        if (b && !a)
+                return SYMBOL_B;
+        /* Prefer a symbol with less underscores */
+        a = prefix_underscores_count(syma->name);
+        b = prefix_underscores_count(symb->name);
+        if (b > a)
+                return SYMBOL_A;
+        else if (a > b)
+                return SYMBOL_B;
+        /* If all else fails, choose the symbol with the longest name */
+        if (strlen(syma->name) >= strlen(symb->name))
+                return SYMBOL_A;
+        else
+                return SYMBOL_B;
+}
+static void symbols__fixup_duplicate(struct rb_root *symbols)
+{
+        struct rb_node *nd;
+        struct symbol *curr, *next;
+        nd = rb_first(symbols);
+        while (nd) {
+                curr = rb_entry(nd, struct symbol, rb_node);
+again:
+                nd = rb_next(&curr->rb_node);
+                next = rb_entry(nd, struct symbol, rb_node);
+                if (!nd)
+                        break;
+                if (curr->start != next->start)
+                        continue;
+                if (choose_best_symbol(curr, next) == SYMBOL_A) {
+                        rb_erase(&next->rb_node, symbols);
+                        goto again;
+                } else {
+                        nd = rb_next(&curr->rb_node);
+                        rb_erase(&curr->rb_node, symbols);
+                }
+        }
+}
 static void symbols__fixup_end(struct rb_root *symbols)
 {
        struct rb_node *nd, *prevnd = rb_first(symbols);
@@ -438,18 +526,11 @@ int kallsyms__parse(const char *filename, void *arg,
        char *line = NULL;
        size_t n;
        int err = -1;
-        u64 prev_start = 0;
-        char prev_symbol_type = 0;
-        char *prev_symbol_name;
        FILE *file = fopen(filename, "r");
        if (file == NULL)
                goto out_failure;
-        prev_symbol_name = malloc(KSYM_NAME_LEN);
-        if (prev_symbol_name == NULL)
-                goto out_close;
        err = 0;
        while (!feof(file)) {
@@ -470,7 +551,7 @@ int kallsyms__parse(const char *filename, void *arg,
                if (len + 2 >= line_len)
                        continue;
-                symbol_type = toupper(line[len]);
+                symbol_type = line[len];
                len += 2;
                symbol_name = line + len;
                len = line_len - len;
@@ -480,24 +561,18 @@ int kallsyms__parse(const char *filename, void *arg,
                        break;
                }
-                if (prev_symbol_type) {
+                /*
-                        u64 end = start;
+                 * module symbols are not sorted so we add all
-                        if (end != prev_start)
+                 * symbols with zero length and rely on
-                                --end;
+                 * symbols__fixup_end() to fix it up.
-                        err = process_symbol(arg, prev_symbol_name,
+                 */
-                                             prev_symbol_type, prev_start, end);
+                err = process_symbol(arg, symbol_name,
-                        if (err)
+                                     symbol_type, start, start);
-                                break;
+                if (err)
-                }
+                        break;
-                memcpy(prev_symbol_name, symbol_name, len + 1);
-                prev_symbol_type = symbol_type;
-                prev_start = start;
        }
-        free(prev_symbol_name);
        free(line);
-out_close:
        fclose(file);
        return err;
@@ -703,6 +778,9 @@ int dso__load_kallsyms(struct dso *dso, const char *filename,
        if (dso__load_all_kallsyms(dso, filename, map) < 0)
                return -1;
+        symbols__fixup_duplicate(&dso->symbols[map->type]);
+        symbols__fixup_end(&dso->symbols[map->type]);
        if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
                dso->symtab_type = SYMTAB__GUEST_KALLSYMS;
        else
@@ -1092,8 +1170,7 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
        if (dso->has_build_id) {
                u8 build_id[BUILD_ID_SIZE];
-                if (elf_read_build_id(elf, build_id,
+                if (elf_read_build_id(elf, build_id, BUILD_ID_SIZE) < 0)
-                                      BUILD_ID_SIZE) != BUILD_ID_SIZE)
                        goto out_elf_end;
                if (!dso__build_id_equal(dso, build_id))
@@ -1111,6 +1188,8 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
        }
        opdsec = elf_section_by_name(elf, &ehdr, &opdshdr, ".opd", &opdidx);
+        if (opdshdr.sh_type != SHT_PROGBITS)
+                opdsec = NULL;
        if (opdsec)
                opddata = elf_rawdata(opdsec, NULL);
@@ -1276,6 +1355,7 @@ new_symbol:
         * For misannotated, zeroed, ASM function sizes.
         */
        if (nr > 0) {
+                symbols__fixup_duplicate(&dso->symbols[map->type]);
                symbols__fixup_end(&dso->symbols[map->type]);
                if (kmap) {
                        /*
@@ -1362,8 +1442,8 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
        ptr = data->d_buf;
        while (ptr < (data->d_buf + data->d_size)) {
                GElf_Nhdr *nhdr = ptr;
-                int namesz = NOTE_ALIGN(nhdr->n_namesz),
+                size_t namesz = NOTE_ALIGN(nhdr->n_namesz),
-                    descsz = NOTE_ALIGN(nhdr->n_descsz);
+                       descsz = NOTE_ALIGN(nhdr->n_descsz);
                const char *name;
                ptr += sizeof(*nhdr);
@@ -1372,8 +1452,10 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
                if (nhdr->n_type == NT_GNU_BUILD_ID &&
                    nhdr->n_namesz == sizeof("GNU")) {
                        if (memcmp(name, "GNU", sizeof("GNU")) == 0) {
-                                memcpy(bf, ptr, BUILD_ID_SIZE);
+                                size_t sz = min(size, descsz);
-                                err = BUILD_ID_SIZE;
+                                memcpy(bf, ptr, sz);
+                                memset(bf + sz, 0, size - sz);
+                                err = descsz;
                                break;
                        }
                }
@@ -1425,7 +1507,7 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size)
        while (1) {
                char bf[BUFSIZ];
                GElf_Nhdr nhdr;
-                int namesz, descsz;
+                size_t namesz, descsz;
                if (read(fd, &nhdr, sizeof(nhdr)) != sizeof(nhdr))
                        break;
@@ -1434,15 +1516,16 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size)
                descsz = NOTE_ALIGN(nhdr.n_descsz);
                if (nhdr.n_type == NT_GNU_BUILD_ID &&
                    nhdr.n_namesz == sizeof("GNU")) {
-                        if (read(fd, bf, namesz) != namesz)
+                        if (read(fd, bf, namesz) != (ssize_t)namesz)
                                break;
                        if (memcmp(bf, "GNU", sizeof("GNU")) == 0) {
-                                if (read(fd, build_id,
+                                size_t sz = min(descsz, size);
-                                    BUILD_ID_SIZE) == BUILD_ID_SIZE) {
+                                if (read(fd, build_id, sz) == (ssize_t)sz) {
+                                        memset(build_id + sz, 0, size - sz);
                                        err = 0;
                                        break;
                                }
-                        } else if (read(fd, bf, descsz) != descsz)
+                        } else if (read(fd, bf, descsz) != (ssize_t)descsz)
                                break;
                } else {
                        int n = namesz + descsz;
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 94c2cf0a98b8..e8a03aceceb1 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -24,7 +24,7 @@
 # Set the following to `true' to make a unstripped, unoptimized
 # binary. Leave this set to `false' for production use.
-DEBUG ?=        false
+DEBUG ?=        true
 # make the build silent. Set this to something else to make it noisy again.
 V ?=            false
@@ -35,7 +35,7 @@ NLS ?=		true
 # Set the following to 'true' to build/install the
 # cpufreq-bench benchmarking tool
-CPUFRQ_BENCH ?= true
+CPUFREQ_BENCH ?= true
 # Prefix to the directories we're installing to
 DESTDIR ?=
@@ -137,9 +137,10 @@ CFLAGS +=	-pipe
 ifeq ($(strip $(NLS)),true)
        INSTALL_NLS += install-gmo
        COMPILE_NLS += create-gmo
+        CFLAGS += -DNLS
 endif
-ifeq ($(strip $(CPUFRQ_BENCH)),true)
+ifeq ($(strip $(CPUFREQ_BENCH)),true)
        INSTALL_BENCH += install-bench
        COMPILE_BENCH += compile-bench
 endif
diff --git a/tools/power/cpupower/debug/x86_64/Makefile b/tools/power/cpupower/debug/x86_64/Makefile
index dbf13998462a..3326217dd311 100644
--- a/tools/power/cpupower/debug/x86_64/Makefile
+++ b/tools/power/cpupower/debug/x86_64/Makefile
@@ -1,10 +1,10 @@
 default: all
-centrino-decode: centrino-decode.c
+centrino-decode: ../i386/centrino-decode.c
-        $(CC) $(CFLAGS) -o centrino-decode centrino-decode.c
+        $(CC) $(CFLAGS) -o $@ $<
-powernow-k8-decode: powernow-k8-decode.c
+powernow-k8-decode: ../i386/powernow-k8-decode.c
-        $(CC) $(CFLAGS) -o powernow-k8-decode powernow-k8-decode.c
+        $(CC) $(CFLAGS) -o $@ $<
 all: centrino-decode powernow-k8-decode
diff --git a/tools/power/cpupower/debug/x86_64/centrino-decode.c b/tools/power/cpupower/debug/x86_64/centrino-decode.c
deleted file mode 120000
index 26fb3f1d8fc7..000000000000
--- a/tools/power/cpupower/debug/x86_64/centrino-decode.c
+++ /dev/null
@@ -1 +0,0 @@
-../i386/centrino-decode.c
-\ No newline at end of file
diff --git a/tools/power/cpupower/debug/x86_64/powernow-k8-decode.c b/tools/power/cpupower/debug/x86_64/powernow-k8-decode.c
deleted file mode 120000
index eb30c79cf9df..000000000000
--- a/tools/power/cpupower/debug/x86_64/powernow-k8-decode.c
+++ /dev/null
@@ -1 +0,0 @@
-../i386/powernow-k8-decode.c
-\ No newline at end of file
diff --git a/tools/power/cpupower/man/cpupower-frequency-info.1 b/tools/power/cpupower/man/cpupower-frequency-info.1
index 3194811d58f5..bb60a8d1e45a 100644
--- a/tools/power/cpupower/man/cpupower-frequency-info.1
+++ b/tools/power/cpupower/man/cpupower-frequency-info.1
@@ -1,10 +1,10 @@
-.TH "cpufreq-info" "1" "0.1" "Mattia Dongili" ""
+.TH "cpupower-frequency-info" "1" "0.1" "Mattia Dongili" ""
 .SH "NAME"
 .LP 
-cpufreq\-info \- Utility to retrieve cpufreq kernel information
+cpupower frequency\-info \- Utility to retrieve cpufreq kernel information
 .SH "SYNTAX"
 .LP 
-cpufreq\-info [\fIoptions\fP]
+cpupower [ \-c cpulist ] frequency\-info [\fIoptions\fP]
 .SH "DESCRIPTION"
 .LP 
 A small tool which prints out cpufreq information helpful to developers and interested users.
diff --git a/tools/power/cpupower/man/cpupower-frequency-set.1 b/tools/power/cpupower/man/cpupower-frequency-set.1
index 26e3e13eee3b..685f469093ad 100644
--- a/tools/power/cpupower/man/cpupower-frequency-set.1
+++ b/tools/power/cpupower/man/cpupower-frequency-set.1
@@ -1,13 +1,13 @@
-.TH "cpufreq-set" "1" "0.1" "Mattia Dongili" ""
+.TH "cpupower-freqency-set" "1" "0.1" "Mattia Dongili" ""
 .SH "NAME"
 .LP 
-cpufreq\-set \- A small tool which allows to modify cpufreq settings.
+cpupower frequency\-set \- A small tool which allows to modify cpufreq settings.
 .SH "SYNTAX"
 .LP 
-cpufreq\-set [\fIoptions\fP]
+cpupower [ \-c cpu ] frequency\-set [\fIoptions\fP]
 .SH "DESCRIPTION"
 .LP 
-cpufreq\-set allows you to modify cpufreq settings without having to type e.g. "/sys/devices/system/cpu/cpu0/cpufreq/scaling_set_speed" all the time.
+cpupower frequency\-set allows you to modify cpufreq settings without having to type e.g. "/sys/devices/system/cpu/cpu0/cpufreq/scaling_set_speed" all the time.
 .SH "OPTIONS"
 .LP 
 .TP 
diff --git a/tools/power/cpupower/man/cpupower.1 b/tools/power/cpupower/man/cpupower.1
index 78c20feab85c..baf741d06e82 100644
--- a/tools/power/cpupower/man/cpupower.1
+++ b/tools/power/cpupower/man/cpupower.1
@@ -3,7 +3,7 @@
 cpupower \- Shows and sets processor power related values
 .SH SYNOPSIS
 .ft B
-.B cpupower [ \-c cpulist ] subcommand [ARGS]
+.B cpupower [ \-c cpulist ] <command> [ARGS]
 .B cpupower \-v|\-\-version
@@ -13,24 +13,24 @@ cpupower \- Shows and sets processor power related values
 \fBcpupower \fP is a collection of tools to examine and tune power saving
 related features of your processor.
-The manpages of the subcommands (cpupower\-<subcommand>(1)) provide detailed
+The manpages of the commands (cpupower\-<command>(1)) provide detailed
 descriptions of supported features. Run \fBcpupower help\fP to get an overview
-of supported subcommands.
+of supported commands.
 .SH Options
 .PP
 \-\-help, \-h
 .RS 4
-Shows supported subcommands and general usage.
+Shows supported commands and general usage.
 .RE
 .PP
 \-\-cpu cpulist,  \-c cpulist
 .RS 4
 Only show or set values for specific cores.
-This option is not supported by all subcommands, details can be found in the
+This option is not supported by all commands, details can be found in the
-manpages of the subcommands.
+manpages of the commands.
-Some subcommands access all cores (typically the *\-set commands), some only
+Some commands access all cores (typically the *\-set commands), some only
 the first core (typically the *\-info commands) by default.
 The syntax for <cpulist> is based on how the kernel exports CPU bitmasks via
diff --git a/tools/power/cpupower/utils/builtin.h b/tools/power/cpupower/utils/builtin.h
index c870ffba5219..c10496fbe3c6 100644
--- a/tools/power/cpupower/utils/builtin.h
+++ b/tools/power/cpupower/utils/builtin.h
@@ -8,11 +8,4 @@ extern int cmd_freq_info(int argc, const char **argv);
 extern int cmd_idle_info(int argc, const char **argv);
 extern int cmd_monitor(int argc, const char **argv);
-extern void set_help(void);
-extern void info_help(void);
-extern void freq_set_help(void);
-extern void freq_info_help(void);
-extern void idle_info_help(void);
-extern void monitor_help(void);
 #endif
diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c
index 5a1d25f056b3..28953c9a7bd5 100644
--- a/tools/power/cpupower/utils/cpufreq-info.c
+++ b/tools/power/cpupower/utils/cpufreq-info.c
@@ -510,37 +510,6 @@ static int get_latency(unsigned int cpu, unsigned int human)
        return 0;
 }
-void freq_info_help(void)
-{
-        printf(_("Usage: cpupower freqinfo [options]\n"));
-        printf(_("Options:\n"));
-        printf(_("  -e, --debug          Prints out debug information [default]\n"));
-        printf(_("  -f, --freq           Get frequency the CPU currently runs at, according\n"
-               "                       to the cpufreq core *\n"));
-        printf(_("  -w, --hwfreq         Get frequency the CPU currently runs at, by reading\n"
-               "                       it from hardware (only available to root) *\n"));
-        printf(_("  -l, --hwlimits       Determine the minimum and maximum CPU frequency allowed *\n"));
-        printf(_("  -d, --driver         Determines the used cpufreq kernel driver *\n"));
-        printf(_("  -p, --policy         Gets the currently used cpufreq policy *\n"));
-        printf(_("  -g, --governors      Determines available cpufreq governors *\n"));
-        printf(_("  -r, --related-cpus   Determines which CPUs run at the same hardware frequency *\n"));
-        printf(_("  -a, --affected-cpus  Determines which CPUs need to have their frequency\n"
-                        "                       coordinated by software *\n"));
-        printf(_("  -s, --stats          Shows cpufreq statistics if available\n"));
-        printf(_("  -y, --latency        Determines the maximum latency on CPU frequency changes *\n"));
-        printf(_("  -b, --boost          Checks for turbo or boost modes  *\n"));
-        printf(_("  -o, --proc           Prints out information like provided by the /proc/cpufreq\n"
-               "                       interface in 2.4. and early 2.6. kernels\n"));
-        printf(_("  -m, --human          human-readable output for the -f, -w, -s and -y parameters\n"));
-        printf(_("  -h, --help           Prints out this screen\n"));
-        printf("\n");
-        printf(_("If no argument is given, full output about\n"
-               "cpufreq is printed which is useful e.g. for reporting bugs.\n\n"));
-        printf(_("By default info of CPU 0 is shown which can be overridden\n"
-                 "with the cpupower --cpu main command option.\n"));
-}
 static struct option info_opts[] = {
        { .name = "debug",      .has_arg = no_argument,         .flag = NULL,   .val = 'e'},
        { .name = "boost",      .has_arg = no_argument,         .flag = NULL,   .val = 'b'},
@@ -556,7 +525,6 @@ static struct option info_opts[] = {
        { .name = "latency",    .has_arg = no_argument,         .flag = NULL,   .val = 'y'},
        { .name = "proc",       .has_arg = no_argument,         .flag = NULL,   .val = 'o'},
        { .name = "human",      .has_arg = no_argument,         .flag = NULL,   .val = 'm'},
-        { .name = "help",       .has_arg = no_argument,         .flag = NULL,   .val = 'h'},
        { },
 };
@@ -570,16 +538,12 @@ int cmd_freq_info(int argc, char **argv)
        int output_param = 0;
        do {
-                ret = getopt_long(argc, argv, "hoefwldpgrasmyb", info_opts, NULL);
+                ret = getopt_long(argc, argv, "oefwldpgrasmyb", info_opts, NULL);
                switch (ret) {
                case '?':
                        output_param = '?';
                        cont = 0;
                        break;
-                case 'h':
-                        output_param = 'h';
-                        cont = 0;
-                        break;
                case -1:
                        cont = 0;
                        break;
@@ -642,11 +606,7 @@ int cmd_freq_info(int argc, char **argv)
                return -EINVAL;
        case '?':
                printf(_("invalid or unknown argument\n"));
-                freq_info_help();
                return -EINVAL;
-        case 'h':
-                freq_info_help();
-                return EXIT_SUCCESS;
        case 'o':
                proc_cpufreq_output();
                return EXIT_SUCCESS;
diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c
index 5f783622bf31..dd1539eb8c63 100644
--- a/tools/power/cpupower/utils/cpufreq-set.c
+++ b/tools/power/cpupower/utils/cpufreq-set.c
@@ -20,34 +20,11 @@
 #define NORM_FREQ_LEN 32
-void freq_set_help(void)
-{
-        printf(_("Usage: cpupower frequency-set [options]\n"));
-        printf(_("Options:\n"));
-        printf(_("  -d FREQ, --min FREQ      new minimum CPU frequency the governor may select\n"));
-        printf(_("  -u FREQ, --max FREQ      new maximum CPU frequency the governor may select\n"));
-        printf(_("  -g GOV, --governor GOV   new cpufreq governor\n"));
-        printf(_("  -f FREQ, --freq FREQ     specific frequency to be set. Requires userspace\n"
-               "                           governor to be available and loaded\n"));
-        printf(_("  -r, --related            Switches all hardware-related CPUs\n"));
-        printf(_("  -h, --help               Prints out this screen\n"));
-        printf("\n");
-        printf(_("Notes:\n"
-               "1. Omitting the -c or --cpu argument is equivalent to setting it to \"all\"\n"));
-        printf(_("2. The -f FREQ, --freq FREQ parameter cannot be combined with any other parameter\n"
-               "   except the -c CPU, --cpu CPU parameter\n"
-               "3. FREQuencies can be passed in Hz, kHz (default), MHz, GHz, or THz\n"
-               "   by postfixing the value with the wanted unit name, without any space\n"
-               "   (FREQuency in kHz =^ Hz * 0.001 =^ MHz * 1000 =^ GHz * 1000000).\n"));
-}
 static struct option set_opts[] = {
        { .name = "min",        .has_arg = required_argument,   .flag = NULL,   .val = 'd'},
        { .name = "max",        .has_arg = required_argument,   .flag = NULL,   .val = 'u'},
        { .name = "governor",   .has_arg = required_argument,   .flag = NULL,   .val = 'g'},
        { .name = "freq",       .has_arg = required_argument,   .flag = NULL,   .val = 'f'},
-        { .name = "help",       .has_arg = no_argument,         .flag = NULL,   .val = 'h'},
        { .name = "related",    .has_arg = no_argument,         .flag = NULL,   .val='r'},
        { },
 };
@@ -80,7 +57,6 @@ const struct freq_units def_units[] = {
 static void print_unknown_arg(void)
 {
        printf(_("invalid or unknown argument\n"));
-        freq_set_help();
 }
 static unsigned long string_to_frequency(const char *str)
@@ -231,14 +207,11 @@ int cmd_freq_set(int argc, char **argv)
        /* parameter parsing */
        do {
-                ret = getopt_long(argc, argv, "d:u:g:f:hr", set_opts, NULL);
+                ret = getopt_long(argc, argv, "d:u:g:f:r", set_opts, NULL);
                switch (ret) {
                case '?':
                        print_unknown_arg();
                        return -EINVAL;
-                case 'h':
-                        freq_set_help();
-                        return 0;
                case -1:
                        cont = 0;
                        break;
diff --git a/tools/power/cpupower/utils/cpuidle-info.c b/tools/power/cpupower/utils/cpuidle-info.c
index 70da3574f1e9..b028267c1376 100644
--- a/tools/power/cpupower/utils/cpuidle-info.c
+++ b/tools/power/cpupower/utils/cpuidle-info.c
@@ -139,30 +139,14 @@ static void proc_cpuidle_cpu_output(unsigned int cpu)
        }
 }
-/* --freq / -f */
-void idle_info_help(void)
-{
-        printf(_ ("Usage: cpupower idleinfo [options]\n"));
-        printf(_ ("Options:\n"));
-        printf(_ ("  -s, --silent         Only show general C-state information\n"));
-        printf(_ ("  -o, --proc           Prints out information like provided by the /proc/acpi/processor/*/power\n"
-               "                       interface in older kernels\n"));
-        printf(_ ("  -h, --help           Prints out this screen\n"));
-        printf("\n");
-}
 static struct option info_opts[] = {
        { .name = "silent",     .has_arg = no_argument, .flag = NULL,   .val = 's'},
        { .name = "proc",       .has_arg = no_argument, .flag = NULL,   .val = 'o'},
-        { .name = "help",       .has_arg = no_argument, .flag = NULL,   .val = 'h'},
        { },
 };
 static inline void cpuidle_exit(int fail)
 {
-        idle_info_help();
        exit(EXIT_FAILURE);
 }
@@ -174,7 +158,7 @@ int cmd_idle_info(int argc, char **argv)
        unsigned int cpu = 0;
        do {
-                ret = getopt_long(argc, argv, "hos", info_opts, NULL);
+                ret = getopt_long(argc, argv, "os", info_opts, NULL);
                if (ret == -1)
                        break;
                switch (ret) {
@@ -182,10 +166,6 @@ int cmd_idle_info(int argc, char **argv)
                        output_param = '?';
                        cont = 0;
                        break;
-                case 'h':
-                        output_param = 'h';
-                        cont = 0;
-                        break;
                case 's':
                        verbose = 0;
                        break;
@@ -211,8 +191,6 @@ int cmd_idle_info(int argc, char **argv)
        case '?':
                printf(_("invalid or unknown argument\n"));
                cpuidle_exit(EXIT_FAILURE);
-        case 'h':
-                cpuidle_exit(EXIT_SUCCESS);
        }
        /* Default is: show output of CPU 0 only */
diff --git a/tools/power/cpupower/utils/cpupower-info.c b/tools/power/cpupower/utils/cpupower-info.c
index 85253cb7600e..3f68632c28c7 100644
--- a/tools/power/cpupower/utils/cpupower-info.c
+++ b/tools/power/cpupower/utils/cpupower-info.c
@@ -16,31 +16,16 @@
 #include "helpers/helpers.h"
 #include "helpers/sysfs.h"
-void info_help(void)
-{
-        printf(_("Usage: cpupower info [ -b ] [ -m ] [ -s ]\n"));
-        printf(_("Options:\n"));
-        printf(_("  -b, --perf-bias    Gets CPU's power vs performance policy on some\n"
-               "                           Intel models [0-15], see manpage for details\n"));
-        printf(_("  -m, --sched-mc     Gets the kernel's multi core scheduler policy.\n"));
-        printf(_("  -s, --sched-smt    Gets the kernel's thread sibling scheduler policy.\n"));
-        printf(_("  -h, --help               Prints out this screen\n"));
-        printf(_("\nPassing no option will show all info, by default only on core 0\n"));
-        printf("\n");
-}
 static struct option set_opts[] = {
        { .name = "perf-bias",  .has_arg = optional_argument,   .flag = NULL,   .val = 'b'},
        { .name = "sched-mc",   .has_arg = optional_argument,   .flag = NULL,   .val = 'm'},
        { .name = "sched-smt",  .has_arg = optional_argument,   .flag = NULL,   .val = 's'},
-        { .name = "help",       .has_arg = no_argument,         .flag = NULL,   .val = 'h'},
        { },
 };
 static void print_wrong_arg_exit(void)
 {
        printf(_("invalid or unknown argument\n"));
-        info_help();
        exit(EXIT_FAILURE);
 }
@@ -64,11 +49,8 @@ int cmd_info(int argc, char **argv)
        textdomain(PACKAGE);
        /* parameter parsing */
-        while ((ret = getopt_long(argc, argv, "msbh", set_opts, NULL)) != -1) {
+        while ((ret = getopt_long(argc, argv, "msb", set_opts, NULL)) != -1) {
                switch (ret) {
-                case 'h':
-                        info_help();
-                        return 0;
                case 'b':
                        if (params.perf_bias)
                                print_wrong_arg_exit();
diff --git a/tools/power/cpupower/utils/cpupower-set.c b/tools/power/cpupower/utils/cpupower-set.c
index bc1b391e46f0..dc4de3762111 100644
--- a/tools/power/cpupower/utils/cpupower-set.c
+++ b/tools/power/cpupower/utils/cpupower-set.c
@@ -17,30 +17,16 @@
 #include "helpers/sysfs.h"
 #include "helpers/bitmask.h"
-void set_help(void)
-{
-        printf(_("Usage: cpupower set [ -b val ] [ -m val ] [ -s val ]\n"));
-        printf(_("Options:\n"));
-        printf(_("  -b, --perf-bias [VAL]    Sets CPU's power vs performance policy on some\n"
-               "                           Intel models [0-15], see manpage for details\n"));
-        printf(_("  -m, --sched-mc  [VAL]    Sets the kernel's multi core scheduler policy.\n"));
-        printf(_("  -s, --sched-smt [VAL]    Sets the kernel's thread sibling scheduler policy.\n"));
-        printf(_("  -h, --help               Prints out this screen\n"));
-        printf("\n");
-}
 static struct option set_opts[] = {
        { .name = "perf-bias",  .has_arg = optional_argument,   .flag = NULL,   .val = 'b'},
        { .name = "sched-mc",   .has_arg = optional_argument,   .flag = NULL,   .val = 'm'},
        { .name = "sched-smt",  .has_arg = optional_argument,   .flag = NULL,   .val = 's'},
-        { .name = "help",       .has_arg = no_argument,         .flag = NULL,   .val = 'h'},
        { },
 };
 static void print_wrong_arg_exit(void)
 {
        printf(_("invalid or unknown argument\n"));
-        set_help();
        exit(EXIT_FAILURE);
 }
@@ -66,12 +52,9 @@ int cmd_set(int argc, char **argv)
        params.params = 0;
        /* parameter parsing */
-        while ((ret = getopt_long(argc, argv, "m:s:b:h",
+        while ((ret = getopt_long(argc, argv, "m:s:b:",
                                                set_opts, NULL)) != -1) {
                switch (ret) {
-                case 'h':
-                        set_help();
-                        return 0;
                case 'b':
                        if (params.perf_bias)
                                print_wrong_arg_exit();
@@ -110,10 +93,8 @@ int cmd_set(int argc, char **argv)
                }
        };
-        if (!params.params) {
+        if (!params.params)
-                set_help();
+                print_wrong_arg_exit();
-                return -EINVAL;
-        }
        if (params.sched_mc) {
                ret = sysfs_set_sched("mc", sched_mc);
diff --git a/tools/power/cpupower/utils/cpupower.c b/tools/power/cpupower/utils/cpupower.c
index 5844ae0f786f..52bee591c1c5 100644
--- a/tools/power/cpupower/utils/cpupower.c
+++ b/tools/power/cpupower/utils/cpupower.c
@@ -11,6 +11,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <errno.h>
 #include "builtin.h"
 #include "helpers/helpers.h"
@@ -19,13 +20,12 @@
 struct cmd_struct {
        const char *cmd;
        int (*main)(int, const char **);
-        void (*usage)(void);
        int needs_root;
 };
 #define ARRAY_SIZE(x) (sizeof(x)/sizeof(x[0]))
-int cmd_help(int argc, const char **argv);
+static int cmd_help(int argc, const char **argv);
 /* Global cpu_info object available for all binaries
 * Info only retrieved from CPU 0
@@ -44,55 +44,66 @@ int be_verbose;
 static void print_help(void);
 static struct cmd_struct commands[] = {
-        { "frequency-info",     cmd_freq_info,  freq_info_help, 0       },
+        { "frequency-info",     cmd_freq_info,  0       },
-        { "frequency-set",      cmd_freq_set,   freq_set_help,  1       },
+        { "frequency-set",      cmd_freq_set,   1       },
-        { "idle-info",          cmd_idle_info,  idle_info_help, 0       },
+        { "idle-info",          cmd_idle_info,  0       },
-        { "set",                cmd_set,        set_help,       1       },
+        { "set",                cmd_set,        1       },
-        { "info",               cmd_info,       info_help,      0       },
+        { "info",               cmd_info,       0       },
-        { "monitor",            cmd_monitor,    monitor_help,   0       },
+        { "monitor",            cmd_monitor,    0       },
-        { "help",               cmd_help,       print_help,     0       },
+        { "help",               cmd_help,       0       },
-        /*      { "bench",      cmd_bench,      NULL,           1       }, */
+        /*      { "bench",      cmd_bench,      1       }, */
 };
-int cmd_help(int argc, const char **argv)
-{
-        unsigned int i;
-        if (argc > 1) {
-                for (i = 0; i < ARRAY_SIZE(commands); i++) {
-                        struct cmd_struct *p = commands + i;
-                        if (strcmp(p->cmd, argv[1]))
-                                continue;
-                        if (p->usage) {
-                                p->usage();
-                                return EXIT_SUCCESS;
-                        }
-                }
-        }
-        print_help();
-        if (argc == 1)
-                return EXIT_SUCCESS; /* cpupower help */
-        return EXIT_FAILURE;
-}
 static void print_help(void)
 {
        unsigned int i;
 #ifdef DEBUG
-        printf(_("cpupower [ -d ][ -c cpulist ] subcommand [ARGS]\n"));
+        printf(_("Usage:\tcpupower [-d|--debug] [-c|--cpu cpulist ] <command> [<args>]\n"));
-        printf(_("  -d, --debug      May increase output (stderr) on some subcommands\n"));
 #else
-        printf(_("cpupower [ -c cpulist ] subcommand [ARGS]\n"));
+        printf(_("Usage:\tcpupower [-c|--cpu cpulist ] <command> [<args>]\n"));
 #endif
-        printf(_("cpupower --version\n"));
+        printf(_("Supported commands are:\n"));
-        printf(_("Supported subcommands are:\n"));
        for (i = 0; i < ARRAY_SIZE(commands); i++)
                printf("\t%s\n", commands[i].cmd);
-        printf(_("\nSome subcommands can make use of the -c cpulist option.\n"));
+        printf(_("\nNot all commands can make use of the -c cpulist option.\n"));
-        printf(_("Look at the general cpupower manpage how to use it\n"));
+        printf(_("\nUse 'cpupower help <command>' for getting help for above commands.\n"));
-        printf(_("and read up the subcommand's manpage whether it is supported.\n"));
+}
-        printf(_("\nUse cpupower help subcommand for getting help for above subcommands.\n"));
+static int print_man_page(const char *subpage)
+{
+        int len;
+        char *page;
+        len = 10; /* enough for "cpupower-" */
+        if (subpage != NULL)
+                len += strlen(subpage);
+        page = malloc(len);
+        if (!page)
+                return -ENOMEM;
+        sprintf(page, "cpupower");
+        if ((subpage != NULL) && strcmp(subpage, "help")) {
+                strcat(page, "-");
+                strcat(page, subpage);
+        }
+        execlp("man", "man", page, NULL);
+        /* should not be reached */
+        return -EINVAL;
+}
+static int cmd_help(int argc, const char **argv)
+{
+        if (argc > 1) {
+                print_man_page(argv[1]); /* exits within execlp() */
+                return EXIT_FAILURE;
+        }
+        print_help();
+        return EXIT_SUCCESS;
 }
 static void print_version(void)
diff --git a/tools/power/cpupower/utils/helpers/helpers.h b/tools/power/cpupower/utils/helpers/helpers.h
index 592ee362b877..2747e738efb0 100644
--- a/tools/power/cpupower/utils/helpers/helpers.h
+++ b/tools/power/cpupower/utils/helpers/helpers.h
@@ -16,11 +16,20 @@
 #include "helpers/bitmask.h"
 /* Internationalization ****************************/
+#ifdef NLS
 #define _(String) gettext(String)
 #ifndef gettext_noop
 #define gettext_noop(String) String
 #endif
 #define N_(String) gettext_noop(String)
+#else /* !NLS */
+#define _(String) String
+#define N_(String) String
+#endif
 /* Internationalization ****************************/
 extern int run_as_root;
@@ -96,6 +105,9 @@ struct cpupower_topology {
                int pkg;
                int core;
                int cpu;
+                /* flags */
+                unsigned int is_online:1;
        } *core_info;
 };
diff --git a/tools/power/cpupower/utils/helpers/sysfs.c b/tools/power/cpupower/utils/helpers/sysfs.c
index 55e2466674c6..c6343024a611 100644
--- a/tools/power/cpupower/utils/helpers/sysfs.c
+++ b/tools/power/cpupower/utils/helpers/sysfs.c
@@ -56,6 +56,56 @@ static unsigned int sysfs_write_file(const char *path,
        return (unsigned int) numwrite;
 }
+/*
+ * Detect whether a CPU is online
+ *
+ * Returns:
+ *     1 -> if CPU is online
+ *     0 -> if CPU is offline
+ *     negative errno values in error case
+ */
+int sysfs_is_cpu_online(unsigned int cpu)
+{
+        char path[SYSFS_PATH_MAX];
+        int fd;
+        ssize_t numread;
+        unsigned long long value;
+        char linebuf[MAX_LINE_LEN];
+        char *endp;
+        struct stat statbuf;
+        snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u", cpu);
+        if (stat(path, &statbuf) != 0)
+                return 0;
+        /*
+         * kernel without CONFIG_HOTPLUG_CPU
+         * -> cpuX directory exists, but not cpuX/online file
+         */
+        snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/online", cpu);
+        if (stat(path, &statbuf) != 0)
+                return 1;
+        fd = open(path, O_RDONLY);
+        if (fd == -1)
+                return -errno;
+        numread = read(fd, linebuf, MAX_LINE_LEN - 1);
+        if (numread < 1) {
+                close(fd);
+                return -EIO;
+        }
+        linebuf[numread] = '\0';
+        close(fd);
+        value = strtoull(linebuf, &endp, 0);
+        if (value > 1 || value < 0)
+                return -EINVAL;
+        return value;
+}
 /* CPUidle idlestate specific /sys/devices/system/cpu/cpuX/cpuidle/ access */
 /*
diff --git a/tools/power/cpupower/utils/helpers/sysfs.h b/tools/power/cpupower/utils/helpers/sysfs.h
index f9373e090637..8cb797bbceb0 100644
--- a/tools/power/cpupower/utils/helpers/sysfs.h
+++ b/tools/power/cpupower/utils/helpers/sysfs.h
@@ -7,6 +7,8 @@
 extern unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen);
+extern int sysfs_is_cpu_online(unsigned int cpu);
 extern unsigned long sysfs_get_idlestate_latency(unsigned int cpu,
                                                unsigned int idlestate);
 extern unsigned long sysfs_get_idlestate_usage(unsigned int cpu,
diff --git a/tools/power/cpupower/utils/helpers/topology.c b/tools/power/cpupower/utils/helpers/topology.c
index 385ee5c7570c..4eae2c47ba48 100644
--- a/tools/power/cpupower/utils/helpers/topology.c
+++ b/tools/power/cpupower/utils/helpers/topology.c
@@ -41,6 +41,8 @@ struct cpuid_core_info {
        unsigned int pkg;
        unsigned int thread;
        unsigned int cpu;
+        /* flags */
+        unsigned int is_online:1;
 };
 static int __compare(const void *t1, const void *t2)
@@ -78,6 +80,8 @@ int get_cpu_topology(struct cpupower_topology *cpu_top)
                return -ENOMEM;
        cpu_top->pkgs = cpu_top->cores = 0;
        for (cpu = 0; cpu < cpus; cpu++) {
+                cpu_top->core_info[cpu].cpu = cpu;
+                cpu_top->core_info[cpu].is_online = sysfs_is_cpu_online(cpu);
                cpu_top->core_info[cpu].pkg =
                        sysfs_topology_read_file(cpu, "physical_package_id");
                if ((int)cpu_top->core_info[cpu].pkg != -1 &&
@@ -85,7 +89,6 @@ int get_cpu_topology(struct cpupower_topology *cpu_top)
                        cpu_top->pkgs = cpu_top->core_info[cpu].pkg;
                cpu_top->core_info[cpu].core =
                        sysfs_topology_read_file(cpu, "core_id");
-                cpu_top->core_info[cpu].cpu = cpu;
        }
        cpu_top->pkgs++;
diff --git a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
index d048b96a6155..bcd22a1a3970 100644
--- a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
+++ b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
@@ -134,7 +134,7 @@ static struct cpuidle_monitor *cpuidle_register(void)
        /* Assume idle state count is the same for all CPUs */
        cpuidle_sysfs_monitor.hw_states_num = sysfs_get_idlestate_count(0);
-        if (cpuidle_sysfs_monitor.hw_states_num == 0)
+        if (cpuidle_sysfs_monitor.hw_states_num <= 0)
                return NULL;
        for (num = 0; num < cpuidle_sysfs_monitor.hw_states_num; num++) {
diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
index ba4bf068380d..0d6571e418db 100644
--- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
+++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
@@ -43,6 +43,12 @@ static struct cpupower_topology cpu_top;
 /* ToDo: Document this in the manpage */
 static char range_abbr[RANGE_MAX] = { 'T', 'C', 'P', 'M', };
+static void print_wrong_arg_exit(void)
+{
+        printf(_("invalid or unknown argument\n"));
+        exit(EXIT_FAILURE);
+}
 long long timespec_diff_us(struct timespec start, struct timespec end)
 {
        struct timespec temp;
@@ -56,21 +62,6 @@ long long timespec_diff_us(struct timespec start, struct timespec end)
        return (temp.tv_sec * 1000000) + (temp.tv_nsec / 1000);
 }
-void monitor_help(void)
-{
-        printf(_("cpupower monitor: [-m <mon1>,[<mon2>],.. ] command\n"));
-        printf(_("cpupower monitor: [-m <mon1>,[<mon2>],.. ] [ -i interval_sec ]\n"));
-        printf(_("cpupower monitor: -l\n"));
-        printf(_("\t command: pass an arbitrary command to measure specific workload\n"));
-        printf(_("\t -i: time intervall to measure for in seconds (default 1)\n"));
-        printf(_("\t -l: list available CPU sleep monitors (for use with -m)\n"));
-        printf(_("\t -m: show specific CPU sleep monitors only (in same order)\n"));
-        printf(_("\t -h: print this help\n"));
-        printf("\n");
-        printf(_("only one of: -l, -m are allowed\nIf none of them is passed,"));
-        printf(_(" all supported monitors are shown\n"));
-}
 void print_n_spaces(int n)
 {
        int x;
@@ -149,6 +140,10 @@ void print_results(int topology_depth, int cpu)
        unsigned long long result;
        cstate_t s;
+        /* Be careful CPUs may got resorted for pkg value do not just use cpu */
+        if (!bitmask_isbitset(cpus_chosen, cpu_top.core_info[cpu].cpu))
+                return;
        if (topology_depth > 2)
                printf("%4d|", cpu_top.core_info[cpu].pkg);
        if (topology_depth > 1)
@@ -190,9 +185,13 @@ void print_results(int topology_depth, int cpu)
                        }
                }
        }
-        /* cpu offline */
+        /*
-        if (cpu_top.core_info[cpu].pkg == -1 ||
+         * The monitor could still provide useful data, for example
-            cpu_top.core_info[cpu].core == -1) {
+         * AMD HW counters partly sit in PCI config space.
+         * It's up to the monitor plug-in to check .is_online, this one
+         * is just for additional info.
+         */
+        if (!cpu_top.core_info[cpu].is_online) {
                printf(_(" *is offline\n"));
                return;
        } else
@@ -238,7 +237,6 @@ static void parse_monitor_param(char *param)
        if (hits == 0) {
                printf(_("No matching monitor found in %s, "
                         "try -l option\n"), param);
-                monitor_help();
                exit(EXIT_FAILURE);
        }
        /* Override detected/registerd monitors array with requested one */
@@ -335,37 +333,27 @@ static void cmdline(int argc, char *argv[])
        int opt;
        progname = basename(argv[0]);
-        while ((opt = getopt(argc, argv, "+hli:m:")) != -1) {
+        while ((opt = getopt(argc, argv, "+li:m:")) != -1) {
                switch (opt) {
-                case 'h':
-                        monitor_help();
-                        exit(EXIT_SUCCESS);
                case 'l':
-                        if (mode) {
+                        if (mode)
-                                monitor_help();
+                                print_wrong_arg_exit();
-                                exit(EXIT_FAILURE);
-                        }
                        mode = list;
                        break;
                case 'i':
                        /* only allow -i with -m or no option */
-                        if (mode && mode != show) {
+                        if (mode && mode != show)
-                                monitor_help();
+                                print_wrong_arg_exit();
-                                exit(EXIT_FAILURE);
-                        }
                        interval = atoi(optarg);
                        break;
                case 'm':
-                        if (mode) {
+                        if (mode)
-                                monitor_help();
+                                print_wrong_arg_exit();
-                                exit(EXIT_FAILURE);
-                        }
                        mode = show;
                        show_monitors_param = optarg;
                        break;
                default:
-                        monitor_help();
+                        print_wrong_arg_exit();
-                        exit(EXIT_FAILURE);
                }
        }
        if (!mode)
@@ -385,6 +373,10 @@ int cmd_monitor(int argc, char **argv)
                return EXIT_FAILURE;
        }
+        /* Default is: monitor all CPUs */
+        if (bitmask_isallclear(cpus_chosen))
+                bitmask_setall(cpus_chosen);
        dprint("System has up to %d CPU cores\n", cpu_count);
        for (num = 0; all_monitors[num]; num++) {
diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
index 63ca87a05e5f..5650ab5a2c20 100644
--- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
@@ -22,12 +22,15 @@
 #define MSR_TSC 0x10
+#define MSR_AMD_HWCR 0xc0010015
 enum mperf_id { C0 = 0, Cx, AVG_FREQ, MPERF_CSTATE_COUNT };
 static int mperf_get_count_percent(unsigned int self_id, double *percent,
                                   unsigned int cpu);
 static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
                                unsigned int cpu);
+static struct timespec time_start, time_end;
 static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = {
        {
@@ -54,19 +57,33 @@ static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = {
        },
 };
+enum MAX_FREQ_MODE { MAX_FREQ_SYSFS, MAX_FREQ_TSC_REF };
+static int max_freq_mode;
+/*
+ * The max frequency mperf is ticking at (in C0), either retrieved via:
+ *   1) calculated after measurements if we know TSC ticks at mperf/P0 frequency
+ *   2) cpufreq /sys/devices/.../cpu0/cpufreq/cpuinfo_max_freq at init time
+ * 1. Is preferred as it also works without cpufreq subsystem (e.g. on Xen)
+ */
+static unsigned long max_frequency;
 static unsigned long long tsc_at_measure_start;
 static unsigned long long tsc_at_measure_end;
-static unsigned long max_frequency;
 static unsigned long long *mperf_previous_count;
 static unsigned long long *aperf_previous_count;
 static unsigned long long *mperf_current_count;
 static unsigned long long *aperf_current_count;
 /* valid flag for all CPUs. If a MSR read failed it will be zero */
 static int *is_valid;
 static int mperf_get_tsc(unsigned long long *tsc)
 {
-        return read_msr(0, MSR_TSC, tsc);
+        int ret;
+        ret = read_msr(0, MSR_TSC, tsc);
+        if (ret)
+                dprint("Reading TSC MSR failed, returning %llu\n", *tsc);
+        return ret;
 }
 static int mperf_init_stats(unsigned int cpu)
@@ -97,36 +114,11 @@ static int mperf_measure_stats(unsigned int cpu)
        return 0;
 }
-/*
- * get_average_perf()
- *
- * Returns the average performance (also considers boosted frequencies)
- *
- * Input:
- *   aperf_diff: Difference of the aperf register over a time period
- *   mperf_diff: Difference of the mperf register over the same time period
- *   max_freq:   Maximum frequency (P0)
- *
- * Returns:
- *   Average performance over the time period
- */
-static unsigned long get_average_perf(unsigned long long aperf_diff,
-                                      unsigned long long mperf_diff)
-{
-        unsigned int perf_percent = 0;
-        if (((unsigned long)(-1) / 100) < aperf_diff) {
-                int shift_count = 7;
-                aperf_diff >>= shift_count;
-                mperf_diff >>= shift_count;
-        }
-        perf_percent = (aperf_diff * 100) / mperf_diff;
-        return (max_frequency * perf_percent) / 100;
-}
 static int mperf_get_count_percent(unsigned int id, double *percent,
                                   unsigned int cpu)
 {
        unsigned long long aperf_diff, mperf_diff, tsc_diff;
+        unsigned long long timediff;
        if (!is_valid[cpu])
                return -1;
@@ -136,11 +128,19 @@ static int mperf_get_count_percent(unsigned int id, double *percent,
        mperf_diff = mperf_current_count[cpu] - mperf_previous_count[cpu];
        aperf_diff = aperf_current_count[cpu] - aperf_previous_count[cpu];
-        tsc_diff = tsc_at_measure_end - tsc_at_measure_start;
-        *percent = 100.0 * mperf_diff / tsc_diff;
+        if (max_freq_mode == MAX_FREQ_TSC_REF) {
-        dprint("%s: mperf_diff: %llu, tsc_diff: %llu\n",
+                tsc_diff = tsc_at_measure_end - tsc_at_measure_start;
-               mperf_cstates[id].name, mperf_diff, tsc_diff);
+                *percent = 100.0 * mperf_diff / tsc_diff;
+                dprint("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n",
+                       mperf_cstates[id].name, mperf_diff, tsc_diff);
+        } else if (max_freq_mode == MAX_FREQ_SYSFS) {
+                timediff = timespec_diff_us(time_start, time_end);
+                *percent = 100.0 * mperf_diff / timediff;
+                dprint("%s: MAXFREQ - mperf_diff: %llu, time_diff: %llu\n",
+                       mperf_cstates[id].name, mperf_diff, timediff);
+        } else
+                return -1;
        if (id == Cx)
                *percent = 100.0 - *percent;
@@ -154,7 +154,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent,
 static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
                                unsigned int cpu)
 {
-        unsigned long long aperf_diff, mperf_diff;
+        unsigned long long aperf_diff, mperf_diff, time_diff, tsc_diff;
        if (id != AVG_FREQ)
                return 1;
@@ -165,11 +165,21 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
        mperf_diff = mperf_current_count[cpu] - mperf_previous_count[cpu];
        aperf_diff = aperf_current_count[cpu] - aperf_previous_count[cpu];
-        /* Return MHz for now, might want to return KHz if column width is more
+        if (max_freq_mode == MAX_FREQ_TSC_REF) {
-           generic */
+                /* Calculate max_freq from TSC count */
-        *count = get_average_perf(aperf_diff, mperf_diff) / 1000;
+                tsc_diff = tsc_at_measure_end - tsc_at_measure_start;
-        dprint("%s: %llu\n", mperf_cstates[id].name, *count);
+                time_diff = timespec_diff_us(time_start, time_end);
+                max_frequency = tsc_diff / time_diff;
+        }
+        *count = max_frequency * ((double)aperf_diff / mperf_diff);
+        dprint("%s: Average freq based on %s maximum frequency:\n",
+               mperf_cstates[id].name,
+               (max_freq_mode == MAX_FREQ_TSC_REF) ? "TSC calculated" : "sysfs read");
+        dprint("%max_frequency: %lu", max_frequency);
+        dprint("aperf_diff: %llu\n", aperf_diff);
+        dprint("mperf_diff: %llu\n", mperf_diff);
+        dprint("avg freq:   %llu\n", *count);
        return 0;
 }
@@ -178,6 +188,7 @@ static int mperf_start(void)
        int cpu;
        unsigned long long dbg;
+        clock_gettime(CLOCK_REALTIME, &time_start);
        mperf_get_tsc(&tsc_at_measure_start);
        for (cpu = 0; cpu < cpu_count; cpu++)
@@ -193,32 +204,104 @@ static int mperf_stop(void)
        unsigned long long dbg;
        int cpu;
-        mperf_get_tsc(&tsc_at_measure_end);
        for (cpu = 0; cpu < cpu_count; cpu++)
                mperf_measure_stats(cpu);
+        mperf_get_tsc(&tsc_at_measure_end);
+        clock_gettime(CLOCK_REALTIME, &time_end);
        mperf_get_tsc(&dbg);
        dprint("TSC diff: %llu\n", dbg - tsc_at_measure_end);
        return 0;
 }
-struct cpuidle_monitor mperf_monitor;
+/*
+ * Mperf register is defined to tick at P0 (maximum) frequency
-struct cpuidle_monitor *mperf_register(void)
+ *
+ * Instead of reading out P0 which can be tricky to read out from HW,
+ * we use TSC counter if it reliably ticks at P0/mperf frequency.
+ *
+ * Still try to fall back to:
+ * /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
+ * on older Intel HW without invariant TSC feature.
+ * Or on AMD machines where TSC does not tick at P0 (do not exist yet, but
+ * it's still double checked (MSR_AMD_HWCR)).
+ *
+ * On these machines the user would still get useful mperf
+ * stats when acpi-cpufreq driver is loaded.
+ */
+static int init_maxfreq_mode(void)
 {
+        int ret;
+        unsigned long long hwcr;
        unsigned long min;
-        if (!(cpupower_cpu_info.caps & CPUPOWER_CAP_APERF))
+        if (!cpupower_cpu_info.caps & CPUPOWER_CAP_INV_TSC)
-                return NULL;
+                goto use_sysfs;
-        /* Assume min/max all the same on all cores */
+        if (cpupower_cpu_info.vendor == X86_VENDOR_AMD) {
+                /* MSR_AMD_HWCR tells us whether TSC runs at P0/mperf
+                 * freq.
+                 * A test whether hwcr is accessable/available would be:
+                 * (cpupower_cpu_info.family > 0x10 ||
+                 *   cpupower_cpu_info.family == 0x10 &&
+                 *   cpupower_cpu_info.model >= 0x2))
+                 * This should be the case for all aperf/mperf
+                 * capable AMD machines and is therefore safe to test here.
+                 * Compare with Linus kernel git commit: acf01734b1747b1ec4
+                 */
+                ret = read_msr(0, MSR_AMD_HWCR, &hwcr);
+                /*
+                 * If the MSR read failed, assume a Xen system that did
+                 * not explicitly provide access to it and assume TSC works
+                */
+                if (ret != 0) {
+                        dprint("TSC read 0x%x failed - assume TSC working\n",
+                               MSR_AMD_HWCR);
+                        return 0;
+                } else if (1 & (hwcr >> 24)) {
+                        max_freq_mode = MAX_FREQ_TSC_REF;
+                        return 0;
+                } else { /* Use sysfs max frequency if available */ }
+        } else if (cpupower_cpu_info.vendor == X86_VENDOR_INTEL) {
+                /*
+                 * On Intel we assume mperf (in C0) is ticking at same
+                 * rate than TSC
+                 */
+                max_freq_mode = MAX_FREQ_TSC_REF;
+                return 0;
+        }
+use_sysfs:
        if (cpufreq_get_hardware_limits(0, &min, &max_frequency)) {
                dprint("Cannot retrieve max freq from cpufreq kernel "
                       "subsystem\n");
-                return NULL;
+                return -1;
        }
+        max_freq_mode = MAX_FREQ_SYSFS;
+        return 0;
+}
+/*
+ * This monitor provides:
+ *
+ * 1) Average frequency a CPU resided in
+ *    This always works if the CPU has aperf/mperf capabilities
+ *
+ * 2) C0 and Cx (any sleep state) time a CPU resided in
+ *    Works if mperf timer stops ticking in sleep states which
+ *    seem to be the case on all current HW.
+ * Both is directly retrieved from HW registers and is independent
+ * from kernel statistics.
+ */
+struct cpuidle_monitor mperf_monitor;
+struct cpuidle_monitor *mperf_register(void)
+{
+        if (!(cpupower_cpu_info.caps & CPUPOWER_CAP_APERF))
+                return NULL;
+        if (init_maxfreq_mode())
+                return NULL;
        /* Free this at program termination */
        is_valid = calloc(cpu_count, sizeof(int));